ML20136F210
| ML20136F210 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 12/31/1985 |
| From: | Holmes M, Johns J PUBLIC SERVICE CO. OF COLORADO |
| To: | |
| Shared Package | |
| ML20136F171 | List: |
| References | |
| EE-EQ-0014, EE-EQ-0014-RB, EE-EQ-14, EE-EQ-14-RB, NUDOCS 8601070304 | |
| Download: ML20136F210 (38) | |
Text
. _ _ - _ . _
EE-EQ-0014 ISSUE B SAFETY ANALYSIS REPORT STEAM LINE RUPTURE DETECTION / ISOLATION SYSTEM FORT ST. VRAIN NUCLEAR GENERATING STATION DOCKET 50-267 PUBLIC SERVICE COMPANY OF COLORADO Prepared by: Nuclear Licensing Department Nuclear Licensing and Fuels Division Public Service Company of Colorado
" December 30, 1985 Approvals: /7-3/'#I SuperviYor, Nuclear Licensing - Engineering
% &], A
= l b 3/-%1-Nucle'ar Licensing Manager f.
B601070304 851231 -
yDR ADOCK 05000267 PDR
f
- TABLE OF CONTENTS PAGE 1.0
SUMMARY
...................................................... 1
2.0 BACKGROUND
.................................................... 1
- 2.1 Purpose.................................................. 1 2.2 System Description ...................................... 2 2 . 3 Sys t em C r i te r i a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.3.1 Des i gn C ri te ri a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.3.2 Environmental Qualification ...................... 11 2.3.3 Seismic-Qualification ............................ 11 2.4 Ins trumenta tion Performance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.5 Component Characteristics................................ 11 2.5.1 Sensors .......................................... 11 2.5.2 Temperature Monitors.............................. 12 2.5.3 -Controllers ...................................... 12
. 2.6 Instrument Rack.......................................... 12 .
2.7 Temperature Profiles .................................... 14 i 2.7.1 Postulated Pipe Rupture Scenarios ................ 14
' 2.7.2 Manually Isolated Leaks .......................... 15 2.8 Results of the 10CFR50.59 Safety Evaluation of the SLRDIS.19 5
3.0 SAFETY ANALYSIS .............................................. 21 3.1 Instrumentation Design Bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.2 Systems Interaction...................................... 22 3.2.1 High Energy Line Breaks .......................... 22 3.2.2 Maximum Credible Accident ........................ 23 3.2.3 Design Basis Accident No. 2 ...................... 24 3.2.4 Fires ............................................ 25 3.2.5 Inadvertent Tri ps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 3.2.6 Water and Steam Hammer Effects.................... 34 4.0 SIGNIFICANT HAZARDS CONSIDERATION (10CFR50.92)................ 35 4
t
-. ,,--,.,y-.-,. 36-.v... . ,- -.m.,,-,_.-,,,,..%,,.,,,,,m. -
,,.py .-.--.w-,--ry,-.em % , . _.---.w.y,.v.,y ,.-,,-.,,,,,-,---,,-.-w
.,.e,.m-me.w,-e,,~,.- .
SAFETY ANALYSIS REPORT FORT ST. VRAIN
-STEAM LINE RUPTURE DETECTION / ISOLATION SYSTEM 1.0
SUMMARY
Public Service Company of Colorado (PSC) has cmnmitted to install a Steam Line Rupture Detection / Isolation System (SLRDIS) for the purpose of automatic isolation of selected high energy steam pipe line breaks in the' secondary coolant system. Rapid isolation of a postulated pipe rupture will 1) limit the harsh environment for safety related electrical equipment to an acceptable level for its qualification per 10CFR50.49 and 2) allow building cooldown to a level acceptable for access within one hour by personnel wearing protective equipment to perform required manual safety actions.
In accordance with 10CFR50.59 PSC has determined (see Section 2.8 for additional detail) that the installation and design function of the Steam Line Rupture Detection / Isolation System constitutes an unreviewed safety question because:
(1) It increases the probability of occurrence of a 30 minute interruption of forced ' circulation cooling previously analyzed in the FSAR.
(2) It reduces that margin of safety for assuring continued forced circulation cooling as defined in the basis for Technical Specification LCO 4.4.1 Plant Protective System Instrumentation, In accordance with 10CFR50.92, PSC has also determined (see Section 4.0) that the installation and design function of SLRDIS does not involve any significant hazards consideration in the operation of the facility.
2.0 BACKGROUND
2.1 Purpose The purpose of the Steam Line Rupture Detection / Isolation System is to detect and automatically isolate selected high energy line breaks in the secondary coolant system in both the Reactor and Turbine Buildings. Leak detection results in alarms and automatic ~ isolation of the high energy steam pipe lines of the secondary coolant system, thereby limiting the steam release into the buildings. This assures that resulting building harsh i 1 l
, - - . - . - . - . - -- . - - . . - ~ . ~ . - . _ _ . . - . . .
environments without any credit for operator action are much less severe than those harsh environments previously established and accepted by the NRC based upon operator termination of the leak at 4 minutes. A second purpose is to assure that the subsequent building air temperature cooldown allows access within one hour from the onset of the steam leak by personnel wearing protective equipment. Human access will permit personnel to perform required manual safety actions.
2.2 System Description
Detection of a high energy line break (HELB) is assured by continuous monitoring of area average temperatures in both the Reactor and Turbine Buildings. The total area monitored is divided into two distinct zones, one in the Reactor Building and
, one in the Turbine Building. The zones selected provide coverage A in the event of a rupture in the high energy steam pi lines (main steam, cold reheat, hot reheat, auxiliary steam)pe SLRDIS is not designed to isolate feedwater, condensate, and extraction steam leaks since analyses demonstrate that these leaks can be adequately isolated by the operators. SLRDIS does previde a low level temperature alarm to aid the operator in detecting and terminating those pipe ruptures not automatically isolated. A two-out-of-four tripping scheme is established for each zone by routing 4 temperature sensing (thermistor-type) cables in each zone. The temperature sensors within each zone are located to sense the average temperature of the building volume.
The sensor cable general locations are shown in Sketch 1. A general diagram of the SLRDIS/PPS relationship is given on Figure 1.
Each thermistor cable independently acts as a zone temperature sensor and provides a resistive signal that decreases exponentially with temperature. The setpoint is based on a resistive signal determined by the length of the sensor cable reaching high temperature. The four signals are routed independently to channel Temperature Monitors such that each zone's "A" cable is input to the respective "A" Temperature Monitor, and so on for Cables B, C, and D as shown in Figure 1.
