ML20080B271
| ML20080B271 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 08/02/1983 |
| From: | COMMONWEALTH EDISON CO. |
| To: | |
| Shared Package | |
| ML20080B270 | List: |
| References | |
| REF-GTECI-A-44, REF-GTECI-EL, TASK-1.G.1, TASK-A-44, TASK-OR, TASK-TM PROC-830802, NUDOCS 8308050393 | |
| Download: ML20080B271 (78) | |
Text
. _ - _ _ - - _ _ - - _ _ _ _ - _ _ _ _ _ _ _ _ _ __ .. _ _ _ _ _ _ _ _ _ _ _ _ _ _
(
l LA SALLE COUNTY STATION STATION BLACKOUT TEST
( OBJECTIVES AND OUTLINE l
l l
I COMMONWEALTH EDISON COMPANY
{
8308050393 830802 PDR ADOCK 05000373
( _ _ . - _ _ _ _ . _ - _ _ _
LSCS TABLE OF CONTENTS PAGE BACKGROUND AND CONCLUSIONS 1
1.0 INTRODUCTION
5 1.1 HISTORY OF STATION BLACKOUT ISSUE 6 1.2 NRC OBJECTIVES FOR STATION BLACKOUT TEST 10 1.3 ACHIEVEMENT OF NRC OBJECTIVE AT LA SALLE COUNTY STATION 11 1.3.1 Operator Familiarization and Training 11 1.3.2 Verification of Predicted Plant Response 12 1.3.3 Plant Limitations and Capabilities 13 1.3.4 Summary 13 2.0 EVALUATION OF LA SALLE COUNTY STATION RESPONSE TO STATION BLACKOUT 15 2.1 DISCUSSION OF ASSUMPTIONS 15 2.1.1 Operational Cases 15 2.1.2 Boundary Conditions for SBO Analysis at 100%
Power 20 2.1.3 Equipment Availability, Station Blackout During Power Operation 21 2.1.4 Failures Considered 24 2.1.5 Extended STP-31 Loss of Offsite Power Start-up Test 25 2.2 PLANT LIMITS FOR SAFETY, STATION BLACKOUT DURING POWER OPERATION 25 2.2.1 Reactor Water Level 26 2.2.2 Suppression Pool Level 27 2.2.3 Reactor Pressure 28 t 2.2.4 Containment Pressure 29 l 2.2.5 Suppression Pool Temperature 29 2.2.6 Drywell Temperature 31 2.2.7 RCIC Cubicle Temperature 32 2.2.8 Control Room Temperature 32 2.3 ASSESSMENT OF A STRATEGY FOR STATION BLACKOUT TESTING 33 2.3.1 Plant Configuration for Emergency Recovery I (B ack up 's) 35 2.4 EVALUATION OF PLANT RESPONSE 36 2.4.1 Total AC Power Loss at Full Power (No Additional Failures) 36 2.4.2 Total AC Power Loss at Full Power with RCIC Failure 39 2.4.3 Total AC Power Loss at Full Power with SORV 40 2.5 EXTENDED STARTUP TEST STP-31 41 2.5.1 Prerequisites and Preconditions for Extended STP-31 Test 42 2.5.2 Test Initiation 42 2.5.3 Test Termination 44 f i I
LSCS TABLE OF CONTENTS (Cont'd)
PAGE 2.5.4 Compromises in the Extended STP-31 Startup Test 44 2.5.4.1 Reactor Level and Suppression Pool Level Control 44 2.5.4.2 Drywell Temperature Response 46 2.5.4.3 Suppression Pool Temperature Response 47 2.5.4.4 Battery Depletion Rate 49 2.5.5 Risks in the Extended STP-31 Test Scenario 49 2.5.5.1 Excessive Drywell Temperature 49 2.5.5.2 Stuck Open Relief Valve (SORV) 52
2.6 CONCLUSION
S FOR THE EVALUATION OF STATION BLACKOUT AND EXTENDED STP-31 TEST 52 3.0 EVALUATION OF PRACTICAL STATION BLACKOUT TESTING 55 3.1
SUMMARY
OF TEST REQUIREMENT 55 3.2 SEGMENTED BLACKOUT TESTS 56 3.2.1 Definition of Segmented Test Plan 57 3.2.1.1 Prerequisites 57 3.2.1.2 Objectives 58 3.2.1.3 Planned Tests 59 3.2.1.4 Existing Tests Supporting Station Blackout Analysis 60
4.0 CONCLUSION
S 63
5.0 REFERENCES
67 ii
l I
L LSCS LIST OF TABLES l
Number Title Page 2-1 E: tended STP-31 Limiting Parameters 54 l
[
iii
( - - - - - - - - - --
ISCS LIST OF FIGURES Number Title 2-1 Decacy Power After Station Blackout 2-2 Vessel Pressure Af ter Station Blackout 2-3 Temperature in Drywell After Station Blackout 2-4 Suppression Temperature After Station Blackout 2-5 Pressure in Drywell After Station Blackout 2-6 RCIC Room Temperature After Station Blackout i
l l
( iv
{
LSCS BACKGROUND AND CONCLUSION This report presents the results of Commonwealth Edison Company's (CECO) evaluation of the feasibility of meeting the NRC's objectives from their proposed station blackout test at La Salle County Station (LSCS) by extension of certain startup tests as augmented by detailed analyses in lieu of performing a dedicated Station Blackout test as initially conceived. This alternate approach to fulfilling the objectives of Item I.G.1 of the TMI-2 action plan, as required by NPF-ll license condition 30e for LSCS, was defined subsequent to the October 5, 1982 meeting held at the offices of Pennsylvania Power & Light Company (PP &L) between the NRC and utility representatives at which the PP&L " Safety Evaluation Report" for the NRC's Proposed Station Blackout Test was reviewed. The conclusion of that meeting was that "no single test can be formulated whi.ch ade-quately simulates station blackout conditions without undue risk to plant equipment and public health and safety."
This report is submitted to fulfill the commitment in CECO's letter of February 9, 1981 (L. DelGeorge to A. Schwencer) to l provide operator f amiliar ization to station blackout conditions, and to define specific plant response to blackout conditions at LSCS. The method of fulfillment has changed markedly from that originally contemplated; the results are equivalent.
[
l
(
l --
{
La Salle County Station is provided with a multiple, highly reliable, AC power network specifically to prevent a station blackout condition. As a consequence, the probability of a blackout occurring due to the simultaneous loss of all offsite AC power and onsite diesel AC power is less than 2 x 10 -5 per year. The design provision for a high availability of AC power is the justification for exclusion of total AC power loss from the design basis at LSCS.
Nevertheless, as was done for the Susquehanna plant by PP&L, CECO made the effort to determine realistically the capabilities and limitations of the LSCS plant to a station blackout.
Analyses of the transient responses of the station to a variety l of postulated station blackout scenarios verified that the duration of a total blackout test was extremely time-limited
( in that the drywell temperature would attain 175 F within about 1.5 minutes and the suppression pool would reach 185 F within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of total AC power loss while at full power
( on a typical hot summer day. Such a short time-interval precludes extensive operator training in real-time on the plant. Repetitive training sessions are ruled impractical because the extreme temperatures needlessly degrade the operational life and environ-mental qualification of much safety-related equipment. The
( actual plant response in such a postulated test situation would properly be conditioned with appropriate operator actions
[ 2
LSCS and test configuration compromises that ensure adequate core cooling, proper containment integrity responses, and necessary mitigating alignments with emergency equipment. The net result is that a practical blackout test, especially with additional single failure postulates, is unrealistic and invalid for training purposes or even demonstration of emergency procedures to familiarize operators with the genuine event.
In lieu of the original NRC test approach, CECO has devised a segnented test approach to verify that the plant responses are predictable and to validate the operator actions that are necessary to mitigate th is event. Plant specific simulator exercises can realistically depict the total loss of AC power event from the data gathered from this segmented-test approach rather than performing the postulated limiting test case.
The value of the training is considered to be higher, however, when based on realistic segmented events observed in this
( segirented test approach. Additional hot functional tests, such as the "In-Plant SRV Discharge Test," and some Startup Tests form the basis for observations which predict plant f response to initiating events resulting from offsite AC power loss conditions. These two sources of data provide adequate information to support the analytical pre-dictions of plant response to station blackout.
[ The conclusions f rom this report are that although the originally conceived loss of AC power test cannot be performed safely 3
LSCS I without jeopardizing the service life of installed equipment, realistic operator training inputs for the LSCS simulator and useful observations of plant responses are obtainable from the alternate segmented'AC power loss tests outlined herein. The net result is an equivalent understanding of plant response to station blackout; an increased assurance of adequate design measures against the occurrence of the event from its several initiators; and, specific operator assurance, through training, that station AC power loss is recognizable and its potential consequences controllable by proper operator actions. These measures, in combination, provide adequate protection against risk to public health and safety without unnecessary risk to plant equipment as would occur in a dedicated station blackout test.
I
}
[
l
( 4
( - - - - - - !
LSCS 1.0 INFRODUCTION This report presents an assessment of in-plant tests and operational procedures for determining the capabilities and limitations of La Salle County Station (LSCS) during station blackouts, which is defined to be the total loss of AC power. This cection provides a brief statement about the station blackout issue and it presents the test objectives and CECO's proposed actions to fulfill those objectives.
Section 2.0 presents the expected safety response of LSCS to a station blackout situation and outlines the station capabilities and limitations which preclude performing the station blackout test as originally proposed by the NRC staff. The station response times and extent of safety conditions necessary to perform such a test are presented for the major considerations.
A comprehensive treatment is not claimed for the many details of all station systems because the obvious conclusion from the consideration of principal ESF systems precluded further study.
f Section 3.0 describes the segmented test approach with various startup tests and procedures and certain other functional tests, i.e., in-plant SRV discharge test, from which CECO intends to obtain the system response information relative
( -
5
L LSCS to simulated blackout conditions to fulfill the I.G.1 commitment.
