ML20073A662
| ML20073A662 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 04/18/1991 |
| From: | COMMONWEALTH EDISON CO. |
| To: | |
| Shared Package | |
| ML20073A653 | List: |
| References | |
| NUDOCS 9104230296 | |
| Download: ML20073A662 (21) | |
Text
_
ATTACHMENT 3 Revised Technical Specification Pages for Unit 2 (DPR-30)
Page:
1.1/2.1-2a 1.1/2.1-3 1.1/2.1-10 1.1/2.1-11 1.1/2.1-12 3.1/4.1 3.1/4.1-6 3.1/4.1-7 3.1/4.1-7a 3.1/4.1-7b 3.1/4.
10 3.1/4.1-11 3.1/4.1-11a 3.1/4.1-14 3.1/4.1-15 n
9104230296 910418ADOCK 05000265 l
PDR PDR P
.~ -.
QUAD CITIES 4
DPR-30 The definitions used above for the APRM scram trip apply.
In the event of operation with a maximum fraction limiting power density (MFLPD) greater than the fraction of rated power (FRP),
the setting shall be modified as follows:
SA (.58Ho + 50)
FRP MFLPD The definitions used above for the APRM scram trip apply.
The ratto of FRP to MFLPD shall be set equal to 1.0 unless the actual operating value is less than 1.0, in which case the actual operating value will be used.
This adjustment may 41so be performed by-increasing the APRM gain by the inverse ratto, MFLPD/FRP, which accomplishes the same degree of protection as reducing the trip setting by FRP/MFLPD.
C.
Reactor low water level scram setting shall be 144 inches above the top of the active fuel
- at normal operating conditions.
D.. Reactor low water level'ECCS initiation shall be 2 84 inches above the top of the active fuel
- at normal operating conditions.
E.
Turbine stop valve scram shall be 1 10% valve closure from full open.
F.
The scram for turbine control valve fast closure due to actuation of the fast acting solenoid valve shall be 2 460 psig EHC fluid pressure.
)
I 0499]
.l.1/2.1-2a.
Amendment No.
,,.v
-.. _ _. -. _ _ _ _.. _ _ _. -. -..~ _ _..
i QUAD CITIES i
DPR-30 G.
Main steamline isolation valve closure scram shall be I 10%
valve closure from full open.
- Top of active fuel is defined to l
be 360 inches above vessel zero (See Bases 3.2).
H.
Main steamline. low-pressure ini-tiation of main steamline isolation valve closure shall be 1 825 psig.
I.
Turbine EHC control fluid Iow-pressure scram on loss of control
~
oil pressure shall be set at greater than or equal to 900.psig.
k J.
Condenser low vacuum scram shall be set at 2 21 inches Hg vacuum.
f e
4 i
t 0499J.
I '.1/ 2.1 -3 Amendment No.
'na e -v
.w-~mee'--
e -c re
,.v.-,esa g e a-as--,--ee-o 5.m,+d i.,w--v.
m-
+--A+-,,
.+'ne'ei-++ws ea6-e e r o.-t
- -*Ftr y-M wr"'tV+-'f*
W'T' T
V'Tw'W T4-tr
w-VU*-t F'
-T 4 f sw-.,w-.+..ww-e-.
=.
'~
QUAD CITIES DPR-30 The trip setpoint of 2 460 psig EHC fluid pressure was developed to ensure q
that the pressure switch is actuated prior to the closure of the turbine control valves (at approximately 400 psig EHC fluid pressure) yet assure that the system is not actuated unnecessarily due to EHC system pressure transients which may cause EHC system pressure to momentarily decrease.
G.
Reactor Coolant Low Pressure Initiates Main Steam Isolation Valve Closure The low-pressure isolation at 825 psig was provided to give protection against fast reactor depressurization and the resulting rapid cooldown of the vessel. Advantage was taken of the scram feature which occurs in the Run mode when the main steamline isolation valves are closed to provide for reactor shutdown so that operation at pressures lower than those specified in the thermal hydraulic safety limit does not occur, although operation at a pressure lower than 825 psig would not necessarily constitute an unsafe condition.
H.
Main Steamline Isolation Valve Closure Scram The low-pressure isolation of the main steam 1thes at 825 psig was provided to give protection against rapid reactor depressurization and the resulting rapid cooldown of the vessel.
Advantage was taken of the scram feature in the Run mode which occurs when the main steamilne isolation valves are closed to provide for reactor shutdown so that high power operation at low reactor pressures does not occur, thus providing protection for the fuel cladding integrity safety limit. Operation of the reactor at pressures lower than 825 pstg requires that the reactor mode switch be in the Startup position, where protection of the fuel cladding integrity safety limit is provided by the IRH and APRM high neutron flux scrams.
Thus, the combination of main steamline low-pressure isolation and isolation valve closure scram in the Run mode assures the availability of neutron flux-scram protection over the entire range of applicability of the fuel cladding integrity safety limit.