Both ends of each sensor cable are connected to the associated Temperature Monitor in a " loop" configuration. A break in a sensor cable will not negate the capability for a valid high temperature signal from being produced by the remaining ends.
The sensor break itself actuates a Trouble Alarm.
The Temperature Monitors are capable of sensing the resistive signal from each cable and independently annunciating the following preset alarms:
Low level pre-trip alarm (adjustable between 140F and 300F)
High level alarm and trip (adjustable between 140F and 350F)
Trouble alarm (for short or open circuit conditions)
Rate of Rise Alarm (100F/ Min.)
The alarm contacts are connec'ad to a control room annunciator window on control board I-05 that reads: " Steam Line Rupture Detection Panel - Acknowledge". Appropriate "reflash" provisions exist so that subsequent valid alarms are presented to the control room operator while a channel is disabled for maintenance, or on test. The temperature from each sensor channel can be read out on the steam line rupture detection rack located in the control room.
The automatic isolation feature of the SLRDIS is provided by redundant microprocessor-based logic. Each cable monitor, upon actuation of the high level alarm / trip, transfers this information through optical isolators to the two redundant (Logic A and Logic B) microprocessors. Each microprocessor combines the four cable alanns from any single zone into a two-out-of-four logic trip signal. Upon actuation, the trip logic scheme provides isolated relay contacts to the existing secondary coolant isolation valve circuits. The interface of this system with the existing valve controls and the plant protective system (PPS) is such that it overrides other commands and does not preclude any prior manual or automatic isolation from occurring.
A simplified diagram showing the PPS interface is shown in Figure
- 2. The SLRDIS provides a trip signal into the circulator trip logic of the PPS to each of the four circulators. The SLRDIS also provides a trip signal into an additional valve actuation logic module to initiate valve closure.
The system employs " transmission logic" in that it takes power to cause an isolation signal. This is consistent with the use of
" transmission logic" in the existing PPS Loop Shutdown and Circulator Trip Logic. Instrument power is provided from non-interruptible instrument buses 1A and 18 as shown in Figure 1.
Testing is facilitated in the two-out-of-four configuration by conversion to a two-out-of-three configuration during test of one sensing channel.
9
The temperature monitors, logic and associated circuitry are mounted in the Steam Line Rupture Detection Rack located in the control room. The design of the Steam Line Rupture Detection Rack incorporates human factors engineering considerations consistent with those for equipment in the FSV Control Room.
Physical and electrical separation between redundant portions is maintained by appropriate compartmentalization.
The temperature sensing and trip signal functions are designed in accordance with single failure criteria and will initiate the following actions within 2 seconds following the detection of a pipe rupture:
Close C-2101 Water Turbine Valves, SV-2109, HV-2109-1, and HV-2109-2, thru XCR-93239A and XCR-932398.
Close C-2102 Water Turbine Valves, SV-2115, HV-2115-1, and HV-2115-2, thru XCR-93241A and XCR-932418.
Close C-2103 Water Turbine Valves, SV-2110, HV-2110-1, and HV-2110-2, thru XCR-93240A and XCR-932408.
Close C-2104 Water Turbine Valves, SV-2116, HV-2116-1, and HV-2116-2, thru XCR-93242A and XCR-94242B.
Close C-2101 Steam Turbine Control Valve, SV-2105 thru XCR-93137A and XCR-931378.
Close C-2102 Steam Turbine Control Valve, SV-2111 thru XCR-93149A and XCR-93149B.
Close C-2103 Steam Turbine Control Valve, SV-2106 thru XCR-93138A and XCR-931388.
Close C-2104 Steam Turbine Control Valve, SV-2112 thru XCR-93150A and XCR-931508.
Close C-2101 Steam Turbine Outlet Valve, HV-2249 thru XCR-93137A and XCR-931378.
Close C-2102 Steam Turbine Outlet Valve, HV-2251 thru XCR-93149A and XCR-931498.
- Close C-2103 Steam Turbine Outlet Valve, HV-2250 thru XCR-93138A and XCR-931388.
- Close C-2104 Steam Turbine Outlet Valve, HV-2252 thru XCR-93150A and XCR-931508.
Close Loop 1 Superheat Header Outlet Stop Check Valve, HV-
?223 thru XCR-93167A and XCR-931678.
- Close Loop 2 Superheat Header Outlet Stop Check Valve, HV-2224 thru XCR-93168A and XCR-931688.
Close Loop 1/ Loop 2 Feedwater Block Valves, HV-2201 thru XCR-93378 and HV-2202 thru XCR-9334A.
Close Loop 1/ Loop 2 Emergency Feedwater Block Valves, HV-2203 thru XCR-93378 and HV-2204 thru XCR-9334A.
Close Loop 1/ Loop 2 Feedwater Control Valves, FV-2205 thru XCR-9334A and FV-2206 thru XCR-93378 Close Loop 1/ Loop 2 Main Steam Bypass Valves, PV-2229 thru XCR-9335A and XCR-93358 and PV-2230 thru XCR-9336A and XCR-93368.
Close Loop 1/ Loop 2 Main Steam Startup Bypass Valves, HV-2292 thru XCR-9336A and XCR-9336B and HV-2293 thru XCR-9335A and XCR-93358.
Close Loop 1/ Loop 2 Reheat Steam Bypass Valves, HV-2241 thru XCR-9335A and XCR-93358 and HV-2242 and XCR-9336A and XCR-9336B.
Close Loop 1/ Loop 2 Reheat Steam Bypass Pressure Ratio Control Valves, PV-2243 thru XCR-9335A and XCR-93358 and PV-2244 thru XCR-9336A and XCR-93368.
Close Loop 1/ Loop 2 Reheat Stop-Check Valves, HV-2253 thru XCR-9335A and XCR-9335B and HV-2254 thru XCR-9336A and XCR-93368.
Close Cold Reheat Header to 150 psig Header Valves, PCV-5214-1, -2, -3 thru XCR-9338A and XCR-93388.
Close Auxiliary Steam to 150 psig Header Valve PCV-5201 thru XCR-9338A and XCR-9338B.
- Close Auxiliary Steam to Cold Reheat Header Valve PCV-5213 thru XCR-9338A and XCR-93388.
Close 150 psig Header to Deaerator Valve, PCV-5305 thru XCR-9338A and XCR-93388.
Reactor scram thru loop trouble trip logic to two loop trouble scram.
Main Turbine Throttle Trip thru XCR-93211A and XCR-932118.
