ML20091A805

Virgil Summer Deletion of Reactor Trip on Turbine Trip Below 50% Power,Apr 1984

ML20091A805
Person / Time
Site:	Summer
Issue date:	04/30/1984
From:	WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML20091A787	List: ML20091A781 ML20091A798 ML20091A805
References
NUDOCS 8405300093
Download: ML20091A805 (26)

Text

.. - . ._ _ _ - -.

1 '.

_y .

4 .

4 l

VIRGIL SUMMER DELLIION OF REACTOR TRIP ON TURBINE TRIP BELOW 50 PERCENT POWER April, 1984 i

Westinghouse Electric Corporation

~

Nuclear Energy Systems P. O. Box 355 Pittsburgh, Pennsylvania 15230 1

8405300093 840523

! PDR ADOCK 05000395 P PDR I

l 59010/10:041284

l. .

TA8LE OF CONTQLT1 Section . Titig, 1.0 Identification of Causes and Accident Description 2.0 Analysis of Effects and Consequences 3.0 Results l

4.0 Conclusion l

,' 59010/10:041284 .--

' LIST OF TA8LES Bjtli Title 1 Initial conditions 2 Time Sequence of Events for a Turbine Trip With 1

Pressure Control 3 Time Sequence of Events for a Turbine Trip Without Pressure Control i

i 1

i a

i l

l 1

' sani n n n .ne t soa

0 LIST OF FIGURES i

Fiaure Title 1 Turbine Trip with Pressure Control - Minimum Feedback -

Nuclear Power and Reactor Coolant Average Temperature 2 Turbine Trip with Pressure Control - Minimum Feedback -

Pressurizer Pressure and Water Volume 3 Turbine. Trip with Pressure Control - Minimum Feedback -

DNER 4 Turbine Trip without Pressure Control - Minimum Feedback

- Nuclear Power and Reactor Coolant Average Temperature 5 Turbine Trip without Pressure Control - Minimum Feedback

- Pressurizer Pressure and Water Volume . .

l 6 Turbine Trip without Pressure Control - Minimum Feedback

- ONBR 7 Turbine Trip with Pressure Control - Minimum Feedback -

Steam Dump - Control Rod Insertion - No Loss of RCS Flow - Nuclear Power and Reactor Coolant Average Temperature 1

8 Turbine Trip with oressure Control - Minimum Feedback -

! Steam Dump - Coretrol Rod Insertion - No Loss of RCS Flow - Pressurizer Pressure and Water Volume 4

1-59010/10:042584

,.. . l.0 IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite AC power remains available to operate plant components such as the reactor coolant pumps.

Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.

For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. The plant would be expected to

trip from the Reactor Protection System. In the event that a safety limit is

! approached, protection would be provided by the high pressurizer pressure and overtemperature AT reactor trips.

In the event the steam dump valves fall to open following a loss of load or turbine trip, the steam generator safety valves may lift and the reactor may I

be tripped by the high pressurizer pressure signal, or the overtemperature i AT signal. The steam generator shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and steam generator saf ety valves are, however, sized to protect the Reactor Coolant l System (RCS) and steam generator against overpressure for all load losses

without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valves, automatic rod cluster control

! assembly control or direct reactor trip on turbine trip.

! The steam generater safety valve capacity is sized to remove the steam flow at

! the Engineered Safety Features Rating (105 percent of steam. flow at rated i

power) from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator l

l 59010/10:042584 1-1

.- safety valves. The presskrizer safety, valves are then able to relievs sufficient steam to maintain-the RCS pressure within 110 percent of the RCS design pressure.

The primary-side transient is caused by a decrease in heat transfer capability from primary to secondary due to a rapid termination of steam flow to the turbine, acw.ipanied by an automatic , reduction of feedwater flow. Should feed flow not be reduced, a larger heat sink would be available and the transient would be loss severe. Terdination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the tu/bine control valv'se in approximately .25 seconds. Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in approximately .25 seconds. Therefore, the transient in primary pressure, temperature, and water volume will not be dependent on the mode of steam flow termination;-therefore, a detailed transient analysis is only presented for the turbine trip event.

