ML20114F981
Text
.__
.1 DISTRIBUTION:
MAY l 8 193
- INCKET FILE: 50-382 CPB r/f L. RUBENSTEIN PEPORANDip' F0e:
T. Novak, Assistant P1 rector C. BERLINGER for Licensiner, DL L. PHILLIPS D. FIEN0 FR0":
L. S. Rubenstein, Assistant Director L. KOPP for Core and Plant Systarts, DSI T. HUANG H. BALUKJIAN S!PJFCT:
WATERF0pD-3 SER StfPPLEMENT N0. 5 Y. HSII D. Powers R. Meyer Plant Name:
Waterford-3 Docket Munber:
50-382 Licensing Stage:
0L Responsible Branch:
LP-3 Pro *ect Manager:.
J. H. Wilson t'S' #eview Prench:
Core Perfomance " ranch Re.*tew Status:
Incmplete
- Enclosed is Supplement No. 5 to the Safety Evaluation Deport for Section 4.4, "Themal-Hydrev11c Design," of the Heterford-3 FSAR.
In our SER we had innosu' a PfmR penalty which was calculated using the staff's interin criteria for evaluating the effects of red how on DNBR. This was in effect while the CE Tonical Report, CEMPD-225, " Fuel and Poison Rod Bowing" ws being reviewed. rEUPP-225 bas now been approved and therefom the new enclosed values of rod bow penalty anriv.
The CPC/CEAC was reviewed and it was found that a correction needs to be made in the software in regards to the LPD penalty factor associated with hnth failed MAC's. We require that this correction be made prior to issuance of the operating license.
We also reviewed additional infomation subnitted in response to Iten II.r.?
- Instrmentation for Detection of Inadequate Core Cooling" of NifREG-0737
" Clarification of THI Action Plant Requirenent." However, sme issues are still under staff review. We will provide our result of this review in the next SSER.
OrfdDd a.s.c...sQ MC
. %,t
'=
L. S. Rubenstein, Assistant Director sku.
for Core and Plant Systes, "SI E
)C I
0fA t+3 g
/42.
M cc:
R. J. Mattson P. Cap N
D. C. Eisenhut C. Knich
- 9 J. Wilson
- DPOWERS 5/17/83
~
- THUANG 5/17/E3 Contacts:
H. RaluHian Y. Hs11
- v. 4: ann I.. ropn
- YHSII 5/17 /P 3 X-2942?
T-29/.73 7-?/ MC 7-2 W 1
)
- See Previous Concurrences
/ *1 !/
C
- CP8:DSI
- CPS:DSI:SL
- CPB:DSI:SL CPB:DSI:SL YORNSI d a.7 0:
b
.P,H,k'L.L I CBEPt,1NGQ. LW * *d b
.. /. 18 /83 5/... 3../. 8. 3 4 + 6 /..... / S 3
.1. 5 /. j,
...../...i f.../. 8 3 S
../....17/. 83 5
..../.18/. 8 3 5
5 o.n p 7-7 e eenmmerconn e n pv u.
.g DISTRIBUTinti:
DOCr.ET FILE:
50-P CPB r/f L. RUBENSTElk C. BERLitlGER L. PHILLIPS D. FIENO
? P'PaAttntM TOD:
C. C. Lainas, f;sistant ' tractor L, Kopp for ear'ratino Reactors, 9L T. HUANG H. BALUKJIAN 000":
L. e. pubenstein..*ssistant Director Y. HSII.
for Core and Plant System. DSI l't.TEDFnP.D-3 SF" Sif"PLD'D'T fl0. 5
/
Stfr.JF Plant Nane:
tlaterford-3 Netet 'aunter:
50-3V
'icensing Stage:
OL "r or.stble Franch:
LR-3
/
'rniect l'cnacer:
J. H. Wilson
S! "eview Pranch:
Core Perfomance Fran Deview Status:
Incomplete
/
Enclosed. is Scoplerient "o.
5 to t Safety F lustion o part for Section f. 4, c
"Thernal 5tydraulic thsign." of the i erfo
-3 FSAP.
In our SFP we had imrosrd a ! Wit penalt.y which as calculated us be staff's interin criteria for evaluatino the effects of rori how on Di This was in effect while t' c Cr Tonicc1 "coort CE'fPD-225. " Fuel and Poison Row 1
- w s Feinn reviewed.
C'"P% '*c h.'s now been approved and therefore the enclos values of rnd bow renalty anniv.
The CPC/CE4C was reviewd and it s found that a co ction needs to *P rside ir the software in regards to the PD penalt.y factor ass ted with hot 6i failed CEAC's. 13e reautre that thi correction be made prior to ssuanca of the neeratinn license.
1*e also reviewad additi 1 infornation sufriitted in resnerse t itm II.F.*
"Instru wntation for ection of Inadeounte Core Coo 11nn" of til'".
n?'7
" Clarification of Tf' Action Plant peovirenent." unwver, some issi s are still under staff iew. lie will provide our result of this review k tt a next StrP.
N
~
/
/
L. 9. Pubanstein, Pssistent rirector s
for Core and Plant 'vstov, Del Enclo
!s s ted
?. J. "ettson r'. Carra e
F.. risenbut r,. Vn17 ton h
.1. il son ritacts:
alut41an, cor:nel
- v. m ii, enr>.'.et I e
k~%~
V-? ^ V '
t-?.473
- C..P..B..:.D..S..I...
Jh5 m
m' 9
.DPOWERS L..r m e sn......
M P.f.".!............
SL..,.'/.La 3..
. p/..