In addition, the isolation valve closure scram in the Run mode anticipates the pressure and flux transients which occur during normal or inadvertent isolation valve closure.
Htth the scrams set at 10% valve closure in the Run mode, there is no increase in neutron flux, l
0499J 1.1/2.1-10 Amendment No.
1 QUAD CITIES DPR-30 I.
Turbine EHC Control Fluid Low-Pressure Scram The turbine EHC control system operates using high-pressure oil.
There are several points in this oil system where a loss of oil pressure could result in a fast closure of the turbine control valves.
This fast closure of the turbine control valves is not protected by the turbins control valve fast closure scram, since failure of the oil system would not result in the fast closure solenoid valves being actuated.
For a turbine control valve fast closure, the core would be protected by the APRM and high-reactor pressure scrams. However, to provide the same margins as provided for the generator load rejection on fast closure of the turbine control valves, a scram has been added to the reactor protection system which senses failure of control oil pressure to the turbine control system.
This is an anticipatory scram and results in reactor shutdown before any significant increase in neutron flux occurs.
The transient response is very similar to that resulting from the turbine control valve fast closure scram.
The scram setpoint of 900 psig is set high enough to provide the necessary anticipatory function and low enough to minimize the number of spurious scrams.
Normal operating pressure for this system is 1250 psig.
Finally, the control valves w111 not start until the fluid pressure is 600 psig.
Therefore, the scram occurs well before valve closure begins.
J.
Condenser low Vacuum Scram Loss of condenser vacuum occurs when the condenser can no longer handle the heat input.
Loss of condenser vacuum initiates a closure of the turbine stop valves and turbine bypass valves which eliminates the heat input to the condenser.
Closure of the turbine stop and bypass valves causesapressuretransient,neutronfluxriseandanincreaseinsurface]
heat flux.
To prevent the cladding safety limit from being exceeded if this occurs, a reactor scram occurs on turbine stop valve closure in the Run mod:-
The turbine stok '/alve closure scram function alone is adequate to prevent the cladding safety limit from being exceeded in the event of a turbine trip transion with bypass closure.
The condenser low vacuum scram is anticipatory to the stop valve closure scram and causes a scram before the stop valves arr closed and thus the resulting transient is less severe.
Scram cctur.1 in the Run mode at 21-inch Hg vacuum, stop valve closure occurs at 20-toch Hg vacuum, and bypass closure at 7-inch Hg vacuum.
0499J 1.1/2.1-11 Amendment No.
QUAD CITIES DPR-30 References 1.
" Generic Reload Fuel Application." NEDE-24011-P-A.*l
- Approved revision number at time reload p;ialyses are performed. l 2.
" Qualification of the One-Dimensional Core Transient Hodel for Bolling Water Reactors", General Electric Co. Licensing Topical Report NED0 24154 Vols. I l
and II and NEDE-24154 Volume III as supplemented by letter dated September 5, 1980 from R.H. Buchholz (GE) to P.S. Check (NRC).
i 0499J 1.1/2.1-12 Amendment No.
l
QUAD-CITIES DPR-30 4.1 SURVEILLANCE REQUIREMENTS BASES A.
The minimum functional testing frequency used in this specification is based on a reliability analysis using the concepts developed in Reference 1.
This concept was specifically adapted to the one-out-of-two taken twice logir of the reactor protection system.
The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal.
Failures such as blown fuses, ruptured bourdon tubes, faulted ampilfters, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram.
The channels listed in Tables 4.1-1 and 4.1-2 are divided into three groups respecting functional testing.
These are:
1.
On-off sensors that provide a scram trip function (Group 1);
I i
2.
Analog devices coupled with bistable trips that provide a scram l
function (Group 2);
and 3.
Devices which serve a useful function only during some restricted 1 mode of operation, such as Startup/ Hot Standby, Refuel, or Shutdown, or for which the only practical test is one that can be performed at shutdown (Group 3).
The sensors that make up Group 1 are specifically selected from among the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. Actual history on this class of sensors operating in nuclear power plants shows four failures in 472 sensor years, or-a failure rate of 0.97 X 10-6 hr. During
/
design, a goal of 0.99999 probability of success (at the 507 confidence level) was adopted to assure that a balanced and adequate design is achieved.
The probability of success is primarily a function of the i
sensor failure rate and the test interval.
A 3-month test interval was planned for Group 1 sensors.
This is in keeping with good operating practice and satisfies the design goal for the logic configuration utilized in the reactor protection system.
0500J 3.1/4.1-5 Amendment No.
1
l QUAD-CITIES l
DPR-30 To satisfy th? long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95%
confidence level is proposed.
Hith the one-out-of-two taken twice logic, this requires that each sensor have an availability of 0.993 at the 95%
confidence level.
This level d availability may be maintained by adjusting the test interval as a function of the observed failure history (Reference 1).
To facilitate the implementation of this technique, Figure 4.1-1 is provided to indicate an appropriate trend in test interval.
