Text

Proposed Tech Specs,Revising Change in SLMCPR & Bases Description of RHR Suppl Fuel Pool Cooling Mode
	ML20113B195
Person / Time
Site:	Browns Ferry
Issue date:	06/21/1996
From:	; TENNESSEE VALLEY AUTHORITY
To:	;
Shared Package
ML20113B188	List: ML20113B185; ML20113B195; ML20113B197;
References
	NUDOCS 9606260240
	Download: ML20113B195 (45)
	v • d • e

{{#Wiki_filter:. I ENCLOSURE 2 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN) UNITS 1, 2, AND 3 PROPOSED TECHNICAL SPECIFICATION (TS) CHANGE T8-377 MARKED PAGES i I. AFFECTED PAGE LIST l l Mpit 1 Unit 2 Unit 3 1.1/2.1-1 1.1/2.1-1 1.1/2.1-1 l 1.1/2.1-8 1.1/2.1-8 1.1/2.1-8 1.1/2.1-9 1.1/2.1-9 1.1/2.1-9 l 1.1/2.1-13 1.1/2.1-13 1.1/2.1-13 1.1/2.1-14 1.1/2.1-14 1.1/2.1-14 1.1/2.1-15 1.1/2.1-15 1.1/2.1-15 3.3/4.3-17 3.3/4.3-17 3.3/4.3-17 l II. MARKED PAGES See attached. l I l i i 9606260240 960621 DR ADOCK 05000259 PDR i

                                                                                                                                              .              1 1

] 1.1/2.1 FUEL CLADDING INTEGRITY SAFETT LIMIT LIMITING EAFETY SYSTEM SETTING ! 1.1 FUIL CLADDING IETEGRITY 2.1 FUEL CLADDIEG INTEGRITY l l Anolicability Annlicability Applies to the interrelated , Applies to trip settings of l variables associated with fuel the instrunants and devices j thermal behavior. which are provided to prevent the reactor system j safety limits from being exceeded. l Obiective Objective j To establish limits which To define the level of the

!                                                 ensure the integrity of the                                            process variables at which

fuel cladding, automatic protective action j is initiated to prevent the j fuel cladding integrity i safety limit from being j exceeded.

j Snacifications Snecifications

Tha limiting safety system j settings shall be as

, specified below l A. Thermal Power Limits A. Eastron Flux Trin Settinas l 1. Rosetor Pressure >800 1. AFIN Flux Scram paia and Core Flow Trip Setting i ) 105 of Ested. (Rua Mode) (Flow ? biased) When tha reactor pressure is greater a. When the Mode than 800 paia, the Switch is in existance of a mini - ths RUN critical power ratio position, the (MCFR) less than W APEN flux shall constitute ido scram trip violation of the fuel setting cladding integrity shall be: safety limit. BFE 1.1/2.1-1 Unit 1

l

1.1 BAEEE

FUEL CLADDING IMMEITY BAFETY LIMIT The fuel cladding represents one of the physical barriers tshich separate radioactive materials from environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use-related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from reactor operation significantly above design conditions and the protection system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking, the thermally-caused cladding perforations sipal a threshold, beyond editch still greater thermal stresses may cause gross rather than incremental cladding deterioration. Therefore, the fuel cladding safety limit is defined in terms of the reactor operating conditions tdnich can result in cladding perforation. The fuel cladding integrity limit is set such that no calculated fuel damage tsould occur as a result of an abnormal operational transient. Because fuel damage is not directly observable, the Fuel Cladding safety Limit is defined with margin to the conditions which would produce onset transition boiling (MCPR of 1.0). Thes* g er? d!!:M: "r'et; '_i-it crt tMt OM ci .i-- _;-it bei - -M - nt h L .O i; = 1 :; th= 1.0 . . .0f : 1.0'Ifrepresents a conservative margin relative to the conditions required to maintainN og fuel cladding integrity. A4 O E onset of transition boiling results in a decrease in heat transfer y from the clad and, therefore, elevated clad temperature and the w possibility of clad failure. Since boiling transition is not a M directly observable parameter, the margin to boiling transition is 4 calculated fron plant operating perameters such as core power, core >i flow, feedwater temperature, and core power distribution. The $ margin for each fuel assembly is characterized by the critical power u ratio (CPR) which is the ratio of the bundle power which tsould $ produce caset of transition boiling, divided by the actual bundle , power. The ministan value of this ratio for any bundle in the core .c is the minimum critical power ratio (MCPR). It is assumed that the # plant operation is controlled to the nominal protective setpoints c via the instrumented variables, i.e., normal plant operation .$ presented on Figure 2.1-1 by the nominal espected flow control # line. The safety Limit ,._ - ..,,,, has sufficient conservatism u tor e that in the event of an abnormal operational transient 3 in ed from a normal operating condition (MCPR > limits specified @ in $scification 3.5.K) more than 99.9 percent of the fuel rods in u the core are expected to avoid boiling transition. The margin *

           '  bettseen MCPR of 1.0 (onset of transition boiling) and the Jafety                                o:
             ,1,1mighe+ is derived from a detailed statistical analysis                                        $

M (6 considering;all of the uncertainties in monitoring the core E operating state including uncertainty in the boiling transition o correlation as described in Reference 1. The uncertainties employed j in deriving the safety limit are provided at the beginning of each , fuel cycle. c 5 0 BFW 1.1/2.1-8 ". Unit 1 9 E

4 1 i f 1.1 BASEE (Cont'd) ! Because the boiling transition correlation is based on a large l quantity of full scale data there is a very high confidence the operationofafuelassemblyattheconditionofMCPRGL4,09[would l not produce boiling transition. Thus, although it is not required l to establish the safety limit additional margin exists between the g

safety limit and the actual occurrence of loss of cladding integrity.

9 f However, if boiling transition were to occur. clad perforation would N not be expected. Cladding temperatures would increase to 0 j l approximately 1100 F which is below the perforation temperature of i the cladding material. This has been verified by tests in the p j General Electric Test Reactor (GETR) where fuel similar in design to & BFNP operated above the critical heat flux for a sigaificant period e of time (30 minutes) without clad perforation. W 4 e i If reactor pressure should ever exceed 1400 psia during normal power $ operation (the limit (l applicability of the boiling transition o i correlation) it would be assumed that the fuel cladding integrity y

safety Limit has been violated. g I

j At pressures below 800 psia, the core elevation pressure drop (0 power. O flow) is greater than 4.56 psi. At low powers and flows this pressure differential is maintained in the bypass region of the f ! core. Since the pressure drop in the bypass region is essentially 1 all elevation head, the core pressure drop at low powers and flow l will always be greater than 4.56 psi. Analyses show that with a

flow of 28x103 lbs/hr bundle flow, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the i bundle flow with a 4.56 psi' driving head will be greater than

! 28x103 lbs/hr. Full scale ATLAS test data taken at pressures from ! 14.7 psia to 800 psia indicate that the fuel assembly critical power j at this flow is approximately 3.35 MWt. With the design peaking i factors this corresponds to a core thermal power of more than 50 } percent. Thus, a core thermal power limit of 25 parcent for reactor pressures below 800 psia is conservative. 1 i For the fuel in the core during periods when the reactor is shut l down, consideration must also be given to water level requirements

due to the effect of decay heat. If water level should drop below j the top of the fusi during this time, the ability to remove decay
heat is reduced. This reduction in cooling capability could lead to 3 elevate & cladding temperatures and clad perforation. As long as the

! fuel remotas covered with water, sufficient cooling is available to j prevent thei clad perforationI. i i 1 l l i 3FW 1.1/2.1-9 Unit 1

m% 2.1 54833 (cont'd) g Analyses of the limiting transients show that no scram adjustment is required to sasure MCPR a_@r07%en 3 the transient is initiated from MCFR limita specified in Specification 3.5.k.

2. Ag g Jtur scram Trin settian (nustrar> or STAsvDP/ HOT svaunnY MODE) l i

l For operation in the startup mode while the reactor is at low } pressure, the AFM scram setting of 15 percent of rated power f j provides adequate thermal margin between the setpoint and the j safety limit, 25 percent of rated. N margin is adequate to , accommodate anticipated maneuvers assseiated with power plant j startup. Effects of increasing pressure at zero or low void i content are minor, cold water from sources available during i startup is not much colder than that already in the system, ! temperature coefficients are small, and control rod patterns are j constrained to be uniform by operating procedures backed up by j the rod worth minimiser. Thus, of all possible sources of reactivity input, uniform control rod withdrawai is the most j probable cause of significant power rise. Because the flux l distribution associated with uniform rod withdrawals does not i involve high local peaks, and because several rods must be moved j to change power by a significant percentage of rated power, the j rate of power rise is very slow. Generally, the heat flux is in i near equilibrium with the fission rate. In an assumed miform ! rod withdrawal approach to the scram level, the rate of power ! rise is no more than 5 percent of rated power per minute, and the AF M system would be more than adequate to assure a scram e l { before the power could exceed the safety limit. N 15 percent 1 APM scram remains active util the made switch is placed in the l EM position. This switch occurs when reactor pressure is

greater than 850 peig.

l

3. I M Flux Seran Trin Settina i

l The IM System consists of 4 chambers, 4 in each of the reactor 4 protection system logic channels. N I M is a 5-decade-l instrument which covers the range of power level between that l covered by the SM and the AFM. N 5 decades are covered by j the I M by means of a range switch and the 5 doesdes are broken i dous into le ranges, each being one-half of a decade in size. j The I M scram setting of 120 divisions is active in each range ! of the I M. For example, if the instrument were on range 1, the l seren setting would be at 120 divisions for that range; likewise t if the instransat was on range 5, the scram setting would be 120 divisions on that range. f / l

-,/

isr greater than the Safety Limit MCPR / i i l i i am 1.1/2.1-13 AllDl0 Muff 110. 213 j Unit 1 'i

2.1 3AgLt (Cont'd) g i I M Flur Seram Trin Settina (Continued) 1 4 Thus, as the IBM is ranged up to accommodate the increase in l j power level, the scram setting is also ranged up. A scram at 120 divisions on the IBM instruments remains in effecti as long i as the reactor is in,the startup mode. In addition, the APRM 15 percent scram prevents higher power operation without being i in the RUN mode. The IBM scram provides protection for changes l j which occur both locally and over the entire core. The most significant sources of reactivity change during the power increase are due to control rod withdrawal. For insequence I control rod withdrawal, the rate of change of power is slow enough due to the physical limitation of withdrawing control i rods that heat flux is in equilibrium with the neutron flux. An IBM scram would result in a reactor shutdown well before any l SAFETY LIMIT is exceeded. For the case of a single control rod j withdrawal error, a range of rod withdrawal accidents vaa i analyzed. This analysis included starting the accident at ! various power levels. The most severs case involves an initial condition in which the reactor is just suberitical and ths IRM l system is not yet on scale. This condition exists at quarter l j rod density. Quarter rod density is illustrated in paragraph 7.5.5 of the FSAR. Additional conservation was taken in this analysis by assuming that the IBM channel closest to the ! withdrawn rod is bypassed. The results of this analysisa== show l that the reactor is scrammed and peak power limited to 1 percent of rated power, thus maintaining MCPR abovel2B3.. Based ] on the above analysis, the IRM provides protection against local control rod withdrawal errors and continuous withdrawal of - l control rods in sequence. _ the Safety Limit MCPR 1 4. Fired Blah Neutron Flur Seram Trin The average power range monitoring (APRM) system, which is l . calibrated using heat balance data taken during steady-state j f conditions, reads in percent of rated power (3,293 MWt). The APRM system responds directly to neutron flux. Licensing l analyses have demonstrated that with a neutron flux scram of 120 percentt of rated power, none of the abnormal operational i transients analyzed violate the fuel SAFETY LIMIT and there is a l substantial margin from fuel damage. 4 1 B. AP M Control Rod Block l Reactor power level may be varied by moving control rods or by l varying the recirculation flow rate. The APRM system provides a control rod block to prevent rod withdrawal boycad a given point at j l constant recirculation flow rate and thus prevents scram actuation. This rod block trip setting, which is automatically varied with i recirculation loop flow rate, prevents an increase in the reactor The 5 power level to excess values due to control rod withdrawal. flow variable trip setting is selected to provide adequate margin to l the flow-biased scram setpoint. j aC TS 357 - TVA Letter 1.1/2.1-14 BFN Dated 05/11/95 i Unit 1 ) -