^-
e
==,
'oa** 8'* o***N ot*o OFFICIAL RECORD COPY i
SUPPLEMENT NO. 5 TO THE WATERFORD-3 SAFETY EVALUATION REPORT 4.4 Themal-Hydraulic Design 4.4.1 Themal-Hydraulic Design Criteria and Design Bases A significant parameter that influences the thermal-hydraulic design is rod-to-rod bowing within fuel assemblies. Men the safety evaluation report as issued the staff was still reviewing the CE Topical Report, CENPD-225 " Fuel and Poison Rod
)
Bowing," which describes the methodology for evaluating the effects of rod-to-rod bowing on D2. Consequently the staff had imposed a DNBR penalty which as calculated using the staff's interim criteria for evaluating the effects of rod bow on DNBR. The CE Topical Report CEMPD-225 has subsequently been approved j
(Ref.1) and therefore new values of the resultant DNBR penalty due to rod bow are given in the table below.
Burnup DER Penalty (GWD/MTU)
(5) 0-10.0 0.00 10.0-20.0 0.50 20.0-30.0 1.50 30.0-40.0 3.00 The applicant has stated that the thermal margin reductions for rod bow will be put in the DNBR limit basis of the Core Protection Calculator (CPC) system. They will be verified to be included in the DER limit calculations in the Core Operating Limits Supervisory System (COLSS) and the CPC systen at least once per 31 days. Therefore, the appropriate provisions will.be incorporated into the Technical Specifications. The applicant should also insert into the basis of the Technical Specifications any generic or plant specific margin that may be used to offset the reduction in DNBR due to rod bowing, and reference the source and staff approval of each generic margin. With these requirements satisfied by the applicant the staff concludes that they have adequately accommodated the reductions listed above.
J
,. j ( #
1 l l 4.4.2 Core Protection Calculator /CEA Calculator The Waterford-3 Core Protection Calculators (CPCs)/CEA Calculators (CEACs) are assentially the same as the Arkansas Nuclear One Unit 2 (AND-2) Cycle-2 i
CPCs/CEACs except for some modifications to acconunodate the reactor power cutbacksystem(RPCS). The RPCS is designed to rapidly reduce the reactor power by dropping pre-selected CEAs in response u a large load rejection l
or a loss of one feeduster peop, and, thus, prevent an unnecessary reactor trip. The CPC/CEAC protection algorithm is modified so that during the i
l RPCS mode more accurate local power density (LPD) and departure from nucleate boiling retto (DWR) calculations are perfomed rather than applying the overly conservative on-line determined CEA-deviation penalty factors to the LPD and DER calculations. The CPC/RPCS mode duration is detamined so that it is long enough to avoid an unnecessary trip but short enough to maintain De margin in cases where an inadvertent drop of a legal CEA group is misinterpreted by the CPC/CEAC as an RPCS event or dere a single failure occurs during a RPC mode.
Sinct the AND-2 CPC/CEAC had been approved by the staff (Ref. 2), the review of the Waterford-3 CPC/CEAC will concentrete on the software modifications and its implementation. Louisiana Power & Light (the applicant) has submittedreportsentheCPC/CEACmodifications(Ref.3)totheANO-2 CPC/CEAC, safety analysis report (Ref. 4). CPC/CEAC protection algorithm test plan (Ref. ti), data base document (Ref. 6), and phases I and IT test reports (Refs. 7 8 8). This SER addresses the staff review and evaluation of these reports regarding CPC/CEAC software modifications and implemen-tation.
4.4.2.1 CPC/CEAC Modifications to Accommodate RPCS CEN-197(c)-P. 'CPC/CEAC Softere Modification For Waterford-3", provides documentation of the Waterford-3 CPC/CEAC modifications from the AND-2 CPC/CEAC to acconunodate the RPCS. The CPC/CEAC modifications consist of:
(
(..,_ )
s a T1 (1) Addition of a CEAC algorithm to detect the actuation of a RPC event; k
- n l
(2) A CEAC algorithe modification so that the multiple CEA deviation is l
determined only when the RPC flag is not set; j
4 (3) Modification of the 16 bit CPC/CEAC data comunication link to include m]
the RPC flag; (4) Use of the off-line calculated adjustment factors and the last-calculated subgroup deviation penali;y factor, radial peaking factors and radial shadowing factors for CPC DER and LPD calculations during the RPCS mode; and (5) The addition of the addressable constant to the CPC/CEAC to define the duration that the RPC flag can remain set.
In the occurrence of a RPC event (either a large load rejection or loss of one feeduster pop). certain pre-selected CEA groups (i.e. legal lead bank N or banks M and #5) will be dropped at free falling speed to reduce the reactor power rapidly. The estes-of-change of the processed CEA positions are used by the CEACs to determine whether the CEAs are dropping.
If,and only if, all of the pre-selected RPC-CEA groups are dropping, then the RPCS flags will be set. indicating the RPCS mode, and remain set for a predeter-mined time period. During the RPCS mode duration, more accurate penalty factors, rather than the on-line determined large multiple-CEA deviation penalty factors, will be applied to the LPD and DER calculations to avoid an unnecessary trip. However, the CEAC are unable to distinguish between a true RPC event and an inadvertent drop of the legal RPC-CEAs.
In the event of an inadvertant drop of the RPC-CEA banks, a safety implication arises since the CPC/CEAC will regard this as a RPC event and preclude the use of the required sulti-CEA-deviation penalty factors. However, the RPC mode deviation has been determined with the criteria so that it is long enough I
e
___ to avoid an unnecessary trip due to a RPC transient and that it is short enough to maintain safety margins for an inadvertent RPC-CEA drop event or a single failure during a RPC event (this is discussed in Section 4.4.2.2).
Therefore, the inability of the CEAC to recognize the inadvertent RPC-CEA drop event will not result in a safety concern since the CPC/CEAC will return to its normal function of applying higher CEA-deviation penalty factors after the RPCS mode ends and the reactor will trip.
