ML20138Q915
| ML20138Q915 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 12/23/1985 |
| From: | PUBLIC SERVICE CO. OF COLORADO |
| To: | |
| Shared Package | |
| ML20138Q913 | List: |
| References | |
| NUDOCS 8512300086 | |
| Download: ML20138Q915 (12) | |
Text
__
Amendment No.
j))[J(j7}
Page 3/4 2-3 DEC 2 3 t985
- [s/
\\
CORE IRRADIATION, TEMPERATURE AND FLOW LIMITS s-3/4.2.2 CORE INLET ORIFICE VALVES / REGION OUTLET TEMPERATURE LIMITS LIMITING CONDITION FOR OPERATION 3.2.2 The INDIVIDUAL REFUELING REGION OUTLET TEMPERATURE shall not exceed:
With the CORE AVERAGE OUTLET TEMPERATURE greater than or a.
equal to 950 degrees F:
1.
The CORE AVERAGE OUTLET TEMPERATURE plus 50 degrees F, for:
a) Any of the nine regions whose inlet orifice valves are most fully closed, and b) Any region with control rods inserted more than 2 feet.
2.
The CORE AVERAGE OUTLET TEMPERATURE plus the
[)
mismatch limit shown in Figure 3.2.2-1 for any
\\- /
remaining region.
b.
With the CORE AVERAGE OUTLET TEMPERATURE less than 950 degrees F:
The CORE AVERAGE OUTLET TEMPERATURE plus 400 degrees F and the conditions of Specification 3.2.4 must be met for all 37 regions.
APPLICABILITY:
POWER, LOW POWER, and STARTUP ACTION:
a.
With an INDIVIDUAL REFUELING REGION OUTLET TEMPERATURE exceeding the above limits by less than 50 degrees F,
restore the out-of-limit condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or be in SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
~
OV t
8512300086 851224
~~
PDR ADOCK 05000267 P
. - ~
v i
)
4 i
ggg ---
i p
Drifice Settings by Position (Adjusting for I
Ngual region outici o 600 -
temperature) j H
j
/
T
\\
n
/
\\
~
P 400 -
/
R e
I f
\\
/
aee D
E i
G l
f l
F a
g e-o s
i i i i i i i.
.,, i e i i.
m o
S I) lj 21) 2b,,,, j o
]
i CALCULATED PERCENT RATED THERflAL Poller (STEADY STATE
- ?RIMARY SIK EAT SALAllCE) m FIGURE 3.2.4-3 MAXIMUM ALLOM48tE EGI0ff TEMPERATURE RISE (F)
Amendment No.
Page 3/4 2-20 DRAFT DEC 2 31985 O
CORE IRRADIATION, TEMPERATURE AND FLOW LIMITS V
3/4.2.5 REGION CONSTRAINT DEVICES LIMITING CONDITION FOR OPERATION 3.2.5 The Region Constraint Devices (RCDs) shall be OPERABLE with:
a.
All RCDs in place on top of the core, b.
All RCD pins engaged in the plenum elements, and c.
RCD structural integrity maintained.
APPLICABILITY:
POWER, LOW POWER, and STARTUP ACTION: With one or more RCDs inoperable, the reactor shall remain in SHUTDOWN or REFUELING until the inoperable RCDs are restored to OPERABLE status.
' [D SURVEILLANCE REQUIREMENTS v/
4.2.5 The Region Constraint Devices (RCDs) shall be demonstrated OPERABLE during each refueling outage by:
a.
Visually inspecting the upper core plenum from those regions being refueled to ensure that the RCDs within visible range are in place on top of the core.
b.
Monitoring the fuel handling machine tertical location coordinates and lifting force as RCDs are oeing removed and installed, to' ensure that the RCD pins engage in the plenum elements and that they disengage as expected.
Upon reinstallation, the vertical location of the fuel handling machine shall be within 3 inches of the expected coordinates to verify proper engagement.
c.