   . - - - - -               - . - - - . . - . . - . - . _ - - . - - - . . .-.- - - _ _ . . ~                            .   .     -     _ _

i 2.1 AMIA (Cont'd) E 11 E ! C. naaetor water Low Level Scram and Isolation (Ereent Main Steam Lines) i ! The setpoint for the low level scram is above the bottom of the i separator skirt. This level has been used in transient analyses l dealing with coolant inventory decrease. The results reported in TSAR subsection 14.5 show that scram and isolation of all process j lines (except main steam) at this level adequately protects the fuel and the pressure barrier, because MCPR is greater than 4MffE all l cases, and system pressure does not reach the safety valve i l settings. The scram setting is sufficiently below normal operatins

range to avoid spurious scrams.

} the safety Limit McPR i D. Turbine Sten Valve Closure Scram i l The turbine stop valve closure trip anticipates the pressure, i neutron fluz and heat flux increases that would result from closure l of the stop valves. With a trip setting of 10 percent of valve

closure from full open, the resultant increase in heat flux is such

! that adequate thermal margins are maintained even during the worst ! case transient that assumes the turbine bypass valves remain ! closed. (Reference 2) l l E. Turbine Control Valve Fast Closure or Turbine Trin Scram l l Turbine control valve fast closure or turbine trip scram anticipates j the pressure, neutron flux, and heat flux increase that could result - from control valve fast closure due to load rejection or control i valve closure due to turbine trip; each without bypass valve l capability. The reactor protection system initiates a scram in less j than 30 milliseconds after the start of control valve fast closure - due to load rejection or control valve closure due to turbine trip. This scram is schieved by rapidly reducing hydraulic control oil ! pressure at the main turbine control valve actuator dise dump valves. This loss of pressure is sensed by pressure switches whose i contacts form the one-out-of-two-twice logic input to the reactor { protection system. This trip setting, a nominally 50 percent

greater closure time and a different valve characteristic from that j of the turbine stop valve, combine to produce transients very i

similar to that for the stop valve. No significant change in MCPR ocents. Relevant transient analyses are discussed in References 2 li and 3 of the Final Safety Analysis Report. This scram is bypassed l when turbine steam flow is below 30 percent of rated, as measured by I turbins first state pressure. i . i i 1 u ) BFN 1.1/2.1-15 TS 357 - TVA Letter : - Unit 1 Dated 05/11/95 {

i g, %. i j FEBz4tgg l [ 3.3/4.3 EL111 (Cont'd) ) i l ! 5. The Rod Block Monitor (RBM) is designed to automatically prevent ; fuel damage in the event of erroneous rod withdrawal from 1 l locations of high power density during high power level f l operation. Two RBM channels are provided, and one of these may ! ! be bypassed from the console for maintenance and/or testing. i l Automatic rod withdrawal blocks from one of the channels will l l block erroneous rod withdrawal soon enough to prevent fuel l l damage. The specified restrictions with one channel out of I l ! service conservatively assure that fuel damage will not occur l due to rod withdrawal errors when this condition exists. I C. Scram Insertion Times d , I The control rod system is designated to bring the reactor suberitical at ! the rate fast enough to prevent fuel damage; i.e., to prevent the MCPR ] rom becWng less tEsii';MG7. The limiting power transient is given in i Reference 1. Analysis of this transient shows that the negative I ! reactivity rates resulting from the scram with the average response of ! all the drives as given in the above specification provide the required i protection, and MCPR remains greater than"hw.r g - i On an early BWR, some degradation of control rod scram performance occurred during plant startup and was determined to be caused by l particulate material (probably construction debris) plugging an internal

control rod drive filter. The design of the present control rod drive (Model 71D81448) is grossly improved by the relocation of the filter to a location out of the scran drive path; i.e., it can no longer interfere with scram performance, even if completely blocked.

The degraded performance of the original drive (CRD7ED8144&) under dirty j operating conditions and the insensitivity of the redesigned drive f l (CRD7RDB1448) has been demonstrated by a series of engineering tests ! under simulated reactor operating conditions. The successful performance i of the new drive under actual operating conditions has also been l demonstrated by consistently good in-service test results for plants . l using the new drive and may be inferred from plants using the older model i h ! the Safety Limit MCPR l 1 i j s i l

}            BFN                                                  3.3/4.3 17            AMENDM9fT N0. 216

Unit 1

1.1/2.1 FITEL CLADDINC INTEGRITY SAFETY LIMIT LIMITINC SAFETY SYSTDI SETTING 1.1 FDEL CLADDIM INTEGRITY 2.1 FUEL CLADDIM IETIGRITY Annlicability Annlicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior. which are provided to prevent ths reactor system safety limits from being exceeded. Oblactive Oh.iective To establish limits which To define the level of the ensure the integrity of the process variables at which fuel cladding. automatic protective action is initiated to prevent the fuel cladding integrity safety limit from being exe,eeded. Snecifications Snecifications The limiting safety system settings shall be as specified below: A. Tharmal Power Limits A. Neutron Flux Trin Settinas

1. Reactor Pressure >400 1. APEN Flux Scram psia and Core Flow Trip Setting

                      > 105 of Rated.                                                                                  (EUN Mode) (Flow Biased)

When the reactor pressure is greater a. When the Mode than 800 pain, the Switch is in existance of a minim = the 30N eritical power ratio position, the (MCPR) less than/,W/0 APEN flux aball constitute seren trip violation of the fuel setting cladding integrity shall be safety limit. RFN 1.1/2.1-1 Unit 2

                                                                         -  amm." Era.
                                              .                                                    i 1.1 m us; yet          noinc IrrrcafrY sArrvY LIMIT             g{7g The fuel cladding represents one of the physical barriers which separate radioactive materials from environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Althcugh some corrosion or use-related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from reactor operation significantly above design conditions and the protection system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking,                      j the thermally-caused cladding perforations signal a threshold,
                                                                                                    ~

beyond which still greater thermal stresses may cause gross rather than incremental cladding deterioration. Therefore, the fuel cladding safety limit is defined in terms of the reactor operating conditions which can result in cladding perforation. j 1 The fuel cladding integrity limit is set such that no calculated i fuel damage would occur as a result of an abeoreal operational 1 transient. Because fuel damage is not directly observable, the Fuel ) Cladding Safety Limit is defined with margin to the conditions which

1 would produce onset transition boiling (MCFR of 1.0). =' P K

        -eet:b1^ 22: : f:::     '_^ 't :T 2 ' t & -* ' _ ::tt' W ;:= :

fi.ib { 6) b Iz " - 1.07. u , 1.G7/ represents a -- conservative margin relative to the conditions regaired to maintain a fuel cladding integrity. j onset of transition boiling results in a decrease in heat transfer N' from the clad and, therefore, elevated clad temperature and the possibility of clad failure. Since boiling transition is not a j directly observable parameter, the margia to boilias transition is calculated free plant operating parameters such as core power, core j flow, feedwater temperature, and core power distribution. The # ! margin for each fuel assembly is characterised by the critical. power c l ratio (CPR) which is the ratio of the bundle power which would $ produce onset of transition boiling divided by the actual bundle d power. The minimma value of this ratio for any beundle in the core 4 is ths =4=i=== eritical power ratio (MCFR). It is assumed that the 3 plant operation is controlled to the naminal protective setpoints @ i via the ins,transated variables, i.e., normal plant operation g presessed on Figure 2.1-1 by the naminal expected flow control ! line. The Safety Limit 5 ;; 1.07) has sufficient conservatism $ ! to assure that in the event of an abnormal operational transient y initiated from a normal operating condition (Mcit > limits specified in Specification 3.5.K) more than 99.9 percent of the fuel rods in $ the core are expected to avoid boiling transition. The margin # be veen MCFR of 1.0 (onset of transition boiling) and the safety & pldA _ini L eP-is derived from a detailed statistical. analysis" .3 , consi ering all of the uncertainties in monitoring the core .$ operating state including uncertainty in the boiling transition 1 correlation as described in Reference 1. The uncertainties employed Y in deriving the safety limit are provided at the beginning of each ; fuel cycle. x BFN 1.1/2.1-8 TS 370 Unit 2 Letter Dated '95

                                                                                                                                                                         -m l

I i i 1.1 AMIA (cont'd) NOV 17 m 1 l 1 Because the boiling transition correlation is based on a large ! quantity of full scale data there is a very high confidence *ha*' ! operation of a fuel assembly at the condition of McFE A1.47tEu~ ld ,$ l not produce boiling transition. Thus, althour,h it is not required y 1 to establish the safety limit additional nargin exists between the I l ' safety limit and the actual occurrence of loss of cladding integrity. M i i a i l However, if boiling transition were to occur, clad perforation would b l l ! not be expected. Cladding temperatures would increase to x l { approximately 1,100*F which is below the perforation temperature of j l l the cladding material. This has been verified by tests in the u General Electric Test Reactor (GETI) where fuel similar in design to $ l BFNF operated above the critical heat flus for a significant period , l of time (30 minutes) without clad perforation. .c l If reactor pressure should ever exceed 1,400 paia during normal 3 l l power operation (the limit of applicability of the boiling transition correlation) it would be assumed that the fuel cladding l e !

integrity Safety Limit has been violat'ed.

i

                                                                                                                                                                                    $S I

! At pressures below 800 pois, the core elevation pressure drop l ) (0 power, 0 flow) is greater than 4.56 pai. At low powers and flom i this pressure differatial is maintained in the bypass region of the ; ! core. Since the pressure drop in the bypass region is esamtially l all elevation head, the core pressure drop at low power and flows l l willalwysbegreaterthan4.5pai. Analyses show that with a flow -{ ! of 2sx10 lbs/hr bundle flow, bundle pressure drop is nearly l independent of badle power and has a value of 3.5 pai. Thus, the i ' bandigflowwitha4.56poidrivingheadwillbegreaterthan 28x10 lbs/hr. Full scale ATL&S test data take at pressures from 14.7 pela to 800 psia indleate that the fuel assembly critical power at this flow is apprezimately 3.35 Ittt. With the design peaking i factors this corresponds to a core thermal power of more than 50 j , percent. Thus, a core thermal power limit of 25 pere nt for reactor i i pressures below 400 psia is conservative. i For the fuel in the core during periods wh a the reactor is shut I down, considerettom anst also be give to water level requirements due to the effect of decay heat. If water level should drop below the tap of the fuel during this time, the ability to remove decay } heat la reduced. This reduction in cooling capability could lead to i elevated elsdding temperatures and clad perforation. As long as the fuel remains covered with water, sufficiac cooling is available to prevent fuel clad perforation. 1 { 4 i RFN 1.1/2.1-9 TS 370

Unit 2 1.etter Dated 25

av . ~. I \ 2.1 B4231 (Cont'd) M 1 'T $ Analyses of the limiting transients show that no ser== adjustment is required to assure MCPE;:IR A W when the transient is initiated from MCPI limits specified in Specification 3.5.k.

