ML20084P546
| ML20084P546 | |
| Person / Time | |
|---|---|
| Site: | Vogtle  |
| Issue date: | 02/29/1984 |
| From: | Arnold E WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML20084P537 | List: |
| References | |
| WCAP-10529, NUDOCS 8405180259 | |
| Download: ML20084P546 (73) | |
Text
-_-
~
e WCAP 10529
.Q_0!!1 COLD OVERPRESSURE Mll! GATING SYSTEM Compiled by Approved R. W. Fleming E. C. Arnold, Manager February,1984 Safeguards Systems Systems Engineering N10
(
i Work Performed Under 5.0. YHTP-35010 WES11NGHOUSE ELECTRIC CORPORATION NUCLEAR ENERGY SYSTEMS P.O. Box 355 Pittsburgh. Pennsylvania 15230 0$bh4 A
f ABSTRACT l
The CONS (Cold Overpressure Mitigating System) is provided in the Westinghouse NSSS as a supplement to the administrative controls intended to prevent overpressure transients and the water relief valves in the Residual Heat Removal System which mitigate inadvertent overpressure transients to the Reactor Coolant System. This report provides the background information which led to the decision to provide the COMS.
This report also includes a description of the system and a discussion of the method used to establish the setpoints for the relief valves (PORV's) utilized in the COMS.
i
)
l 4
e r
l
I t
i FOREWORD 4
An internal Westinghouse technical review of the Cold Overpressure Mitig4 Ling System, conducted during the last quarter of 1983, led to a conclusion that a record of the COMS modification was needed.
This j
report is to satisfy that conclusion.
The Westinghouse personnel that participated in the review, under the chairmanship of W. 6. Poulson, Manager of Safeguards Systems, and who contributed to the preparation of this report were:
I E. C. Arnold W. S. Brown E. M. Burns R. Calvo M. L. Drury D. F. Oudek R. G. Edinger R. W. Fleming
- 6. G. Harkness W. T. Kaiser l
N. P. Mueller l
J. A. Schwab H. A. Sepp I
A. N. Sklencar 1
C. A. Vitalbo l
I' G
1 L
t
t CONTENTS i
Section Page 4
1.
Introduction 1
===2.
Background===
2 2.1 General 2
I I
i 2.2 Reported Events Up to June 1976 2
2.3 Administrative Controls 2
l 2.4 Introduction of CONS 2
i 3.
Description of System 5
l j
3.1 Function 5
3.2 General Description 5
3.3 Design Bases and Description of Equipment 8
3.4 Electrical Power 8
1 3.5 Instrumentation and Control 8
3.6 Operation 9
4.
Potential Overpressure Transients 12 i
4.1 General 12 4.2 Mass Input Transients 12 l
4.3 Heat Input Transients 14 4
4.4 Summary of Transient Evaluation 19 i
.l 1
e Page 5.
Technical Specifications and Administrative Controls 5.1 General 22 5.2 Deactivation of Safety Injection System 22 5.3 Limitations 4tgarding When Plant Will le Taken Water 23 Solid 4
5.4 Precautions When Operating in Water Solid Mode 24 5.5 Residual hat Removal System Isolation Valves Lockout 26 6.
Setpoit.t Determination 27 h.1 General 27 6.2 Pressure t.imlis Selection 27 6.3 Mass In'sut Constoerotion 30 6.4 Heat input Lnnsideration 30 6.5 Final Setpoint Salettien 33 7.
Instrument & Control Characteristics 34 7.1 P. essure Channels 34 7.2 Triptrature Channels 34 7.3 overall Trip Uncartainty 35 8.
Rslief Valve Characteristics 36 8.1 knerei'Oestription 36 8.2 51 V e Time 36 9.3 Flow teacity of Pony 39 11
e l
tibliography Appendix A)
M C General lesign Criteria 34; Residual Heat Removal B)
N#C tranch Technical Position IC58-3; Isolation of Low Pressure Systems from the High Pressure Reactor Coolant System C)
MC Branch Technical Position R$8 5-2; Overpressurization Protection of Pressurized Water Reactor While Operating at Low Temperature 0)
Westinghouse Standard Technical Specifications; Sections:
3.1.2.1 toration Systems 3.1.2.2 toration Systems 3.1.2.3 Beration Systems 3.1.2.4 Scration Systems 3.4.1.3 RCS:
Not Shutdown 3.4.1.4.1 RCS:
Cold Shutdown - Loop Filled 3.4.1.4.2 RC5: Cold Shutdown - Loops Not Filled 3.4.3 RCS Pressuriser 3.4.g.3 RC5: Overpressure Protection Systems 3.5.1 (CCS Accumulators e
3.5.2 (CC5: Tevg 1350'F 3.l.3 (CC5:
Tavs 1350'F t.
W Technical Bulleting N58-it-77-7, Residual Heat Removal Pump.
ill
mm ; a
- ,.. s....-
u
.e n a.
m / s p.": '.+.
..+ W e.
.v'a:.
1 e
1.0 INTRODUCTION
Overpressure protection for the Reactor Coolant System (RCS) is achieved by means of self-actuated, steam safety valves located high in the system on the steam space of the pressurizer.
These safety valves have a set presssure based on the RCS design pressure of 2485 psig and are intended to protect the system against transients initiated in the plant when the RCS is operating near its normal temperature. To avoid brittle fractures at reactor vessel metal temperatures below about 350*F, the allowable system pressure is substantially less than the normal system design pressure of 2485 psig.
Therefore, supplemental overpressure mitigation provisions for the reactor vessel must be available when the RCS and hence the reactor vessel, is at temperatures below about 350*F. One part of this supplemental protection is known as the Cold Overpressure Mitigating System (COMS).
Normally when the RCS is at a temperature below 350*F, the RCS is open to the Residual Heat Removal System (RHRS) for the purposes of removing residual heat from the core, providing a path for letdown to the purification subsystem and to control the RCS pressure when the plant is operating in a water solid mode. The RHRS is provided with self-actuated water relief valves to prevent overpressure in this relatively low design pressure system (600 psig) caused either within the system itself or from transients transmitted from the RCS. The RHRS relief valves will mitigate pressure transients originated in the RCS to maximum pressure values determined by the relief valves set pressure of 450 psig plus a pressure accumulation above the set pressure dependent on the liquid volume magnitude of the transient.
The low design pressure RHRS is normally isolated from the high design pressure RCS, during reactor power operation at temperatures above 350*F, by two isolation valves in series. Therefore the RHRS can be inadvertently isolated from the RCS by these same isolation valves. The COMS is intended to provide overpressure mitigation for the RCS addressing those transients which might occur when the RHRS isolation valves are inadvertently closed thus isolating the RHRS water, relief valves from the RCS.
f
2.0 BACKGROUND
2.1 General During the early years of operation of Westinghouse pressurized water reactors (1970-1976) a number of events were reported in i
which the RCS pressure exceeded the allowable limit for a i
particular low system temperature as prescribed by the ASME code Section III and 10CFR50 Appendix G.
The events were caused by equipment malfunction, incorrect operator action or a combination of the two.
In the vast majority of the events, the unintended pressure transient was recognized and terminated by the operator.
2.2 Reported Events Up to June.1976 Before the introduction of the 10CFR50 Appendix G requirements and before the COMS aetign was introduced in 1976, the prevention of overpressure transients while the plant was operating in the water solid mode was the responsibility of the operators of the plant.
No specific equipment was provided to automatically mitigate pressure transients because the operator was expected to observe the instructions and precautions provided to avoid causing unacceptable pressure transients.
Using the published Abnornal Occurrence Reports and information provided to the industry by the NRC in June 1976, an evaluation was made of the type of overpressure events which had occurred, their causative factors and the plant conditions at the time of the event. This review led to the general conclusion that 24 of the 29 reported events could be divided into two major categories 1) ness input (18 events) or 2) heat input (6 events) to an isolated constant volume of reactor coolant. The other 5 events were either of unknown origin (3) or were caused by operators following inadequate procedures while attempting to control the reactor coolant pressure.
The review demonstrated that of the 18 events caused by sess input to the RCS, by far the greatest number (14) involved a mismatch between the charging and letdown flows.
In all but one of these events, the mismatch was caused by a loss of letdown flow while the charging system remained in operation with a relatively low rate of mass input.
- I
, - - ----., _ _. - -.. - _. -. -.. _. -. -. -. - - -. ~. - -. -
4 t
The remaining 4 mass input events were the result of an abnormal, or inadvertent actuation of some portion of the safety injection system.
In the only event involving the actuation of safety injection pumps, a single safety injection pump was deliberately started by an operator and flow inadvertently entered the RCS.
In the other 3 events, the accumulator isolation valves were deliberately opened by the operator or inadvertently opened by a Ipurious signal from the engineered safety features actuation i
ci rcuits.
l For the majority of the mass input caused pressure transients, the abnormal condition was recognized and terminated by the operator.
The magnitude of the pressure transient was limited as a direct result of the speed of the operator in recognizing the situation and taking remedial action.
Among the few (6) reported events attributed to the heat input case, five were those in which a temperature asyminetry was allowed to develop in the RCS generally due to insufficient mixing. Then, when a reactor coolant pump was started, the cooler volumes of reactor coolant circulated around the system and were heated by warmer sections of the system, particularly the steam generators.
These heat input events were self limiting in that the temperatures eventually equalized and th6 magnitude of the pressure transient was not great. One of the events was the result of removing heat from the coolant such that the temperature was caused to decrease to a temperature below the allowable for the constant coolant pressure being maintained at the time.
2.3 Administrative Controls Until the mid 1970's, the strict administrative controls in effect during plant heatup and cooldown operations, when most systems are under manual control, were considered sufficient to avoid overpressure transients.
In fact, the vast majority of the transients reported prior to 1976 did not occur during normal plant operation but were caused during pre-operational testing, periodic surveillance testing or specially improvised tests.
4 As a result of several meetings with the NRC during 1975 and 1976, regarding the apparent growing number of overpressure events, renewed emphasis was placed on highlighting the normal operating guidelines and precautions to be observed during those operating modes which could lead to an overpressure event.
This renewed emphasis by the designers and operators of the plants however, could not completely address the overpressure concern since changes to the pre-operational and surveillance testing programs were increasingly being implemented. - -
--,,, - -,, -., - - ~., _,. -.,. - - -.
I 2.4 Introduction of CONS During the early months of 1976, increased NRC attention was focused on the reported overpressure events which had occurred primarily during testing. As a result, all PWR vendors were called to appear before the NRC on June 21, 1976, and told of the se.iousness of the issue and the need to prevent future events by some additional system / equipment means. Therefore, to address the NRC concerns, the design of the COMS was completed and made available to Westinghouse plants in November,1977. The purpose of the COMS was to supplement the normal plant operational administrative controls and the water relief valves in the RHRS which had not prevented nor sufficiently mitigated past overpressure events.
I,
f
3.0 DESCRIPTION
OF SYSTEM 3.1 Function The Cold Overpressure Mitigating System (COMS)' is designed to provide the capability, during relatively low temperature Reactor Coolant System operation, to prevent the RCS pressure from exceeding allowable limits. The COMS is provided in addition to the administrative controls, to prevent overpressure transients and as a supplement to the RCS overpressure mitigating function of the Residual Heat Removal System (RHRS) water relief valves.
The system is designed with redundant components to assure it will perform its function assuming any single active component failure.
3.2 General Description The COMS shown schematically by Figure 3.1 and described in the following paragraphs applies to the Westinghouse reference Model 212, 312, and 412 plants.
