ML20129C799

Topical Rept Evaluation of BAW-10121P, Reactor Pressure Vessel Limits & Setpoints. Rept Acceptable for Referencing within Specified Limits

ML20129C799
Person / Time
Issue date:	05/24/1985
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20129C790	List: ML20129C786 ML20129C799
References
NUDOCS 8506050668
Download: ML20129C799 (14)

Text

. .

ENCLOSURE Evaluation of Ba.bcock and Wilcox Licensing Topical Report BAW-10121, "RPS Limits and Setpoints" (TACS 4B45)

Report Numb'er: BAW-10121P Re:ert

Title:

RH Limits and Setpoints Ecpart C?te: JEr.uary 1975 Originating Organization: Babcock and Wilcox Reviewed By: Core Performance Branch The Power Generation Group of Babcock and Wilcox has submitted licensing topical report BAW-10121P entitled "RPS Limits and Setpoints" for ' staff

. review. This report describes the techniques and procedures used to '

establish safety limits and trip setpoints for the RPS-II protection

~

system to be used on Babcock and Wilcox 205-fuel-assembly plants. It is one of a series' of topical reports which have been submitted by Babcock and.Wilcox in order to provide the staff with generic information on the nuclear design of B&W reactors and to facilitate the review of such designs.

The staff has completed its review of this report an2 has evaluated all of

.the trip functions.

Our evaluation follows.

1. Sumary of Reoort This report describes the manner in which setpoints are established for the reactor protection system (RPS) in current generation 205-fuel assembly Babcock and Wilcox reactors. The presence of the RPS-II plant protection. system is assumed. RPS-II is described in topical report BAW-10085, Revision 2.

8506050668 850524 PDR TOPRP ENVBW C PDR

.c. ,

The general approach to reactor protection described in the report is as

-follows:

1. Steadj state s Cety limits are derived

2. To the extent possible reactor protec' tion system set

. points are based on steady state considerations.

3. Values used for trip setpoints in transient and accident analyses include a calculated effect of the trnsient or ac:ident on the ef#ective set;:oir.t.

Stea,dy state safety limits are established to preclude fuel damage during normal (steady state) operation. These limits include no centerline fuel melting, a maximum coolant system pressure of 110 percent of desigh value, and a 95 percent probability with 95 percent confidence that departure from nucleate boiling (DNB) will not occur on the hot rod in the core. With the exception of the system pressure these limits are not directly observable.

They are therefore redefined in terms of observable quantities for purposes of establishing protection system setpoints. The centerline fuel melt -limit is -

first reduced to a linear heat generation limit by use of a fuel performance code. A typical value for this limit is 20.1 kilowaits per foot.

The departure from nucleate boiling ratio limit is derived from critical heat flux correlations that are based on experimental data. Correlations used by Babcock and Wilcox included the BAW-2 correlation for which the 95/95 limit is 1.30 and the BWC correlation for which the limit is 1.25. The reactor coolant system pressure limit of 110 percent of design value is taken from the ASME Boiler and Pressure Vessel Code,Section III. It should be reiterated that the limits described above are for steady state operation for an indefinite period. These limits are also used for anticipated transients for which they are conservative.

The safety limits used for infrequent occurrences and design basis accidents depend upon the event. However, violation of some or all of the above criteria are permitted for a design basis accident and the acceptance of the results of an event analysis is usually dependent on off-site doses.

2

{

c.

L In order to establish protection system setpoints the safety liraits must first be defined in terms of observable reactor parameters. For the linear heat generation rate limit these include cor,e power and axial offset *.- For the DNB trip they inclu'de coolant temperature and flow rate, reactor pressure, core power, and axial offset. Once the limits have 'been defined in this manner un-certainties are included to establish instrument setpoints. These include measurement uncertainties, allowances for drift, errors due to variations in other core parameters (for example pressure measurement error due to variatier.c in cc:ent te perature), and an allewance for "c'ecalibration" durir.g trcnsion:s (for trips used in safety analyses).

The ,following trip setpoints are discussed in BAW 10121:

1. High Reactor Coolant pressure -

2. Low Reactor Coolant pressure

3. Flux / Flow

~

4 High Flux

5. High Reactor Coolant Temperature

6. High Pressurizer Level

7. Low Pressurizer-Level

~

8. Flux /a T

9. Flux / offset

10. Low DNBR

_11. Pump Status 12.- Shutdown Bypass High Pressure.