The procedure is as follows:
1.
Like sensors are pooled into one group for the purpose of data acquisition.
2.
The factor H is the exposure hours and is equal to the number of sensors in a group, n, times the elapsed time T(H=nT).
3.
The accumulated number of unsafe failures is plotted as an ordinate against M as an abscissa on Figure 4.1-1.
4.
After a trend is established, the appropriate monthly test interval to satisfy the goal will be the test interval to the left of the plotted points.
5.
A test interval of 1 month will be used initially until a trend is established.
The turbine control valve fast acting solenoid valve pressure switches directly measure the trip oil pressure that causes the turbine control valves to close in a rapid manner.
The reactor scram setpoint was developed in accordance with NEDC 31336 " General Electric Instrument Setpoint Hethodology" dated October, 1986. As part of the calculation, a calibration period is inputted to achieve a nominal trip point and an allowable setpoint (Technical Specification value).
The nominal setpoint is procedurally controlled.
Based on the calculation input, the calibration per'iod is defined to be every Refueling Outage.
Group 2 devices utilize an analog sensor followed by an amplifier and a bistable trip circuit.
The sensor and ampitfier are active components, and a failure is almost always accompanied by an alarm and an indication of the source of trouble.
In the event of failure, repair or substitution can start immediately.
An "as-is" failure is one that " sticks" midscale and is not capable of going either up or down in response to an out-of-limits input.
This type of failure for analog devices is a rare occurrence and is detectable by an operator who observes that one signal does not track the other three.
Fo purposes of l
analysis, it is assumed that this rare failure will be detected within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
0500J 3.1/4.1-6 Amendment No.
_ = -.
_.---= -
QUAD-CITIES DPR-30 The bistable trip circuit which is a part of the Group 2 devices can sustain unsafe failures which are revealed only on test.
Therefore, it is necessary to test them periodically.
A study was conducted of the instrumentation channtis included in the Group 2 devices to calculate their ' unsafe' failure rates.
The analog devices (sensors and ampitfiers) are predicted to have an unsafe failure rate of l
less than 20 X 10-6 failures / hour.
The bistable trip circult; are predicted to have an unsafe failure rate of less than 2 X 10-0 I
failures / hour.
Considering the 2-hour monitoring interval for the analog devices as assumed above and a weekly test interval for the bistable trip circuits, the design reliability goal of 0.99999 is attained with ample l
margin.
The bistable devices are monitored during plant operation to record their failure history and establish a test interval using the curve of Figure.
4.1-1.
There are numerous identical btstable devices used throughout the plant instrumentation system.
Therefore, significant data on the failure rates for the bistable ievices should be accumulated rapidly.
The frequency of calibration of the APRM flow blasing network has been established at euch refueling outage.
The flow blasing network is functionally tested at least once per month and, in addition, cross calibration checks of the flow input to the flow-blasing network can be made I during the functional test by direct meter reading (IEEE 279 Standard for Nuclear Fower Plant Protection Systems, Section 4.9, September 13, 1966).
There are several instrdments which must be calibrated, and it will take several days to perform the calibration of the entire network. While the calibration is being performed, a zero flow signal will be sent to half of the APRMs, resulting in a half scram and rod block condition.
Thus, if the l
calibration were performed during operation, flux shaping would not be possible.
Based on experience at other generating stations, drift of instrument such as those in the flow blasing network is not significant; therefore, to avoid spurious scrams, a calibration frequency of each refueling outage is established, Reactor low water level instruments' 2-263-57A, 2-263-578, 2-263-58A, and e
2-263-58B have been modified to be an analog trip system.
The analog trip system consists of an analog sensor (transmitter) and a master / slave trip unit setup which ultimately drives a trip relay.
The frequency of calibration and functional testing for instrument loops of the analog trip system, including reactor low water level, has been established in Licensing Topical Report NED0-21617-A (December 1978).
With the one-out-of-two-taken-twice logic, NEDO-21617-A states that each trip unit'be subjected to a calibration / functional test frequency of one month.
An adequate calibration / surveillance test interval for the. transmitter is once per operating cycle.
0500J 3.1/4.1-7 Amendment.No.
i e
,w,
-w-,-
1
,,.h-r....y-
,,-e.
,E.
DPR-30 Group 3 devices are active only during a given portion of the operational cycle.
For example, the IRH is active during startup and inactive during full-power operation.
Thus, the only test that is meaningful is the one performed just prior to shutdown or startup, i.e., the tests that are performed just prior to use of the instrument.
Calibration frequency of the instrument channel is divided into two groups.
These are as follows:
1.
Passive type indicating devices that can be compared with like units on a continuous basis, and 2.
Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.
Experience with passive type instruments in Commonwealth Edison generating stations and substations indicate that the specified calibrations are adequate.
For those devices which employ ampitfiers, etc., drift specifications call for drift to be less than 0.4%/ month, i.e.,
in the period of a month a drift of 0.4% would occur, thus providing for adequate margin.