The staff has reviewed the CPC/CEAS algorithm associated with the proposed modifications and finds them acceptable.
In addition, the CPC/CEAC software modifications and implementat 'ms are done in accordance with the HRC-approved procedure described in CEN-139(A)P (Ref. 9). The staff concludes that these modifications are acceptable.
4.4.2.2 Safety Analysis and RPCS Mode Duration Determination Because of the modifications made to the CPC/CEAC systen to accommodate the RPCS an evaluation was made of the safety significance of these modi-fications. In addition, the RPCS mode duration had to be determined for
)
i the CPC/CEAC such that the CPC/RPCS will prevent unnecessary plant trips during a reactor power cutback transient and also protect acainst a single failure within the RPCS as well as an inadvertent RPC-CEA group drop.
In CEN-200(P) " Safety Evaluation of the Reactor Power Cutback Systen," the applicant provides the safety analysis for these concerns. The staff evaluation follows:
During the RPCS mode, the CPC hot pin LPD and DNBR calculations will use (1) the off-line determined bounding adjustment factors in lieu of the instantaneous on-line calculated large CEA-deviation penalty factors (PF);
and (2) the last (pre-RPCS mode) calculated values of the subgroup devia-tion PF, planer peaking factors and rod shadowing factors. The effects of these modifications are two-fold:
(1) if the RPCS node duration lasts long enough. it will prevent unnecessary trips due to a RPCS transient during proper cperation of the syster.s; and (2) if the RPCS mode does not end
El i
, 1 l
)
i soon enough to return to nomal CPC mode, it will incur safety implications if an inadvertent CEA drop perceived as a RPCS event or a single failure occurs within the RPCS event.
To avoid a spurious trip during a RPC event, the minimum duration of the RPCS sode operation is detemined. The applicant in CEN-200(P) perfomed an j
analysis of the response of the core power to a CEA drop due to a reactor power cutback (Figure 3.1.1) and a comparison of the nomal CPC response to the actual DNB margir. (Figure 3.1.2) to the specified acceptable fuel design limit (SAFDL). The HEID41TE space time kinetics caputer code, which has been approved by the staff, was used in a one dimensional axial mode to model a CEA group drop. Conservative asseptions were used in the selection of the reactivity feedback effects and the radial peak magnitude and ramp rate. The results indicate an initial decrease in power until the moderator and Doppler feedback effects cause a power rise to a new steady state value which is lower than the initial power. The CEAs become fully inserted in less than j
approximately 5 seconds during which tine the local power is decreasing everywhere in the core and therefore the DNB margin is increasing. The j
normal mode CPC, on the other hand, calculated the DMB margin to be decreasing. The discrepancy is due to the CPC application of the large CEA-deviation penalty factors and its omission of the dynamic " Delta-T" power correction for decreasing power events.
The inherent CPC powet calculation conservatism results in DNBR decreasing below the SAFDL. Figure 3.1.2, therefore, provides the infomation regarding the minimum duration of the RPCS mode for a more accurate calculation to prevent the unnecessary trip for a nomal RPCS event.
The maxima duration allowed for the Ch, to operate in the RPCS mode is dictated by the time the CPC must trip in order to maintain sufficient safety margin for an invalid RPCS event or a single failure within a RFCS event.
l The maxism RPCS mode duration can he specified to assure that any false RPCS event will result in a trip before a SAFDL is reached by returning the I
CPC to the normal mode of operation before such a trip is needed. There are several categories of CEA drop configurations, but only the " legal" groups dropping " sequentially" are recognized by the CPC/CEAC as a WCS e.c
- I
4 t A legal group is a group of CEAs recognized by the CPC/CEAC as useable for the RPCS, For Waterford-3. the legal groups are the lead CEA group (Group 3
{
- 6) and the first following group (Group #5). Sequential CEA drop refers to a simultaneous drop of'some sequentially nebered groups starting with the highest nebered group not fully inserted. Any non-legal CEA group drop or l
1egal groups dropping non-sequentially or incomplete legal group drop will not be recognized by the CPC/CEAC as a RPCS event, and, therefore, do not affect the CPC/RPCS modifications. The safety concern of the CPC/RPCS modi-fications should therefore be directed toward events involving the legal CEA groups dropping sequentially. These events consist of (1) inadvertent drop of the legal lead group. (2) insertion of two legal groups when only one group is required, and (3) insertion of one legal group when two legal i
groups are required on either a large loss of load or loss of a feedwater pump. However, event #3 insertion of one legal group when two groups are required initially has the turbine demand less than the core power. Thus the core power would decrease slowly to match the turbine demand through a negative moderator temperature reactivity feedback. This is an increasing thermal margin event and is bounded by the loss of external load analysis in
~
the FSAR which did not require a CPC trip. Event #2 insertion of two legal groups when only one group is required is very similar to the inadvertent drop of a legal group in that both involve the insertion of a single CEA group more than the corresponding decrease in turbine demand would require.
I Of the two, the inadvertent drop of the lead CEA group would be more limiting on dis margins since it can occur at rated steam demand while the other case has reduced steam demand due to either the RPCS turbine runback or the loss of load event. Therefore, the inadvertent drop of lead CEA group is studied for the time duration analysis.
The RPCS is designed to rapidly reduce the reactor power in the events of large load rejection and loss of a feedwater pump. Several single failure events, such as failure to drop CEAs and drop of incorrect CEAs, associated with these events are not recognized by the CPC/CEAC as RPCS events, and therefore, bear no concern. Other single failure events which are legitimate l
RPCS events are failure to setback turbine, and too much or too little turbine j
setback during loss of one feedster pump. However, too much turbine run-I back with loss of single feedwater pump is bounded by the loss of condever
. vacuan analysis in the FSAR Section 15.2.
