ML20149M290

Proposed Tech Spec Re Plant Protective Sys Trip Setpoint & Operating Requirements

ML20149M290
Person / Time
Site:	Fort Saint Vrain
Issue date:	02/08/1988
From:	PUBLIC SERVICE CO. OF COLORADO
To:
Shared Package
ML20149M274	List: ML20149M273 ML20149M285 ML20149M290
References
TAC-47416, NUDOCS 8802250465
Download: ML20149M290 (66)

Text

. . . _

Attachment 2 To P-88025 PROPOSED AMENDMEt:T REQUEST TO THE FSV PPS TECHNICAL SPECIFICATION i

l f

5 k

8902250465 DR 000208 p ADOCK 05000267 PDR ,

Attachment 2 P-88025 Page 2 February 8,1988 Enclosure 1 1 0F Attachment 2 of P-88025 SUFFARY OF PROPOSED CHANGES i

I O

4 a

(

l

[

l

-l l 1

]

l i

a

a ~

?w , e..

~

~

,,9

,, t,. ,

,, A Attachment ? ' -

P-88025 ., - ,

^

Page 3 ,

., _.m.

February 8, 1988 SUMMd?JOFPROPOSEDCHANGds 3

SECTION DESCRIPTION 1.

LSSS 3.3 -

1. Page 13.3-1, Definftions are added for. Trjp Setpoint,'and 'Allowabl6 Value

2. Pages 3.3-2a, 2b, '2c, 3a, and 3b

= replace old'pages 3.3-2 and 3.3-3..

A'(rip Setpoint @,d Allow.ible Valvd are no'" specified- for each parameter und two curies are d ed alth Tabio 3.3-1. '

Basis for LSSS 3.3 1. Pages 3.3-4 throuhh3.3-8 replace old pages 3.3-4 through 3.3-8. The new basis the general methodology' provides,,i!/ing, frm deter Trip Setpoint and Allowao'c Valucu nd then describes t'te basis for each limiting safety"system parameter.

LC0 4.4-1 1. Page 4.4-1. Definiti'>ns'added for Trip Setpoint bnd Aliowable Value.

Two paragraphs of old page moved to next page.

2. Dage 4.4-2. The p.tragraph on Table 4.4-1 expanded to add new requirements. The paragraph on Table 4.4-3 expanded and page reformetted.

3. Table 4.4-1 through 4.4-4. The tables were reformat +,ed .to provide for a Trip Setpofct and Allowable

, Value to replace the Trip St.tt uig .

Each table was split into Part I containing Trip- Setpoint and Allowsble Values for each pa'rameter.

and a ;Part' 2 containing liinimum Operable . Channels,. Mirnmum Ocgree

~

r "Y '-'

tr- -* - -

+

t:

P-88025 Page 4 February 8, 1988 of Redundancy and Pennissible Bypass Conditions. Part 2 follows Part 1 for each table.

4. Old pages 4.4-3 through 4.4-6 and 4.4-7 replaced by pages 4.4-3a, 3b, 3c, 4a, 4b, 4c, 4d, Sa, 5b, Sc, 7a, and 7b.

5. New page 4.4-4d. Permissible Bypass Conditions clarified for parameter 7c to reflect actual design.

6. Page 4.4-8. Notes for Tables 4.4-1 through 4.4-4. Note (a) deleted as Table 4.4-1 line Items 3a and 3b refer operator to Table 3.3-1.

Note (d) deleted as the Trip Setpoint and Allowable Value in new tables provide specific criteria for the Plan Electrical S -

Loss parameter. Note (e)ystem updated to correctly describe the undervoltage protection system design. Note (h) in existing license split into two separate notes (hl) and (h2) to more correctly reflect applicable permissible bypass conditions for the different types of moisture monitors.

Basis for LCO 4.4-1 1. Pages 4.4-10 through 4.4-13 of existing license replaced by new pages 4.4-10, 10a, 10b, 10c, 11, lla, 12, 12a, 12b, 12c, and 4.4-13.

The new basis is more descriptive than the original, t

c

= ,- vn P-88025 Page 5 February 8, 1988 Enclosure 2 Of Attachn.ent 2 Of P-88025 PROPOSED CHANGES TO LSSS 3.3 AND LC0 4.4.1 0F THE FSV TECHNICAL SPECIFICATIONS

l I

Fort St.'Vrain 01 ~;

TGehnical SpGcifications j Amendment e Page 3.3-1 l

l l

3.3 LIMITING SAFETY SYSTEM SETTINGS Applicability Applies to the trip settings for instruments and devices which provide for monitoring of reactor power, hot reheat temperature, reactor internal pressure, and moisture content of the helium coolant.

Objective To provide for automatic protective action such that the principal process variables do not exceed a safety limit as a result of transients.

Specificatien LSSS 3.3 - Limicino Safety System Settinos The Limiting Safety System Settings for trip shall be as specified in Table 3.3.1. The following definitions are used in the table:

o Trio Setroint - TSe trip setpoint is the least conservative "as lef t" value for a channel to be considered Operable.

A11ewable Value -

The allowable value is the least conservative "as found" valse for a channel to be considered Operable.

I I

l

Fort St. Vrain #1 Technical Specifications knendment #

Page 3.3-2a Specification LSSS 3.3 Table 3.3-1 LIMITING SAFETY SYSTEM SETTINGS TRIP ALLOWABLE PARAMETER FUNCTICN SETPOINT VALUE

1. Reactor Core Limiting Safety System Settings a) Linear Scram Varies as s. varies as a Channel-High Function c' Function of (Neutron Indicated Indicated Flux) The rm:,1 The rmal Power per Power per Figure 3.3-1 Figure 3.3-1 b) Reheat Scram < 1055 < 1067 Steam Begree F 3egree F Temperature-High c) Primary Scram 1 68.6 psi 1 72.7 psi Coolant below normal, below normal.

Pressure- programmed programmed Programmed with Circu- with Circu-Low lator Inlet later Inlet Temperature. Temperature Upper TRIP per Figure SETPOINT of 3.3-2. Upper 631.1 psia. limit to produce trip 1 at t 627 {

psia.

l i

l l

l l

l

. ~ , -- -

, , - , , - .,- - . . _e, v.--- . -, . . - - -

Fort St. Vrain #1

-Technical Specifications Amendment #

Page 3.3-2b Scecification LSSS 3,3 Table 3.3-1 (Continued)

LIMITING SAFETY $YSTEM SETTINGS TRIP ALLCWABLE PARAMETER FUNCTION SETp0!NT val,UE

2. Reactor Vessel Pressure Limiting Safety System Settings

4) Primary Scram and i 46 psi 1 52.7 psi Coolant Preselected above normal, above normal, Pressure- Loop Shutdown programmed programmed programmed and Steam / with Circu- with Circu-High Water Dump lator Inlet lator Inlet Temperature. Temperature Upper TRIP per Figure SETPOINT of 3.3-2. Upper

< 746.3 psia, limit to Lower TRIP produce trip SETPOINT of at < 753 1 538.3 psia, psia. Lewer limit to produce trip at 5 545 psia b) Primary Scram, Loop 1 60.5 Coolant 1 62.2 Shutdown, degree F degree F Moisture- and Steam / dewpoint de= point High Water Oump temperature temperature c) PCRV Pressure Pressure: Relief Rupture Disc 812 osig plus 820 psig (Low Set er mir.us 8 Safety Valve) psi l

Fort St. Vrain 01 Technical Specifications Amendment # 3 Page 3.3-2c Specification LSSS 3.3 Table 3.3-1 (Continuee)

LIMITING SAFETY SYSTEM SETTINGS TRIP ALLOWABLE DARAMETER FUNCTION SETPOINT VALUE Low Set Safety 796 psig plus 804 psig Valve or minus 8 psi Rupture Disc (High Set Safety 832 psig plus 840 psig or minas 8 pst Valve)

High Set Safety Valve 812 psig plus 820 psig or minus 8 psi d) Helium pressure Circulator Relief Penetration Interspace Pressure:

Ruoture Disc 825 psig plus 842 psig (2 Per or minus 17 Penetration) pst Safety Valve (2 Per 805 psig plus 829 psig or minus 24 Penetration) psi e) Steam pressure Generator Relief Penetration Interspace Pressure; Rupture Disc (2 For Each 825 psig plus 842 psig or minus 17 Steam Generator) pst Safety Valve (2 For Each 475 psig plus 489 psig or minus 14 Steam Generator) psi

120 _

. --.  : ,I__

E 110 5 g _

l O ALIAMAfABLE VALUE [

a, 100 --

( ,}g TRIP SETPOINT t g ,

i

= m i p b l o 70 [ -l g g ____ ____ ____ ____ _ _!

< %_ ^

O -

1 Indicated Thermal Power Reactor Power Range Trip Setpoint Allowable Value g --

--  ; O to 45 < 64 < 65 g g - Greater than 45 to 70 < 85 < 86

- 2 Greater than 70 to 80 < 95 <%

F = Greater than 80 to 90 < 105 < 106 E Greater than 90 to 95 110 E111 ,N m g Greater than 95 to 10r < 115 < 116 m3 g" C  : ." X

• us  : " ? ".*

u) 10 _ h m<

n. I W *_

O Z-iii; iiii iiii iii i i i iiir iiii iiir Tii ii iI, QQ 0 10 20 30 40 50 60 70 80 90 100 f INDICATED THERMAL POWER (%) l FIGURE 3.3-1 HIGH NEUTRON FLUX SCRAM DETECTOR DECALIBRATION CURVES FOR CYCLE 4

Fort St. Vrain #1 Technical Specifications Amendment #

Page 3.3-3b

. **. ~C :I _ +. ~ ~ _ _ . _ -r . _ - -

.__.,,.._._____..__._.a_.~_._~_.._-------;;*

_.__.1..-+__.t__..._--

r .. - .

_--*T - -^ 7 C_217*;.!!: f~~.17.*'.*~.'~

_j_.m

-. _ . ~ _ - -- - - -

+t. + _ __ i___

t+***

+- . . . _ ' . '

.__c_.._.__.._-.. -

==t= ==t.= =:=n

__ ..._._.n--!. :=

= .:=:-----+-..-.a_ =:rn =L- un~ i==n_at=_t.=  :=t- 1___

i-

_ . .e

--a -

q soo -

=. ._=. . 1 - - _- .=. . _ .:.=..i_ ..

unn =}=t--j t= === j n=En

• :Z'.Z:.=;~l;~~.L- . .

-.--- - =. . . r= :: t= =t=.

t==:==t=. . . . _ =t= - +

n==~ .

n=. =i- --.= ~7=EEliEi'

--4-- + - - -

_ + - . -. - - - - n=- r=

!===n~ p=  :== g=t- =g=gj=:"t

- =~m

7.z~ilE!EEiEE={EEE ~~- .

? _-_=t ==:=  :="- 7" -

7E=iEiEiEHf5l5E3={i=iEl5!5 5!5 55I 5:5 !5 N 55 753 PSIA E S*5 +

m ' ii b55L555 E51}~IE5I54rE==1=:=12 =:

E . 1}iniiEElEZZ.~';

r=; HIGH PRIMARY ALLOWABLE VALUE == := = =:= - ' ~ ~ " ~

D m u) - -; COOLANT == r=

M.=~700 PSI A _JEdEi!.EE t_ -

u) ~ r=El

= EEE._." :Ei ~~~~E~742 F

C=

W 7oo - . , . l .~. _ .' .'i P R E S S U R E -- = =

- - et= ! ===-

m = == . ~= a -- -

EM P1 + 282rr.NO' 2.7 $ AL

turr-  : .#2..=;zp un - .= = t= r: d_I".E.

C. ..!:.~....:  ! P R_E SS: -

ut=4=..;_p_

.63381T -- +- --

n- O P ER ATING c:=

i z

- :li: 1 7 ili -;  !!EEli=

........a-.-..{EEM.0-.L.- i!Ei2 Er1EE .: O li-E:tx

=

:tAnrh= PRESSURE 3"!

5

=

~=wii-iii=iet!E!Ei55 Eli!Mn5 !ai=M!E E!E - + -

o

....y

. :=.~ v r x =~:=:t

.------.=;==.=.=_t= -"~'

i== 627 j,sipn=EiE =

O my- -: .-

O t. .iEliEd3EEEi{i3.= EEliali=i' 6 .li=?i.EgiggiEEF'.:d5i5 lie!55iEEi soo -- .

+ - _._. '... . - , . : =.. . -

. + .= -::: : . =. x .x t

-+. -.: 610 6 0 0 oP:=u FS rI- A inzl =t -.= nu:=N==t:--= =t = l .. =nt. .-

M

. . u r : =. .=. _. t =.. - t.=.. . _==.

<  : . ... = ._ ut a . = nn r= n .:p -- :={==: =tm a.H.  :- :=" ..= :r ' - - ~~ t -- " =n ' = : = i = ~1 = i=;=

g -- 5 4 5 P S I A . tr .,.nar--

.. x-ALLOWABLE VALUE 7 -LOW PRESSURE li -:" !ELOW PRIMARY

{  :

, .= SCRAM BYPASSED h .:

:WHEN LESS TH AN u =7-M w :'= CPRESSURE O O LA NT

.  : na _. -

i-EE_30% R ATE D POWE R -.i2.ihEEPR ESS = .63381 TEM Pl+ 15 6.7 500 l l l l l 300 400 soo soo 700 soo CIRCULATOR INLET TEMPERATURE ( F)

FIGURE 3.3-2 PRIMARY COOLANT PRESSURE vs. CIRCULATOR INLET TEMPERATURE ALLOWABLE OPERATION 1 l

l

Fort St. Vrain #1 Technical Specifications l 1

Amendment #

Page 3,3-4 i 8_ asis for Specification LSSS 1.3 Safety limits have been established in Specification SL 3.1 and SL 3.2 to safeguard the fuel particle integrity and the reactor primary coolant system barriers. Protective devices have been provided in the plant design to ensure that automatic corrective action is taken when required to prevent the Safety Limits from being exceeded during normal operation or during operational transients resulting from possible operator errors, or as a result of equipment malfunction. This specification establishes the Trip Setpoints and Allowable Values for these automatic protective devices.