For each of these trips a qualitative discussion of the reason for the trip and the choice of setpoint range is given, a quantitative discussion of the con-st'raints on the setpoint is presented, and an error analysis is performed to establish the relationship between the setpoint and the value used in accident analyses. Finally a sample calculation is performed to illustrate the process.

• For the purpose of establishing protection system set points a constant value

-of radial' peaking factor is assumed.

. 3

Appendices of BAW-10121P present details of certain features lof the methodology, including reactor coolant system pressure drops, effect of water density on pressurizer level measurements, offset error analysis and heat generation rate / d offset limits, and DNBR ':mited pressure, temperatures and offset.

2. Summary of Evaluation General Design Criteria 20 through 29 of 10 CFR 50, Appendix A set forth

• hs *styiremerts fer the Prc;ection and Rcactivity Control Systems of power reactors. These have been further elaborated in a number of Regulatory Guides.and in the Standard Review Plan. Our review of the setpoint

, methodology described in BAW-10121P was conducted within the framework of Lthese requirements.

In the performance of the review which follows we have confirmed that, for each of the setpoints described:

1. _ appropriate observable parameters are seleted;

2. allowance is made for the difference between the measured parameter and that used in the safety analysis (e.g., cold leg temperature vs core inlet temperature);

3. all sources of uncertainty in the measured parameter are accounted for; and 4.. uncertainties are treated in a manner that ensures conservatism.

Sample setpoint analyses are presented with typical values of the various errors.

Howe'er, v we have not verified these values as part of our review.

Safety Limits The use of fuel centerline melting and departure from nucleate boiling as Specified Acceptable Fuel Design Limits (SAFDLs) is common industry practice 4

for pressurized water reactors and is consistent with the Standard Review Plan (f;UREG-0800, Section 4.2). We find the use of these safety limits acceptable. ,

The use of the ASME Boiler and Pressure Vdssel: Code is endorsed by the Standard Review Plan and we find it acceptable for Babcock and Wilcox Reactors.

oi g y 3%, e 7e ch r?

This trip is set high enough to permit normal operation of the plant with-

, out spurious trips but low enough to prevent exceeding pressure criteria for the limiting anticipated transient. The uncertainties include the pressure measurement error and the difference in pressure between the measurement point and the location defined in the analyses (the core outlet).

The latter quantity varies with the particular pump combination in use and

'T the. largest value of the difference is used. . Finally, a conversion from gauge to absolute pressure is performed to be consistent'with the safety analysis. We conclude that the relevant factors are addressed in this procedure and that it is acceptable.

Low RC Pressure Setooint Essentially the same analysis is done as for the high pressure trip except that the minimum pressure difference between measurement and calculation points ~ is used rather than the maximum. The set point is adjusted to be far enough below normal operating pressure to prevent spurious scrams but sufficiently above the shutdown bypass pressure set point (see below) to prevent confusion. We conclude that relevant factors are addressed and that the procedure is acceptable.

. Shutdown Bypass Trio Setpoint This' trip is activated when the RPS is switched into the shutdown bypass mode. This' trip function provides backup protection when the reactor is

, 5

shutdown but is not used in safety analyses. It also initiates a reactor trip ~if the' bypass is activated when the reactor is operating. A value is chosen-which is above the -lower 5 percent of the bistable range. He con-clude that ' setting Che trip in this manners fulfills the requirements for

.thisLtrip. .

Flux / Flow Trip Setooint r!ur/ fica trip setpcint is established so that a trip c: curs when the indicated flux is greater than or equal to the product of a factor (the setpoint) and the indicated core flow. It is used to limit the

, reactor power when operating with fewer than the total number of pumps and to provide protection against certain events 'during such operation.

To -correct the measured flow to the actual flow it is necessa'ry to correct for instrument error and noise in the flow measurement. To correct the measured flux (power) to the actual value a measurement error and a heat balance error must be included. We conclude that appropriate uncertainties have been treated correctly and that the procedure for establishing the flux / flow trip setpoint is acceptable.