2. APRM Flur Seram Trio Settina (BEFUEL or STARvDP/ HOT STANDFT M For operation in the startup mode while the reactor is at low pressure, the APIM scram setting of 15 percent of rated power provides adequate thermal margin between the setpoint and the safety limit, 25 percent of rated. The margin is adequate to accommodate anticipated maneuvers associated with power plant

;                                   startup. Effects of increasing pressure at zero or low void content are minor, cold water from sources available during startup is not much colder than that already in the system, temperature coefficients are small, and control rod patterns are constrained to be uniform by operating procedures backed up by the rod worth minimiser. Worth of individual rods is very low in a uniform rod pattern. Thus, of all possible sources of reactivity input, uniform control rod withdrawai is the most                              I probable cause of significant power rise. Because the flux distribution associated with uniform rod withdrawals does not                               {
    ~

involve high local peaks, and because several rods must be moved to change power by a significant percentage of rated power, the rate of power rise is very slow. Generally, the heat flux is in near equilibrius with the fission rate. In an assumed uniform rod withdrawal approa.ch to the seras level, the rate of power rise is no more than five percent of rated power per minute, and l the APEN system would be more than adequate to assure a scram before the power could exceed the safety limit. h 15 percent APEN scram remains active util the mode switch is placed in the

     .                              gN position. This switch occurs when reactor pressure is greater than 350 peig.

3. IEN Flux Scram Trin Settina l h IEN System consists of eight chambers, four in each of the !

reactor protection system logic channels. The IBM is a five-decade instruent which covers the range of power level between that covered by the SIM and the APIN. The five decades are covered by the IBM by means of a range switch and the five decades are broken down into 10 ranges, each being one-half of a decade in size. The IBM scram setting of 120 divisions is active in each range of the IBM. For example, if the instrument was on range 1, the scram setting would be 120 divisions for l that range; likewise if the instrument was on range 5, the scram setting would be 120 divisions for that range. l

is greater than the Safety Limit MCPR , BFN 1.1/2.1-13 TS 370 Unit 2 Letter Dated 11/17/95

                                                                            ~ < ac.

2.1 A&AIA (cont'd) g17g IEN Flur Scram Trin Settina (Continued) Thus, as the IRN is ranged up to accommodate the increase in power level, the scraa setting is also ranged up. A scram at 120 divisions on the IRN instruments remains in effect as long as the reactor is in the startup mode. In addition, the APRM 15 percent scram prevents higher power operation without being in the RUN node. The IEN scram provides protection for changes which occur both locally and over the entire cere. The most significant sources of reactivity change during the power increase are due to control rod withdrawal. For insequence control rod withdrawal, the rate of change of power is slow enough due to the physical limitation of withdrawing control rods that heat fluz is in equilibrium with the neutron fluz. An IEN scram would result in a reactor shatdown well before any SAFETY LIMIT is exceeded. For the case of a single control rod l withdrawal error, a range of rod withdrawal accidents was analysed. This analysis included starting the accident at various power levels. m most severe case involves an initial condition in which the reactor is just suberitical and the IEN system is not yet on scale. This condition exists at quarter rod density. Quarter rod density is discussed in paragraph 7.5.5.4 of the FSAR. Additional conservatism was taken in this analysis by asstuning that the IBM channel closest to the withdrawn rod is bypassed. N results of this analysis show that the reactor is scrammed and peak power limited to one percent of rated power, thus maintaining NCFR abovef3 iip 0&. Based on the above analysis, the IBM provides protection against local control rod withdrawal errors and continaeus withdrawal of control rods in sequence.-

4. Fixed Einh Bentram Flux Scram Tria ~

h average power range monitoring (APEN) systen, which is calibrated using heat balanes data taken during steady-state conditions, reads in percent of rated power (3,293 Mt). h

         .APEN system responds directly to neutres flux. Licensing analyses have demonstrated that with a neutrem flux scram of 120 percent of rated power, none of the abnormal operational transisats analysed violate the fuel SAFETT LIMIT and there is a          l substantial margin from fuel damage.

B. APEN Centrol Rod Block Reactor power level any be varied by moving control rods or by varying the recirculation flow rate. N APEN system provides a control rod block to prevent rod withdrawal beyond a given point at constant recirculation flow rate and thus prevents scram actuation. This rod block trip setting, which is automatically varied with recirculation loop flow rate, prevents an increase in the reactor power level to excess values due to control rod withdrawal. The flow variable trip setting is selected to provide adequate margin to the flow-biased scram setpoint. RF5 1.1/2.1-14 TS 370 Unit 2 , Letter Dated '/95

i i 2.1 AM &1 (Cont'd) NOV17jgg i ! C. Reactor water Low Level Scram ==d Isolation (rweent Main steam Lines) l The setpoint for the low level scram is above the bottom of the l separator skirt. This level has been used in transient analyses i dealing with coolant inventory decrease. The results reported in FSAR Subsection 14.5 show that scram and isolation of all process a lines (except main steam) at this level adequately protects the fuel j and the pressure barrier, because MCPR is greater than 4EG7/in all ! cases, and system pressure does not reach the safety valve I l settings. The scram setting is sufficiently below normal operating i range to avoid spurious scrams. l the Safety Limit MCPR l D. Turbina Ston Valve Closure Scram l The turbine stop valve closure trip anticipates the pressure, neutron flux and heat flux increases that would result from closure of the stop valves. With a trip setting of 10 percent of valve

closure from full open, the resultant increase in heat flux is such

! that adequate thermal margins are maintained even during the worst case transient that assumes the turbine bypass valves remain l closed. (Reference 2) . 1 i E. Turbina Centrol Valve Fast Closure r Turbine Trin Scram i ! Turbine control valve fast closure or turning trip serem anticipates i the pressure, neutron flux, and heat flux increase that could result from control valve fast closure due to load rejectica or control valve closure due to turbine trip; each without bypass valve j capability. The resetor protection system initiates a scram in less i than 30 milliseconds after the start of control valve fast closure due to load rejectica or control valve closure due to turbine trip. l j This scram is achieved by rapidly reducing hydraulic control oil l pressure at the main ca bine control valve actuator dise duse ! valves. This loss of pressure is sensed by pressure switches whose i contacts form tha <me-out-of-two-twice logic input to the reactor protection system. This trip setting, a naminally 50 percent greater closure time sad a different valve characteristic from that i of the turbine stop valve, combine to produce transients very similar to that for the stop valve. No significant change in McFR occurs. Relevant transient analyses are discussed in References 2 l and 3 of the Final Safety Analysis Report. This seras is bypassed j when turbine steam flow is below 30 percent of rated, as measured by j turbina first state pressure.

l 4 i s i i BFN 1.1/2.1-15 TS 370 Unit 2 Letter Dated '95

e. %

l 3.3/4.3 BMEA (cont'd) NOV 171995 t

5. The Rod Block Monitor (RBM) is designed to automatically prevant l fuel damage in the event of erroneous rod withdrawal from i locations of high power density during high power level

, operation. Two RBM channels are provided, and one of these may be bypassed from the console for maintenance and/or testing. i Automatic rod withdrawal blocks from one of the channels will ! block erroneous rod withdrawal soon enough to prevent fuel l damage. The specified restrictions with one channel out of j service conservatively assure that fuel damage will not occur due to rod withdrawal errors when this condition exists. s , C. Scram Insertion Times ! The control rod system is designed to bring the reactor suberitical at a l l l rate fast enou4h to prevent fuel damage; i.e., to prevent the MCPR froe ; ! ecoming less thaR4J07. The limiting power transients are given in l

Reference 1. Analysis of these transients shows that the negative reactivity rates resulting from the scram with the average response of i all drives as given in the above specifications provide the required l 2

protection and MCPR remains greater than,% "". j l On an early BWR, some degradation of control rod scram performance ' l occurred during plant STARTUP and was determined to be caused by l particulate material (probably construction debris) plugging an internal , s . control rod drive filter. The design of the present control rod drive l (Model 7tDB1445) is grossly improved by the relocation of the filter to a l j location out of the scram drive path; i.e., it can no longer interfere j with scram performance, even if completely blocked. l l The degraded performance of the original drive (CRD7tDB144&) under dirty l operating conditions and the insensitivity of the redesigned drive [ (CBD7EDS1445) has been demonstrated by a series of engineering tests l tmder simulated reactor operating conditions. The successful performance ! of the new drive under actual operating conditions has also been l demonstrated by consistently good in-service test results for plants l using the new drive and may be inferred from plants using the older model i l ' } the Safety Limit MCPR l i - 4 I i

i 4 i i 3.3/4.3 17 TS 370 l BFN Letter Dated '95 Unit 2

2 l

. -e: .

i 1.1/2.1 FUEL CtAnDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1.1 NEL CLADDING. INTEGRITY 2.1 FUEL CLADDING IlffEGRITY Annlicability Aeolicability l Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior. which are provided to prevent the reactor system safety limits from being i exceeded. j Obiective Obiective l To establish limits which To define the level of the l ensure the integrity of the process variables at which j j fuel cladding. autmatic protective action ' i is initiated to prevent the l fuel cladding integrity safety limit from beins ! exceeded. i I Snecification Snacification { The limiting safety system j settings shall be as i specified below: ) A. Tharmal Power Limita A. Heutron Flux Trin j Settinas ) 1. Reactor Pressure >800 1. AFEN Flux Scram paia and Core Flow Trip Setting

                                                                                      > 105 of Rated.                                                         (Run Mode) (Flow Biased)

When the reactor pressure is greater a. When the Mode than 800 peia, the Switch is in existence of a minimum the RUN critical power ratio position, the (MCFR) less than 4WS- - APEN flux aball constitute / /d scram trip violation of the fuel setting cladding integrity shall be: safety limit. BFN 1.1/2.1-1 Unit 3 p

ex. -r. 1.1. RHESt FmtL tmDIlm INTEGRITY SAFETY LIMIT NOV 17 em The fuel cladding represents one of the physical barriers which separate radioactive materials from environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use-related cracking may occur during the life of the cladding, fission product migrstion from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from reactor operation significantly above design conditions and the protection system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking, the thermally-caused cladding perforations signal a threshold, beyond which still greater thermal stresses may cause gross rather than incremental cladding deterioration. Therefore, the fuel cladding safety limit is defined in terms of the reactor operating conditions which can result in cladding perforation. The fuel cladding integrity limit is set such that no calculated fuel damage would occur as a result of an abnormal operational transient. Because fuel damage is not directly ob, servable, the Fuel % Cladding Safety Limit is defined with nargin to the conditions which a would produce onset transition boiling (MCPR of 1.0). S': '