Operation with setpoints less conservative than the Trip Setpoint but within the Allowable Value is acceptable since an allowance has been made in the safety analysis to accommodate this error, as described below.

General Methodology The Analysis Value is the value of a parameter for which a Trip and initiation of automatic protective action is assumed to occur in FSV accident analyses (FSAR Chapter 14).

Provided that the trip occurs at a value equal to or more conservative than the Analysis Value, analyses demonstrate '.

that consequences of the accident or transient are acceptable.

ISA Standard, 567.04-1982 has been applied to these Analysis Values to arrive at Allowable Values and Trip Setpoints for each PPS parameter, i

I 1

l l

l l

. . .. ~_. .

.~r . - .

Fort St. Vrain #1 Technical Specifications

/Vnendment #

Page 3,3-5 Basis for Specification LSSS 3.3 (Continued)

Lirear Channel - High (Neutron Fluxl The neutron flux Trip Setpoints are established to protect the fuel particle integrity during rapid overpower trtnsients. The power range nuclear channels respond to changes in neutron flux. During normal power' operation, the channels are calibrated using a plant heat balance so that the neutron flux that is sensed is indicated as percent of Ra*.ed The rmal Power. For slow maneuvers, those where core thormal power, surface heat. flux, and the heat- transferred to the helium follow the neutron flux, the power range nu:: lear channels will indicate reactor Thermal Power. For d

fait transients, the neutron flux change will lead the chtnge in heat transferred from the core to the helium due to the effect of the fuel, moderator and reflector thermal titte constants. Therefore, when the neutron flux increases to the scram Trip Setpoint rapidly, the percent increase in heat flux and heat transferred to the helium will be less than the percent increase in neutron flux. Trip Setpoints that' ensure a reactor scram at no greater than 140% Rated Thermal Power are sufficient for~ the plant because the -

negative temperature coefficient of reactivity and l a rge .

beat capacity of the reactor limit the transient increases in fuel and helium temperatures to acceptable values.

Control rod snim bank movement can result in decalibration of the external-core neutron flux detectors. To account for this potential decalibration and other instrumentation errors, the actual Trip Setpoint is administratively set less than 140% Rated Thermal Power based upon indicated power. These administratively set flux Trip Setpoints ensure the scram will occur at or less than 140% Rated Thermal Power for those postulated reactivity accidents evaluated in FSAR Section 14.2. Additional discussion on detector decalibration is given in updated FSAR Section 7.3.1.2.1.

4 4

4

Fort St,- Vrain 01 Technical Specifications Amendment i Page 3.3-6 Basis for Specification i.SSS 3.3 (Continued)

Reheat Steam Temperature - High High reheat steam temperaturc indicates either an increase in Thermal Power generation without an appropriate increase in helium cooling . flow rate or a decrease in steam flow rate. (Reheat steam temperature in lieu of reactor core outlet helium temperature is used because of the difficulty in measuring gross helium temperature for protective system -

purposes.) The design of the steam generator is such that changes in hot helium temperature due to a power increase first affect the reheat steam temperature, thus allowing the latter to serve as an index of the helium temperature. A reheat steam temperature scram is provided to prevent excessive Power-to-Flow-Ratio due to a power increase or steam flow imbalance. (FSAR Section 14.2)

Primary Coolant pressure - Programmed Low The low primary coolant pressure Trip Setpoint has been established to maintain the fuel particle coating integrity due to loss of primary coolant as a result of a coolant-leak.

Primary Coolant Pressure - programmed High The major potential source of primary coolant pressure increase above the normal operating range is due to water and/or steam inleakage by means of a defective evaporator-economizer-superheater subheader or tube. For a double- '

ended offset tube rupture, the rate of water and steam inleakage will not exceed 35 lbs/see initially, resulting in '

a maximum rate of primary coolant pressure increase of approximately 1 psi per second. The normal PPS action upon  ;

detection of moisture is reactor scram, loop shutdown, and steam / water dump (FSAR Section 7.1.2.5), occurring after approximately 12 seconds, assuming rated power and flow conditions. In this situation, the peak PCRV pressure at 100% reactor power does not exceed 705 psia. The Trip Setpoint of less than or equal to 46 psi above the normal operating pressure between 25% and 100% rated power is selected: (1) to prevent false scrams'due to normal plant transients, and (2) to allow adequate time for the normal protective action (high moisture) to terminate the accident while limiting the resulting peak PCRV pressure in the j unlikely event that the normal protective action was inoperative. In this case, Reactor Pressure would continue to rise to the high pressure Trip Setpoint. The resulting peak PCRV pressure would be less than the PCRV Reference Pressure. The high pressure Trip Setpoint is programmed as a function of load, using helium circulator inlet te?perature as the measured variable indicative of load, as shown in Figure 3.3-2. The PCRV safety valves provide the ultimate protection against primary coolant system pressure exceeding the PCRV Reference Pressure of 845 psig.

- , , --,,e , r,-- - - - -.s - - - , - - , ,- -- --

-_-c , , - - - . - , - gc

l Fort St. Vrain #1 Technical Specifications Amendment # 1 Page 3.3-7 i Basis for Specification LSSS 3.3 (Continued)

.l Primary Coolant Moisture - High l I

The high moisture Trip Setpoint corresponding to 60.5 1 degrees F dewpoint was established, considering the moisture i monitor characteristics and the necessity to minimize water inleakage to the primary coolant system. A Trip would be reached after several hours of full power operation with a minimum water / steam inleakage rate in excess of about 20 lbs/hr. Below that inleakage rate, the Trip Setpoint would never be reached, but the indicating instruments would show an abnormal condition. For maximum design leakage rates, the system behavior is as discussed in the preceding section on Primary Coolant Pressure-Programmed High. Backup protective action is provided by the high primary coolant pressure scram, loop shutdown, and dump of a pre-selected loop and remaining loop steam depressurization. (FSAR Sections 7.1.2.3 and 7.1.2.4.)

PCRV Pressure The PCRV safety valves provide the ultimate protection against primary coolant system pressure exceeding the PCRV Reference Pressure of 845 psig. This engineered safeguard system consists of the isolaticq valves, the rupturt discs, the relief valves, and the containment tank. Two safety valves are provided, either of which is adequate to prevent exceeding the PCRV Reference Pressure in the event of a steam ge9erator subheader rupture, which is the only credible means of substantially increasing the primary coolant pressure. If the pressure in the PCRV were to rise significantly above the Normal Working Pressure, the low-set rupture disc would rupture within the range of 804 psig

(-1%), to 820 psig (+1%). The low set safety valve, sr.c at 796 psig plus or minus 15, would be wide open and rel ieving at full capacity at or above 820 psig (3% accumulation). If the pressure still continued to rise, the high-set rupture disc would rupture between 824 psig and 840 psig. The high-set safety valve, set at 812 psig plus or minus 1%, would be relieving at full capacity above 836 psig (31 accumulation).

As the pressure decreased, the high-set safety valve would close at a pressure of approximately 690 psig and the low-set safety valve at approximately 677 psig; the corresponding primary system pressure would be approximately 737 psig when the low-set safety valve closed. The minimum permissible trip setpoint of each PCRV overpressure relief train rupture disc and relief valve is specified to provide assurance that primary coolant helium will not be vented to atmosphere during primary coolant pressure surges, resulting from transients or accidents, in which pressures do not approach the Allowable Yalue and thereby do not challenge the integrity of the PCRV. (FSAR Section 6.8.3)

L

Fort St. Vrain #1 Technical Specifications .

Amendment 0 Page 3.3-8 Basis for Specification LS$5 3.3 (Continued)

Helium Circulator Penetration Interspace Pressure The penetration interspaces are protected against pressures exceeding PCRV Reference Pressure (845 psig). The safety valves are set at 805 psig and rupture discs are set at 825 psig(nominal). A redundant safety valve and rupture disc are provided. The rupture discs would burst in the pressure range of 808 psig (-2%) to 842 psig (+2%). The safety valves would open in the range of 781 psig (-3%) to 829 psig

(+3%) and would relieve at full capacity at 886 psig (101 accumulation). The safety valves would reseat at about 725 psig. The safety valve and rupture disc relieving pressures were specified so as to comply with the ASME Boiler and Pressure Vessel Code Section III, Class B Nuclear Vessels, for overpressure protection. The minimum pemissible trip setpoint of each rupture disc and associated relief valve is specified to provide assurance that PCRV penetration interspace helium, which could potentially be radioactive, will not be vented to atmosphere during interspace pressure surges in which pressures do not a pproach the Allowable Value and thereby do not challenge the integrity of the PCRV penetration. (FSAR Section 5.8.2)

Steam Generator Penetration Interspace Pressure The six steam generator penetration interspaces in each loop are provided with ccrvnon upstream rupture discs and safety valves to protect against pressures exceeding PCRV Reference Pressure (845 psig). A redundant safety valve and rupture disc are provided. The rupture discs would burst in the pressure range of 808 psig (-2%) to 842 psig (+2%), with a nominal setting of 825 psig. The safety valves are each set at 475 psig which allows for a pressure drop in the inlet lines of 370. psi mhen relieving at valve capacity. The minimum permissible trip setpoint of each rupture disc and ,

associated relief valve is specified to provide assurance ,

that PCRV penetration interspace helium, which could potentially be radicactive, will not be vented to atmosphere during interspace pressure surges in which pressures do not approach the Allowable Value and thereby do not challenge the integrity of the PCRV penetration. (FSAR Section 5.8.2) l f

I t

I

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-1 4.4 INSTRUMENTATION AND CONTROL SYSTEMS - LIMITING CONDITIONS FOR OPERATICH Applicability Applies to the plant protective system and other critical instrumentation and controls.

Objective To assure the operability of the plant protective system and other critical in s trumenta t ion by defining the minimum operable instrument channels and trip settings.

Specification LCO 4.4.1 - plant Protective System Instrumentation. Limittna Concitions for Operatton The limiting conditions for the plant protective system instrumentation are shown on Tables 4.4-1 through 4.4-4. These tables utilize the following definitions:

Georee of Redundancy - Olfference between the number of operable channels ano the minimum number of operable channels which when tripped will cause an automatic system trip.

Coerable Channel - A channel f s operable if it is catable of fulfilling its cesign functions.

Inoperable Channel - Opposite of operaole channel.

Trip Setpoint -

The trip setpoint fs the least conservative "as lef t" value for a channel to be considered Operable.

Allowable Value -

The allowable value is the least conservative Operable. "as founa" value for a channel to be considered manner:

Tables 4.4-1 through 4.4-4 are to be read in the following If the minimum operable channels or the minimum degree of redundancy for each functional unit of a table cannot be met or cannot be bypassed under the stated pe rmi s s ible bypass conditions, the following action shall be taken:

Fort St. Vrain el Technical Sp:cifications Amendment f Page 4.4-2 For Table 4.4-1, the reactor shall be shut dewn within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, except that to facilitate maintenance on tne Plant Protective System (PPS) moisture monitors, the moisture monitor input trip functions to the Plant Protective System which cause scram, loop shutdown, circulator trip, and steam water dump may be disabled for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. During the time that the Plant Protective System moisture monitor trips are disabled, an observer in direct communication with the reactor operator shall be positioned in the control room in the location of pertinent instrumentation. The observer shall continuously monitor the primary coolant moisture levols indicated by at least two moisture monitors and the primary coolant pressure indications, and shall alert the reactor operator to any indicated moisture or pressure change. During the time in which the trip functions are disabled the requirements of LCO's 4.2.10 and 4.2.11 shall be met and primary coolant shall not exceed a moisture concentration of 100 ppmv.

For Table 4.4-2, the a f fected loop shall be shut down within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

For Table 4.4-3, perform one of the following within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />;

a. The reactor shall be shutdown, or

b. the affected helium circulator shall be shutdown.

For Table 4.4-4, the reactor shall be shut down within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

If, within the indicated time limit, the minimum number of operable chanaels and the minimum degree of redundancy can be reestablished, the system is considered normal and no further action needs to be taken.

i i

l l

1

Fort St.'Vrain #1' Technical Specifications ~ l Amendment #

Page 4.4-3a Specification LCO 4.4.1 Table 4.4-1 (Part 1)-

INSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM, SCRAM TRIP ALLOWABLE NO. FUNCTIONAL UNIT SETPOINT VALUE la. -Manual Scram Not Applicable Not Applicable (Control Room)

~

lb. Manual Scram Not Applicable Not Applicable (Outside Control Room)

I

2. Startup Channel High $8.3E+04 cps I9.3E+04 cps-Count Rate 3a. Linear Channel-High -----------See Table 3.3 1-------

Channels 3,4,5  ;

(Neutron Flux) l 1

3b. Linear Channel-High ...--------See Table 3.3 1 ------

Channels 6,7,8 (Neutron Flux) ,

4 Primary Coolant Moisture High Level Monitor < 60.5 degree F < 62.2 degree F Hewpoint Hewpoint Loop Monitor < 20.4 degree F < 22,1 degree F Hewpoint Hewpoint

/ l S. Reheat Steam Terrperature f1055degreeF f1067degreeF

- -High u

Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4 8 and 4.4 9 i ,

1 l

)

l I

F

- - - - - . -- - - - . , ..,,y-y- , _ - , ~ , , , ,,yr ., y- -

-,, --m -, e c--, - - - - , , - ,. .-- - -

Fort St. Vrain #1 Technical Spesifications Amendment #

Page 4,4-3b Specification LCO 4.4.1-Table 4.4-1 (Part 1)'

INSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM, SCRAM TRIP ALLOWABLE NO. FUNCTIONAL UNIT SETPOINT VALUE  ;

6. Primary Coolant Pressure - -------See Table 3.3-2---------

I

-Progracuned Low

7. Primary Coolant Pressure ---------See Table 3.3-2--------- '

j

-Progranined High j 8. Hot Reheat Header Pressure > 44 psig > 43 psig

-Low

9. Main Steam Pressure-Low > 1529 psig >1517 psig

10. Plant Electrical System-Loss > 278V > 266Y 7 31.5 Seconds 7 35 Seconds  ;

i

11. Two Loop Trouble Not Applicable Not Applicable

12. High Reactor Building -< 161 degree F < 166 degree F

~

Temperature (PipeCavity)

Notes for Tables 4.4-1 through 4.4 4 are on Pages 4.4-8 and 4.4-9 $

i  !