Too little turbine setback it bounded by the failure of turbine setback event, which was analyzed alorig with the inadvertent lead CEA drop event to detemine the maximum duraticr:
of the RPCS mode.
For bot' the inadvertent lead CEA group drop and turbine runback failure events, the initial effect is a core power level reduction resulting in an Since irnediate increase in DW margin during the first few seconds.
l neither of these events has a turbine runhack, a core power / turbine power mismatch develops which drives the core inlet _ temperature down significantly.
The moderator temperature feedback effect causes the power to increase to nearly the initial level. Due to the insertion of the legal CEA group, the CEA configuration changes resulting in substantial increase in radial power peaking and local power and, therefore, decreases in DNB margin.
In Section 3.3 of CEN-200(P) the applicant provided an analysis to derive the maximun duration for the RPCS mode. Simulation of the reactor systems response to a RPC event with a single failure was perfomed using the CESEC program to model pouer generation. heat removal. and RCS flow rates, temper-ature and pressure based on the input driving functions such as feedwater The most extreme conditions of temper-flow, and turbine steam demand, etc.
ature coefficients. CEA worths, etc. were used in the CESEC model es a f,
bounding analysis. The resulting changes in flow, temperature, pressure and local power were used with the most conservative sensitivity of DNB Figures overpower margin to these parameters to determine the DNB margin.
3.3.1 and 3.3.2 present the analysis results of the response of the DNBR SAFDL margin to the turbine runhack failure and inadvertent lead CEA group drop events, respectively. The off-line calculated adjustment factors The maximum RPCS node were used in the analyses during the RPCS mode.
duration is determined from the analyses so that by returning to the nomal CPC operation using the large CEA-deviation PFs. a CPC trip will be given The staf f if the reactor trip is required to maintain safety margin.
review of the analyses concludes that the mainnum RPCS mode duration and the associated adjustment factors for the LPD and DNBR calculations during the RPCS mode are acceptable.
. 1 4.4.2.3 CPC/CEAC Data Base Constants CEN-207(C)-P "Waterford 3. Cycle 1 CPC and CEAC Data Base Document *, provf er:
the CPC/CEAC data base constants applicable to the Waterford-3 Cycle I se't -
were and CPC/CEAC functional derign specification. ihe staff has revie ed the important parameters, such as the core inlet flow split factors, algorithm uncertainty factors, fuel assembly spacer grid fom loss factors, DNBR aM LPD trip setpoints and the addressable constants BERR's values, RPCS dui-tion time and the associated off-1fre calculated adjustnent factors for the LPD and DNBR calculations. The review has concluded that the data base constants are acceptable.
4.4.2.4 Verification of CPC/CEAC Software Modification Implementation The implementation of the CPC/CEAC software modifications is to translate the systen functional requirements into modules of machine executable code and to integrate these modules into a real time software system. The over-all CPC/CEAC softare imple.entation is verified through the Phase I and Phase II softsare verification tests. The applicant has submitted the j
Waterford-3 Cycle 1 CPC/CEAC Phase I and Phase II test reports, CEN-209(C)P andCEN-208(C)P.
The Phase I test is performed at the CEAC Single Channel Unit on relatively small, singlo-entry / single exit segments of modules. The objective is to verify the implementation of CPC/CEAC S)ftware. Sufficient test cases were chosen to exercise each functional branch in the application program and executive software systen. Expected results for the application progran test cases were generated by either the C'PC FORTRAN Simulation Code or by hand calculations by the test engineer based on the system functional requirements. When test case input had been selected and expected results had been generated, a test tape was prepared to be read by the Automated Phase I test program. Whenever the actual value differs from the expected value by more than 0.1 percent, an analysis of the error was perfomed to assure that the deviation was not caused by a coding error. There were several branches not exercised because of the fact that the assigned constant values made it impossible to branch on certein conditf or I
s
fs
-g_
H h
these cases the module was verified by inspection to assure correct imple-
{
mentation. The executive software was tested through the debug program.
CLUB, which was used to insert test case inputs into memory, to insert breakpoints, to trace and intercept code execution and to examine results.
The overall Phase I test was performed in accordance with the approved Phase I test procedure and the test results show no coding error in the application program and executive software. Therefore, the implementation of CPC/CEAC software into machine executable modules has been verified correctly.
i
)
The objectives of the Phase II tests are to verify that the CPC/CEAC soft-were modifications have been properly integrated with the CPC/CEAC sof t-were and system hardware, and that the static and dynamic operation of the integrated systen is consistent with the predictions of design analyses.
These objectives are achieved by comparing the response to that projected j
by the CPC/CEAC FORTRAN Simulation Code. The test was performed in the Single Channel CPC and the test cases were selected in accordance with the approved procedure described in CEN-39(A)P. Additional test cases were included to verify the RPCS design.
The Phase II testing consists of Input Sweep Test (IST), Dynamic Software Verification Test (DSVT) and Live Input Single Parameter Test (LISP).
Input sweep tests were utilized to determine the processing uncertainties inherent in the CPC/CEAC designs. Thousands of cases were run in IST and the resulting uncertainties were factcred into the acceptance criteria for the DSVT and LISP. The DSVT is a real time exercise of the CPC software to verify the dynamic response of the integrated CPC software with design analyses by determining whether the initial DNBR and LPD calculations and the trip time of each transient are within the acceptance criteria predicted by the FORTRAN Simulation Code.