The power operated relief valves (PORV) located near the top of the pressurizer, together with additional actuation logic from the wide-range pressure channels, are utilized to mitigate potential RCS overpressure transients which might occur if the RHRS water relief valves are inadve'rtently isolated from the RCS.
The COMS provides the additional relief capacity for the specific transients (See Section 4.0) which would not be mitigated by the RHRS relief valves and thereby maintain the system pressure below the limits determined by use of the 10CFR50 Appendix G. requirements.
Each pressurizer relief valve (PORV) is signaled to open should the RCS pressure approach an unacceptable pressure for the particular temperature of the reactor coolant.
The relief valves are simple open-close valves with no throttling action except that which occurs during the stroke period.
The function of the instrument system actuation logic, shown by Figure 3.2, is to monitor both the RCS temperature and pressure, whenever the temperature is below about 350'F, to ascertain when an unacceptable condition regarding the Appendix G requirements is
~
being approached.
The wide-range RCS temperature indications are auctioneered to select the lowest temperature and this low signal is processed through a function generator to calculate the maximum acceptable pressure for the prevailing temperature. The calculated pressure is then compared with the indicated RCS pressure from a wide-range pressure channel and if the indicated pressure exceeds the calculated value, a PORV will be signaled to open. The determination of the pressure setpoint program for the PORV's is described in Section 6.0.
i,
..m.-
m.
l FIGURE 3.1 i
TRAIN B
.t P0'[ER_'0P,
_4.
e y
L:
)
(LT) i eREssuRizEa REtiEr innx
^
~
~
SPRAY PRESSURIZER t
I l
F
(
RCS HOT LEG FUNCTION P - - - - +
GENERATOR /
(SEE FIGURE 3.2)
COMPARATOR
+
TRAIN A r
a 1
4
f FIGURE 3.2 CONTROL LOGIC FOR EACH PORV RCS TEMPERATURE CHANNELS T
I T
l T
T l
I
____j i
i c _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _!
4 AUCTIONEER LO T
~
RCS PRESSURE v
CHANNEL P y (T)
/
P =f Q
APPENDIX p
G LIMITS I
l i
l V{
4 _ _ _ _ _.j MAINTAINED POSITION l
l ARM BLOCK I(P P
1 N
)
b v,
=A v
OPEN VALVE. -. -
I 3.3 Desian Bases and Description of Eautomen+
l The PORV's are destgised to limit the RCS pressure during normal l
l operational transients when the reactor is at power, by discharging steam to the pressurizer relief tank (PRT) thus avoiding the need for the code safety valves to function. The flow capacity and stroke time of the PORV'S are selected to avoid a reactor trip during a large step load decrease.
In addition, the valves are utilized for pressure relist (Water, gas or a mixture) as a part of the COMS and when performing this function they also discharge to the PRT. Two valves are provided for the COMS function so that if one valve fails to actuate when required, the second valve will be available to mitigate the transient.
3.4 Electrical Power The electrical power to the instrumentatMr. nnd the actuating system is provided by two separt; in$apendent sources so that a single failure in the * % trical equipment will not prevent the operation of at legn one PORV.
3.5 Instrumentation e.d control Figure 3.2 describes the control for one train (i.e. one of the two PORV's).
The RCS pressure is monitored by several independent wide-range pressure channels which typically measure hot leg pressure.
These channels are capable of measuring and indicating the RCS pressure over the range of 0 to 3000 psig. The COMS signals derived from two of these channels are typically in the range of 400 to 2335 psig.
Each PORY is associated with one of the wide-rsrge pressure channels so that a failure of one channel will affect only one PORV.
The RCS temperature is monitored by several indeper. dent wide-range temperature channels in both the hot and the cold legs. A group of the temperature signalt are auctioneered for the lowest indicated temperatur'e and this lowest temperature is processed in a function generator to calculate an acceptable PORY pressure setpoint'for i
the particular temperature based on the Appendix G requirements.
Two separate independent auctioneering circuits and function i
generators are provided so that a single failure will adversely affect the actuation of only one PORV.
4.
t The setpoint calculated by the function generator is compared with the indicated wide range pressure signal and if the indicated pressure approaches the setpoint an alarm will be sounded in the control room to warn the operator of a potential actuation of the relief valve.
If the indicated pressure continues to increase to the calculated setpoint pressure, the relief valve will be signaled to open to mitigate the transient.
3.6 Operation During a norwal plant heatup, the RCS is open to the RHRS and is operated in a water solid mode until the steam bubble is formed in the pressurizer. During these low-temperature, low-pressure operating conditions the CDMS is armed and in a ready status to mitigate pressure transients which might occur if the RHRS is inadvertently isolated. Af ter the steam bubble is formed and the pressurizer water level is at the normal value for no-load operation, the RHRS is manually isolated from the RCS and the plant continues to be heated while the system pressure is controlled by the steam bubble. When the reactor coolant temperature has increased above about 350'F the COMS is manually disarmed.
While the plant is in normal operation, that is, in Operating Modes 1,2 or 3, (defined by the Technical Specifications) the COMS is not armed and is maintained in a passive mode.
During a normal plant cooldown, the COMS is manually armed as the reactor coolant temperature is decreased below 350'F. Note that at this time there it a steam bubble in the pressurizer and the water level is at the normal level for no-load operation. The RHRS is then placed in service by opening the section isolation valves thus making the RHRS water relief valves available to mitigate pressure transients. When the coolant temperature has been decreased to 160*F by the operation of the RHRS, the steam bubble nay be quenched and the reactor coolant pumps stopped.
From this point on in the cooldown, the plant is water solid and if the RHRS becomes inadvertently isolated, the CONS will bc in an active status ready to mitigate pressure transients which might occur.
After the plant reaches the cold shutdown condition (Modes 4 ar.d 5) and is being mainteined cold by the RHRS, the COMS remains in an active status to backup the water relief valves in the RHRS should the RHRS become inadvertently isolated..
f When the RCS is operated in the water solid mode, the pressure is automatically controlled by the low-pressure letdown valve in the Chemical and Volume Control System (CVCS). This valve sehses the pressure in the letdown line (Pi on Figure 3.3) and maintains the pressure at the selected control value by throttling the letdown flow from the RCS. At this time, the charging flow into the RCS is set at a constant value and is controlled by the charging flow control valve.
It should be noted that the pressure being controlled is that in the letdown line which then indirectly controls the RCS pressure.
However, if the pressure drop through the RHRS and the bypass line into the CVCS is changed by throttling of valves or changing the flow rate through the RHRS, the RCS pressure will also change since the location of the controlled pressure is in the letdown line.
1 S.
iIl l
no i
t e
ea nrl rc wuo ui osr sf dst si t en wer ero w
oru LPC o
LPP V
l C
Fl P
o D
gr nt r
[
i n go U
rC a
V h/
q'H C
i C
H X
s '-
C V
H C
H s'
'l
,i d
H R
HX X
RH H
j
,i x
3 g,
3 p
E m
R G
u U
S f
P ee G
iv R
/
l Rll H
f O
/
Hea R
RRV t
')
r VR o
tcae f
7 1
f i'
4 4
f 4.0 POTENTIAL OVERPRESSURE TRANSIENTS 4.1 General Potential overpressurization transients to the reactor coolant system (RCS), while at relatively low temperatures (less than about 350*F), can be caused by either of two types of events to the RCS:
that is, mass input or heat input. Both types result in more rapid pressure changes when the RCS is water solid. Therefore, the descriptions of the following two types of transients imply that the RCS is water solid, at a relatively low temperature and is open to the residual heat removal system (RHRS).
Mass Input Type Transients:
M1.
Inadvertent safety injection M2.
Charging / letdown flow mismatch Heat Input Type Transients:
Hl.
Actuation nf oressurizer heaters or H2s Loss of residual heat removal cooling or H3.
RCP startup with temperature asymmetry within the RCS or between the RCS and SG 4.2 M_a}s Input Transients M1 Inadvertent actuation of safety injection considerations irclude full system (both trains), single train or single component within a train events. Each of the three types of events are discussed separately.
Full system actustion u gid include the opening of the isolation valves on all SI accucalators, startup of all low-head and high-head safety injection pumps and isolaticn of the normal letdown path to the Chemical and Volume Control System. Such an event would result in unacceptable, large volanes of coolant being forced into the RCS. Therefore, such events must be prevented by strict administrative contsois which require the blocking of the automatic SI actuation circuits, immobilizing the SI accumulator motor operated isolation valves (by locking out their power supplies) and locking out power to the high-head safety injection pumps.
(See Section 5.2).
In a typical Westinghouse design, the low-head safety injection (RHR) pumps are normally in operation, taking their suction from the RCS, during low-pressure, l
~ - - - - - - _. _ -
t low-temperature plant operations. Therefore, even if a spurious start signal were received, the low-head safety injection (RHR) pumps would not function in their safety injection mode.
The probability of a single train actuation is not much different than a full system actuation since the signals which call for safety injection, both manual and automatic, are normally processed through the engineered safety features logic circuits such that a signal whether spurious or not, will impact both trains.
Therefore, since the safety injection system is essentially immobilized at low temperature, single-train, inadvertent actuation is considered no more likely than full system actuation.
Inadvertent actuation of a single component would require that a Juman operator selectively unlock the electrical power to the component and then cause the component to be energized. The most probable way for this event to occur would be during periodic surveillance testing required by the Technical Specifications or
~
during post maintenance check-out of the component.
Deliberate opening of an SI accumulator isolation valve while the accumulator is pressurized with gas is not considered probable because there is no Technical Specification to test the isolation valves at shutdown and prudent maintenance procedures for the valves would likely require that the compressed gas in the accumulator be removed.
I Post maintenance check-out or periodic surveislance tests however.
might be attempted on a high-head safety irgection pump providing an opportunity for operator error to cause an inadvertent single pump injection event. Therefore, a single pump startup event during surveillance testing or following maintenance is considered a potential mass input transient but, since the RHRS would be open tc the RCS at this time, an RHRS relief valve would mitigate the i
resulting RCS pressure transient.
i El. Charging / letdown flow mismatch events can be postulated to occur in a number of ways. One way would involve the complete termination of letdown, such as by closure of the letdown control 1
i valve, isolation of the RHRS/CVCS crossover path or closure of the j
RHRS inlet isolation valves caused by malfunctions of the control systems. =A second way would involve an increase in the charging flow by either operator or instrument error such that the charging flow exceeds the prevailing letdown flow.
The most severe mass input transient would occur il the letdown flow controls failed to the zero flow condition while the charging flow controls failed to the full flow condition. This failure mode would result in the maximum charging / letdown flow mismatch event but does not result in the isolation of the RHRS relief valves from the RCS. Therefore, an RHRS relief valve would mitigate this transient and prevent an overpressure condition in either the RHRS or the RCS.
l l. - _.
4 9
l The most likely way that a charging / letdown flow mismatch would occur is for the RHRS (and relief valves) to be inadvertently isolated from the RCS by spurious closure of the RHRS inlet 3
isolation valves. Such a spurious closure is credible due to the presence of the automatic closing signal required by the NRC (see i
Section 9.0).
Since this spurious valve closure event causes an RCS pressure transient by stopping the letdown flow and negating i
the pressure control and concurrently isolating the RHRS relief valves from the RCS, it is considered a " design bases" transient i
for the CONS. The maximum mismatch in flow rates for this case will be on the order of 100 to 150 gpm, the maximum normal charging j
flow rate into the RCS.
l l
4.3 Heat Incut Transients l
Hl. The inadvertent actuation of the pressurizer heaters when the pressurizer is filled solid will cause a slow rise in the water i
i temperature (~50*F/hr) with a consequent increase in pressure of the constcnt volume RCS (See Figure 4.1) Since the 1
temperature / pressure transient is very slow, the operator should recognize and terminate the transient before an unacceptable l
j pressure is reached. The RHRS is open to the RCS whenever the pressurizer is filled solid, in accordance with administrative i
i controls (see Section 5.3).
