ML20141G053

Forwards WCAP-10529, Coms,Cold Overpressure Mitigating Sys, Per Request for Addl Info

ML20141G053
Person / Time
Site:	Vogtle
Issue date:	02/19/1986
From:	Bailey J GEORGIA POWER CO., SOUTHERN COMPANY SERVICES, INC.
To:	Youngblood B Office of Nuclear Reactor Regulation
References
0373V, 373V, 373V3, GN-813, NUDOCS 8602260149
Download: ML20141G053 (1)

Text

.' Georgia Power Company -

- Project Management Route 2. Box 299A -

Waynesboro. Georgia 30830 Telephone 404 724 8114 404 554-9961 Southern Company Services. Inc.

Post Office Box 2625 Birmingham, Alabama 35202 lg P ggg Telephone 205 870-6011 February 19, 1986 Director of Nuclear Reactor Regulation File: X7BC35 Attention: Mr. B. J. Youngblood Log:

GN-813 PWR Project Directorate #4 Division'of PWR Licensing A U. S. Nuclear Regulatory Commission Washington, D.C.

.20555 NRC DOCKET NUMBERS 50-424 AND 50-425 CONSTRUCTION PERMIT NUMBERS CPPR-108 AND CPPR-109 V0GTLE ELECTRIC GENERATING PIANT - UNITS 1 AND 2 REQUEST FOR ADDITIONAL INFORMATION - WCAP-10529

Dear Mr. Denton:

Enclosed please find 6 copies of WCAP-10529, COMS Cold Overpressure Mitigating System. Your staff has requested copies of this report for use in their review for the VEGP.

If your staff requires any additional information, please do not hesitate to contact me.

S cerely,

. g.

J. A. Bailey Project Licensing Manager JAB /sm Enclosure xc:

R. E. Conway G. Bockhold, Jr.

R. A. Thomas T. Johnson J. E. Joiner, Esquire D. C. Teper (w/o enclosure)

B. W. Churchill, Esquire L. Fowler (w/o enclosure)

M. A. Miller. (2)

W. C. Ramsey B. Jones (w/o enclosure)

L. T. Gucwa Vogtle Project File 0373V 8602260149 860219 7

]

PDR ADOCK 05000424-t A

PDR I

o

WCAP 10529 5

lh M

COLO OVERPRESSURE 4

M11IGATING SYSTEM 1

15

^

l 4

I l

Compiled by Approved 9

R. W. Fleming E. C. Arnold, Manager February, 1984 Safeguards Systems j

Systems Engineering i

NTU i

.i j+

Work Performed Under S.O. YHTP-35010 WESIINGHOUSE ELECTRIC CORPORATION NUCLEAR ENERGY SYSTEMS P.O. Box 355 Pittsburgh, Pennsylvania 15230

,_,_m i ',, y, o,Lu y 6,0 /

ABSTRACT 1

The COMS (Cold Overpressure Mitigating System) is provided in the Westinghouse NSSS as a supplement to the administrative controls intended to prevent overpressure transients and the water relief valves in the Residual Heat Removal System which mitigate inadvertent overpressure transients to the Reactor Coolant System. This report provides the

(

background information which led to the decision to provide the COMS.

This report also includes a description of the system and a discussion of g

the method used to establish the setpoints for the relief valves (PORV's) utilized in the COMS.

P

=

g-

.I i

L i

I e

,-w----

i FOREWORD E

An internal Westinghouse technical review of the Cold Overpressure Mitigating System, conducted during the last quarter of 1983, led to a conclusion that a record of the CONS modification was needed. This report is to satisfy that conclusion.

t The Westinghouse personnel that participated in the review, under the

..a chairmanship of W. G. Poulson, Manager of Safeguards Systems, and who 9

contributed to the preparation of this report wer'.

4 f

E. C. Arnold W. S. Brown E. M. Burns T

R. Calvo M. L. Drury D. F. Dudek R. G. Edinger 4

R. W. Fleming G. G. Harkness W. T. Kaiser N. P. Mueller J. A. Schwab H. A. Sepp A. N. Sklencar r

C. A. Vitalbo I(

+

i I

- -.. _ -. ~, _,,,. -,

1 CONTENTS Secti;n Page 1.

Introduction 1

r

===2.

Background===

2

~ Q s

2.1 General 2

2.2 Reported Events Up to June 1976 2

g

}

2.3 Administrative Controls 2

2.4 Introduction of CONS 2

1t 3.

Description of System 5

t 1 -

3.1 Function 5

3.2 General Description 5

T

,4 3.3 Design Bases and Description of Equipment 8

i 3.4 Electrical Power 8

i i -

3.5 Instrumentation and Control 8

3.6 Operation

-9 I) 4.

Potential Overpressure Transients 12 4.1 General 12 4.2 Mass Input Transients 12 4.3 Heat Input Transients 14 4.4 Summary of Transient Evaluation 19

[

A 1

1 4

v,-----,

-,c-

--m....-.y..-

. - - ---.,,,,.- -,,-----~,---

,,,-..--.,wym.. _,, - -.,

Page 5.

Technical Specifications and Administrative Controls 5.1 General 22 5.2 Deactivation of Safety Injection System 22 i

5.3 Limitations Regarding When Plant Will Be Taken Water 23 Solid 7

u' 5.4 Precautions When Operating in Water Solid Mode 24 5.5 Residual Heat Removal System Isolation Valves Lockout 26 k.

- 5.

f 6.

Setpoint Determination 27

I 6.1 General 27 6.2 Pressure Limits Selection 27 6.3 Mass Input Consideration 30 6.4 Heat Input Consideration 30 6.5 Final Setpoint Selection 33 7.

Instrument & Control Characteristics 34 7.1 Pressure Channels 34 7.2 Temperature Channels 34 7.3 Overall Trip Uncertainty 35 8.

Relief Valve Characteristics 36 8.1 General Description 36 8.2 Stroke Time 36 I

8.3 Flow Capacity of PORY 39 11

._,.r,..

_ _,.. ~,

_,-m_._.._,__,

~. _ _ _. _ _, _,,.. _

__-,--,_7....,,,,__,.

Bibliography Appendix A)

NRC General Design Criteria 34; Residual Heat Removal 4

8)

NRC Branch Technical Position ICS8-3; Isolation of Low Pressure j

Systems from the High Pressure Reactor Coolant System C)

NRC Branch Technical Position RS8 5-2; Overpressurization Protection of Pressurized Water Reactor While Operating at Low Temperature 4 -3 0)

Westinghouse Standard Technical Specifications; Sections:

i -

d 3.1.2.1 Boration Systems

,b

{^

3.1.2.2 Boration Systems 3.1.2.3 8 oration Systems f

3.1.2.4 Boration Systems

!\\

,j{

3.4.1.3 RCS: Hot Shutdown

~~

3.4.1.4.1 RCS: Cold Shutdown - Loop Filled 3.4.1.4.2 RCS: Cold Shutdown - Loops Not Filled 3.4.3 RCS Pressurizer

^

3.4.9.3 RCS: Overpressure Protection Systems 1

3.,5.1 ECCS: Accumulators l5 3.5.2 ECCS: Tavg >350*F 3.5.3 ECCS: Tavg 1350'F l

s E.

W Technical Bulletin; NSD-TB-77-7, Residual Heat Removal Pump.

I ii i

-.,,-,-,-,.-,-,,,-na-

,,--------enem--

a--,--

---

,--n.-----

-...w,-,

-,wn--,--

,-,----n---.,-

w,

4 1.0 INTR 000CTION Overpressure protection for the Reactor Coolant System (RCS) is achieved by means of self-actuated, steam safety valves located i

high in the system on the steam space of the pressurizer. These safety valves have a set presssure based on the RCS design pressure of 2485 psig and are intended to protect the system against transients initiated in the plant when the RCS is operating near its normal temperature. To avoid brittle fractures at reactor vessel metal temperatures below about 350*F, the allowable system pressure is substantially less than the nonnal system design pressure of 2485 psig. Therefore, supplemental overpressure i ;

mitigation provisions for the reactor vessel must be available when g

the RCS and hence the reactor vessel, is at temperatures below about 350*F. One part of this supplemental protection is knUwn as the Cold Overpressure Mitigating System (COMS).

)d 4

8 Normally when the RCS is at a temperature below 350*F, the RCS is j

open to the Residual Heat Removal System (RHRS) for the purposes of removing residual heat f rom the core, providing a path for letdown a

I to the purification subsystem and to control the RCS pressure when the plant is operating in a water solid mode. The RHRS is provided with self-actuated water relief valves to prevent overpressure in this relatively low design pressure system (600 psig) caused either within the system itself or from transients transmitted from the i

j RCS. The RHRS relief' valves will mitigate pressure transients j

originated in the RCS to maximum pressure values determined by the relief valves set pressure of 450 psig plus a pressure accumulation above the set pressure dependent on the liquid volume magnitude of the transient.

The low design pressure RHRS is nonnally isolated from the high

j) design pressure RCS, during reactor power operation at temperatures above 350*F, by tuo isolation valves in series. Therefore the RHRS can be inadvertently isolated from the RCS by these same isolation valves. The CONS is intended to provide overpressure mitigation for the RCS addressing those transients which might occur when the i

RHRS isolation valves are inadvertently closed thus isolating the j

RHRS Water relief valves from the RCS.

4 s,

I u

2.0 BACKGROUND

2.1 General Onring the early years of operation of Westinghouse pressurized water reactors (1970-1976) a number of events were reported in which the RCS pressure exceeded the allowable limit for a particular low system temperature as prescribed by the ASME code Section III and 10CFR50 Appendix G.

The events were caused by equipment malfunction, incorrect operator action or a combination O

of the two.

In the vast majority of the events, the unintended pressure transient was recognized and terminated by the operator.

2.2 Reported Events Up to June.1976 i

Before the introduction of the 10CFR50 Appendix G requirements and I

before the COMS design was introduced in 1976, the prevention of l

overpressure transients while the plant was operating in the water solid mode was the responsibility of the operators of the plant.

No specific equipment was provided to automatically mitigate pressure transients because the operator was expected to observe the instructions and precautions provided to avoid causing unacceptable pressure transients.

r Using the published Abnormal Occurrence Reports and information provided to the industry by the NRC in June 1976, an evaluation was o

made of the type of overpressure events which had occurred, their causative factors and the plant conditions at the time of the event. This review led to the general conclusion that 24 of the 29 reported events could be divided into two major categories 1) mass

'~

input (18 events) or 2) heat input (6 events) to an isolated constant volume of reactor coolant. The other 5 events were either

.,y of unknown origin (3) or were caused by operators following inadequate procedures while attempting to control the reactor i

coolant pressure.

The review demonstrated that of the 18 events caused by mass input to the RCS, by far the greatest number (14) involved a mismatch between the charging and letdown flows.

In all but one of these events, the mismatch was caused by a loss of letdown flow while the charging system remained in operation with a relatively low rate of j,

mass input.

e l

3

~

m

The remaining 4 mass input events were the result of an abnormal, or inadvertent actuation of some portion of the safety injection system.

In the only event involving the actuation of safety injection pumps, a single safety injection pump was deliberately started by an operator and flow inadvertently entered the RCS.

In the other 3 events, the accumulator isolation valves were deliberately opened by the operator or inadvertently opened by a i

ipurious signal from the engineered safety features actuation 4

circuits.

For the majority of the mass input caused pressure transients, the abnormal condition was recognized and terminated by the opera, tor.

The magnitude of the pressure transient was limited as a direct result of the speed of the operator in recognizing the situation and taking remedial action.

Among the few (6) reported events attributed to the heat input case, five were those in which a temperature asymmetry was allowed to develop in the RCS generally due to insufficient mixing.

Then, l'}

when a reactor coolant pump was started, the cooler volumes of reactor coolant circulated around the system and were heated by warmer sections of the system, particularly the steam generators.

l These heat input events were self limiting in that the temperatures

}

eventually equalized and the magnitude of the pressure transient was not great. One of the events was the result of removing heat 3

from the coolant such that the temperature was caused to decrease to a temperature below the allowable for the constant coolant pressure being maintained at the time.

2.3 Administrative Controls i:.:

l1 Until the mid 1970's, the strict administrative controls in effect jk during plant heatup and cooldown operations, when most systems are i

under manual control, were considered sufficient to avoid overpressure transients.