The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate.
Changes in power distribution and electronic drift also require compensation.
This compensation is accomplished by calibrating the APRM system every 7 dayt using heat balance data and by calibrating individual LPRMs at least every 1000 equivalent full-power hours using TIP traverse data. Calibration on this frequency assures plant operation at or below thermal limits.
A comparison of Tables 4.1-1 and 4.1-2 indicates that some instrument channels have not been included in the latter table.
These are mode switch in shutdown, manual scram, high water level in scram discharge volume, main steamline isolation valve closure, and turbine stop valve closure.. All of l
the devices or sensors associated with these scram functions are simple on-off switches, hence calibration is not applicable..i.e., the switch is either on or off.
Further, these switches are mounted solidly to the device and have a very. low probability of moving; e.g., the thermal switches in the scram discharge volume tank.
Based on the above, no calibration is required for these instrument channels.
B.
The HFLPD shall be checked once per day to determine if the APRM scram requires adjustment.
This may normally be done by checking the LPRM readings, TIP traces, or process computer calculations. Only a small number i
of control rods are moved daily, thus the peaking factors are not expected to change significantly and a daily check of the HFLPD is adequate.
0500J 3.1/4.1-7a Amendment No..
i
QUAD-CITIES DPR-30 References 1.
I. M. Jacobs
" Reliability of Engineered Safety Features as a function of Testing Frequency," huclear Safety, Vol. 9. No. 4, pp. 310-312, July-August, 1968.
i 2.
Licensing Topical Report NED0-21617-A (December 1978).
3.
NEDC 31336 " General Electric Instrument Setpoint Methodology" dated October, 1986, i
\\
1 i
1 9
i a
i i
i i
.i 0500]
3.1/4.1-7b
-Amendment No.-
i
QUAD-CITIES DPR-30 TABLE 3.1-3 REACTOR PROTECTION SYSTEH (SCRAM) INSTRUMENTATION REQUIREMENTS RUN HODE Minimum Number of Operable or Tripped Instrument Channels per Trio Systemill Trio Function Trio Level Settina Action (2) 1 Mode switch in shutdown A
1 Hanual scram A
I APRM(3) 2 High Flux (flow biased)
Specification 2.1.A.I A or B 2
Inoperative A or B 2
Downscale (11]
2 3/125 of full scale A or B 2
High-reactor pressure 1 1060 psig A
2 High drywell pressure 1 2.5 psig A
2 Rea: tor low water level 2 8 inches [8]
A 2 (per bank) High-water level in scram discharge volume 1 40 gallons per bank A
2 Turbine condenser low 1 21 inches Hg vacuum A or C vacuum 2
Main Steamline high 1 15 X normal full A or C radiation (123 power background (without hydrogen addition) 4 Main steamline isolation 1 10% valve closure A or C valve closure (63~
2 Turbine control valve fast 1 460 psig (10]
A or C closure, valve -trip system oil pressure low-[9]
2 Turbine stop valve 1 10% valve closure A or C closure (9)-
2 Turbine EHC control fluid 2 900 psig-A or C low pressure (9)-
0500J 3.1/4.1-10 Amendment No.
c
--,m
-v,,n
~+,
-v
,~
r-e
,r,--n s..-e r w g
.vg
.n.-
r
(
QUAD-CITIES DPR-30 TABLE 3.1-4 NOTES FOR TABLES 3.1-1, 3.1-2, AND 3.1-3 (1)
There shall be two operable trip systems or one operable and one tripped system for each function.
[2]
If the first column cannot be met for one of the trip systems, that trip system shall be tripped.
If the first column cannot be met for both trip systems, the appropriate actions Itsted below shall be taken:
A.
Initiate insertion of operable rods and complete insertion of all operable rods within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
B.
Reduce power level to IRM range and place mode switch in the Startup/ Hot Standby position within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
C.
Reduce turbine load and close main steamline isolation valves within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
[3]
An APRM will be considered inoperable if there are fewer than 2 LPRM inputs per level or there are less than 50% of the normal complement of LPRM's to h
an APRM.
[4]
Permissible to bypass, with control rod block fer reactor protection system reset in refuel and shutdown positions of the.eactor mode switch.
[5]
Not required to be operable when primary containment integrity is not required.
[6]
The design permits closure of any one line without a scram being initiated.
[7]
Automatically bypassed when reactor presrure is < 1060 psig.
[8]
The +8-inch trip point is the water level n measured by the instrumentation outside the shroud.
The water level inside the shroud will decrease as power is increased to 100% in comparison to the level outside the shroud to a maximum of 7 inches.
This is due to the pressure drop across the steam dryer.
Therefore, at 100% power, an indication of +8-inch water level will actually be +1 inch inside the shroud.
1 inch on the water level instrumentation is 2. 504" above vessel zero.
(See Bases 3.2).