These trip signals also close valves HV-2223 and HV-2224 (above).
These additional valve closures or actions occur:
Signal to each circulator auxiliary system (identical to normal circulator trip).
Close each circulator steam trap isolation valve HV-22111, HV-22112, HV-22113, HV-22114. HV-21335, HV-21336, HV-21337, and HV-21338.
Close reheater attemperator block and control valves HV-22133, HV-22134, FV-22119, and FV-22120.
Additional loop valve closures based on first in with lockout actuation.
1
- 1 1.w I N )
pygygg i ass 7f* & 6a's, 1'-
f!N0WN) 2 ce!.
72 - M2nto' ,.., f yg. 43439 s i
gyfy;; 1r -
m- o /
- ose, \ *
.,f.93943 7dMB/ME &LD d' .
71-93H/~, ',$1, N d nen m , ,, 1" TN&A M/3 70A CA 6 Lf3 u.. an, *** jd7WI44 14.4600 ? !!.. Ja?E
-- ,.,,, t-, N J
.. su w simi a n, 5 (re-ssna "
- l
- l n vmou q(rs-essu f,"Gi, (isomwa ossr) (nrseaway dif7 L 2 1 4M $ bT
- l I I ll l ll t
re nm
^
y-re.;mq ~
N y ,
),m-,l.m
) m -- ( guara agog l
. l i iI
'*""/'l
[ L- l ll i r/ i ! Ii l ;-re.;mej il 3 I I
- f. ro ma ,
TUR8/Nd $! D5.
l l i:nml-y a
l "*\* l stuu oxo 5 **
- Ruprund C&7EC7/C.
!ffffM CVdA'//2W
- 2 l l l l [ ,
PLA A/ W&W l
.S k E TC H .1 i
FXiURE I STEAM LINE RUPTURE OETECTION/ ISOLATION INSTRUMENTATION sitA= W avefunc :cfc:f::,,
nsfech@st Su S ' A _ C8I8*93583) r.0CA74% gcC4f*0u40cul
$[NSCAS ftw(NAfust SENS*G 1 CA8Lt3 w CONTAcc accu h l A3 - - AP+0NCATOR
~ -
ft9ptatAfung i (fvihCAU W , uopefC# _
^ '
c7 _
De 'A 3 (C G.C 2 Ouf CF e '**
N ANY W TO 881) peufs SMown g ,,
r04 20 Pet t tfTP 074.4 20put31 I
= =-
fmw wopefon _
a 1 i
5 i
I 4 FCusteA fg g U AN#8cNC. W uCNf04 -
C l LCGC
& CUT Cf A f**
N ANY W TC #81) l !;Nt
<ctfAs. A, e _
ftw(e4 fung C ANNVNC.
l C -(
- T @fCR IM l - ;
0 l 1
O f
.Ns raca.csf sus 4 CE 4:L A z cut :r A tooC A sus ,A . f. e.c , . .. .cc 3 ,s 3 ,,,
ZONE e ZONE 2 l2 Out Of el 12 Ouf or al IP if 0 PJf f## At' .A'S f
FIGURE 2: SLROIS AND PPS RELATIONSH!3
( A LOGIC SHOWN,8 LOGIC SIMILAR)
INPUTS FROM INPUTS FROM E%ISTING SLR015 INSTRUMENTATION INSTRUMENTATION
^ ^
r r s 000 OOOQ e " g u g, ,
, STEAM LINE CIRCULATOR RUPTURE yggp _
(ONE PER CIRCULATOR) DETECTION LOGIC RACK (1-93543)
PPS (I-13to)
VALVE ACTUATION LOGIC (N EW) o yy e y o o 1
w 2 EXISTING ADDITIONAL OUTPUTS OUTPUTS 1
2.3 System Criteria 2.3.1 Design Standards The sensor and signal processing system meets the following design standards:
Institute of Electrical and Electronic Engineers Short Name as Date of Identification used Herein Issue of the Document IEEE-279 1971 Criteria for Protection Systems for Nuclear Power Generating Stations IEEE-308 1974 Criteria for Class 1E Power Systems for Nuclear Power Generating Station IEEE-323 1974 Qualifying Class 1E Equipment for Nuclear Power Generating Stations IEEE-338 1975 Standard Criteria for Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection System IEEE-344 1975 Recommended Practices for Seismic Qualification of Class IE Equip-ment Nuclear Power Generating Stations IEEE-379 1977 Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Class IE System IEEE-384 1977 Standard Criteria for Independence of Class 1E Equipment and Circuits The interface with the existing PPS and valving is commensurate with the existing plant design standards.
2.3.2 Environmental Qualification The instrumentation provided to accomplish the detection and provide the isolation signal is environmentally qualified to IEEE-323. Service conditions appropriate for the instrumentation locations have been used.
2.3.3 Seismic Qualification The instrumentation provided to accomplish the isolation is seismically qualified to IEEE-344 to withstand both the Design Basis Earthquake (DBE) and the Operating Basis Earthquake
.(OBE). Response spectra appropriate for the instrumentation locations have been used. Acceptance criteria include no loss of function or improper safety action during or after the seismic event.
2.4 Instrumentation Performance Instrumentation Range: 140F to 350F System accuracy (including sensor): 12%
Sensor accuracy: 11%
Sensor response time to trip: 2 seconds subsequent to sensor exposure to trip temperature 2.5 Component Characteristics 2.5.1 Sensors Type:- Thermistor cable (Lengths to 50 feet).
Cable Assembly: 0.09" diameter stainless steel jacket (0.016" thickness), thermistor (powder ceramic) core, 20 AWG nickel center conductor. Both ends of the stainless steel jacket are sealed to prevent entry of moisture.
Junction Boxes: Stainless steel junction boxes complete with socket connectors and terminal strips.
2.5.2 Temperature Monitors Type: Solid state thermistor cable Temperature Monitor. Each monitor accepts up to 7 thermistor cable inputs (2 operational and 5 spare).
Characteristics: Temperature Monitors are designed to convert a resistance value from a thermistor and initiate changes in relay contact positions when the measured variable exceeds the trip set point.
The monitors are dual adjustable set point units for high temperature (pre-alarm and alarm / trip).
Overall accuracy (including sensor): 12%.
Repeatability: 11%.
Monitors are furnished with open circuit supervision- and short circuit discrimination.
Monitors include " cable test" circuitry.
Local Control Individual windows for each thermistor Board cable input are provided.
Annunciation
- a. Low level pre-tripalarm(adjustable between 140F and 300F).