The segmented approach identifies startup tests and special tests which can be used to show the plant's capability to handle a Station Blackout event. Satisfaction of safe reactor shutdown, coolant inventory control, and core heat removal are covered in this segmented test approach.
Section 4.0 presents CECO's conclusions that further blackout testing to verify plant response or to provide training exercises are not warranted nor could they add materially to the confirmatory results provided from the segmented blackout test outlined herein, f
1.1 History of Station Blackout Issue
(
Station Blackout is defined as the loss of offsite AC power (LOSP) to a generating unit coincident with the failure of onsite emergency AC generators to deliver power to their
(
respective Engineered Safeguards System buses. Such an event deprives the unit of the power normally utilized to accomplish safe shutdown conditions and to mitigate design basis events.
The importance of the AC power supply to a nuclear unit is
(
recognized, and design provisions are taken to assure adequate power supplies for needed safety functions.
[ 6
( _ - ----
(
Each unit at LSCS is supplied with two electrically and physically independent sources of offsite power (see FSAR Section 8.2) .
The of fsite power is supplied by the CECO 345-kV system via four lines connected to the extensive Chicago area transmission system. As a result, the voltage variation band at LSCS buses is quite narrow. The LSCS 345-kV switchyard is arranged in a double ring bus so that a single failure cannot cause loss of offsite power to both units. During unit normal operation, half its load is supplied from the Unit Auxiliary Transformer (UAT) and the other half from the System Auxiliary Transformer (SAT) . When the power generator is not operating, such as during startup or shutdown or unit trip, the loads fed from the UAT are transferred to the SAT. The unit's SAT is the first offsite source for its safety-related buses. The SAT of the other unit at the station is the second offsite source
( through bus ties provided between corresponding safety-related buses of the two units at LSCS. These ties would be closed only in the event of loss of offsite power to one of the units (see FSAR Figure 8.1-1). The offsite AC power unavailability
-5 to a unit is 7 x 10 considering all elements from the grid
( down to the 4160 volt buses. Even with a pessimistic diesel generator failure probability of 4 x 10 -2 per year, the AC power unavailability at LSCS meets the NRC's unreliability goal of 2.5 x 10 -5 failures per year. The onsite AC power
[
is supplied to each unit from two emergency diesel generators
[
[
LSCS within separate electrical divisions. A single electrical .
division is adequate for reactor shutdown. Accommodation cf a LOCA requirement is concurrently possible with the third F
diesel generator which is dedicated to the High Pressure Core Spray (HPCS) for each unit.
In addition, electrical power is also available from station storage batteries in corresponding electrical divisions.
Also when the plant is pressurized, steam generated by decay heat is available to drive the Reactor Core Isolation Cooling pump turbines to provide water injection for inventory control in the vessel. The LSCS plant was not designed to maintain safe shutdown conditions indefinetely with only battery power and steam produced by decay heat.
NRC concerns over station blackout apparently arise from concerns over the reliability of offsite and emergency onsite power supplies. Failures of diesel generators to start or provide power on demand and LOSP event histories justify concern for certain limiting situations. The NRC however has relegated f the concern to a generic unresolved safety issue (A-41) for further appraisal. Station blackout at a plant on the end of a shoe-string transmission line is surely a different problem from that presented by a plant in double ring transmission
[
loops with many generating stations and multiple interties 8
(
[ - -- -
LSCS to adjoining utility transmission networks. The LSCS blackout probability was addressed in the ?SAR and in subsequent questions and answers with the NRC staff. The results of LSCS specific analyses are reported there and included above to give perspective l to the station blackout hypothesis. The largest single contributor l
! to LOSP is a tornado through the switchyard or both rights-of-way for either unit, the transient time limiting faults are essentially of trivial duration, however they are included for completeness. An assessment of the station response to the blackout conditions has been performed. Based on this assessment and the results of the alternate segmented testing, operating procedures and training program can be changed, as necessary, for future simulator exercises.
The NRC instructed CECO on January 16, 1981 that an AC loss of power test be performed at LSCS to satisfy the requirements of TMI-2 Action Item I.G.I. By letter of February 9, 1981 CECO committed to performing a test contingent upon a favorable safety evaluation that NRC would approve along with a mutually agreeable test plan. Finally, the SER cited that a specific license condition v:ould require submittal of a detailed test program and safety evaluation for staff review 4 weeks prior to test sometime during the first fuel cycle. The training objectives and the verification of plant behavior were both cited as reasons for the test.
9
LSCS 1.2 NRC Objectives for Station Blackout Test TMI-2 Task Action Plan Item I.G.1, " Training During Low Power Testing," requires applicants for a new operating license to define and to commit to a special low power test program (1) to provide meaningful technical information beyond that obtained in the normal startup test program, and (2) to provide supplemental training. The extensive preoperational test program at LSCS and the augmented startup testing program was specifically defined in FSAR Amendment 56 (May 1981) to validate CECO's conclusion that adequate operator. training was provided to fulfill the training objectives. Specific startup test outlines were provided to indicate the scope of coverage for loss of power events. These training exposures were specific elabccations on the BWR Owners' Group response to Item I.G.1. The general objectives and criteria for the l
testing requirements were as follows:
f
- a. to provide meaningful technical information or
( data relative to plant response during off-normal conditions, specifically information not provided by any of the tests described in Regulatory Guide
[ 1.68, " Initial Test Programs";
[ b. to be equivalent in scope to the PWR Special Low Power Tests; 10
[
- c. to pose no undue risk to public health and safety; and
- d. to pose no undue risk to the plant.
When the NRC indicated that a simulated loss of all AC power or " station blackout" test would be required, several additional objectives were added as follows:
- a. to familiarize operators with plant response to station blackout;
- b. to provide data on the response of reactor vessel and containment parameters during a station blackout; NRC would use this data to evaluate the accuracy of analytical predictions and to determine whether simulator training is a satisfactory substitute for operator training during the test; and
- c. to determine the limitations and capabilities of BWRs to maintain safe reactor and containment conditions in the event of a station blackout.
1.3 Achievement of NRC Objectives at La Salle County Station 1.3.1 Operator Familiarization and Training f
Because of the restrictions necessary to protect the plant i 11 I .
LSCS and the public, a station blackout test is not beneficial for familiarizing operators with plant response or for providing training in implementing mitigating procedures. The duration of a real-time test is limited to less than 5 minutes, repetitive tests are neither prudent nor possible. Operator familiarization can be provided more effectively through a combination of classroom instruction, equipment walkdowns, as appropriate, and simulator training.
1.3.2 Verification of Predicted Plant Response Confirmation of analytical predictions with in-plant test data is desirable to assure that response strategies are based l on a realistic conception of plant response. However, testing to achieve this objective must be consistent with the need to protect plant equipment and to minimize risk to public health and safety. CECO has always felt that a full station blackout test should not be performed at an operating plant,
( and only limited tests could simulate various system responses under blackout conditions.
Detailed plant evaluations showed that limitations necessary to protect plant equipment would preclude the determination
( of reactor vessel and primary containment response through testing. Only limited tests of particular components whose response can be safely tested have been defined and can be conducted during hot functional testing to verify the predicted 12 r
\. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
LSCS performance of these components. Section 2.0 presents the results of the safety evaluations of various aspects of station blackout testing. Section 3.0 describes startup tests and additional hot functional tests whose output can be used to confirm the analytical predictions of plant performance.
1.3.3 Plant Limitations and Capabilities CECO has evaluated plant response to a station blackout in order to generate procedures for plant operation. As a result of these efforts, determinations were made of the capa-bilities and limitations of the LSCS plant to maintain safe reactor and primary containment conditions during a station blackout, f
' Section 2.0 presents the evaluations of plant response, including
[
strategies developed to recover from a blackout.
L 1.3.4 Summary L The capabilities and limitations of Le Salle County Station
- under LOSP conditions were determined through detailed operational l
and engineering evaluations. The information generated by these evaluations, which considered a range of event sequences,
(
is presented in Section 2.0. Operator familiarization and L training can be provided by a Training Program based upon L
e s 13
LSCS these reviews, the results of the segmented testing program, and any procedural changes ensuing theref rom.
Another application of test results from a station blackout test would be the confirmation of plant responses to realistic plant predictions in contrast to the conservative safety pre-dictions for extreme cases, which of ten give results that are orders of magnitude more conservative and almost always not measurable within operating ranges of instrumentation. Station blackout is not a design-basis event, hence certain operating limits will be exceeded very rapidly, i.e., temperature within an isolated ECCS cubicle, suppression pool temperature whenever all cooling is removed, etc. Restrictio'n on in-plant testing to preserve plant equipment which is qualified for a specific service life plus an accident (LOCA, HELB, etc.) limits the duration of a blackout test to a very brief period or necessitates providing alternate cooling capability that invalidates the purpose of a blackout test. In lieu of a general station blackout test, CECO proposes in Section 3.0 that a segmented loss of power test comprised of partial verification tests be utilized to validate analytical predictions of plant response. The aggregate of these tests, when incorporated into a training simulator, is considered adequate to fulfill the objectives
[ outlined in Section 1.2 above.
[
k 14
LSCS 2.0 EVALUATION OF LA SALLE COUffrY STATION RESPONSE TO STATION BLACKOUT 2.1 Discussion of Assumptions 2.1.1 Operational Cases The impact of a station blackout (SBO) on the plant is dependent on the operating state at the time of occurrence. In order to limit the magnitude of the analysis required, reference was made to the prior evaluation of the Susquehanna plant.