[9]
Permissible to bypass when first stage turbine pressure is less than that which corresponds to 45% rated steam flow. (< 400 psi)
[10)
Trip is indicative of turbine control valve fast closure (due to low EHC fluid pressure) as a result of fast acting valve actuation.
05003 3.1/4.1-11 Amendment No.
l
QUAD-CITIES DPR-30 TABLE 3.1-4 NOTES FOR TABLES 3.1-1, 3.1-2, AND 3.1-3 (11)
The APRH downscale trip function is automatically bypassed when the IRH instrumentation is operable and not high.
[12]
Channel shared by the reactor protection and containment isolation system.
i 0500]
3.1/4.1-11a Amendment No.
QUAD-CITIES DPR-30 TABLE 4.1-2 SCRAM INSTRUMENT CALIBRATION HINIMUM CALIBRATION FREQUENCIES FOR REACTOR PROTECTION INSTRUMENT CHANNELS Instrument Channel Group [l3 Calibration Standard [5]
tilfLmum Frecuenev[23 High flux IRM C
Comparison to APRM after Every controlled heit balance shutdown [4]
i High flux APRM Output signal B
Heat balance Once every 7 days Flow bias B
Standard pressure and Refueling outage voltage source
]
LPRM B(6)
Using TIP system.
Every 1000 equivalent-j full power hours l
High reactor pressure A
Standard pressure source Every 3 months l
High drywell pressure A
Standard pressure source Every 3 months t
Reactor low water level 3
, ater level
[7]
W
}
Turbine condenser low vacuum A
Standard vacuum source
-Every 3 months i
j Main steamline high radiation B Appropriate radiation Refueling outage source [3]
I Turbine EHC control fluid A
Pressure source Every 3 months l_
low pressure l
Turbine control valve A
Pressure source
-Refueling outage i
fast closure Highwater level in scram A
Hater level Refueling outage l
discharge volume (dp only)
I Notes:
l
[1].A description of the three groups is included in the bases of this l
specification.
[2] Calibration tests are not required when the systems are not required to be i
operable or are tripped.
If tests are missed, they shall be performed prior to returning the systems to an operable status.
l
[3] A current source provides an instrument channel alignment every 3 months..
l
}-
i-0500J 3.1/4.1-14
-Amendment No.
4 h
y
,.__.,,__.,,,m.r,-..,,,
.m.,
-...,,,,..m.,,.,,,,,.c__.,,,,...._,,..~,.m,,,.,...
_,,m.,
QUAD-CITIES DPR-30 TABLE 4.1-2 SCRAM INSTRUMENT CALIBRATION MINIMUM CALIBRATION FREQUENCIES FOR REACTOR PROTECTION INSTRUMENT CHANNELS
[4] Maximum calibration frequency need not exceed once per week.
[5] Response time is not part of the routine instrument check and calibration but will be checked every refueling outage.
[6] Does not provide scram function.
[7] Trip units are calibrated monthly concurrently with functional testing.
Transmitters are calibrated once per operating cycle.
4 G
S 4
~
4 ATTACHMENT 4 EVALUa110tL0EELSIGNIEICAELHAZARDS As described in the Description and Bases for the Amendment Request, the proposed change involves the requirements for the use of a pressure switch, which initiates a reactor scram, in the fast acting solenoid valves.
The actuation of the fast acting solenoid valves (due to a load reject signal) causes the turbine control valves to close rapidly due to decreasing EHC fluid pressure.
Commonwealth Edision has reviewed the proposed amendment in accordance with the criteria delineated in 10 CFR 50.91 and has concluded that the proposed amendment does not present a Significant Hazards Consideration.
The basis for this determination is as follows:
1.
The proposed change does not involve a significant increase-in the probability or consequences of an accident.
The turbine control valve fast closure scram is provided to anticipate the rapid increase in pressure and neutron flux resulting from the-fast closure of the turbine control valves due to a-load reject and subsequent failure of the bypass valves (UFSAR section 14.1.2, 3.2.5.4).
The turbine control valves are required to fast close as rapidly as possible to prevent overspeed of the turbine-generator rotor.
The rapid closure of the control i
valves causes a sudden reduction of the steam flow which results in an increase to reactor pressure. The scram is provided to prevent the violation of the minimum critical power ratio (MCPR) safety limit.
The use of a pressure switch (in lieu of the limit. switch) does not involve a significant increase in the probability of the transient.
Upon actuation of the fast acting solenold, the new pressure switch will sense the decreasing electro-hydraulic control (EHC) fluid (indicative of the control valve closure) and provide a reactor scram.
The use of the_ pressure switch, therefore, provides the same function.as the limit switch.
In addition,-the logic'for the RPS trip remains the same.
The pressure switches on fast acting solenoid valves for control valves #1 and #2 input to.the Reactor Protection System (RPS) Channel-A.
Either pressure switch will cause-.the RPS channel to trip.
Similarly, the pressure switches on the fast acting solenoid valves for control valves #3 and #4 input into Reactor Protection System' Channel.B.