In contrast to the DVST where the transient CPC input values are read from a storage device, the LISP test is a real-time exercise with transient input value generated from an external source and read through the CEAC/CPC input hardware. The LISP test is to verify b
w 9
7 6 ~]
1
! !I h!
that the dynamic response of the trip time of the integrated CPC/CEAC l;'j software / hardware system is consistent with the design analysis prediction j
These tests during operational modes approximating plant conditions.
have shawn that the CPC/CEAC calculations are, in general, confoming to the lI acceptance criteria. However, during the OSVT testing, a one-pep loss (l
i of flow case and a RCP speed ramp case were found with the DNBR trip times g
exceeding the maxima allowed trip times. The applicant suspected that the jl h
diffemnces was due to the difference in interpolation methods between the CPC FORTRAN and the CPC Single Channel that resulted in slight difference in flow coastdown calculations. Because the flow coastdowns in those two yW cases yield projected DER so close to the DNBR trip setpoint, this differ-In p
ence would result in the trip time exceeding the acceptance criteria.
1 Supplement 1-P to CEN-208(C)e, (Ref.10) the applicant provided the results a
The two cases were re-run using more data points in g
of their investigation.
the RC pop flow table and the results show that the DNBR trip are within
}
the acceptance criteria. These results confirm that the difference in trip jj time is due to the difference in the interpolation methods by the two h
Since the data interpolation subroutine is not part of the normal 1
systems.
I CPC algoritha as defined by a functional specification, this is not a sof t-were error.
J l
d During the DSVT testing, it as also found that the Single Channel CPC 1
failed to generate a high LPD trip due to its failure to apply a pre-3 This is a deviatici d
detemined LPD penalty factor when both CEACs failed.
?!
j from the CPC functional specification requirement. The applicant in Supplement 1-P to CEN-208(C)P provided a safety evaluation of the functiona. j deviation and contended that the LPD trip function with or without the PF S
is not required for plant protection under both CEAC failure condition, and, therefore, the CPC software is acceptable for operation without the j
i However, the staff believes 9
application of the PF to the LPD calculation.
that the nature of the CPC software protection logic.is not amenable to an j
evaluation or test program which can provide complete assurance that all I i ciremstances requiring LPD trip protection have been adequately analyzed.
3;j The error degrades the protection provided by the CPCs by effectively
~1 3
1:h
, eliminating one sof tware trip path to the protection circuit. There'ca.
the current Waterford-3 CPC sof tware is unacceptable with tne LP(' pr deficiency uncorrected. The staff has expressed our concern in lette~.
of February 10,1983 (Ref.11) and March 29, 1983 (Ref. 12). We ther<*
t require that the CPC software be corrected to confom to its design specification prior to issuance of an operating license.
4.4.3.
Sunmary The staff has reviewed the Waterford-3 implementation of the effect of fuel rod bow in DNBR and finds it acceptable.
The staff has also reviewed the CPC/CEAC modifications to accommodate the RPCS operation, the safety analysis associated with the modifications as well as the detemination of the RPCS mode duration and adjustnent factors for the LPD and CNBR calculations, tha data base constants, and the Phase I and Phase !! test report to validate the CPC/CEAC software implementation. We have found them acceptable except for a deficiency in the CPC sof tware with regard to the LPD penalty factor associated with the both-failed CEAC.
Failure of the CPC sof tere to apply this LPD PF required by the CPC/CEAC functional specifications is not acceptable. The applicant is required to correct this error prior to the issuance of an operating 1Icense.
l l
l l
l I
me.
c e
. 4.4.4 References 1.
Letter from C. 0. Thomas (NRC) to A. E. Scherer (CE). " Acceptance for Referencing Topical Report CENPD-225(P)." February 15, 1983.
2.
Memoranda. L. hbenstein to T. Novak. "ANO-2 Cycle 2 Reload Review."
July 21,1981.
3.
CEbl97 (c)-P. 'CPC/CEAC Software Modification For Waterford-3."
Waterford Stem Els.ric Station Unit No. 3. Maech 1982.
4.
CEb200 (P). " Safety Evaluation of the Reactor Power Cutback Systen."
Waterford Steam Electric Station Unit No. 3. March 1982.
5.
CEbit5 (c)-P. "CK/CEAC Protection Algorithm Test Plan." WSE2 Unit No. 3 m rch 1982.
6.
CEb207 (c)-P. "Waterford 3. Cycle 1 CK and CEAC Data Base Document."
Waterford Steam Electric Station Unit 3. June 1982.
7.
CEb209 (c)-P. "Waterford 3. Cycle 1 CK/CEAC Phase I Software Verification Test Report." Waterford Stem Electric Station Unit No. 3. June 1982.
8.
CEb208 (c)-P. "Waterford 3. Cycle 1 CK/CEAC Phase !!! Sof tware Verification Test Report." WSES. Unit No. 3. June 1982.
9.
CEb39 (a)-P. Rev. 2. *CK Protection F.lgorithm Software Change Procedure."
Arkansas helear One. Unit 2. Docket No. 50-368. Deceber 21. 1978.
- 10. CEb208 (c)-P. Supplement 1-P. "Supp1 ment to Waterford 3. Cycle 1 CPC/CEAC Phase III Software Verification Test Report." Loutstana Power & Light Company, Nov m ber 1962.
i
~
n[
f
l 1 11. Letter. G. W. Knight (NRC) to L. V hurin (LP&L) " Request for Mditional Information Concerning Core Protection Calculator / Reactor Power Cutback Systen at Waterford 3.* Docket No. 50-382 February 10, 1983.
- 12. Manorenden, L. Rubenstein to T. hvak, 'Waterford CPC Software Discrepancy,"
Docket File 50-382. March 29, 1983.
i e'
I j
l i
l 9
. -a
SER INPtR FOR WATERFORD UNIT 3 RESPONSE TO
! TEM !!.F.2 0F NUREG-0737 INADEQUATE CORE C0OLING INSTRUMENATION 1.0 Clarification of Requirements i
i j
A clarification of mquirements for inadequate core cooling instruentation (ICCI) l uhich is to be installed and operational prior to fuel load uns provided in the H. Denton letter to All Operating phelear Power Plants, on " Discussion of Lessons Learned Short-Tern Requirements." dated October 30. 1979, and in Item II.F.2 l
of NUREG-0737 " Clarification of 1MI Action Plan Requirements."