- b. High level alarm and trip (adjustable between 140F and 350F).
- c. Trouble - short or open circuit.
- d. RateofRise(100Fperminute).
All annunciation windows have reflash capability, with silence-acknowledge-test buttons. Spares are provided for at least 2 more cables per Temperature Monitor.
1
-- . - - - - . - . -_ .. - -.. . _ ~ _- -._-_.
if -
- Output: Appropriate optically isolated outputs to the logic A and logic B microprocessor logic controllers are processed.
Dry relay contacts for use in control room s alarm that -combines annunciation points j from all cables are utilized.
An RS232 port for future use in data logger L monitoring is provided.
l 2.5.3 Controllers Type: Microprocessor based. Programmed to trip on 2 out of 4 transmission logic (energize to actuate) from any temperature zone.
Capable of tripping on 2 out of 3 logic in any single zone when one cable in the zone is in the test mode.
. Output: Relay contacts for use in output vclve 4
control.
Failure / cable test alarm contacts for use in control room alarm.
2.6 Instrument Rack 2
Type: Free standing rack, for mounting on . a concrete floor.
Seismically qualified per IEEE-344, including contents.
Rack Contents: All necessary temperature monitors, controllers, output relays, controls and i displays.
Electrical Rack. including input / output cabling wire-Separation: ways, is compartmentalized to provide for electrical separation and isolation between -
4 divisions per IEEE-384.
l 3
- 13 -
i TT'-Y--' =-$A4-W y--y)wyme ,-erm1-wew----.m-w-yy*ey&y- gg n - me m>s-mm yy =-er-gin %gwe-gipe y e-t w e,n ey y W * + pop w e gig eip- vrp 9 m -gyyvey -+ ,e m-p r--eie*P-typm..- m-y--pywe---
)
2.7 Temperature Profiles 2.7.1 Postulated Pipe Rupture Scenarios Postulated HELBs from 0.093% flow area to full offset ruptures were analyzed for termination by SLRDIS (see Figure 3). These analyses were performed using the following criteria:
- Identify and terminate those secondary coolant pipe ruptures which must be automatically isolated to protect the Safe Shutdown electrical equipment.
Impose those single active failures which are considered to have the most deleterious impact upon each pipe rupture accident. Failures of simple check valves and the check valve portion of stop check valves are considered passive failures.
- Apply existing plant protection and control system actions, with the exception that no credit has been taken for actions of the existing ultrasonic sensing steam pipe rupture detection system which is being deleted.
- Apply the temperature sensing Steam Line Rupture
- Detection / Isolation System to be installed in both the Reactor and Turbine Buildings, which will initiate the actions listed in Section 2.2. The temperature sensing and trip signal functions are designed in accordance with the FSV single failure criteria, and will initiate the action'within 2 seconds of the setpoint being reached.
Input a Reactor Scram for all automatically isolated pipe ruptures.
No operator action taken within the first 10 minutes.
- Auxiliary boilers are never in service above 59% reactor power.
Components which are environmentally qualified can be assumed to function correctly unless they are the object of a single active failure.
Components which are not environmentally qualified can be assumed to function correctly, provided that they perform their function before being exposed to a harsh environment and are not the object of a single active failure. It is not necessary to assume structural failure of such
. I components, unless they are the object of an imposed rupture accident.
t The resultant pipe rupture mass / energy releases were determined '
using the FLASH /GA computer code. Conservative estimates of the timing of protection system actions and mitigating control
' system actions were assumed, based upon the anticipated system response from system transient analyses in Design Criteria DC-4 5-2, the FSAR, and on engineering judgement. Building heatup and temperature response was determined by the CONTEMPT-G
- computer code using the FLASH /GA release rates.
The resultant temperature profiles for each accident scenario isolated by SLRDIS were used to produce an enveloping temperature profile curve shown in Figures 4 and 5 for the Reactor and Turbine Buildings, respectively. The results indicate peak bulk building temperatures of 371 degrees F and 360 degrees F are reached for the Reactor and Turbine Buildings, respectively.
- 2.7.2 Manually Isolated Leaks !
Those postulated pipe ruptures which are not isolated by SLRDIS because of requiring too low of a trip setpoint were analyzed to demonstrate that these HELBs can be adequately isolated by i the operator. (See Figures 4 and 5.)
The analyses were based upon the following criteria:
- No operator action taken until time 10 minutes following actuation of the SLRDIS low level pre-trip alarm.
i 1 minute per each operator action thereafter.
4
- All instrumentation the operator must rely on to providt indication of the pipe rupture (assuming a single failure) will either be environmentally qualified if they are exposed to the harsh environment or located in a mild environment.
Impose those single active failures which are considered to have the most deletrious impact upon each pipe rupture l accident.
Those pipe ruptures which neither trip SLRDIS nor actuate the low level pre-trip alarm will be detected by the operators caking their normal rounds and isolated by operator action f
15 -
l m_, ,.._-_,,.-..,_.._.r_._,.,. .,_, ____.._...,_m, ..,.,,.,,_,,,____,,___.._..,,,._,,,_m_.__,.mm.__.,,m....,,_____..
1
. j-is i 3 !! ! i r. i
! i! ! j ; ! !
2 }!l!i!!i!;;ijli.!jiII-!ltig!g
[-liism;8gir I
iji ig!.lj- l !I!I:!!!,:i i:!:s !! 5 1
I Nl!!!!!!!!!!!!!!!!l!!!!!!N!!_!!!!!!!!i!!lN!!!lllll!l!ll!
eseees eeeees e e e e e ese secces cee e e ol i jk! r. !! ji li j l I l '! 3 3, 1"iI a
.i i a. Iil!!!.)
al 11 f
- * * ** *$ n i i s : : ,
r .l.
I
= ,f; o
- g 12
_ .x.
y 7 l eoo ;
6'
, 1
' ~
i _ I w 5 I "
L.yt g! !
I' ce e,b 4 ha@ et ic
~
,s2ne .- c. i o 8s
~
ug
$ SJ. - 5
' e j ,* \
q, /\ 1 5 5 5 5. . $$
- o : e" lig_ f_ 't
_ gg s e { $ 0 0 2 Ij
- p" = ou e -
bt '
0 ,_,
j ,_ y MM -
o
" . , etec -
[ i I
he
{ ft [ DIYd d "
O 2 I
__8'8 si i 2 _ _
I i U 12 3 &, v ,
8 It ;
,o a iK -ir ,
, i ! ',O, C
, te .. ,
y
- _______g,
___l____
==
e ! j i s a o !