In fact, the vast majority of the transients reported prior to 1976 did not occur during normal plant operation but were caused during pre-operational testing, periodic

.3 surveillance testing or specially improvised tests.

i As a result of several meetings with the NRC during 1975 and 1976, N

regarding the apparent growing number of overpressure events, 5

renewed emphasis was placed on highlighting the normal operating guidelines and precautions to be observed during those operating modes which could lead to an overpressure event. This renewed a

6 emphasis by the designers and opetrators of the plants however, could not completely address the overpressure concern since changes to the pre-operational and surveillance testing programs were increasingly being implemented.

1 l

l

_. _ _ _ _ _ _ ~. -.. _ _

2.4 Introduction of CONS Ouring the early months of 1976, increased NRC attention was i

focused on the reported overpressure events which had occurred primarily during testing. As a result, all PWR vendors were called to appear before the NRC on June 21, 1976, and told of the seriousness of the issue and the need to prevent future events by some additional system / equipment means. Therefore, to address the 5r

, gt NEC concerns, the design of the COMS was completed and made available to Westinghouse plants in November,1977. The purpose of the COMS was to supplement the normal plant operational administrative controls and the water relief valves in the RHPS which had not prevented nor sufficiently mitigated past f

overpressure events.

s I

9 k

j

-J E

i s

s

~

J.

l-

3.0 DESCRIPTION

OF SYSTEM 3.1 Function

~

The Cold Overpressure Mitigating System (CONS) is designed to provide the capability, during relatively low temperature Reactor Coolant System operation, to prevent the RCS pressure from exceeding allowable limits. The CONS is provided in addition to the administrative controls, to prevent overpressure transients and as a supplement to the RCS overt.ressure mitigating function of the Residual Heat Removal System (RHRS) water relief valves.

,f

!l The system is designed with redundant components to assure it will

I perform its function assuming any single active component failure, r

,y

- 3.2 General Description The COMS shown schematically by Figure 3.1 and described in the following paragraphs applies to the. Westinghouse reference Model j

212, 312, and 412 plants.

I The power operated relief valves (PORV) located near the top of the j\\j pressurizer, together with additional actuation logic from the wide-range pressure channels, are utilized to mitigate potential i

RCS overpressure transients which might occur if the RNRS water relief valves are inadve'rtently isolated from the RCS. The CONS ll provides the additional relief capacity for the specific transients l

(See Section 4.0) which would not be mitigated by the RHRS relief valves and thereby maintain the system pressure below the limits

+

l z.

determined by use of the 10CFR50 Appendix G. requirements.

Each pressurizer relief valve (PORV) is signaled to open should the RCS pressure approach an unacceptable pressure for the particular l{

temperature of the reactor coolant. The relief valves are simple open-close valves with no throttling action except that which occurs during the stroke period.

l*

The function of the instrument system actuation logic, shown by Figure 3.2, is to monitor both the RCS temperature and pressure, a

whenever the temperature is below about 350'F, to ascertain when an

!4 unacceptable condition regarding the Appendix G requirements is

~

l1 being approached. The wide-range RC5 temperature indications are auctioneered to select the lowest temperature and this low signal IN' is processed through a function generator to calculate the maximum l /.,.

acceptable pressure for the prevailing temperature. The calculated l

pressure is then compared with the indicated RCS pressure from a wide-range pressure channel and if the indicated pressure exceeds the calculated value, a PORV will be signaled to open. The determination of the pressuae setpoint program for the PORV's is described in Section'6.0.

I i

S-i S

____.___.--__.-..-_.m,,...-.,e,r-

_mm.,..

c

_,-.w._.,%.,ce,m

-m.mm

,w#m-,,_

y,-

I A4 l

11,I A

uoa ~...w.

c FIGURE 3.1 c --- -- -

TRAIN B

~

A POWER,pP, P

1 9

=

l f

h (r

T)

'-J J '

PRESSURIZER RELIEF TAMK LT SPRAY s

PRESSURIZER e

e i

i S

RCS HOT LEG FUNCTION

- - - - +

GENERATOR /

(SEE FIGURE 3.2)

COMPARATOR T -------+

TRAIN A 4

FIGURE 3.2

]

CONTROL LOGIC FOR EACH PORV RCS TEMPERATURE CHANNELS 4

T l

l T

j l

T I

T l

s g

6_______________J I

i

'd v

4+

AUCTIONEER n

- - - - + T j

!~

RCS PRESSURE

/

w CHANNEL Q

j APPENDIX f(T) p G LIMITS i

+

l 1

4 l

=

8

{

g _ _ _ _ _ _j MAINTAINED POSITION

+

E 2 '['

l ARM BLOCK I

P P

j Q

}

e OPEN VALVE 7

l e

n e

,e--e n,,

,---g

-,-e

4 3.3 Desian Bases and Description of Eauipment i

l The PORV's are designed to limit the RCS pressure during normal i

operational transients when the reactor is at power, by discharging steam to the pressurizer relief tank (PRT) thus avoiding the need i

for the code safety valves to function. The flow capacity and stroke time of the PORV'S are selected to avoid a reactor trip -

,3 during a large step load decrease.

i

/

In addition, the valves are utilized for pressure relief (water, gas or a mixture) as a part of the CONS and when performing this function they also discharge to the PRT. Two valves are provided ib for the CONS function so that if one valve fails to actuate when

y required, the second valve will be available to mitigate the j'

transient.

4

j 3.4 Electrical Power The electrical power to the instrumentation and the actuating i

system is provided by two separate independent sources so that a l

single failure in the electrical equipment will not prevent the operation of at least one PORV.

l 3.5 Instrumentation and control 4

i" Figure 3.2 describes the control for one train (i.e. one of the two

{~

PORV's).

The RCS pressure is monitored by several independent wide-range pressure channels which typically measure hot ' leg pressure. These channels are capable of measuring and indicating the RCS pressure over the range of 0 to 3000 psig. The COMS signals derived f rom

]

two of these channels are typically in the range of 400 to 2335 l <

psig. Each PORY is associated with one of the wide-range pressure i

channels so that a failure of one channel will affect only one PORV.

I The RCS temperature is monitored by.several independent wide-range

{

temperature channels in both the hot and the cold legs. A group of

{

the temperature signals are auctioneered for the lowest indicated temperature and this lowest temperature is processed in a function jw generator to calculate an acceptable PORY pressure setpoint for

j the particular temperature based on the Appendix G requirements.

j Two separate independent auctioneering circuits and function.

j generators are provided so that a single failure will adversely ji affect the actuation of only one PORV.

j..

(

1 f

I 1

8

The setpoint calculated by the function generator is compared with the indicated wide range pressure signal and if the indicated pressure approaches the setpoint an alarm will be sounded in the control room to warn the operator of a potential actuation of the relief valve.

If the indicated pressure continues to increase to the calculated setpoint pressure, the relief valve will be signaled to open to mitigate the transient.

m G

3.6 Operation 1*

Ouring a normal plant heatup, the RCS is open to the RHRS and is operated in a water solid mode until the steam bubble is formed in the pressurizer. During these low-temperature, low-pressure I

operating conditions the COMS is armed and in a ready status to mitigate pressure transients which might occur if the RHRS is inadvertently isolated. After the steam bubble is formed and the pressurizer water level is at the nornel value for no-load operation, the RHRS is manually isolated from the RCS and the plant continues to be heated while the system pressure is controlled by the steam bubble. When the reactor coolant temperature has increased above about 350*F the COMS is manually disarmed, h

While the plant is in normal operation, that is, in Operating Modes 4

1,2 or 3, (defined by the Technical Specifications) the COMS is not armed and is maintained in a passive mode.

C During a normal plant cooldown, the COMS is manually armed as the reactor coolant temperature is decreased below 350*F. Note that at this time there is a steam bubble in the pressurizer and the water r

level is at the normal level for no-load operation.

The RHRS is T

then placed in service by opening the suction isolation valves thus making the RHRS water relief valves available to mitigate pressure

./

transients. When the coolant temperature has been decreased to L

160*F by the operation of the RHRS, the steam bubble may be quenched and the reactor coolant pumps stopped. From this point on in the cooldown, the plant is water solid and if the RHRS becomes inadvertently isolated, the COMS will be in an active status ready to mitigate pressure transients which might occur.

After the plant reaches the cold shutdown condition (Modes 4 and 5) and is being maintained cold by the RHRS, the COMS remains in an active status to backup the water relief valves in the RHRS should the RHRS become inadvertently isolated.

2 l _ _ _ _ _

_._ n

= -

i t

When the RCS is operated in the water solid mode, the pressure is automatically controlled by the low-pressure letdown valve in the Chemical and Volume Control System (CVCS). This valve senses the pressure in the letdown line (P) on Figure 3.3) and maintains the pressure at the selected control value by throttling the letdown flow from the RCS. At this time, the charging flow into the RCS is set at a constant value and is controlled by the charging flow control valve.

It should be noted that the pressure being a

conteo11ed is that in the letdown line which then indirectly controls the RCS pressure. However, if the pressure drop through the RHRS and the bypass line into the CVCS is changed by throttling of valves or changing the flow rate through the RHRS, the RCS pressure will also change since the location of the controlled d

q pressure is in the letdown line.

4

a d

i i

4 b "*

-a j-l e

9.

A t

di l*

tl

, i i

no i

t e

ea nrl rc wuo ui osr sf dst si t en wer ero w

oru LPC 8

o LPP l

Fl o

D gr nt

=

/

i n go

.w h/

w-U rC V

a C

{

H C

^

VC V

H CH S

b',

t i

,i i

V X

X H

H

. L

• d

~

. a

. L

{'

3 3

p E

m i

R G

u U

S f

P 24 G

ee V

RRV iv R

I Rll H

F Hea g R

/

s r

._h o

tca e

R W

_I 6

ll i'

)

4 1

l r

i 4.0 POTENTIAL OVERPRESSURE TRANSIENTS 4.1 Gen _eral Potential overpressurization transients to the reactor coolant i

system (RCS), while at relatively low temperatures (less than about 350'F), can be caused by either of two types of events to the RCS:

that is, mass input or heat input. Both types result in more rapid

!I pressure changes when the RCS is water solid. Therefore, the descriptions of the following two type's of transients imply that the RCS is water solid, at a relatively low temperature and is f

j open to the residual heat removal system (RNRS).

Mass Input Type Transients:

i4 M1.

Inadvertent safety injection i]4 3

jq M2. Charging / letdown flow mismatch Heat Input Type Transients:

Is Hl. Actuation of pressurizer heaters or H2. Loss of residual heat removal cooling or 1

l, H3. RCP startup with temperature asymmetry within the RCS or between the RCS and 56 1,,

j 4.2 Mass Incut Transients

~

l 4 -

51 Inadvertent actuation of safety injection considerations

{!

include full system (both trains), single train or single component j*"

within a train events.

Each of the three types of events are i

j discussed separately.

1 l'

Full system actuation would include the opening of the isolation valves on all SI accumulators, startup of all low-head and I

high-head safety injection pumps and isolation of the normal letdown path to the Chemical and Volume control System. Such an j ;

event would result in unacceptable, large volumes of coolant being forced into the RCS. Therefore, such events must be prevented by 4 >

!d strict administrative controls which require the blocking of the I

]

automatic SI actuation circuits, immobilizing the SI accumulator i

motor operated isolation valves (by locking out their power j

supplies) and locking out power to the high-head safety injection pumps. (See Section 5.2).

In a typical Westinghouse design, the i

low-head safety injection (RNR) pumps are normally in operation.

l*

taking their suction from the RCS, during low-pressure,

)

(-

}

4 j

i 4

i Iow-temperature plant operations. Therefore, even if a spurious i

start signal were received, the low-head safety injection (RNR) i pumps would not function in their safety injection mode.

l The probability of a single train actuation is not much different j

than a full system actuation since the signals which call for i

safety injection, both manual and automatic, are normally processed i (i through the engineered safety features logic circuits such that a signal whether spurious or not, will impact both trains.

i Therefore, since the safety injection system is essentially immobilized at low temperature, single-train, inadvertent actuation

,g is considered no more likely than full system actuation.