Therefore, the RHRS relief valves will
)
be actuated, negating the need for COMS, if the operator does not first intervene and stop the transient. This case is not considered significant to the' design of either the RHRS relief valves or the COMS.
i Hl. A loss of residual heat removal cooling while the pressurizer is filled solid could be caused by a loss of flow malfunction in j
the service water or component cooling water systems or the closure of the RHRS inlet isolation valves. The continual release of core 4
i residual heat into the reactor coolant, with no beat rejection to
}
the environs, would cause a slow rise in the coolant temperature
)
and pressure (See Figure 4.1).
Since the transient is slow, the operator should respond and either restore the 9 HRS valves to their l
open pcsition, restore cooling or limit the RCS pressure by venting l
l the pressyrizer. This transient is not considered significant to t
j the design of the CONS since it is a relatively slow transient j
compared to the heat input transient Hl.
4 e
i i, _-
t 1600
~
RCS/SG AT = 50 F 1400 - -
1200 FIGURE 4.1 AL HEAT INPUT TRANSIENTS 1000 NO RELIEF VALVE ACTUATION a
M a.
800,
E v
i IE i
O 600 <
g C
i 400 f
LOOP SEAL hT = 120er 200,
DECAY HEAT ADDITION E,AESSURIZER HEATERS 20 40 60 80 100 TIME. SEC.
-r
t Hl.
During plant heatup and cooldown operations, administrative controls (See Section 5.4) require at least one reactor coolant pump be maintained in operation whenever the reactor coolant temperature is greater than 160*F. Therefore, the large volumetric flow throughout the RCS will maintain an isothermal condition in the RCS. The steam generator secondary side water immediately surrounding the tubes will also remain at a temperature near that of the circulating reactor coolant on the primary side.
During normal cooldown operations, when the reactor coolant tanperature has been decreased below 160*F the reactor coolant pumps may be stopped. Subsequently, isothermal conditions in the RCS may no longer exist. The reactor coolant temperature will be decreased below 160*F by heat rejection through the Residual Heat Removal System. The steam generator contained water (both primary and secondary) may remain at a relatively constant temperature greater than the RCS temperature since there may be little circulation through the tubes.
Therefore, a significant temperature asymmetry between the SG water and the reactor coolant may develop.
If a reactor coolant pump were to be started, the sudden heat input into the reactor coolant from the steam generators would cause a rapid increase in reactor coolant temperature.
If the event should occur while the pressurizer is filled solid, a rapidly increasing pressure transient would occur.
]
Normally, the RHRS is open to the RCS when the pressurizer is
]
filled solid, so that the relief valves in the RHRS would be available to mitigate the pressure transient if the event should occur.
In accordance with typical administrative controls, the plant will be under water solid conditions only while the RHRS is in service, and at least one reactor coolant pump will be in operation at reactor' coolant temperatures above 160*F. Therefore, this type of 4
heat input transient will be limited to initial coolant temperatures below 160'F. Since it is not practical to determine a representative temperature for the large stagnant volume of secondary water in the steam generator, the operator will not be aware that the temperature may be substantially different from the
]
primary s,ide reactor coolant.
From the initial isothermal l
temperature of 160*F when the RCP is stopped, the bulk reactor coolant temperature is unlikely to decrease below 110'F without i
some extraordinary cooling means while the steam generator water may remain near 160*F. Therefore, the differential temperature is not expected to be greater than 50*F for this type of heat input transient.
i
f I
If the pump start event should occur with a steam bubble of the normal no-load volume present in the pressurizer, the resultant expansion of the reactor coolant due to the sudden heating would be i
acconmodated by an insurge into the pressurizer with only a small reactor coolant pressure change. Therefore, administration controls require that a RCP not be restarted during a plant cooldown unless a steam bubble exists in the pressurizer.
(See Section 5.4)
During normal plant heatup operations, the reactor coolant pumps remain in operation throughout the water solid condition and the steam generator secondary water temperature will remain equal to or slightly less than the primary side. Therefore there is no opportunity for the heat input case to occur due to a temperature asymmetry between the RCS and SG. However, if the reactor coolant
) umps are stopped and the cold charging and seal injection water are continued in service, a relatively cold volume of water could i
be developed in the vertical pipe loop below the reactor coolant pumps (See Figure 4.2).
A restart of a RCP in a water solid system would cause a sudden heating and mixing of the coolant and result in an increasing pressure transient. Therefore, administrative controls (see Section 5.3) require that the RHRS remain open to the RCS until the steam bubble is formed in the pressurizer so the RHRS i
relief valves are available to mitigate the transient.
Under most plant operating conditions during heatup, cooldown or at cold shutdown conditions, the RHRS loop is open to the RCS and heat input transients will be mitigated by the RHRS relief valves. Only when the normal volume steam bubble exists in the pressurizer is the RHRS deliberately isolated from the RCS thus making the RHRS relief valves not available to mitigate RCS transients.
If the RHRS is inadvertently isolated from the RCS by closure of the isolation valves, (as by a spurious operation of the auto-close '
interlock required by the NRC) while the plant is water solid and in Mode 4, the Technical Specifications require that a reactor coolant pump be restarted within one hour if an RHR loop is not returned to service.
During the potential one hour delay period, a temperature asymmetry in the reactor coolant loops, due to the continued input of cold seal injection water, could develop and not t
be apparent to the operator.
Then when the reactor coolant pump is restarted, an increasing pressure transient will occur. This particular heat input transient is therefore considered a " design bases" transient for the COMS because the RHRS relief valves would t
not be available to mitigate the transient since the RHRS isolation valves are closed.
1
e -
e FIGURE 4.2 STEAM GENERATOR 1
8 6
}_
_ ri A
PUMP J
!l told Pump Seal bb '
Injection Water ' Q_
=
1 4
~
g
-t----
..w_
y 9
y-a
4.4
. Summary of Transient Evaluation Based on the above discussion, most of the identified mass input and heat input transients, which might occur while the plant is water solid, will be mitigated by a relief valve in the RHRS.
However, for those remote cases which occur when the RHRS has become isolated from the RCS, (most likely caused by the spurious closure of the RHRS inlet valves by the auto-close interlock), the COMS may be called upon to mitigate certain increasing pressure transients. Specifically, the COMS design bases transients are defined as:
- 1) the mass input transient caused by a charging / letdown flow mismatch after the termination of letdown flow and 2) the heat input transient caused by the restart cf a RCP pump when the RHRS is not open to the RCS, i.e., the isolation valves are closed and a temperature asymmetry exists within the RCS due to the continued injection of cold seal injection water.
2 1
I l
i l
(
l l l
t Table 4.1 RCS Overcressure Mitigation While Operatina at low Temperature i
Part I Plant Conditions The following Plant Conditions (primarily RCS ar.d RHRS) are those which are relevant to the overpressure concern at low system temperatures (i.e.
below 350'F). The reference to Operational Modes is consistent with the definitions in the NRC's Standard Technical Specifications but the definition of Plant Conditions is unique to this report.
Plant Condition 1.
During Mode 5, Cold Shutdown operations:
RCS loops and pressurizer filled or not filled RCP's not in operatioil RCS temperature: 70< T < 160*F RCS pressure: 0 < P < 450 psig RHRS pumps in operation to remove residual heat and RHRS open for RCS letdown Plant Condition 2.
During plant heatup (Modes 4 & 5):
RCS loops and pressurizer filled (water solid)
One or more RCP's in operation RCS temperature: 70 < T < 350*F RCS pressure: 325 < P < 450 osig RHRS pumps not in operation but RHRS open for RCS letdown ano pressure control Plant Condition 3.
During plant cooldown (Mode 5):
RCS loops and pressurizer filled (water solid)
At least one RCP in operation RCS temperature: 160 < T < 200'F RCS pressure: 325 < P < 450 psig RHRS in operation for cooldown, letdown and pressure control
I Plant Condition 4.
During plant cooldown (Mode 5):
RCS loops and pressurizer filled (water solid)
RCS's not in operation RCS temperature: '10 < T < 160'F RCS pressure: 0 < P < 450 psig RHRS in operation for cooldown and letdown Part II Desian Transients 1.
RHRS water relief valves (one or two depending on the particular plant design) are provided to mitigate the following pressure transients (due to mass or heat input) initiated in the RCS while operating in water solid mode:
a) Mass input during plant heatup, cooldown or at cold shutdown conditions (Modes 4 and 5); Plant Conditions 1, 2, 3, or 4:
1.
Inadvertent start and injection into RCS by one safety injection pump.
2.
Simultaneous loss of letdown and failure of charging flow control to maximum flow conditions (one charging pump).
b) Heat input during plant cooldown (Mode 5); Plant Conditicn 4:
i 4
1.
Cooldown of RCS by RHRS to 110*F (RCS to SG tem;erature asymetry of 50*F) and subsequent restart of RCP.
2.
Cold Overpressure Mitigating System (two PORV's) is provided to mitigate the following pressure transients initiated in the RCS if RHRS becomes inadvertently isolated due to spurious closure of isolation valves or operato. error while plant is operating in water solid made:
a) Mass in'put during plant heatup (Modes 4 and 5); Plant Conditions 1 2, 3, or 4:
Loss of letdown caused mass input transient (up to about 150 gpm) and loss of RCS pressure control.
b) Heat input during plant cooldown (Mode 5); Plant Condition 4:
Isolation and consequent loss of function of the RHRS requires restart of RCP with possible cold loop seal (minimum 40*F) and warm RCS components (maximum 160*F).
. _ = _ __
e j.
5.0 TECHNICAL SPECIFICATIONS AND ADMINISTRATIVE CONTROLS 5.1 9eagal All reactor plant operations are guided by administrative controls which specify the availability of equipment, systems alignments and ranges of process parameters. The administrative controls are intended to prevent deliberate plant operations which would result in potentially unsafe or unacceptable plant conditions. These administrative controls are identified in either 1) The Technical Specifications issued by the NRC or 2) The Precautions, Limitations i
and Setpoints document, special notes and limits in operating instruction guidelines and technical bulletins issued by Westinghouse.
5.2 Reactivation of Safety Injection System j
The Standard Technical Specifications (STS) describe the ECCS requirement to have a minimum number of components available during j
Operational Modes 1, 2 and 3 (STS Sections 3.5.1 and 3.5.2) and also for Mode 4 (STS Section 3.5.3) to assure that sufficient emergency core cooling capability will be available. However, the j
footnote to STS Section 3.5.3 also specifies that a maximum of one j
centrifugal charging pump and one safety injection pump shall be operable, when the RCS temperature is below 275'F,* thereby attempting to limit the magnitude of potential mass input i
The Technical Specifications permit the blocking of the actuation circuits from the pressurizer and steam lines instruments to 1
prevent SI actuation at low system pressure and temperature. This j
administrative control to manually block the circuits when the 1
system parameters are below the instrumentation permissive j
setpoints is susceptible to spurious actuation, i.e., unblocking, and is not considered a positive protection against inadvertent safety injection.
t
)
1 In addition to the administrative permission to limit the flow I
capacity or block the safety injection actuation circuits, provided j
by the Technical Spectiications, Westinghouse has provided operating' instruction (0.I.) guidelines and the Precautions, Limitations and Setpoints (PLS) document which specify the i
)
following additional requirements to avoid or limit potential RCS overpressure transients which might originate from spurious
)
actuation of the Safety Injection System:
'Although the STS shows a temperature of 275'F, the appropriate i
value varies from plant-to-plant and is likely to be as high as i
350*F. Note also that the mass input transient resulting from the j
actuation of one train of ECCS may be greater than the relief i
capacity of the RNRS relief valves at the low RCS pressures of concern.
i l
}
}
-??-
l l
During Plant Cooldown and Depressurization:
o " Block the automatic safety injection circuit when the reactor coolant pressure is reduced below the automatic unblocking setpoint. The operator must be prepared to manually tctuate the system if required." (consistent with STS Section 3.3.? permission) i o "Close the accumulator isolation valves and lock out the valve controllers when the reactor coolant pressure is less than 1000 psig and the temperature is less than 425"F." (see STS Section 3.5.1)
"When the reactor coolant pressure is less than 1000 psig, lock o
out the safety injection pumps and non-operating charging pumps."