' = -
-g _____.__i_ ~ - i 1
___!____ ge y @3 's 4
o w
~ '
e ,
i l l
} ,
COMPOSITE
SUMMARY
OF LARGE AND SMALL LEAKS REACTOR BUILD 1HG 1
T 4gg I
{ E -
SCEllAR10
,1 M -
.e
\
P .
HRtF2 ,
i .
! i .
its-a 1
O 300 = 'J 1,.~..
\. .__;_,.-----
) F , .
\* ns-3 j _ ;
, ./.
g __------
( n -
1]'
CR64-18
\
3 1
7 - ,
's---
\ ,
2 M
0
- 3 ')- 'FU-6 i
g 200- / l4- _ . - - - - - ,
i ? '~
CRH-12
\ n
- ' 2 _.
/ \' '
gtRit-4 g
e.
y _
,y w' c',, --/ .
p- %g $', f .
- ~'%
-~ **
i -
.- .- nS-4 1
j
\
E
_ 196-M /,/d'I', A
' _y ,
N._.t.gg 0FF ET
. ~ ~ . -
3
'D S, cRH-16 cyg.gAc
\ g -
(e.53 FL e.254 AREA CRH-149 1
\
E -
~
! G _ CHil_14E i
l i F 0- ,,,,,,,,, ,,,i,,,,- i , , ii ,, , , , , , , , , , , , ,,,,, ,iinm
! -3 g9-2 10 10'I 1 le 10 10 3 i
3 -
TIME - MINUTES ,
I l
i l
i 1
l
1 1
COMPOSITE StNMARY OF LARGE AHD SMAL$ LEAKS TURRINE BUILDING
- T 400 SCENARIO E -
! M -
) p HRN-1
~
l
-- g9 j----
O 300-F -
caH-9 i _.-______
j A -
FM-3 j OFFSET T -
Flou ll . m n area as-t i ig
) ;;; 0
} -e.7,44 - cfg_g37-
! , S 269 ,. f g
,,. ,q i
i y, P - * *
/ CRH-13F i -
\ r e s .sp.
,.s ,.e.egas --- --
! R E
j #' '
~-
&M '
~; %g k% "~
,-] ' , , -
CRH-15 ~
_ I99- _
r.--
sw_- - = . - - -
D -
} E -
G _
F 9 i v iisies i i s i ssii , i i n sisii : -siuna i a r riin i s i s mi l -3 gg -2 gg-1 2 10 1 le 10 10 3 i 1
TIE - MIHlffES 4
I i
l 1
1 l
l 7
within one hour.
2.8 Results of the 10CFR50.59 Safety Evaluation of the SLRDIS (1) Has the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the FSAR been increased?
The Safety Analysis which follows assesses the impact of SLRDIS on accidents or equipment malfunctions previously evaluated in the FSAR. Several accidents previously evaluated in the FSAR, besides a steam line rupture accident, result in high building temperatures which could potentially actuate the SLRDIS. The SLRDIS would then isolate both secondary reactor cooling loops resulting in an interruption of forced circulation core cooling. Those accidents which could potentially actuate the SLRDIS were evaluated to determine if the accident consequences are increased over those previously evaluated in the FSAR. The following Safety Analysis in Section 3.0 concludes that the consequences of those accidents which could actuate the ,
.- SLRDIS are not affected. t Installation of the SLRDIS increases the probability of occurrence of an interruption of forced circulation cooling due to the potential for inadvertent actuations of SLRDIS.
, ' It is anticipated that for inadvertent actuations the operators will be able to re-establish forced circulation cooling within 30 minutes so that the consequences of interruption of forced circulation coofing due to inadvertent actuation of SLRDIS will not exceed those previously evaluated in FSAR Section 14,4.4.2. In any event, the consequences of an inadvertent actuation are bounded by the 1 1/2 hour delay for a boosted firewater cooldown (Safe Shutdown Cooling, FSAR Section 14.4.2.2).
(2) Has the possibility of an accident or malfunction of a different type than any evaluated previously in the FSAR been created?
.F The required function of SLRDIS is to isolate both primary and secondary coolant loops ir, the event of a HELB resulting in an interruption of forced circulation cooling. The FSAR evaluates the consequeaces of an interruption of forced circulation cooling from "30 minutes" (FSAR 14.4.4.2) to a
" permanent loss" of (FSAR 14.10). A postulated inadvertent actuation does provide a new mechanism of entering into a previously FSAR analyzed accident or malfunction but does e
not in itself create a new accident .
As stated in Item (1) above, it is anticipated that recovery can be accomplished within 30 minutes for an inadvertent actuation of SLRDIS, Since the consequences of an inadvertent actuation of SLRDIS are the same as by previous FSAR analyses (FSAR 14.4.2.2),
no new accidents or malfunctions have been created.
The following Safety Analysis in Section 3.0 discusses the impact of inadvertent actuation of the SLRDIS on overall sa fety.
(3) Has the margin of safety, as defined in the basis for any Technical Specification been reduced?
A review was conducted to determine if the installation of the SLRDIS.would result in a reduction of the margin of safety as defined in the basis for any Technical Specification or in the FSAR.
Technical Specification 7.6 addresses exclusively the environmental qualification of safety-related electrical equipment. Installation of SLRDIS limits the harsh environment to which safety related electrical equipment is exposed and to which its qualified. Therefore, the margin of safety in the basis for environmental qualification has not been reduced.
Environmental qualification of equipment is addressed in Fort St. Vrain FSAR Section 1.4. The harsh environments defined in the Reactor and Turbine Building which serve as the bases for equipment qualification are 4-minute operator terminated offset ruptures of steam piping. The SLRDIS function is to perform automatic detection and isolation of these postulated steam leaks without operator intervention such that the harsh environments do not exceed those previously defined for equipment qualification. An additional function of the SLRDIS is to assure a building average temperature sufficiently low so as not to preclude human access into the building one hour from the onset of the accident. The latter requirement is the most restrictive, and mandates that steam energy releases be less than those previously established in the FSAR for equipment qualification. It is, therefore, concluded that the installation of the SLRDIS does not reduce any margin of safety defined in the FSAR with respect to the basis for any Technical Specification.