Four general operating states were addressed in that evaluation which sought to define the most limiting operational state from which a station blackout event would create the bounding case (Dockets 50-387/50-388; letter of June 15, 1982 fron N.W. Curtis to A. Schwencer, subject "Susquehanna Steam Electric Station, Station Blackout Safety Analysis and Test Plan").
That evaluation concluded that the first three cases described below are trivial in comparison to the full power operation case:
- a. Refueling Case With the plant shut down, cooled down and depressurized with decay heat being removed by the RHR system in the shutdown cooling
(
mode, station blackout was assumed to occur after
(
( 15
( 1
LSCS vessel head removal and prior to flood up. At this time 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> has elapsed since shutdown, hence the decay heat load establishes the shutdown cooling requirement and it drives the temperature rise in ::ase of power loss. For this cace, ample time is available (5 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) for recovery of AC power or for provision of emergency water inventory makeup. If flood up has occurred, the fuel pool cooling capacity is available to extend the available time to obtain the inventory makeup and to absorb decay heat.
- b. Spent Fuel Pool Cooling Case With decay heat from the core fuel inventory located in the spent fuel pool, the consequence of loss of AC power depends upon the pool heat capacity and the emergency fuel pool makeup capability to replace pool boil off; The LSCS FSAR examined the boiling of the spent fuel pool from separate initiators and reported the extended time frame in which makeup be attained.
4 Again, a last resort is the use of the fire protection system with lake water, l.
k
( 16
(
- c. Shutdown Cooling case with the plant shutdown and decay heat being removed by the RHR system 4
in the shutdown cooling mode (depressurized),
i the total station blackout was assumed to occur.
Immediately, the RHR heat exchanger pumps and l the RHR pump (s) on the cooling loop (s) stop from loss of power. Core cooling would be lost and decay heat would cause the RPV to repressurize due to this heat input. Eventually water boiloff and SRV discharge to the suppression pool would lead to core uncovery if a makeup source is not employed.
Station blackout was assumed to occur 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after shutdown, because 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the shortest prac-tical interval between shutdown and the initiation of the shutdown cooling mode. The same decay heat curve as used for the 100% power case was used here. The RPV water inventory was assumed to be at normal water level at the time blackout begins. These assumptions provide an upper bound estimate of reactor vessel heatup, repressurization, and boil-off rates. This condition is much less demanding than a station blackout at power because
(
the initial high decay heat rates and the thermal
(
( 17
LSCS energy releases from fuel relaxation and from RPV depressurization have already been removed from the containment prior to initiation of blackout.
More sensible heat and maximum decay heat must be removed from the full power operating condition of the LSCS reactors. The bounding case is discussed below.
- d. Full Power Case The LSCS plant at normal conditions with an equilibrium core at 100% power experiences a postulated total loss of AC power (LOSP) including I
failure of onsite emergency diesel generators. The plant DC power is assumed to be available. The imme-diate plant response would be similar to the LOSP transient reported in Chapter 15.0 of the FSAR. Reactor scram, recirculation pump trip, MSIV closure, and equipment shutdown from loss of AC power would ensue immediately. Primary containment would isolate and heat would be dissipated to the suppression pool through the safety / relief valves. Reactor
{ coolant starvation would eventually occur unless corrective actions were taken. Steam driven RCIC injection occurs or, where it fails, operator responsiveness to Emergency Procedural Guidelines (EPG's) provides inventory makeup by use of the diesel fire pumps to assure core coverage.
(
18
{
f
LSCS For this total LOSP situation, the following functions are unavailable: drywell cooling, suppression pool cooling, and RCIC cubicle cooling. This would cause increasing temperatures in the drywell, the suppression pool and the RCIC cubicle as well as throughout the reactor building (secondary containment).
The primary containment would pressurize, the RCIC would become less reliable if the cubicle temperature increases significantly, and the suppression pool temperature would rise even though the RPV coolant inventory was being made-up from emergency water sources. If reactor injection water were lost, the fuel could exceed Technical Specification temperature limits after it becomes uncovered.
Power operation is considered to be the limiting case for a station blackout event. Specific response evaluations were made to describe the plant capability and its limitations for this postulated event. Responses of the reactor coolant system, primary containment, and the RCIC cubicle along with f the time response of the suppression pool were the detailed measurements of plant capability for this total station blackout i event. These detailed responses were evaluated to develop a strategy for segmented testing to yield the requested test objectives because it became immediately evident that plant limitations precluded accomplishment of all objectives with a
[
single blackout test.
(
( 19
1 LSCS 2.1.2 Boundary Conditions for SEO Analysis at 100% Power
- a. The initial plant response was assumed to be similar to the LOSP transient presented in the FSAR.
- b. After the initial transient the plant response was determined using a model which simulated plant conditions with the reactor shut down and isolated, with an option to depressurize the reactor by manually operating the SRV's. This model is reported in Chapter 6 of the La Salle DAR. The model provides a best estimate of plant transient response for the input parameters and the. thermal properties of the La Salle suppression pool.
- c. The decay heat curve utilized in the model was computed using the ANS 5.1 Decay Power Standard (1979) for an equilibrium core.
- d. The fuel relaxation energy an[ the sensible heat
( released from the reactor vessel and internals during depressurization were considered in addition to decay heat in determining depressurization rate, reactor makeup requirements and suppression pool hest loads.
20
[
I
1 LSCS These assumptions result in practical but conservative best catinates of plant response to a station blackout during full power operation.
j 2.1.3 Equipment Availability, Station Blackout During Power Operation only equipment which does not require or depend upon normal cr emergency AC power can be utilized to maintain the plant
(
in a safe condition after occurrence of station blackout.
However , equipment required to recover from a station blackout i
event must be preserved from the consequences. Evaluation of the plant electrical, and instrumentation and control systems has demonstrated that equipment adequate to maintain the plant in a safe condition for an extended period of time will be ava ilable. This includes the following equipment:
- a. Reactor vessel level instrumentation. Narrow and wide range indications would be available in the control room and wide range-indication is available at the remote shutdown panel in the AEE Room. Additionally, narrow range, wide range, and fuel zone indications would also be available at local instrument racks in the reactor building.
(
( 21 f
l LSCS 1
- b. Reactor pressure instrumentation. Indication would be available at the Emergency Core Cooling Control Panel in the control room and at the Remote Shutdown Panel in the AEE Room, and if accessibility permits, at local instrument racks in the reactor building.
, c. Suppression pool temperature instrumentation.
Suppression pool bulk temperature suppression chamber air temperature and drywell temperature can be monitored at the Remote Shutdown Panel.
( d. Suppression pool level instrumentation. Indication would be available at local instrument racks in the reactor building.
- e. RCIC injection from the CST or the suppression pool at reactor vessel pressures greater than 84 psia. For analytical purposes, RCIC was conser-vatively assumed to shut down at 165 psia. The RCIC could be monitored and controlled from the control room or from the remote shutdown panel in the auxiliary electric equipment room or from
( its local controls in the RCIC cubicle.
I
( 22 l
- f. The Diesel Fire Pumps and the Fire Protection Water Supply System are assumed available as a potential reactor makeup source.
- g. SRVs in manual or automatic relief mode until accumulator depletion and in the safety relief mode thereafter. Pneumatic compressor supply to the relief mode accumulators is lost due to shut down of the compressor on LOSP. After the initial SRV response to the turbine trip following reactor pressure vessel isolation, low-low setpoint logic will engage to control reactor pressure via the SRVs.
- h. SRVs individually actuated in the Automatic Depres-
[ surization System (ADS) mode at control room panel H13-P601 or via keylock switches from panels in the Auxiliary Electric Equipment Room.
[
SRV actuation in the ADS mode remains available since the accumulator air supply and backup nitrogen supply to the pneumatic actuators for the seven SRVs assigned to ADS is not isolated. Upon loss
[ of the instrument air compressor, the external nitrogen supply is provided by a bank of high pressure nitrogen cylinders which may be replaced o
23
LSCS as needed. In addition, these SRVs are equipped with large capacity accumulators inside containment which, in the remote event of loss of the external supply, provide sufficient capacity for SRV actuation to repeatedly depressurize the reactor vessel to mitigate station blackout effects, f 1. 125-vde batteries in three electrical divisions which provide power for emergency lighting and SRV actuation in relief and ADS modes among other functions. The 125-V batteries are expected to last a minimum of 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> under station blackout conditions, provided unnecessary loads are stripped per emergency response procedures and substantial reductions are made in emergency lighting loads which are the major loads on these batteries.
2.1.4 Failures Considered In order to evaluate the capability of the plant to withstand the total blackout event certain failures of some safety equip-ment were also considered. The following f ailures were considered:
( a. RCIC' failure, and
- b. Stuck Open Relief Valve (SORV) .
24
LSCS The capability of the plant in terms of how long a safe condition could be maintained is discussed in Section 2.4.
Loss of compressed air for ADS was not considered due to the capacity, redundancy, and provisions for external resupply provided in the design of this system. Loss of DC power was not considered because of the expected long time to depletion of the 250-Vdc and 125-Vdc systems.
2.1.5 Extended STP-31 Loss of Offsite Power Start-up Test f
Section 2.5 presents an analysis of a partial blackout test as it would be performed under an Extended STP-31, Loss of Offsite Power Startup Test. It presents the conclusion that this type of test is not representative of a station blackout due to testing constraints and unacceptable plant risks.
[
2.2 Plant Limits for Safety, Station Blackout During Power Operation While the plant may be maintained in a safe condition for
[
some period of time after occurrence of total AC power loss, eventually the inability to remove decay heat from the contain-ment'affects containment integrity if the AC power outage
[
25
[
LSCS continues indefinitely. After a finite time some plant para-Ester will exceed its limiting value. The following parameters cust be considered against their Technical Specification safety limits:
L. Reactor water level, r b. Suppression pool level, i
- c. Reactor pressure,
- d. Containment pressure,
- e. Suppression pool temperature,
- f. Drywell temperature,
- g. RCIC room temperature, and
- h. Control room temperature.