(see STS Sections 3.5.2 and 3.5.3 for operability requirement)
Durina Plant Heatup and Pressurization
" Unlock all safety injection and charging pumps after the o
pressurizer steam bubble is formed and the residual heat removal loop is isolated."
4
" Unlock and open the accumulator isolation valves when the reactor o
coolant pressure approaches 1000 psig." (STS Section 3.5.1)
" Verify that the safety injection actuation block is automatically o
removed at the pressure setpoint." (STS Section 3.3.2) 5.3 Limitatjons Regarding When Plant Will 8a Taken Water Solid The Standard Technical Specifications do not completely address the i
issue of when or under what conditions the RCS may be water solid except that in Modes 1, 2 and 3 the pressurizer must not be water solid (STS Section 3.4.3).
By impli:ation the pressurizer may be water solid for Modes 4, 5 and 6 (i.e., RCS temperatures below 350"F).
l However, the Westinghouse 0.I. guidelines and PLS document specifically l
state that the RHRS must be open to the RCS whenever the plant is
{
taken to the water solid mode. The statement is as follows:
i "Do not isolate the RHR inlet line from the reactor coolant loop o
unless there is a steam bubble in the pressurizer. This precaution is to assure there is a relief valve (i.e., RHR water relief) protecting the reactor coolant system when it is at low pressure and solid water."
I
(. -.
'f I
5.4
_ Precautions When Operating in Water Solid Mode i
The Standard Technical Specifica'tions do not provide operational guidance when operating in the water solid mode under Operational Modes 4, 5 and 6 except to require that when the RCS temperature is below 275'l in Mode 4 and when in Modes 5 and 6 with the reactor vessel head in place, that there be overpressure protection systems operable (STS Section 3.4.9.3).
l To assure that the capability to borate is available in Modes 4, 5 and 6, STS Sections 3.1.2.1, 3.1.2.2 and 3.1.2.3 require that one charging pump be operable.
Also, the Westinghouse 0.I. guidelines specify that l
seal injection flow be provided when the system is full which requires j
that one charging pump be in operation. Therefore, there will be l
charging and letdown flows when the plant is water solid. STS Section
]
3.1.2.4 also specifies, by means of a footnote, that a maximum of one l
centrifugal charging pump be operable when the plant is in Mode 4 and relatively cold. This footnote is an attempt to limit the magnitude of 3
potential mass input transients.
i Section 3.4.1.3 of the STS, which is applicable to Mode 4, does recognize, in a footnote, that restart of a reactor coolant pump in a water solid system can cause heat input type pressure transients.
However, in a second footnote, the STS gives permission to have no RCS flow for up to one hour which will result in temperature conditions in the RCS conducive to a pressure transient when a reactor coolant pump is restarted.
I Similarly, Section 3.4.1.4.1 of the STS, which is applicable to Mode 5, again permits RCS temperature conditions to be developed which are conducive to pressure transients although it is less likely that a i
reactor coolant pump will be restarted while in Mode 5.
P However, the Westinghouse 0.I. guidelines and PLS document provide inar.y caution statements which are intended to prevent overpressure transients
)
in the RCS and thus the need to challenge the water relief valves in the
]
RHRS, or if the RHRS valves are not available, the COMS.
i To avoid mass input transients resulting from a chirping / letdown flow
]
mismatch taused by operator action, the following caution statuent is i
provided in the 0.I.'s and PLS:
i o "Whenever the plant is solid water and the reactor coolant pressure is being maintained by the low pressure letdown control
{
valve, letdown flow must bypass the normal letdown orifices via the residual heat removal system with the isolation valve in the bypass line in the full open position.
During this mode of operation, all three letdown orifices must also remain open." --
.. w
t A special type of charging / letdown flow mismatch transient which can be initiated by the operator, when under water solid pressure control, involves changes in the flow rate through the RHRS (see Section 3.6 and Figure 3.3).
Therefore the following precaution is provided~to the I
operators in the 0.1. guidelines and PLS document:
o "When the reactor coolant pressure is being maintained by the low pressure letdown control valve, changes to the flow rate i
through the residual heat removal loop by throttling of valves or starting and stopping the residual heat removal pumps will result in changes to the reactor coolant pressure.
For example, stopping of the residual heat removal pumps may cause an increase in the reactor coolant pressure of between 100-150 psig."
To avoid developing those conditions which might lead to a heat input type transient to the RCS or to transients caused by operator action, the following caution statements have been provided to the operators:
o "During coolown, all steam generators should be connected to the steam header to assure uniform cooldown of the reactor coolant loops."
"Whenever the reactor coolant temperature is above 160*F, at i
o i
least one reactor coolant pump should be in operation to j
maintain uniform temperature conditions in the system."
i "If all reactor coolant pumps have been stopped for more than o
five minutes and the reactor coolant temperature is greater than the charging and seal injection water temperature, do not restart the first pump until a steam bubble has been formed in the pressurizer. This precaution will minimize the pressure transient when the first pump is started and the cold water i
previously injected by the charging pump is circulated through the warmer reactor coolant components. The steam bubble will 4
acconnodate the resultant expansion as the cold water is rapidly wa rmed. "
i i
o "If all reactor coolant pumps are stopped and the reactor c001 ant is being cooled down by the residual heat exchangers, a l
non-uniform temperature distribution may occur in the reactor coolant system.
Do not attempt to restart a reactor coolant pump unless a steam bubble exists in the pressurizer."
r
}
i.
I 5.5 Residual Heat Removal System Isolation Valves lockout The water relief valves in the RHRS are provided to prevent pressure transients initiated in the RCS from exceeding the design pressure of the RHRS. At the same time these RHRS relief valves will mitigate the effect of the initiating transient on the RCS. An administrative control (Section 5.3) specifies that the RHRS isolation valves not be closed deliberately unless there is a steam bubble in the pressurizer so that the RHRS relief valves are available when the plant is at relatively low temperature and pressure conditions.
As an additional precaution, Westinghouse Technical Bulletin NSD-TB-77-7 reconsnends that, when the RCS is at zero pressure, the power supplies to the suction isolation valves be locked out in such a way that the RHRS would not be isolated by a single pressure instrument malfunction.
This i
additional precaution is intended to prevent both a loss of RHRS cooling and potential damage to the residual heat removal pumps caused by the auto-close interlock.
Since this precaution involves valve power lockout only when the RCS is at zero pressure, that is, when open to the atmosphere, it does not directly impact reactor pressure transients but is identified here for completeness.
i t
t l
I 26-I
~
n
-.,,--.-,-,e-.
,,.._,..,,.n
,,.. ~- -., - -- -,,, - -,,, - -,,.,.
I t
l 6.0 SETPOINT DETERMINAJJM Arngrh 6.1
\\
The selection of proper CONS setpoints for tripping the PORV's requires the consideration of several system parameters including.
i
- a. Volume of reactor coolant involved in transient I
- b. RCS pressure signal transmission delay 4
- c. Volumetric capacity of the relief valves versus opening position
{
- d. Stroke time of the relief valves (open & close) i
- e. Initial temperature and pressure of the RCS
- f. Mass input rate into RCS i
- g. Temperature of injected fluid e
- h. Heat transfer chsracteristics of the steam generators
]
- k. Volume of cold loop seal
- 1. Mass of steam generator secondary water
- m. RCP startup dynamics
- o. Appendix 6 pressure / temperature characteristics of the reactor i
vessel j
i e
(
6.2 Pressure Limits Selection 1
The isnction of the COMS is 13 prevent the RCS pressure from increasing abcve limits prescribed by the allowable pressure / temperature 3
characteristic for the specific reactor vessel material in accordance with rules given in Appendix G to 10CFR50. A typical characteristic is sfiown by Figure 6.1 where the allowable system pressure increases with j
increasing temperature. 'This type of curve sets the nominal upper limit i
or the pressure which should not be' exceeded during RCS increasing j
pressure transients.
)
l When a relief valve is actuated to mitigate an increasing pressure transient, the release of a volume of coolant through the valve will j
^
cause the pressure increa:e to be slowed and reversed as described by
~
Figure 6.2.'
The system pressure then decreases, as the relief valve releases coolant, until a reset pressure is reached where the valve is signalled to close. Note that the pressure continues to decrease below j
the reset pressure as the valve recloses. The nominal lower limit on the I
pressure during tnE iransient 15 selected based on a requirement of the 3
reactor coolant pump #1 seal to maintain a nominal 200 psig differential i
j pressure across the seal faces.
The nominal Appendix G upper limit and nominal RCP #1 seal lower limit j
pressure values create an acceptable RCS pressure range into which the setpoints for toth PORV's must be fit as shown on Figures 6.3 and 6.4.
J
~
i t
j i
4 j
i
(
{
t FIGURE 6.1 TYPICAL APPENDIX G P/T CHARACTERISTICS l
6 l
1 l
l 2500 I
2000,
S E
1 J
l E
l 1500,
E E
a8
'F/HR v
g 1000 O
5
.x S
tE O
500..
100 4
100 200 300 400 500 INDICATED COOLANT TEMPERATURE, 'F I
f FIGURE 6.2 TYPICAL PRESSURE TRANSIENT (1 RELIEF VALVE CYCLE)
Pg-----------,
p i
g SETPOINT - - - - - _--i [-
10 g
c S
- - RESET 10 E
p Y
g I
APUnder TIME 4.
j
' i..
-29 1
f Where the setpoint pressure range is insufficient to accommodate both the pressure overshoot and undershoot, produced by the PORV operation, compliance with the Appendix G upper pressure limit will take precedence over the RCP #. seal lower pressure limit.
6.3 Mass Input Consideration For a particular design basis mass input transient to the RCS, the
- elief valve will be signalled to open at a specific pressure setpoint. However, as shown on Figure 6.2, there will be a pressure overshoot during the delay time before the valve starts to move and during the time the valve is moving to the full open position. This overshoot is dependent on the dynamics of the system and input parameters and results in a maximum system pressure somewhat higher than the set pressure. Similarly there will be a pressure l
undershoot while the valve is relieving both due to the reset pressure being below the setpoint and to the delay in stroking the l
valve closed. The maximum and minimum pressures reached in the transient are a function of the selected setpoint and must fall within the acceptable pressure range shown on Figure 6.3.
A locus of the maximum and minimum pressure values calculated for several selected setpoints are plotted on Figure 6.3.
The shaded area represents the acceptable range from which to select the setpoint based on the design bases mass input case.
6.4 Heat Input Consideration The design basis heat input case is done similarly to the mass input case except that the locus of transient pressure values versus selected setpoints may be determined for several values of the-initial RCS temperature. This heat input evaluation provides a range of acceptable setpoints dependent on the reactor coolant temperature whereas the mass input case is limited to the most restrictive low temperature condition only.