The staff has reviewed the applicant's submittals in response to Item II.F.2 l
of the 1MI Action Plan for confomance to the requirements in NUREG-0737.
I l
2.0 Discussion i
In response to IRlREG-0737 requirements, the applicant has transmitted a letter j
from S. D. McLendon (LPE) to NRC on January 21, 1982 with section 1.9.30
" Instrumentation for Detection of Inadequate Core Cooling (!!.F.2)." in Amendment l
he. H to FSAR and a letter fra L. V. Maurin (LPE) to G. Knighton (NRC) on j
Marsh 5. 1933 with an attachment. " Response to Section !!.F.2 of NUREG-0737 Inadegnate Core Cooltag Instrumentatten." LpE has selected an ICCI package for use in thterford Steam Electric Station Unit 3. consisting of a saturation margin monitor (999), core exit theruecouple (CET) system and heated junction thermo-couple (NJfC) system.
i
]
1he ICCI frstem (including the 05PDS) is environmentally and seismically qualified.
The details of the que11fication are provided in LP&L's " Response to Reg. Guide 1.97. Rev. P eMch is scheduled to be submitted to the 'NRC by May 30. 1983. The instrumentation has been seismically qualifted to IEEE-344-1975.
1 1he final ICCI systes including the Qualified Safety Parameter Display System I
(OIPOS) will he installed and operational prior to first cycle comercial l
eperetten. During first cycle operation, the NJTC system will be used for eperator training and familiarization.
Instructions on the use of the HJTC will he developed and incorporated into the emercency procedures prior to cycle twe l
eperation.
4 l
7
(
! The QSPDS displays present direct, reliable, and continuous safety grade infor-nation on demand from each of the ICCI components. Existing alann conditions and system faults are also shown. Hunan factors engineering is incorporated into the alphanumeric displays. Paging capabilities are provided in order to group and display all the information more efficiently.
2.1 Saturation Marvin Monitor The Spet is a two-channel, on-line system dich provides a continuous indication of the RCS margin fran saturation conditions (subcooled or superheated).
It can be used to infom the operator of the approch to saturation and the existence of core uncovery. RCS pressure input to the Sfft is provided by two (one per channel) wide
~.ge safety grade pressurizer pressure channels. RCS temperature inputs are provided by hot and cold leg RTD's, maximm unheated junction thennocouple (UHJTC) temperature from the upper head region, and the representative (maximum) core exit thermocouple taperature. The representative CET taperature is detemined from a statistical analysis of the CET inputs and is close to (951) the maximum of all valid CET taperatures. The sensor inputs to the Siti are swumarized below.
Input Range Pressurizer Pressure 15-3000 psia ColdLegTemperature(Ch.A-Loop 1A.2A)
(Ch.B-Loop 1C,,28) 50-750*F Not Leg Temperature (Ch. A-Loop 1) 4 (Ch. B-Loop 2) 50-750*F Maxiom UHJTC Temperature (from upper head) 100-1200*F*
Representative CET Temprature 100-1650*F*
Thermocouples continue to function and provide input beyond this range.
Although the accuracy is reduced above 1800*F. the correct tenperature trend is maintained. The specified ranges for the UHJTC and CET are different because the maxima temperature used for qualification testing is different.
~1J 3
An audible and display alam is initiated den the RCS (not including CET) tenper-ature saturation margin falls below tne setpoint value of 10'F subcooling. An alam is also initiated den the CET taperature based saturation margin reacnes 10*F superheat. No alams am initiated based on the pressure margin.
The following infomation is displayed:
peremeters Display Rance 1.
T e perature margin to 700*F Subcooled to saturation for each 2100*F Superheated i
taperature source (RTD UNJTC. CET) 2.
Pressure margin to saturation 3000 psi subcooled to for each t a perature source 3000 psi superheat 3.
Te perature input values RTD - 50 to 750'F UHJTC - 32 to 2300*F CET - 32 to 2300*F 4.
Pressure input value 15 to 3000 psia i
3 The saturation margin is identified as subcooled or superheated on the display.
2.2 Core Exit Themecouple $rsta The core sait themecouple provides an indication of core uncovery and clad heatup.
They measure the taperature of the steam at the core exit dich becomes super-heated as the tus-phase mixture level falls below the top of the core. The CETs provide the operator with the important infomation on the trend of the clad heatup.
i
~ ~ -
.m.
,m
_nn.m-,,
_,n
e l
l Type K (Chromel-Alumel) themocouples am included within each of the 56 In-Core Instnanentation (ICI) detector assemblies. The junction of each thenno-couple js located above the top of the active fuel inside a tube which supports and shields the ICI detector assembly from hydraulic forces.
l l
The processing equipment for the CETs calculates the represecutive (maximum) CET temperature from the valid available values input to the channel.
It also calculates the two highest valid CET taperatures in each quadrant. The represent-ative CET temperature is calculated at the upper 95% of the distribution of valid CET taperatures with a 955 confidence level. Half of the CET temperatures (28 CETs) from all four core quadrants are input and processed by each channel.
Tnese taperatures are categorized into four quadrants and identified by their location above the core. Any temperatures that are out-of-range (thereby indicating a fault) based on statistical analysis are elininated from the calculations. An alam is generated when the representative CET temperature exceeds a high temperature setpoint of 670*F.
The following information is displayed.
parameter Display Range 1.
Representative CET temperature 32 - 2300'F 2.
Two highest CET taperatures 32 - 2300*F per gandrent (with identifier) 3.