A discussion is presented below for each of these limits.
2.2.1 Reactor Water Level The success criterion for reactor water level is that it be maintained above the top of active fuel (TAF), but no higher 26 i
__ l
LSCS than Level 8 (L8). This criterion is somewhat conservative in that a transient that drops water level below TAF by approxi-mately one-third of the core height f or a short time would not result in a loss of adequate two phase cocling of the fuel rods. Adequate core cooling might be expected until the core is less than half covered.
Exceeding L8 it considered unacceptable on the basis of potentially introducing liquid carryover into the steam lines. This could seriously degrade the operation of the RCIC turbines and severely damage the SRV, neither of which have been demonstrated capable g of operating under water slug conditions at high pressures, l.
[ The criterion that reactor water level be maintained above TAF is the primary criterion for judging safety of the reactor.
It assures fuel integrity and therefore an absence of fission product release from the fuel.
2.2.2 Suppression Pool Level
[
During an AC power blackout, the suppression pool level will rise due to (1) thermal expansion from heatup, and (2) addition
[ of condensed steam from the reactor, less any water returned to the reactor by RCIC when pumping f rom the pool.
{
b The upper limit of the pool level was set at an elevation below the bottom of the RCIC turbine steam exhaust lines, 27
LS CS where they pass through the wet well wall at elevations corre-sponding to 31 feet water depth. This limit was selected to avoid flooding of the line to the check valve, which would happen whenever the RCIC turbine is shut down. Failure of the RCIC turbine upon restart due to water in the casings might occur if the check valve were to leak or if water were to flood the line upon initial opening of the check valve prior to the development of sufficient steam velocity to clear the line. As long as the RCIC turbine is operating, steam velocity is sufficient to keep the lines clear even if this limit is exceeded. However, even though higher pool levels may be acceptable, assuming continuous RCIC turbine operation
( to f ailure, operator response strategies were developed to maintain the pool level below this limit.
[
( 2.2.3 Reactor Pressure
[ Overpressure protection is provided by the SRVs operating in the pressure relief mode at first and later in the safety
{
mode (spring) if necessary.
L Reducing reactor pressure below 200 psia is not essential to maintaining the plant in a safe condition. However, E
{
I LSCS following reactor depressurization, pressure can be maintained normally above 165 psia for full flow and above 84 psia to avoid tripping the RCIC on low steam pressure.
Failure to maintain reactor pressure above the minimum needed I
for RCIC operation is not an essential requirement (except during the first sur af ter AC power loss) because the diesel driven fire pump would be available to supply makeup water l to the reactor vessel, as a last resort. This source can be utilized only if RCIC or AC power has not been restored
( by the time the vessel level drops to TAF. Nevertheless, maintaining RCIC available increases the likelihood of main-taining safe conditions throughout the long-term cooling period.
2.2.4 Containment Pressure The design value for containment pressure, 45 psig, was selected as the limiting condition for station blackout.
( Containment pressure remained below this limit for the bounding transient case considered.
[-
2.2.5 Suppression Pool Temperature
[
A bulk average suppression pool temperature limit of
{
185 F was selected for the station blackout condition. The following phenomena were considered in selecting' this value:
[ 29 F
- 1. NUREG-0738.
- 2. Results of the La Salle County Station In-Plant SRV test.
The first of these is not expected to be limiting in that the reactor pressure will have been reduced to less than 200 f psia prior to the suppression pool bulk average temperature exceeding 150 F. The second is not expected to be limiting in that the amount of subcooling will be about 60 F at 220 F and the test data reported in the LSCS Design Assessment Report shows that smooth condensation is expected to this condition.
Subsequent to reactor depressurization localized high tempera-tures in the vicinity of the quenchers are not expected, because the steam discharge and heating of the pool occurs over an interval of several hours. Temperature stratification results
{
from the rise of heated water to the surface of the pool.
I L Mixing of the suppression pool requires mechanical pumping action.
t The La Salle in-plant SRV test demonstrated that no adverse consequences.are expected from bulk pool temperatures up to 237 F for the event sequences considered in this station
, blackout test.
f L
30
[ - - -
LSCS 2.2.6 Drywell Temperature If the drywell temperature limit for the blockout test were selected based upon environmental qualification limits for the most critical safety-related item in the drywell, a tempera-l ture limit of 180 F would apply for the SRV actuators and associated components. Accident environment limits have been used to determine acceptability using a time-at-temperature approach. The following analytical limits were considered:
( a. Below 150 F- indefinite.
- b. Between 150 F and 200 F - 2400 hours0.0278 days <br />0.667 hours <br />0.00397 weeks <br />9.132e-4 months <br /> (100 days).
[
- c. Between 200 F and 250 F - 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.
[
- d. Between 250 F and 320 F - 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
[
- e. Between 320 F and 340 F - 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
[ It is believed unlikely that these time-at-temperature limits would be exceeded by the mean drywell temperature. During a real blackout test, the local temperature in the drywell will cause thermal degradation to some components, thus resulting in immediate or premature replacement. Local temperature could
{ exceed the mean temperature by an appreciable amount, such as 100 F.
31
[ _ - - - - - \
LSCS 2.2.7 RCIC Cubicle Temperature The design limits for the RCIC turbine and pump cubicle equip-ment are 104 F for normal maximum and 148 F for accident conditions. Room temperatures are believed to rise fairly slowly and the equipment shoald be capable of emergency operation under the conditions anticipated. Analyses indicates about 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for room temperature to rise to 148 F.
(
Violation of the RCIC cubicle temperature limits does not represent
( failure to maintain the plant in a safe condition, because exceeding these temperature limits does not necessarily result in immediate loss of the equipment. It results in a consumption
[ of the service life of the equipment during this special test.
[ 2.2.8 Control Room Temperatures
[
No hard limit for control room temperature has been established
[- for evaluation of the total blackout event. The blackout event results in loss of power to all equipment in the control I
L room except that supplied from DC or uninterruptible power sources and much of this could be switched off very early in the transient to conserve DC power supplies. The major heat
[- sources, therefore, are the sensible heat located in control room equipment and the biological heating from the room occupants.
[
b 32
[ - - - -
LSCS Control room temperature and humidity can be moderated via natural circulation pathways by opening the access doors to the control room.
2.3 Assessment of a Strategy for Station Blackout Testing
(
In assessing the preceding limits for the important plant parameters in the blackout event, it becomes clear that a prime concern is the consequences of additional equipment
[ failure caused by overtemperature during the test.
As an example, a SORV would eventually depressurize the vessel
( and cause loss of RCIC which in turn could cause eventual core uncovery due to lack of makeup water if operator actions
[ were not considered. As another example, for a prolonged blackout interval (several days), avoidance of overfilling the vessel eventually requires alternate operation of RCIC
[ in the injection mode and the test mode to avoid cycling the RCIC on and off with increased potential for failure to restart.
A station blackout event is considered to be extremely improbable; the concurrent loss of reliable safety-related equipment repre-
[ sents another improbable condition in the plant. Nevertheless, response strategies were selected to reduce the probability of such failures and to provide corrective actions to preclude severe consequences from such failures. The response strategies were developed from the following guidelines:
33
- a. When makeup flow is available to the reactor vessel, the reactor vessel is depressurized and maintained at low pressure to limit drywell temperatures.
t
- b. The number of SRV lifts is minimized to reduce the probability of an SORV.
- c. The RCIC system is initiated and maintained in operation until the steam generation rate cannot sustain its continuous operation.
- d. Reactor vessel water level is maintained at normal level whenever possible or is recovered to normal level as quickly as possible,
- e. During the early part of this transient, RCIC suction is switched to the suppression pool until depres-surization is complete or until the suppression pool temperature exceeds 1450 F. This is done to reduce pool level rise early in the scenario due to the accumulation of condensed steam frcm the reactor vessel. This, in turn, extends the time during which pool level can be kept below the limits given in Section 2.2, and preserves cooler CST water for use later in the scenario.
34
- f. Operator action is taken to make a connection from the Fire Protection System to the feed water system header. This allows injection of fire water into the vessel via the feed water system.
L This provides of Fire Protection Water for reactor vessel makeup.
- g. All DC loads not required to mitigate the station blackout event are stripped from the DC supplies to extend the life of the DC power supplies.
- h. Automatic load shed and operator action strip the AC buses to assure acceptability of the initial loading when AC power is reestablished.
This response strategy also maximizes the period of time the plant can be maintained in a safe condition. Maintenance of core coverage is the top priority consideration in this l regard. As long as adequate core coverage is maintained the plant is considered to be in a safe condition.
{
2.3.1 Plant Configuration for Emergency Recovery (Backup's)
[ The plant configuration prior to, and during the segmented blackout testing shall involve one or several of the following normal safety grade systems to accomplish an emergency recovery chould multiple or cascading failures be encountered.
7 L
35 L .
LSCS 2.4 Evaluation of Plant Response Plant response has been deter. tined analytically for the initial conditions of full power operation and shutdown cooling, utilizing the strategy described in Section 2.3 to maximize the time
{ before attaining the plant limits for safety as given in Section 2.2. Various combinations of subsequent equipment failures as postulated in Section 2.1.4 were also described. Individual cases considered are discussed below. Each discussion presents the response strategy appropriate for the plant condition
( and equipment availability, describes the plant response, and summarizes the analytical predictions applicable for that case.
[
2.4.1 Total AC Power Loss At Full P_ower (No_ Additional Failures)
[
The first 20 seconds (approximately) of plant response is similar to the LOSP transient documented in the FSAR. Reactor scram and MSIV closure signals would be generated immediately
[ due to loss of the Reactor Protection System (RPS) power.