1 t 4 i t

I i

1 [

3  !

?

4  :

1 9

i i

, (

) i 1 .

I 1..- . . . . . - , - , - _ , . . . . , . _ . _ _ ___ _ . _. _, . . _ _ _ , _ _ _ _ _ _ _ __ , . _ _ . , _ _ _ _ __ , _ _,

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-3c SPECIFICATION LCO 4.4.1 TABLE 4.4-1 (Part 2)

INSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM, SCRAM MINIMUM MINIMUM PERMISSIBLE OPERABLE DEGREE OF BYPASS NO. FUNCTIONAL UNIT CHANNELS REDUNDANCY CONDITIONS la. Manual (Control Room) 1 0 None Ib. Manual (Outside Control 2 (f) 1 None Room)

2. Startup Channel-High 2 1 Reactor Mode Count Rate Switch in "RUN" 3a. Linear Channel-High, 2(f) 1 None Channels 3, 4, 5 3b. Linear Channel-High, 2 (f) 1 None Char.nels 6, 7, 8 4 Primary Coolant Moisture High level Monitor 1 (f,t) 1(c) (h2)

Loop Monitor 2/ Loop (f,t) 1/ Loop (hl)

5. Reheat Steam 2 (b.f) 1 None Temperature - High

6. Primary Coolant 2 (f.k) 1 Less Than 30%

Pressure - Rated Power Programed Low

7. Primary Coolant 2 (f.k) 1 None Pressure -

Programed High

8. Hot Reheat Header 2 (f) 1 Less Than 30%

Pressure - Low Rated Power

9. Main Steam 2 (f) 1 Less Than 30%

Pressure - Low Rated Power

10. Plant Electrical 2(e.f) 1 None System - Loss

11. Two Loop Trouble 2 1 Reactor Mode Switch in "Fuel loading"

12. High Reactor Building 2 (f) 1 None Teeperature (Pipe Cavity)

{

Notes for Tables 4.41 through 4.4-4 are on Pages 4.4-8 and 4.4-9 f l

l

4 Fort St. Vrain #1 Technical Specifications knendment #

Page 4.4-4a Specification LCO 4.4.1 Table 4.4-2 (Part 1)

INSTRUMENT CPERATING REQUIREWENTS FOR THE PLANT GROTECTIVE SYSTEM. LOCP SHUTDCVN TRIP ALLCWABLE NO. FUNCTICNAL UNIT SETPOINT VALUE la. Deleted Ib. Deleted Ic. Deleted Id. Deleted le. Deleted If. Deleted 2a. Celeted  ;

2b. Celeted 2c. Deleted 2d. Deleted 1

3a. Loop 1 Shutdown Logic Not Applicable Not Applicable l 3b. Leop 2 Shutdown Logic Not Applicable Not Applicable da. Circulator 1A and 18 Not Applicable Not Applicable Shutdown - Loop Shutdown Logic )

Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4-8 and 4.4-9 l

l l

l Fort St. Vrain #1 Technical Specifications :

Amendment #  !

Pagt 4,4-4b Specification LCO 4.4.1 Table 4.4-2 (Part 1)

INSTRUMENT OPERATING RE0'JIREMENTS FOR THE PLANT PROTECTIVE SYSTEM. LOOP $ HUT 00'.H TRIP ALLOWABLE NO. FUNCTIONAL UNIT SETPOINT VALUE 4b. Circulator IC and 10 Not Applicable Not Applicable Shutdown - Loop Shutdown Logic Sa. Steam Generator 5 796 psig 5 801 psig Penetration Overpressure, Loop 1 Sb. Steam Generator 5 796 psig 1 801 psig Penetration Overpressure Loop 2

64. High Reheat Header < 3.2 mrem /hr < 3.5 mrem /hr Activity, Loop 1 Xbove Xbove Background Background 6b. High Reheat Header < 3.2 mrem /hr < 3.5 mrem /hr Activity, Loop 2 Xbove Ibove Background Background 7a. Low Superheat Header 1 798 degres F 3 794 degree F  !

Temperature, Leap 1 (p) 1 7b. Low Superheat Header 1 798 degree F 1 794 degree F l Temperature, Loop 2 (D) l I

7c. High Differential 5 44.8 degne F $ 46.7 degree F Temperature Between Loop 1 and Loop 2 (D)

Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4-8 and 4.4-9

Fort St. Vrain 01 Technical Specifications Amendment #

Page 4.4-4c SPECIFICATION LCO 4.4.1 TABLE 4.4-2 (Part 2)

(NSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM, t.CCP SHUTDCwN MINIMUM MINIMUM PERMISSIBLE OPERABLE DEGREE OF BYPAS$'

NO. FUNCTIONAL UNIT CHANNELS REQUNDANCY CONDITICNS la. Deleted 1

Ib. Deleted Ic. Deleted Id. Deleted le. Deleted If. Osleted

24. Deleted 2b. Deleted 2c. Deleted '

2d. Deleted Ja. Loop 1 Shutdown 2 1 None Logic ,

3b. Loop 2 Shutdown 2 1 None Logic Notes for Tables 4.4=1 through 4.4-4 are on Pages 4.4-8 and 4.4-9 I

l l

Fort St. Vrain di Technical Specifications Amendment #

Page 4.4-4d s SPECIFICATION LCO 4.4.1 TABLE 4.4-2 (Part 2)

INSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM.

LOOP SHUTDOWN MINIMUM MINIMUM PERMISSIBLE CPERABLE DEGREE OF BYPASS NO. FUNCTIONAL UNIT CHANNELS REDUNDANCY CONDIT!CNS 4a. Ctreulator IA and 18 2 1 None Shutcown - Loop Shutcown Logic 4b. Circulator 1C and 10 2 1 None Shutcown - Loop Shutcown Logic Sa. Steam Generator 2 (f) 1 None Penetration Overpressure, Loop 1 '

Sb. Steam Generator Penetration 2 (f) 1 None Overpressure, Loop 2 6a. High Reheat Header 2 (f) 1 None Activity, Loop 1 I

6b. High Reheat Header 2 (f) 1 Activity, Loco 2 Hone 7a. Low Sucerheat Header 4

2 (f) 1 Less Than 30%

Temperature, Loop 1 (p)

Rated Power  ;

7b. Low Su erheat Header 2 (f) 1 Less Than 30%

Te-cerature, Loop 2 (p) Rated Power 7c. High Differential 2 (f) 1 Teecerature Between Less Than 30% I Loop 1 and Loop 2 (p) Rated Power i l

1 Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4-8 and 4.4 9 i

1

• Fort S2. Vrain 01~

Technical Specifications

' Amendment #

Page 4.4-5a mSeification LCO 4.4.1 TaUle 4.4-3 (Part 1)

INSTRUMENT OPERAT!NG REOUIREMENTS FOR THE PLANT PROTECTIVE SYSTEL CIRCULATOR TRIP TRIP Al.LCWABLE NO. FUNCTIONAL UNIT $ETD0!NT VALUE

1. Circulator Speed < 1850 r:m Below < 2035 r:m Below

- Low sormal As Rormal As Prograved by Progra med by Feecwater Flow Feecwater F.o.

2a. Loop 1, Fixed > 230,500 lb/hr > 230,500 lb/hr Feedwater {20*.ofnor-al {20% of normal Flow - Low ( h tn Full Load) Full Load)

Circulators) 2b. Loop 2, Fixed > 230.100 lb/hr > 230,500 lb/hr Feedwater {2C%ofnormal ' [20% of normal i Flow - Low (Both Full Load) Full Load)

Circulators)

. Loss of Circulator -> 459 psid > 454 psid ,

Bearing Water ~

i 4 Circulator 1 796 osig 1 S01 psig Penetration j T rot,bl e i 5. Cir:ulator Orain -> 8.5 psid > 8.0 psid I

Malfunction ~

6. (freulater Speed - 1 11,495 rpm i 11.b84 rpm High 5ttam

7. Manual Not Not App 11:aele Applicaele Notes for Tables 4.4-1 througn 4.4-4 are on Pages 4.4-8 and 4.4-9 1

Fort St. Vrain #1 Technical Specifications Amendment #  !

Page 4.4-5b

$pectffcation LCO 4.4.1

.f Table 4.4-3 (Part 1)

INSTRUMENT OPERATING REQUtt!MENTS FOR THE PLANT PROTECTIVE SYSTEM, CIRCULATOR TRIP TRIP ALLOWA8LE NO. FUNCTIONAL UNIT SETPOINT VALUE

8. Circulator Seal 2 -5.2" H20. > -6.1" H20, Malfunction 1 +74.8" H2O 3-76.1"H2O

9. Cf reulator Speed -  ! 8,589 rpm 1 8,786 rpm High Water i l

l 1

I Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4 8 and 4.4-9 t

4 i i 1

l i

,l

Fort St. Vrain 01 Technical Specifications Amendment 4 Page .4.4-5c SPECIFICATION LCO 4.4.1 TABLE 4.4-3 (Part 21 INSTRUMENT OPERATING REQUIREMENTS FOR PLANT DROTECTIVE SYSTEM.

CIRCULATOR TRIP MINIMUM MINIMUM PERMISSIBLE OPERABLE DEGREE OF BYPASS '

NO. AJNCTIONAL UNIT CHANNELS REOUNDANCY CONDITIONS l

1. Circulator Speed 2 (f) 1 Less Than 30%

- Low (r) Rated Power 2a. Loop 1. Fixed Feed- 2 (f) 1 Less Than 30%

water Flow - Low Rated Power (Both Circulators) ,

2b. Loop 2, Fixed Feed- 2 (f) 1 Less Than 30%

water Flow - Low Rated Power (Soth Circulators)

3. Loss of Circulater 2 (f) 1 None Bearing Water (r) j 4 Circulator 2 (f) 1 None Penetration Trouble (r)

5. Circulator Drain 2 (f) 1 None Malfunction (r) ,

6. Circulator Speed - 2 (f) 1 None i

High Steam (r)

7. Manual 1 0 None

8. Circulator Seal 2 (f) 1 Opposite loop Malfunction (r) shu. own or circulator seal malfunction trip  !

of otner circulator !

In same loop

9. Circulator Speed - 2 (f) 1 None High Water i' Notes for Tables 4.4-1 through 4.4-4 are on lages 4.4-8 and 4.4-9

Fort St. Vrain #1 Technical Specifications Amendment f-Page 4.4-7a-I I

Specification LCO 4.4.1 Table 4.4-4 (PartJ INSTRL*ENT OPERATING REQUIREMENTS FOR THE PLANT PROTECTIVE SYSTEM. ROD WITHDRAWAL PROHIBIT (RWP)

,. TRIP ALLOWABLE NO. FUNCTIONAL UNIT SETPOINT VALUE

1. Startup Channel-Low > 4.2 cps > 3.2 cps Count Rate .

2a. Linear Gannel-tow > 5% >5%

Power Rh/ (Channels 3 Indicated Indicated 4 and 5) Themal Thermal Power (m) Power a

1 2b. Lineir Channel-Low > 5% >5%

Power RWP (Channels 5. Tndicated Indicated

, 7 and 8) Themal Themal 2 Power (m) Power 3a. Linear Channel-High < 30% < 30%

Power RWP (Channels 3 Indiccted Indicated #

4 and 5) Thermal Thermal Power (n) Power 3b. Linear Channel-High < 30% < 30%

Power RWP (Channels 6 Indicated Trdicated .