For a turbine trip event, the reactor would be tripped directly (unless beloy approximately 50 percent power) from a signal derived from the turbine auto stop emergency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly on loss of trip-fluid pressure actuated by one of a number of possible turbine trip signals. Turbine-trip initiation signals include:

1. Generator trip

2. Low Condenser Vacuum

3. Loss of Lubricating 011

4. Turbine Thrust Bearing' Failure

5. Turbine Overspeed

6. Manual Trip -

l l

Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and initiate steam dump and, if above 50% power, a reactor trip. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient.

l 5901Q/10:042584 1-2

-. ~ _ - . _ . . _ . ___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

i .

' The automatic steam dump system wsuld normally accommodate the excess steam l generation. Reactor coolant temperatures and pressure do not signficantly increase if the steam dump system and pressurizer pressure control system are functioning properly (i.e. the better estimate case). If the turbine condenser was not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost. For this situation feedwater flow would be maintained by the Auxiliary Feedwater System to insure adequate residual and decay heat removal capability. Should the steam dump system fail to operate, the steam generator safety valves may lift to provide i pressure contiol, as discussed previously.

t Normal power for the reactor coolant pumps is supplied through busses f rom a transformer connected to the network side of the generator breaker. When a generator trip occurs, these busses are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to supply coolant flow to the core. Following any turbine trip where there are no electrical faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds.. .

The reactor coolant pumps remain connected to the generator, thus ensuring flow for 30 seconds before any transfer is made.

f Should the network bus transfer fail at or before 30 seconds, a complete loss of forced reactor coolant flow would result. The immediate effect of loss of coolant flow is a rapid increase in the coolant temperature in addition to the increased coolant temperature as a result of the turbine trip. This increase could result in DN8 with subsequent fuel damage if the reactor were not tripped promptly.

The following signals provide the necessary protection against a complete loss of flow accident: -

l 1. Reactor coolant pump power supply undervoltage.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolcot pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant l '

l' l

59010/10:042584 1-3 ,

.~ pumps, i.e., station blackout. This function is blocked below approximately 10 percent power (Permissive 7).

The reactor trip on low primary coolant loop flow is provided to protect agains't loss of flow conditions which affect only one reactor coolant loop.

This function is generated by two out of three low flow signals per reactor coolant loop. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

l l

1 5901Q/10:042584 1-4

, , . 1 l

2.0 ANALYSIS OF EFFECTS AND CONSEQUENCES Method of Analysis I In this analysis, the behavior of the unit is evaluated for a complete loss of 4 l

steam load from 60 percent of full power without direct reactor trip. This '

shows the adequacy of the pressure relieving devices and also demonstrates the core protection margins; that is, the turbine is assumed to trip without actuating all the sensors for reactor trip until conditions in the RCS result in a trip due to other signals. Thus, the analysis assumed a worst transient. In addition, no credit is taken for steam dump. Main feedwater flow is terminated at the time of turbine trip, with no credit taken for auxiliary feedwater to mitigate the-consequences of the transient.

Following the loss of steam load but before a reactor trip, a fast bus transfer is attempted. The transfer to an external power source is assumed to fail at the time pcoducing the most limiting DNB resulting in a complete loss of flow transient initiated from the loss of load conditions. - -

The loss of flow transient coincident with turbine trip transients are analyzed by employing the detailed digital computer code LOFTRAN } ,

FACTRAN, and THINC. The LOFTRAN Code calculates the loop and core flows following the initial loss of load. The LOFTRAN Code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, power

'avel, and DN8 margin. The FACTRAN code calculates heat flux, which allows THINC to determine the DNBR.

i Major assumptions are summarized below:

1. Initial Operating Conditions - the initial reactor power and RCS temperatures are assumed at their maximum values consistent with the steady state 60 percent power operation including allowances for calibration and instrument errors.

l

) Burnett, T. W. T., et. al., 'LOFTRAN Code Description", WCAP-7907, June, 1972.

l 5901Q/10:042584 2-1

~

The initial RCS pressure is assumed at a minimum value consistent with thm steady state 60 percent power operation including allowances for calibration and' instrument errors. The initial RCS flow is assumed to be consistent for three loop operation. This results in the maximum power i

difference for the load loss and the minimum margin to core protection limits at the intiation of the accident. Table 1 summarizes the initial conditions assumed.