{ The recirculation pump drive motor breakers would open on LOSP, resulting in coastdown of recirculation flow. Within
[ 2 seconds the MSIVs would begin to close. Reactor pressure would increase rapidly, causing SRV's to lift. Within 3 seconds
[ the first groups of SRVs would have opened at their relief mode set pressures. The low-low SRV logic will engage and
{
SRV's wi.".1 control the pressure between 896 and 1006 psig.
, 36
LSCS Reactor water level during this interval would drop rapidly due primarily to void collapse following the scram and pressuri-
~
zation and partly due to steam (inventory) loss which is not completely replaced by feedwater flow in the early seconds of the transient. RCIC initiates when reactor water level
( reaches Level 2 (-50 inches) . Initially RCIC flow can not compensate for SRV discharge, thus vessel level will decrease.
At about 40 minutes, the water level will begin recovery and when RCIC flow exceeds flashing and boil-off in the reactor vessel. Reactor water level is then generally restored and
[ maintained at normal level.
[ Operator action would then be required to throttle RCIC flow to maintain a stable water level. This action is not mandatory because RCIC would automatically trip at Level 8 to prevent vessel overf111.
{
Early in the transient the operators would (1) transfer RCIC suction from the CST to the suppression pool, and (2) initiate
[ depressurization. As discussed in Section 2.3, this suction shift would be made to minimize suppression pool level rise
{
during depressurization. Manual pressure control is accom-
[ plished by opening one of the SRVs in ADS mode (presuming all relief mode accumulators had been depleted). The reactor would be depressurized into the minimum pressure control range for RCIC as appropriate. During this event, the suppression
{
b 37
LSCS pool temperature will increase due to the addition of steam from the SRVs and the RCIC exhaust. This increase is about 60 F for the first hour.
L Operation at low reactor pressure would continue until restoration of AC power, with pressure controlled by manual SRV operation as necessary, and reactor vessel level controlled with RCIC.
RCIC pump suction would be shifted back to the CST when the Suppression Pool bulk temperature reached 145 F. In the event that steam pressure dropped below the minimum necessary for RCIC operation, injection water could be supplied from the Fire Protection Water Supply System if necessary, but this is a last resort situation.
Figure 2-1 shows the decay heat generation rate and also the rate of release of energy to the suppression pool as a function of time from shutdown, assuming that an SRV was opened at 10 minutes to initiate depressurization. Figure 2-2 shows the water pressure response. The minimum pressure of 165 psia would be reached at about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> af ter the start of depressurization. Due to the loss of drywell cooling, drywell temperature and pressure will increase (discussed separately) .
l Figures 2-3, 2-4, 2-5, and 2-6 show the response of drywell
[
temperature, suppression pool temperature, containment pressure r
- and RCIC cubicle temperatures respectively during the event.
38
LSCS The first limiting parameter violated would be the suppression pool temperature limit of 220 F. This would occur at about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
It is possible that core coverage might be maintained for several hours, however suppression pool temperature and possibly (very remote) containment pressure would exceed design values also.
2.4.2 Total AC Power Loss at Full Power With RCIC Failure The strategy and plant response for this case would again be
( similar to the base case above. RCIC is assumed not to func-tion at the time the water level drops below Level 2 and that it cannot be manually actuated.
[
Loss of RCIC leaves no means for high pressure water injection
( into the vessel. Because conservation and preservation of RPV water inventory (to keep the core covered as long as possible) is the primary objective, immediate depressurization is man-datory to enable low pressure water sources to provide inven-
[ tory makeup. In the event reactor water level drops to TAF, with no other sources of water injection available, the operator
{
would resort to the fire protection water for emergency injection.
b Analysis indicates that the vessel level would drop to TAF within 17.5 minutes of blackout. Adequate core cooling is
[ expected via steam cooling until the core is approximately half covered; this occurs in about 26 minutes.
{
39 F _ - - - - - - - - - - - - -
LSCS Use of injection from the Fire Protection Water Supply System cannot be accomplished for this event without uncovering of the core for a significant period of time. In order to use this low pressure injection water source, prompt depressuri-zation of the vessel is required. The analysis shows that given the decay heat rate and the thermal energy stored in the vessel and internals early in the transient, this depres-surization is achieved in about 32 minutes. The maximum possible injection rate at essentially complete reactor depressurization
( (75 psia) is 500 gpm. At this injection rate, the core is expected to be deprived of adequate cooling for at least 90 minutes; slower injection will result in proportionally longer
( core exposure times. As a consequence, severe core overtemperature is anticipated but " core melt" and consequential vessel failure is not expected. The drywell and suppression pool responses are similar to the station blackout base case in Section 2.4.1.
2.4.3 Total AC Power Loss at Full Power With SORV
[
This transient is similar to the base case except that reactor pressure continues to decrease beyond the SRV reset point pressures of the SORV. With RCIC available,.the strategy and plant response during the early stages of the event would be
{
the same as without SORV. Reactor water level is approximately
[ 13 feet above the top of the active fuel when RCIC is assumed inoperable at 165 psia.
40 r
LSCS In the analysis, SORV was assumed to occur on the first SRV lift, resulting in a slightly earlier pressurization. Reactor water level is approximately 13 feet above the top of the reactor fuel when reactor pressure drops below 165 psia at about 105 minutes into the -transient. Injection of water from the fire main would be possible at this' reactor pressure, and reactor water level could then be maintain'ed indefinitely.
Depressurization to about 70 psia will permi.t the~ diesel driven fire pump to inject enough water to replace boil-off at 'a decay heat rate of 1% power, which is reachgd'at about'2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, f
The suppression pool temperature limit would be reached'at. ,
about 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, or about an hour' e'arlier than in the base case, (
[
see Section 2.4.1. The drywell response is essentially the same as the base case. "
7 2.5 Extended Startup Test STP-31 s
~
s
{
Startup Test STP-31, Loss of Of fsite Power, p'iiesants a posiible h format in which test data ,could be gathered 'for comparison of the station blackout ovhnt. This section'pnalyzes the y
[ results of this test if it were extended to include thc SBO
~
scenario. The definition of test controls and a defipition
[
of test termination is also included herc~for clarity.of intent;
[
- .e <
[ -
d A
~
[
h' ., $
LSCS 2.5.1 Prerequisites and Preconditions for Extended STP-31 Test Prior to initiating this test, the plant would have been operated at about 80 power for 17 days to assure sufficient fission product inventory for significant decay heat.
Normal plant systems not involved in the test would be shut
(
down or placed on standby. The Control Rod Drive pump would be restarted to cool the CRD's and normal cooling would be provided to the recirculation pump seals. Safety-related b
systems would be energized and placed in standby configura-tions appropriate for the test,
{
b 2.5.2 Test Initiation
[ Using normal plant procedures, pu er and flow would be reduced to about 35% thermal power and 50% core flow. At this point
{
a turbine trip and loss of AC power would be initiated. A
[ scram results from loss of power to the RPS bus which in turn deenergizes the primary containment isolation equipment.
[ The MSIV's close to isolate the reactor vessel, drywell cooling is lost and all AC powered machinery is de-energized. The Emergency Diesel Generators energize the vital buses thereby 42
{
E .
LSCS providing power to ECCS equipment and other vital equipment.
ECCS's would remain in standby. A control rod drive pump is manually restarted to provide recirculation pump seal cooling and CRD pump cooling. The first SRV group would lift as a result of the initial pressurization. The ADS low-low set-( point logic would automatically energize to control vessel pressure.
Subsequent to the initial transient the following would occur:
[ a. RCIC is manually started before level 2 is attained to pre-empt HPCS initiation.
- b. Reactor water level will be controlled at normal water level after recovery by RCIC.
[
- c. Drywell cooling remains off (no energy source).
[
- d. RCIC cubicle cooling remains off for the same reason.
F L
- e. Approximately 5 minutes into the test a vessel cooldown will commence via an SRV to maintain approximately N100 F/hr cooldown rate. Reactor l vessel pressure will be reduced to the assumed
{ minimum operational pressure for RCIC (165 psia) .
43
LSCS 2.5.3 Test Termination The test would be terminated under either of the following conditions:
- a. Upon determination by the test director that sufficient data had been collected.
- b. Upon reaching a limiting value for a system parameter per Table 2-1.
The plant would subsequently be brought to a normal hot standby condition by restoring all isolated systems via normal operating procedures.
2.5.4 Compromises in the Extended STP-31 Startup Test f
In this section, plant response and operator actions under
( station blackout conditions are compared to those under extended STP-31 test conditions to show compromises in the latter test approach.
{
2.5.4.1 Reactor Level and Suppression Pool Level Control Under actual blackout conditions, RCIC suction would be switched from the CST to the suppression pool (SP) early in order to
{
44
ISCS minimize SP level rise during reactor depressurization. This would also conserve cooler CST water for use later in the transient. In the extended STP-31 test, water for injection is drawn only from the CST. Thus, operator actions to control suppression pool levels during the test would not duplicate actual blackout conditions. CST water after passing through the reactor vessel would normally accumulate in the suppression pool as condensed steam. Suppression pool level would rise f airly rapidly during RPV depressurization in contrast to the expected slower rise (due to thermal expansion) corresponding to the genuine station blackout event.
The restriction to use only CST water during an extended STP-31 f test is necessary to avoid injecting suspended solids and impurities from the suppression pool into the reactor in a non-emergency situation. If injected, such impurities could
( result in corrosion and fouling problems in the reactor.
If activated, these impurities could produce higher plant radiation fields and thus increased man-REM exposure. The time required to clean up the reactor coolant prior to the resumption of power operation would also impose a significant
[ economic penalty in terms of lost power production.