The shaded area on Figure 6.4 describes the acceptable band for a heat input transient from which to select the setpoint for a particular initial reactor
(
coolant temperature.
I l I
f SETPOINT DETERMINATION (MASSINPUT)
FIGURE 6.3 NX APPENDIX G MAXIMUM LIMIT 7 MAX A_._\\x p
MIN e
se w~
E P
~
- - - - - - MIN -
a c.
RCP #1 SEAL m
M l
MINIMUM LIMIT k
I SETPOINT RANGE i
---,,---.--,,,a
,-y
..y
-w-.,,-,,,,,-..e--c--r-n
f SETPOINT DETERMINATION (HEATINPUT)
FIGURE 6.4 PMAX PMX _ _ _ _
P g
4D$D2 NN
___PMIN _ _ _ _
=
5?
O s
10 E
i f
i l
=
SETPOINT RANGE
/
.x I
e l
P3 PORY SETPOINT, PSIG 1
i._.__
i 1
6.5 Einal Setooint Selection By superimposing the results of the mass input and heat input cases, from a series of figures such as 6.3 and 6.4, the range of allowable setpoints to satisfy both conditions can be selected subject to the statement qualification of Section 6.2.
The setpoints will typically be listed in the Precautions, Limitations and Setpoints document, as system pressure setpoints versus temperature for use in scaling the function generators.
Each of the two valves may have a different pressure setpoint versus temperature list calculated such that only one valve will open and mitigate the transient (the second valve operates only if the first fails to open on command).
However, the staggered setpoints must result in the system pressure staying within the nominal pressure band shown by Figures 6.3 and 6.4 when either valve is utilized to mitigate the transient.
The selection of the pressure setpoints for the PORV's is based on the use of nominal upper and lower pressure limits specified by Appendix G to 10CFR50 and the reactor coolant pump shaf t seals respec tively. Since both pressure limits are considerd to have been conservatively determined, the uncertainties in the COMS
. instrumentation are not explicitly utilized in the selection of the pressure setpoints. Therefore, if the instrumentation develops a calibration error or drif ts out of alignment in the most unfavorable direction, one or the other nominal pressure limits might be exceeded during a transient. However, the deviation from the nominal limits will be limited to a value less than the instrument uncertainty.
See Section 7.0 for a discussion of the instrument and control uncertainties.
-. -. ~.
1
~
7.0 INSTRUMENT & CONTROL CHARACTERISTICS 7.1 Pressdre Channels The monitoring of the reactor coolant pressure for use in COMS is by means of two wide-range pressure channels having a range of 0-3000 psig. Each of these pressure instrument channels consists of a completely separate set of devices powered from independent power sources.
Each channel typically includes a transmitter, power supply and MCB indicator. The pressure signal is also sent to a comparator which compares the indicated pressure with a calculated PORY setpoint pressure value for the prevailing temperature.
In accordance with the Westinghouse accepted method of determining the uncertainty in the pressure signal to the comparator, the sensor and process rack uncertainties are combined to obtain the overall channel uncertainty. The value of the pressure uncertainty is typically about 60 psig for the wide-range pressure channels using Barton transmitters and 53 psig using other vendor's transmitters 7.2 lemperature Channels The monitoring of the reactor coolant temperature for use in COMS is by means of multiple, wide-range temperature channels, in both the hot and cold legs, having a range of 50-700*F.
Each temperature channel consists of a resistance temperature detector and associated R/E converter and power supply. Several of the temperature signals associated with a particular power source are auctioneered to select the lowest indicated temperature of the group. This selected low temperature is then processed in a function generator where a relief valve pressure setpoint is calculated.
The uncertainty in the temperature signal being sent to the function generator is evaluated by combining the sensor and process rack uncertainties. The result of the combination of these effects is an uncertainty in the temperature measurement of about 14.4*F.
exclusive of any temperature stratification or streaming in the loop piping.
f 7.3 Overall Trio Uncertainty The function generator takes the autioneered low indicated temperature for the particular channel and converts the temperature signal into a relief valve setpoint pressure signal based on specific Appendix G curves for the particular reactor vessel. A typical Appendix G curve (Figure 6.1) indicates the calculated pressure value will be relatively insensitive to the temperature sigt.al uncertainty at low system temperatures (typically below 100*F) so that the overall uncertainty in the pressure trip setpoint will be on the order of 100 psig.
However, as seen f rom Figure 6.1, the calculated pressure value for system temperatures above 200'F becomes more sensitive to the uncertainty in the indicated temperature. Fortuitously the design overpressure transients utilized for the determination of the COMS setpoints occur at temperatures below 200'F where the instrument uncertainty is not as sensitive to the indicated temperature.
i e
i i
I 1 0 RELIEF VALVE CHARACTERISTICS 8.1 General Description 1
The COMS utilizes one of the two power operated relief valves (PORV) located on the pressurizer as the active component to mitigate certain overpressure transients to the RCS. There are two types of PORV's currently used in Westinghouse designs; an air-operated, spring-to-close globe valve and a solenoid-pilot-operated, process pressure actuated valve.
The air-operated type valve, shown by Figure 8.1, requires a reliable source of compressed gas to actuate the valve to the open position. To assure at least one of the two valves will respond on i
demand, the single failure criterion requires a separate, independent source of compressed gas and controls for each valve.
Also, since the valve will cycle open-and-closed repeatedly during some transients, an adequate volume of gas must be available to sustain the cycling action until the operator intervenes to gain control of the RCS pressure.
The second type of valve which may be used as a PORV is the pilot-operated valve shown by Figure 8.2.
This type of valve is caused to stroke open or closed by a differential pressure across the plug in the valve body. This differential pressure is supplied by the process fluid and is controlled by the pilot valve and orifices between the pilot and main valve.
For these valves the electrical power supplies to the pilot valves must be separate and l
independent to provide the single failure protection for the COMS.
8.2 Stroke Time i
The stroke time for the air-operated type valve has been specified j
as $2 seconds to open and SS seconds to close to meet the normal operating pressure relief function at high pressurizer pressures.
Note that to support these stroke times, the air supplies to the valve and the venting path most be made compatible with the
]
requirements of the air operator on the valve.
For the COM$ function, with pressurizer pressures about one-fourth the normal relieving pressures, the stroke times may be longer than at the normal relieving pressure.
However, if the stroke times for the COMS function are made shorter, the performance of the COMS is improved. That is, the overshoot and undershoot pressure are i
decreased, but the valve will cycle at a higher frequency and a larger stored volume of gas would then be required to sustain the cycling for a given operator action time period. Therefore, it is not desirable to cause the air-operated type of valve to stroke more rapidly than necessary to meet the minimum COMS requirements.
l
. -. _ _.. _. _ _ _. _ _ _ _ -, _ _ _. _ _ _.. _. _ _.. _. _. ~ _. _ _ _ _. _. _ _ _ _. _. -. _ _. -
f
\\_
F-DIAPHRAGM CASES ym 4m y.'
AIR A
,n GM r
x DIAPHRAGM PLATE M
,[ ggg')
ACTUATOR SPRING I
/
I I f
/
SPRING ADJUSTOR
/
%d
~
ACTUATOR STEM j
g j
-YOKE
/
/
LEAK OFF
/
f w
k I\\
> R I a CAGE 1
i
% /
Nr
-SODY l' Mr INLET C
.# 500M
(//
/#
9 FIGURE 8-1 AIR-0PERATED PORY _
t Il 11 Solenoid Operated Pilot Valve I
h a1 T
c on
/
1 L.
M
,- [
.l
]
gy
- 4mma.
e
~
m g
1 l
h..l, /'
i i
4 A_
_4 y-
_A jd: Egj:hs j
n l l
- 9
) s\\
' y E l-i Inlet u
- p f
,g g-N s
4
/b y s
' y\\ h 5
l
/
Control N
Orifice s
i e
Control Orifice Plug Outlet m
a FIGURE 8-2 PILOT OPERATED PORV. -.
f The stroke times for a particular design air-operated PORV were determined in experimental tests sponsored by EPRI*. From several of the tests the opening stroke time was found to average about 2.4 seconds for various pressure / temperature conditions.
The pilot-operated type valve opening and closing stroke times can be varied by changing the control orifices. Since this type of valve does not require a stored energy source (such as a supply of gas) the increased cycles of valve operation due to a shorter stroke time is not a concern. Therefore, the stroke time can be shortened to improve the COMS performance if the increase in the hydraulic loads imposed on the piping can be tolerated. The final selection of the stroke time of the Garrett pilot-operated valve is to be determined af ter an evaluation of acceptable piping loads has been i
completed.
For one particular configuration of a Garrett j
4 pilot-operated PORV, the EPRI sponsored tests demonstrated the valve stroked open in about 3.2 second average for various 1
pressure / temperature conditions.
8.3 Flow Capacity of PORV The design flow capacity of the PORV's was specified to provide the required steam relief for normal reactor operational transients.
This requirement led to vendors supplying air-operated valves with maximum Cy's between 45 to 57. From one of the flow tests sponsored by EPRI, the apparent Cy for an air-operated type valve was calculated to be 60.4 which demonstrates that the typical vendor's design sizing is conservative.
Similarly, the experimental capacity from the EPRI tests of the Garrett pilot-operated valve indicated the apparent Cy to be 90 i
i where the design Cy was originally estimated by the vendor to be about 60.
4
~
- EPRI/WYLE Power-Operated Relief Valve Phase III Test Report, EPRI NP-2670-LD, October,1982 Volumes 1, 8,11.
I --
Biblioaraohv A.
" Pressure Mitigating Systems Transient Analysis Results,"
Westinghouse Owners Group On Reactor Coolant System Overpressurization, July 1977.
8.
" Supplement to the July 1977 Report," Ibid, September 1977.
C.
" Reference Safety Analysis Report; RESAR 414" Westinghouse Nuclear Energy Systems, October 1976.
"RCS Pressure Control During Low Temperature Operation."
Anunendment 15 June 1978.
D.
"NUREG 0941, Safety Evaluation Report, Westinghouse Elect-ic Corporation, Reference Safety Analysis Report, RESAR 414 " Docket NO.
STN 50-572 NRC Of fice of Nuclear Reactor Operation, November 1978.
4 f -
t APPENDIX 4
i g
t i
" GENERAL DESIGN CRITERIA IN NUCLEAR POWER PLANTS" Criterion 34-Residual heat removal. A sys-tem to remove residual heat shall be pro-vided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at j
n rate such that specified acceptable fuel dell 3n limits and the design conditions of the reactor coolant pressure boundary are mot exceeded.
Sultable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure tha*, for onsite electrict power systern cperation (assuming osatte power is not available) and for oNatte elec-trict power system operation (assuming on-site power is hot svallable) the system safety function can be accomplished, assuming a single failure.
)
e i
8 l
t 8
.y7--. _ - - - _ _ - - - - -, - - - - - - - -..
_-.w7%,,g 9,
.,----,_g--
,wy
,,.w---
y-.--,w,v-----
e l
. ~,.
SAANCH TECHNICAL p0$! TION ICSS 3 l
iSOLAT!006 0F LOW pAES$URE SYSTEMS FA0M THE NIGH pAE55URE REACTOR COOLANT A.
BACEGAOUNO i
Suring neraal and emergency conditions, it is necessary to keep low pressure systees that are connected to the hf h pressure reactor coolant systes properly isolated in 0
order to aveid damage by overpressuriaatien er the potential for less of fntegrity ef the few pressure systas and possible radfeactive releases. There have been a number of I
recensendations for accomplishing this afe. Until a, sore definitive gufde is pd llshed, the criteria in part 8, below, provide so adequate and acceptable design solution for thfa concern..
0.