7 and 8) Thermal Themal t i

Power (n) Power h

v l

Notes for Tables 4.4-1 through 4.4 4 are on Pages 4.4-8 and 4.4-9 l

}

i

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-7b SPECIFICATION LCO 4.4.1 TABLE 4.4-4 (Part 2)

INSTRUMENT OPERATING REQUIREMENTS FOR REACTOR PROTECTIVE SYSTEM, ROD WITHDRAWAL PROHIBIT (RWP)

MINIMUM MINIMUM PERMISStBLE OPERABLE DEGREE OF CYPAS5 NO. FUNCTIONAL UNIT CHANNELS REDUhDANCY CONDITIONS

1. Startup Channel - Low 2 1 Above 1.0E-031 Count Rate Rated Power 2a. Linear Channel - Low 2 1 (9)

Power RWP (Channels 3, 4, and 5) 2b. Linear Channel - Low 2 1 (g)

Power RWP (Channels 6, 7 and 8) 3a. Linear Channel - High 2 (f) 1 None Power RWP (Channels 3, 4, and 5) 3b. Linear Channel - High 2 (f) 1 None Power RWP (Channels 6, 7, and 8)

Notes for Tables 4.4-1 through 4.4-4 are on Pages 4.4-8 and 4.4-9 I

1 J

Fort St. Vrair. #1 Technical Fpecifications knendment #

Pago 4.4-8 J

t SPECIFif.Af f 0N LCO 4'.4.1 NOTES FUR IABLtd 4.4 1 IHKUUGH 4.4-4 l a) ') ele ted .

b) Two themocouples film each loop, total c0 four, coatitute nne channel. For each channel, two thernoccuples must be operaP e in at least one operating loop for that channel to be censidtred operable.

c) With one primary coolant hiG h level misture monitor tripped, trips of either locp primary co.ilant moisture monitors will cause full scram. Hence, number of operable channels (1) minus minimum number required to cause scram (0) equals one, the minimum degree of redundancy.

d) Deleted.

e) One channel consists of thro undsrvoltage relayt each monitoring a single phase of a 480 VAC essential bus. A channel trip wG1 occur *when two of the three undervoltage relays comprising that channel opera te after a preset time ' delay indicating loss cf bus voltage. Initiation of a scram requires two of t5e three undervoltage relays on two of the three 480 VAC es:ientiat 7uses to operate.

f) The inoperable channel swst be in the tripped condition, unless the trip of the channel will cause the protective Action to occur. Failure to trip the inoperable channel requ9tes taking the appropriate corrective ection es listed on P ges 4.4-1 and 434 within the specified time limit.

g) RV' bypa'.s permitted if the bypass also causes associated single charinet teram. .

'<1) For loop monitors only, permissible bypass conditions viclude:

1. Any circulator buffer seal malfunc? ion.

II. Loop hot reheat header high activity.

Ill. As stated in LCO 4.9.2.

h2) Fce high level monitors only, pemissible bytass co?uith ns include: <

!. As stated in LCO 4.0.2.

j) Eele ted, k) Cte operable helium circulator inlet themocouple in an operable loro is required fer the c:hannel to be conWored coerable, m) Low Poier RWP bistatde resets at 4% after reactor power inKtiell;r exceeds 5%.

n) Power range RWP bi s tat,les rutomsdrally reset at 10% after reactor power is decrea:ea from griater than 30%. The RWP may be manually reset tetween 10% and 30% power.

p) Itam 74. must be accompanied by item 7c. for Leap 1 shutdown.

Item 7b. must be accx.panied t;y item 7c. for I. cop 2 shutdown.

\

-v. _

Fort St. Vrain #1'

-Technical Specifications

-Amendment #-

Page 4.4-10 Basis for Specification LCO 4.4.1 The plant protection system automatically initiates protective functions to prevent established- limits from being exceeded. In additten. other protective instrumentationy is provided to initiate action which mitigates the' consequences of accidents. Some protective actions are necessary only during startup and/or low Power and require bypass at power; others are required during power operation and need to be bypassed at startup and/or low power. A simple method, based on a minimum of administrative control, has been devised to' sequence and bypass protective actions. The equipment consists.of.two selector switches (Reactor Mode and Interlock Sequence) on the reactor control board. This specification provides the limiting conditions for operation necessary to preserve the effectiveness of these instrument systems.

If the minimum operable channels or the minimum degrees of redundancy for each functional unit of a table cannot be met or cannot be bypassed under the stated permissible bypass conditions, the following action shall be taken:

For Table 4.4-1, the reactor shall be shut down within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

For Table 4.4-2, the affected loop shall be shut down within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

For T&ble 4.4-3, perform one of the following within 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s:

1 1) The reactor shall be shutdoen, or

2) the affected helium circulator shall be shutdown.

For Table 4.4-4, the reactor shall be shut down within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

If, within the indicated time limit, the minimum number of operable channels and the minirnum degree of redundancy can be reestablished, the system is considered j normal and no further action needs to be taken.

The trip level settings are included in this section of the specification. The bases for these settings are briefly discussed below. Additional discussions l pertaining to the scram, loop shutdown and circulator trip inputs (nay' be found in Sections 7.1.R.3, 7.1.2.4 and 1 7.1.2.6, respectively, of the FSAR. High moisture instrumentation is discussed in Section 7.3.2 of the FSAR.

1 1

1

Fort St. Vrain el Technical Specifications knendment e Page 4.4-10a Basis for Specification LCO 4.4.1 (Continued)

• To accommodate the instrument drift assumed to occur cetween operational. tests and the accuracy to =hich Trip 5etpoints can be measured and calibratec Allowable Values '

and Trip Setpoints have been specifico in Part 1 of Tables 4.4-1 through 4.4-4 The methodology used for calculating the A'elowable Values and Trip Setpoints is discussed in Tecnnical Specification LS$1 3.3.

i

4. Scram Iaruts '

The simultanecus insertf on of the control rods will be inttfated by the following conditions:

Manual Scram A manual scram is provided to give the operator means for emergency shutdown of the reactor inde:endent of the automatic reactor protective system. The Reactor Mode Switch (RMS) in the "off" position also causes a manual scram.

Start up Channel - Wich Count Rate i

High start up count rate is provided as a scram for use during fuel leading, preoperatioral testing, or other icw power operations.  !

Linear Channel - Htch (Neutron Flum) 1 See Technical Specification LS$$ 3.3. '

7 t  ;

4 b

d l

l i

i i

I l

Fort St. Vrain 01 Technical Specifications :

Amendment

• Page 4.4-10b

]

gasis for Seecification LCO 4.4.1 (Continued)

Primary Coolant Moisture

• High See Technical $pecification LS$$ 3.3-Reheat Steam Temocratyre - Hich See Technical Specification LS$$ 3.3.

Primary Coolant pressure - Programmed Low See Technical Specification LS$$ 3.3.

Primary Coolant pressure - Programmeo High See Technical Specification LS$$ 3.3.

Het Reheat Header Pressure - Low Low reheat steam pressure is an indication of either a cold reheat steam line or a hot reheat steam line rupture in a section of line common to both loops, i i

Loss of the cold reheat steam line results in loss of the steam supply to the circulators which necessitates plant shutdown. The direct scram in this case i

crecedes a scram resulting from the two-loop trouble. '

The loss of either steam line results in loss of plant generation output, and a reactor scram is appropriate in this situation. The Trip Setpoint is selected to be below normal operating and transient levels, which i j

vary over a wide range.

a Main Steam Pressure - Low Low main steam pressure is an indication of main steam line rupture or loss of feedwater flow. Immediate shutdown of the reactor is appropriate in this case.

in aedition, the superheater outlet stop check valves are automatically cloted to reroute main steam to the flash tank (through the individual loop bypass valves and desuperheaters). This is required for the continued operation of the helium circulators on steam. The Trip Setpoint is selected to be below

normal operating levels and system transients.

1 Plant Electrical System - Loss Loss of plant electrical system power requires a scram to prevent any Power-to-Flow mismatches from occurring. A preset time delay is provided following a power loss before the scram is initiated to allow an emergency diesel generator to start. If it oces start, the scram is avoidsd.

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-10c Basis for Specification LCO 4.4.1 (Continued)

Two-Looo Trouble Scram Logic _

Operation on one loop at a maximum of about 50% power may continue following the shutdown of the other loop (unless preceded by scram as in the case of high moisture). Onset of trouble in the reenaining loop (two-loop trouble) results in a scram. Trouble is Jefined as a signal which normally initiates a 100,:

shutdown. Similarly. Simultaneous shutdown signals to both loops result in shutdown of one of the two loops only, and a reactor scram. However, actuation of both Steam Line Rupture Detection / Isolation System (SLR0!S) loops, effectively shuts down both loops because it sends an actuation logic signal to all four circulator trip logic channels. The consequences of a two-loop shutdown and subsequent loss of forced circulation have been analyzed and found to be acceptable. The -

consequences are bounded by an interruption of forttd circulation cooling accident described in FSAR Section 14.4.2.2, Safe Shutdown Cooling.

High Reactor Building Temperature (Pipe Cavity)

High tetrperature in the pipe cavity would indicate the r presence of a steam leak. A steam leak or pipe rupture under the PCRV within the support ring would also be detectable in the pipe cavity, therefore only one set of sensors and logic is required to monitor both areas. The setpoint has been set above the SLRDIS pre-trip temmrature alann.

i

Fort St. Vrain #1 Technical Specifications -

Amendment #

Page 4.4-11 4

3' 2

Basis for Specificatinn LCO 4.4.1 (Continued)

b. Loop Shutdown inputs The following loop shutdown inputs are provided primarily for equipment protection and are not relied  !

upon to protect Safety Limits. Malfunctiun of these i items could prevent a scram due to loss of the two loop trouble scram input. ,

i Shutdown of Both Circulators (Loop $hutdown Logic) ,

Shutdown of both circulators in one loop is a loop

shutdown input 50 that secondary coolant flow' is  ;

automatically isolated to the affected loop's steam l generator upon IM ) of primary coolant flow in that loop. This loop shutdown ensures proper reactor i a protection system action (scram) through the two-loop  !

> trouble scram in the event of the loss of all four circulators. Low feedwater flow to both loops can i

', result in automatic trip of all four circulators,

' which would activiate the two loop trouble scram.

1 ,

Steam Generator penetration Overpressure (Loop 1/ Loop 2)

Steam generator penetration overpressure is indicative of a pipe rupture within the penetration. A loop -

4 shutdown is appropriate for such an accident, and the helium pressurizing line to the penetration is closed

! to prevent moisture backflow to the purified helium system. The penetration overpressure is handled by '

, relief valves; however, to minimize the amount of steam / water released, the steam generator contents are -

3 also dumped, i i

< The steam generator interspace rupture discs are set ,

d at 825 psig (nominal). The burst pressure range (plus ,

j or minus 25) is 808 psig to 842 4 Specification LS$$ 3.3, Table 3.3-1)psig(Technical

. The relief valve is sized to allow a 370 psi pressure drop in a safety valve inlet line when the valve is relieving at -

nameplate capacity of 126.000 lb/hr superheated steam i

at 1000 degree F. This prevents the penetration J i pressure from exceeding the reference pressure of 845 psig. ,

1 1

I J

l i

i 1 i

Fort St. Vrain el Technical Sp?cifications Amendment

• Page 4.4-11a Basis for Specification LCO 4.4.1 (Continued)

High Reheat Header Activity - (loop 1/ Loop 2)

High reheat header activity is an indication of a reheater tube rupture resulting in leakage of reactor helium into the steam system, The Trip $etpoint ensures detection of major reheat tube ruptures and an on-scale reading, with up to design value circulating activity for post accident monitoring. Detection of smaller size Isaks or leaks with low circulating coolant activity can be detected and a la rmed by the backup reheat condensate monitors and/or the air ejector monitor.

Low Superheat Heaoer Temperature (Loop 1/ Loop 2) and Htan Otfferential Temperature Between toop 1 and Loop 2 Low superheat header temperature in a loop is indicative either of a feedwater valve or controller failure yielding an excessive loop feedwater flow rate or a deficiency c/ helium flow rate, and a loop shutdown is appropriate. The required coincident high differential temperature between loops functions to prevent the loop Trip from occurring during normal operation at low main steam temperatures such as in a normal plant shutdown.

l i

l l

i

I Fort St. Vrain #1 Technical Specifications '

Amendment #

Page 4,4-12 Basis for Specification LCO 4.4.1 (Continued)

c. Circulator $hutdown Inputs i

All circulator shutdown inputs are equipment protecticn items. With the exception of Circulator Speed High on  !

water turbine drive, all circulator shutdown inputs are ,

l

, connected to the two-loop trouble scram logic -through the loop shutdown system. These items are included in Table 4.4-3 because a r.alfunction could prevent a scram due to loss of the two-loop trouble scram input.

Circulator Speed High on water turbine drive is ,

included to afford protection to the water turbine ,

assembly against the effects of overspeed during i continued core cooling upon loss of steam drive

capability, j Circulator Speed - Low t

Too low a circulator speed causes a mismatch between thermal power input and heat removal (feedwater flow) in a steam generator, which may result in flooding the '

superheater section. The circulator Trip causes an automatic adjustment, as required, in the turbine governor setting, feedwater flow rate, and remaining.

circulator speed to maintain stable steam pressure and j

temperature conditions.

Loop 1/ Loop 2 Finod Feedwater Flow - low The Fixed Feedwater Flow - Low is an equipment protection feature designed to protoct the steam generator from overheating for complete loss of ,

feedwater flow.  !

Loss of Circulater Bearina Water In order to prevent circulatcr damage upon loss of ,

I normal and backup bearing water supplies, a gas  !

pressurized water accumulator is fired when water -

pressure falls below the Trip 5etpoint value. The i

Trip Setpoint value is selected so that adequate water pressure is available during circulator coastdown, .1' i which lasts for about 30 seconds, to maintain clearances within the circulator bearings of at least 0.001 in. Tests and analyses have shown that a Trip at 450 psid provides substantial clearance margin ,

above 0.001 in, when the circulators are operating at normal speeds.

s i

i 1

l l

a

I i Fort St. Vrain #1 i

Technical Specifications  !

Amendment #

. Page 4.4-12a '

\  ;

j Basis for Specification LC0 4.4.1 (Continued) >

i Circulator Penetration Trouble  ;

I Circulator penetration overpressure is indicative of a pipe rupture within the penetration. A circulator Trip is appropriate for such an accident and the >

helium pressurizing line to the penetration is closed '

to prevent moisture backflow to the purified helium system. The overpressure is handled by the i'

penetration relief valves. The penetration interspace rupture discs are set at 825 psig (nominal). The

" burst pressure range (plus or minus 2t) is 808 psig to

! 842 psig (Technical Specification LSSS 3.3, Table '

3.3 1). The relief valve is sized to allow a 40 psi pressure drop in the tafety valve inlet line when the .

j valve is relieving at nameplate capacity (170 gpm).