All CET toeperatures input to 32 - 2300'F channel (by quadrant with identifier) 2.3 Heated Junction Themocouples Systes The principal function of the HJTC System is to measure the water irventory in the reactor vessel above the fuel alignnent plate. This is done at discrete elevations by monitoring the temperature difference between adjacent heated and unheated themocouples.
3
. The HJTC sensor consists of two thermocouple junctions separated by several inches and a splash shield. One of the junctions is heated by an electric coil. men the heated junction is surrounded by a fluid of relatively good heat transfer properties (liquid), the taperature difference beteen the two themocouple junctions is small (less than 2004). When the heated junction is surrounded by a fluid of poor heat transfer properties (steam), the taperature difference is large (such greater than 200T). Thus, by monitoring the taperature difference between adjacent heated and unheated themocouples. it can be detemined if an j
individual HJTC sensor is covered by liquid or surrounded by steam. The splash shield protects the heated junction from spurious cooling by ater running oown the sensor sheath or entrained noter droplets.
i l
Eight ETTC sensors are placed at specific elevations inside a separator tube to make up a probe assembly. The purpose of the separator tube is to create a collapsed unter level inside dile a two-phase mixture exists outside the tube.
lesen the collapsed noter level falls below a heated junction elevation its teoperature and the sensor differential taperature increase above a predeter-eined setpoint value. The sensor is then identified as being uncovered (i.e..
(i.e.,surroundedbysteam).
At Waterford 3. a ' split probe" configuration is used. This refers to the separator tube dich is divided into two independent separator tubes, one on top of the other, each of dich creates a collapsed level inside it. A divider disk inside the separator tube located at the elevation of the upper guide structure support plate hydraulically isolates the two regions. Thus, the collapsed water level is measured in the upper plane as well as, and separately fram, the collapsed eter level in the upper head. Each portion of the split probe has j
8 holes of 13/64 inch diameter near both the top and the botten. This provides approximately the same flow area for water drainage as was used and verified to j
be adequate in the phase !! tests of the NJTC probe assenbly. The processing and display of the collapsed level is consistent with the manner in which it is measured. That is, the percent liquid height in each region, which corresponds to the naber of covered sensors in region is displayed separately.
r 1
i
. A sensor heater power control systen is used to protect the heated junction themocouple from damage due to overheating. E en an increasing heated junction taperature or sensor differential taperature exceed a preset value, the heater power is reduced until an acceptable stable taperature is reached.
The power still resins high enough however, so that all sensors are capable of providing an uncovered signal. Een any sensor differential temperature or unheated junction temperature exceeds the uncovered setpoint value, an audible and display alars is initiated indicating that the collapsed level in the reactor vessel has decreased.
The mergency procedure guidelines provide function oriented instructions for the detection of and mcovery from ICC based on the $m and CETs. However, these guidelines do not currently incorporate infomation obtained from the HJTC System on water inventory above the core. The emergency procedures will be revised and upgraded to include use of the ICCI for Cycle 2 operation. During first cycle operation, the NJTC System will be used for operator training and familiarization.
The ICC System including the QSpDS. will be installed and operational at Waterforat 3 prior to fuel load.
The following information is displayed by the QSPDS:
Parameters Display Range 1.
Percent liquid level in upper head 0 - 1005 L Percent liquid level in upper plenum 0 - 1005 3.
Status of each HJTC sensor Covered / Uncovered 4.
Nested junction ta peratures 32 - 2300*F 5.
Unheated junction temperatures 32 - 2300'F 6.
Differential temperatures
-2268 - +2268'F 7.
Heater power 0 - 1005
~.
3.0 Staff Evaluation In Amendment 25 of Waterford 3 FSAR, and March 25, 1983 letter from L. V. Maurin (LPE) to G. Knighton (NRC), the applicant (LPE) provided documentation in response to NUREG-0737. Item II.F.2. The applicant has consnitted to provide additional information to support the final ICCI system as follows:
1 Reoort Submittal Date 1.
HJTC performance Analysis June 30, 1983 2.
Response to Reg, kide 1.97, Rev. 2 May 30, 1983 3.
Modification to amargency Cycle 2 procedures operation Based on our review of the ICCI system docusentation provided in Amendment 25 and a March 25, 1983 letter, the staff has concluded as follows:
1.
The consitment to install the final operational ICCI Systen including QSPDS prior to fuel load is acceptable.
2.
The commitment to use the HJTC System for operator training and familiar-ization during the first cycle operation without incorporating emergency operating procedures for HJTC is not acceptable.
3.
The response to Item (2) of II.F.2 Attachment 1 on a primary operator display is incomplete. It should be clarified, f
4.
The commitment to develop and incorporate instruct'ons on the use of the l
HJTC into the energency procedures prior to cycle two operation is still under the staff review.
l l
l l
l
..e
--v-g-..--.
,y-y.,
+ -,. --,.-._.-, - -_
s----e w
o 'l e.
II 5.
The response to Item (4) of II.F.2 documentation required is not conplete.
j 5
It should include each subsystem of the final ICCI System.
Therefore, the staff will require the applicant to provide the infomation stated above as either incomplete of unacceptable prior to fuel load. We will report our findings in a future SER supplement.
l v
'}
l th
<s 5a E,
- N$
_v/k iY. A.
.L
UNITED sT ATEs NUCLE AR REGULATORY COMMISSION i.
waswiNGTON.D c. 2c115
~
I
...s
?s.;--~//
July 6,1983 MEMORANDUM FOR:
James J. Cumings, Director Office of Inspector and Auditor George A. Mulley Jr., Investigato yd Q gr.