2. Moderator and Dopoler Coefficients of Reactivity - the turbine trip is analyzed with a least negative moderator temperature coef ficient.

Although the FSAR presents analyses for the loss of load assuming both minimum and maximum moderator coefficients, only the minimum coefficient; cases are presented here. This is because the loss of flow event, which occurs after the loss of load, is limiting only for cases with a minimum moderator temperature coefficient. Doppler power coef ficients are adjusted to provide consistent minimum reactivity feedback cases.

! 3. Reactor control - from the standpoint of the maximum pressures attained,. .

it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would insert prior to trip and reduce the severity of the transient.

4. Steam Release - no credit is taken for the operation of the steam dump system or ste'am generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits secondary steam pressure at the setpoint value.

S. Pressurizer Soray and Power-Operated Relief Valves - two cases for the minimum reactivity feedback cases are analyzed:

, a. Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are also available.

b. No credit is taken for the effect of pressurizer spray and l

I power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are operable.

i 5901Q/10:042584 2-2 ,

= .__ .--

6. Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.

7. Reactor trio is actuated by the first Reactor Protection System trip s'e tpoint reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, overtemperature AT, low reactor coolant loop flow, and reactor coolant pump power supply undervoltage.

1 Except as discussed above, normal reactor control systems and Engineered l Safety Systems are not required to function. The Reactor Protection System may be required to function following a turbine trip. Pressurizer safety valves and/or steam generator safety valves may be required to open to , ,

maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function.

The NRC has expressed concerns regarding the potential increase in probability of a stuck-open pressurizer PORY following the implementation of Deletion of Reactor Trip on Turbine Trip below 50% power. The NRC position is addressed in NUREG-0660, Vol. 1, Requirement #10, Table C-3 and NUREG-0611, Paragraph 3.2.4.6: the anticipatory reactor trip function should not be deleted "until it has been shown on a plant-by-plant bases that the ' mall s break LOCA probability resulting from a stuck-open PORV is little affected by the modification."

The Westinghouse design criterion is that load rejections up to 50% should not require a reactor trip if all other functions operate properly. The power mismatch is taken up by the 49% steam dump and automatic rod insertion (10%).

The PORV's are provided to reduce the likelihood of tripping the reactor on i the high pressurizer pressure signal and opening the pressurizer safety valves, which cannot be isolated.

f 5901Q/10:042584 2-3 .

So in addition to the limiting transient described above, a better Gstimate transient was simulated assuming operation of the control systems that normally would be available. This is done in order to simulate a better estimate of the transient that would normally occur following a loss of load without subsequent reactor trip to show that the pressurizer PORV's would normally not open. Using the same initial operating conditions, the better estimate case assumed correct operation of the network bus transfer, steam dump, feedwater control system, and pressurizer pressure control system. Also for the better estimate case, automatic rod control and beginning of life reactivity feedback conditions were assumed. The same protect *on systems were available but not used for the better estimate transient.

l 5901Q/10:042584 2-4

~

3.0 RESULTS The transient responses for a turbine trip from 60 percent of full power operation are shown for three cases: two cases for minimum reactivity l feedback and one better estimate case (Figures 1 through 8). The calculated sequence of events for the transients is shown in Tables 2 and 3.

Figures 1 through 3 show the transient responses for the total loss of steam load with a least negative moderator temperature coefficient assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for steam dump. The bus transfer failure at 30 seconds results in an undervoltage trip of the reactor and the initiation of the loss of flow transient. The minimum DN8R remains well above the 1.3 limit. The pressurizer PORV's are actuated and maintain primary system pressure below 110% of the design value. The steam generator safety valves limit the secondary steam conditions to saturation at the safety valve setpoint. A plot of DNBR versus time is only given for the beginning of life cases since all other cases are significantly less limiting.