           - t d1' 9 r : *:":'- L' 't :                           '" t ?? ' ' --_. riti::.1 nn; #/          ,$
       ~*-::t'                              ( M i: .- 1--- '- 1.07.   '""2" ; 1.07/ represents a          l     a conservative margin relative to the conditions required to maintain                                 j fuel cladding integrity.                                                                             3 a

Onset of transition boiling results in a decrease in heat transfer d from the clad and, therefore, elevated clad temperature and the j possibility of clad failure. Since boiling transition is not a directly observable paramater, the margin to boiling transition is ,$ calculated from plant operating parameters such as core power, core # flow, feedwater tesperature, and core power distribution. The c margin for each fuel assembly is characterised by the critical power .E ratio (CFR) whfch is the ratio of the bundle power which would produce onset of transition boiling divided by the actual bundle y power. The minimus value of this ratio for any bundle in the core u is the mini = = critical power ratio (MCFR). It is asem ed that the $ plang operation is controlled to the naminal protective setpoints y via the instruented variables, i.e., normal plant operation presented on Figure 2.1-1 by the nominal expected flow control $ liar. The Safety Limit (L.. vi uvry has sufficient conservatism @ to assare that in the event of an abnormal operational transient , initiated from a normal operating condition (MCPR > limits specified .c in Specification 3.5.K) mors than 99.9 percent of the fuel rods in the core are expected to avoid boiling transition. The margin p between MCPR of 1.0 (onset of transition boiling) and the.pafety a

C g M ~~~15s3%beis derived from a detailed statistical analysis considering all of the uncertainties in monitoring the core j operating state including uncertainty in the boiling transition c correlation as described in Reference 1. The acertainties empic'/d 1 in deriving the safety limit are provided at the beginning of each

fuel cycle.

BFN 1.1/2.1-8 TS 370 Unit 3 Letter Dated I;

! ser -A i l d I l l f 1.1 AMER (Cont'd) NOV 17193 ! Because the boiling transition correlation is based on a large I quantity of full scale data there is a very high confidence that ! operation of a fuel assembly at the condition of MCPR E.ke7[would ' k i not produce boiling transition. Thus, although it is not required W !- to establish the safety limit additional margin, exists between the j safety limit and the actual occurrence of loss-of-eladding integrity. M , . m l However,'if boiling transition were to occur, clad perforation would b i not be expected. Cladding temperatures would increase to >, j approximately 1,100'y which is below the perforation temperature of a the cladding material. .This has been verified by tests in the u l ! General Elaetric Test Reactor (GETR) where fuel similar in design to 02 l BFEF operated above the critical heat flux for a significant period e of ties (30 minutes) without clad parforation. j l If reactor pressure should ever eseaed 1,400 paia during normal O ! power operation (the limit of applicability of the boiling g transition correlation) it would be assmed that the fuel cladding a l j integrity Safety Limit has been violated. @, e i At pressures below 800 peia, the core elevation pressure drop

(0 power, O flow) is greater than 4.56 pai. At low powers and flows 1

this pressure differential is maintained in the bypass region of the core. Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows i be greater than 4.5 pai. Analyses show that with a flow i willalvplbs/hrbundleflow,bundlepressuredropisnearly of 28x10 independent of bundle power and has a value of 3.5 psi. Thus, the bandig flow with a 4.56 poi driving head will be greater than 24x10* lbs/hr. Full scale ATLAS test data takaa at pressures from 14.7 pela to 800 pela indicate that the fuel assembly critical power i at this flow is approximately 3.35, Nft. With the design peaking factors this correspends to a core thermal power of more than 50 percent. Thus, a core thermal power limit of 25 percent for reactor pressures below 800 pais is conservative. For the feel in the core during periods when the reactor is shot doun, consideraties mest also be given to water level requirements due to the effect of decay heat. If water level abould drop below the top of~the fuel daring this time, the ability to remove decay heat-tr reduced. Thia reduction in cooling capability could lead to eleveqes cladMag temperatures and clad perforation. As long as the fuel remains covered with water, sufficient cooling is available to prevent fuel clad perforation. BFN 1.1/2.1-9 TS 370 Unit 3 Letter Dated 11/.' 45

e -G l l [ 2 .1- R&131 (Cont'd) NOV 1 7 1995 l Analyses of the limiting transients show that no scram _ ! adjustment is required to assure MCPR #%@7j1then the transient is initiated from MCPR limits specified in Specification 3.5.k. l l

2. APEN Flur Scram Trio Settina (REFUEL or STARvUP/ HOT STANDBY MODE) f For' operation in the startup mode while the reactor is at low }

I pressure, the APRM scram setting of 15 percent of rated power ! provides adequate thermal margin between the setpoint and the { safety limit, 25 percent of rated. The margin is adequate to

               -                  accessmodate anticipated maneuvers associated with power plant l

startup. Effects of increasing pressure at zero or low void i content are minor, cold water from sources available during l startup is not much colder than that already in the system, ! temperature coefficients are small, and control rod patterns are I constrained to be uniform by operating procedures backed up by I the rod w9rth minimizer. Worth of individual rods is very low in a uniform rod pattern. Thus, of all possible sources of I ! reactivity input, uniform control rod withdrawal is the most f l probable cause of significant power rise. Because the fitat i distribution associated with uniform rod withdrawals does not involve high local peaks, and because several rods must be moved l' to change power by a significant percentage of rated power, the k y rate of power rise is very slow. Generally, the heat flux is in near equilibrium with the fission rate. In an assumed uniform rod withdrawal approach to the scram level, the rate of power rise is no more than 5 percent of rated power per minute, and l j the APEN system would be more than adequate to assure a scram before the power could exceed the safety limit. The 15 percent i APEN scram remains active until the mode switch is placed in the l, RUE position. This switch occurs when reactor pressure is ji greater than 850 peig.

3. IEN Flur Scram Trin Satt4mm l

l The IRN System consists of eight chambers, four in each of the l l reactor protection system logic channels. The IEN is a j five-decade instrument which covers the range of power level between that covered by the SIN and the APEN. The five decades , ) , are covered by the IEN by means of a range switch and the five l l, decadas are broken down into 10 ranges, each being one-half of a l j decade in size. The IRN scram setting of 120 divisions is active in each range of the IRN. For exampic, if the instrument was on range 1, the scram setting would be 120 divisions for ! - that range; likewise if the instrument was on range 5, the scram j setting would be 120 divisions 'r that range. l 1 i y is greater than the Safety Limit MCPR i i 4 i BFN 1.U2.1-13 TS 370 l Unit 3 Letter Dated <5

1

l - -- l i - i l 2.1 3M31 (Cont'd) gy 17 g i l I M Flur Scram Trin Settina (Continued) 1 l I l Thus, as the IBM is ranged up to accommodate the increase in i j power level, the scram setting is also ranged up. A scram at 120 divisions on the IBM instruments remains in effect as long j j as the reactor is in the startup mode. In addition, the APRM i i 15 percent scram prevents higher. power operation without being ! ! in the RUN mode. The IBM scram provides protection for changes l which occur both locally and over the entire core. The most l ! significant sources of reactivity change during the power i increase are due to control rod withdrawal. For insequence l control rod withdrawal, the rate of change of power is slov l enough due to the physical limitation of withdrawing control l I i rods that heat flux is in equilibrium with the neutron flux. An i l j IBM scram woud result in a reactor shutdown veil b6fere any I i SAFETY LIMIT is exceeded. For the case of a single conteel rod withdrawal error. a range of rod withdrawal accidents was l analyzed. This analysis included starting the accident at I various power levels. The most severe case' involves an initial condition in which the reactor is just suberitical and the IBM l system is not yet on scale. This condition exists at quarter l l rod density. Quarter red density is discussed in l l paragraph 7.5.5.4 of the FSAR. Additional conservatian was l l taken in this analysis by aseming that the IBM channel closest j to the withdrawn rod is bypassed. The results of this analysis show that the reactor is scrammed and peak power limited to one percent of rated power, thus maintaining MCPR abovefG42. Based l on the above analysis, the IBM provides protection against local i

control rod withdrawal errors and contianous withdrawal of .

control rods in sequence. l the Safsty Limit MCPR l j 4. F4wed Elah Beatron Flur Scram Tria l The average power range monitoring (APRM) system, which is l calibrated using heat balance data taken during steady-state l i conditions, reada in percent of rated power (3,293 fett). The l APRM system responds directly to neutron fluz. Licensing analyses have demonstrated that with a neutron flus scram of 120 percent of rated power, none of the abnormal operational transients analysed violate the fuel SAFETY LIMIT and there is a l sekstantial margin from fuel damage. ,i i B. APRM Centrol Rod Block l i 4 Reactor power level may be varied by moving control rods or by varying the recirculation flow rate. The APRM system provides a } control rod block to prevent rod withdrawal beyond a given point at j J constant recirculation flow rt.te and thus prevents scram actuation. j This rod block trip setting, which is automatically varied with recirculation loop flow rate, prevents an increase in the reactor i 1 1 1.1/2.1-14 TS 370 ! BFR Letter Dated 1. ' i Unit 3

4 / 1 2.1 gg31 (Cont'd) MAY 1 1 g

power level to excess values due to control rod withdrawal. The

. flow variable trip setting is selected to provide adequate margin to the flow-biased scram setpoint. C. Reactor Water Low Level Scram =d Isolation (Excent Main Steam Lines) 1 The setpoint for the low level scram is above the bottom of the separator skirt. This level has been used in transient analyses dealing with coolant inventory decrease. The results reported in FSAR subsection 14.5 show that scram and isolation of all process

lines (except main steam) at this level adequately protects the fuel and the pressure barrier, because MCPR is greater than b S7[in all ]

cases, and system pressure does not reach the safety valve I i settings. The scram setting is sufficiently below normal opere*fus ) range to avoid spurious scrams. D. Turbina Stoo Valve Closure Scram a The turbine stop valve closure trip anticipates the pressure, neutron flux and heat flux increases that would result from closure of the stop valves. With a trip setting of 10 percent of valve closure from full open, the resultant increase in heat fluz is such that adequate thermal margins are maintained even during the worst case transient that ass ees the turbine bypass valves remain closed. (Reference 2) , 1 i R. Turbine Centrol Valve Fast closure or Turbina Trin Scram Turbina control valve fast closure or turbina trip scram anticipates the pressure, neutron flux, and heat flux increase that could result from control valve fast closure due to load rejection or control valve closure due to turbine trips each without bypass valve capability. The reactor protection system initiates a scram in less than 30 milliseconds after the start of control valve fast closure due to load rejection or control valve closure due to turbina trip. l This scram is achieved by rapidly reducing hydraulie control vil ; pressure at the main turbine control valve actuator dise duny l valves. This loss of pressure is sensed by pressure switches whose contacts form the one-out-of-two-twice logie input to the reactor protecties system. This trip setting, a naminally 50 percent greater closure time and a different valve characteristic from that of the turbina stop valve, combine to produce transients very similar to that for the stop valve. No significant change in MCPR occurs. Relevant transient analyses are discussed in References 2 and_3 of the Final Safety Analysis Report. This scram is bypassed when turbine steam flow is below 30 percent of rated, as measured by turbine first state pressure. BFN 1.1/2.1-15 TS 357 - TVA Letter 8 Unit 3 Dated 05/18/95

i '.