FROM:
Office of Inspector and Auditor SL'SJECT:
unTERFORD QA at the Office of Gambit Publications, Inc., 921 Canal Street, Suite 900 New Orleans, LA, I attended a confererce regarding t Or. June 28, 1983, Participating f rom Gar. bit Publications wen crogram at Waterford SES, Unit 3.
Ron Ridenhour, reporter; Gary Esolen, editor; and Brae Eagert, attorney.
l Representing NRC wem Mark Peranich, Chief, This conference was arranged by
- &E; Eric Johr. son, Region IV; and ryself.
Feranich to obtain specific information f rom Gambit Publications regard cencerns over the QA progree at Waterford raised by Ridenhour in re My purpose at the conference was to solicit information frc Garibit pertaining ta alleged collusion between NRC and Louisiana Po news articles.
Light Compay (LPR) and alleged complicity of NRC in QA problems at Waterford.
At the outset of the conference Esolen stated that he would be the spoke Esolen also for Gattbit and we would not be allowed to interview Ridenhour.
r.ade it clear that his newspaper was not in the bus Escien, in his introductory remarks, also stated th Bagert, the the ;roblers. alrea$ outlined in the newspaper articles.
a-.:rrey, also expmssed surprise that the inquiry teae "ad decided to
'rterview Pidenhour instead of beginning t$e investigati:n at Materford or Eagert questioned my presence at the conference.
as the only " investigator" sent by ',RC, my investigaticr. shculd be 75L.
Eager; separate from the investigation by other re nbers o Publications did not trust the motives of NRC in asking for information about Waterford.
effectively investigate itself and ventured that NRC would use anj infe Perenich provided by Gambit to defend the QA prograns at W i.
from Gambit has to gather sufficient infor.ation to allow the team eip devestigate in detail and with object.vity theIn response to u gemorapdum from James K. Joosten to Richard C. DeYoung cen f
.~t
~
/
/
/
N p
- w, 2
aater'cro QA.
Esolen then sur: arized tne news:a:er art c'es :.:' s ec ty S t -t.
pertaining to the problems at Watericrd.
90 grc.;ec t e :rt:1e s U ee r.ajor categories:
- 1) overall CA prcgre at Later# re :y LFIL; 2' relationship between LP&L, EEASCO, and Cerbcstion Engineering (CE) anc, was res:
- if :
scetific, the outcone of the contract cispute ccncernir; wn:
fcr the "new" costs of the QA program at Waterford; and 3) :rctices ett ts cc struction of the basement at Waterford.
Esolen concludec the su-ary t stating that at this time that was all the ir.for.ation he was 9:ing to prc. :
concerning Waterford and that Gambit's news articles would speak for ine selves. Neither Esolen nor Bagert would confirm or deny that Gar. bit ha:
any further information concerning Waterford.
Eagert e phasized t, hat Gambi-should not be considered uncenperative in this r.atter a;;d that the newspape-stood ready to assist in an investigation of Wat'erford. Even though.he dic not wish to discuss the problems at Waterford curing.this conference, Escle-states that Gambit might be willing to provide information to a higher authority (Congressional comittee) or even NRC at a later cate.
During the meeting Esolen questioned the team about the status of two Freec:-
of Ir. formation Act (FOIA) requests submitted by Gambit to NRC about two m: :
Esolen and Bagert were disturbed that the requests hac not yet been ago.
The requests were for 1) gli con:.unicatier.s between NRC and LP&L honored.
regarding an NRC Inspection Report, dated December 6,1982, of Waterford.
specific, Gambit wanted to learn why a proposed $40,000 fine of LP&L was reduced to $20,000; 2) all Atomic Safety Licensing Board Panel (ASLBP) docc-Peranich explained the workload involved -
rants pertaining to Waterford 3.
processing FOIA requests and the interplay between NRC and a licensee when 'J These remarks were interpreted by Esolen and Eagert as be' proposes a fine.
in defense of NRC and LP&L and indicative of the type of investigation NRC would conduct at Waterford.
During the discussions between Peranich Esolen and Bagert, I had the oppc -
tunity on several occasions to ask the Gambit representatives for informati:
Esolen told indicating " collusion" or " complicity" between NRC and LP&L.
Peranich and me that he was " closing the door" at this time to any discussi-When pressed for information to substantiate Gambit innue :
l on this matter.
of collusion on the part of NRC with LP&L, Esolen stated that even the fac-Gambit's F01A requests had not yet been answered by NRC raised the possibi' that NRC was trying to protect LP&L.
Esolen refused to discuss inis area further except to say again he was not convinced that NRC could cbjectively l
investigate itself. Esolen asked us for a cardate or sir.ilar de:cment that
- ould guarantee an impartial and.cbjective investigation of the facts anc -
of the alleger. Although I explain *d the inde:encent role of OU, Esolen i'
would nct alter his position.
The conference was concluded by Esolen who stated that although his newsca::
was not in the business of di ecting NRC investigations, he suggested that Esolen team begin by developing information already published by Ganbit.
repeated that although he did not want to discuss L'aterfo d probie s durir, the conference, he might be willing to provide inferr.ation at a later cate a higher authority.
Esolen then requested that af ter the meeting ' c::--
him, Ridenhour, and Bagert to a separate office.
In this office, f(c' -
stated that he thought that I could conduct an cbjective ir.est gW: ;
however, prior to him providing any information indicating cdi..s'cr. bet.4-NRC and the licensee, he wanted assurances of my professic
- " f rer 5: -
3
- :sice of HRC.
Esolen recuested I contact a :ersen of authority outside cf
- ~ ar.d have that person vouch for 16y character to Escien.
In s::ecific, Eselen wanted assurances that I could conduct en it;. iial and objective i vestigation.
With this request the meetin; was conchded.
cc:
M. Peranich, IE
'e o
S e
e D
_ _ _ _ _ _ _.