I I
Technical Specifications LCO 4.4.2 and LC0 4.4.6 deal with harsh environments for operation of safety-related equipment l in the three-room control complex. The SLRDIS does not I protect against harsh environments in the three-room control l
. complex for a HELB. Therefore, the SLRDIS does not result i in a reduction of a margin of safety in the basis fcr these )
Technical Specifications. '
The basis of LC0 4.4.1 - Plant Protective System Instrumentation requires the plant protective system to automatically initiate protective functions to prevent established safety limits from being exceeded. In addition, nther protective functions are provided to initiate protective actions to mitigate the consequences of accidents. The present PPS Loop Shutdown Logic design inhibits the automatic shutdown of both primary and secondary coolant loops. However, tripping of all four circulators can occur due to the PPS Circulator Trip Logic (for example, on low feedwater flow in which restart of the circulator on water turbine drive is inhibited resulting in loss of forced circulation of primary coolant). The interface of SLRDIS into the Circulator Trip Logic will override the existing design features to cause automatic shutdown of both primary and secondary coolant loops for a loss of forced circulation cooling. Therefore, this means of overriding the two loop shutdown inhibit reduces the margin of safety for assuring continued forced circulation cooling.
3.0 SAFETY ANALYSIS A review of the FSAR and Technical Specifications was conducted to determine the effect of the SLRDIS on systems, components, equipment, tests or procedures described therein. The results are presented in the following sections.
3.1 Instrumentation Design Bases The principles of design, design bases, and the protective functions of the Plant Protective System (PPS) are addressed in Section 7.1 of the FSAR. The PPS initiates automatic corrective actions upon the occurrence of the following:
- Equipment failures which require corrective action beyond the capability of the plant control system,
- Failure of the plant control system causing an abnormal condition,
- Misoperation which has resulted in a potentially unsafe condition.
The corrective actions are directed towards safe operation of the plant and protection of the core and equipment.
The addition of the SLRDIS instrumentation is commensurate with the present system design described in the FSAR, however, the approach is different (i.e., two-out-of-four sensing logic) and more recent industry design standards have been utilized.
The SLRDIS employs coincident logic to preclude inadvertent trips and." Transmission Logic" in that it requires power to cause an isolation trip signal. This is consistent with the Circulator Trip Logic in the PPS where the SLRDIS interface exists. In-operation testing features are provided to assure operability of the system. Redundancy and independence is provided to assure that no single failure will cause the loss of the protective function.
The addition of the SLRDIS instrumentation and interface with the PPS does not inhibit any existing automatic protective feature in the scram, loop shutdown, circulator trip or rod withdrawal
_ prohibit circuits.
3.2 Systems Interaction The purpose of the SLRDIS is to detect and automatically isolate pipe ruptures in selected portions of the secondary coolant system. However, primary coolant leakage, if of sufficient magnitude, could also trip this system in the Reactor Building. This in turn could result in secondary coolant flow isolation along with interruption of forced circulation.
Two primary coolant leak accidents are analyzed in the Fort St.
Vrain FSAR. These are the " Maximum Credible Accident" discussed in FSAR Section 14.8, and Design Basis Accident No.
2, " Rapid Depressurization/ Blowdown" discussed in FSAR Section 14.11. These are analyzed in Sections 3.2.2 and 3.2.3 of this report.
3.2.1 High Energy Line Breaks High Energy Line Breaks are discussed and analyzed in various FSAR sections. FSAR Section 7.3.10, 6.2, and 14.5.1 address pipe ruptures in the Reactor Building while Appendix I addresses pipe ruptures outside the Reactor Building.
As shown in Section 2.0 " Background", the SLRDIS will detect and automatically isolate High Energy Line Br'eaks for which it is dasigned both in the Reactor and Turbine Buildings. The rapid isolation will result in a less severe environment (see Figures 4 and 5) than that for which the safe shutdown electrical equipment was previously qualified (see FSAR Figures 1.4-1 thru I.4-3 enclosed for reference) to assure its continued operation for safe shutdown and decay heat removal.
The rapid isolation will also allow building cooldown to a level acceptable for access within one hour by personnel wearing protective equipment to perform any required manual safety actions.
3.2.2 Maximum Credible Accident The Maximum Credible Accident results from a multiple failure involving the helium purification system regeneration piping.
The primary coolant leakage results from the postulated rupture of a 2 inch pipe which comes out of the PCRV top head and goes to the helium purification regeneration system located just below the refueling floor. The FSAR analysis assumes that no operator action is taken to mitigate the consequences of this event. FSAR Figures 14.8-2 and 14.8-3 show PCRV pressure and
. Reactor Building temperature with time. These figures are enclosed for reference. About 2 minutes into the accident, a reactor scram would occur on low programmed primary coolant pressure. Building temperature response is relatively slow reaching the peak temperature of about 175 degrees Fahrenheit at about 40 minutes into the accident. This analysis was very conservative in that it did not account for the Reactor Building's heat sinks or the mixing of the helium with the building's entire volume.
GA Technologies Inc. reanalyzed the event using the CONTEMPT-G code which accounts for the heat sinks and volume mixing. The er.caping primary coolant is considered to be mixed in the building volume environment. The results of the reanalysis show that the maximum average temperature in the Reactor Building is about 94 degrees Fahrenheit as shown in Figure 6a (about 5 degrees above analysis ambient). The analyses also reports a peak Reactor Building pressure of 1.0 inches w.g. at 1 minute (Figure 6b). The temperature is not considered to present a harsh environment and will not result in actuation of SLRDIS nor result in the failure of unqualified electrical equipment. Since the electrical equipment is expected to remain operable, reactor cooldown is accomplished by continued forced circulation core cooling at a reduced helium density.
i 3.2.3 Design Basis Accident No. 2 The Design Basis Accident No. 2, " Rapid Depressurization/ Blowdown," results from a hypothetical sudden '
failure of both closures in the bottom head access penetration. Blowdown of the PCRV to atmospheric pressure is 1 completed in about 2 minutes. A reactor scram would occur on
, low primary coolant pressure with forced circulation cooling ,
being continued by auto-start of the Pelton drives using feedwater. For analysis purposes in FSAR Section 14.11, forced circulation cooling was assumed to be interrupted with auto-start of the helium circulator Pelton wheels occurring 5 minutes into the accident. Building temperatures would quickly peak to greater-than 600 degrees Fahrenheit causing a trip of the SLRDIS. See the enclosed FSAR Figure 1.4-1. This would
, result in isolation of all secondary coolant flow not permitting forced circulation cooling to be quickly re-
, established as assumed in the current FSAR accident analysis.
-The current FSAR analysis indicates a peak fuel temperature of 2600 degrees Fahrenheit which is below the conservative FSAR temperature . limit of- 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur.