                                                                                                              & ~~.

4 l l 3.3/4.3 AMER (Cont'd) i NOV 17195

5. The Rod Block Monitor (RBM) is designed to automatically prevent fuel i

damage in the event of erroneous rod withdrawal from locations of high power density during high power level operation. Two RBM channels are i provided, and one of these may be bypassed from the console for

j. maintenance and/or testing. Automatic rod withdrawal blocks from one i

of the. channels will block erroneous rod withdrawal soon enough to prevent fuel damage. The specified restrictions with one channel out ! of service conservatively assure that fuel damage will not occur due j to rod withtraval errors when this condition exista. 1 j C. Scram Insertion Times ! The control rod system is designed to bring the reactor suberitical at a l rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from i oming less than; W The limiting power transients are given in i Reference 1. Analysis of these transients shows that the negative i reactivity rates resulting from the scram with the average response of all ! drives as given in the above specifications provide the required l protection and MCPR remains greater than,% 897- q

on an early BWR, some degradation of control rod scram performance j occurred during plant STARTUP and was determined to be caused by l particulate material (probably construction debris) plugging an internal

! control rod drive filter. The design of the present control rod drive j (Model 7EDB1448) is grossly improved by the relocation of the filter to a l location out of the scram drive path; i.e., it can no longer interfere with scram performance, even if completely blocked. The degraded performance of the original drive (CBD7EDB144&) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7EDB1448) has been demonstrated by a series of engineering tests under sinalated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by l consistently good in-service test results for plants using the new drive ! and may be inferred from plants using the older model j the Safety Limit MCPR i l BFN 3.3/4.3-17 TS 370 Unit 3 _ - _ 3mnm )*vnLa l ' ' ' -

ENCLOSURE 3 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN) UNITS 1, 2, AND 3 PROPOSED TECHNICAL SPECIFICATION (TS) CHANGE TS-377 REVISED PAGES 4 I. AFFECTED PAGE LIST Unit 1 Unit 2 Unit 3 l 1 1.1/2.1-1 1.1/2,1-1 1.1/2.1-1 l' 1.1/2.1-8 1.1/2.1-8 1.1/2.1-8 1.1/2.1-9 1.1/2.1-9 1.1/2.1-9 1.1/2.1-13 1.1/2.1-13 1.1/2.1-13 1.1/2.1-14 1.1/2.1-14 1.1/2.1-14 3 , 1.1/2.1-15 1.1/2.1-15 1.1/2.1-15 3.3/4.3-17 3.3/4.3-17 3.3/4.3-17 II. REVISED PAGES See attached.

  *  - Denotes spillover page l

l ~ M. 1.1/2.1 FUEL CLADDING INTEGRITY l SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1.1 FUEL CLADDING INTEGRITY 2,1 FUEL CLADDING INTEGRITY Aeolicability Aeolicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices l thermal behavior, which are provided to prevent the reactor system safety limits from being exceeded. l Obiective Obiective l To establish limits which To define the level of the l ensure the integrity of the process variables at which fuel cladding, automatic protective action is initiated to prevent the fuel cladding integrity safety limit from being exceeded. Soecifications Specifications The limiting safety system settings shall be as specified below: A. Thermal Power Limits A. Neutron Flux Tr(p Settinam

1. Reactor Pressure >800 1. APRM Flux Scram psia and Core Flow Trip Setting

                      > 10% of Rated.                                   (.R un Mode) (Flow biased)

When the reactor pressure is greater a. When the than 800 psia, the Mode Switch existence of a minimum is in the critical power ratio RUN (MCPR) less than 1.10 l position, shall constitute the APRM violation of the fuel flux scram cladding integrity trip setting safety limit. shall be: i I i BFN 1.1/2.1-1 Unit 1

W b l 1.1 BASEST FUEL CLADDING INTEGRITY SAFETY LIMIT The fuel cladding represents one of the physical barriers which separate radioactive materials from environs. The integrity of this cladding l barrier is related.to its relative freedom from perforations or cracking. Although some corrosion or use-related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from reactor operation significantly above design conditions and the protection system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking, the thermally-caused cladding perforations signal.a threshold, beyond which still greater thermal stresses may cause gross rather than incremental cladding deterioration. Therefore, the fuel cladding safety limit is defined in terms of the reactor operating conditions which can result'in cladding perforation. The fuel cladding integrity limit is set such that no calculated fuel damage would occur as a result of an_ abnormal operational transient. Because fuel damage is not directly observable, the Fuel Cladding Safety Limit is defined with margin to the conditions which'would produce onset transition boiling (MCPR of 1.0). Maintaining the MCPR greater than the l Safety Limit MCPR represents a conservative margin relative to the l conditions required to maintain fuel cladding integrity. j onset of transition boiling _results in a decrease in heat transfer from the clad and, therefore, elevat.ed clad temperature and the possibility of clad failure. Since boiling transition is not a directly observable parameter, the margin to boiling transition is calculated from plant operating parameters such as core power, core flow, feedwater temperature, and core power distribution. The margin for each fuel assembly is characterized by j the critical power ratio (CPR) which is the ratio of.the bundle power which would produce onset of transition boiling, divided by the actual bundle power. The minimum value of this ratio for any bundle in the core is the minimum critical power ratio (MCPR). It is assumed that the plant operation is controlled to the nominal protective setpoints via the instrumented variables, i.e., normal plant operation presented on Figure 2.1-1 by the nominal expected flow control line. The Safety Limit d has suf ficient conservatism to assure' that in the event of an abnormal operational transient initiated from a normal operating condition (MCPR > limits specif,ied in Specification 3.5.K) more than 99.9 percent of the fuel rods in the core are expected to avoid boiling transition. The margin between MCPR of 1.0 (onset of transition boiling) and the Safety Limit MCPR l is derived from a detailed statistical analysis considering all of the uncertainties in monitoring the core operating state including uncertaint,.- in the boiling transition correlation as described in Reference 1. The uncertainties employed in deriving the safety limit are provided at the beginning of each fuel cycle. BFN 1.1/2.1-8 Unit 1

     .        .          .   ~-       - - - - . .-           - ~        -

4 l l s 1 1.1 BASES (Cont'd) Because the boiling transition correlation is based on a large quantity of full scale data there is a very high confidence that operation of a fuel assembly at the condition of MCPR equal to the Safety Limit MCPR would not l produce boiling transition. Thus, although it is not required to establish the safety limit additional margin exists between the safety limit and the actual occurrence of loss of cladding integrity. I However, if boiling transition were to occur, clad perforation would not be j expected. Cladding temperatures would increase to approximately 1100 0 F j which is below the perforation temperature of the cladding material. This l has been verified by tests in the General Electric Test Reactor (GETR) i where fuel similar in design to BFNp operated above the critical heat flux for a significant period of time (30 minutes) without clad perforation. If reactor pressure should ever exceed 1400 psia during normal power operation (the limit of applicability of the boiling transition correlation) it would be assumed that the fuel cladding integrity Safety Limit has been violated. 1 At pressures below 800 psia, the core elevation pressure drop (o power, j 0 flow) is greater than 4.56 psi. At low powers and flows this pressure differential is maintained in the bypass region of the core. Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low powers and flow will always be greater than 4.56 psi. Analyses show that with a' flow of 28x10 3 lbs/hr bundle flow, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.56 psi driving head will be greater than 28x10 3 lbs/hr. Full scale ATLAS test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors this corresponds to a core thermal power of more than 50 percent. Thus, a core thermal power limit of 25 percent for reactor pressures below 800 psia is conservative. For the fuel in the core during periods when the reactor is shut down, consideration must also be given to water level requirements due to the effect of decay heat. If water level should drop below the top of the fuel during this time, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation. As long as the fuel remains covered with water, sufficient cooling is available to prevent fuel clad perforation. BFN 1.1/2.1-9 Unit 1

l 2.1 BASES (Cont'd) 9 Analyses of the limiting transients show that no scram adjustment is required to assure MCPR is greater than the Safety Limit MCPR when the l transient is initiated from MCPR limits specified in Specification 3.5.k. I

2. APRM Flux Scram Trio Settina (REFUEL or STARTUP/ HOT STANDBY MODE) l For operation in the startup mode while the reactor is at low pressure, !

the APRM scram setting of 15 percent of rated power provides adequate thermal margin between the cetpoint and the safety limit, 25 percent of rated. The margin is adequate to accommodate anticipated maneuvers associated'with power plant startup. Effects of increasing pressure at zero or low void content are minor, cold water from sources available during startup is not much colder than that already in the system, temperature coefficients are small, and control rod patterns are constrained to be uniform by operating procedures backed up by the rod worth minimizer. Thus, of all possible sources of reactivity input, uniform control rod withdrawal is the most probable cause of significant power rise. Because the flux distribution associated with uniform rod withdrawals does not involve high lo. cal peaks, and because j several rods must be moved to change power by a significant percentage - of rated power, the rate of power rise is very slow. Generally, the heat flux is in near equilibrium with the fission rate. In an assumed uniform rod withdrawal approach to the scram level, the rate of power rise is no more than 5 percent of rated power per minute, and the APRM system _would be more than adequate to assure a scram before the power j could exceed the safety limit. The 15 percent APRM scram remains active until the mode switch is placed in the RUN position. This switch occurs when reactor pressure is greater than 850 psig.

   '3. IRM Flux Scram Trio Settino                                                    I The IRM System consists of 8 chambers, 4 in each of the reactor protection system logic channels. The IRM is a 5-decade instrument which covers the range of power level between that covered by the SRM and the APRM,   The 5 decades are covered by the IRM by means at a range switch and the 5 decades are broken down into 10 ranges, each bel.1g one-half of a decade in size. The IRM scram setting of 120 divisions is active in each range of the IRM. For example, if the instrument were on range 1, the scram setting would be at 120 divisions for that range; likewise if the instrument was on range 5, the scram setting would be 120 divisions on that range.

BFN 1.1/2.1-13 Unit 1

 - _ _ _    . . _ ~               -            . _ _            - -         . . _  ,      _        - -..

i ! l 2.1 BASES (Cont'd) IRM Flux Scram Trio Settino (continued) [ Thus, as the IRM is ranged up to accommodate the increase in power level, the scram setting is also ranged up. P. scram at 120 divisions ; on the IRM instruments remains in effect as long as the reactor is in { i the startup mode. In addition, the APRM 15 percent scram prevents. l l higher, power operation without being in the RUN uode. The IRM scram l l provides protection for changes which occur both locally and over the entire core. The most significant sources of reactivity change during the power increase are due to control rod withdrawal. For insequence control rod withdrawal, the rate of change of power is slow enough due to the physical limitation of withdrawing control rods that heat flux ] ! is in equilibrium with the neutron flux. An IRM scram would result in ! ( a reactor shatdown well before any SAFETY LIMIT is exceeded. For the { case of a single control rod withdrawal error, a range of rod I withdrawal accidents was analyzed. This analysis included starting the accident at various power levels. The most severe case involves an l initial condition in which the reactor is just suberitical and the IRM l system is not yet on scale. This condition exists at quarter rod density. Quarter rod density is illustrated in paragraph 7.5.5 of the FSAR. Additional conservatism was taken in this analysis by assuming l l that the IRM channel closest to the withdrawn rod is bypassed. The l results of this analysis show that the reactor is scrammed and peak power limited to one percent of rated power, thus maintaining MCPR 1 above the Safety Limit MCPR. Based on the above analysis, the IRM l l provides protection against local control rod withdrawal errors and continuous withdrawal of control rods in sequence.

