ML20151Z021
| ML20151Z021 | |
| Person / Time | |
|---|---|
| Site: | North Anna  |
| Issue date: | 02/06/1986 |
| From: | Stewart W VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.) |
| To: | Harold Denton, Rubenstein L Office of Nuclear Reactor Regulation |
| References | |
| 85-772A, NUDOCS 8602130265 | |
| Download: ML20151Z021 (58) | |
Text
-
VINGINIA ELECTHIC AND Pownu CoxPANY R ic u n o x1). V t w o ix A u:5261 February 6, 1986 W.L. STEWART Vace Pamespuur NucLeam Ormaatsome Mr. Harold R. Denton, Director Serial No. 85-772A Office of Nuclear Reactor Regulation E&C/GLD/ ace Attn: Mr. Leste: S. Rubenstein, Director Docket Nos. 50-338 PWR Project Directorate #2 50-339 Division of PWR Licensing-A License Nos. NPF-4 U.S. Nuclear Regulatory Commission NPF-7 Washington, D.C. 20555 Gentlemen:
VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS NO. 1 AND 2 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION ON CORE UPRATE By letter dated May 2,1985, Virginia Electric and Power Company requested an amendment to the North Anna Unit 1 and 2 Technical Specifications to allow operation with a core rated thermal. power of 2893 MWt.
Subsequently, the NRC staff by letter dated October 23, 1985 requested additional information concerning the proposed core uprating.
Our response to this request is enclosed as Attachment 1 to this letter.
As described in the response, we have concluded that additional changes are required to the North Anna Unit i and 2 Technical Specifications to ensure consistency with the safety analysis during shutdown modes of operation, Attachment 2 provides additional changes to supplement our May 2, 1985 Technical Specifications change request. A safety evaluation of these additional changes is provided in Attachment 3.
This response to the NRC staff's request for additional information and the additional changes to the Technical Specificatiens changes for operation at the uprated. thermal power have been reviewed by the Station Nuclear Safety and Operating Committee and the Safety Evaluation and Control Staff. It has been determined that the additional changes do not involve an unreviewed safety question as defined in 10 CFR 50.59 or a significant hazards consideration as defined in 10 CFR 50.92.
Should you have any questions regarding our response or require any additional information to complete your review, please contact us as soon as possible.
Very truly yours, s
W.
'. Stewart i0 0 0602130265 060206 PCR ADOCK 05000338 P
PDR t
VinorwnA Etscraic Awn Powns CourAxv to Mr. Harold R. Denton Attachments:
1.
Response to NRC Request for Additional Information 2.
Additional Technical Specifications Changes 3.
Safety Evaluation cc:
Dr. J. Nelson Grace Regional Administrator NRC Region II Mr. Morris W. Branch NRC Resident Inspector North Anna Power Station Mr. Charles Price Department of Health 109 Governor Street Richmond, Virginia 23219 Mr. Leon B. Engle NEC North Anna Project Manager PVR Project Directorate #2 Division of PWR Licensing-A
ATTACHMENT 1 RESPONSE TO NRC REQUEST FOR ADDITIONAL INTORMAT.ON s
January, 1986 s.
s
Question 1. (Section 3.1.3.3.12 of Reference 1)
The analysis of the postulated locked rotor accident predicted a peak cladding temperature of 2203 F, but concludes that fuel failure will not occur based on a cladding temperature less than 2700 F criterion.
It has been and continues to be the NRC staff position that cladding failure is assumed to occur when the fuel rod DNBR is less than 1.3.
This position provides conservatism to cover analytical uncertainties in the core thermal hydraulics, geometry, and power peaking, in addition to uncertainties in experimental accuracy.
Therefore, you should assume that all fuel which experiences a DNBR of less than 1.3 fails, and calculate the offsite dose consequences.
In the offsite dose analysis you should assume maximum technical specification pre-accident coolant activity s
and steam generator leakage. Single failures should be considered, including a stuck open secondary relief valve.
Loss of offsite power should be assumed per GDC-17. The effect of steam generator tube uncovery on the offsite dose consequences caused by operator action to isolate the affected steam generator should also be considered in the analysis.
a.
Assuming one secondary system relief valve falls to close, provide the total steam releases to the atmosphere at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and upon reaching cold shutdown. These steam releases should be provided separately for the intact steam generators and for the affected steam generator.