4 Inadvertent actuation of a single component would require that a human operator selectively unlock the electrical power to the i

i4 component and then cause the component to be energized. The most

!)

probable way for this event to occur would be during periodic surveillance testing required by the Technical specifications or l

during post maintenance check-out of the component. Deliberate ie opening of an SI accumulator isolation valve while the accumulator l7 is pressurized with gas is not considered probable because there is

)

no Technical Specification to test the isolation valves at shutdown jm and prudent maintenance procedures for the valves would likely j

require that the compressed gas in the accumulator be removed.

Post maintenance check-out or periodic surveillance tests however.

4 might be attempted on a high-head safety injection pump providing an opportunity for operator error to cause an inadvertent single i

pump injection event.

Therefore, a single pump startup event

' ~

during surveillance testing or following maintenance is considered a potential mass input transient but, since the RHR$ would be open j,,

to the RCS at this time, an RHR5 relief valve would mitigate the ii resulting RCS pressure transient.

Bl. Charging / letdown flow mismatch events can be postulated to l

occur in a number of ways. One way would involve the complete j

termination of letdown, such as by closure of the letdown control i'

valve, isolation of the RHRS/CVCS crossover path or closure of the RHRS inlet isolation valves caused by malfunctions of the control systems. A second way would involve an increase in the charging jf flow by either operator or instrument error such that the charging 1-flow exceeds the prevailing letdown flow, i

bk j

The most severe mass input transient would occur if the letdown

\\

flow controls failed to the zero flow condition while the charging i

flow controls failed to the full flow condition.

This failure mode would result in the maximum charging / letdown flow mismatch event 1

but does not result in the isolation of the RHR$ relief valves from I'

the RCS. Therefore, an RHR5 relief valve would mitigate this transient and prevent an overpressure condition in either the RNRS l

or the RCS.

i

)

i l

~ _ -

t 1

i The mest likely way that a charging / letdown flow mismatch would occur is for the RNRS (and relief valves) to be inadvertently isolated from the RCS by spurious closure of the RNRS inlet isolation valves. Such a spurious closure is credible due to the presence of the automatic closing signal required by the NRC (see Section g.0).

Since this spurious valve closure event causes an ECS pressure transient by stopping the letdown flow and negating j

the pressure control and concurrently isolating the RHRS relief

I valves from the RCS, it is considered a " design bases" transient j

for the CONS.

The maximum mismatch in flow rates for this case i

will be on the order of 100 to 150 gpe, the maximum normal charging flow rate into the RCS.

I 1

j 4.3 Heat Innut Transients l

!!1 The inadvertent actuation of the pressurizer heaters when the i

pressurizer is filled solid will cause a slow rise in the water temperature (-50'F/hr) with a consequent increase in pressure of 1

the constant volume RCS (See Figure 4.1) Since the i

temperature / pressure transient is very slow, the operator should l

recognize and terminate the transient before an unacceptable g

pressure is reached. The RNRS is open to the RCS whenever the i

pressurizer is filled solid, in accordance with administrative 1

controls (see Section 5.3).

Therefore, the RNRS relief valves will

!a be actuated, negating the need for COMS, if the operator does not i

j-first intervene and stop the transient.

This case is not j

considered significant to the design of either the RHRS relief

~

valves or the COMS.

~

!!1 A loss of residual heat removal cooling while the pressurizer L

is filled solid could be caused by a loss of flow malfunction in the service water or component cooling water systems or the closure 1

of the RHRS inlet isolation valves. The continual release of core I,

residual heat into the reactor coolant, with no heat rejection to the environs, would cause a slow rise in the coolant temperature i

and pressure (See Figure 4.1).

Since the transient is slow, the j*

operator should respond and either restore the RNRS valves to their open position, restore cooling or limit the RCS pressure by venting the pressurizer. This transient is not considered significant to lg the design of the CONS since it is a relatively slow transient i i compared to the heat input transient ig. i l I l -,n- -.y--n ,, m m e mmy.-,m--.-,ve-mn-.,- m - w m n e, m .e--n,-n-,-ww eg -, -nwm,-,,w . ve-

1 1600 9 RCS/SG AT = 50'F 1400. f

j 1200.

h FIGURE 4.1 TYPICAL HEAT INPUT TRANSIENTS 1000, NO RELIEF VALVE ACTUATION E E 800, 5o m E 600 < - 0 E 400, [ LOOP SEAL AT = 120'F (. 200,, DECAY HEAT ADDIT 10N SSURIZER HEATERS t t 20 40 60 80 100 TIME,SEC. e

i !Q. During plant heatup and cooldown operations, administrative i controls (see Section 5.4) require at least one reactor coolant i r, ump be maintained in operation whenever the reactor coolant I temperature is greater than 160*F. Therefore, the large volumetric flow throughout the RCS will maintain an isothermal condition in j the RCS. The steam generator secondary side water immediately surrounding the tubes will also remain at a temperature near that i i* of the circulating reactor coolant on the primary side. During normal cooldown operations, when the reactor coolant I temperature has been decreased below 160*F the reactor coolant ig pumps may be stopped. Subsequently, isothenmal conditions in the RCS may no longer exist. The reactor coolant temperature will be l l decreased below 160*F by heat rejection through the Residual Heat j Removal System. The steam generator contained water (both primary and secondary) may remain at a relatively constant temperature j greater than the RCS temperature since there may be little i circulation through the tubes. Therefore, a significant t i ;3 temperature asymmetry between the SG water and the reactor coolant may develop. If a reactor coolant pump were to be started, the j sudden heat input into the reactor coolant from the steam generators would cause a rapid increase in reactor coolant i temperature. If the event should occur while the pressurizer is i' filled solid, a rapidly increasing pres,ure transient would occur. Normally, the RNRS is open to the RCS when the pressurizer is filled solid, so that the relief valves in the RNRS would be available to mitigate the pressure transient if the event should j oC C'J r. 4-In accordance with typical administrative controls, the plant will i' be under water solid conditions only while the RHRS is in service, i~~ and at least one reactor coolant pump will be in operation at reactor coolant temperatures above 160*F. Therefore, this type of heat input transient will be limited to initial coolant ie temperatures below 160*F. Since it is not practical to determine a i representative temperature for the large stagnant volume of { secondary water in the steam generator, the operator will not be aware that the temperature may be substantially different from the primary side reactor coolant. From the initial isothermal temperature of 160*F when the RCP is stopped, the bulk reactor l' coolant temperature is unlikely to decrease below 110'F without some extraordinary cooling means while the steam generator water !8 may remain near 160'F. Therefore, the differential temperature is I i not expected to be greater than 50*F for this type of heat input transient. i!* 1 e

t l If the pump start event should occur with a steam bubble of the i normal no-load volume present in the pressurizer, the resultant expansion of.the reactor coolant due to the sudden heating would be accormodated by an insurge into the pressurizer with only a small . reactor coolant pressure change. Therefore, administration controls require that a RCP not be restarted during a plant cooldown unless a steam bubble exists in the pressurizer. (See -l i l-Section 5.4) ! i During norinal plant heatup operations, the reactor coolant pumps remain in operation throughout the water solid condition and the 1 steam generator secondary water temperature will remain equal to or j slightly less than the primary side. Therefore there is no 1 opportunity for the heat input case to occur due to a temperature j asylunetry between the RCS and 56. However, if the reactor coolant Jumps are stcpped and the cold charging and seal injection water i are continued in service, a relatively cold volume of water could j be developed in the vertical pipe loop below the reactor coolant i 1 pumps (See Figure 4.2). A restart of a RCP in a water solid system would cause a sudden heating and mixing of the coolant and result q in an increasing pressure transient. Therefore, administrative i controls (see Section 5.3) require that the RHRS remain open to the i4 RCS until the steam bubble is formed in the pressurizer so the RNRS j relief valves are available to mitigate the transient. 4 lf Under most plant operating conditions during heatup, cocidown or at l* cold shutdown conditions, the RHR$ loop is open to the RCS and heat I input transients will be mitigated by the RHRS relief valves. Only i when the normal volume steam bubble exists in the pressurizer is )~ the RHRS deliberately isolated from the RCS thus making the RHRS l relief valves not available to mitigate RCS transients. l% If the RHRS is inadvertently isolated from the RCS by closure of 3 the isolation valves, (as by a spurious operation of the auto-close

• l interlock required by the NRC) while the plant is water solid and i

in Mode 4, the Technical Specifications require that a reactor 4 coolant pump be restarted within one hour if an RHR loop is not }7 returned to service. During the potential one hour delay period, a l 1, temperature asysumetry in the reactor coolant loops, due to the 1-continued input of cold seal Injection water, could develop and not be apparent to the operator. Then when the reactor coolant pump is restarted, an increasing pressure transient will occur. This 3 particular heat input transient is therefore considered a " design l bases' transient for the CONS because the RHR$ relief valves would !7 not be available to mitigate the transient since the RHRS isolation ] 7, valves are closed. ) i i l,

4 FIGURE 4.2 e t 'j. t V i STEAM M GENERATOR ~ s 1 I s i E PUMP } -.f \\_ < J)=) Cold Pump Seal T-= Injection Water ' Q_.__ =.- H, + t

• k

+

4.4 . Summary of Transient Evaluation Based on the above discussion, most of the identified mass input and heat input transients, which might occur while the plant is water solid, will be mitigated by a relief valve in the RHRS. However, for those remote cases which occur when the RHRS has i 1 become isolated from the RCS, (most likely caused by the spurious closure of the RHRS inlet valves by the auto-close interlock), the COMS may be called upon to mitigate certain increasing pressure transients. Specifically, the COMS design bases transients are I defined as:

1) the mass input transient caused by a charging / letdown flow mismatch after the termination of letdown flow and 2) the heat input transient caused by the restart of a RCP pump when the RHRS is not open to the RCS, i.e., the isolation i

valves are closed and a temperature asymmetry exists within the RCS due to the continued injection of cold seal injection water. e a 'l e 9 !i

Table 4.1 RCS Overoressure Mitiaation While Operatino at Low Temperature Part I Plant Conditions The following Plant Conditions (primarily RCS and RHRS) are those which g are relevant to the overpressure concern at low system temperatures (i.e. below 350*F). The reference to Operational Modes is consistent with the g definitions in the NRC's Standard Technical Specifications but the definition of Plant Conditions is unique to this report. ) ,} Plant Condition 1. During Mode 5. Cold Shutdown operations: RCS loops and pressurizer filled or not filled i RCP', ng1 in operation RCS temperature: 70< T < 160*F RCS pressure: 0 < P < 450 psig RHRS pumps in operation to remove residual heat and.RHRS open for RCS letdown ~ Plant Condition 2. During plant heatup (Modes 4 & 5): RCS loops and pressurizer filled (water solid) One or more RCP's in operation RCS temperature: 70 < T < 350'F RCS pressure: 325 < P < 450 psig RHRS pumps not in operation but RHRS open for RCS letdown and pressure control Plant Condition 3. During plant cooldown (Mode 5): I ? j RCS loops and pressurizer filled (water solid) At least one RCP in operation RCS temperature: 160 < T < 200*F RCS pressure: 325 < P < 450 psig RHRS in operation for cooldown, letdown and pressure control 4 D -..., _ -.. _. -. -. ~. - - -. _. - -. -.. - - - . -. I

4 i i Plant Condition 4. During plant cooldown (Mode 5): RCS loops and pressurizer filled (Water solid) RCS's pgt,in operation RCS temperature: 70 < T < 160*F 4 4 RCS pressure: 0 < P < 450 psig RHRS in operation for cooldown and letdown Part II Desian Transients 1. RHRS water relief valves (one or two depending on the particular' plant design) are provided to mitigate the following pressure transients (due to mass or heat input) initiated in the RCS while operating in water solid mode: a) Mass input during plant heatup, cooldown or at cold shutdown

k conditions (Modes 4 and 5); Plant Conditions 1, 2, 3, or 4

1. Inadvertent start and injection into RCS by one safety injection pump. y =s 2. Simultaneous loss of letdown and failure of charging flow control to maximum flow conditions (one charging pump). b) Heat input during plant cooldown (Mode 5); Plant Condition 4:

2 1.

Cooldown of RCS by RHRS to 110*F (RCS to S6 temperature asymmetry of 50*F) and subsequent restart of RCP. 2. Cold Overpressure Mitigating System (two PORV's) is provided to mitigate the following pressure transients initiated in the RCS if RHRS becomes inadvertently isolated due to spurious closure of isolation valves or operator error while plant is operating in water solid mode: i a) Mass input during plant heatup (Modes 4 and 5); Plant Conditions 1, 2, 3, or 4: Loss of letdown caused mass input transient (up to about 150 gpm) and loss of RCS pressure control, b) Heat input during plant cooldown (Mode 5); Plant Condition 4: ~ Isolation and consequent loss of function of the RHRS requires restart of RCP with possible cold loop seal (minimum 40*F) and warm RCS components (maximum 160*F).