Circulator Drain Malfunction k

This Trip is provided to prevent steam from entering

the bearing of an operating circulator. A ,

1 differential pressure controller is utilized to  ;

maintain the bearing water main drain pressure above the steam turbine exhaust pressure. When the pressure differential drops, the steam water drain control  ;

valves are opened to prevent steam from entering the bearings. If the above controls do not work, three t

PPS differential pressure switches for each 8 circulator, set at greater than or equal to 8.5 psid. ,

will initiate an automatic shutdown of the circulator, 4

j Circulator Speed - High Steam ,

The speed sensing system response and Trip setting are 1 chosen so that under the maximum overs situation I possible (loss of restraining torque) peed the circulator i will remain within design criteria.

Circulator Trip - Manual (Steam / Water) j A manual Trip of each circulater for both steam and l l water turbine drives is available so that in an l

! emergency an operator can trip a circulator when  :

J required. l t

I i ,

1 i

j t 1

2

, t f

i i i

1.  !

l

For% St. Vrain #1 Technical Specifications Amendment #

Page 4.4-12b Basis for Specification LCO 4.4.1 (Continued)

Circulator Seal Malfunction (Lew/Hlom)

A high reverse differential of -6.1" H2O would be reasonable evidence that bearing water is leaking into the prima ry coolant system. An incesasing differential pressure of +76.1" H2O would be reasonable evidence that primary coolant is leakiag into the bearing water and thus into the closed circulator service system. In both cases a circulator trip with brake and seals set is appropriate.

Circulator Speed - Hioh Water the Trip Setpoint has been established above normal operating speed. Equipment testing ensures that this Trip Setpoint will prevent failure due to fatigue cracking.

Steam Leak Detection in the Reactor Bu11dino Steam Leak Detection in the Reactor Building is required for emulpment qualification of Safe Shutdown Cooling Systems. The ALLOWABLE VALUE is set at 152.8 cegrees F per minute rate of rise in order to prevent exceeding the harsh environment temperature profile to which sne safe shutdown electrical equipment is qualifted, per the requirements of 10CFR50.49, A setpoint calculation analysis performed per 15A Standard 567.04 and RG1.105 results in the stated ALLCwABLE VALUE and TRIP SETPOINT as specified in the LCO and this basis. The TRIP $ETPOINT has been established with sufficient margin between the technical specification limit for the process variable and the nominal TRIP SETPo!NT to allow for

1) inaccuracy of the instruments; 2) uncertainties in the calibration; 3) instrument drif t that could occur during the interval between calibrations; and 4) inaccuracies due to smeient temperatura changes, vibration and other environmental con 31tions. The TRIP SETPCINT is set at < 52.3 degrees F per minute rate of rise until' such time as the drift characteristics of the detection system are better understood from actual plant operating experience and the assumptions used in the setgaint analysis are verified.

SLR0!$ design incorporates two panels, each with its own set of sensors for the Reactor and Turbine Buildings and dual logic trains in each panel. The

. $LR0!$ design preserves the single failure concept. A single failure will neither cause nor prevent SLR0!$

actuation in the event of a high energy line break.

The probability of an inadvertent actuation is entremely small due to the matrix legic ecoloyed for circulator trip and valve actuation. The $LR0!$

paeols are referred to as "locos"; however, due to the way the outputs of the parels are combined to provide protective action and satisfy the single failure concept, the SLR0!$ loops do not correspond to primary or seconcary loops.

\

'i 1

For2 St. Vrain el '

Technical Specifications Amendment

• Page 4.4-12c l

Basis for Specification LCO 4 4.1 (Continued)

For each SLR0!$ loco, the OPERA 8!LITY requirements and their respective ACTICNs represent good operating practices and judgment for a four channel detection system with a 2 of 4 coincidence trip logic. The t fourth channel may be placed in bypass for test and/or maintenance purposes, subject to the ACT!0N statement restrictions, while preserving a 2 of 3 coincidence logic OPERA 8LE. The Steam Line Rupture Detection / Isolation System as designed and installed has spare channels available for input. Any of the available channels may be selected for tenut signal processing provided the surveillances are current on the channels used. The $LR0!$ is required to be OPERABLE only at power (above 24 rated thermal power).

Analyses with rated reactor cower at 2% demonstrate that automatic actuation of $LR0!$ is not likely to ,

occur during a high energy line break lasting until it is manually terminated at one hour following inittation. The temperatures as analyzed in both the reactor and turbine buildings stay well below the temperature for which the equipment is qualified.

The ACTION statements for inoperable $LR0!$ detection and information processing equipment allow one channel in each building to be inoperable for up to 7 days; a second inoperable channel in either building requires that power be reduced to below 2% within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The 7 day ACTION time for a single detector chaneel is acceptable based on preservation of a 2 out of 3 coincidence detection system still in operation.

ACTION 3 is applicable to other functions within the

$LR0!$ instrumentation panel such as loss of power '

from instrument buses, or other failures in the logic trains and associated electronics. A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time ,

period in ACTION 3 for inoperability of those associated $LR0!$ functions minimized the time that "

$LR0!$ may operate with Itaited functional capamility.

An inoperable valve or associated equipment is allowed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. High energy line break analysis for environmental qualification assumes the worst case single active failure. Thus, a single valve inoperable for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is within the bounds of '

analysis, when two or more valves and/or associated equipment is inoperable. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is allowed to restore the inoperable equipment. Repairs may be performed while the plant is at power, thus.

minimizing thermal cycling of plant and installed equipment.

Steam Leak Detection in the Turbine BW11dino is required for equtoment qualification of Safe $nuscown Cooling Systems. Thus, the limits and basis are the same as discussed in the basis for steam leak  ;

detection in the reactor building. '

t i

I 1

1

Fort St. Vrain #1 Technical Specifications Anendment #

Page 4.4-13 Basis for Specification LCO 4.4.1 (Continued)

d. Rod Withdrawal Prohibit Inputs The termination of control rod withdrawal to prevent further reactivity addition will occur with the following conditions:

Startup Channel - Low Count Rate Start up Channel . Low Count Rate is provided to prevent control rod pair withdrawal and t

l reactor startup without adequate neutron flux indication. The trip level is selected to be above the background noise level.

Linear Channel - Low Power RWP l Linear Channel (51 Power) directs the reattor i ope-ator's attention to either a downscale failure of a power range channel or improper positioning of the Interlock Sequence Switch. (FSAR Sections 7.1.2.2 and 7.1.2.8)

Linear Channel - High Power RWP Linear Channel (30% Power) is provided to prevent control red pair withdrawal if reactor power exceeds the Interlock Sequence Switch limit for the "Low Power" position. (FSA2 Sections 7.1.2.2 and l

7.1.2.8) l l

1 I

1 l

l l

1 l  !

l

Attachment 3 To P-88025 Significant Hazards Consideration Analysis

l Attachment 3 P-88025 Page 2 February 8, 1988 i i

SIGNIFICANT HAZARDS CONSIDERATIONS ANALYS!$  !

I I. INTRODUCTION l

. 1

~

. This Significant Hazards Considerations Analysis describes the reevaluation of Fort St. Vrain (FSV) Nuclear Generating l Station Plant Protective System (PPS) setpoints, and describes  ;

the method used to determine those setpoints. The results of ,

this setpoint reevaluation require a revision to the Facility i Operating License, Technical Specification LSSS 3.3, Table 3.3-1, LCO 4.4.1, and Tables 4.4-1 through 4.4-4.  ;

In response to a Comission letter from Speis to Fuller,

dated August 28, 1978, PSC reevaluated FSV PPS setpoints. As a result, PSC informed the Comission, in a letter from Lee to t Miller dated October 1, 1980 (P-80340), that the first phase of  !

identifying Instrument Trip Settings and Absolute Values for Category I and II setpoints contained in LSSS 3.3, Table 3.3-1  ;

and LC0 4.4.1. Tables 4.4-1 through 4.4-4 had been completed. In this submittal, the existing Technical Specification Trip Setpoint was redefined as the Absolute Value, and a new Trip Setpoint was calculated. The minimum difference between the Absolute Value and the new Trip Setpoint was the instrument i channel cumulative inaccuracy, determined by the least squares j method utilizing manufacturers' published accuracy data, i Included in PSC s October 1980 submittal, was supportive i information for the proposed new Absolute Values for Low Circulator Speed, Fixed Feedwater Flow - Low, Loss of Circulator i Bearing Water and the applicability of 5% and 30% Rod Withdrawal

. Prohibits.

1 In a Comission letter from Madsen to Lee, dated July 11, '

1983 (G-83255) PSC was informed that their October 1980 submittal t

did not adhere to the current practice used for the Standard Technical Specifications (STS). PSC utilized Absolute Values

rather than Allowable Values in their proposed Tecnnical Specifications. Setpoints in the STS are defined as limits with ,

either greater than or less than, in contrast to the tolerances '

with plus or minus used by PSC. In addition, PSC defined a i

reportable occurrence as exceeding an Absolute Value, as opposed to an Allowable Value. As a result, in their letter The i Comission recomended that FSV PPS setpoints be specified in

! terms of an Allowable Value and a Trip Setpoint. "expressed as

! either greater than or less than as well as equal to the value specified." The Comission also informed PSC that the method i described by the Comission was ccnsistent with industry

, consensus as stated in ISA Standard S67.04-1982, "Setpoints for l Nuclear Safety-Related Instrumentation Used in Nuclear Power i

Plants" and that the standard would be endorsed by a Commission

Regulatory Guide in the near future. (A draft of ISA Standard 7 i

l t

P-88025 Page 3 February 8,1988 S67.04 was endorsed by a draft of proposed Revision 2 to Regulatory Guide 1.105, issued for coment in December 1981.

Subsequently, this issue of ISA-S67.04 was finalized in 1982.)

The Comission requested in their letter of July 11, 1983 (G-83255), a discussion on the various types of data used and sample calculations, addressing "test equipment accuracy, process measurement accuracy, environmental effects, component accuracy and drift rates." It was also recomended that the Technical Specifications for FSV be revised to "bring them more in line with the format and degree of specifically used in STS for water reactors."

In order to clarify the method used in the calculation of setpoints, a meeting between PSC and the Comission was held on -

October 27, 1983. In this meeting, the application of ISA Standard S67.04-1982 to FSV PPS Setpoints was discussed. As described in a Comission letter dated November 3, 1983 (G-83409), PSC agreed to revise the 1980 application to include the STS type format, the analysis of Category III instruments, as defined in P-80340, and bases for the numerical values selected.

In a letter dated March 9, 1984 (P-84078), PSC enclosed the work specification for the setpoint reevaluation program for the Comission's review, which incorporated the method recomended by the Comission. In addition, PSC agreed to resubmit the proposed amendment to the Facility Operating License.

In a letter dated June 21, 1985 (P-85214), PSC submitted an amendment request to the PPS Instrumentation Technical Specification utilizing ISA Standard 567.04-1982 as guidance and in the STS upgraded format. The NRC in a letter dated January 24, 1986 (G-86053) submitted a Draft Safety Evaluation Report (SER) and requested that a new amendment, using the existing Technical Specifications with the new Trip Setpoints and Allowable Values, be resubmitted.

PSC resubmitted an amendment request dated May 15,1986(P-86279), addressing only those parameters currently specified in the existing Technical Specifications with the new analyzed Trip Setpoints and Allowable Values. Several discussions with the NRC staff were held subsequent to the May 15, 1986 letter to address an issue that arose on the methodology (based on the monthly surveillance frequency) and the basis for determining a reportable event.

The NRC staff, in a letter dated November 26,1986,(G-86624), requested that PSC resubmit the amendment request based on the refueling interval calculated Allowable Values. In a letter dated August 28, 1987 (P-87278), PSC resubmitted the amendment request on the existing PPS Technical Specification parameters using the Refueling interval revised nethodology.

i Attachment 3 '

P-88025 Page 4 February 8, 1988 In a letter dated November 25, 1987 (G-87422), the NRC submitted a Draf t Technical Evaluation Report (TER), including portions of the January 24, 1986 SER, and addressing additional issues as a result of the August 28, 1987 amendment request. On December 3, 1987, a PSC/NRC meeting was held to discuss and teach resolution on the conclusions documented in the above Draft TER. ,

This Significant Hazards Consideration Analysis supports the proposed amendment in Attachment 2 of this letter.

P M

i I

I I

b

_ .- . - . - _ . . . - - = _ . - ~~. .

i.

3 Attachment 3 l P-88025 ,

Page 5 t i February 8, 1988  !

i l II. METHODOLOGY

' The method used by PSC for the reevaluation of PPS setpoints [

was rduested by the Comission in the October 27, 1983 meeting i between PSC and the Comission and submitted to the Commission  ;

in t. Ietter dated March 9, 1984 (P-84078). ISA Standard 567.04  !

i 1982 was used by PSC as a guideline, and the standard, was 1 endorf,ed in Revision 2 to Regulatory Guide 1.105, February, 1986.  !

There fore, the method used as guidance for reevaluation has been recoamended for use by both the nuclear industry and the Commission.

i ISA Standard 567.04-1982 defines Safety Limits as "limits '

ucon important process variables which are found to be necessary to reasonably protect the integrity of certain physical barriers t which guard against the uncontrolled release of radioactivity."