2
Response
The total releases are provided below. They are based on an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> cooldown period, consisting of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> from hot full power to hot shutdown (547*F) and 6 additional hours to reach 350*F. when the Residual Heat Removal System can be placed in service. These times are conservative (longer than actual plant experi-ence) and will therefore result in a conservatively long period of radioactive steam releases from the steam generators. Listed separately are re. leases from the affected and unaffected steam generators. These values are those used in the dose calculation, derived in a manner to maximize release and doses from the affected steam generator. The releases from the af fected steam generator are terminated 15 minutes af ter initiation of the incident. The steam generator PORV is isolated by manually closing a block valve upstream of the PORV. This operation must be per-formed in the Main Steam Valve House. The 15 minute interval includes diagnosis of the open PORY and 5-10 minutes for actually performing the local manual iso-l 1ation of the valve. This assumed time is conservative, based on the procedural guidance described below in response to Question 1.b.
Time Interval l
0-2 Hours 2-8 Ho.srs Total Steam Release, all SGs (1bm) 447,619 871,295 Total Steam Release, Affected SG (1bm) 198,000 0
Total Steam Release, Unaffected SG (1bm) 249,619 871.295 l
Question 1.b Describe the operator procedural response to a locked rotor accident with reactor trip-turbine trip, and the consequential failure to close a secondary system relief valve.
Include any actions to isolate steam flow and feedwater flow to and j
from the affected steam generator.
3
Response
This response is based upon operator actions as described in the Westinghouse Owners Group Emergency Response Guidelines (ERG), Rev.1 (Reference 2). The North Anna emergency operating procedures are currently planned for revision to reflect the Rev.1 ERG requirements by June 30, 1986.
The expected NSSS response to a locked rotor event is characterized by a rapid reduction in RCS coolant flow, in conjunction with a rapid increase in RCS temper-ature and pressure.
Reactor trip on low RCS flow followed by turbine trip is expected within a few seconds of the event. Within a few more seconds, the primary and secondary pressure relieving valves (PORVs and safety valves) are expected to lift. The postulated scenario also assumes that the PORV on the steam generator in the af fected loop fails to close. These events will occur in rapid succession, so the operator actions will be guided by the procedure for response to reactor trip and/or safety injection (SI).
The stuck open steam generator PORV will cause this event to behave as a small steamline break.
Previous analysis results of such events shows that SI will either be actuated on high differential pressure between steamlines (within a few seconds after the event) or on low pret urizer pressure (within a few minutes after the event). Since RCS pressure returns to nominal shortly af ter the locked -
rotor event the RCS depressurization is expected to proceed similar to that for the credible break. Following is a description of the major steps of the expected procedural direction for the locked rotor event. The procedure designation and titles are from the ERG, Rev. I guidelines.
l 4
l l
E-0, Reactor Trip or Safety Injection Major steps:
- 1. Verify reactor and turbine trips.
- 2. Determine if SI is required.
At this point in the postulated scenario, SI actuation setpoints may not have been reached.
If SI is determined not to be required, the operator is directed to ES-0.1, Reactor Trip Response, where he achieves stable post-trip plant conditions.
If SI has actuated, proceed through remaining E-0 steps. The main effect of this upon the scenario is to allow earlier identification of and isolation of the affected steam generator.
- 3. Verify feedwater and Phase A containment isolation
- 4. Verify all auxiliary feedwater pumps running
- 5. Check if main steamlines should be isolated
- 6. Verify SI florepath alignment and flow
- 7. Verify auxiliary feed flow greater than minimum required for heat removal
- 8. Confirm RCS temperature stable or trending to no load'value.
For the scenario with a stuck open SG PORV, temperatare is expected to be less than no load and decreasing. Operator is instructed to stop dumping steam and control total feed flow to maintain proper level in at least one SG.
- 9. Confirm that pressurizer spray and PORVs are closed.
- 10. Check if RCPs should be stopped. All RCPs will be stopped if subcooling is less than trip setpoint.
- 11. Check that SGs are not faulted.
Assuming a stuck open SG PORV, operator will observe that faulted SG pressure is decreasing in an uncontrolled manner.
5
Procedure directs him to E-2 Faulted Steam Generator Isolation.
E-2, Faulted Steam Generator Isolation Major Steps
- 1. Confirm that main steamline isolation and bypass valves of affected SG are closed.
- 2. Isolate faulted SG (main and aux feedlines, close steam supply to turbine-driven aux feed pump, verify SG PORVs closed)
Operator will observe that the valve on the faulted SG is not closed. For conservatism, it is assumed that it cannot be closed remotely from the control room. An operator is
. dispatched to the Main Steam Valve House to manually close the. block valve upstream of the stuck PORV. This operation can be performed within 5-10 minutes from the time of identifying the valve to be closed. The calculation of offsite dose consequences (see response to Question 1.f below) assumes that the affected PORV is closed 15 minutes after the start of the event.