4. Fixed Hioh Neutron Flux Scram Trir l

l The average power range monitoring (APRM) system, which is calibrated using heat balance data taken during steady-state conditions, reads in percent of rated power (3,293 MWt). The APRM system responds directly to neutron flux. Licensing analyses have demonstrated that with a neutron flux scram of 120 percent of rated power, none of the abnormal operational transients analyzed violate the fuel SAFETY LIMIT and there is a substantial margin from fuel damage. B. APRM control Rod Bloch Reactor power level may be varied by moving control rods or by varying the recirculation flow rate. The APRM system provides a control rod block to prevent rod withdrawal beyond a given point at constant recirculation flow rate and thus prevents scram actuation. This rod block trip setting, which is automatically varied with recirculation loop flow rate, prevents an

increase in the reactor power level to excess values due to control rod j withdrawal. The flow variable trip setting is selected to provide adequate j margin to the flow-biased scram setpoint.

l l r BFN 1.1/2.1-14 Unit 1

1 l I 2.1 SASES (Cont'd) l C. Reactor Water Low Level Scram and Isolation (Excent Main Steam Lines) l The setpoint for the low level scram is above the bottom of the separator ' skirt. This level has been used in transient analyses dealing with coolant inventory decrease. The results reported in FSAR subsection 14.5 show that scram and isolation of all process lines (except main steam) at this level adequately protects the fuel and the pressure barrier, because MCPR is ' greater than the Safety Limit MCPR in all cases, and system pressure does l not reach the safety valve settings. The scram setting is sufficiently below normal operating range to avoid spurious scrams. D. Turbine Ston Valve Closure Scram ) The turbine stop valve closure trip anticipates the pressure, neutron flux and heat flux increases that would result from closure of the stop valves. With a trip setting of 10 percent of valve closure from full open, the I resultant increase in heat flux is such that adequate thermal margins are l maintained even during the worst case transient that assumes the turbine bypass valves remain closed. (Reference 2) E. Turbine Control Valve Fast Closure or Turbine Trio Scram Turbine control valve fast closure or turbine trip scram anticipates the l pressure, neutron flux, and heat flux increase that could result from control valve fast closure due to load rejection or control valve closure due to turbine trip; each without bypass valve capability. The reactor ; protection system initiates a scram in less than 30 milliseconds after the I start of control valve fast closure due to lead rejection or control valve closure due to turbine trip. This scram is achieved by rapidly reducing , hydraulic control oil pressure at the main turbine control valve actuator disc dump valves. This loss of pressure is sensed by pressure switches whose contacts form the one-out-of-two-twice logic input to the reactor protection system. This trip setting, a nominally 50 percent greater closure time and a different valve characteristic from that of the turbine stop valve, combine to produce transients very similar to that for the stop valve. No cignificant change in MCPR occurs. Relevant transient analyses are discussed in References 2 and 3 of the Final Safety Analysis Report. This scram is bypassed when turbine steam flow is below 30 percent of rated, as measured by turbine first state pressure. BFN 1.1/2.1-15 Unit 1

_ _ , _ . ~ . _ _ . . _ _ _ _ . . . _ _ _ _ _ _ . . . . _ _ _ _ _ . . . _ - .... _ _.. _ _ _._ _ __ _ m ___ 1

j' 3.3/4.3 BASES (Cont'd) j 1 l' 5. The Rod Block Monitor (RBM) is designed to automatically prevent I fuel damage in the event of erroneous rod withdrawal from ) locations of high power density during high power level operation. Two RBM channels are provided, and one of these may be bypassed from the console for maintenance and/or testing. Automatic rod withdrawal blocks from one of the channel's will block erroneous ; rod withdrawal soon enough to prevent fual damage. The specified ! restrictions with one channel out of service conservatively assure that fuel damage will not occur due to rod withdrawal errors when this condition. exists. C. scram insertion Timan ' The control rod system is designated to bring the reactor subcritical at the rate fast enough to prevent fuel damage; i.e., to prevent'the MCPR from-becoming less than the Safety Limit MCPR. The limiting power transient is l given in Reference 1. Analysis of this transient shows that the negative reactivity rates resulting from the scram with the average response of all the drives as given in the above specification provide the required

                                                   ' protection, and MCPR remains greater than the Safety Limit MCPR.                                                l     l On an early BWR, some degradation of control rod scram performance occurred                                          ,

during plant startup and was determined to be caused by particulate material (probably construction debris) plugging an internal control rod drive filter. The design of the present control rod drive -(Model 7RDB144B) is grossly improved by the relocation of the filter to a. location out of the scram drive path; i.e.,; it can no longer interfere with scram performance, even if completely blocked. The degraded performance of the original drive (CRSIRDBA?4A) under dirty operating conditions and the insensitivity of tLe redesigned drive 1 (CRD7RDB144B) has been demonstrated by a series of engineering tests i under simulated reactor operating conditions. The successful performance of the new drive under actual. operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and may be inferred from plants using the older model J l BFN 3.3/4.3-17 Unit.1

W To j 1.1/2:1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1.1 FUEL CLADDING INTEGRIIX 2.1 FUEL CLADDING INTEGRITY l Aeolicability Aeolicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior, which are provided to prevent the reactor system safety 3 limits from being exceeded. Obiective obiective To establish limits which To define the level of the ensure the integrity of the process variables at which fuel cladding. automatic protective action is initiated to prevent the fuel cladding integrity safety limit from being exceeded. Seecifications Seecifications The limiting safety system settings shall be as specified below: A. Thermal Power Limits A. Neutron Flux Trio Settings

1. Reactor Pressure >800 1. APRM Flux Scram psia and Core Flow Trip Setting (RUN Mode) (Flow

                        > 10% of Rated.

Biased) Wh*tn the reactor pressure is greater a. When the Mode than 800 psia, the Switch is in existence of a minimum the RUN critical power ratio position, the l (MCPR) less than 1.10 APRM flux shall constitute scram trip violation of the fuel setting cladding integrity shall be: safety limit. BFN 1.1/2.1-1 Unit 2

                                                                         . e 1

l 1.1 BASEST FUEL CLADDING INTEGRITY SAFETY LIMIT The fuel cladding represents one of the physical barriers which separate radioactive materials from environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use-related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from j reactor operation significantly above design conditions and the protection I system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking, the thermally-caused cladding perforations signal a threshold, beyond which still greater thermal stresses may cause gross rather than incremental l cladding deterioration. Therefore, the fuel cladding safety limit is ; defined in terms of the reactor operating conditions which can result in I cladding perforation. l 1 The fuel cladding integrity limit is set such that no calculated fuel damage would occur as a result of an abnormal operational transient. Because fuel damage is not directly observable, the Fuel Cladding Safety ! Limit is defined with margin to the conditions which would produce onset ! transition boiling (MCPR of 1.0). Maintaining the MCPR greater than the Safety Limit MCPR represents a conservative margin relative to the conditions required to maintain fuel cladding integrity. Onset of transition boiling results in a decrease in heat transfer from the clad and, therefore, elevated clad temperature and the possibility of clad failure. Since boiling transition is not a directly observable parameter,

the margin to boiling transition is calculated-from plant operating. parameters such as core power, core flow, feedwater temperature, and core ; power distribution. The margin for each fuel assembly is characterized by l the critical power ratio (CPR) which is the ratio of the bundle power which would produce onset of transition boiling divided by the actual bundle power. The minimum value of this ratio for any bundle in the core is the l minimum critical power ratio (MCPR). It is assumed that the plant operation is controlled to the nominal protective setpoints via the instrumented variables, i.e., normal plant operation presented on , Figure 2.1-1 by the nominal expected flow control line. The Safety Limit d l has sufficient conservatism to assure that in the event of an abnormal operational transient initiated from a normal operating condition (MCPR > limits specified in Specification 3.5.K) more than 99.9 percent of the fuel rods in the core are expected to avoid boiling transition. The margin between MCPR of 1.0 (onset of transition boiling) and the Safety Limit MCPR l ) is derived from a detailed statistical analysis considering all of the ! uncertainties in monitoring the core operating state including uncertainty )

   .in th'e boiling transition correlation as described in Reference 1. The                         l uncertainties employed in deriving the safety limit are provided at the                         j beginning of each fuel cycle.                                                                   '

l BFN 1.1/2.1-8 Unit 2

                                                                                    ~ *:

t 4 ! 1.1 BASES (Cont'd) Because the boiling transition correlation is based on a large quantity of j full scale data-there is a very high confidence that operation of a fuel j j assembly at the condition of MCPR equal to the Safety Limit MCPR would not l d produce boiling transition. Thus, although it is not required to establish the safety limit additional margin exists between'the safety limit and the actual occurrence of loss of cladding integrity. I 4 However, if boiling transition were to occur, clad perforation would not be expected. Cladding temperatures.would increase to approximately 1,100 0F ? which is below the perforation temperature of the cladding material. This ,

has been verified by tests in the General Electric Test Reactor (GETR) )
where fuel similar in design to BFNP operated above the critical heat flux

{ for a significant period of time (30 minutes) without clad perforation. ' l If reactor pressure should ever exceed 1,400 psia during normal power ! operation (the limit of applicability of the boiling transition

.              correlation) it would be assumed that the fuel cladding integrity Safety I

Limit has been violated. At pressures below 800 psia, the core elevation pressure drop (o power, i 1 0 flow) is greater than 4.56 psi. At low powers and flows this pressure i l differential is maintained in the bypass region of the core. Since the ] pressure drop in the bypass region is essentially all elevation head, the

- core pressure drop at low power and flows will always be greater than

! 4.5 psi. Analyses show that with a flow of 28x10 3 lbs/hr bundle flow, i bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.56 psi driving head will be greater than 28x103 lbs/hr. Full scale ATLAS test data taken at pressures

;             -from 14.7 psia to 800 psia indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors I               this corresponds'to a core thermal power of more than 50 percent. Thus, a

core thermal power limit of 25 percent for reactor pressures below 800 psia
is conservative.

For the fuel in the core during periods when the reactor is shut down,

consideration must also be given to water level requirements due to the
effect of decay heat. If water level should drop below the top of the fuel during this time, the ability to remove decay heat is reduced. This
reduction in cooling capability could lead to elevated cladding

] temperatures,and clad perforation. As long as the fuel remains covered

with water, sufficient cooling is available to prevent fuel clad perforation.