[
[
[ 45 l
LSCS 2.5.4.2 Drywell Temperature Response In an actual station blackout, the operator would take the following actions in order to reduce the expected increase in drywell air temperature:
- a. a rapid depressurization of the reactor vessel would be initiated early in the event by holding open one of the steam relief valves;
- b. pressure would be reduced to the minimum required for RCIC to provide reactor level control.
- c. in an emergency situation during an actual station l
blackout, fire protection system water would be f utilized if necessary whereas in an extended STP-31 test, it would not be utilized for fuel contamination
(- reasons.
[
The extended STP-31 test conditions differs from actual station
( blackout conditions in the following aspects:
- a. The cool down rate from depressurization (5100 F/hr) is slower and thus would be less effective in controlling the peak drywell air temperature.
[
46
{
I __ --
LSCS This restriction is necessary in order to avoid a thermal cycle on the RPV which reduces its fatigue life.
- b. The low pressure control range for RCIC is about
(
100 psi higher in the test than it would be during a real blackout. This produces higher drywell
(
temperatures during the special test. This presumes f that some realistic time interval is available to extend. The restriction is desirable for test conditions because it provides margin to keep RCIC within its design operating envelope.
{
( c. Drywell spray is not used to cool the primary -
containment during an extended STP-31 test because
[ of the serious economic inpact of damaged drywell equipment, whereas in a real blackout situation with drywell threatened that option is available.
[
2.5.4.3 Suppression Pool Temperature Response
[
Suppression pool temperature response during an extended STP-31 test would not simulate station blackout conditions in the
[ following aspects:
[
[ 47
[ - - - - - - - -
- a. Heatup Rate Suppression pool heatup rate during the extended STP-31 test would be lower than during a station blackout because:
- 1. Pool water inventory is increasing due to the addition of CST water, and
- 2. The reactor is depressurized at a slower rate.
- b. Condensation Load Distribution For the test, the reactor would be manually depressurized by sequencing relief valves in order to equalize
{
condensation loads around the suppression pool.
These multiple valve operation increases the potential
[
for a SORV. In an actual station blackout, one SRV, or at most two, would normally operate under the low low setpoint logic unless manually over-
[ ruled.
[
This automatic action minimizes the number of r
L valve lifts hence the probability of a stuck open relief valve (SORV) . In either case, RPV depressurization 48
LS CS would be completed before suppression pool temperatures rose high enough to adversely affect the condensation of SRV discharge steam.
2.5.4.4 Battery Depletion Rate Under actual station blackout conditions, the batteries assume the-loads normally carried by their respective chargers as f well as additional loads such as emergency lighting off the 125-Vdc buses. All non-essential loads would be shed in order
( to extend battery life. In the extended S'JP-31 test , simulated load shedding is not equivalent because the rest of the plant
[
is energized and on standby during this test; i.e., DC power
[ is required for protective and control logics, for instrumentation, and for valve and pump motors throughout the plant. Battery
[ chargers would remain in service during the test to assure the availability of that DC power. As a consequence, battery
{
performance is not representative of actual station blackout.
[
2.5.5 Risks in the Extended STF-31 Test Scenarlo F
L 2.5.5.1 Excessive Drywell Temperature
[ Termination of drywell cooling results in an extremely rapid increase in drywell temperature. Assuming an initial drywell
[
h 49 T -----
LSCS temperature of 135 F at 15.4 psia (0.7 psig), the environmental design specification of 150 F for normal operation would be reached in less than 1 minute. Within 3 minutes, the dry-well air temperature will increase to 173 F where a high l drywell pressure LOCA signal (at 1.69 psig) is generated.
Temperature would continue to rise to a peak of approximately 250 F at 5 to 6 minutes into this test. These calculations are for bulk (average) drywell air temperatures. Much higher local temperatures may be experienced in thermal plumes above
[ individual heat sources (scram discharge piping, SRVs and SRV exhaust lines) and in the containment dome region. Even L. with prompt restoration of drywell cooling, drywell temperatures are not expected to return to normal for 5 to 30 minutes (optimum).
Longer exposures to excessive drywell temperatures could be
{ expected if difficulties are experienced with the restoration of cooling.
[
Accelerated aging and thermal degradation of non-safety equipment
[
are natural consequences of such excessive drywell temperatures.
[ Additional testing may be required to assure that the equipment is functional prior to restart, and premature failures may be experienced during operation following this test. Thus, plant availability is reduced as a result of excessive drywell temperatures during this extended STP-31 test.
[
[ 50
l LSCS Safety-related equipment in the drywell is expected to remain )
functional throughout the temperature excursion described above . However , the capacity of this equipment to survive future excursions (e.g . , LOCAs) is decreased by thermal exposures.
Reanalysis, requalification or replacement of safety-related equipment may be required for extreme local temperatures (SRV
{
actuators, for instance) and at a substantial cost.
Operator options to minimize drywell heatup without restoration
( of the AC powered drywell coolers are limited. Drywell spraydown would not be initiated for this test because of the certainty
(
of water damage to drywell equipment. The reactor could be depressurized rapidly to reduce drywell heat load, but this impcses a severe thermal cycle on the reactor pressure vessel,
[ reducing its design allowable fatigue lifetime and exposing CECO to the costs of re-analyzing fatigue and adjusting
{
vessel service life.
[
In summary, any test in which drywell cooling is turned off
[ with primary system at operating temperature will result in drywell air temperatures exceeding normal operating limits
{
within minutes. Drywell cooling must be maintained during
[ the extended STP-31 test to avoid unnecessary degradation of equipment in the drywell. This restriction prevents the determination of drywell thermal response to a station blackout case except as deduced from analysis.
[ 51 E- - __ -
LSCS 2.5.5.2 Stuck Open Relief Valve (SORV)
The extended STP-31 test stipulates the use of numerous relief 1
valves as a consequence of isolating the reactor and conducting I a slow, controlled depressurization. SRVs can fail by sticking open when the actuator is deenergized. This would result in an uncontrolled depressurization of the reactor vessel with associated loss of RCIC for inventory makeup.
2.6 Conclusions for the Evaluation of Station Blackout and Extended STP-31 Test The evaluations described in Sections 2.1.1 and 2.4 indicate f that emergency flexibility exists to maintain the plant in a safe condition should a station blackout occur. For a genuine event, it is expected that no limiting parameters could be exceeded prior to 1.5 minutes after total AC power loss.
Beyond that time, certain of the limits identified in Section
( 2.2 would be violated. These violations immediately place the plant in an unsafe condition however it is anticipated that adequate core cooling can be maintained or re-established using the EPG's thereby preventing fuel damage. Core cooling is provided via RCIC or if necessary reactor pressure is reduced via ADS to allow makeup with Fire Protection Water in a real
(
station blackout event. On this basis, the plant has the
( 52 T -
LSCS ability to withstand the blackout event and to be maintained in a safe condition until AC power is restored. The risk of fuel damage depends upon the time period available for reacquisition of AC power. The emergency injection of fire protection system water into the reactor coolant loop intro-duces non-reactor grade water into the core. With expected high transient temperatures on the fuel in contact with poor quality water, the possibility of fuel clad damage is very high. Degradation of fuel cladding is a significantly greater disadvantage (cost) than is the benefit from a dedicated black-out test, especially when I.G.1 objectives can be met via a simulator training of operators based upon analytical predictions of station blackout.
f An evaluation was made of an extended startup test (ST P-31) which is configured best to provide plant data on loss of AC power as input to plant operations (and possibP " .a training
{
simulator). In that configuration, the emergency power to
( vital buses was maintained from the diesel generators, thereby keeping ECCS equipment in ready status while also providing
[ additional monitoring capability. The drywell heatup rate was the constaining parameter again. The plant risk and potential economic impact associated with emergency actions in this
( extended STP-31 test data mitigate against pursuing it. This conclusion reinforces the concept that only a segmented or partial test approach can provide input for simulation of a station blackout on a trainer.
53
LSCS TABLE 2-1 EXTENDED STP-31 LIMITING PARAMETERS PARAMETER LIMITING VALUE (S)
- 1. Reactor Vessel Level
- b. Control Range Normal vessel levels 30 to 40 inches (RCIC on)
- 2. Cooldown Rate Tech. Spec. 5100 F/hr
- 3. Drywell Pressure <1.5 psig Selected to avoid high drywell pressure isolation signal at 1.69 psig
- 4. Drywell Temperature Tech. Spec. 135 F
- 5. Suppression Pool Level l
- a. Hi Level Tach. Spec. 26'10"
{
- b. Temperature, Maximum Tech. Spec. limit after MSIV closure 12d F
( 6. RCIC Room Temperature Normal Environmenta1 Conditions 150 F per Tech. Spec.
- 7. Steam Relief Valve Stuck Open
- 8. Recirculating Pump Seal Temperature, Alarm Setpoint 190 F Batterles
( 9.
Tech. Spec., Table 4.8.2.3.2-1 Category B 54 E-- __ _ . . . .
0 1
x 4
4 R 1 E
W O
P '
R O
T C
R E
H t ' 0 0
1 T
U O
K C
' A L
B N
_ O I
2 T 7 A T
S 0)
C R
' E E T
_ S F
A
( R E
W
- O P
E Y
' M A C
- 6 I E D
3T .
- 0 1
' 2 E
i R
U G
- i I
F i
Y i
. _ - - - - l 5 . 5 .O 1
1 . 0 0
CJ2On Cu J_C ~ -1 Z ~
_ u_O o Er u_
(
)
1.5 x10' .
~i VESSEL PRESSUFE I
i 1
- i E
m (n
Q v
0.5 LU -
CC -
J -
w i
/
EXTRAPOLATION s., .L -. --E----.*---
~
CC -
s _s _ _ , _ _ _ _ -
O_
~
O.
' ' ' ' l i ' ' ' . O36
- 0. 0.72 1.08 1.44x10' TIME (SEC)
FIGURE 2-2 VESSEL PRESSURE AFTER STATION BLACKOUT
.__-_r___
m rm rm r rt r- , e- , ,-- - -
? -N- N
[ ?. -
- . ..~ ~ - - - - . - -
}.