Visually inspecting at least two selected RCDs from the regions being refueled to ensure that there are no abnormal cracks, deformations, loose or missing parts, or other visible defects affecting structural integrity.
A) i,
I DRAFT Amendment No.
Page 3/4.7-59 DEC 2 3 885
{v BASIS FOR SPECIFICATION LCO 3.7.9 / SR 4.7.9 The control room ventilation system is designed to supply filtered, recirculated air at a positive pressure with minimum makeup.
FSAR Table 7.1-1 specifies that a slight positive.
pressure 'is assumed in the analysis of an operating environment.
The recirculation mode with minimum makeup, also known as the hi-radiation mode or the minimum makeup mode, isolates the normal makeup and uses the normal control room supply and return fans to recirculate air through the air handling units. Makeup air is taken from the turbine building and passed.through a prefilter, a High Efficiency Particulate Air (HEPA) filter, and a charcoal adsorber thereby ensuring that control room personnel airborne radiation exposures during and following all credible accident conditions will not exceed 10 CFR 20 limits.
The control room pressure can be maintained at a positive pressure of 0.125 inches water gauge in the recirculation mode with emergency makeup, with both the emergency filter fan and the supply fan operating.
If either of these fans becomes inoperable, control room pressure can still be maintained positive, by shutting off the control room return fan and closing the toilet exhaust damper, in which case a positive pressure of 0.05 inches water gauge is provided.
The channel accuracy for measuring control room pressure is 2% or less of the instrument range which_ia 2 inches.
- Thus, 0.04-inches
\\
water gauge may be assumed for total channel accuracy.
Specifying a control room pressure of 0.05 inches water gauge as the surveillance requirement ensures positive pressure in the control room even in the event of a failure of one of. the two required fans in the emergency ventilation line-up. Thus, the FSAR assumptions are verified through required surveillances.
(FSAR Section 11.2.2 and Appendix C. Criterion 11).
The assumptions relative to control room positive pressure assume.the access door to the control room is closed.
However,.due to plant security reasons, the access door may be opened and personnel access controlled by a full-time guard.
In the event of an emergency, the. door will be closed as required by plant operating procedures to ensure that a positive control room pressure is maintained.
7 i
ATTACHMENT 2 TO F-85481 l
{
1 i
(
f
(
l 1
1 t
t i
l l
f
Justification for Deletion of Specification 3/4.1.9 The purpose of the Reserve Shutdown System is to provide sufficient negative reactivity control to:
1.
Ensure reactor shutdown to refueling temperatures in the absence of all control rod pairs (FSAR Sections 3.5.3 and 3.8.3),and 2.
Provide an absorber material that maintains stability during high core temperatures that may be present during Design Basis Accident #1, Permanent Loss of Forced Circulation described in FSAR Section 14.10.
The current Technical Specifications require the Reserve Shutdown (RSD) System to be operable during reactor operation (POWER, LOW POWER, and STARTUP).
PSC considers that RSD System operability is not required during SHUTDOWN and REFUELING, and Specification 3/4.1.9 can therefore be deleted from the Upgrade Technical Specifications, for the following reasons:
The reserve shutdown material is an effective form of reactivity control when inserted into core regions where the control rod pairs have not been fully inserted.
Because of the proximity to the control rod pairs, it has almost no additional worth when inserted into regions where the control rod pairs are inserted.
Specification 3.1.4.2 insures that either control rod pairs or reserve shutdown material have been inserted into the core following each controlled or automatic reactor shutdown.
It further requires that all control rod pairs will be fully inserted and will be made incapable of being withdrawn except those required for either refueling, repair. or test.
This is accomplished by either placing the reactor mode switch in the "off" position, or disabling the electrical supply to the drive motors.
Per the surveillance requirement of Specification 4.1.4.2 c, prior to the removal of more than one control rod drive assembly from the
- PCRV, the SHUTDOWN MARGIN must be explicitly calculated per the requirements of Specification 3/4.1.3.