5.0 TECHNICAL SPECIFICATIONS AND ADMINISTRATIVE CONTROLS 5.1 Seatrg1 All reactor plant operations are guided by administrative controls which specify the availability of equipment, systems alignments and ranges of process parameters. The administrative controls are intended to prevent deliberate plant operations which would result in potentially unsafe or unacceptable plant conditions. These administrative controls are identified in either 1) The Technical Specifications issued by the NRC or 2) The Precautions, Limitations and Setpoints document, special notes and limits in operating instruction guidelines and technical bulletins issued by Westinghouse. 5.2 Reactivation of Safety Injection System

• ~

The Standard Technical Specifications (STS) describe the ECCS requirement to have a minimum number of components available during Operational Modes 1, 2 and 3 (STS Sections 3.5.1 and 3.5.2) and also for Mode.4 (STS Section 3.5.3) to assure that sufficient emergency core cooling capability will be available. However, the footnote to STS Section 3.5.3 also specifies that a maximum of one '? centrifugal charging pump and one safety injection pump shall be operable, when the RCS temperature is below 275*F,* thereby attempting to limit the magnitude of potential mass input [ transients. The Technical Specifications permit the blocking of the actuation Lircuits from the pressurizer and steam lines instruments to prevent SI actuation at low system pressure and temperature. This 1 administrative control to manually block the circuits when the system parameters are below the instrumentation permissive setpoints is susceptible to spurious actuation, i.e., unblocking, and is not considered a positive protection against inadvertent safety injection. In addition to the administrative permission to limit the flow capacity or block the safety injection actuation circuits, provided by the Technical Specifications, Westinghouse has provided operating instruction (0.I.) guidelines and the Precautions, Limitations and Setpoints (PLS) document which specify the ,f following additional requirements to avoid or limit potential RCS overpressure transients which might originate from spurious actuation of the Safety Injection System: .J

• Although the STS shows a temperature of 275'F, the appropriate value varies from plant-to-plant and is likely to be as high as 350*F. Note also that the mass inp::t transient resulting f rom the actuation of one train of ECCS may be greater than the relief capacity of the RHRS relief valves at the low RCS pressures of concern.

-??-

During Plant Cooldown and DeDressurization: o " Block the automatic safety injection circuit when the reactor coolant pressure is reduced below the automatic unblocking setpoint. The operator must be prepared to manually actuate the system if required." (consistent with STS Section 3.3.2 permission) b o "Close the accumulator isolation valves and lock out the valve i controllers when the reactor coolant pressure is less than 1000 f psig and the temperature is less than 425'F." (see STS Section 3.5.1) y o "When the reactor coolant pressure is less than 1000 psig, lock out the safety injection pumps and non-op< rating charging pumps." (see STS Sections 3.5.2 and 3.5.3 for oDerability requirement) i Durina Plant HeatuD and Pressurization o " Unlock all safety injection and charging pumps after the pressurizer steam bubble is formed and the residual heat removal loop is isolated." o " Unlock and open the accumulator isolation valves when the reactor. coolant pressure approaches 1000 psig." (STS Section 3.5.1) ~ " Verify that the safety injection actuation block is automatically o removed at the pressure setpoint." (STS Section 3.3.2) 5.3 Limitations Regarding When Plant Will Be Taken Water Solid The Standard Technical Specifications do not completely address the ) issue of when or under what conditions the RCS may be water solid except that in Modes 1, 2 and 3 the pressurizer must not be water solid (STS Section 3.4.3). By implication the pressurizer may be water solid for Modes 4, 5 and 6 (i.e., RCS temperatures below 350*F). 5 However, the Westinghouse 0.I. guidelines and PLS document specifically p state that the RHRS must be open to the RCS whenever the plant is d taken to the water solid mode. The statement is as follows: "Do not isolate the RHR inlet line from the reactor coolant loop o unless there is a steam bubble in the pressurizer. This precaution is to assure there is a relief valve (i.e., RHR water relief) protecting the reactor coolant system when it is at low t + pressure and solid water." 3i ~.

5.4 Precautions When Doeratina in Water Solid Mode The Standard Technical Specifications do.njt1 provide operational guidance when operating in the water solid mode under Operational Modes 4, 5 and 6 except to require that when the RCS temperature is below 275'E in Mode 4 and when in Modes 5 and 6 with the reactor vessel head in place, that there be overpressure protection systems operable (STS Section 3.4.9.3). = 3 To assure that the capability to borate is available in Modes 4, 5 and 6 STS Sections 3.1.2.1, 3,1.2.2 and 3.1.2.3 require that one charging pump be operable. Also, the Westinghouse 0.I. guidelines specify that .f. seal injection flow be provided when the system is full which requires l that one charging pump be in operation. Therefore, there will be y charging and letdown flows when the plant is water solid. STS Section 3.1.2.4 also specifies, by means of a footnote, that a maximum of one l centrifugal charging pump be operable when the plant is in Mode 4 and relatively cold. This footnote is an attempt to limit the magnitude of potential mass input transients. Section 3.4.1.3 of the STS, which is applicable to Mode 4, does ( recognize, in a footnote, that restart of a reactor coolant pump in a water solid system can cause heat input type pressure transients. However, in a second footnote, the STS gives permission to have no RCS flow for up to one hour which will result in temperature conditions in a the RCS conducive to a pressure transient when a reactor coolant pump is restarted. Similarly, Section 3.4.1.4.1 of the STS, which is applicable to Mode 5, again permits RCS temperature conditions to be developed which are i conducive to pressure transients although it is less likely that a reactor coolant pump will be restarted while in Mode 5. However, the Westinghouse 0.I. guidelines and PLS document provide many 1 caution statements which are intended to prevent overpressure transients in the RCS and thus the need to challenge the water relief valves in the RHRS, or if the RHRS valves are not available, the CONS. f To avoid mass input transients resulting from a charging / letdown flow p mismatch caused by operator action, the following caution statement is .U provided in the 0.I.'s and PLS: >b o "Whenever the plant is solid water and the reactor coolant pressure is being maintained by the low pressure letdown control ,J. valve, letdown flow must bypass the normal letdown orifices via s the residual heat removal system with the isolation valve in the bypass line in the full open position. During this mode of 7 operation, all three letdown orifices must also remain open." i 24-e ~ +- ,n

---

,---------.--+----.,,._,------<----.-,,-----e.

A special type of charging / letdown flow mismatch transient which can be initiated by the operator, when under water solid pressure control, involves changes in the flow rate through the RHRS (see Section 3.6 and Figure 3.3). Therefore the following precaution is provided to the operators in the 0.I. guidelines and PLS document: o "When the reactor coolant pressure is being maintained by the low pressure letdown control valve, changes to the flow rate through the residual heat removal loop by throttling of valves or starting and stopping the residual heat removal pumps will result in changes to the reactor coolant pressure. For example, stopping of the residual heat removal pumps may cause an increase in the reactor coolant pressure of between 100-150 psig." To avoid developing those conditions which might lead to a heat input type transient to the RCS or to _ transients caused by operator action, the following caution statements have been provided to the operators: o "During coolown, all steam generators should be connected to the steam header to assure uniform cooldown of the reactor coolant loops." o "Whenever the reactor coolant temperature is above 160"F, at least one reactor coolant pump should be in operation to maintain uniform temperature conditions in the system." o "If all reactor coolant pumps have been stopped for more than five minutes and the reactor coolant temperature is greater than the charging and seal injection water temperature, do not l! restart the first pump until a steam bubble has been formed in the pressurizer. This precaution will minimize the pressure transient when the first pump is started and the cold water previously injected by the charging pump is circulated through the warmer reactor coolant components. The steam bubble will accommodate the resultant expansion as the cold water is rapidly warmed." o "If all reactor coolant pumps are stopped and the reactor coolant is being cooled down by the residual heat exchangers, a non-uniform temperature distribution may occur in the reactor coolant system. Do not attempt.to restart a reactor coolant pump unless a steam bubble exists in the pressurizer." r t l ~25- \\

a s -+ u a a 5.5 Residual Heat Removal System Isolation Valves lockout The water relief' valves in the RHRS are provided to prevent pressure transients initiated in the RCS from exceeding the design pressure of the RHRS. At the same time these RHRS relief valves will mitigate the effect of the initiating transient on the RCS.. An administrative control (Section 5.3) specifies that the RHRS isolation valves not be closed deliberately unless there is a steam bubble in the pressurizer so 4-that the RHRS relief valves are available when the plant is at relatively low temperature and pressure conditions. I As an additional precaution, Westinghouse Technical Bulletin NSO-T8-77-7 recommends that, when the RCS is at zero pressure, the power supplies to the suction isolation valves be locked out in such a way that the RHRS would not be isolated by a single pressure instrument malfunction. This additional precaution is intended to prevent both a loss of RHRS cooling and potential damage to the residual heat removal pumps caused by the i auto-close interlock. Since this precaution involves valve power -lockout only when the RCS is at zero pressure, that is, when open to the atmosphere, it does not directly impact reactor pressure transients but is identified here for completeness. r

• P

- l I

4

- 9 ._L r. c,-

6.0 SETPOINT DETERMINATION i 6.1 General The selection of proper COMS setpoints for tripping the PORV's requires the consideration of several system parameters including: i i

a. Volume of reactor coolant involved in transient j

b. RCS pressure signal transmission delay j

c. Volumetric capacity of the relief valves versus opening position

d. Stroke time of the relief valves (open f,close)

e. Initial temperature and pressure of the RCS

f. Mass input rate into RCS

g. Temperature of injected fluid

h. Heat transfer characteristics of the steam generators

1. Initial temperature asymmetry between RCS and SG secondary water

j. Initial temperature asymetry between RCS and loop seal water

k. Volume of cold loop seal

1. Mass of steam generator secondary water

m. RCP startup dynamics

n. RCP #1 seal AP requirements i

o. Appendix G pressure / temperature characteristics of the reactor vessel il[

6.2 Pressure Limits Selection The function of the COMS is to prevent the RCS pressure from increasing above limits prescribed by the allowable pressure / temperature characteristic for the specific reactor vessel material in accordance with rules given in Appendix G to 10CFR50. A typical characteristic is shown by Figure 6.1 where the allowable system pressure increases with increasing temperature. This type of curve sets the nominal upper limit i on the pressure which should not be exceeded during RCS increasing

3 pressure transients.