In order to achieve a full reactor scram, both RPS channels must bt. tripped.
The use of the-pressure switch does not affect the limiting parameter (MCPR) of the transient.
As such, there would be no sequence of events which would lead to the safety limit beingl exceeded and: barrier integrity would'be assured. Additionally, the proposed change would'not change, degrade or prevent the responses of systems assumed in the accident (s) nor alter any assumptions'previously made in evaluating the' radiological consequences of:an accident described (above) in_the SAR.
ATTACHMENT 4 (CONTINUED)
The consequences of the turbine / generator load reject with the subsequent failure of the bypass valves are not significantly increased by this change.
The pressure switch provides a scram signal to RPS when the turbine control valves close rapidly in the same tit.a period as the position switch in place.
The use of a pressure switch to input into the Reactor Protection System is widely used throughout the industry and has been shown to be reliable.
The results of the accident (the lowest MCPR achieved) are, therefore, not significantly affected and are bounded by the existing analysis.
The existing analysis concludes that under this transient, the site boundary doses are well within the 10 CFR 100 limits.
2.
The proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.
The significant difference between the existing valve design and the proposed design is the use of a pressure switch in lieu of a limit switch.
The use of the pressure switch eliminates the failure mode associated with the limit switch and inherently introduces its own failure mode.
The failure of the tubing which connects the pressure switch to the solenoid valve would initiate a scram signal.
The use of the pressure switch to input into the Reactor Protection System is widely used throughout the industry and has been shown to be reliable.
Based on industry experience, the new design of the fast acting solenoid valve has been more reliable in actuating the fast closure of control valves than the use of the existing design.
The logic for the RPS trip remains unchanged.
In order to create a reactor scram, the logic is arranged such that actuation of the pressure switches for the fast acting solenoid valves on control valve #1 or #2 and #3 or #4 will initiate a reactor scram.
Therefore, in order for the scram function to fail, two pressure switches would have to fall within the same RPS channel (which is the same RPS failure mode as the existing design).
The fast closure of the turbine control valves is considered to be an anticipatory reactor scram.
The reactor pressure and neutron flux would increase significantly in the ovent of the turbine fast closure without a scram; however, the reactor pressure (1060 psig) or the high neutron flux scrams provide backup to the turbine fast closure scram, in the event that sensor falls to actuate RPS.
The existence of the new failure mode, therefore, does not introduce the possibility of a new or different kind of accident than previously evaluated.
3.
The proposed change does not involve a significant reduction in the margin of safety.
The limiting event associated with the turbine col. trol valve fast closure is the load reject with failure of the bypass valves.
A reactor scram is initiated, when the turbine control valves fast close, to anticipate the increase in reactor pressure and neutron flux, thereby ensuring that the MCPR safety limit is not violated.
The use of the pressure switch does not affect the margin of safety associated with the MCPR safety limit since the pressure switch will initiate the reactor scram within the same time period as the existing design.
The trip setpoint was calculated to ensure that a reactor scram will be initiated when the turbine control valves start to close rapidly, l
o ATTACHMENT 4 (CONTINUED)
The proposed fast acting solenoid valves are designed such that the pressure switch will be actuated within 30 milliseconds of the time the control valves start to close.
Also, current Technical Specifications require that the RPS trip actuator contacts be actuated within 50 milliseconds of the actuation of the pressure switch.
These times are consistent with the design values used in the Reload Licensing calculation to analyze the load reject without bypass valve transient.
The trip setpoint was calculated such that the trip signal will be generated within the 30 milliseconds after the start of the control valve fast closure. Verification of the 30 millisecond actuation will be conducted during post modification testing.
This modification, therefore, does not involve a significant reduction in the margin of safety.
I l
o ATTACHMENT 5 DPIMII0tLOE TRLELECIRG_-HYDMULIC_COMIROL1EHCLSYSIEM The following provides a brief synopsis of the operation of the EHC system as it relates to the control valves and the load reject signal to assist in the review of the proposed amendment.
I.
Electro-Hydraulic Control.(EHC) Pressure Control and Logic System The purpose of the EHC pressure control and logic system is to position the turbine control valves, intercept valves and bypass valves in order to achieve the turbine speed or load which is consistent with the ability of the reactor to supply adequate steam.
The system also controls and maintains reactor pressure during plant start-up, heat-up and cooldown.
The logic system consists of five (5) subsystems which includes the pressure control unit, bypass control unit, load control unit, speed and acceleration control unit and the valve flow control unit.
The purpose of the load control unit is to develop a steam flow signal which represents the desired load to be placed on the turbine.
The load control unit of the EHC pressure control and logic system will develop a power / load unbalance (load reject) signal in the event the first stage turbine pressure and stator winding ampere ratio exceeds 407..
The load unbalance signal actuates relays which send a signal to the turbine fast acting solenoid valves.
The fast acting solenoid valves energize which causes the fast closure of the turbine control valves by decreasing the EHC fluid pressure.