04ANCH TECHN! CAL 805ff!0N
' ~ ~ '
' ' ~
k j
The fo11 ewing esasures sheeld be incorporated in designs of the interfaces between few pressure systems and the high pressure reactor coolant system:
1 j
1.
At least two valves in series should be provided to foolate any subsystem whenever the primary systas pressure is above the pressure rating of the sesystas.
2.
j For system interfaces where both valves are seter-operated, the valves should have independent and diverse interlocks to prevent both from opening unless the primary l
i systes pressure is below the subsystes design pressure. Also, the valve operators
{
h, should receive a signal to close' automatically whenever the primary systes pressure emceeds the sesystas design pressure.
i i
For these sysi.e faterfaces.here one checa vaive anil -ter-e,eraud vaive -
s.
provided, the ester-sperated valve should be f aterlocked to prevent the valve free opening whenever the primary pressure is above the sesystes design pressure, and j
to close avtaastically whenever the primary systas pressure emceeds the sesystas i
design pressure.
4 4.
Sultable velve position indicatten should be provided in the control reos for the laterface valves.
4 5.
For these faterfaces where the sesystem ts required for ECCS operetten, the above j
recessendations need not be faplemented. System faterfaces of this type shev1d be d
evaluated on an Individual case basis.
C.
ItPEQtNC[$
l 1
pov. 1 7A 4
~ ~ ' ~ ~
~~~~~ ~~
~~ ~
e SRANCH TECHNICAL POSITION RS8 5-2
'0VERPRESSURIZATION PROTECTION OF PRESSURIZED WATER REACTORS wiu wtwins ai ww iwtwists I
A.
84ck0round General Oasign Criterion 15 of Appendix A of 10 CFR Part 50 reoufres that "the t
setor Coolant Systas and associated auxilfary, control, and protection systems shall be designed with sufficient aargin to assure that the design concitions of the reactor coolant pressure boundary are not exceeoed during any constt1on of normal operat1on. including ant 1cipates operatianal occurrences."
Anticipated operational occWrences, as defined in Appendix A of 10 CFR Part 50,
' 'h "those conattfons of normal operation whict, are expected to occur one or 2
i aiore times during the life of the nuclear powet unit and include but are not j
1ieitaa ta less of power to all rectrculat1on ptmos, tripping of the tureine generator set, isolation of the main condenser, and loss of all offsite power."
Appendix G of 10 CFR Part 50 provides the fracture toughness recuirements for reactor pressure vessels under certain conditions. To assure %at the Appenoix G j
limits of the reactar coolant pressure bouncary are not exceeced during ar:y anticipatea operational occurrences, tecnnical specification pressure-temperature l
limits are provided for operating the plant.
N primary concern of this position is that during startue and shutdown 1
f.cnottfons at low temerature, especially in a watar-solid condition, the
.acter coolant systas pressure signt exceso the reactor vessel pressure-tannerature Ifaitations in the tecnnical specifications estanlishes for protec-l tion against brittle fracture. This inadvertent ovegressurization could be generated by any one of a variety of malfunctions or operator errors. Many incidents have occurred in operating plants as describee in Reference 1.
l Additional discussion on the background of this position is contained in i
Reference 1.
8.
Iranch Position j
1.
A system should be designed and installed which will prevent asceeding I
the aspifcable technical specifications and Appendix G Ifaits for.
i the reactor coolant systas wnile operating at low tameratures.- N
, system should be capaale of reifeving pressure during all anticipated everpressurization events at a rete sufficient to satisfy the-tecnnical specification Ifsits, particularly whfie the reactor coolant systas 1s Jn a water-selfd condition.
i 2.
N systes should be able to perfore its function assiming any single sctive component failure. Analyses using appreoriate calculational tacaniques aust be provided whfch demonstrate that the systas =f11 provide the required pressure reifef capacity assiming the most i
Ifsiting single active failure. N cause for initiation of the i
event, e.g., operator error, comonent malfunction should not be
}
considereo as the single active failure. N analyses should assuse the most Ifsiting allomaale operating conditions and systans configura-tion at the time of the postulated cause of the ovegressure event.
(
i 5.2.2-7 Rev. 0 - July 1981
___,,.,-,-,--n--
-.w.
awnn-n,.,e-,----_v--,e--,-.-n,,.n, mm,
,,.,n-n,vn,,,---_
-m.-
I All potential ovareressurization avsnts should be considered unen
- l estaolishing tha worst-case event.
Some events say be prevented by t
protective interlocks or by locking out power.
These events snoulo be identified un an inoividual basis.
If the events are excluced from the analyses, the controls to the plant tecnnical specifications. prevent these events should be in ThesystemshduldbedesignedusingIEEEStd.-279asguidance'(see l
3.
isolamentatiori).
The system may be manually enabled, however, an alare to alert the operator to enaole the system at the correct i
plant condition during cooldown, should be provided.
Pesitive An alars should}de provided when the protective action i 4
To assure operational readiness, -the overpressure protection systes should be testable.
Technical specification surveillance requirements j
should include:
k A test performed to assure operability of the system (exclusive a.
i of relief valves) prior to each shutdown.
i b.
A test for valve operability, as a miniana, be conducted as 1
specified in the ASME Code Section XI.
)
~
t 5.
The system sust meet the reavirements of Regulatory Guide 1.'26,
" Quality Groun Classifications anc Standaras for Water, Steam, and Radioactive-Wasta-Containirg Conconents of Nuclear Power Plants,"
and Section III of the ASMii Coce.
6.
The overpressure protection systes should be designed to function during an Operating Basis Earthquake.
It should not comorosise the i
design criteria of any other~ safety grade system with which it would interface, such that the recuirements of Regulatory Guide 1.29,
" Seismic Design Classification," are met.
7.
The overpressure protection systas should not depend on the avail-ability of offsita power'to perform its function.
The system should be opersole from battary-backed power sources, not necessarily Class IE buses.
8.
Overpressure protection systans which take credit for an active component (s) to mitigatir the consecuences of an overpressurization event should include additional analyses considering inadvertent system initiation / actuation or provide justification to show that existing analyses bound such an event.
9.
If pressure relief is from a low pressure system not normally connectea to the primary systas, the overpressure, protection function snould not be defeated by interlocks which would isolate the low pressure system from the primary coolant system.
(See BTP ICSB3)
References 1.
NUREG-0138, Staff Discussion of Fifteen Technical Issues Listec in i
Attacnment to Novemoer 3,1976 Memoranous from Jf rector, NRR, to NRR 1
Staff.
S.2.2-S 9ev. 0 - July 1991 i
f REACTIVITY CONTROL SYSTEMS
)
3/4.1.2 BORATION SYSTEMS FLOW PATH - SHUTDOWN LIMITING CONDITION FOR OPERATION 3.1.2.1 As a minimum, one of the following baron injection flow paths shall be OPERABLE and capable of being powered from an OPERABLE emergency power source.
A flow path from the boric acid tanks via either a boric acid a.
transfer pump or a gravity feed connection and a charging pump to the Reactor Coolant System if the boric acid storage tank in Specification (3.1.2.5a) is OPERABLE, or b.
The flow path from the refueling water storage tank via a charging pump to the Reactor Coolant System if the refueling water storage tank in Specification (3.1.2.5b) is OPERABLE.
}
APPLICABILITY:
MODES 5 and 6.
ACTION:
i With none of the above flow paths OPERABLE or capable of being powered from an GPERABLE emergency power source, suspend all operations involving CORE ALTERATIONS or positive reactivity changes.
- h SURVEILLANCE REQUIREMENTS i
4.1.2.1 At least one of the above required flow paths shall be demonstrated l
OPERA 8LE:
1 a
At least once per 7 day; by verifying that the temperature of the 1
a.
heat traced portion of the flow path is greater than or equal to (65)'F when a flow path from the boric acid tanks is used.
i b.
At least once per 31 days by verifying that each valve (manual, i
power operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct i
position.
h 4
l jf-STS 3/4 1-7 JUL 2 71981 L
. =
1
\\
REACTIVITY CONTROL SYSTEMS FLOW PATHS - OPERATING LIMITING CONDITION FOR OPERATION 3.1.2.2 At least two of the following three boron injection flow paths shall be OPERABLE:
The flow path from the boric acid tanks via a boric acid transfer a.
pump and a charging pump to the Reactor Coolant System.
b.
Two flow paths from the refueling water storage tank via charging pumps to the Reactor Coolant System.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTION:
With only one of the above required boron injection flow paths to the Reactor Coolant System OPERA 8LE, restore at least two boron injection flow paths to the Reactor Coolant System to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANOBY and borated to a SHUTDOWN MARGIN equivalent to at least 1% delta k/k at 200*F within.the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; restore at least two flow paths to OPERA 8LE status within the next 7 days or be in COLD SHUTDOWN.within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
SURVEILLANCE REQUIREMENTS 4.1.2.2 At least two of the above required flow paths shall be demonstrated OPERA 8LE:
At least once per 7 days by verifying that the temperature of the a.
heat traced portion of the flow path from the boric acid tanks is greater than or equal to (65)*F when it is a required water source.
At least once per 31 days by verifying that each valve (manual, b.
power operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.
At least once per 18 ranths during shutdown by verifying that each c.
automatic valve in the flow path actuates to its correct position on a _ test signal.
d.
At least once per 18 months by verifying that the flow path required by Specification 3.1.2.2.a delivers at least _ _ gpm to the Reactor Coolant System.
l
- nly one baron injection flow path is required to be OPERA 8LE whenever the 0
temperature of one or more of the RCS cold legs is less than or equal to (275)*F.
)f-STS 3/4 1-8 u n. ; ;gg;
t REACTIVITY CONTROL SYSTEMS CHARGING PUMP - SHUTDOWN LIMITING CONDITION FOR OPERATION 3.1.2.3 One charging pump in the boron injection flow path required by Specification (3.1.2.1 OPERABLE emergency powe)r source.shall be OPERA 8LE and capable of being po APPLICABILITY:
M00ES 5 and 6.
ACTION:
With no charging pump OPERA 8LE or capable of being powered from an OPERABLE emergency power source, suspend all operations involving CORE ALTERATIONS or positive reactivity changes.
i SURVEILLANCE REQUIREMENTS 4.1.2.3.1 The above required charging pump shall be demonstrated OPERABLE by verifying, that on recirculation flow, the pump develops a discharge pressure j
of greater than or equal to psig when tested pursuant to Specification 4.0.5.
4.1.2.3.2 All charging pumps, excluding the above required OPERA 8LE pump, shall be demonstrated inoperable at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, except when the reactor vessel head is removed, by verifying that the motor circuit breakers have been removed from their electrical power supply circuits.
i W-STS 3/4 1-9 JUL 2 7 501
i REACTIVITY CONTROL SYSTEMS i
]
CHARGING PUMPS - OPERATING i
4 LIMITING CONDITION FOR OPERATION i
l 3.1.2.4 At least two charging pumps shall be OPERA 8LE.
APPLICA81LITY:
MODES 1, 2,'3 and 4.
ACTl0N:
With only one charging pump OPERA 8LE, restore at least two charging pumps to OPERA 8LE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least H0T STAN08Y and borated to a f
SHUTDOWN NARGIN equivalent to at least 15 delta k/k at 200*F within the next 6 i
hours; restore at least two charging pumps to 0PERA8LE status within the next 7 days or be in COLD SHUTDOWN within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
1 i
l l
1 a
j
$URVEILLANCE REQUIREMENTS j
l 1
4.1.2.4.1 At least two charging pumps shall be demonstrated OPERA 8LE by l
verifying, that on recircJlation flow, each pump develops a discharge pressure i
of greater than or equal to psig when tested pursuant to Specification i
4.0.5.
l j
4.1.2.4.2 All charging pumps, except the above required OPERABLE pump, shall be demonstrated inoperable at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> whenever the temperature l
1 of one or more oi' the RCS cold legs is less than or equal to (275)*F by verifying i
i that the motor ctrcuit breakers have been removed from their electrical power l
supply circuits.