When a relief valve is actuated to mitigate an increasing pressure transient, the release of a volume of coolant through the valve will cause the pressure increase to be slowed and reversed as described by Figure 6.2. The system pressure then decreases, as the relief valve releases coolant, until a reset pressure is reached where the valve is signalled to close. Note that the pressure continues to decrease below the reset pressure as the valve recloses. The nominal lower limit on the pressure during the transient is selected based on a requirement of the ,f reactor coolant pump #1 seal to maintain a nominal 200 psig differential lE pressure across the seal faces. The nominal Appendix G upper limit and nominal RCP #1 seal lower limit pressure values create an acceptable RCS pressure range into which the setpoints for both PORV's must be fit as shown on Figures 6.3 and'6.4.. b ...m

FIGURE 6.1 TYPICAL APPENDIX G P/T CHARACTERISTICS 2500 2000 S w 2 1. Ea s t] 1500 E ~ i s E a 8

• F/HR i

u g 1000,, U5 ce S e 0 y 500 " 100 ) d a 1 a a e i 100 200 300 4b0 Sd0 INDICATED COOLANT TEMPERATURE, 'F

FIGURE 6.2 TYPICAL PRESSURE TRANSIENT j (1RELIEFVALVECYCLE) h w Pg-------_--, p d i, e 3 SETPOINT - - - - - ___f E ~ u3 - - RESET

r E

.y pg.- _ _ _ _ V. 4 F APUnder .+e TIME

Where the setpoint pressure range is insufficient to accommodate both the pressure overshoot and undershoot, produced by the PORY operation, compliance with the Appendix G upper pressure limit will take precedence over the RCP #1 seal lower pressure limit. 6.3 Mass Input Consideration i For a particular design basis mass input transient to the RCS, the j

elief valve will be signalled to open at a specific pressure j

setpoint. However, as shown on Figure 6.2, there will be a pressure overshoot during the delay time before the valve starts to move and during 9e time the valve is moving to the full open position. This overshoot is dependent on the dynamics of the system and input parameters and results in a maximum system pressure somewhat higher than the set pressure. Similarly there will be a pressure 3 undershoot while the valve is relieving both due to the reset { pressure being below the setpoint and to the delay in stroking the g valve closed. The maximum and minimum pressures reached in the i - transient are a function of the selected setpoint and must fall within the acceptable pressure range shown on Figure 6.3. A locus of the maximum and minimum pressure values calculated for several i selected setpoints are plotted on Figure 6.3. The shaded area ?. represents the acceptable range from which to select the setpoint based on the design bases mass input case. c. 6.4 !! eat Input Consideration The design basis heat input case is done similarly to the mass input case except that the locus of transient pressure values versus selected setpoints may be determined for several values of the-i[.. initial RCS temperature. This heat input evaluation provides a range of acceptable setpoints dependent on the reactor coolant temperature whereas the mass input case is limited to the most restrictive low temperature condition only. The shaded area on i Figure 6.4 describes the acceptable band for a heat input transient from which to select the setpoint for a particular initial reactor coolant temperature. ! I es .m i ! I

SETPOINT DETERMINATION (MASSINPUT) i Z FIGURE 6.3 r" ir P MX APPENDIX G MAXIMUM LIMIT 7 P p gy,<,_ ss ~ p - - - - - - MIN - 8 ) RCP #1 SEAL MINIMUM LIMIT g L 8 4 j SETPOINT RANGE r 9 P3 PORY SETPOINT, PSIG 6 .---...,-a,-- -,,n.-

SETPOINT DETERMINATION (HEATINPUT) FIGURE 6.4 ? O L i i Pgy P N P MX - - - - K g ? /OU a P N\\ w ---MIN---- t ~ E NN I y !N f g SETPOINT RANGE iy r 4 l l 8 ) ,.a I p S PORV SETPOINT, PSIG l

• 1

4 6.5 Einal Setooint Selection By superimposing the results of the mass input and heat input cases, from a series of figures such as 6.3 and 6.4, the range of allowable setpoints to satisfy both conditions can be selected subject to the statement qualification of Section 6.2. The setpoints will typically be listed in the Precautions, Limitations and Setpoints document, as system pressure setpoints versus temperature for use in i scaling the function generators. Each of the two valves may have a different pressure setpoint versus temperature list calculated such that only one valve will open and mitigate the transient (the second l valve operates only if the first fails to open on command). However, the staggered setpoints must result in the system pressure staying within the nominal pressure band shown by Figures 6.3 and 6.4 when either valve is utilized to mitigate the transient. 9 s The selection of the pressure setpoints for the PORV's is based on { the use of nominal upper and lower pressure limits specified by Appendix G to 10CFR50 and the reactor coolant pump shaft seals respectively. Since both pressure limits are considerd to have been conservatively determined, the uncertainties in the CONS ss . instrumentation are not explicitly utilized in the selection of the pressure setpoints. Therefore, if the instrumentation develops a calibration error or drif ts out of alignment in the most unfavorable direction, one or the other nominal pressure limits might be y, exceeded during a transient. However, the deviation from the nominal limits will be limited to a value less than the instrument uncertainty. See Section 7.0 for a discussion of the instrument and control uncertainties. 4.- 4 ) J h l ag tK- .I y _.._.y

7.0 INSTRUMENT & CONTROL CHARACTERISTICS 7.1 Pressdre Channels The monitoring of the reactor coolant pressure for use in CONS is by means of two wide-range pressure channels having a range of 0-3000 psig. Each of these pressure instrument channels consists of a j completely separate set of devices powered from independent power 3 sources. Each channel typically includes a transmitter, power supply and MCB indicator. The pressure signal is also sent to a I ? comparator which compares the indicated pressure with a calculated ~ PORY setpoint pressure value for the prevailing temperature. In accordance with the Westinghouse accepted method of determining the uncertainty in the pressure signal to the comparator, the sensor and process rack uncertainties are combined to obtain the overall channel uncertainty. The value of the pressure uncertainty is typically about 60 psig for the wide-range pressure ~ channels using Barton transmitters and 53 psig using other vendor's transmitters 7 >Y 7.2 lemoerature Channels a The monitoring of the reactor coolant temperature for use in COMS is .-c by means of multiple, wide-range temperature channels, in both the hot and cold legs, having a range of 50-700*F. Each temperature 4 chanr.el consists of a resistance temperature detector and associated R/E converter and power supply. Several of the temperature signals associated with a particular power source are auctioneered to select the lowest indicated temperature of the group. This selected low ~~ temperature is then processed in a function generator where a relief valve pressure setpoint is calculated. . g-The uncertainty in the temperature signal being sent to the function li' generator is evaluated by combining the sensor and process rack 1 I uncertainties. The result of the combination of these effects is an uncertainty in the temperature measurement of about 14.4*F, exclusive of any temperature stratification or streaming in the loop piping.

sb R

3 ' I a _-_. _ _ _, o

7.3 Overall Trio Uncertainty The function generator takes the autioneered low indicated temperature for the particular channel and converts the temperature signal into a relief valve setpoint pressure signal based on + specific Appendix 6 curves for the particular reactor vessel. A typical Appendix 6 curve (Figure 6.1) indicates the calculated ~ + pressure value will be relatively insensitive to the temperature i sigr.a1 uncertainty at low system temperatures (typically below 100*F) so that the overall uncertainty in the pressure trip setpoint will be on the order of 100 psig. However, as seen from Figure 6.1, the calculated pressure value for i system temperatures above 200*F becomes more sensitive to the T uncertainty in the indicated temperature. Fortuitously the design overpressure transients utilized for the determination of the CONS setpoints occur at temperatures below 200*F where the instrument l uncertainty is not as sensitive to the indicated temperature. 1 3 mm i /E 'd . d I

~ 1 0 RELIEF VALVE CHARACTERISTICS 8.1 General Description The COMS utilizes one of the two power operated relief valves (PORV) located on the pressurizer as the active component to mitigate certain overpressure transients to the RCS. There are two types of PORV's currently used in Westinghouse designs; an air-operated, e spring-to-close globe valve and a solenoid-pilot-operated, process pressure actuated valve. 1 The air-operated type valve, shown by Figure 8.1, requires a reliable source of compressed gas to actuate the valve to the open y position. To assure at least one of the two valves will respond on I demand, the single failure criterion requires a separate, l independent source of compressed gas and controls for each valve. j Also, since the valve will cycle open-and-closed repeatedly during some transients, an adequate volume of gas must be available to sustain the cycling action until the operator intervenes to gain control of the RCS pressure. l The second type of valve which may be used as a PORV is the pilot-operated valve shown by Figure 8.2. This type of valve is 4

}

caused to stroke open or closed by a differential pressure across <j the plug in the valve body. This diffarential pressure is supplied by the process fluid and is controlled by the pilot valve and orifices between the pilot and main valve. For these valves the electrical power supplies to the pilot valves must be separate ar.d independent to provide the single failure protection for the CONS. !u 8.2 Stroke Time The stroke time for the air-operated type valve has been specified as 52 seconds to open and 15 seconds to close to meet the normal l operating pressure relief function at high pressurizer pressures. Note that to support these stroke times, the air supplies to the valve and the venting path must be made compatible with the l requirements of the air operator on the valve. 1 For the COMS function, with pressurizer pressures about one-fourth j the norinal relieving pressures, the stroke times may be longer than ip at the normal relieving pressure. However, if the stroke times for ~ the COMS function are made shorter, the performance of the COMS is 3 improved. That is, the overshoot and undershoot pressure are 'N decreased, but the valve will cycle at a higher frequency and a ? larger stored volume of gas would then be required to sustain the cycling for a given operator action time period. Therefore, it is not desirable to cause the air-operated type of valve to stroke more rapidly than necessary to meet the minimum COMS requirements. -,.,...1 ..,. ~. _. _..,..,.

g DIAPHRAGM F-p DtAPHRAGM CASES L y iy s_ - s y f M ,a i I e SEES : OtAPHRAGM PLATE / ACTUATOR SFRtNG g 1 / SPRING ADJUSTOR g y /

• --~~ d ACTUATOR STEM

~ / l / / / ' . j -YOKE / / LEAK OFF f j w <id l c f% p CAGE g, l ,5 -socy - f f/ >,, 1 -4 o m ET iNtET c j ,S ( // / /) 4 FIGURE 8-1 AIR-0PERATED PORY - -,.n. . -..,,.,, -,-..~... -,- ..,w-

\\ I Il 11 Solenoid Operated Pilot Valve -W% -4 n Position T T Indication = [ cI p[ 9

t gg B-7bf' f'

~ ~ I x s x s i s gf b d Inlet ( 42,v \\ f' y" ' y / ll - R 'Fq {~ / Control \\ Orifice t I Control Orifice Plug FIGURE 8-2 PILOT OPERATED PORV.

The stroke times for a particular design air-operated PORV were determined in experimental tests sponsored by EPRI*. From several of the tests the opening stroke time was found to average about 2.4 seconds for various pressure / temperature conditions. The pilot-operated type valve opening and closing stroke times can be varied by changing the control orifices. Since this type of valve does not require a stored energy source (such as a supply of I gas) the increased cycles of valve operation due to a shorter stroke j time is not a concern. Therefore, the stroke time can be shortened to improve the CONS performance if the increase in the hydraulic loads imposed on the piping can be tolerated. The final selection of the stroke time of the Garrett pilot-operated valve is to be determined af ter an evaluation of acceptable piping loads has been 3 completed. For one particular configuration of a Garrett pilot-operated PORV, the EPRI sponsored tests demonstrated the valve stroked open in about 3.2 second average for various pressure / temperature conditions. t 8.3 Flow Capacity of PORV ,f i The design flow capacity of the PORV's was specified to provide the required steam relief for normal reactor operational transients. This requirement led to vendors supplying air-operated valves with maximum Cy's between 45 to 57. From one of the flow tests 4 sponsored by EPRI the apparent Cy for an air-operated type valve was calculated to be 60.4 which demonstrates that the typical vendor's design sizing is conservative. Similarly, the experimental capacity from the EPRI tests of the Garrett pilot-operated valve indicated the apparent Cy to be 90 .c c where the design Cy was originally estimated by the vendor to be about 60. ~ 5 P

• EPRI/WYLE Power-Operated Relief Valve Phase III Test Report, EPRI NP-2670-LD, Octaber,1982 Volumes 1, 8,11.