1 4 j i BFN 1.1/2.1-9 Unit 2

 .- . . - -         -.                -                .   =  -       .     .          . _ _ . .
                                                                                    = -1 l

l i l l 2.1 BASES (Cont'd) ' l Analyses of the limiting transients show that no scram adjustment is required to assure MCPR is greater than the Safety Limit MCPR when the l 1 transient is initiated from MCPR limits specified in I

Specification 3.5.k.

i

2. APRM Flux Scram Trio Settino (REFUEL or STARTUP/ HOT STANDBY MODE) I

' l For operation in the startup mode while the reactor is at low ! pressure, the APRM scram setting of 15 percent of rated power provides adequate thermal margin between the setpoint and the safety limit, 25 percent of rated. The margin is adequate to accommodate anticipated maneuvers associated with power plant startup. Effects of increasing pressure at zero or low void content are minor, cold water from sources available during startup is not much colder than that ' already in the system, temperature coefficients are small, and control rod patterns are constrained to be uniform by operating procedures backed up by the rod worth minimizer. Worth of individual rods is j very low in a uniform rod pattern. Thus, of all possible sources of reactivity input, uniform control rod withdrawal is the most probable cause of significant power rise. Because the flux distribution associated with uniform rod withdrawals does not involve high local peaks, and because several rods must be moved to change power by a significant percentage of rated power, the rate of power rise is very slow. Generally, the heat flux is in near equilibrium with the ; fission rate. In an assumed uniform rod withdrawal approach to the scram level, the rate of power rise is no more than five percent of cated power per minute, and the APRM system would be more than adequate to assure a scram before the power could exceed the safety limit. The 15 percent APRM scram remains active until the mode switch is placed in the RUN position. This switch occurs when reactor pressure is greater than 850 psig.

3. IRM Flux Scram Trio Settina The IRM System consists of eight chambers, four in each of the reactor protection system logic channels. The IRM is a five-decade instrument which covers the range of power level between that covered by the SRM and the APRM. The five decades are covered by the IRM by means of a range switch and the five decades are broken down into 10 ranges, each being one-half of a decade in size. The IRM scram setting of 120 divisions is active in each range of the IRM. For example, if the instrument was on range 1, the scram setting would be 120 divisions for that range; likewise if the instrument was on range 5, the scram setting would be 120 divisions for that range.

BFN 1.1/2.1-13 Unit 2

2.1 BASES (Cont'd) IRM Flux Scram Trio Settina (Continued) Thus, as the IRM is ranged up to accommodate the increase in power level, the scram setting is also ranged up. A scram at 120 divisions on the IRM instruments remains in effect as long as the reactor is in the startup mode. In addition, the APRM 15 percent scram prevents higher power operation without being in the RUN mode. The IRM scram provides protection for changes which occur both locally and over the entire core. The most significant sources of reactivity change during the power increase are due to control rod withdrawal. For insequence control rod withdrawal, the rate of change of power is slow enough due to the physical limitation of withdrawing control rods that heat flux is in equilibrium with the neutron flux. An IRM scram would result in a reactor shutdown well before any SAFETY LIMIT is exceeded. For the case of a single control rod withdrawal error, a range of rod withdrawal accidents was analyzed. This analysis included starting the accident at various power levels. The most severe case involves an initial condition in which the reactor is just suberitical and the IRM system is not yet on scale. This condition exists at quarter rod density. Quarter rod density is discussed in paragraph 7.5.5.4 of the FSAR. Additional conservatism was taken in this analysis by assuming that the IRM channel closest to the withdrawn rod is bypassed. The results of this analysis show that the reactor is scrammed and peak power limited to one percent of rated power, thus maintaining MCPR above the Safety Limit MCPR. Based on the above analysis, the IRM l provides prouection against local control rod withdrawal errors and continuous withdrawal of control rods in sequence.

4. Fixed Mich Neutron Flux Scram Trio The average power range monitoring (APRM) system, which is calibrated using heat balance data taken during steady-state conditions, reads in percent of rated power (3,293 MWt) . The APRM system responds directly to neutron flux. Licensing analyses have demonstrated that with a neutron flux scram of 120 percent of rated power, none of the abnormal operational transients analyzed violate the fuel SAFETY LIMIT and there is a substantial margin from fuel damage.

B. APRM Control Rod Block Reactor power level may be varied by moving control rods or by varying the recirculation flow rate. The APRM system provides a control rod block to

prevent rod withdrawal beyond a given point at constant recirculation flow rate and thus prevents scram actuation. This rod block trip setting, which is automatically varied with recirculation loop flow rate, prevents an increase in the reactor power level to excess values due to control rod withdrawal. The flow variable trip setting is selected to provide adequita margin to the flow-biased scram setpoint. l l BFN 1.1/2.1-14 Unit 2

                                                                                             -- *w.

2 .1 - BASES (Cont'd) C. Reactor Water Low Level Scram and Isolation (Excent Main Steam Linesl The setpoint for the low level scram is above the bottom of the separator skirt. This level has been used in transient analyses dealing with coolant inventory decrease. The results reported in FSAR Subsection 14.5 show that scram and isolation of all process lines (except main steam) at this level adequately. protects the. fuel and the pressure barrier, because MCPR is

       . greater than the Safety Limit MCPR in all cases, and system pressure does-                             (

not reach the safety valve settings. The scram setting is sufficiently below normal operating range to avoid spurious scrams. D. Turbina Sten Valve closure Scram The turbine stop valve closure trip anticipates the pressure, neutron flux and heat flux increases that would result from closure of the stop valves. With a trip setting of 10 percent of valve closure from full open, the resultant increase in heat flux is such that adequate thermal margins are maintained even during the worst case transient that assumes the turbine bypass valves remain closed. (Reference 2) E. Turbine control valve Fast Closure or Turbina Trio Scram Turbine control valve fast closure or turbine trip scram anticipates the pressure, neutron flux, and heat flux increase thac could result from control valve: fast closure due to load rejection or control valve closure due to turbine trip; each without bypass-valve. capability. The reactor protection system initiates a scram in less than 30 milliseconds after the start of control valve fast closure due to load rejection or control valve

        ' closure due to turbine trip. This scram is achieved by rapidly reducing hydraulic control oil pressure at the main turbine control valve actuator disc dump valves. This loss of pressure is sensed by pressure switches whose contacts form the one-out-of-two-twice logic input to the. reactor protection system. This trip setting, a nominally 50 percent greater closure time and a different valve characteristic from that of the turbine stop valve, combine to produce transients very similar to that for.the?stop valve. No significant change in MCPR occurs. Relevant transient analyses are discussed in References 2 and 3 of the Final Safety Analysis Report.

This scram is bypassed when turbine steam flow is below 30 percent of rat.ed, as measured by turbine first state pressure. BFN 1.1/2.1-15 Unit'2

.~

                                                                                    ,   9-3.3/4.3    BASES (Cont'd)

5. The Rod Block Monitor (RBM) is designed to automatically prevent fuel damage in the event of erroneous rod withdrawal from locations of high power density during high power level operation.

Two RBM channels are provided, and one of these may be bypassed from the console for maintenance and/or testing. Automatic rod withdrawal blocks from one of the channels will block erroneous rod withdrawal soon enough to prevent fuel damage. The specified restrictions with one channel out of service conservatively assure that fuel damage will not occur due to rod withdrawal errors when this condition exists. C. Scram Insertion Times The control rod system is designed to bring the reactor suberitical at a rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than the Safety Limit MCPR. The limiting power transients l are given in Reference 1. Analysis of these transients shows that the negative reactivity rates resulting from the scram with the average response of all drives as given in the above specifications provide the required protection and MCPR remains greater than the Safety Limit MCPR. l. On an early BWR, some degradation of control rod scram performance occurred during plant STARTUP and was determined to be caused by particulate I material (probably construction debris) plugging an internal control rod drive filter. The dnsign of the present control rod drive (Model 7RDB144B) ) is grossly improved by the relocation of the filter to a location out of I I the scram drive path; i.e.; it can no longer interfere with scram performance, even if completely blocked. i The degraded performance of the original drive (CRD7RDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7RDB144B) has been demonstrated by a series of engineering tests under simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and may be inferred from plants using the older model 1 1 as l l BFN 3.3/4.3-17

         - Unit 2

W. % 1.1/2:1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1,1 FUEL CLADDING INTEGRITY 2.1 FUEL CLADDING INTEGRITY Aeolicability Aeolicability Applies to the interrelated Applies to trip settings of l variables associated with fuel the instruments and devices thermal behavior. which are provided to prevent the reactor system safety limits from being exceeded. Obiective Obiective l To establish limits which To define the level of the ensure the integrity of the process variables at which fuel cladding, automatic protective action is initiated to prevent the fuel cladding integrity safety limit from being exceeded. Snecification Seecification The limiting safety system settings shall be as specified below: A. Thermal Power Limits A. Neutron Flux Trie Settinam

1. Reactor Pressure >800 1. APRM Flux Scram psia and Core Flow Trip Setting

                     > 10% of Rated.                                  (Run Mode) (Flow   j Biased)             '

When the reactor pressure is greater a. When the Mode than 800 psia, the Switch is in existence of a minimum the RUN

critical power ratio position, the l (MCPR) less than 1.10 APRM flux shall constitute scram trip j violation of the fuel setting j cladding integrity shall be: j safety limit.

BFN 1.1/2.1-1 ! Unit 3

                                                   -   .-..--   -~    -           . . .

1.1 BASES

FUEL CLADDING INTEGPITY 9AFETY LIMIT l l The fuel cladding represents one of the physical barriers which separate j radioactive materials from environs. The integrity of this cladding I barrier is related to its. relative freedom from perforations or cracking. Although some corrosion or use-related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses which occur from I reactor operation significantly above design conditions and the protection system setpoints. While fission product migration from cladding perforation is just as measurable as that from use-related cracking, the thermally-caused cladding perforations signal a threshold, beyond which still greator thermal stresses may cause gross rather than incremental cladding deterioration. Therefore, the fuel cladding safety limit is defined in terms of the reactor operating conditions which can result in cladding perforation. The fuel cladding integrity limit is set such that no calculated fuel damage would occur as a result of an abnormal operational transient. Because fuel damage is not directly observable, the Fuel Cladding Safety Limit is defined with margin to the conditions which would produce onset transition boiling (MCPR of 1.0). Maintaining the MCP,R greater than the l Safety Limit MCPR represents a conservative margin relative to the l conditions required to maintain fuel cladding integrity. Onset of transition boiling results in a decrease _n heat transfer from the clad and, therefore, elevated clad temperature and the possibility of clad failure. Since boiling transition is not a directly observable parameter, the margin to boiling transition is calculated from plant operating parameters such as core power, core flow, feedwater temperature, and core l power distribution. The margin for each fuel assembly is characterized by l the critical power ratio (CPR) which is the ratio of the bundle power which would produce onset of transition boiling divided by the actual bundle power. The minimum value of this ratio for any bundle in the core is the minimum critical power ratio (MCPR) . It is assumed that the plant operation is controlled to the nominal protective setpoints via the instrumented variables, i.e., normal plant operation presented on Figure 2.1-1 by the nominal expected flow control line. The Safety Limit 4 has sufficient conservatism to assure that in the event of an abnormal operational transient initiated from a normal operating condition (MCPR > limits specified in Specification 3.5.K) more than 99.9 percent of the fuel rods in the core are expected to avoid boiling transition. The margin between MCPR of 1.0 (onset of transition boiling) and the Safety Limit MCF? l is derived from a detailed statistical analysis considering all of the uncertainties in monitoring the core operating state including uncertain:, in th'e boiling transition correlation as described in Reference 1. The uncertainties employed in deriving the safety limit are provided at the beginning of each fuel cycle. BFN 1.1/2.1-8 Unit 3

  .. - . . , .     . ~ - ~ . . - , , ~ _ , - - - - - . . .                             -   . ~ . . . ~ ~ . - . - - - - . -           - - . - --

4- .