. j......_. . -
. g.
,a . _ _ . .
4 4_. _....p
..-g.
$1 .} L 4 ,
.;l,,
..{l 3 g_ ._ . . _.
9 . ._.
7_..
9 l _
3 ,. , 3. .. .
+'
._ .._.. _ .. __...- -.. _._.. ..__q. .-
_lp,.g 4 4. , . ,_ . ,
j*l; i tII I ! -I.. t*
j !
l l i
I il ~ "C l l ' l- l ---
t-800. ~f I
. -i i t i -
- t. .
il
! t '
l
...l 3
. . . _J. l... +r - --- --- - --- - - -- --- - --- ----- - - ---- ---- - - - - - ---- --- - - - -- -
h,- - -- - - -'- r --- -'- -
I- 'r.
ih l .}j
- . } ._. 1, l - -
-l j {. j, g7., I ,4-t
- i i- l .
i
- +fii
. - l i 4 li N -
' t l 9
- -4 00., ;{. --
t i ,
l g ,I it l4'g
,. l ,I
, l . ,
}
- i il . -
e t,__ l ga... f. q.,t ..#4 .-.. , _ _ - _ . . . _ _.. _.. _. . . ..__ ._. . ._.. .__..._ _. ..__._ __._. _
.-~r -P l l g t i t-a !,
.t tt-t' t t ;'
a t tt ! e I t 1, xm -$001- ei ---- r-
-T ,
,. e
'i ,,
i ,
1,,
i
- i e .*.* f,,l.
(I
]
i
{
t f
I f
t ll d.
m :,..
d
'f.
i,
,i.
.L i
e c
_ g _'. . _. . ._...
I
. ...1 __... _.
.. i.
. .h h
e, ,1.j_ ,
fl.L .
I
,I l ..
s ,!l,I- /l ,./
1
, 1,t. . i '.I : t. -
- ,. r- i 1.
> d--
i + --
a 100." ',,i. ti , --t.ii l t i / f 1: ti i
{
ii I
j r i ,;
ll! !' / f (
',j; r n-
,,4l
, j i ;,- ,
1 l
-l ;
rr i
sr y --
r-1 i l - -[ 7 - .r.
r -t 1
i T t-h
[,,
i in' l'!t 1 llll li..II I I; -tf,l
! I f . I. -!!.I. 1.i Ili! l' i, ,i. ll,1 i
.,.. , i, , .i i.
00 7 .; rnyo uiq.i,d m pp .o o!ii; 4:i,o -pi.p py ,n;E i pp ipi.i,E u -irrn o ui.' d. ingim o-
- 2p s-.
3 I
,;;3 i 2' i. o 1-i io4.. ..
u r3.zli.u. i.,i io;, . ': : ti ni, ,. :
. ; 309 :. i :.i . , .,
l TIME (SECONDS)
FIGURE 2-3 TEMPERATURE IN DRYWELL AFTER STATION BLACKOUT l
l
_=.E wEam$Ea. >QK 0 0 0 0 0 0 O 0 0 0 0 0 0 2 0 8 6 4 2 1 1
. . - - . - . - . . ~ - - . . - . . . - . . .
- 4
. T U
O
. K 3 C A
L R
D R N R O R
I t l i T u R A o .
T h h S t t i i .
R W W ) E S T
. R F U A O
. H E
, 2 ( R U
T
- R A
E E
- . M I
P M
_ T E T
N O
. I
- S S
. E R
P P
1 U
S c .
4 2
E R
U e ~ -
G I
F O
0 0 4 0 0 0 2 0 6 2 8 2 1 1 f
C _ Eare%wa.5H ;_e3 CG !
. zO mmw=SmV
. - )
p
v m rm r- r- , e, -
\
L, i .f ~..
~
'. f . . 2
$. J.{j... 4 gli . . .p
..! L ,, . l I. j
. I.
.... . . 1
- t. . , 4. .
i , j -} 4 . .
.[ .g.,.. .. gl .
p .
t 6 1 g l. .
.} ,. -
2 4 . .-- .+ - l.m.; - ---
- H.. ----- 4-- -- ----- ------ - --- - -- -
-+- ---- - ---.- -- -- 4 1
--l- . g ;
.4 4- l 1 e i 1 4 6
- 4.,- i 4 4
- { g l 6
't I.
- 2 3,I -t - t l {-
1
}- t-t
. j '.
, lI T,~
., .. , l -
- j. . -
l . -
l 22 '. . : 14-4-'
' ---i-- L-- bl 'I l.pl Ti
. .. . ., 8
. , . - t, i '
e l
.i i 6
. . . . ( -ltl
- . . . - .t t t f )./ -
---+
4 aC 4 2. l. -ir-- 7 /[il 3 ile l H .- tt,,(i t l. { y) -.. - e g ,,,1., - t l-4 ,' , , . . - 4( , g ' I ei , w .
.. g} ..
.f_
r g .1 8
. _ ...,.A.6 4 T,.
i , 2 Q ,6 . - n .. . .. .. .. __._.. ,_ _. _ . _.__.. .. _ - _ _... .. _ __-. . ._..___ . .. ._ . .._ , _ .. .. ._.. _, . . . .. _.__ g,t] - , , - ).,i- l l l l 4 m * .- t j l f . D ' " t , 1, i l t I i i U2 - - - 14 ? l}t t t i j l t ; v2 - 19* r-- .- N Z ,
.- -1lIt 4 t !
ll t, I t . t II 48 4 . f ( ; ji
,g f
..t-- f .
. .j. __ p_.
1.,i l l a , a .. } g , . . :_ . 4 . .. ... .
+ - . .._ _ ... .
]__ .4
- _,. .. .. __ . . - .
- , . .. __ w I I $, _._ +[
1 r ,- t>e- 1 .} I I .- I I l N i I 8
& .t'-
.4- I.
,s , .
,j g.7 j ,i .
% .a6 l f,9 ,
r-j f g 1.- - g- ---t Z -
- { - ,}9 - : -- ;
O - t * / .I f [ I I Il e i: r ri !
/ a . ) r I-I t - I 9 {1' 6 e;
. 7 tlif 3 .
. . . - i [ t i
_.. } g , .' ~. ,.yf ,i l l l p k .
}+. --p 5l
--t--*-.
t* e--
, t - -+;----
Il1 i t{e j e . ! . l '
. . ..: i.I L i6l . l t__ I gI1 l +f
}
L 'l
!...- .I6 f
.... i.:.
. i...: ii ..I ,li!
, 1,;,i.
1'j, i i l. !!: . l l 1, - si fi
-1k
. . 4 qi. i g i n y. i ,i
,i.g iiiii .l .nTn .., in iisy , g. . i si .-
; "p' i,iq
; g i vg i ni .-
10 ! g ln'Tr[! !1 3, '2 ; y
'~
6
- : . '1 7.1l j :l'09,,i: llt. ll : ir! f i . ! 10 2 lti! 104: l.l 11 TIME (SECONDS)
FIGURE 2-5 PRESSURE IN DRYWELL AFTER STATION BLACKOUT
\l l il l!1Il . 1 l!
l 0 0 2 F ' 6 ' 0 1 '
= ' 5 E 7 R 8 1
U T ' A R ' E P ' M 0 E - T i 5 1 L
/
A ' I T T - U I O N - K I 5 C A 2 L i 1 D N O p
' I T
A 0 T
- S i 0 ) R 1 S E
- R T U F
- O A f
l l
- ( E R
, - 5 E M U T i I A 7 T R
- E P
- - M E
- T
- M 0 O i O 5 R C
- I
- C r - R 5 r / 2 r 6 0 2
. [
- - - ~ - - - . . ...
O E r . . . . . . 0
. R U
0 0 0 0 0 0 G 8 5 4 3 2 1 0 I 1 1 1 1 1 1 1 F r aD wxoywSwE coo ! d l
- Om0:a r
i l( il l ,'
LSCS 3.0 EVALUATION OF PRACTICAL STATION BLACKOUT TESTING Section 3.1 presents the current licensing requirement for CECO to fulfill the I.G.1 objectives via alternate station blackout testing. Section 3.3 provides the details of the segmented testing which can be performed safely and which partially fulfills the I.G.1 objectives. Its practicality has not been fully established nor have detailed test plans been written for these segmented tests. This compilation represents the distilled result for the question "what can be done safely." 3.1 Summary of Test Requirement f The original NRC purpose of the test was to obtain data related to plant performance under the imposed condition of no AC power available for mitigation of transient effects. A related purpose was the training of operators in the recognition of and response to station AC blackout conditions. As described in Section 1.3.4, the test data could be used to represent ( realistic predictions of plant response to blackout conditions. Needed changes to training programs could be made as a conse-quence of testing inputs which are incorporated into a BWR [ training simulator for blackout events. E 55 I L ~
LSCS 3.2 Segmented Blackout Tests This section describes practical segmented station blackout tests that can partially satisfy the preceding requirement. The segmented test approach identifies additional testing which may be accomplished or scheduled during the Preoperational and Startup Testing Programs to obtain data pertinent to station blackout. This testing takes the form of either a special test or an addition to a startup test. Such tests accumulate data without placing the plant in an unsafe condition. The tests are scheduled at a convenient point during the first f fuel cycle, with the constraint that adequate decay heat exist to provide a valid test. Performance of any test is made contingent upon 1) a favorable safety conclusion, 2) specific NRC test approval, and 3) a training requirement for the test { data that can not be fulfilled with analytical data. ( Also identified in this section are tests, predominantly preoperational and startup tests, that verify control, logic and functional performance of equipment (or systems) utilized during a station blackout or to recover the plant to a safe shutdown condition. ( The results from certain segmented tests have been reviewed or will be reviewed upon their completion by the NRC; they [ [ se
LS CS "do not need to be repeated to obtain any additional information." ! l Data can be drawn f rom these tests, as necessary, to support l the station blackout inputs to the simulator model. l 3.2.1 Definition of the Segmented Test Plan 3.2.1.1 Prerequisites In order to protect plant equipment and to assure public safety I during the segmented tests, the following restrictions are imposed: (
- a. Plant AC buses would not be deenergized, safety f equipment would not be separated from power sources, and emergency diesel generators would be available
( or running as backup, emergency recovery provisions to assure safe testing. { ( b. Low pressure ECCS functions would be in standby; tests would be planned to avoid initiation of [ these systems, but the systems would be permitted to function as designed in the event predefined { initiation points for specific tests were reached. [ [ 57
LSCS
- c. Plant instrumentation would remain energized in order to assure control of tests and to provide for data collection.