- 3. Confirm that secondary side SG radiation is normal.
Operator is directed to E-1, Loss of Reactor or Secondary Coolant.
E-1,' Loss of Reactor or Secondary Coolant
- 1. Check if RCPs should be stopped.
Should the subcooling criterion for tripping RCPs be reached 6
f.
r L_.
during the postulated scenario, the procedure contains detailed steps to accommodate such operation. This possibility will not affect the estimate of fuel failure, which would occur only in the first few seconds. The offsite dose calculation will be bounding for cases with or without continued RCP operation.
- 2. Check if any SGs are faulted.
After actions taken above, none should be depressurized or have
. pressure decreasing in an uncontrolled manner.
- 3. Check if SI tiow should be reduced.
It is expected that SI can be reduced at some time in this step.
Operator is directed to ES-1.1, SI Termination.
The procedural steps following this involve reducing SI, establishing
. charging flow to maintain pressurizer level and later termination of 15 1. After verification of stable plant conditions, the appropriate plant procedure is entered to continue unit shutdown.
Question 1.c Provide the water level relative to the tube bundle as a function of time for' the affected steam generator.
Response
No detailed calculation of water level relative to the affected steam generator tube bundle was performed for this evaluation. An alternative approach was taken which is conservative for calculation of offsite dose consequences. The offsite dose calculation assumed that the tube bundle in the affected steam generator was completely uncovered from the initiation of the event. This case, denoted as Case 1 in item 1.f below, maximizes the predicted radioactive releases and offsite dose 7
associated with the affected. steam generator. Past experience with steam genera-tor tube failures has indicated that the most likely location of leakage is near the tube sheet. This was accounted for in the offsite dose results from a second, more realistic case, presented below as Case 2.
This case assumed that any affected steam generator tube leakage sites remain covered with water for 15 min-utes, which is the assumed duration of its release to the atmosphere (see dis-cussion in item 1.f).
Question 1.d Provide the calculated percent of failed fuel.
Response
A conservative calculation of predicted rods in DNB for the North Anna uprated condition results in failure of 13*. of the fuel rods. The thermal-hydraulic eval-uation was performed using the Westinghouse WRB-1 DNB correlation (Reference 3).
The transient analysis assumes simultaneous reactor and turbine trips, and the coolant pump coastdown effects of a postulated loss of offsite power 2.0 seconds after the turbine trip.
Question 1.e Provide the secondary side iodine decontamination factors assumed for the affected and unaffected steam generators in the offsite dose calculations.
8
Response
TVo cases were analyzed for the locked rotor offsite dose calculation. Case 1 is a bounding case which assumed the affected SG tubes were uncovered from time zero. Case 2 represents a more realistic condition for which it was assumed no uncovery of the region of primary to secondary leakage occurred in the affected SG during the first 15 minutes of the event. After this time, the stuck SG PORV is assumed shut, stopping releases from the affected SG. The decontamination factors for each case are given below.
Steam Generator Decantamination Factor North Anna Locked Rotor Analysis Affected SG Unaffected SG Case 1 - With tube uncovery 1.0*
0.01 Case 2 - No tube uncovery 0.01 0.01
- Applicable until t = 15 minutes. Affected SG releases stop at this time, when c perator isolates stuck open SG PORV.
Question 1.f Provide the offsite dose consequences for the accident.
Response
The offsite dose calculation was performed for the two cases described in the response to Question 1.e above. The results are presented below, where each case assumes failure and gap activity release for 13'; of the fuel rods.
The doses below are reported from three sources, which will be briefly described.
The ' Tech Spec Activity' column accounts only for the doses from release of initial allowed system activity (RCS primary to secondary leakage and SG initial activity). The pre-accident spike result is dose from release of RCS 9
s coolant containing the higher activity allowed by Technical Specification Figure 3.4-1.
The final column for the failed fuel is the dose from release of the total gap activity from 13*. of the fuel rods,'again released via primary to secondary leakage to.the SGs.