$1 T <og l~ l 1 I. P J- ...,m_. ._,_.-_,,,,,,_..,_.-___m-.--. .,,,. _,, -,, -. -. ~ ~,,...,,, - - -,

4 Bibliocrachv A. " Pressure Mitigating Systems Transient Analysis Results," Westinghouse Owners Group On Reactor Coolant System Overpressurization, July 1977. 8. " Supplement to the July 1977 Report," Ibid, September 1977. C. " Reference Safety Analysis Report; RESAR 414" Westinghouse Nuclear 1 Energy Systems, October 1976. 'RCS Pressure Control During Low Temperature Operation." Ammendment 15, June 1978. D. "NUREG 0941, Safety Evaluation Report, Westinghouse Electric Corporation, Reference Safety Analysis Report, RESAR 414 " Docket NO. STN 50-572 NRC Of fice of Nuclear Reactor Operation, November 1978. e i

m E

1 L. I .. - ~ -

M 1* 'y e APPENDIX = e 4 i .Y e

t 10CFR50 Appendix A. " GENERAL DESIGN CRITERIA IN NUCLEAR POWER PLANTS" ( Criterion 34--Residual heat removal. A sys-tem to remove residual heat shall be pro-vided. The system safety function shall be to transfer Assion product decay heat and other residual heat from the reactor core at a rate such that specined acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. Sultable redundancy in components and features, and suitable interconnections, leak

• detection, and Isolation capabilities shall be it Provided to assure that for onsite electrict power sy, stem operation (assuming offatte e

power is not available) and for ossite elec-tric: power system operation (assuming on= i-site power is hot available) the system safety function can be accomplished, assuming a single failure. ll ,g l s ,-,,,-m,--,-n,-,--r,,r, ee-y,,, -.... - -.,.,, - - - - - - - - ,m---- .,n. m--,-,m -o-ow-,--s,. __--,~-- w-- - - -- - - - -

---

n---

-,r,--

~ 5 ~.. F SRANCH TECHNICAL p0$!T!0N IC$8 3 l kSOLATION OF LOW p4ES$URE SYSTENS FRON THE NIGN pAES$URE REACTOR C00! ANT SYSTDI A. SACEGROUNO Suring normal and emergency condittens, it is necessary to keep low pressure systems that are connected to the high pressure reactor coolant systes properly isolated in order la avoid damage by overpressucitation er the potential for less of fategrity of the law pressure system and possible redfesetive releases. There have been a number of receamendetiens for accomptfshing thfs ais. Unt11 a, sere deffnitive gutde ia pub 11shed, I the criteria in part 8, belew, provide ao adequate and acceptable desip solutten for this concern.. 3. ORANCH TEDef! CAL 90$! TION ~' lj The following esasures should be incorporated fa designs of the faterfaces between low pressure systems and the high pressure reacter coolant systas: i I, 1. At least two valves in series should be provided to feetate any sesystas whenever I' the primary systas pressure fs above the pressure reting of the sesystas. I f l 2. For system interfaces where both valves are motor-operated, the valves should have fndependent and diverse interlocks to prevent both from apening unless the primary l systas pressure fs below the subsystem desip pressure. Also, the valve operators should receive a' signal to close automatically whenever the primary systas pressure i. exceeds the sesystas desip pressure. ~ i 3. For these system faterfaces where one check valve and one ester-sperated valve are provided, the ester-sperated valve should be interlocked to prevent the valve fres spening whenever the primary pressure is above the sesystas desip pressure, and l to close autasetically whenever the primary systes pressure exceses the sesystes design pressure. l-4. Sof table valve positten indicatten should be provided in the control rose for the }? faterface valves. iI !J 5. For these interfaces where the sesystem is required for ECCS operetten, the above recensendetiens need not be toplamented. System interfaces of this type should be l evaluated en an ineividual case hasis. 1-C. REFERENCES l l = l Sev. 1 7A-+ I l

SRANCH TECHNICAL POSITION R58 5-2 -'0VNPRE!5URIZATION PROTECTION OF PRESSURIZED WATER R umu ort.w uni n ww awt.uiuRu l A. Backoround General Design Critacion 15 of Appendix A of 10 CR Part 50 reoufres that "the 4 actor Coolant Systas and associated ausfifary, control, and protection systems shall be designed with sufficient sargin to assure that the design a conettions of the reactor coolant pressure boundary are not esceeeed during any conoitton of normal operation, including anticipatas operational occurrences." Anticipated operational oceanrences, as defined in Appendix A of 10 CFR Part 50, ' % "those conettions of normal operation which are expected to occur one or afore times during the life of the nuclear power unit and include but are not limitaa to loss of power to all recirculation pisos, tripping of the termine generator set, isolation af the main condenser, and losa of all effsite power." Appendix G of 10 CFR Part 50 provides the fracture toughness requirements for reactor pressure vessels under certain conditions. Ts assure that the Appeneix G Ifsits of the reactor coolant pressure bouncary are not excessed during any 'i anticipates operational occurrences, tecnnical specification pressure-tamperature 4 f ifsits are provided for operatiiig the plant. The s,risary concern of this position is that during startup and shutsown 4 sanoitions at low tamerature, esoecially in a water-solid condition, the . actor coolant systas pressure algnt excess the reactar vessel pressure = i tamerature Ifsitations in the tecnnical soecifications estaalishes for protec-tion against brittle fracture. This inadvertent overpressurization could be generataa by any one of a variety of salfunctions or operator errors. Many incidents have occurred in operating plants as describes in Reference 1. I Additional discussion on the background of this position is contained in

f Reference L

) 8. Branch Position 1. A systes should be designed and installed which will prevent exceeding the appifcable technical specifications and Appendix G Ifsits for the reactor coolant systse wnile operating at low tamperatures.* The j syntas should be capatie of relieving pressure during all anticipated everpressurization events at a reta sufficient to satisfy the-tecnnical specification Ifsits, particularly while the rest, tor coolant systas l 1s in a water selfd conettian. 2. The systas should be able to perform ita function assuming any single active casoonent failure. Analyses using appreeriate calculational 'e tecnniques must be provided which demonstrate that the systas will

2 provide the required pressure relief capacity assiming the most

) Ifsiting single active failure. The cause for initiation of the event, e.g., operstar errer, component asifunction snould not be considerne as the single active failure. The analyses thould assume the most limiting alismaele operating conditions and systans configura-l tion at the time of the postulatae cause of the overpressure _ event. f 5.2.2-7 Rev. 0 - July 1981 i t .-.-.-,....-.--,--.--__-,--,-..._,,,-,.n.~n a.n.-.- --e...,-

All potential overgressurization events should be considered wnen i estanlishing the worst case event. Some events any be prevented by protective interlocks or by locking out power. These events snoula be identified on an inoividual basis. If the events are excluoed from the analyses, the controls to i the plant tecnnical specifications. prevent these events should be in 3. The system shihld"be designed using IEEE 5td.-279 as guidancai (see isolamentatfori). The systas may be manually enabled, however, an alarm to alert the operator to enaale the system at the correct plant condition during cooldown, should be provided. Positive inoication should be provided to indicate when the system is enabled. j An alarm ~should2e provided when the protective action is initiated. ti l 4 To assure operational readiness,-the overpressure protection systas should be testable. Technical specification sutveillance requirements i should include: 3 a. A test performed to assure operability of the system (exclusive j of relief valves) prior to each shutdown. b. A test for valve operability, as a minimum, be conducted as specified in the ASME Code Section XI. ~ n t 5. The system sust meet the reovirements of Regulatory Guide 1.25, ~ "Cuaif ty Groun Classifications ano Standards for Water, Steasr, and Radioactive-Weste-Containing Coanonents of Nuclear Power Plants,"- j-ana Section III of the ASME Cooe. 6. The overpressure protection systas should be designed to function during an Operating Basis Earthquake. It should not compromise the design critaria of any other' safety grade systas with which it would lj interface, such that the requirements of Regulatory Guide 1.29 " Seismic Design Classification," are met. - 7. The overpressure protection systas should not depend on the avail-ability of offsita power to perform its function. The system should be operaole from battery-backed power sources, not necessarily Class i IE buses. 8. Overpressure protection systans which take credit for an active comoonent(s) to sitigate the consecuences of an overpressurization l event should include additional analyses considering inadvertent systas initiation / actuation or provide justification to show that esisting analyses bound such an event. is ii 9. If pressure relief is from a low pressure system, not normally j connected to the primary system, the overpressure protection function saould not be defeated by interlocks whica would isolate the low pressure systas from the primary coolant systas. (See BTP IC583) Reforences. 1. NUREG-0138, Staff Ofscussion of Fifteen Technical Issues 1.istec in Attact: ment to Novemoer 3,1976 Memorancus from Jfrector, NRR, to NRR Staff. 5.2.2-8 Rev. 0. July 1981

3 ) \\. ) k REACTIVITY CONTROL SYSTEMS 3/4.1.2 BORATION SYSTEMS L FLOW PATH - SHUTDOWN LIMITING CONDITION FOR OPERATION t ,4 3.1.2.1 As a minimum, one of the following boron injection flow paths shall be~ OPERABLE and capable of being powered from an OPERABLE emergency power j source. N a. A flow path from the boric acid tanks via either a boric acid transfer pump or a gravity feed connection and a charging pump to [ the Reactor Coolant System if the boric acid storage tank _in Specification (3.L2.5a) is OPERABLE, or b. The flow path' from the refueling water storage tank via a charging pump to the Reactor Coolant System if the refueling water storage tank in Specification (3.1.2.5b) is OPERABLE. t APPLICABILITY: MODES 5 and 6. ACTION: With none of the above flow paths OPERABLE or capable of being powered from an OPERABLE emergency power source, suspend all operations involving CORE ALTERATIONS or positive reactivity changes. SURVEILLANCE REQUIREMENTS 4.1.2.1 At least one of the above required flow paths shall be demonstrated OPERABLE: a. At least once per 7 dys by verifying that the temperature of the heat traced portion of the flow path is greater than or equal to !} (65)*F when a flow path from the boric acid tanks is used. b. At least once per 31 days by verifying that each valve (manual, v power operated, or automatic) in the flow path that is not locked, T sealed, or othenvise secured in position, is in its correct position. 4 i pSTS 3/4 1-7 JUL 2 71981 ~~--.,.--,n

\\ REACTIVITY CONTROL SYSTEMS FLOW PATHS - OPERATING LIMITING CONDITION FOR OPERATION 3.1.2.2 At least two of the following three baron injection flow paths shall be OPERABLE: a. The flow path from the boric acid tanks via a boric acid transfer pump and a charging pump to the Reactor Coolant System. b. Two flow paths from the refueling water storage tank via charging pumps to the Reactor Coolant System. ~ j APPLICABILITY: MODES 1, 2, 3, and 4. ACTION: I With only one of the above required boron injection flow paths to the Reactor Coolant System OPERABLE, restore at least two baron infection flow paths to I the Reactor Coolant System to OPERA 8LE status within 72 hours or be in at 1 east HOT STAN08Y and borated to a SHUTDOWN MARGIN equivalent to at least 1% delta k/k at 200*F within. the next 6 hours; restore at least two flow paths to OPERA 8LE status within the next 7 days or be in COLD SHUTDOWN.within the next 30 hours. SURVEILLANCE REQUIREMENTS ll 4.1.2.2 At least two of the above required flow paths shall be demonstrated OPERA 8LE: a. At least once per 7 days by verifying that the temperature of the ~ heat traced portion of the flow path from the boric acid tanks is greater than or equal to (65)*F when it is a required water source. b. At least once per 31 days by verifying that each valve (manual, power operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position. I L c. At least once per 18 months during shutdown by verifying that each automatic valve in the flow path actuates to its correct position on l' a _ test signal. i' d. At least once per 18 months by verifying that the flow path required by Specification 3.1.2.2.a delivers at least gpa to the Reactor Coolant System.

1. nly one baron infection flow path is required to be OPERA 8LE shenever the 0

temperature of one or more of the RCS cold legs is less than or aqual to i (275)*F. W-STS 3/4 1-8 un,,j igg;

REACTIVITY CONTROL SYSTEMS CHARGING PUNP - SHUTDOWN LIMITING CONDITION FOR OPERATION 3.1.2.3 One charging pump in the boron injection flow path required by-Specification (3.1.2.1) shall be OPERABLE and capable of being powered from an OPERABLE emergency power source. APPLICABILITY: MODES 5 and 6. ACTION: With no charging pump OPERABLE or capable of being powered from an OPERABLE e trgency power source, suspend all operations involving CORE ALTERATIONS or . po:;itive reactivity changes. i i SURVEILLANCE REQUIREMENTS 4.1.2.3.1 The above required charging pump shall be demonstrated OPERABLE by } verifying, that on recirculation flow, the pump develops a discnarge pressure of greater than or equal to psig when tested pursuant to Specification 4.0.5. 4.1.2.3.2 All charging pumps, excluding the above required OPERABLE pump, shall be demonstrated inoperable at least once per 12 hours, except when the reactor vessel head is removed, by verifying that the motor circuit breakers have been removed from their electrical power supply circuits. i l l I .~ e PSTS 3/4 1-9 JUL 2 7 581 L

REACTIVITY CONTROL SYSTEMS CHARGING PUMPS - OPERATING LIMITING CONDITION FOR OPERATION 3.1.2.4 At least two charging pumps shall be OPERABLE. I APPLICABILITY: MODES 1, 2,'3 and 4. ACTION: With only one charging pump OPERA 8LE, restore at least two charging pumps to OPERA 8LE status within 72 hours or be in at least HOT STAND 8Y and boratsd.to a SHUTDOWN MARGIN equivalent to at least 1% delta k/k at 200*F within the next 6 hours; restore at least two charging pumps to OPERA 8LE status within the next 7 days or be in COLD SHUTDOWN within the next 30 hours. i SURVEILLANCE REQUIREMENTS 1 ( 4.1.2.4.1 At least two charging pumps shall be demonstrated OPERABLE by verifying, that on recirculation flow, each pump develops a discharge pressure of greater than or equal to psig when tested pursuant to Specification 4.0.5. 4.1.2.4.2 All charging pumps, except the above required OPERA 8LE pump, shall' . be demonstrated inoperable at least once per 12 hours whenever the temperature of one or more of the RCS cold legs is less than or equal to (275)*F by verifying l+ that the motor circuit breakers have been removed from their electrical power supply circuits.