r d. Limiting conditions for operations as defined I in the Technical Specifications would not be violated. 3.2.1.2 Objectives The elements of the Segmented Blackout Test Plan are practical alternates to a dedicated station blackout test. Their composite objectives are as follows: ( a. To demonstrate the capability of available reactor equipment to maintain reactor water level and to control depressurization of the primary system; [
- b. To demonstrate the capability of available plant equipment to mitigate the loss of AC power transient
( without compromising conta inment integrity; [
- c. To demonstrate time-temperature parametr ic results
[ for the suppression pool and the RCIC cubicle resulting from the loss of AC power transient; { [ [ 58 r
LSCS
- d. To verify the availability of sufficient operational information to enable operator functional responses.
- e. To provide future realistic training opportunities on a BWR/5 simulator bled on test results.
- f. To review Engineering Operating Procedures against data obtained during SBO Segmentented Testing.
3.2.1.3 Planned Tests
- a. RCIC Cubicle Heatup Rate: A test will be designed to determine the heatup rate in the RCIC cubicle during full-flow RCIC operation without area cooling.
The result will verify the predicted time before room temperature exceeds the environmental temoerature limit of 1480 F. { [ b. Control Instrumentation: Verification will be made that adequate control instrumentation is L available to monitor reactor and containment parameters during an AC power outage. { ( c. Control Room Habitability: Loss of control room habitability due to high temperatures is not expected. 59 T -_ _
LSCS A test will be designed to determine the control room heatup rate without ventilation.
- d. Fire Protection System: A test will be made to demonstrate that the fire protection system can be lined up for emergency injection into the reactor vessel. A functional test of the Diesel Fire Pump injecting water into the vessel will not be done.
The data will be analyzed upon completion of the above tests cnd the results made available for NRC review and possible incorporation into a BWR/5 simulator model of the blackout [ event. ( 3.2.1.4 Existing Tests Supporting Station Blackout Analysis ( The following tests were satisfactorily completed or are nearing completion. Certain aspects of these tests are pertinent [ to a station blackout event. The results of these tests are or will be available for NRC review. [ a. STP-14, Reactor Core Isolation Cooling System Startup test, demonstrated satisfactory response { of the RCIC system over its expected range of 60 u e
LSCS operating pressures and flows. This includes the operating ranges assumed in the analysis for the station blackout event.
- b. Preoperational test PT-MS-101C (FSAR Table 14.2-39) verified proper functioning of the pressure relief valves, ADS and low low setpoint logic.
- c. Preoperational Test PT-AP-102 (FSAR Table 14.2-5) verified the 250-Vdc supply and that the Division I and II 125-Vdc batteries provided adequate DC power for the safe shutdown and cooldown of the reactor facility under both normal and faulted f (LOCA) conditions.
k d. Preoperational Test PT-DG-101B (FSAR Table 14.2-34) provided a capacity check of the Division III { battery as in "c" above. [
- e. LST 79-1, the La Salle In-Plant SRV test, demonstrated considerable suppression pool thermal margin for an extended SRV blowdown. The adequacy of the operational suppression pool thermal measuring
( system (SPTMS) was demonstrated also. E m 61
LSCS
- f. Startup Test STP-31, Loss of Turbine Generator and Offsite Power, demonstrated satisfactory reactor and electrical system response under a loss of offsite power. This was not a station blackout demonstration because the emergency diesel generators energized and provided power for ECCS and vital instruments, however, the initial transient in both events is similar.
- g. Startup Test STP-25, Main Steam Isolation Valves, will verify plant response following an MSIV closure from about 95% thermal power. Startup Test STP-27, Turbine Stop Valve Trip and Generator Load Rejections, f will verify plant response following a turbine trip. these two tests will verify satisfactory responce of the plant and reactor during the initial transients similar to a station blackout event as far as reactor response is concerned.
[ [ [ [ [ [ 62
,- s
~
LSCS .
- a ; _-
4.0 CONCLUSION
S - ' l CECO has evaluated plant response to postulat'ed loss of _, c - - AC power and has assessed the extent ~to whlebJthat response, can be simulated by' dedicated blackout testing.. 3estrictior;s
,7 on testing necessary<to protect public hedith;4nd plant equipmgnt- + .
',,e u
prohibit a_ plant-wide' statio'6 blackout test and severely ljmit
~
the degree to wh @h expected AC power locs conditions can be s, [' -
% . a'.; ; - c. ~ ,
simulated i,n~Ehe reactor vessel and drywell
' As a consequence,; j ^ -
the value of a dedicated station blacy.out test for training- - _ c5pabilitie.E or providing operator fdmiliarization is minimal. A. , . s, - *
,& % ,z - , ,-
c' s v .- , Practical station blackout testing is.eqsent.} ally limited ,1 ^ to performance and responde testing witD. a limited'humber cd. s ' ( - [ s u '
~ ~. ;, ,
p. t specificsystemsandcompendhtswhere1 chi-ofJowei: p conditions \\ ,
. .- 2 4 ,
v ,, ( can be safety simulated. Such testing can generate' data which T-
,, 4 .s f /^
would provide increased confid'ence in the inalytical' methods J}, 'C 4.- . used to predict plant response. As i,nput for[DNTftl5 simulator
~
s , , ( for La Salle, such data can be used for mr$xinhni t. raining benefit,.' s
?
[ , '. = CECO will utilize data from the startup tests aad will conduct
, '[ "'
practical segmented power lofs tests to generate data on [ .-,., the response of individual 1.yctems.,and,coyponents to station { blackout conditions. Actualplantdataff,Ompreoperational tests and f rom startup teats can be ubed to validate th'e. analytical [ . .
. ~ ,
g
- f
LSCS predictions and fulfill the objectives of TMI Action Item I.G.1 via simulated station blackout on t ne La Salle reactor cimulator. The original NRC objectives are addressed through a composite ceries of segmented tests which are proposed by CECO in response to NRC concerns expressed in Generic Letter 81-04 (Reference 1). The objective of that effort was to verify plant response, to define operating procedures and tests for the blackout event from training experience viewpoint. CECO has analytically verified the initial plant response to station blackout (Section 2.0) and has draf ted this alternate plan (Section 3.0) to seek NRC endorsement prior to execution. By Generic Letter 83-24, NRC revised the thrust of TMI Action Plan Item I.G.1 and concluded that a meaningful BWR blackout test program, analogous to that for PWR's, could not be applied, hence that test parameters associated with station blackout and the related time constants for plant response be determined ( during preoperational and startup testing. Further, that incor-poration of these test results along with other training materials in the regular training program would adequately fulfill the [ IGl requirement of NUREG-0660 and 0694. This report responds to the early Generic Letter 81-04 to i [s iclosecut the original determination that a station blackout ( 64 f _ - - - - - - - - -
LSCS test is not to be performed at La Salle and the basis for that conclusion. But it also goes further into the definition of segmented tests that could contribute to training predictions and simulator models of the La Salle plant. The engineering evaluation of plant response to blackout was comprehensive enough to indicate what alternative tests might be use ful. Plant and equipment design have been reviewed to assure operability under segmented blackout conditions; analytical models have been constructed to predict the response of major plant parameters to various scenarios; and strategies have been developed which maximize the time that safe conditions can. be maintained while minimizing the risk of f ailure of key equipment. These efforts have demonstrated that CECO can obtain suf ticient test data from this segmented test approach [ to meet NRC's original objectives. Output f rom this engineering evaluation and segmented testing during the initial start-up program can be incorporated into revised BWR/5 simulation of the blackout event to upgrade ( operator training. This is the preferred method for broadening the training experience of operators to include station blackout. Any changes in training needed because of future segmented testing will be incorporated into operator training programs. u 65 E
LSCS Station procedures for recovery from a station blackout condition will be teveloped, as needed by addition to the Emergency Procedure Guidelines, with unique configuration inputs for La Salle Station. Any such procedures would of necessity require correlation with existing EPG's and implementing LPG's. CECO believes that this segmented test approach satisfies the regulatory objectives underlying the requirement for a station blackout test. It provides a workable alternative to a dedicated blackout test which is neither possible nor necessary to fulfill I.G.1 requirements. Hence, it responds to the second generic letter (83-24) by identifying the additional testing at La Salle which fulfills the revised NRC guidance. The BWR Owner's group recommendation which is the basis for generic letter 83-24 independently outlines test options from which the La Salle segmented testing is the practical part. ( NRC acceptance of this report is therefore sought to enable [ completion of these additional tests. [ l ( 66 { .
LSCS
5.0 REFERENCES
- 1. Generic Letter 81-04, " Emergency Procedures and Training for Station Blackout Events," dated February 25, 1981.
- 2. Generic Letter 83-24, TMI Task Action Plan Item IG1, "Special Low Power Testing Training," Recommendations for BWR's dated June 29, 1983.
( . ( r ( L [. [ [ 67 [}}