Design Basis Accident No. 2 has been reanalyzed using the RECA computer code. A delay time of 30 minutes was considered in
+ the reanalysis to allow for operator action to restart forced circulation cooling. Operator access to the Reactor or Turbine Building is not required. All required operations are performed remotely from the control room. Region peaking factors of up to 1.83, as utilized in the current FSAR analysis and permitted by the Technical Specifications, were retained in the new analysis. A region temperature outlet mismatch of 100 degrees Fahrenheit was used. For the 100 degrees Fahrenheit i region outlet mismatch and a 30 minute delay in restart of forced circulation, the maximum fuel temperature is 2677 degrees Fahrenheit. This maximum fuel temperature satisfies -
the conservative FSAR temperature limit of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur. Maximum fuel temperature versus delay time for the reanalyzed cases are shown in Figure 7. Average 1
l-
-core outlet gas temperatures (Figure 7) are less than 2000 degrees Fahrenheit and therefore are acceptable regarding Class B thermal barrier insulation.
It is concluded that while DBA-2 could result in a interruption
- of forced circulation cooling due to actuation of SLRDIS, l sufficient time exists for the operators to restart forced i
f i
O circulation cooling with no' change in the accident consequences.
3.2.4 Fire The FSAR addresses a fire and the fire protection system in Section 9.12. A fire is a particular concern since it has the potential for activating the SLRDIS due to high temperatures.
Initiating a trip of the SLRDIS results in steam line isolation and interruption of forced circulation cooling.
Under the 10CFR50 Appendix R Fire Protection Review for a fire in the congested cable area, cooldown is accomplished using the PCRV l .' ner cooling system powered by the Alternate Cooling Method (ACM) system. For this postulated event, the fire results in a permanent loss of forced circulation cooling.
Actuation of the SLRDIS would not have an effect on the consequences of this fire as there is no need to operate any of the valves shut by the SLRDIS for liner cooling.
For fires outside the congested cable areas, cooldown is accomplished by forced circulation cooling. Forced circulation must be reestablished within 90 minutes after interruption of forced circulation using either Fire Protection Shutdown Train A or Fire Protection Shutdown Train B. Actuation of the SLRDIS by a fire would automatically interrupt forced circulation by closing numerous valves, some of which are in the Fire Protection Shutdown Trains. These valves must be reopened within 90 minutes to permit forced circulation cooling. Plant and SLRDIS system designs are such that means exist to re-establish forced circulation cocling within 90 minutes.
3.2.5 Inadvertent Trips The design function of the SLRDIS causes a-loss of forced circulation cooling by isolation of high energy steam pipe lines portions of the secondary coolant system in the event of a major secondary coolant leak. Inadvertent tripping of the SLRDIS could occur as a result of hardware failure, accidental trip during surveillance testing, localized steam leaks, fires or primary coolant leaks. Should the SLRDIS trip be inadvertent, the operator has sufficient information to diagnose that a major steam line rupture has not occurred and to re-establish forced circulation within analyzed time limits.
There are a number of things that will aid the operator in the diagnosis of the type of event taking place. Normal PCRV pressure would be an indication it is not a primary coolant
/00 NOTE:
TEMPERATURE Of ATMOSPHERE 600 -
--- SURFACE TEMPERATURE
$00 -
HELIUM LEAK O
400 -
, a m !i SIE AM L[ AK
=
i U
300 -
/
'p"_- 3 N
~ \ $ TEAM LEAK
/
/ %'N s 200 - HElluM LEAK
// /
I00 '
I i i i i 0 0" E o i 4 5 6 2..
2 3
.c M, TIME (MIN.) 0n Figure 1.4-1 Reactor Buildirig Temperatures following a Design Basis Accident or a Cold Reheat Steani l'ipe Rupture inside PCRV Support Ring at 30 ft. From Leak i
E EMo 3;
- g' ~
j a
5 2
'l I i ll l.l
%N' I l ,
3 ' Tc /
1 !
g 3g5 l l ii
[
0 2
5 8
gnc t e ner idu rio ucS Dc A e e l reb eri h us pt s spo ouP mR t m Aeo pr .
giF
)
nP o . i i
i t
N d mR l a
(
I H ie" ut e E
BSc H n l rt a i
t oSt c i s
- a 'a D eR w R f a do r fl oonk o Coa Wc \
h u
o n
A t 5 e i e rdtL uec tt nm aaua rl f e eu pt aS ms eosf t
TPao
.llI 1 I j l l ! g l l l 30: l 4
_ 'A .a 5 ": 2 72 V R
4
- A
'0 s 'o l %
D N
I 1 1 2 2
= - = - U R R R a O B
e r
L ug A I <
i N
o gc F
i t
a i I 0
0 0 0
- o 0
0 6 5 0 4 # *
- 0"
'. : S t";
s g'
EEm m3 uE 0
3 I
5 2
I 0
2 r $5 ll lI i I l' gii l 1 l !ll 8ilg 1[ il. 1
3.
400 -
300 O 4 g 12 16 20 14 l TIME (MIN) i l Figure 14.8-2 Heuen Laak Rate and Primary Coolant Systsui Prumme Fouowing the l Mausium Credible Acadent (Neuen Punfinados System Regeneration Line :
i Multiple Failure) t
[ i l
FSAR UPCAT-I4.3-7
\ %
v 4T e-
$ % .4 s1
.kk'; 3 3 3).
3
~ e
- k.S3 h_ I
- E
- .. O-E I-
- .m -
I- ca 1 'J
- g. -
2 : Ij 25 **
"O
==
I j %g
.3 CE gh Bs -
=5
- $ 5b
- g s 34 15 jy =i 5- -2 -4 23 $2 at z<
l -e t w
3
[ f ' I '
- g,
. . g < a < l 3
3-(J.) Im1Tv34W11 SM1011n# ( > s1w3ms)
I ;
i jusslue smielins ;
1 l l l
1 I
30 -
MCA, TOTAL REACTOR BUILDING WITH LEAKAGE 94 ' '
DISTANCE A : N ro m i93 #
E -
H -
T -
T 92 -
E -
. I M _
w E P
' 7 2 E I
? R gg =
A .
f T -
U ..
p -
E 90 -
~
F 0 5 10 15 20 25 30 TIME - MINUTES ST3't33 II/ebSS I
A HCA, TOTAL REACTOR BUILDING WITH LEAKAGE M 1.5 B -
y E
N -
T .
p 1. 0 - p R -
E _
S
~
n A, .5-E 1 N
N -
C -
H .