Hich Flux Trip Setpoint The high flux trip setpoint is chosen to be high enough above full power ,

to permit normal plant maneuvers without spurious trips but low enough to provide a useful limit on steady state plant power. Since this trip is used in safety analysis an analytical setpoint (to be used-in analyses) must be derived. This setpoint must be low enough to preclude fuel damage in the analyses of normal operation and transients. The high flux trip setpoint used on B&W reactors is 105.5% full power. In order to obtain the analytic value for the trip a high flux setpoint error and a flux

-(power)-calibrationerrormust.beadded. In addition a heat balance error

.must be added if this is not included in the analysis (current practice includes this error in the analysis). We conclude that an appropriate evaluation of the high flux trip'setpoint is performed.

6 .

In the shutdown bypass mode the high flux trip is reset manually to 5 percent. full power to prevent inadvertent return to pcwer with this mode in-effect. No analytic valug for this setpoint is calculated since it.is not use in safety-analyses.

Hiah RC Temoerature Trip Setooint The high RC temperature setpoint is placed above the maximum expected re ctor cutlet .se;srature for nc-mal r.aneuvering. Tcaperatures ex-cluded by this trip are not considered as part of the operationt.1 range, which requires protection by the low DNBR trip. The analytic value for

, this trip is obtained by adding the measurement-(instrument string) error

-to the setpoint. We conclude that the high RC temperature setpoint 'is properly chosen. -

Flux /a T Trio Setooint

^

This function will actuate a reactor trip if the flux (power) is greater than the flux setpoint and the temperature rise across the core is less than the a T setpoint. The trip is included to protect against rapid power increases. from low power (e.g. from a hig'fi worth bank withdrawal event) whil'e permitting a normal startup.

The 3 T setpoint is taken to be the value of the core temperature rise at.

some reference power level which is usually taken to be ten percent of full power. This power is high enough to produce an easily measured t T but low enough to afford adequate protection for the startup event. The flux trip setpoint is then chosen to be higher than the reference power level to pre-vent spurious trips. A margin of 10 percent full power is usually chosen.

For accident analysis calculations the flux trip is increased by the . total flux measurement error and the a T trip is reduced by the temperature measureme$ terrors. This is the conservative direction for the errors.

~

, We conclude that a proper procedure is employed for determining the set-point for the flux /A T trip.

7

U

, - a '

. r f

Flux / Offset Trio Setooint The flux / offset trip function limits power as a function of offset, and, '

in combinat' ion witn' tie high f-lux trip, forms a trip envelope ~in the offset-flux plane. Operation .of the plant within' this envelope limits the peak linear heat rate so that the kW/ft safety limit is 'not exceeded. The first step in the procedure for deriving this trip setpoint is to obtain the "real"

' lux / offset limits. This is achieved by perfcrming a series of three-

~ ' er.ricr.ai cciculaticrs tc relate the . core ;4dk heet 5:<cratica rate to core power.and offset. The approved analysis code FLAME 3, which couples neutronic and thermal-hydraulics effects, is used for this purpose. An

, extensive series of calculations,is performed which includes the effects of fuel and lumped burnable poisen loading, control rod insertion, axial power shaping reid' position, fuel depletion and fuel management schemes.

The core is depleted through the normal fuel cycle to represent steady-state peaks under balanced core conditions. The design power transient and other load-following maneuvers are run at various times in core life to include the effects of transient xenon redistribution on power peaks.

The extremes of core operation, including over-insertion of control rods, mispositioning of power shaping rods and partial pump operation are in-cluded.

The body of data obtained from.these halculations is examined and a " fly-speck" chart is generated which relates linear heat generation rate to offset for all the various core conditions. A curve is then drawn which represents the centerline fuel melt heat generation limit as a function of offset. This is the "real" flux / offset limit envelope.

The "real" limit envelope is next error-adjusted to account for uncertainties in the measurement of the offset and the core power. The offset is measured by the excore detectors which are calibrated against offset measured by the incore detector system. The offset measurement errors include an incore t

8

system measurement error and an incore to excore calibration error. The flux measurement error consists of a calibration error, a heat balance error, and a calculation module er,ror. In addition both the offset and 3

flux m'easu'rement contain an analog to digital conversion error to account for' the . fact that the analog signals must be converted to digital ones for use in the' calculation module. The error adjusted limit envelope is obtained by lowering each point on the real curve by the amount of the flux error and moving each point irward (toward zero offset) by the amount of the offset n rce.