It has already been shown by analyses in FSAR Section 3.5.3 that a SHUTDOWN MARGIN of greater than 0.01 delta k is always available with just one control rod pair fully withdrawn.
In addition, all control rod pair withdrawal is accomplished in a controlled manner per System Operating Procedure, S0P 12.01.
All control rod pairs are withdrawn in specified increments while monitoring the core reactivity for count rate changes on two Startup Channels.
Therefore, any inadvertent criticality would require multiple failures-failure to disable the control rod pairs or an error in the explicit SHUTDOWN MARGIN calculation and an error during control rod pair withdrawal either in redundant instrumentation or failure by the operator to respond to indicated count rate changes.
Criticality could not be maintained because of the large negative temperature coefficient of the core, unless the operator continued to withdraw the control rod pair being withdrawn and other withdrawn control rod pairs failed to insert.
This sequence of events is not considered credible. An attached Failure Mode and Effects Analysis (FMEA) for this sequence of events provides clarification.
The. Reserve Shutdown System is not similar to the Baron Injection System for water reactors during the actual fuel loading operation.
At FSV, the fuel for each region is unloaded and loaded through the penetration which normally contains the control rod drive assembly.
The control rod drive assembly containing both the control rod pairs
'and reserve shutdown material will be removed.
Therefore, the reserve shutdown material for that region is not available and does not require surveillance.
With regard to the second purpose for the reserve shutdown system, the Design Basis Accident described in FSAR Section 14.10, is a loss of primary coolant flow at full power. DBA-1 specifically states that if the LOFC occurs while the reactor is shutdown, the time available for any corrective action _ increases significantly with time after shutdown, when the decay heat falls off rapidly.
Refueling operation cannot commence until the conditions of Specification 3/4.9.1 are satisfied which requires the CORE AVERAGE INLET TEMPERATURE to be less than 165 degrees F.
This cannot be accomplished if there is significant decay heat.
Therefore, any requirement for the reserve shutdown material during refueling because of high core temperatures during an LOFC would allow several days for RSD material insertion to be accomplished.
Failure Mode and Effects Analysis An analysis follows to highlight potential failure modes and consequences for a sequence of events leading to an inadvertent criticality while withdrawing control rod pairs during refueling.
This sequence of events is considered incredible.
The analysis
'is described in narrative formal describing the sequence of events in step fashion, identifying the failure mode, design or procedural method to control the failure and the postulated
~
consequence of such a failure. _ Note that the failure consequence is evaluated for each failure in isolation and does not represent the most probable statistical summation of events.
Sequence of Events 1.
Select refueling region sequence.
Considerations include top head interference and maximum SHUT 00WN MARGIN.
Failure Mode: None i
Control Mechanism: None Consequences: None 2.
Perform explicit nuclear analysis to determine control rod worth at refueling conditions to support SHUTDOWN MARGIN for expected control rod pair configurations.
Failure Mode:
Error in calculations.
Perform analysis on
-wrong configuration.
Control Mechanism:
Independent review required for the nuclear analysis.
The analysis uses' confirmed analytical models.
Two key assumptions used in the analysis are: Core Tenparature = 80 degrees F and full Protactinium-233 decay.
That last assumption is conservative by approximately 0.02 delta k.
Consequences: An error in SHUTDOWN MARGIN analysis may result or new fuel installed in refueling region is worth more than control rod pair worth.
SHUTDOWN MARGIN is verified each time a region is refueled so that an error in analysis will be detected before it is compounded by more errors in later calculations.
If new fuel is worth more than the control rod pair, it will be detected when SHUTDOWN MARGIN is verified for that region.
I
_4 3.
Disable all control rod pairs except those to be withdrawn in12 refueling regions and for SHUTDOWN MARGIN verification.
Failure Mode: Disable wrong control rod pairs.
Control Mechanism:
Enabling or disabling control rod pairs is performed at local panels where power to the control rod drive motors is located.
The reactor operator withdraws control rod pairs at the control console on the west side of the control room independent of the activity associated with isolating or providing power to the control rod drive motors. Thus, the Control Room Operator would not be able to withdraw the correct control rod pair if the wrong control rod pair is disabled.