The turbine trip accident was also studied assuming the plant to be initially operating at 60 percent of full power with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam dump. The reactor is tripped on high pressurizer pressure signal. The fast bus transfer for this case is assumed to fail 1.5 seconds before rod drop time to produce the transient most limiting with respect to DNS and to assume the rod drop time from the high pressurizer pressure signal is coincident with the time from the undervoltage signal. Figures 4 through 6 show the transients with a least negative moderator coefficient. The neutron flux remains essentially constant at 60 percent of full power until the reactor is tripped. The DNBR remains above 1.3 throughout the transient.

In this case the pressurizer safety valves are actuated and maintain system pressure below 110% of the design value.

59010/10:051084 3-1

A better estimate turbine trip accident was also simulated assuming the plant to be initially operating at 50 percent of full power with credit taken for pressurizer spray, steam dump, successful bus. transfer, feedwater control  ;

system operation, automatic rod control, and beginning of life reactivity i feedback conditions in mitigating the transient. l The control rods are inserted and the steam dump quickly actuated following the turbine trip event which limits the increase of primary side pressure.

There is no reactor trip, and the plant is smoothly and quickly brought to hot shutdown condition. DN8R remains well above the 1.3 limit. Maximum pressurizer pressure is 2311 psia; maximum secondary pressure is 1164 psi.

Neither the primary or secondary side pressure reaches the point where the pressurizer PORV's or the steam generator safety valves are actuated (see Figures 7 and 8).

1 I

~

I 59010/10:051084 3-2

~

4.0 CONCLUSION

S l

Results of the anal'ses y show that the plant design is such that a turbine trip without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the system are adequate to limit the maximum pressures to within the design limits. The analysis also demonstrates that for a complete loss of forced reactor coolant flow initiated from the most adverse preconditions of a turbine trip, the ONBR does not decrease below 1.30 at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

For normal plant operation with all normal control systems assumed operational, pressurizer pressure does not reach the point of pressurizer PORY

, activation. Therefore the deletion of reactor trip on turbine trip below 50%

power is not expected to significantly increase the probability of a small break LOCA due to a stuck-open PORV.

l l

i 59010/10:042584 4-1

, . '. . i

- TABLE 1 INITIAL CONDITIONS No. of Active Loops 3 Core Power, MWt (% Power) 1671 (60%)

Thermal Design Flow (TOTAL) GPM 294000 Reactor Coolant Average Temperature, 'F 578.6 Reactor Coolant System Pressure, psia 2220 l

l 5901Q/10:042584

~

~~

. TABLE 2

' TIME SEQUENCE OF EVENTS FOR A TURBINE TRIP WITH PRESSURIZER PRESSURE CONTROL Event Time (sec.)

1. Minimum I

Feedback (BOL)

Turbine trip 0.0 l Initation of steam release from steam generator safety valves 8.5 Peak pressurizer pressure occurs 9.0 Fast bus transfer failure, flow coastdown begins, and undervoltage trip occurs 30.0 Rods begin to fall 31.5 Minimum DNBR occurs 33.0 l

~

f l

59010/10:042584

TABLE 3

' TIME SEQUENCE OF EVENTS FOR A TURBINE TRIP WITHOUT PRESSURIZER PRESSURE CONTROL Event Time (sec.)  ;

1. Minimum Feedback (BOL)

Turbine Trip 0.0 Initiation of steam release from steam generator safety valves 8.5 Fast bus transfer failure, flow coastdown begins, and undervoltage trip occurs 6.5 Rods begin to fall, high pressur-izer pressure trip occurs 8.0 Minimum DNBR occurs 9.5 Peak pressurizer pressure occurs .

(2523 psia) 9.5 59010/1D:041884

1.2000 ,

j

t. 0000 - - --

5 3

8 .80000 - - --

a w

= .60000 --

5 2

i .40000 - - .

2

.20000 - - - --

0.0 _

640.00 c

o 8 620.00 - - --

U e

$ 600.00 - - --

W E -

• 580.00 -

g -

i d-E 560.00 - -

W 540.00 e a

$ $ $ 8 8 S l  : si e a s s a TIME (SEC)

FIGURE I TURBINE TRIP WITH PRESSURE CONTROL - MINIMUM FEEDBACK - NUCLEAR POWER AND REACTOR COOLANT -

AVERAGE TEMPERATURE l

. . , - - . , . . , . -- . . . . , _ . ~ -- - .