II. Electro-Hydraulic Control (EHC) Hydraulic System The pupose of the EHC hydraulic system is to supply cooled, filtered, high pressure fluid for the control of the turbine valves.
The turbine control valve hydraulic positioning unit contains two ports which are supplied by high-pressure hydraulic fluid.
The Fluid Jet Supply (FJS) enters one of the ports of the positioning unit (pressure rated at 1600 psig) and is directed to a servo-valve.
The purpose of the-servo-valve is to convert low level input signals from the EHC pressure.
control logic into high level hydraulic outputs which are.used to position the valves.
The second hydraulic fluid ~ supply is the Fluid Actuator Supply Trip Control (FASTC) fluid which is also rated at 1600 psig. The FASTC fluid enters.the positioning unit and is directed to the servo-valve and the. fast acting solenold valve.
The FASTC fluid is transmitted through the fast acting solenoid valve to the disk dump valve.
The purpose of the disk dump valve is to seal the end of the hydraulic positioning cyclinder-so that the servo-valve (with the aid of.the.FJS fluid pressure) can be' positioned to direct FASTC-into the single acting actuator cyclinder of'the turbine control valve.
The-turbine control-valve uses the FASTC pressure to open against a closing spring and steam pressure.
The disk dump valve, which normally remains closed by the FASTC pressure, will open to release actuator positioning'cyclinder pressure, in the event the fast acting solenoid valves are energi. zed.
.__-. ~ _._.._ _.__._.. _._._. _ _
)
ATTACHMENT 5 (CONTINUED)
III. Operation During The Turbine / Generator Load Mismatch When the load control unit of the EHC logic system senses the turbine / generator load mismatch, the logic system sends a signal to the fast acting solenoid valve to reposition, When the fast acting solenoids l
reposition, the following occurs:
a.
The FASTC fluid begins to drain as a result of the repositioned fast acting solenoid valve.
The pressure, which holds the disk dump valve seated, begins to decrease.
b.
The fast acting solenoid pressure switch' senses decreasing fluid pressure and at a pressure equal to or greater than 460 psig initiates a scram signal to the Reactor Protection System.
Y Under the existing design, a position switch on the fast acting solenoid valve senses that the fast acting solenoid valve has repositioned and initiates la scram signal to the Reactor Protection System.
c.
When the EHC fluid pressure reaches approximately 400 psig,
- the disk dump valve is forced away from its seat and the FASTC fluid in the hydraulic cylinder is rapidly drained, d.
The control valve closes rapidly, i
1 A
F w
1 y
,-9nr--,-
r t*'-v-ev "w-f--*
'"+-erW-"*-v*
M?Y**
87
'*"***Tde
- -wr'me"--+e'--*ev-a e e-
- Ntr
+
w-e*'
-"-Te--*
'=-*--***-e4*
- * * *- '-=-*
o EDE-40 1190 DRF C71 00086 November 16, 1990 EN C LO S UR.E 1-I Setpoint Calculation for Reactor Protection System Turbine Control Valve Fast Closure Trip Function Prepared for Comonwealth Edison Company Quad Cities Nuclear Station
/
Prepared by: //M E Jiu s
'Date: #I4/fd W. K. Green - Principal ~ Engineer
~
Verified by:
// /,
=
Date:
//-/4 to
@ L. Leop - Sonict Engineer Approved by: C # M N Date:
//-/4 - 9M VB. F. lleischman - Manager Reactor Protection systems Application Engineering (p" v.L
l*
1.0 Objectives l
The objective of this calculation is to datamine the setpoint to be used l
for the Reactor Protection System (RPS) Turbine control Valve Fast Closure These p)ressure switches are Part Number 184C4815P001. This i (TCVFC Trip Function after the installation of new pressure switches.
i was obtaineid via telecon with Rob Korneta of Commonwealth Edison on November 6, 1990.
The new pressure switches are beity installed as part of turbine vendor The signals from th(GE) recommended modifications to tlte turbine system.
ese switches will replace the signals that origins.ily 4
came from contacts on the turbine system fast acting solenoids.
2.0 Methodology pThis setpoint calculation is being perfomed consistent with GE document NEDC 31336. " General Electric Instrument Setpint Methodology," dated October 1986.
This is a proprietary document that was deve oped ur. der contract between GE and certain members c/ the Licenstna Review Group Instrument Setpoint Methodology owners Group.
3.0. Assumptions This calculation makes the folloting assumptions.
The individual error terr,s represent a two signa value (98 percent probability of the valu9 being correct).
Primary Element Accuracy (beca)use of the short instrument l PEA and Process Neasurement Accuracy PMA are considered negitgible because the pressum switches are measuring the process directly.
The Calibration Accuracy tem (C) is conservatively estimated to be one percent (17,) of full range.
$1nce this value is a function of the instrumentation and procedures used for calibration this value must be verified to be conservative by Quad Cities perso,nnel.