A further constraint or the error adjusted limit curve is imposed by

,the

offset measurement range. The more conservative points of this range and the error adjusted limit curve are combined to form a modified error adjusted curve. Finally, the combined curve is represented in the calculating module by two straight lines one for negative offset and one for positive offset. Each of these lines is constructed below the modified

~

error adjusted limit curve and the trip envelope consists of these lines and the high flux trip line (105.5% full power).

We conclude that relevant constraints and uncertainties have been included in the analysis of the flux / offset trip setpoint and that the described procedures produce a conservative setpoint end are acceptable.

Pump Status Trip The reactor protection system calculating model generates a reactor trip whenever the pump status monitors indicate that both pumps in either (or both) loops have been lost. No setpoint analysis is required for this trip.

9

F-Hiah Pressurizer Level Trio Setooint The purpos.e of the high pressurizer level trip is to ensure that a minimum stsam volum? always exists in the pressurizer during_ normal reactor operation. This minimum steam vol'ume is necessary to minimize the possibility of the pressurizer going solid as a result of a sudden change in liquid level. While serving as a backup.to the high reactor coolant pressure trip. This trip is not required as the primary trip

'urction for ar.y tr:r.sient, nor is'the trip functicn credited in any accident analysis. Therefore, no analytical value of the trip setpoint is specified. The trip setpoint is chosen high enough to allow for design

, maneuvering of the plant without spurious trip, but low enough to mget the' constraints to ensure that the setpoint does not fall within the upper five percent of the bistable range and that the measurement e'rrors can be accounted for. The-components of the measurement error and their compensation are spelled out in the report. Also, since the indicated pressurizer level is determined by the differential pressure signals, a level measurement correction factor to account for the effects of water density variations on the indicated level is specified in Appendix B of the report. We conclude that the relevant factors are addressed and the procedure for determining the setpoint is accepfable.

Low Pressurizer Level Trio Setpoint The purposes of the low pressurizer level trip are to ensure a minimum pressurizer liquid level for the protection of the pressurizer heaters and to prevent the pressurizer from emptying during the postulated accidents which would cause rapid depressurization of the RC' system.

While serving only as a backup to the lon 2C pressure trip the low pressurizer level trip is not requiref as the primary protection for any transient, nor is it credited r a, 'ccident analysis. Therefore, s

i 10

no analytical value of the trip setpoint is specified. However, the trip setpoint is chosen low enough to allow normal maneuvering of the plant without spurious trip but high enough to meet the constraints which ensu're that the setpoint does not fall within the lower five percent.of the bistable range and that measurement errors can be accounted for. As in the high pressurizer level trip, the components of the measurement errors including the level correction factor for the density variation .effect are scecified in the report. We conclude that th:- reinar.t factors are addressed 2nd the precedure fer decmining the setpoint is acceptable,

, Low DNBR Trio Setooint The low DNBR trip provides the primary steady-state and RC p: Imp coast down transient protection against low DNBR (in which the final pump status is a permitted configuration of operation). Since DNBR is not a measureable quantity, the low DNBR trip is implemented through a calculating module which limits the power level as a function of RC pump status, RC pressure, reactor inlet temperature and axial power offset. A reactor trip is initiated when the reactor power as indicated by_ the excore flux detectors exceeds the compufed power level trip set-point. This trip function defines a variable envelope of operation which prevents the DNBR safety limit from being violated for operating conditions not excluded by other trip functions. The power level trip setpoint algorithm consists of three components: (i) the maximum allowable core power ,a , as a function of core inlet temperature and system pressure, (ii) an offset correction term ,s , to account for the effect of axial offset on DNBR, and (iii) a correction term ,y , to account for partial pump operation and flux measurement error. Each component is defined by a set of fitting equations. The report provides a step-by-step description of the process of determining these equations.

~

11

Appendix E of the topical report provides a description of the method of determining the maximum allowable core power permitted under DNBR constraint at various inlet temperatures and system pressures. The

~

equations used in tF. trip function are line-fitting equations chosen to be conservative with respect to the DNBR limit lines to which they are fitted. Since these equations are derived with the core inlet temperature and system pressure, the measured RC pressure by the r,arrcw-range pressure senscrs and the coolant temperature by the cold

'eg ETD's should be correned before their applicatien to the equations.