                                                                                                                           ~ - - = -

i I. } 1.1 BASES (Cen t ' d) . 4 Because the boiling transition correlation is based on a large quantity of full scale data there is a very high confidence tnat operation of a fuel ,' assembly at the condition of MCPR equal to the Safety Limit MCPR would not l j produce boiling transition. Thus, although it is not required to establish ; the safety limit additional margin exists between,the safety limit and the l actual occurrence of loss-of-cladding' integrity. However, if boiling transition were to occur, clad perforation n>uld c.at be expected. Cladding temperatures would increase to approximatelf 1,10J0F

which is below the perforation temperature of the cladding materici. This )

has been verified by tests in the General Ele,ctric Test Reactor (GETR) j 4: where fuel similar in design to BFNP operated above the critical heat flux ' l for a significant period'of time (30 minutes) without clad perforation.

If-reactor pressure should ever exceed 1,400 psia during normal power. j 1

operation (the limit of applicability of the boiling transition l correlation) it would be assuaed that the fuel cladding integrity Safety ! Limit has been violated. J l } At pressures below 800 psia, the core elevation pressure drop (0 power, , o flow)'is greater than 4.56 psi. At low powers and flows this pressure

!                      differential is maintained in the bypt.ss region of the core. Since the l                       pressure drop in the bypass region is essentially all elevation head, the                                                  j j                       core pressure drop'at low power _and flows will always be greater than 4.5                                                 i e

psi. Analyses show that with a flow of 28x103 lbs/hr bundle flow, bundle j pressure drop is nearly independent of bundle power and has a value of - 3.5 psi. Thus, the bundle' flow with a 4.56 psi driving head will be 2 greater than 28x10 3 lbs/hr. Full scale ATLAS test data taken at pressures j from'14.7 psia to 800 psia indicate that the fuel assembly critical power j ~ at this flow is approximately 3.35 MWt. With the design peaking factors 1 this corresponds to a core thermal power of more than 50 percent. Thus, a j core thermal _ power limit of 25 percent for reactor pressures below 800 psia ) is conservative, i For the fuel in the core during periods when the reactor is shut down, consideration must also be given to water level requirements due to the effect of decay heat. If water level should drop below the top of the fuel during this time, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation. As long as the fuel remains covered with water, sufficient cooling is available to prevent fuel clad perforation. BFN 1.1/2.1-9 Unit 3

4 2.1 BASES (Cont'd) Analyses of the limiting transients show that no scram adjustment is required to assure MCPR is greater than the Safety Limit MCPR when the l transient is initiated from MCPR limits specified in Specification 3.5 k.

2. APRM Flux Scram Trio Settina (REFUEL or STARTUP/ HOT STANDBY MODE)

For operation in the startup mode while the reactor is at low pressure, the APRM scram setting of 15 percent of rated power provides adequate thermal margin between the setpoint and the safety limit, 25 percent of rated. The margin is adequate to accommodate anticipated maneuvers associated with power plant startup. Effects of increasing pressure at zero or low void content are minor, cold water from sources available during startup is not much colder than that already in the system, temperature coefficients are small, and control rod patterns are constrained to be uniform by operating procedures backed up by the rod worth minimizer. Worth of individual rods is very low in a uniform rod pattern. Thus, of all possible sources of reactivity input, uniform control rod withdrawal is the most probable cause of significant power rise. Because the flux distribution associated with uniform rod withdrawals does not involve high local peaks, and because several rods must be moved to change power by a significant percentage of rated power, the rate of power rise is very slow. Generally, ths heat flux is in near equilibrium with the fission rate. In an assumed uniform rod withdrawal approach to the scram level, the rate of power rise is no more than 5 percent of rated power per minute, and the APRM system would be more than adequate to assure a scram before the power could exceed the safety limit. The 15 percent APRM scram remains active until the mode switch is placed in the RUN position. This switch occurs when reactor pressure is greater than 850 psig.

3. IRM Flux Scram Trio Settina

           .The IRM. System consists of eight chambers, four in each of the reactor protection system logic channels. The IRM is a five-decade instrument which covers the range of power level between that covered by the SRM and the APRM. The five decades are covered by the IRM by means of a range switch and the five decades are broken down into 10 ranges, each being one-half of a decade in size. The IRM scram setting of 120 divisions is active in each range of the IRM. For example, if the instrument was on range 1, the scram setting would be 120 divisions f:r that range; likewise if the instrument was on range 5, the scram setting would be 120 divisions for that range.

BFN 1.1/2.1-13 Unit 3

           --          ~ . . . .   ..      .     .       . . _ , .   ..    -        -       .   . _ -

2.1 BASES (Cont'd) IRM Flux Scram Trio Settina ' Continued) Thus, as the IRM is ranged up to accommodate the increase in power level, the scram setting is also ranged up. A scram at 120 divisions on the IRM instruments remains in effect as long as the reactor is in the startup mode. In addition, the APRM 15 percent scram prevents higher power operation without being in the RUN mode. The IRM scram provides protection for changes which occur both locally and over the j entire core. The most significant sources of reactivity change during i the power increase are due to control rod withdrawal. For insequence ) control red withdrawal, the rate of change of power is slow enough due I to the physical limitation of withdrawing control rods that heat flux is in equilibrium with the neutron flux. An IRM scram would result in a reactor shutdown well before any SAFETY LIMIT is exceeded. For the case of a single control _ rod withdrawal error, a range of rod withdrawal accidents was analyzed. This analysis included starting the accident at various power levels. The most severe case involves an ' initial condition in which the reactor is just suberitical and the IRM system is not yet on scale. This condition exists at quarter rod density. Quarter rod density is discussed in paragraph 7.5.5.4 of the j FSAR. Additional conservatism was taken in this' analysis by assuming I that the IRM channel closest to the withdrawn rod is bypassed. The i results of this analysis show that the reactor is scrammed and peak j power limited to one percent of rated power, thus maintaining MCPR ' above the Safety Limic MCPR. Based on the above analysis, the IRM l provides protection against local control rod withdrawal errors and continuous withdrawal of control rods in sequence.

4. Fixed Hich Neutron Flux Scram Trio The average power range monitoring (APRM) system, which is calibrated using heat balance data taken during steady-state conditions, reads in percent of rated power (3,293 MWt). The APRM system responds directly to neutron flux. Licensing analyses have demonstrated that with a neutron flux scram of 120 percent of rated power, none of the abnormal operational transients analyzed violate the fuel SAFETY LIMIT and there is a substantial margin from fuel damage.

B. APkM control Rod Block Reactor power level may be varied by moving control rods or by varying the recirculation flow rate. The APRM system provides a control rod block to prevent rod withdrawal beyond a given point at constant recirculation flew rate and thus prevents scram actuation. This rod block trip setting, which is automatically varied with recirculation loop flow rate, prevents an BFN 1.1/2.1-14 Unit 3

                                                                         ~w 1

l l 2.1 BASES (Cont'd) ' increase in the reactor power level to excess values due to control rod withdrawal. The flow variable trip setting is selected to provide adequate margin to the flow-biased scram setpoint. i l C. Reactor Water Law Level Scram and Isolation (Excent Main Steam Lines) l The setpoint for the low level scram is above the bottom of the separator skirt. This level has been used in transient analyses dealing with coolant i inventory decrease. The results reported in FSAR subsection 14.5 show that i scram and isolation of all process lines (except main steam) at this level adequately protects the fuel and the pressure barrier, because MCPR is greater than the Safety Limit MCPR in all cases, and system pressure does l not reach the safety valve settings. The scram setting is sufficiently below normal operating range to avoid spurious scrams. D. Turbine Sten Valve Closure Scram l l 1 The turbine stop valve closure trip anticipates the pressure, neutron flux l and heat flux increases that would result from closure of the stop valves, j With a trip setting of 10 percent of valve closure from full open, the 1 resultant increase in heat flux is such that adequate thermal margins are maintained even during the worst case transient that assumes the turbine bypass valves remain closed. (Reference 2) E. Turbine Control Valve Fast Closure or Turbine Trin Scram Turbine control valve fast closure or turbine trip scram anticipates the pressure, neutron flux, and heat flux increase that could result from control valve fast closure due to load rejection or control valve closure due to turbine trip; each without bypass valve capability. The reactor protection system initiates a scram in less than 30 milliseconds after the start of control valve fast closure due to load rejection or control valve closure due to turbine trip. This scram is achieved by rapidly reducing hydraulic control oil pressure at the main turbine control valve actuator dise dump valves. This loss of pressure is sensed by pressure switches whose contacts form the one-out-of-two-twice logic input to the reactor protection system. This trip setting, a nominally 50 percent greater closure time and a different valve characteristic from that of the turbine stop valve, combine to produce transients very similar to that for the stop valve. No significant change in MCPR occurs. Relevant transient analyses are discussed in References 2 and 3 of the Final Safety Analysis Report. This scram is bypassed when turbine steam flow is below 30 percent of rated, as measured by turbine first state pressure. BFN 1.1/2.1-15 Unit 3

l e> ~~. 1 3.3/4.3 BASES (Cont'd)

5. The Rod Block Monitor (RBM) is designed to automatically prevent fuel i damage in the event of erroneous rod withdrawal from locations of high

, power density during high power level operation. Two REM channels are , provided, and one of these may be bypassed from the console for maintenance and/or testing. Automatic rod withdrawal blocks from one of the channels will block erroneous rod withdrawal soon enough to prevent fuel damage. The specified restrictions with one channel out of service conservatively assure that fuel damage will not occur due to rod withdrawal errors when this condition exists. i C. Scram Insertion Times The control rod system is designed to bring the reactor suberitical at a rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than the Safety Limit MCPR. The limiting power transients are l given in Reference 1. Analysis of these transients shows that the negative reactivity rates resulting from the scram with the average response of all

          -drives as given in the above specifications provide the required protection and MCPR remains greater than the Safety Limit MCPR.                         l On an early BWR, some degradation of control rod scram' performance occurred   l during plant STARTUP and was determined to be caused by particulate material (probably construction debris) plugging an internal control rod drive filter. The design of the present control rod drive (Model'7RDB144B) is        I grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere with scram performance, even if completely blocked.

The degraded performance of the original drive (CRD7RDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7RDB144B) has been demonstrated by a series of engineering tests under simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and may be inferred from plants using the older model i l BFN 3.3/4.3-17 Unit 3

1 ENCLOSURE 4

                     'IENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN)

UNITS 1, 2, AND 3 REVISED UNIT 2 CYCLE 9 CORE OPERATING LIMITS REPORT l l l l l l l _ _ . _ . _ _ _ . _ _ . _}}

ML20113B195

Text

1.1 BAEEE

1.1 BASES

Navigation menu

Search