H 0.0-2 -
0 _
G A -
y -0.5- ii i ii i i ii iii iiii ii i E O 5 10 15 20 25 30 TIME - NINUTES ST3733 1ie42/85
c -
3000
- Itut MEL 1Eur T nir sit iga n E -
M .. . **... -.....- _._._._.
- "' m amn p -
E gqqq _. - '-
R '
, A -
~-
, , T . -
'. .s' m u -
- ~
r.-
w .
' R -
s,~ .
l E !/ s s s , s .-
y s
D toes i E
G -
t:7)
F l -
8 I I 5 5 I I I I I I I 5 5 5 5 I I I I I I I I 9 1 2 3 4 5 6 TIME AFTER REACTOR TRIP (HR)
Fig. 7. FSV: EQS83 CORE, 100CP, DEPRESSURIZED, 30 MINUTE DELAY IN STARTING CIRCULATORS
leak. Much of the available information would come from the affected building itself. The personnel on shift would be able to inform the control room if a fire, localized steam leak, or surveillance test had tripped the system. The presence of smoke alarms, fire suppression actuation and smoke would be an indication that it was a fire rather than a steam leak. The most important information savailable to the control room operator, in addition to the above, is that for the SLRDIS microprocessor. The microprocessor will show the specific channels and zones which have tripped. Continuous actual temperature readings are provided at the steam line rupture detection rack located in the control room. Since large volumes of either the Turbine or Reactor Buildings would essentially see the same environment for a major steam leak, absence of trips on other SLRDIS channels in the same building would be a sign in itself that this trip is inadvertent. Fires would be local, at least at the start, and thus should not trip the SLRDIS.
The FSAR analyzes an interruption of forced circulation cooling for 30 minutes in Section 14.4.4.2. Forced circulation cooling is resumed at 30 minutes with the consequences of this accident bounded by the consequences of a firewater cooldown following a 1 1/2 '1our delay. The resultant fuel te.1peratures are 1865 degrees Fahrenheit (30 minute delay) versus approximately 2750 degrees Fahrenheit for a 1 1/2 hour delay which are below the conservative FSAR temperature limit of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur.
While inadvertent trips of the SLRDIS cannot be totally precluded, cufficient information is available to the operator to properly diagnose the event in sufficient time to undertake the requireu action to restart forced circulation cooling in 30 minutes to preclude any plant damage.
3.2.6 Water and Steam Hammer Effects A portion of the boiler feedwater system was analyzed to determine the effects of a water hammer (fluid transients) due to the sudden closure of isolation valves (both loops) on the system pipfsg. This portion was selected based on the results of previous analyses performed for a single loop isolation by Sargent and Lurcy.
In the analysis of the fluid transients, the dependent forcing functions were calculated from pressure and velocity data, by applying finite differenca techniques to a thermo-hydraulic
(
O n
model of the system. These forcing functions were then applied along individual segments of a lumped mass, dynamic, stiffness model of the piping system from which the time history response was calculated to predict piping stresses and restraint loading. The output of the programmed model was maximum loads at the restraint nodes (including skewed boundary conditions) and maximum stresses in the piping segments (based on ANSI B31.1-1967 code requirements). The results of the fluid transients were compared to the allowable loads and stresses established in the previous Sargent and Lundy analyses based on combined dead weight, Operating Bases Earthquake (0BE) and sudden valve closure stresses.
Preliminary results show that the maximum loads at the dynamic restraint nodes were nominally below the allowable load of the seismic restraints in all cases but two. One 3540 lb capacity snubber was overstressed by 4 lbs and another 3540 lb capacity snubber was overstressed by 60 lbs. These calculated fluid transient loads exceed the allowable load by less than 2%,
according to the computer model. The maximum stresses calculated on the piping system were also nominally below the allowable stress for combined dead weight, OBE and sudden valve closure stresses. In any event, particularly in the case of the two overloaded snubbers, assurance will be provided either by the final analyses or by design modifications , that the water hammer resulting from SLRDIS actuation will not damage essential piping. The water hammer will not interfere with the decay heat removal function of the secondary coolant system piping following SLRDIS actuation. Should design modifications be required, those modifications will be completed prior to SLRDIS becoming operational to initiate valve closures.
4.0 SIGNIFICANT HAZARDS CONSIDERATION (10CF450.92)
Based upon the analyses, it 'I concluded that the SLRDIS is capable of performing its intended function to detect and isolate major secondary coolant line ruptures of high energy steam pipe lines of the secondary cooling system without operator intervention. The resulting harsh environments from a SLRDIS terminated leak are less severe than the harsh environment previously established on the basis of the operator manually terminating the leak at 4 minutes. These operator 4 minute tenninated leaks previously established the harsh environments used for Fort St. Vrain equipment qualification.
Manual operator intervention for isolating HELBs in the feedwater, condensate extraction steam systems and those line breaks not isolated by SLRDIS is adequate to assure that the r
. l resulting temperature profiles are enveloped by that to which the equipment will be qualified.
Consequences of other accidents analyzed in the FSAR were examined for adverse impact as a result of the installation of the SLRDIS. Design Basis Accident No. 2, " Rapid Depressurization/ Blowdown Accident," was determined to have one assumption invalidated in that the SLRDIS could prevent initiation of forced circulation cooling at 5 minutes into the accident. Reanalysis of the accident determined that forced circulation cooling could be delayed for at least 30 minutes without exceeding the conservative FSAR temperature of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur. This is more than ample time for the operator to restore forced circulation cooling.
The potential fo' the SLRDIS to create new or different types of accidents not pr siously analyzed was examined. The conclusion was that the SLRDIS could result in interruption of forced circulation cooling through inadvertent trips. It was further concluded that sufficient information is currently available in conjunction with new information available from the SLRDIS for the operator to properly diagnose and recover from the event by re-establishing forced circulation cooling within 30 minutes, an accident previously analyzed in the FSAR.
A review was conducted to determine if any margins of safety defined in the basis for a Technical Specification or in the FSAR were significantly decreased. It was concluded that the SLRDIS isolating the secondary coolant system only causes a temporary interruption of forced circulation cooling in both loops.
Recovery means exist to re-establish forced circulation cooling in ample time to mitigate the consequences of a pipe rupture.
Based on the above, the installation of the SLRDIS will not significantly effect the risk to the health and safety of public, nor involve any significant hazards because it is deemed not to:
(1) Involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) Create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) Involve a significant reduction in a margin of safety.