Specifically, in the FSV Technical Specifications, "Safety Limits i are defined to protect the fuel particle integrity and the j integrity of the primary reactor coolant system boundaries. The (

integrity of these barriers will ensure that an uncontrolled  :

release of radioactivity could not occur." Thus, the specific physical barriers protected at FSV are the fuel particle coating and the primary coolant system boundaries. ,

I The FSV Technical Specifications also define the Limiting Safety System Settings (LSSS), which "are established for l

} instrumentation and protective devices related to the process }

l variables upon which Safety Limits are based." The LSSS >

parameters monitored by instrumentation at FSV are listed in  ;

Technical Specification LSSS 3.3, N ble 3.3-1, as follows: High  !

j Neutron Flux, High Reheat Steam Temperature, Low Primary Coolant >

{ Pressure, High Primary Coolant Pressure, and High Moisture in the  ;

j Primary Coolant.  !

ISA 567.04-1982 applies only to LSSS parameters associated

{ with Safety Limits. In the October 27, 1983 meeting between PSC i and the Comission, the Comission requested that FSC apply the  ;

ISA Standard to all FSV PPS parameters. The majority of FSV PPS  !

j parameters protect safety related equipment and are not  !

i associated with the Safety Limits. Therefore, the Comission i j requested PSC to identify an "Analysis Value" for each parameter, l whether it be an LSSS parameter or not.

l The Analysis Value is the value of a parameter for which a j trip and initiation of automatic protective action is assumed to '

j occur in FSV accident analyses. Provided that the trip occurs at l a value equal to or more conservative than the Analysis Value, analyses demonstrate that consequences of the accident or transient are acceptable and do not exceed Safety Limits or squipment design limits. Since safety analyses documented in the j P-88025 Page 6 February 8, 1988 FSV FSAR assume that trip and initiation of automatic protective action occur at the least conservative trip setting permitted by the current Technical Specifications Tables 4.4-1, 4.4-2, and 4.4-3, for any parameter, these Trip Settings are the Analysis Values. The Comission requested that PSC apply the ISA Standard methodology to these Analysis Values to arrive at Monthly Allowable Values and Trip Setpoints for each PPS parameter.

The factors which are identified by the ISA Standard and considered in the determination of Analysis Values are:

(1) The effects of potential transient overshoot. (Section 4.3.1 (4))

(2) The effects of transient time response characteristics.

(Section 4.3.1 (5))

(3) Process measurement inaccuracy. (Section4.3.1(3))

The effects of these factors are discussed for each Analysis Value.

The ISA Standard states that "For each LSSS a Trip Setpoint and its associated Allowable Value shall be established." An Allowable Value is defined in the ISA Standard by the allowances for instrument error between the Allowable Value and the Safety Limit. These allowances are divided into six factors in Section 4.3.1 of ISA 567.04-1982. Three of these factors are accounted for in the determination of the Analysis Value (as described above), using PSC's revised ISA methodology. The remaining three factors contributing to instrument error and used to detemine the Monthly Allowable Values have been addressed in the following manner:

(1) Accuracy (including drift) of components not tested when the setpoint is measured. (Section 4.3.1 (1))

This factor was detemined by PSC as the accuracy, including drift, of components not tested when the monthly surveillance is perfomed. The greater of two values, either the manufacturer's inaccuracy or the yearly drift, was used in the Monthly Allowable Value calculation.

(2) Accuracy of test equipment. (Section 4.3.1 (2))

Test equipment accuracy was detemined by PSC using the manufacturer's quoted accur6cy of the least accurate P-88025 Page 7 -

February 8. 1988 equipment permitted to be used for a given surveillance.

(3) Environmental effects on equipment accuracy (Section 4.3.1 (6))

These were determined using the environmental qualification report and manufacturer's data. The' use of the environmental qualification report and method of-application in many cases resulted in the use of a more conservative value than required by the ISA Standar6.

The environmental qualification report gives the most extreme conditions for which the equipment is qualified. The ISA Standard requires only that the conditions which are a result of the accident which that particular component is required to miti5 ate be considered. Also, the effects- of seismic and environmental events were combined as.if these events occurred simultaneously, which is more restrictive than the design basis accident analysis for FSV.

The items considered above were combined using the square root of the sum of the squares where no common source error existed and algebraically when the effects could occur concurrently. A "total inaccuracy" value was calculated which was used to determine the margin between the Analysis Value and the Monthly Allowable Value.

The Trip Setpoint, according to the ISA Standard, is to be established by determining the margin for drift between the Monthly Allowable Value and Trip Setpoint. This margin is defined by the ISA Standard as "Drift of that portion of the instrument channel which is tested when the setpoint is determined." In the October 27, 1983 meeting, the Cocinission further specified that the test of the instrument channel to be utilized for this drift consideration is the monthly functional test, as opposed to the annual calibration test. The drift of the latter is taken into consideration in the allowances between the Analysis Value and the Monthly Allowable Value. For certain parameters, the portion of the instrument channel which is tested monthly is checked only for logic operability by pulse testing.

Therefore, the Monthly Allowable Value and the Trip Setpoint are the same for those parameters. Two years of monthly surveillance data was reviewed to determine instrument channel drift.

In the process of applying ISA Standard S67.04 1982 to FSV PPS setpoints, certain Trip Setpoints resulted which could infringe on the normal operating range of their parameters.

Operation with these setpoints would result in unnecessary reactor scrams, loop shutdowns and circulator trips occurring

i Attachment 3 i P-8802S Page 8 ,

February 8, 1988 I

4 ,

)

during minor transients under nomal operating conditions.

, In l these cases, en evaluation was performed to determine if a less conservative Analysis Value could be used, which continued to <

protect the Safety Limit or equipment design limit. The reanalyzed Analysis Values and their resulting Trip Setpoints continue to provide overall plant safety. Their reanalysis will reduce the number of challenges to plant systems without i 4

significant reduction in margins from the Safety Limit or equipment design limit.

The reanalyzed Analysis Values are discussed in detail in-the following section.

PSC notified the NRC in late 1986 of concerns regarding  :

identification of the "Monthly Allowable Value" in the FSV Technical Specification. The concerns centered on reportability  !

of instrument Trip Setpoints determined in surveillances which  ;

- exceed the Monthly Allowable Value. As explained above, the Monthly Allowable Value is offset from the Analysis Value by a

• margin which accomodates, among other items, the accuracy or <

drift (whicheverisgreater) of components in the instrument t train not tested in the monthly Technical Specification  !

Surveillance. #

j The Trip Setpoint is offset from the Monthly Allowable Value i by a margin which accommodates drift of componerts in the instrument train which are tested~- in the monthly Technical

} Specification Surveillance.

4 4

For those monthly surveillances in which the Trip Setpoint I

! is determined (as stated above, it is not determined for certain  !

J parameters pulse tested monthly for logic operability), it is i anticipated that the AS FOUND Trip Setpoint will be more conservative than the Monthly Allowable Value. Provided the l

t i

portion of the instrument train which is tested in the acnthly surveillance has not drifted excessively and the AS FOUND Trip Setpoint remains below the Monthly Allowable Value, the margin  :

l between the Monthly Allowable Value and the Analysis Value i

provides assurance that the entire instrument train will actuate i

the trip function before the measured parameter reaches the '

. Analysis Value, in addition to the monthly surveillances, the -

1 Technical Specifications also require that the PPS instrument  !

! trains be tested in an annual /rofueling surveillance. Typically. .

I the annual / refueling surveillance tests all components in an '

instrument train, from the detector to the final trip device.  ;

Provided the entire instrument train is capable of actuating its  !

trip function before the measured parameter reaches the Analysis  !

i Value, it will accomplish its safety function. It is likely that l l the Trip Setpoint of the entire instrument train, as determined i 1

in the annual / refueling surveillance, will exceed the Monthly l

)

l l

A22achment 3

. P-88025 Page 9 February 8, 1988 l t

I Allowable Value, since the margin between the Trip Setpoint and  ;

t the Monthly Allowable Value only accommodates drif t of those  ;

components in the instrument train which are tested during the 2

monthly surveillance. The margin between the Trip Setpoint and the Monthly Allowable Value does not accommodate accuracy and drift of the remaining components in the instrument train, which  !

are tested in the annual / refueling surveillance. Therefore, the  :

Monthly Allowable Value can not be compared to the Trip Setpoint  !

of the entire instrument train which is typically determined in l

the annual / refueling surveillance to assess capability of the  ;

1 instrument train to perform its safety function. Since the  ;

Monthly Allowable Value only applies to monthly surveillances, the NRC decided that the Monthly Allowable Value should not be .

incorporated into the FSV Technical Specification since its  !

incorporation would result in reportable occurrences whenever the 4

Trip Setpoint determined in the annual / refueling surveillance exceeded the Monthly Allowable Value, even though the instrument  ;

ma be capable of performing its safety function (trip actuation e ore the measured parameter reaches the Analysis Value)._ In

NRC Letter dated 11/26/86, Heitner to Williams (G-86624), the NRC recomended that PSC "propose Technical Specifications based on the annual (or refueling interval) allowable values. Monthly 1

al*owable values should be the basis for your administrative Controls."

l " An.,ual/ refueling Allowable Values" (referred to simply as

Allowable Values) are calculated by applying paragraph 4.3.1 of 1 the ISA Standard S67.04-1982 to the annual / refueling surveillances. The margin between the Analysis Value and the Allowable Value (not the Mcnthly Allowable Value) accomodates, j among other items, accuracy'or drift (whichever is greater) of  !

components in the instrument train not tested in the annual / refueling surveillance. Since the entire instrument train j from detector to the final trip device is tested in all but

] several annual / refueling surveillances, the margin between the .

j Allowable Value and the Analysis Value is much less than that .

between the Analysis Value and the Monthly Allowable Value.

Provided the AS FOUND Trip Setpoint determined in the  !

I innual/ refueling surveillance is more conservative than the 1 Allowable Value, there is assurance that the instrument train

} would actuate its trip function before the Analysis Value is 1 reached, thus accomplishing its safety function. For this reason j i the Allowable Values, which are based on the annual / refueling  ;

j surveillance, will be incorporated into the FSV Technical j 1 Specifications. The factors contributing to Instrument error and j used to determine the Allowable Value are as follows:

1 1

1 l

1 1

1 Attachment 3 P-88025 .

Page 10 t a

February 8, 1988  ;

(1) Accuracy (including Drift) of components not calibrated when the setpoint is measured during the annual / refueling surveillance. [

This factor was determined by PSC as the greater of (1) the

component's accuracy or (2) The drift data from the annual / refueling calibrations.  ;

t

(2) Accuracy of Test Equipment. l This factor was determined by PSC as the accuracy of.the  !

test equipment used to calibrate instruments during the annual / refueling surveillence. {

(3) Design Drift Allowances.  ;

These factors were determined by PSC as the accuracies for  ;

environmental and seismic effects, power supply variations, i vibration, etc.

The above items were combined using the square root of the  !

sum of the squares. A total inaccuracy value was calculated and '

was used to determine the margin between the Analysis Value and i i

4 the Allowable Value.

3 The 5% and 30% reactor power Rod Withdrawal Prohibits, Table j 4.4-4 of the Technical Specifications, were not analyzed in this

! program. They are administrative in nature and no credit is .

! taken for them in accident analyses; therefore, the ISA Standard i does not apply. Trip Setpoints and Allowable Values for those i

} parameters have been established to assure operator compliance with Administrative Procedures to maintain the Interlock Sequence 4

Switch in the proper position consistent with the reactor power level. The issue of not applying instrumentation uncertainties ,

to the RWP Instrumentation for future submittals is considered an  :

NRC open Item as addressed in the Draft TER of November 25, 1987, i l

l 1 i

1 l l i

4 1

i

t Attachment 3 i P-88025 Page 11  !

February 8, 1988 L

)

III. EVALUATION

, A. PRIMARY COOLANT PRESSURE LOW I

i Primary Coolant Pressure - Low is listed in FSV

Technical Specification LSSS 3.3, Table 3.3-1. Although low  ;

primary coolant pressure itself is not a Safety Limit, it is

an indication of inadequate core cooling and protects PCRV 1 internal thermal temperature limits. The'present Technical

SpecificationTripSettingoff50 psi below normal gage

pressure, programed with circulator inlet temperature, was established for depressurization accidents analyzed in FSAR sections 14.11, 4.3.3, 14.7 and 14.8.

l Design Basis Accident No. 2 (DBA-2) "Rapid ,

Depressurization/ Blowdown," FSAR Section 14.11, assumes primary coolant pressure decay is instantaneous in the analysis of subsequent cooling. Therefore, the consequences l I of DBA-2 are not affected by changing the Primary Coolant ,

! Pressure - Low Analysis Value. '

1 q For the Maximum Credible Accident analyzed in FSAR i Section 4.3.3 and 14.8, multiple failures are assumed in 1

conjunction with the offset rupture of 2 inch diameter

] helium purification system regeneration piping. The 4

accident is assumed to occur from 100% rated power. The PCRV pressure decays due to a loss of primary coolant ,

i inventory at a rate corresponding to a time constant of

• about 1600 seconds. Primary coolant pressure drops 50 psi

, below normal at about 120 seconds, at which time primary coolant flow is 97% of rated, and the average core outlet temperature has peaked at 13 degrees F above normal for 100%  !

power operation. '

I l For an analysis value of 90 psi below normal, reactor  !

scram occurs at about 220 seconds after the loss of helium i

, is initiated. This results in primary coolant flow of 92.5% l of rated flow at the time of the trip, and a peak average i l core outlet temperature of 44 degrees F above normal for )'

100% power operation. After the reactor scram, the core

! outlet temperature declines steadily with continued core  ;

4 cooling by the continually decreasing primary coolant  !

inventory.