}!
- A maximum of one centrifugal charging pump shall be OPERA 8LE whenever the j
temperature of one or more of the RCS cold legs is less than or equal to l
(275) ~
t i
l i
esTS 3/4 1-10
- Is an A
t l
l HOT SHUTOOWN i
LIMITING CONDITION FOR OPERATION 3.4.1.3 a.
At least two of the Reactor Coolant and/or residual heat removal
{
(RNR) loops listed below shall be OPERA 8LE:
i 1.
Reactor Coolant Loop (A) and its associated steam generator j
and reactor coolant pump,"
i f.
Reactor Coolant Loop (B) and its associated steam generator j
and reactor coolant pump,"
j 3.
Reactor Coolant Loop (C) and its associated steam generator and reactor coolant pump,"
?
i 4.
Reactor Coolant Loop (D) and its associated steam generator and reactor coolant pump,"
]
5.
Residual Heat Removal Loop (A),
I
)
6.
Residual Heat Removal Loop (5).
b.
At least one of the above Reactor Coolant and/or RHR loops shall be in operation.**
4 APPLICA81LITY: M00E 4.
t ACTIg:
j a.
With less than the above required Reactor Coolant and/or RNR loops j
OPERABLE, immediately initiate corrective action to return the required loops to OPERABLE status as soon as possible; if the i
r I
remaining 0PERABLE loop is an RNR loop, be in COLD SHUTDOWN within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
b.
With no' Reactor Coolant or RNR loop in operation, suspend all operations involving a reduction in boron concentration of the i
Reactor Coolant System and immediately initiate corrective action to t
return the required coolant loop to operation.
I I
L I
"A Reactor coolant pump shall not be started with one or more of the Reactor l
Coolant System cold leg temperatures less than or equal to (275)*F unless
~
- 1) the pressurizer water volume is less than cubic. feet or 2) the
' secondary water temperature of each steam generator is less than
- F
{
above each of the Reactor Coolant System cold leg temperatures.
1 l
- All Reactor Coolant pumps and residual heat removal pumps may be de-energized for up to I hour provided 1) no operations are permitted that would cause dilution of the Reactor Coolant System boron concentration, and 2) core i
{
outlet temperature is maintained at least 10*F below saturation temoerature.
W-STS 3/4 4 3 JUL 2 71981 i
f I
,q
}
SURVEILLANCE REQUIREMENTS l
l I
4.4.1.3.1 The required Reactor Coolant puep(s), if not in operation, shall be determined to be OPERA 8LE once per 7 days by verifying correct breaker alignments and indicated power availability.
j 4.4.1.3.2 The required steam generator (s) shall be determined OPERA 8LE by verifying secondary side water level to be greater than or equal to (17)% at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
3 4.4.1.3.3 At least one Reactor Coolant or RHR loop shall be verified to be in j
operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
i i
i l
3 I
i t
]
j i
4 i
}
i l
1 i
1 l
i 1,
i l
4 I
1 1
PSTS 3/4 4-4
.N0i 2 0 $80
~_-
l t
COLD SHUTDOWN - LOOPS FILLED LIMITING CONDITION FOR OPERATION 4
l 3.4.1.4.1 At least one residual heat removal (RHR) loop shall be OPERA 8LE and i
in operation *, and either:
One additional RHR loop shall be OPERA 8LE#, or a.
i b.
The secondary side water level of at least two steam. generators shall be greater than (17)%.
j APPLICABILITY: MODE 5 with Reactor Coolant loops filled##
1 i
ACTION:
l a.
With less than the above required loops OPERABLE or with less than the required steam generator level, immediately initiate corrective
{
i i
action to return the required loops to OPERABLE status or to restore the required level as soon as possible.
b.
With no RHR loop in operation, suspend all operations involving a j
reduction in boron concentration of the Reactor Coolant System and immediately initiate corrective action to return the required RHR loop to operation.
I I
SURVEILLANCE REQUIREMENTS i
4.4.1.4.1.1 The required RHR loop shall be demonstrated OPERA 8LE pursuant to j
Specification 4.0.5.
t 4.4.1.4.1.2 The secondary side water level of at least two steam j
generators when required shall be determined to be within limits at least once per 1
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
4 1
4.4.1.4.1.3 At least one RHR loop shall be determined to be in operation and j
circulating reactor coolant at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
j
- One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing j
provided the other RHR loop is OPERA 8LE and in operation.
A Reactor Coolant pump shall not be started with one or more of the Reactor j
Coolant System cold leg temperatures less than or equal to (275)*F unless
- 1) the pressurizer water volume is less than cubic feet or 2) the
{
secondary water temperature of each steam generator is less than
'F above each of the Reactor Coolant System cold leg temperatures.
l
- The RHR pump may be de-energized for up to I hour provided 1) no operations i
are permitted that would causa dilution of the Reactor Coolant System baron i
concentration, and 2) core outlet temperature is maintained at least 10*F i
below saturation temperature, t
W-STS 3/4 4-5 JUL 2 71991 I
i
_.. _ _ _ _. _ ~ _. _, _ _,. _ _ _. _ _ _ ~. _ _
f l
REACTOR COOLANT SYSTEM COLD SHUTDOWN - LOOPS NOT FILLED LIMITING CONDITION FOR OPERATION 3.4.1.4.2 Two residual heat removal (RHR) loops shall be OPERABLE # and at least one RHR loop shall be in operation."
APPLICABILITY:
MODE 5 with Reactor Coolant loops not filled.
ACTION:
With less than the above required loops OPERABLE, immediately initiate a.
correctiva action to return the required loops to OPERABLE status as soon as possible.
b.
With no RHR loop in operation, suspend all operations involving a reduction in boron concentration of the Reactor Coolant System and immediately initiate corrective action to return the required RHR loop to operation.
SURVEILLANCE REQUIREMENTS 4.4.1.4.2.1.The required RHR loops shall be demonstrated OPERABLE pursuant to Specification 4.0.5.
4.4.1.i.2.2 At least one RHR loop shall be determined to be in operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
OneRHRlobpmaybeinoperableforupto2hoursforsurveillancetesting provided the other*RHR loop is OPERABLE and in operation.
O The RHR pump may be de-energized for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> provided 1) no operations are permitted that would cause dilution of the Reactor Coolant System boron concentration, and 2) core outlet temperature is maintained at least 10*F below saturation temperature.
W-STS 3/4 a-4
r REACTOR COOLANT SYSTEM 3/4.4.3 PRESSURIZER LIMITING CONDITION FOR OPERATION 3.4.3 The pressurizer shall be OPE'RABLE with a water volume of less than or equal to (1656) cubic feet, and at least two groups of pressurizer heaters each having a capacity of at least (150) kw.
APPLICA8ILITY:
MODES 1, 2, and 3.
ACTION:
a.
With one group of pressurizer iieaters inoperable, restore at least two groups to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STAND 8Y within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHUTDOWN within the following 6' hours, b.
With the pressurizer otherwise inoperable, be in at least HOT STAN08Y with the reactor trip breakers open within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
i SURVEILLANCE REQUIREMENTS 4.4.3.1 The pressurizer water volume shall be determined to be within its limit at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
4.4.3.2 The capacity of each of the above required groups of pressurizer heaters shall be verified by measuring circuit current at least once per 92 days.
l 4.4.3.3 The emergency power supply for the pressurizer heaters shall be demonstrated OPERA 8LE at least once per 18 months by manually transferring power from the normal to the emergency power supply and energizing the heaters.
i
~
NOV 2 1981 W-STS 3/4 4-11
---..--.,--.--.-.-.--.r---.,
- y. - - -.
4 REACTOR COOLANT SYSTDi OVERPRESSURE PROTECTION SYSTEMS i
l LIMITING CONDITION FOR OPERATION i
i i
l I
3.4.9.3 At least one of the following overpressure protection systems shall i
be 0FERABLE:
t i
Two power operated relief valves (PORVs) with a lift setting of l
a.
I less than or equal to (450) psig, or 1
b.
The Reactor Coolant System (RCS) depressurized with an RCS vent of greater than or equal to ( ) square Inches.
APPLICABILITY: MDDE 4 when the temperature of any RCS cold leg is less than or equal to (275)'F, MODE 5 and M00E 6 with the reactor vessel head on.
ACTION:
With one FORY inoperable, restore the inoperable PORV to OPERA 8LE a.
i status within 7 days or depressurize and vent the RCS through a
( ) square inch vent (s) within the next 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
b.
With both PORVs inoperable depressurize and vent the RCS through a
( )squareinchvent(s)wIthin8 hours.
In the event either the PORVs or the RCS vent (s) are used to mitigate c.
an RCS pressure transient, a Special Report shall be prepared and
)
submitted to the Commission pursuant to Specification 6.9.2 within 30 days. The report shall describe the circumstances initiating the transient, the effect of the P0RVs er vent (s) on the transient, and any corrective action necessary to prevent recurrence.
j d.
The provisions of Specification 3.0.4 are not applicable.
i I
I 1
i 4
I p5TS 3/4 4-36 NCV 2 1981 i
r 1
.:J:
SURVEILLANCE REQUIREMENTS 4.4.9.3.1 Each PORY shall be demonstrated OPERA 8LE by:
perfomance of a ANALOG CHANNEL OPERATIONAL TEST on the PORY a.
actuation channel but excluding valve operation within 31 days prior to entering,a condition in which the PORY Is required OPERABLE and at least once per 31 days thereafter when the PORV is required OPERA 8LE.
b.
Perfomance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18 months.
Verifying the PORV isolation valve is open at least once c.
when the PORV is being used for overpressure protection. per 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> d.
Testing pursuant to Specification 4.0.5.
4.4.9.3.2 The RCS vent (s) shall be verified to be open at least once 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />
- when the vent (s) is being used for overpressure protection. per "Except when the vent pathway is provided with a valve which is locked, sealed, or otherwise secured in the open position, then verify these valves open at least once per 31 days.
I PSTS 3/4 4-37 2
E
l ;,- i.'. b :l.lQh?w l j k,;.? j N k j.l.k..., &~[,llkY;'llil;.!.3:.3$ Y f f,l t
3/4.5 EMERGENCY CORE COOLING SYSTEMS 3/4.5.1 ACCUMULATGRS LIMITING CONDITION FOR GPERATION 3.5.T Each reactor coolant system accumulator shall be OPERABLE with:
The isolecian valve open, a.
b.
A coatsined borated water voltme of between and
- gallons, A baron conrantration of between (1800) and (2100) ppe, and c.
d.
A nitrogen cover pressure of between and psig.
APPLIC/.BILITY: MODES 1, 2, and 3*.
ACTION:
With one accumulator inoperable, except as a result of a closed a.
isolation valve, restore the inoperable accumulator to OPERABLE status within 1-hour or he in at least HOT STAND 8Y within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHLITDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, b.
With one accumulator incperable due to the isolation valve being closed, either immediately open the. isolation valve or be in at i
least HOT STANDBY within 1 nour and in HOT SHtJTDOWN within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
SURVQLLANCEREQUIREMENTS 4.5.1.1 Each accumulator shall be demonstrated OPERABLE:
Atleastonceper12 hours $y:
a.
1.
Verifying, by the absence of alarms the contained borated water volume and nitrogen cover pres,sure in the tanks, and 2.