The reasured pressure is adjusted for the measurement error and the pressure drop from the core exit to the pressure sensor tap location.

, The calculation of the pressure drop for various pump operation com-binations is described in Appendix A of the repor't. The cold leg coolant temperature is adjusted by a measurement error which ensures a conservative representation of the real reactor inlet temperature.

The effect of axial offset on DNBR is implemented through the reduction of the power limit by a quantity ( s ) which is a function of axial offset.

Appendix F of the report provides a description of the method of calculating the real DNBR margin versus axial offset at various power levels, system pressures and coolant temperatures. These DNBR/ offset limits are used to develop a flux / offset plane for DNBR equal to the safety limit. The real flux / offset limits are further adjusted by the total offset measure-ment error. The resulting power reduction function ( 8 ) is such that the DNBR trip envelope is conservative with respect to the real DNBR limit.

-The power limit is further reduced by a correction tem ( y ) which accounts for (i) the total flux measurement error and (ii) the DNBR penalty incurred from partial pump operation. The total flux measurement error consists of (a) calibration error of the excore flux detector, (b) measurement error of the heat balance used for calibration, (c) analog / digital conversion error and (d) error in the power level trip setpoint calculation introduced by the I

12

9 calculating module. The pump status penalty is required for any-partial pump operation configuration (2/1 or 1/1) other than the normal four pump (2/2) operation. . The penalty is the amount of

. reduction 'that must be made to the total power to account for an RC flow rate.less than 100 percent to main'tain the same DNBR limit.

The determination of the pump-status penalty is described in the report and the penalties for both 2/1 and 1/1 pump operations are large encugh to ensure that the low DNBR trip function is censervative Or all DNER li-it points that require protection.

For the transient pump coastdown from either 2/2 or 2/1 to 1/1 pump

, configuration, the pump-status penalty for 1/1 configuration is used as soon as pump coastdown is detected. Therefore, this trip, if required, is as fast as the pump status trip discussed earlie'r. For the case of pump coastdown from the 2/2 to the 2/1 configuration, the power level setpoint reduction (which is a component of the pump-status

~

penalty term) is imposed in a series of steps. The report provides a detailed description on the application of the stepwise penalty for the power level setpoint reduction throughout the coastdown. The method conservatively accounts for the decrease in DNBR due to coastdown

~of the RC flow.

We have concluded that the relevant factors have been adequately addressed for both steady-state and RC pump coastdown transient protection and the procedure for the low DNBR trip is acceptable.

Effect of Coolant Density and Radial Power Distribution Chanaes After the publication of the topical report two additional soruces of un-certainties were discovered in operating plants containing 177 fuel assem-I blies. For cooldown events, in which the density of the water in the down-comer increases, the neutron attenuation between the core and the out-of-core detectors is increased resulting in a reduction in their response to core power changes. A similar reduction in response would occur if the core

~

13

C' radial power distribution were to become more peaked near the core center during a transient.

These phenomena wil'- affect chiefly those setp'oints associated with the monitoring of core power (e.g. the high flux trip, flux / AT trip, etc.).

We will confirm, for each application referencing this document, that these. effects are included. A similar procedure will be followed for any additional effects that may be discovered.

3. Evaluation Procedure

.The rev'iew of topical report BAW-10121 has been carried out within the guidelines provided by the Standard Review Plan, Sections 4.3 and 4.4.

Sufficient information is included to conclude that the methods and procedures employed to determine the RPS setpoints are state-of-the-art and are acceptable. The general approach to reactor protection is typical of that in the industry and is acceptable. The list of trips employed is similar to that used throughou,t the industry and is acceptable since it provides adequate protection against violating the Specified Acceptable Fuel Design Limits on DNB, fuel centerline melt and the limit on vessel pressure. The treatment of uncertainties is consistent with the measure-ment techniques used and is acceptable. -

4. Reculatory Position Based on our review which is described above we conclude that topical report BAW-10121P is acceptable for referencing in licensing actions by Babcock and Wilcox with respect to techniques and procedures used in establishing trip setpoints for plants employing the RPS-II protection system. The particular values of the uncertainties used in the analyses of these setpoints must be established for each application. In parti-cular the effects of overcooling transients and transient radial power distribution changes on the excore detector power calibration error must be addressed.

I 14

~

_