, The effects of an ingress of air due to the decreasing  ;

i primary coolant temperature after completion of the  :

i depressurization are analyzed in Section 14.11.2.3.1 of the <

! FSAR. This analysis hypothesizes an instantaneous primary l 1

coolant system depressurization, As a result, reactor scram (

is also instantaneous and therefore the low primary coolant i I

~ _ _ _ - _ _ _ _ _ _ __._-___ J

Attachment 3 P-88025  :

Page 12 l February 8, 1988 '

pressure setpoint does not affect the consequences of the

, accident.

, Analyses were performed to determine the effects of an.

Analysis Value of 90 psig below normal by evaluating the end i points at 100% and 25% load using the SCAP heat balance code. The results demonstrate the operation 90 psi below normal is acceg:able. The reduction in helium pressure from l 700 psia to 610 psia at 100% power, and about 615 psia to about 525 psia at 25% power, results in a reduced helium density. The circulator speeds increase from about 8263 rpm ,

to about 3004 rpm at 25% power, to compensate for the reduced helium density. Because the circulator speeds '

increase, helium flow does not drop significantly. Helium

• flow decreases to about 3,484,285 lb/hr from 3,532,213 lb/hr i at 100% power, and decreases to about 1,053,262 lb/hr from about 1,059,439 lb/hr at 25% power. Core power to flow ratio changes only .01 at both 25% and 100% power. Helium temperatures at the steam generator inlet only change from l

, about 1383 degrees F to about 1392 degrees F at 100% power,  ;

j and from about 1192 degrees F to about 1194 degrees F at 25%  ;

power. 1 As demonstrated by the analyses described above, the i effects of changing t b Analysis Value for Primary Coolant f

] Pressure - Low f rom 50 psi to 90 psi below normal programed

> pressure are not significant. The new Analysis Value continues to protect against inadequate core cooling and 1

3 exceeding PCRV internal temperature limits. '

B. PRIMARY COOLANT PRESSURE - HIGH l

High primary coolant pressure indicates continued i steam / water leakage into the PCRV and serves as a backup trip to the PPS moisture monitors. For significant steam

leakage into the PCRV, compounded by coincident failure of 1

the redundant moisture monitors, the high primary coolant pressure trip initiates reactor scram, ' hutdown and dump of a preselected loop, and main steam debressurization of the i

remaining operating loop. These actiois are designed to j prevent opening the PCRV relief valv;s. The high primary ,

coolant pressure trip is programmed with reactor power  !

1 (using circulator inlet temperature), with the most severe 4 consequences, in terms of graphite oxidation, occurring at "

l 100% power. l

! The existing value of 7.5% above nonnal, programed

with reactor power, has been reanalyzed to justify an ,

) Analysis Value of 70 psi above normal gage pressure.  :

1 l i  !

I 1

.. . . _ - . .. . . .__. _ - . = -.

i  !

Attachment 3 e P-88025 i j Page 13 j j February 8, 1988 .

i f 1 3

FSAR Section 14.5.3 analyzes six accident cases j i resulting from steam ingress into the PCRV. Cases 1 and 3 1

! are r.ot included here because they analyze events which are  !

I detected Jy the moisture monitors, so the high primary i j coolant systen pressure setpoint is not reached. Cases 2 '

4, 5 and 6 postulate multiple failures in the. moisture  :

monitor system, resulting in a high primary coolant pressure l l trip. Therefore, these cases have been reanalyzed for a '

high primary coolant pressure Analysis Value of 70 psi above t normal,, programed with reactor power by utilizing circulttor inlet temperature. Since a leak from 100% power ,

causes the most severe consequences in terms of graphite  !

oxidation, only a trip at 100t power has been_ reanalyzed, t t Multiple failures must take place in the moisture tenitor  !

, system before action by the high primary coolant preswre  :

! trip occurs, therefore no additional failures in the high l primary coolant pressure system are assumed in the accident .

l scenardos. .

i j For each case reanalyzed, the same conditions are '

applied. Cooling is continued with the remaining operating .

! main loop for about 30 minutes, at which time the l

temperature of the core and the steam generators is about.  :

i 500 cegrees F. If, at this time, PCRY pressure indicates i

significant leakage in the operating loop, the economizer- l 1 evaporator-superheater sections are isolated and dumped, and .

j the reheater sections in that loop are flooded. No credit  !

4 is taken in these reanalyses for moisture removal by '

i condensation in the primary circuit excluding the graphite, '

or by the helium purification system.  !

i l

FSAR 14.5.3.2 Case 2 - Subheader Rupture and Wrong Loop Dump .  ;

l

. PCRV Pressure, steam content and maximum graphite I

! temperature during this accident scenario are shown in  ;

Figure 2. ,

1 -

1 As a result of the failure of the redundant moisture '

j monitors in the leaking loop, the high moisture level is

detected by the monitors in the intact loop in about 13.6 ,

! seconds. The intact loop is then tripped, shutdown and f j dumped, concurrent with a reactor scram. The leaking loop,

, continuing to operate, leaks at the equilibrium rate of 21.5  ;

i lb/sec. Cooling after the scram tends to reduce the system i

.j pressure, but the continued steam / water leakage and steam j j formation will cause the pressure to rise. In about 2  !

3 minutes the Analysis Value of 70 psi above normal pressure. l

! programmed with circulator inlet temperature, is reached due i i

to the reduction in circulator inlet temperature. At this j I

L Attachment 3 P-88025 4 Page 14 -

February 8, 1988 e

time, a feedwater pressure reduction is initiated for the 1 leaking loop which further reduces- the leakage rate. A '

maximum primary coolant pressure of 739 psia is reached approximately 10 minutes after the start of the leak.  ;

For the next 20 minutes the PCRV pressure rises and ,

falls, reaching a value of 648 psia at the end of the 30 minute main loop cooldown. From this point on, cooling is j accomplished with the flooded reheaters, and the main ,

section of the leaking steam generator is isolated and dumped. During the cooldown utilizing the flooded 4

reheaters, the pressure rises to 658 psia but the steam-graphite reaction is negligible due to the low temperature '

of the graphite. The steam / water leakage for this case is l

15,000 lbs. of which only 180 lbs. react with the core graphite as shown in Table 1.  ;

FSAR 14.5.3.4 Case 4 - Subheader Rupture with Moisture Monitor Failure and Correct Loop Dump l For this accident, the redundant moisture monitors in both loopc are assu,yd to fail to detect and dump the .

leaking steam generatot. Water / steam continues to leak into the primary coolant system until the analysis Value, l equivalent to 770 psia for this case, is reached at 157 seconds. A reactor scram is initiated and the correct loop '

) is isolated and dumped. Of the 3200 lbs, total H2O inleakage, 1112 lbs. react with the core graphite, as shown

) by Figure 3. In this case, reactor cooling utilizing i feedwater is maintained by the remaining operating loop for 1 the total duration of the accident since the leaking loop was correctly isolated and dumped. ,

FSAR 14.5.3.4 Case 5 - Subheader Rupture with Moisture Monitor Failure and Wrong loop Dump

]

l In this case, the moisture monitors are assumed to fail so that a reactor scram with an insnediate turbine trip and a j steam generator dump of one loop is initiated on high PCRV J

pressure (775 psia) at 157 seconds. Further, the wrong loop ,

is dumped but the faulty loop, which is used for the i cooldown, is operated at reduced pressure to , minimize steam 1 inleakage during the cooldown. The maximum pressure reached i during the 30 minutes of main loop cooling is 783 psit at ,

j 200 seconds after the start of the leak. During cooling the i total H2O inleakage for this case is 15,600 lbs, of which  ;

j 1162 lbs, reacts with the core graphite, as is shown on j 4 Figure 4 l 1

1 l

_ . - _ - -~. -. _ , . -. _ _ _ _ . . - - ._ _ . _ . . - - , _ _ . _ . . . _ - . . . _ _

Attachment 3 +

P-88025 Page 15 February 8, 1988 It is noted that the 15,600 lbs. total H2O inleakage is a slight reducticn from the 15,740 lbs. value.shown in FSAR ,

Table 14.5-1. The initial evaluation, contrary to Note (3) of the table, assumed for Case No. 5 only, that the leakage ,

was terminated after 30 minutes from scram and not 30 .

minutes from the start of the leakage. This inconsistency has been corrected in this evaluation.

FSAR 14.5.3.4 Case 6 - Subheader Rupture with Moisture Monitor Failure, Correct Loop Isolation and Failure to Dump l

In this case, moisture monitors in both loops are postulated to fail to detect the leaking steam generator.

Water / steam continues to leak into the primary coolant until l i the Analysis Value, equivalent to 775 psia is reached at 157  !

seconds. A reactor scram is initiated at this point and the t leaking loop is isolated but not dumped. During the 157 ,

seconds prior to 1 solation of the leaking loop, about 3200  ;

, lbs. of H2O will leak into the primary coolant system.  ;

l Following this initial inleakage, the entire 6000 lbs. i

inventory of the steam generator is assumed to enter the r i primary coolant s) stem. Conservatively assuming that the j

isolated leaking steani generator is pressurized to 1000 psia  ;

l because of steam line isolation valve leakage, the draining l rate it specified as the inleakage rate from an operating j leaking loop with reduced feedwater pressure (about 8  ;

l lb/sec.). The primary coolant pressure reaches a peak of  :

i 785 psia 200 seconds after the start of the leak. Figure 5 3'

shows that the total H2O inleakage for this case is about 9200 lbs., of which approximately 1200 lbs. reacts with the core graphite.

C, LOW SUPERHEAT HEADER TEMPERATURE AND HIGH DIFFERENTIAL TEMPERATURE BETWEEN LOOP 1 and LOOP 2 Low superheat header temperature, in conjunction with

! high differential ten,perature between loop 1 and loop 2, initiates a ittp shutdown. The function of the Low

( Superheat Header Temperature trip is to provide safe i

shutdown of a loop on early indication of potential superheater header floodout. This action will also preclude 1 unnecessary turbine trips when only a loop trip is required 1 to prevent wet steam or water from flowing into the main J

tu rbi r.e . The turbine control system, which includes a low main steam temperature turbine trip, is available as a backup to the loop trip.

] The existing Low Superheat Header Temperature Analysis j Value of 800 Negree F has been reanalyzed to justify an j Analysis Value of 780 degree F. At normal main steam

.i

?

. . - ~ . . . - _ - . . . . .- . - , , .

i i i

Attachment 3 2

P-88025 7 i Page 16 a j February 8, 1988 - . ,!

! operating pressure of 2400 psig, the satur2 tion {floodout)

temperature of the steam is about 660 degree F. The Low  ;

t Superheat Header Temperature Analysis Value of 780 degree F

!j was selected to provide early indication of a floodout event [

but to be sufficiently below the expected main steam i temperature range to avoid spurious trips during normal 1 plant operation.

l A 65 degree F High Differential Temperature Between [

a Loops Analysis Value was reviewed to determine if this 15  !

degree higher value would result in a significant time delay <

! in the initiation of the loop trip after a flow imbalance event begins. Since the operating intac' loop main steam temperature will be controlled at the nominal setpoints of -

about 880 degree F at 30% load and 1000 degree F at 100%

load, the loop temperature differences will be between

approximately 80 and 200 degree F when the malfunctioning ,

j loop reaches the Low Superheat Header Temperature setpoint. 1 3

Therefore, High Differential Temperature Between Loops 1 and i 2 will be tripped first, before the_ Los Superheat Header  !

! Temoerature trip occurs, even if the differential l teraperature trip does not occur until the Analysis Value of i 65 degree F is reached. "

)

I

} The low main steam temperature setpoint for the turbine

! trip is 800 degree F, therefore, the loop trip interaction i

with this system was reviewed to determine if trip of a malfunctioning loop occurs first over the normal power

) operating range of the plant. Main steam from the two loops ,

} is mixed upstream of the turbine inlet temperature sensors.

] The temperature of this mixture is compared with malfunctioning loop temperature at the point at which  !

Analysis Values for Low Superheat Header Temperature and

High Differential Temperature Between Loops are reached. ,

j This analysis is presented here and demonstrates that the '

j conditions for trip of a malfunctioning loop are attained j prior to reaching the turbine trip setpoint.  ;

k i I

i

! l l  ! '

4 l

I l

i i

l _ . ____

1

.= v P-88025 -

Page 17 February 8, 1988 30% i-ower Malfunctioning Loop Temp: 780 degree F Other Loop Temp: 880 degree F Turbine Mixed Inlet Steam Temp: 830 degree F Loop-to-Loop delta T: 100 degree F 100% Power Malfunctioning Loop Temp: 780 degree F Other Lc,0 Temp: 1000 degree F Turbine Mixed Inlet Stean Temp: 890 degree F Loo,1-to-Loop delta 7: 220 dsgree F From the above it can be seen that conditions for trip of a malfunction'ing loop are astained prior to reaching the

-turbine trip setpoint. Therefore, turbine trip ~is precluded dur to a single malfunctioning loop over the plant power operating range. ,

The new Analysis Values for Low Superheat Header Temperature and Hich Differential Temp. era ture continue to ensure that steam generator floodout does not occur. In addition, they ensure that unnecessary trips of the turbine do not occur due to low main steam temperature.

D. CIRCULATCR SPEED LOW Low circulator speed initiates a circu!ator trip to avert a loop shutdown as a result of only one malfunctioning-circulator. Low circulator speed indicates speed control or equipment malfunction, resulting in decreased helium floy.

This may cause a mismatch between heat input and heat removal (by feedwater flow) in a steam generator, resulting in a loop shutdown due to Low Supecheat Header Temperature -

High Differential Betwetn Loops (discussed in the previous paragraphs). The remaining c'rculator in the affected loop is relcased to exceed its nerni programmed speed, allowing operation at up to 50% power on a single loop.