If it i
1 is found to be non-conservative the results of this report must be recalculated to reflect the larger value.
Instrument Drift Accuracy (A) since(0)here is no value given for drift on drawi t
184C4815.
This is consistent with NEDC-31336. Drift is assumed to be random for the subsequent intervals.
The probability for avoiding a License Event Report (LER) event should be greater than 90 percent.
This is consistent with-NEDC-31336.
l The probability for Spurious Trip' Avoidance (STA) should be greater than 96 percent. This is consistent with NEDC 31336.
k
.{.
1
.i
4.0 Inputs to Calculation The pressure switches to which this calculation applies are measuring directly.the trip oil pressure that causes the turbine control valves to close in a rapid manner. - According to information in Design Record File (ORF)C7100017 this oil pressure 's normally about 1500 to 1600 ;21g, and the control valve can't start to close until the pressure drops to 400.
psig.
Durity nomal operation of the control valves it is considered possible to have transients that would cause the trip systes pressure to drop somentarily ta about 740 psig. On the basis of this information the following valum, am derivedt AnalyticalLimit(AL)=400psig The pressure switch must trip by the time the oil pressure reaches this leval in order to ensure that a trip si nal will be generated within 30 milliseconds after start of cent i valve fast closure.
OperationalLimit(0L)=740psig The Nominal Trip 3etpoint must be far enough from this value so as to mininiae the probability o1 tripping during normal operational transients.
S Drawing 184C4815 indicates that the accuracy of this pressure switch is twopercent(
of full r a.
Since the full range of part one (P001) is 3000 psig, e accuracy is then t60 psig. Inis valus is assumed to apply over the full range o o)perating temperatures since no information regarding temperature effect on accuracy is given.
A summary of the inputs to be used in the calculations is as follows:
InstrumentAccuracy(A)=160psig CalibrationAccuracy(C)=230psig Instrument Drift (D)- = t60 psig (assume 6 mo.) = 1104 psig (18 me.)
Analytical Lindt (AL) = 400 psig W'
OperationalLimit-(0L)=740'ps'ig 9
h D
1-i
...---.-_---.---___-----..c_
_.. _ _ ~ -
i 5.0 Results The following are the results based on the methodology, assumptions, and t
inputs as given in sections 2.0, 3.0, and 4.0 respectively:
Calculated Recossended Parameter Value Value Allowable Value (AV) 466 psig 460 psig or Tech. Spec.Value(TSV)
NominalTripSetpoint(NTSP) 640 psig 550 psig Probability for License 92%
N/A Event Report (LER) Avoidance (Using recoassended values)
Probability of S uriou 995 N/A TripAvoidance(TA)
(Usingrecommenddvalues)
The NTSP now needs to be adjusted for the practicalities of plant calibration procedures.
The Required Limit the NTSP must not be found in order to assure (RL) is the value below w that the AV is-not exceeded.
The RL is a function of accuracy (A) and calibration accuracy (C) as follows:
2 2
RL = AV + (A + C )1/2 Information received on 11 Edison indicates that the /4/90 from Erryl Mendenhall of Commonwealth calibration for this setpoint is accomplished using a Heise pressure gkuge measuring 0 to 1000 psig with an accuracy of 1 psi.
If one assumes an equal error when calibrating the Heise gauge and another 1 psi error when reading it, the total error is then:
2
+ 1 )l/2, (3)1/2 = 1.732 psi CT=(1
+1 Us6 C = 2 psi T
ThenRL=460+(602+2)1/2 - 52TJ psig 2
However, this value-is less than' the value required for go arcant probability of LER aw idance.
Therefore, use 540 psig as t1e RL.
In order to obtain an STA probability of 95 percent or greater the NTSP should never exceed 638 psig.
between RL (540 psig) and 638 psig.Therefore, sslect the NTSP *.o be midway HTSP=540+(638-540)/2=589psig Use NTSP = 590 nuic with As-Left and Leeve Alone Iclarances of $20 psi..
__.m__
DUMP PtPE ASSEMBLY FCD A
y,,,,T,,,,,,,,,,,,,
OtSK DUMP VALVE HOUSING
.,,,,,,,,,_-g,,,,,,,
isssssssssssssssO///////////////// M
\\
3 a
<wem b
ACTUATOR PISTON k
DESK DUMP VALVE HYDRAULIC CVLtNDER h h SERVO VALVE
\\\\\\\\\\\\
\\\\\\\\\\M SOL E NORD OPE R AT E D s
FAST ACTING VALVE l
\\
(SHOWN DE ENERGlZED)
LEGEND l
1600 PSI F.A S T.C. FLUID TRtP CONTROLLED
(
0-50 PStk F C D FLUID DRAIN TO COOLER F.J S F A S.T C 3600 PSI k F J S FL01D JET SUPPLY Figure 3. Steam Control Valves Nos.1 through 4, and intercept Valves Nos.1,3. and 5 (Fluid Flow Diagram) lL
- _ _ _ _