..,..,n,- - , , ,. . - - - . . - . , . . ,. , . _ . - , - -

--a 1

2500.0 '

l 2400.0 - - --

5 y 2300 0 - - -

w E

N 2200.0 - - --

sa. 1 5

~

2100.0 - - --

5

$! 2000.0 - - --

4a.

1900.0 - - --

1800.0 1800.0 1750.0 - - "

O '

3 1500.0 - - --

W k

% 1250.0 - - --

.s a

W 5 1000.00 - -

5

~

\

3 750.00 - - -

C f

500.00 - - --

~

400.00 a a a a a i

• 5 g s a e TIME (SEC)

FIGURE 2 TURBINE TRIP WITH PRESSURE CONTROL -

MINIMUM FEEDBACK - PRESSURIZER PRESSURE AND WATER '/0LUME

l I

3.2 --

. 2.8 l a  !-

E . .

~ -

2.6 -- --

2.4 . ','

0 10 20 30 40 Time (seconds) 1 FIGURE 3 TURBINE TRIP WITH PRESSURE CONTROL -

MINIMUM FEEDBACK - DNBR

. '. o 1.2000 t.0000 - -

.t 8 .80000 - -

4 5 --

es .60000 l

5 2

% 40000 - -

.20000 - -

0.0 640'.00 C

o ..

W 620.00 - -

w 3

2 1 5 600,00 - -

I w '

I ..

< 580.00 -

v d ~

~

5 560.00 -

W l

l 1

540.00 g g g g o o @

s i a s s s TIME (SEC)

FIGURE 4 TURBINE TRIP WITHOUT PRESSURE CONTROL -

MINIMJM FEED 8ACK - PRESSURIZER PRESSURE AND WATER VOLUE

2600.0 2500.0 - - --

2

2400.0 - - --

y 2300.0 - - --

a

$ 2200.0 - - --

5 2 2100.0 - --

3 a

g 2000.0 - - --

a.

1900.0 - - --

1800.0 1900.0 ' * -

1750.0 - - --

O 3 1500.0 - - --

W Y

3 e 1250.0 - - --

2 W

$ 1000.00 - - --

E 4

750.00 - --

Y 500.00 - - --

I 400.00 '

6 4

4 5

S S

TIME (SEC)

FIGURE 5 TURBINE TRIP WITHOUT PRESSURE CONTROL -

MINIMUM FEEDBACK - NUCLEAR POWER AND REACTOR COOLANT AVERAGE TEMPERATURE

s 3.2 --

2.8 ~

E ' '

E 2.6 -- --

2.4 . .

0 5 10 15 Time (seconds)

FIGURE 6 TURBINE TRIP WITHOUT PRESSURE CONTROL -

MINIMUM FEEDBACK - DNBR

)

1 l

l l

l m ,n.-,4 , -, '-- ~

\

0.5 E .

b7 0.4 82 N

.2 8 '

E3 02 zg 0.0 0 50 100 150 200 Time (seconds) 580 C

en il; 540 .

500 0 50 100 150 200 Time (seconds)

.IGURE 7 TURBINE TRIP WITH PRESSURE CONTROL -

MIMIMUM FEEDBACK - STEAM OUMP - CONTROL R00 INSERT:0N .'10 LOSS OF RCS .: LOW -

.10 CLEAR POWER AND REACTOR CCOLANT AVERAGE TEMPERATURE

1 2200 2 2300

=

P C-u 5 2200 - -

, EE

=

G E 2100 t

2000 0 50 100 150 200 Time (seconds) 700 5

3 m^ 600 _

52 -

55 2%

g> 500 c

400 0 50 100 150 200 Time (seconds)

FIGURE 8 TURBINE TRIP WITH 3RE55URE CCflTROL .MIflIMUM FEEDBACK - STEAM JUMP - CONTROL RCD ItlSERTION -

NO LOSS OF RCS FLOW - PRE 55URIZER PRESSURE AND WATER 'l0LUME

- - . . .