The existing Technica! Specifkation trip setting of 1910 rpm below normal as programmed by feedwater flow, has been reanalyzed to justify an A mlysis Value of 2390 rpm.

Circulator coastdown characteristics are such that circt:lator m:1 functions are detected quickly on the basis of a speed measurement. Upon complete loss of drivino power, the time taken to coast down 25% (2390 rpm) from rated steed is c seconds;. at part load the time would be up to 4.

seconas. PPS~ action has an intentional delay of 5 seconds i

v i

P-88025 Page 18 February 8, 1988 to discriminate against transient speed deviations. The time constant of the steam generator superheater header temperature responding to a change in helium flow is approximately 30 seconds. Therefore, a reduction in circulator speed of 2390 rpm (Analysis Value) in less than 30 seconds will result in the trip of a single circulator followed by a power runback (if required) and a speedup of the remaining circulator, thus avoiding a loop trip on Low Superheat Header Temperature.

E. LOSS OF CIRCULATOR BEARING WATER Loss of circulator bearing water initiates a circulator trip to ensure sufficient lubrication for circulator bearings. Recirculating water is supplied to each circulator bearing, set at about 170 gpm and at a pressure about 640 psi above primary coolant pressure. Each circulator bearing set includes two journal bearings, a main thrust bearing and a reverse thrust bearing. The recirculating water is normally supplied by 2 of 3 (1 standby) pumps and is referred to as the normal bearing water (NBW). A backup source is available from the feedwater system and is referred to as backup bearing water (BUBW). Given the sudden loss of bearing water from both of the above two sources, a third supply is available for safe shutdown of the circulator. This safe shutdown supply consists of a gas pressurizer and water accumulator capable of supplying bearing water for at least 30 seconds at' design flow rate. This is adequate for safe shutdown of tha affected circulator.

The setpoint at which the accumulator is fired given a sudden loss of bearing water is the subject of this evaluation. The setpoint needs to be sufficiently high to ensure the bearings are not damaged and yet low encugh not to cause unnecessary circulator trips during plant transients, including transfers from NBW to BVBW.

I l

l l

Attachment 3 P-88025 Page 19 February 8, 1988

1. Bearing Clearances Normal operating clearances for the circulator bearings are:

Turbine Journal Bearing (centered) 0.0025 in.

Compressor Journal Pearing (centered) 0.0035 in.

Main Thrust Bearing (centered) 0.0045'in.

Reverse Thrust Bearing (centered) 0.0045 in.

A clearance of 0.001 in. is conservatively selected as the minimum clearance to assure adequate lubrication during shutdown of a circulator from 100% speed.

2. Circulator Shutdown Tests Bearing pressure dynamics during circulator shutdown were measured as a part of the RT-368B tests. During these tests, the NBW and BUBW supplies were terminated and an accumulator was fired at the 475 psid setpoint.

Following accumulator firing, momentary dips in bearing cartridge differential pressure were recorded on Brush recorders during the transfer to the accumulator water supply. Minimum pressures observed during these dips are:

Circulator Minimum Pressure (psid)

A 405 8 405 C 375 D 378 For 'C' and 'D' circulators, these dips in delta P occurred within 0.5 seconds after firing of the accumulator and recovered within 1 second to above 400 psid and within 4 seconds to 450 psid.

From this data, it follows that if the accumulators were fired at 450 psid instead of 475 psid, the momentary pressure dips would also be 25 psi less, or a minimum of 350 psid for the 'C' circulator.

, 3. Journal Bearings Each circulator is equipped with two journal bearings.

The purpose of the bearings is to center the shaft in the housing. Load on the journal bearings is solely a function of the imbalance on the rotor. Prior to assembly of the FSV circulators, the rotor is balanced

P-88025 Page 20 February 8, 1988 so that the residual static imbalance and the dynamically imposed imbalance due to the coupling moments during rotation is less than 0.2 inch ounces in 10,800 rpm with a bearing water flow generated delta P of 700 psid across the bearing housing. Displacement increases with' increasing circulator speed.

Since the stiffness of the bearings is generated by the pressure differential across them, as the pressure drops the stiffness decreases, and therefore for the same imbalance load the shaft displacement will increase. Thus, at 350 psid, the shaft displacement will only be 0.00008 in, at 10,800 rpm with an imbalance of 0.2 inch ounces. Thus, it can be seen that the minimum delta P that may occur during a sudden loss of bearing water incident has practically no effect on the journal bearing operating clearances.

Further evidence as to the large margin of safety on the journal bearings was demonstrated in tests performed as part of RT-3688. For these tests, the circulators were shut down with pressure drops across the bearings of only 50 psid, generated by accumulator water flow. This pressure drop is considered adequate to shut down the circulator from 8000 RPM.

4 Thrust Bearings Each circulator is also equipped with two thrust bearings: a main thrust bearing, and a reverse thrust bearing. Extensive design margin in these thrust bearings occurs at the design operating speed where the generated thrust is - 2000 lbs. (i.e., the thrust load is carried by the reverse thrust bearing). The thrust goes through zero at 90% speed and up to a running maximum of +8000 lbs. on the main thrust bearing at 30%

speed.

The maximum load on the reverse thrust bearing would occur during a rapid PCRV depressurization event while the circulator is at 100% speed. During this event, the operating reverse thrust load would increase from 2000 lbs. to 2900 lbs. in conjunction with the helium pressure decay while the reheat steam pressure in the circulator turbine would remain at operating pressure.

For this reverse thrust load, a bearing water pressure of 263 psid is required to maintain a clearance of 0.001 in on the reverse thrust bearing.  ;

P-88025 Page 21 February 8, 1988 The thrust load on the main thrust bearing, as described above, varies with circulator speed, and is about 8000 lbs. at 30% of rated speed. This bearing, however, was designed to accept a maximum thrust load of 11,400 lbs. Assuming a minimum 350 psid bearing water pressure as discussed under "Circulator Shutdown Tests", the minimum clearance of 0.001 is maintained with the maximum thrust load (11,400 lbs.) at normal  ;

circulator operating speeds. The clearance improves with increasing circulator speed as shown in the attached table.

Running Clearance for Circulator Speed 350 psid Bearing delta P (RPM) and 11,400 Thrust load 2,000 0.0010 4,000 0.0011 6,000 0.0012 8,000 0.0014 10,000 0.0018 There is one case resulting from multiple failures, in which the running clearance on the main thrust bearing ,

is reduced slightly below 0.001 in. This case is an offset steam generator tube rupture with wrong loop dump, producing high PCRV pressure but below the PCRV relief valves' setpoint. A circulator in the shutdown loop is self-turbining at 300 rpm with atmospheric circulator steam turbine. Under the above conditions, the maximum thrust load of 11,400 lbs. is experienced.

With sudden loss of bearing water, the rotor is stopped by application of the brake within 6 to 10 seconds.

Assuming the minimum bearing pressure of 350 psid, the running clearance is reduced during the 6 to 10 seconds shutdown time to 0.0009 in. This would not cause any damage to the main thrust bearing. In fact, the original (first prototype) circulator tested at Valmont had no brakes and was normally stopped by reducing the bearing water flow and allowing the thrust runner to rub on the bearing surface. No damage occurred to the thrust runner es a result of this shutdown method.

Thus, at any speed above self-turbining, the shaft clearance will be maintained over the conservative 0.001 in, value during a circulator shutdown, orotecting the 450 psid Analysis Value.

P-88025 Page 22 February 8, 1988-F. CIRCULATOR SPEED HIGH - STEAM High circulator speed initiates a circulator trip to provide equipment protection for the helium circulators.

The limiting accidents leading to circulator overspeed are loss of restraining torque due to blade shedding and reheat steam line ruptures downstream of the circulator turbines.

High circulator speed trip settings of 11,000 rpm and 11,500 rpm were analyzed, and resulted in peak speeds of 13,050 rpm and 13,267 rpm, respectively. Extrapolating this data for the 11,700 rpm analysis value results in a peak speed of 13,360 to 13,370 rpm. The design overspeed of the circulators is 13,500 rpm, thus the new analysis value results in acceptable consequences.

Steam line ruptures downstream of the circulators were postulated, and an overspeed trip setting of 11,000 was analyzed. The analysis determined that an overspeed of 13,264 rpm would be reached with no control action or trip.

This is less than the design overspeed at 13,500 rpm.

Therefore, a trip at 11,700 rpm will not result in circulator speeds beyond design conditions.

The trip at 11,700 rpm has been reviewed and approved in License Amendment No. 52 to the Facility operating License, dated April 6,1987 (G-87117).

P-88025 Page 23 February 8, 1988 IV. Significant Hazards Consideration Evaluation:

The proposed Amendment would modify Technical Specification Sections LSSS 3.3 and LC0 4.4.1, which provides a listing of the Plant protective System (PPS) Instrumentation parameters and the associated Bases.

The Plant Protect.ive System consists of the instrumentation and controls required to initiate automatic corrective actions upon the onset of unsafe conditions. Individual instrumentation protective channels consists of various instruments from sensor to final output devices to supply the required input (s) into the PPS tripping logic. Each protective channel or instrument loop is provided with a Trip Setpoint where specific actions are either initiated, terminated or prohibited.

The Trip Setpoints selected should contain sufficient margin between the Trip Setpoint and the analyzed safety limits (Analysis Values) to account for uncertainties, such as accuracy, drift and dynamic responses, of the instrumentation.

The above Technical Specification sections have been modified to apply instrumentation uncertainties to the PPS pa rameters . The uncertainties have been determined using the NRC regulatory endorsed (Reg. Guide 1.105, Rev. 2) Standard ISA S67.1982, "Setpoints for Safety-Related Instruments in Nuclear power Plants", as guidance.

Basis for No Significant Hazards Determination:

The proposed amendment does not involve a significant hazards consideration because operation of the Fort St. Vrain Nuclear Generating Station in accordance with this change would not:

(1) Involve a significant increase in the probability or consequences of an accident previously evaluated. This change specifies Trip Setpoints with an adequate margin based on calculations of the installed instrumentation accuracies, surveillance requirements and surveillance data. The specified margin ensures that upon the onset of plant conditions, which require the need for automatic protective actions, appropriate actions are initiated prior to reaching an equipment design limit or a safety limit specified in the equipment design and accident bases.

Attachment 3 P-88025 Page 24 February 8, 1988 For those parameters where the instrumentation uncertainties applied challenged normal plant operation, new Analysis Values for which the trip and initiation of a protective action is assumed to occur in the Accident analyses was justified. While the new values as analyzed in the evalution (Section III) show increases in the consequences of the accident or transient (such as the amount of graphite oxidation, fuel temperatures, etc...), these changes are not significant and do not present an increase in the radiological consequences. The analyses demonstrated that the consequences of the accident or transient are acceptable and do not exceed the equipment design limits or safety limits. Therefore, this change cannot significantly increase the probability or consequences of an accident.

(2) Create the possibility of a new or different kind of accident from any previously analyzed. The design basis of the PPS is to initiate protective actions upon the occurrence of equipment failures, abnormal conditions and misoperation resulting in a potentially unsafe condition. This is accomplished by monitoring numerous equipment and system operating parameters.

Applying an adequate margin to the settings of those variables for automatic protective functions ensures that equipment design basis limits and Safety Limits will not be exceeded. Therefore, this change does not create the possibility of a new or different kind of accident.

(3) Involve a significant reduction in a margin of safety.

Accounting for instrumentation uncertainties in the determination of the Trip Setpoints of protective devices whose variables have a safety function, ensures conservatively that equipment design limits and safety limits are not exceeded. Analyses demonstrate that the protective trip function occurs at a value equal to or more conservative than the values assumed in the accident or transient analyses. While the new Analysis Values are less conservative than those currently assumed in the FSAR and the margin between the Analysis Value and Safety Limit has been reduced, the analyses  ;

in Section III show this reduction to not be  !

significant. Equipment Design and Safety Limits are '

not compromised. Therefore, this change does not significantly reduce the margin of safety. j l

P-88025 Page 24 February 8, 1988 For those parameters where the instrumentation uncertainties applied challenged normal plant operation, new Analysis Values for which.the trip and initiation of a protective action is assumed to occur in the Accident analyses was justified. While the new values as analyzed in the evalution (Section III) show increases in the consequences of the accident or transient (such as the amount of graphite oxidation, fuel temperatures, etc...), these changes are not significant and do not present an increase .in the radiological consequences. The analyses demonstrated that the consequences of the accident or transient are acceptable and do not exceed the equipment design limits or safety limits. Therefore, this-change cannot significantly increase the probability or consequences of an accident.

(2) Create the possibility of a new or different kind of accident from any previously analyzed. The design basis of the PPS is to initiate protective actions upon the occurrence of equioment failures, abnormal conditions and misoperation resulting in a potentially unsafe condition. This is accomplished by monitoring numerous equipment and system operating parameters.

Applying an adequate margin to the settings of those variables for automatic protective functions ensures that equipment design basis limits and Safety Limits will not be exceeded. Therefore, this change does not create the possibility of a new or different kind of accident.

(3) Involve a significant reduction in a margin of safety.

Accounting for instrumentation uncertainties in the determination of the Trip Setpoints of protective devices whose variables have a safety function, ensures conservatively that equipment design limits and safety limits are not exceeded. Analyses demonstrate that the protective trip function occurs at a value equal to or more conservative than the values assumed in the accident or transient analyses. While the new Analysis  ;

Values are less conservative than those currently assumed in the FSAR and the margin between the Analysis '

Value and Safety Limit has been reduced, the analyses in Section III show this reduction to not be significant. Equipment Design and Safety Limits are not compromised. Therefore, this change does not )

significantly reduce the margin of safety.

l l

!