Consequences: None.
No power is available to wrong control rod pair.
4.
Withdraw and remove the control rod drive assembly from the PCRV for the first region to be refueled.
Failure Mode: Withdraw the wrong control rod pair.
Control Mechanism: As stated in FSAR 3.5.3, the reactor is always shutdown by at least 0.01 delta k with one control rod pair withdrawn even if it is the highest worth control rod pair at the most active time in core life. Consequences: None 5.
Withdraw control rod pair from next region to be refueled.
Failure Mode: Withdraw wrong control rod pair resulting in inadvertent criticality.
Control Mechanism:
Standard Operating Procedures are used for all activities affecting core reactivity. A well-tested and used procedure, S0P 12-01, requires that control rod pairs be withdrawn in 20 inch increments.
The procedure requires at least 2 startup channels be OPERABLE, and operating and that the reactor operator monitor both startup channels visually. Operability of 2 startup channels is required by Specification 3.9.1.
The startup channels are also alarmed audibly for high count rate in the control room and refueling floor.
The startup channel plant protective scram must be OPERABLE.
Thus, multiple layers of protection are required for this procedural action.
Consequences: There are several potential consequences due to withdrawing the wrong control rod pair.
These include:
SHUTDOWN MARGIN may be less than 0.01 delta k, or a.
b.
Inadvertent criticality.
Scram would occur at 10E-5% POWER, or c.
There is a core heatup of 60 degrees F.
This would be due to movement of 20 inches on a control rod pair which is equivalent to approximately 0.004 delta k, or d.
Rod withdrawal accident from source range power level occurs. Consequences are described in FSAR 14.2.2.7.
Those consequences have been described as acceptable.
6.
Enable those control rod pairs to be withdrawn for. SHUTDOWN MARGIN verification and withdraw them one at a time.
. Verification may require movement of up to.3 control rod pairs.
The calculated reactivity worth of the withdrawn control rod pair is greater than the calculated reactivity worth of the new fuel being added in the first refueling region by at least 0.01 delta k.
After verification has been confirmed, insert all control rod pairs except the two in the regions to be refueled.
Disable all control rod pairs.
Failure Mode: Same as in Step 5 above.
Control Mechanism: Same as in Step 5 above.
Consequences: Same as in Step 5 above.
7.
Unload the irradiated fuel and replace with new fuel in the first region.
Remove the second control rod drive assembly from the PCRV. Return the first control rod drive assembly and verify operability of the control rod pair.
Failure Mode: New fuel is more reactive (worth more) than calculation assumed.
Control Mechanism: Only one fuel element added at a time.
.By refueling procedure, the count. ate is recorded at appropriate intervals while refueling each region.
If count rate increases by factor of 10, refueling operations are suspended.
-, -.. _ - _, ~
Consequences: SHUTD0'dN MARGIN may be less than 0.01 delta k.
In any event, refueling operations are suspended to determine reasons for significant increase in countrate.
Summary It can be seen that multiple procedu al errors, ignoring visual and audible indications and operator cognitive failures would have to occur within a narrow framewor!. of probabilistic occurrences for an unexpected, unanalyzed accident to occur.
One reliable indicator of proper refueling operations is the startup channel monitoring.
Since the count rate is recorded periodically and an audible high count rate alarm is heard in both the control room and refueling floor, either location may take manual or automatic actions for a high count rate.
PSC considers the deletion of Specification 3.1/9 an acceptable course of action in view of the highly incredible sequence of events. leading to an inadvertent criticality during SHUT 00WN or REFUELING.
1 4
4 j
SPECIFICATION 3/4.2.4 CORE' INLET ORIFICE VALVES / MINIMUM HELIUM FLOW This Specification has been rewritten, consistent with the. submittal of the Draft revision of existing LCO 4.1.9 (P-85442, dated November l
22,1985).
s i
I:
i 1
l l
I L