Verifying that each accumulator isolation valve is open.
" Pressurizer pressure above 1000 psig.
i
,-i I 3/4 5-1
.NOV 2 01980
e EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) b.
At least once per 31 days and within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after each solution volume increase of greater than or equal to (1% of tank volume) by verifying the boron concentration of the accumulator solution.
At least once per 31 days when the RCS pressure is above 2000 psig c.
by verifying that power to the isolation valve operator is disctnnected by removal of the breaker from the circuit.
d.
At least once per 18 months by verifying that each accumulator isolation valve opens automatically under each of the following
. conditions:
1.
When an actual or a simulated RCS pressure signal exceeds the P-11 (Pressurizer Pressure Block of Safety Injection) setpoint, 2.
Upon receipt of a safety injection test signal.
4.5.1.2 Each accumulator water level and pressure channel shall be demonstrated OPERABLE:
l I
At least once per 31 days by the performance of a ANALOG CHANNEL a.
OPERATIONAL TEST.
I b.
At least once per 18 months by the performance of a CHANNEL CALIBRATION.
\\
I SEP 151981 W-STS 3/A 5-2
(
I EMERGENCY CORE COOLING SYSTEMS 3/4.5.2 ECCS SUBSYSTEMS - T,yg > 350*F LIMITING CONDITION FOR OPERATION I
3.5.2 Two independent Emergency Core Cooling System (ECCS) subsystems shall be OPERABLE with each subsystem comprised of:
a.
One OPERABLE centrifugal charging pump, b.
One OPERABLE safety injection pump (four loop plants only),
c.
One OPERABLE residual heat removal heat exchanger, d.
One OPERABLE residual heat removal pump, and An OPERABLE flow path capable of taking suction from the refueling e.
water storage tank on a safety injection signal and automatically transferring suction to the containment sump during the recirculation phase of operation.
APPLICABILITY: MODES 1, 2, and 3.
ACTION:
With one ECCS' subsystem inoperable, restore the inoperable subsystem a.
to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
b.
In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describ-ing the circumstances of the actuation and the total accumulated actuation cycles to date.
The current value of the usage factor for each affected safety injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70.
W-STS 3/4 5-3 NOV 2 0 560
,----g+
l EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS 4.5.2 Each ECCS subsystem shall be demonstrated OPERABLE:
a.
At least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> by verifying that the following valves are in the indicated positions with power to the valve operators removed:
Valve Number Valve Function Valve Position a.
a.
a.
b.
b.
b.
c.
c.
c.
b.
At least once per 01 days by:
1.
Verifying that the ECCS piping is full of water by venting the ECCS pump casings and accessible discharge piping high points, and 2.
Verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.
c.
By a visual inspection which verifies that no loose debris (rags, trash, clothing, etc.) is present in the containment which could be transported to the containment sump and cause restriction of the pump suctions during LOCA conditions. This visual inspection shall be performed:
1.
For all accessible areas of the containment prior to establish-ing CONTAINMENT INTEGRITY, and 2.
Of the areas affected within containment at the completion of each containment entry when CONTAINMENT INTEGRITY is established.
d.
At least once per 18 months by:
1.
Verifying automatic isolation and interlock action of the RHR system from the Reactor Coolant System by ensuring that:
a) with a simulated or actual Reactor Coolant System pressure signal greater than or equal to 425 psig the interlocks prevent the valves from being opened, and b) with a simulated or actual Reactor Coolant System pressure signal less than or equal to 600 psig the interlocks will cause the valves to automatically close.
2.
A visual inspection of the containment sump and verifying that the subsystem suction inlets are not restricted by debris and that the sump components (trash racks, screens, etc.) show no evidence of structural distress or abnormal corrosion.
W-STS 3/4 5-4
'NOV 2 1981
t EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) i e.
At least once per 18 months, during shutdown, by:
1.
Verifying that each automatic valve in the flow path actuates to its correct position on (safety injection actuation and automatic switchover to containment sump) test signals.
2.
Verifying that each of the following pumps start-automatically upon ' receipt of a safety injection actuation test signal:
a)
Centrifugal charging pump b)
Safety injection pump c)
Residual heat removal pump f.
By verifying that each of the following pumps develops the indicated discharge pressure on recirculation flow when tested pursuant to Specification 4.0.5:
1.
Centrifuge 1 charging pump 1
psig 2.
Safety Injection pump 1
psig 3.
Residual heat removal pump 1
psig g.
By verifying the correct position of each electrical and/or mechanical position stop for the following ECCS throttle valves:
1.
Within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following completion of each valve stroking operation or maintenance on the valve when the ECCS subsystems are required to be OPERABLE.
2.
' At least once per 18 months.
HPSI System LPSI System Valve Number Valve Number a.
a.
b.
b.
c.
c.
d.
d.
W-STS 3/4 5-5
.NOV-2 01980
t EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)
By performing a ' flow balance test, during shutdown, following com-h.
pletion of modifications to the ECCS subsystems that alter the subsystem flow characteristics and verifying that:
1.
For centrifugal charging pump lines, with a single pump running:
a)
The sum of the injection line flow rates, excluding the highest flow rate, is greater than or equal to
- gpm, and b)
The total pump flow rate is less than or equal to gpm.
i 2.
For safety injection pump lines, with a single pump running:
1 a)
The sum of the injection line flow rates, excluding the highest flow rate, is greater than or equal to
- gpm, and b)
The total pump flow rate is less than or equal to gpm.
i 3.
For residual heat removal pump lines, with a single pump running, the sum of the injection line flow rates is greater i
than or equal to gpm.
i O
W-STS 3/4 5-6 NOV 2 1931
EMERGENCY CORE COOLING SYSTEMS
.3/4.5.3 ECCS3U$hYSTEMS-T
< 350*F
~
av_w LIMITING CONDITION FOR OPERATION l
l 3.5.3 As a minimum, one.ECCS subsystem comprised of the following shall be OPERABLE:'
~
- a.
One OPERABLE centrifugal charging pump,#
b.
One OPERABLE residual heat removal heat exchanger, c.
One OPERABLE residual heat removal pump, and d.
An OPERABLE flow path capable of taking suction from the refueling water storage tank upon being manually realigned and transferring suction to the containment sump during the recirculation phase of operation.
APPLICABILITY: MODE 4.
ACTION:
a.
With no ECCS subsystem OPERABLE because of the inoperability of either the centrifugal charging pump or the flow path from the refueling water storage tank, restore at least one ECCS subsystem to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in COLD SHUTDOWN within the next 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.
b.
With no ECCS subsystem OPERABLE because of the inoperability of either the residual heat removal heat exchanger or residual heat removal pump, restore at least one ECCS subsystem to OPERABLE status i
or maintain the Reactor Coolant System T"'8 less than 350*F by use of alternate heat removal methods.
i c.
In the event the ECCS is actuated and injects water into the Reactor Coolant' System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describ-ing the circumstances of the actuation and the total accumulated actuation cycles to date.
The current value of the usage factor for each affected safety injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70.
- A maximum of one centrifugal charging pump and one safety injection pump shall be OPERABLE whenever the temperature of one or more of the RCS cold 1egs is less than or equal to (275)*F.
PSTS 3/4 5-7 gav i e.pg i
EMERGENCY CORE COOLING SYSTEMS SURVEILLANCEREdUIR$MENTS
^
4.5.3.1 The ECCS subsystem shall be demonstra'ted OPERA 8LE per the applicable Surveillance Requirements of 4.5.2.
4.5.3.2 All charging pum required OPERABLE pumps, ps and safety infection pumps, except the above i
shall be demonstrated inoperable at least once per 12 1
hours whenever the temperature of one or more of the RCS cold legs is less than or equal to (275)*F by verifying that the motor circuit breakers have b'een removed from their electrical power supply circuits.
M-STS 3/4 5-8
.W Y
."5 :373
' Wastingnc. z.3 Nuclaar
]
Service Technical Bulletin y
Division An advisory notice of a recent technical development pertaining to the installation or operation of Westinghouse-supplied Pt:nt equipment. Recipients should evaluate the information and recommendation, and initiate action where appro P.O. Som 2728.Pittsbureh. PA 15230 e
bubpCI 9
Residual Heat Removal Pump NumbH Syste n(s)
NSD.TB. 77-7 Residual Heat Removal System U dit?
AffcCtea l'; ants July 15, 1977 ALL S.O.(s)
Retuentes 215 Plant Operations Engineering Letter Dated May 5,1977 1
2 A review of the current, standard Westinghouse, 'two suction line, RHR system revealed the potential for RHR pump damage due to inadvertent suction isola-tion valve closure.
single suction line plants.The above potential for RHR pump damage also exists for For a two line suction system, the concern is the inadvertent RHR suction valve closure initiated by spurious actuation of the RHR autoclosure interlock.
The actuation of the interlock could occur as a result of a single pressure transmitter failure or a single bistable fail-ure resulting in the closure of a suction valve in each line of a two line RHR suction system with the potential for RHR pump damage depending upon plant conditions.
Current plant designs include a RHR low flow alann which would alert the operator to inadvertent closure of a suction valve on a running RHR pump.
ly 200 psi), the RHR pumps should not be damaged by clo valves since they operate satisfactorily on miniflow.
Also steam generators would be available for decay heat removal if it became neces,sary under the above set of conditions.
Therefore, for this plant condition, no action is recomended.
i If RCS' pressure is less than the shutoff head of the RHR pumps and the RCS closed, the potential for RHR pump damage due to inadvertent closure of the suction isolation valves exists.
However, since the time the plant is in this condition is typically short and since the steam generators would be available for decay heat removal if it becomes necessary, no action is recomended for this plant condition.
..:e.w.n t..w...... n. c.u~.
m s >. n... u.... o - i... " - u c -
a>>
256-7736 uc' n 236. 7736 W. B. Pai
[ _[4 d
4e <.-
F. C. We fer, Manager
. _.._.e.c...n. i cal _S.e. r..v.i c.e...
7//8/.- 77 M ha j Mechanicg1 Service f.
c o.
set 0 0.
e
+_.,
zeestinghouse Nucinar Service Technical Buhi Division An advisory notice of a recent technical d'evelopment pertaining to the installation or operation of Westinghouse-supplied N Plant equipment. Recipients should evaluate the information and recommendation, and initiate action where app P.O. Box 2728, Pittstwrgh, PA 15230 i
If the RCS is open to atmosphere with the reactor vessel. head on, the potential for RHR pump damage exists due to inadvertent closure of-the suction isolation valves.
Makeup to the RCS could be used for decay heat removal in this case; however, it would be limited by the availability of borated water and would be difficult to control.
To preclude a single event (suction valve closure) re-I sulting in RHR pump damage under the above plant conditions, it is recommended that electrical power be locked out to the suction isolation valve in each suction line which is powered from an emergency power source different from tnat of its respective pump. The above recomendation also applies if the RCS is in a refueling condition with the reactor vessel head off and the refuel-ing canal full.
For a single suction line plant, spurious actuation of the autoclosure inter-lock, any failure mechanism which results in closing of either suction iso-i lation valve is a concern for single suction line plants, since damage to i
both RHR pumps could occur.
The various plant conditions considered above for the two suction line applies to the single jine system.
The recomendations are the same except the elec-trical power should be locked out for both suction valves and that only one RHR pump should be operated when the RCS is open.
It is requested that operating plants should review their individual plant designs to assess whether the recommended actions are both necessary and suf-ficient.
In addition, those operating plant customers with plants which do not have RHR low flow alann may wish to add the alarm to alert the operator of an inadvertent RHR suction valve closure.
.