1. A maximum of one centrifugal charging pump shall be OPERA 8LE whenever.the temperature of one or more of the RCS cold legs is less than or equal to (275) -

a l W-STS 3/4 1-10 % 1 5 197g

REACTOR COOLANT SYSTEM HOT SHUTDOWN 1 LIMITING CONDITION FOR OPERATION 3.4.1.3 a. At least two of the Reactor Coolant and/or residual heat removal (RHR) loops listed below shall be OPERABLE: 1. Reactor Coolant Loop (A) and its associated steam generator and reactor coolant pump,* f;' f. Reactor Coolant Loop (B) and its associated' steam generator and reactor coolant pump,* I l 3. Reactor Coolant Loop (C) and its associated steam generator and reactor coolant pump,* 4. Reactor Coolant Loop (D) and its associated steam generator and reactor coolant pump," 5. Residual Heat Removal Loop (A), 6. Residual Heat Removal Loop (B). b. At least one of the above Reactor Coolant and/or RHR loops shall be in operation.** l APPLICABILITY: MODE 4. \\ l ACTION: a. With less than the above required Reactor Coolant and/or RHR loops OPERABLE, immediately initiate corrective action to return the required loops to OPERABLE status as soon as possible; if the remaining OPERA 8LE loop is an RHR loop, be in COLD SHUTDOWN within 24 hours. b. With no Reactor Coolant or RHR loop in operation, suspend all operations involving a reduction in boro'n concentration of the Reactor Coolant System and immediately initiate corrective action to return the required coolant loop to operation. ?

A "A Reactor Coolant pump shall not be started with one or more of the Reactor Coolant System cold leg temperatures less than or equal to (275)*F unless

~

1) the pressurizer water volume is less than cubic feet or.2) the secondary water temperature of each steam generator is less than

• F above each of the Reactor Coolant System cold leg temperatures.
  • All Reactor Coolant pumps and residual heat removal pumps may be de-energized for up to I hour provided 1) no operations are permitted that would caus.e dilution of.the Reactor Coolant System boron concentration, and 2) core outlet temperature is maintained at least 10*F below saturation temoerature.

W-STS 3/4 4-3 JUL 2 71981

REACTOR COOLANT SYSTEM SURVEILLANCE REQUIREMENTS 4.4.1.3.1 The required Reactor Coolant pump (s), if not in operation, shall be determined to be OPERA 8LE once per 7 days by verifying correct breaker alignments and indicated power availability. i 4.4.1.3.2 The required steam generator (s) shall be determined OPERA 8LE by verifying secondary side water level to be greater than or equal to (17)% at least once per 12 hours. i I e 4.4.1.3.3 At least one Reactor Coolant or RHR loop shall be verified to be in operation and circulating reactor coolant at least once per 12 hours. t 0 e i I I.L. W-STS ~3/4 4-4 .N0', 2 0 180

REACTOR COOLANT SYSTEM-COLD SHUTDOWN - LOOPS FILLED LIMITING CONDITION FOR OPERATION-3.4.1.4.1 At least one residual heat removal (RHR) loop shall be OPERABLE and in operation *, and either: a. One additional RHR loop shall be OPERABLE #, or b. The secondary side water level of at least two steaa generators shall be greater than (17)L APPLICABILITY: MODE 5 with Reactor Coolant loops filled" !I ACTION: 1 a. With less than the above required loops OPERABLE or with less than the required steam generator level, immediately initiate corrective action to return the required loops to OPERABLE status or to restore the required level as soon as possible. a b. With no RHR loop in operation, suspend all operations involving a reduction in boron concentration of the Reactor Coolant System and immediately initiate corrective action to return the required RHR loop to operation. i SURVEILLANCE REQUIREMsNTS i 4.4.1.4.1.1 The required RHR loop shall be demonstrated OPERABLE pursuant to Specification 4.0.5. 4.4.1.4.1.2 The secondary side water level of at least two steam a generators when required shall be determined to be within limits at least once per 12 hours. 4.4.1.4.1.3 At least one RHR loop shall be determined to be in operation arid 3 ? circulating reactor coolant at least once per 12 hours.

1. One RHR loop may be inoperable for up to 2 hours for surveillance testing i

provided the other RHR loop is OPERABLE and in operation. " A Reactor Coolant pump shall not be started with one or more of the Reactor Coolant System cold leg temperatures less than or equal to (275)*F unless

1) the pressurizer water volume is less than cubic feet.or 2) the secondary water temperature of each steam generator is less than "F

above each of the Reactor Coolant System cold leg temperatures.

• • The RHR pump may be de-energized for up to 1 hour provided 1) no operations are permitted that would cause dilution of the Reactor Coolant System boron concentration, and 2) core outlet temperature is maintained at least 10*F below saturation temperature.

W-STS 3/4 4-5 J.UL 2 71981 .---_,_,_.m-,,._--. ~ _ _.,,., _.,. _,. _ _ _ _ _.., _ _, _ _, _ _ - _,,. _ _. _, _ -.. _.. _ _.. _, _. - -,

REACTOR COOLANT SYSTEM COLD SHUTDOWN - LOOPS NOT FILLE 0 LIMITING CONDITION FOR OPERATION t 3.4.1.4.2 Two residual heat removal (RHR) loops shall be OPERA 8LE and at least one RHR loop shall be in operation." i APPLICA8ILITY: M00E 5 with Reactor Coolant loops not filled. ACTION:

a..

With less than the above required loops OPERA 8LE, immediately initiate corrective action to return the required loops to OPERA 8LE status as soon as possible. ~ b. With no RHR loop in operation, suspend all operations involving a '( reduction in baron concentration of the Reactor Coolant System and. immediately initiate corrective action to return the required.RHR loop to operation. SURVEILLANCE REQUIREMENTS 4.4.1.4.2.1 -.The required RHR loops shall be demonstrated OPERABLE pursuant to Specification 4.0.5. 4.4.1.4.2.2 At least one RHR loop shall be determined to be in operation and circulating reactor coolant at least once per 12 hours. 4 4 u

1. One RHR loop may be inoperable for up to 2 hours for surveillance testing provided the other*RHR loop is OPERABLE and in operation.

y' " a The RHR pump may be de-energized for up to 1 hour provided 1) no operations are perritted that would cause dilution of the Reactor Coolant System baron concentration, and 2) core outlet temperature is maintained at least 10*F below saturation temperature. i l 3/4 4 ~ W-STS

REACTOR COOLANT SYSTEM 3/4.4.3 PRESSURIZER i i LIMITING CONDITION FOR OPERATION l1 3.4.3 The pressurizer shall be OPE'RABLE with a water volume of less than or equal to (1656) cubic feet, and at least two groups of pressurizer heaters each having a capacity of at least (150) kw. I APPLICABILITY: MODES 1, 2, and 3. .i l ACTION: With one group of pressurizer heaters inoperable, restore at least two a. groups to OPERABLE status within 72 hours or be in at least H0T STAND 8Y within the next 6 hours and in HOT SHUTDOWN within the following 6' hours. With the pressurizer otherwise inoperable, be in at least HOT STAND 8Y b. with the reactor trip breakers open within 6 hours and in HOT SHUTDOWN within the following 6 hours. ,= l, i SURVEILLANCE REQUIREMENTS 4.4.3.1 The pressurizer water volume shall be determined to be within its ) limit at least once per 12 hours. l, 4.4.3.2 The capacity of each of the above required groups of pressurizer l.g heaters shall be verified by measuring circuit current at least once per 92 days. i.]k The energency power supply for the pressurizer heaters shall be 4.4.3.3 demonstrated OPERABLE at least once per 18 months by manually transferring i power from the normal to the emergency power supply and energizing the i heaters. 4 I @0V 2 M W-STS 3/4 4-11

REACTOR COOLANT SYSTEM OVERPRESSURE PROTECTION SYSTEMS

l LIMITING CONDITION FOR OPERATION 3.4.9.3 At least one of the following overpressure protection systems shall be OPERABLE:

i a. Two power operated relief valves (PORVs) with a lift setting of g less than or equal to (450) psig, or b. The Reactor Coolant System (RCS) ibpressurized with an RCS vent of greater than or equal to ( ) square inches. APPLICABILITY: MODE 4 when the temperature of any RCS cold leg is less than or equal to (275)*F, MDDE 5 and M00E 6 with the reactor vessel head on. 4 ACTION: i With one PORY inoperable, restore the inoperable PORY to OPERABLE a. status within 7 days or depressurize and vent the RCS through a ( ) square inch vent (s) within the next 8 hours. l b. With both PORVs inoperable, depressurize and vent the RCS through a ( ) square inch vent (s) within 8 hours. In the event either the PORVs or the RCS vent (s) are used to mitigate c. an RCS pressure transient, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 30 days. The report shall describe the circumstances initiating the l. transient, the effect of the PORVs or vent (s) on the transient, and ^ '2 any corrective action necessary to prevent recurrence. d. The provisions of Specification 3.0.4 are not applicable.

3 l2 l3 e

4 __pSTs _ [ _ __ _ 3/4 4-as Ncv 2 isat o i

REACTOR C0OLANT SYSTEM l SURVEILLANCE REQUIREMENTS 4.4.9.3.1 Each PORY shall be demonstrated OPERABLE by: a. Perfomance of a ANALOG CHANNEL OPERATIONAL TEST on the PORV actuation channel, but excluding valve operation, within 31 days prior to entering a condition in which the PORV is required OPERABLE and at least once per 31 days thereafter when the PORV is required OPERABLE. b. Performance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18 months. Verifying the PORY isolation valve is open at least once per 72 hours. c. when the PORV is being used for overpressure protection. d. Testing pursuant to Specification 4.0.5. 4.4.9.3.2 The RCS vent (s) shall be verified to be open at least once per 12 hours

• when the vent (s) is being used for overpressure protection.

4 1.,

"Except when the vent pathway is provided with a valve which is locked, sealed, 5 or otherwise secured in the open position, then verify these valves open at least once per 31 days. l V 4 N ,.a 2 m w-STS 3/4 4-37 1 ___._-----.,-,-.,---,-_-,,--,.----,..--,a_-,..,n__ ,._,,,... w w. n-.---., w,_, .v_...--..,,n.~,,n-...,.~.,,..~na

i 3/4.5 EMERGENCY CORE COOLING SYSTEMS 3/4.5.1 ACCUMULATORS LINITING CONDITION FOR OPERATION ig 3.5.1 Each reactor coolant system accueulator shall be OPERABLE with: 't a. The isolation valve open, b. A contained borated water volume of between and gallons. A boron concentration of between (1900) and (2100) ppe, 'and c. / d. A nitrogen cover pressure of between and psig. \\d APPLICA8ILITY: MODES 1, 2, and 3*. 5 ACTION: e^s With one accumulator inoperable, except as a result of a closed a. isolation valve, restore the inoperable accumulator to OPERABLE i status within 1-hour or be in at least NOT STA 2 8Y within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

Nf With one accumulator inoperable due to the isolation valve being b.

closed, either immediately open the. isolation valve or be in at q 1 east HOT STAND 8Y within 1-hour and in NOT SHt1TDOWN within the > h. following 12 hours. SURVEILLANCE REQUIREMENTS 1 1 4.5.1.1 Each accumulator shall be demonstrated OPERA 8LE: At least once per 12 hours thy: a. 1. Verifying, by the absence of alarms, the contained borated water volume and nitrogen cover pressure in the tanks, and 2. 1 Verifying that each accumula Mr isolation valve is open. ~ " Pressurizer pressure above 1000 psig. L .i! 3/4 5-1 .NOV 2 01980

EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) b. At least once per 31 days and within 6 hours after each solution volume increase of greatwr than or equal to (15 of tank volume) by verifying the boron concentration of the accumulator solution. c. At least once per 31 days when the RCS pressure is above 2000 psig i; by verifying that power to the isolation valve operator is j disconnected by removal of the breaker from the circuit. I d. At least once per 18 months by verifying that each accumulator isolation valve opens automatically under each of the following . conditions: 1. When an actual or a simulated RCS pressure signal exceeds the P-11 (Pressurizer Pressure Block of Safety Injection) setpoint, i 2. Upon receipt of a safety injection test signal. 4.5.1.2 Each accumulator water level and pressure channel shall be ,a demonstrated OPERA 8LE: 8 a. At least once per 31 days by the performanca of a ANALOG CHANNEL OPERATIONAL TEST. I l b. At least once per 18 months by the performance of a CHANNEL CALIBRATION. h? 1c ~ j .y 4 si lf q w SEP 151981 W-STS 3/a 5-2

EMERGENCY CORE COOLING SYSTEMS 3/4.5.2 ECCS SUBSYSTEMS - T,y,> 350*F i LIMITING CONDITION FOR OPERATION 3.5.2 Two independent Emergency Core Cooling System (E:..cs) subsystems shall be OPERABLE with each subsystem comprised of: a. One OPERABLE centrifugal charging pump, b. One OPERABLE safety injection pump (four loop plants only), 3 c. One OPERABLE residual heat removal heat exchanger, d. One OPERABLE residual heat removal pump, and An OPERABLE flow path capable of taking suction from the refueling ) e. water storage tank on a safety injection signal and automatically transferring suction to the containment sump during the recirculation 9 phase of operation. APPLICABILITY: MODES 1, 2, and 3. ACTION: g .n With one ECCS' subsystem inoperable, restore the inoperable subsystem a. to OPERABLE status within 72 hours or be in at least HOT STANOBY within the next 6 hours and in HOT SHUTDOWN within the following a 6 hours. b. In the event the ECCS is actuated and injects water into the Reactor ( Coolant System, a Special Report shall be prepared and submitted to 1 the' Commission pursuant to Specification 6.9.2 within 90 days describ- ) ing the circumstances of the actuation and the total accumulated actuation cycles to date. The current value of the usage factor for each affected safety injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70. O H 3/4 5-3 NOV 2 01980 W-STS l

h i

• EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS II 4.5.2 Each ECCS subsystem shall be demonstrated OPERABLE:

a. At least once per 12 hours by verifying that the following valves are in the indicated positions with power to the valve operators g removed: h Valve Number Valve Function Valve Position U a. a. a. g b. b. b. ig C. C. C. b. At least once per 31 days by: 1. Verifying that the ECCS piping is full of water by venting the ECCS pump casings and accessible discharge piping high points, g and 2. Verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed, or otherwise ,~ secured in position, is in its correct position. c. By a visual inspection which verifies that no loose debris (rags, trash, clothing, etc.) 'is present in the containment which could be transported to the containment sump and cause restriction of the pump suctions during LOCA conditions. This visual inspection shall be performed: l 1 1 1. For all accessible areas of the containment prior to establish-ing CONTAINMENT INTEGRITY, and 2. Of the areas affected within' containment at the completion of i each containment entry when CCNTAINMENT INTEGRITY is established. d. At least once per 18 months by: f, 1. Verifying automatic isolation and interlock action of the RHR system from the Reactor ' Coolant System by ensuring that:

i a) with a simulated or actual Reactor Coolant System pressure r,

signal greater than or equal to 425 psig the interlocks prevent the valves from being opened, and 4 b) with a simulated or actual Reactor Coolant System pressure signal less than or equal to 600 psig the interlocks will cause the valves to automatically close. 2. A visual inspection of the containment sump and verifying that the subsystem suction inlets are not restricted by debris and that the sump components (trash racks, screens, etc.) show no evidence of structural distress or abnormal corrosion. l W-STS 3/4 5-4 'NOV 2 1981

EMERGENCY CORE COOLING SYSTEMS i SURVEILLANCE REQUIREMENTS (Continued) i e. At least once per 18 months, during shutdown, by: i 1. Verifying that each automatic. valve in the flow path actuates to its correct position on (safety injection actuation and automatic switchover to containment sump) test signals. i 2. Verifying that each of the following pumps start automatically l upon ' receipt of a safety injection actuation test signal: i a) Centrifugal charging pump i. b) Safety injection pump ,y c) Residual heat removal pump f. By verifying that each of the following pumps develops the indicated discharge pressure on recirculation flow when tested pursuant to C Specification 4.0.5: . *se 1. CentrifugM char 0ing pump 1 psig I~ 2. Safety Injection pump 1 psig ] 3. Residual heat removal pump 3, psig j g. By verifying the correct position of each electrical and/or. mechanical position stop for the following'ECCS throttle valves: 1. Within 4 hours following completion of each valve stroking

g operation or maintenance on the valve when the ECCS subsystems-are required to be OPERA 8LE.

2. At least once per 18 months. 1 j. HPSI System LPSI System Valve Number Valve Number 4 l a. a. 6. 6. !*e C. c. d. d. l i 4 I W-STS 3/4 5-5 NOV 2 01980 t - _.., - - - _ - -. _, _... -,.. -.. ~... -. -... _. _. _ _. _, _.. _.. _ _...,.., _.... ~... - _ _ _ _. _, _... _ _ -. _. - _ -, - - -. _ _, -

1 EMERGENCY CORE COOLING SYSTEMS s SURVEILLANCE REQUIREMENTS (Continued) I h. By performing a flow balance test, during shutdown, following com-pletion of modifications to the ECCS subsystems that alter the l. subsystem flow characteristics and verifying that: 1. For centrifugal charging pump lines, with a single pump running: i a) The sum of the injection line flow rates, excluding the highest flow rate, is greater than or equal.to . gps, and ) b) The total pump flow rate is less than or equal to gpa. i-3 2. For safety injection pump lines, with a single pump running: 4 a) The sum of the injection line flow rates, excluding the highest flow rate, is greater than or equal to

gpm, j ;j and

~~ b) The total pump flow rate is less than or equal to i 9E** 1 3. For residual heat removal pump lines, with a single pump running, the sum of the injection line flow rates is greater than or equal to gpe. a J INi !r 1 W-STS 3/4 5-6 NOV 3 1981 l

6 l EMERGENCY CORE COOLING SYSTEMS ECCSbuNSYStEMS-Tv,_<350*F ~ 3/4.5.3 LIMITING CONDITION FOR OPERATION )i i ,} 3.5.3 As a minimum, one.ECCS subsystem comprised of the following shall be l OPERABLE:' a. One OPERABLE centrifugal charging pump,# j b. One OPERABLE residual heat removal heat exchanger, 'c. One OPERABLE residual heat removal pump, and d. An OPERABLE flow path capable of taking suction from the refueling l[ water storage tank upon being manually realigned and transferring suction to the containment sump during the recirculation phase of l( operation. 7;) APPLICABILITY: MDDE 4. ACTION: With no ECCS subsystem OPERABLE because of the inoperability of a. ij , either the centrifugal charging pump or the flow path from the !i refueling water storage tank, restore at least one ECCS subsystem to jP OPERABLE status within 1 hour or be in COLD SHUTDOWN within the next ~ j 20 hours. l I b. With no ECCS subsystem OPERABLE because of the inoperability of either the residual heat removal heat exchanger or residual heat removal pump, restore at least one ECCS subsystem to OPERABLE status

I or maintain the Reactor Coolant System T8 less than 350*F by use i$

of alternate heat removal methods. 1 In the event the ECCS is actuated and injects water into the Reactor i c. l Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describ-ing the circumstances of the actuation and the total accumulated actuation cycles to date. The current value of the usage factor for each affected safety injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70. l l

1. A maximum of one centrifugal charging pump and one safety injection pump shall be OPERABLE whenever the temperature of one or more of the RCS cold 1egs is less than or equal to (275)*F.

_-STS 3/4 5-7 gy, y.33) W

l EMERGENCY CORE COOLING SYSTEMS l SURVEILLANCEREUkREMENTS l l, 4.5.3.1 The ECCS subsystem shall be demonstra'ed OPERA 8LE per the applicable t Surveillance Requirements of 4.5.2. i 4.5.'3.2 All charging pumps and safety injection pumps, except the'above jg required OPERA 8LE pumps, shall be demonstrated inoperable at least once per 12 e hours whenever the temperature of one or more of the RCS cold legs is less than or equal to (275)*F by verifying that the motor circuit breakers have b' en removed from their electrical power supply circuits. -} e g I 1 l c i lw \\- .? 1e ,4 1 i.'./ l 4 1 1 i )(-STS 3/4 5-8 MAY

• 5 ~;-73 i

Wasungnc 2.i Nuclear m Service Technical Bulletin Division An advisory notice of a recent technical development pertaining to the installation or operation of Westinghouse supplied Nuclear Plant equipment. Recipients should evaluate the information and recomnwndation, and initiate action where appropriate. P.O. Som 2728. Pittsasureh. PA 16230 k~ i SubjeCl Numbit 4 Residual Heat Removal Pump NSD TB. 77-7 Systemid Unie Residual Heat Removal System XIfcctea l'; anis July 15, 1977 ALL S.O.(sl 215 References Sheet Of Plant Operations Engineering Letter Dated May 5,1977 1 2 j A review of the current, standard Westinghouse,'two suction line, RHR system revealed the potential for RHR pump damage due to inadvertent suction isola-tion valve closure. The above potential for RHR pump damage also exists for single suction line plants. For a two line suction system, the concern is . s the inadvertent RHR suction valve closure initiated by spurious actuation of 3H the RHR autoclosure interlock. The actuation of the interlock could occur as a result of a single pressure transmitter failure or a single bistable fail-ure resulting in the closure of a suction valve in each line of a two line RHR suction system with the potential for RHR pump damage depending upon plant conditions. Current plant designs include a RHR low flow alann which would alert the operator to inadvertent closure of a suction valve on a running RHR pump. If RCS pressure is greater than the shutoff head of the RHR pump (approximate-ly 200 psi), the RHR pumps should not be damaged by closure of the suction valves since they operate satisfactorily on miniflow. Also, steam generators would be available for decay heat removal if it became necessary under the above set of conditions. Therefore, for this plant condition,'no action is I recomended. k If RCS' pressure is less than the shutoff head of the RHR pumps and the RCS is closed, the potential for RHR pump damage due to inadvertent closure of the suction isolation valves exists. However, since the time the plant is in this

el condition is typically short and since the steam generators would be available 9

for decay heat removal if it becomes necessary, no action is recomended for this plant condition. f..:e.wiw t.v.,,... 4 4. i' nn,c-.e, i >..... m.... ' u.. i - Ta' - w 256-7736 oe c 236-7736 W. B. Pa / d ofer,Mangr,_,, F. C. We Mechanical Service 7/A8/77 j M chanicgl Service 2A 7 m. n,. l l

N sstinghouso 'r Nuclocr M. I Service Technical Bulid Division An advisory notice of a recent technical d'evelopment pertaining to the installation or operation of Westmghouse-supplied Nuclear Plant equipment. Recipients should evaluate the information and recommendation, and initiate action where appropriate. P.O. Bos 2728, Pittsburgh, PA 15230 0 t 9 i If the RCS is open to atmosphere with the reactor vessel. head on, the potential A for RHR pump damage exists due to inadvertent closure of the suction isolation valves. Makeup to the RCS could be used for decay heat removal in this case; L however, it would be limited by the availability of borated water and would be difficult to control. To preclude a single event (suction valve closure) re-I sulting in RHR pump damage under the above plant conditions, it is recommended that electrical power be locked out to the suction isolation valve in each suction line which is powered from an emergency power source different from i tnat of its respective pump. The above recommendation also applies if the RCS is in a refueling condition with the reactor vessel head off and the refuel-ing canal full. For a single suction line plant, spurious actuation of the autoclosure inter-lock, any failure mechanism which results in closing of either suction iso-lation valve is a concern for single suction line plants, since damage to both RHR pumps could occur. The various plant conditions considered above for the two suction line applies to the single line system. The recommendations are the same except the elec-trical power should be locked out for both suction valves and that only one RHR pump should be operated when the RCS is open. It is requested that operating plants should review their individual plant designs to assess whether the recontnended actions are both necessary and suf- ! c. ficient. In addition, those operating plant customers with plants which do lC not have RHR low flow alarm may wish to add the alarm to alert the operator of an inadvertent RHR suction valve closure. I.- 9 8}}