Calculated Dose (rem) from Sources Given Tech Spec Pre-Accident Failed Fuel Activity Iodine Spike Gap Activity Case 1 - With Affected SG Tube'Uncovery Thyroid 1.23 0.199 30.7 Exclusion Area Gamma 1.07-3*
2.63-4 0.249 Boundary.(EAB)
Beta 5.03-4 1.04-4 9.27-2 Thyroid 4.59-2 1.30-2 1.94 Low Population Gamma 5.25-5 1.39-5 2.18-2 Zone (LPZ)
Beta 3.82-5 5.79-6 1.02-2 Case 2 - No Affected SG Tube Uncovery Thyroid 3.30-2 1.14-2 1.72
-Exclusion Area Gamma 9.22-5 2.53-5 0.142 Boundary (EAB)
Beta 9.71-5 2.05-5 6.50-2 Thyroid 3.30-3 6.28-3 0.911 Low Population Gamma 1.79-5 5.48-6 1.79-2 Zone (LPZ)
Beta 2.37-5 2.81-6 9.17-3 4
- notation: 1.07-3 = 0.00107 8
X/Q Values:
3.1-4 sec/m 0-2 hrs at EAB 8
1.1-5 sec/m 0-8 hrs at LPZ It is concluded from the results above that the exclusion area boundary doses for both cases are a small fraction of the 10 CFR Part 100 guidelines. Case 1 represents a very conservative prediction of doses for the locked rotor event.
Case 2, while still conservative, provides a more realistic estimate of these dos-es.
I i
10
Question 2. (Section 3.2 of Reference 1)
Analyses were not provided for postulated loss of coolant accidents during shut-down, following operation at the increased power level. We conclude that such analyses are required to demonstrate compliance with 10 CFR 50.46.
- a. Provide analyses of a large break loss of coolant accident during hot standby at a reactor system pressure of 1000 psig. The accum-ulators should be assumed to be isolated in accordance with the Technical Specifications.
Response
The following conservative analysis determined that during hot standby (Mode 3 operation) with the accumulators isolated, in accordance with the Technical Spec-ifications, the remaining.available ECCS systems are capable of mitigating the consequences of a large break LOCA without any operator action. The results of this conservative analysis show a limiting PCT of 1955 degrees F.
These results are easily bounded by the 2161 degrees F limiting PCT calculated for the full pow-er large break LOCA analysis. Details of this analysis are described below.
Mode 3 Initial Conditions The analysis consisted of the following assumptions regarding the initial condi-tions of the plant during Mode 3 operation:
1.
The RCS fluid is isothermal at a temperature of 425 degrees F and a pressuri of 1000 psig.
11
2.
The core and metal sensibic heat above 425 degrees F has been removed.
3.
The plant was brought from full. power to Mode 3 operation at a cooldoun rate of'50 degrees F per Hour.
.This was conservatively estimated.to require 2.44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />, whereas actual plant operations indicate tha't this procedure requires at least 2.65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> and generally
. about 4.00 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> based on historical. data from 1985.
4.
The decay heat level was conservatively based on.120%
of the 1971 ANS standard and determined to be 1.36% of full power after 2.44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />.
Full power is conservatively estimated to be 102% of nominal up-ated full power.
5.
Consistent with the Technical Specifications the ECCS system is configured as follows:
a.
Accumulators are isolated.
bi Two ECCS subsystems are operable and available.
c.
Pressurizer Low-Low pressure setpoint is blocked by the'P-11 interlock. The Hi-1 containment pressure setpoint is available for automatic actuation 12
of the Safety Injection. System.
Hot Standby. Accident Analysis The accident analysis consisted of a simple, yet conservative, calculation with
~
' the following major-assumptions:
1.
A 'large, double-ended guillotine cold leg break.
2.
Only one ECCS subsystem is assumed to deliver SI to the RCS (worst single-failure assumption), with one line assumed to spill to the containment.
3.
All SI d'elivered to'the RCS is entrained out the-
. break during blowdown. Consequently, SI is not.
allowed to begin refilling the lower plenum until
~
after the end of blowdown (E0B).
4.
The reactor vessel is conservatively assumed to be completely devoid of liquid at the end of blowdown.
5.
The core hot spot is assumed to occur at the core midplane and is conservatively based on a full power peaking factor of 2.15 even though the core is not producing any power (excluding decay heat) in this hot standby Mode of operation.
13
6.
No credit is taken for heat transfer from the clad to any surrounding steam or entrained droplets during the refill and reflood portions of the transient.
Consequently, the fuel rod is assumed to heat-up adiabatically. This conservatively increases the i
clad heat-up rate during the refill and reflood portions of the accident.
7.
The peak clad temperature is assumed to occur at the core hot spot (core midplane). The calculated clad heat-up is assumed to terminate when the core midplane is quenched by SI water filling the core. Hot spot quenching is. conservatively assumed to occur when the SI water is calculated to fill the core to the midplane.
No credit is taken for a two phase froth level that would be produced by boiling as the SI water reflooded the core.
The detailed description of the blowdown, refill, and reflood phases of the acci -
dent, along with corresponding calculations are discussed in the following para-graphs.
l The blowdown portion of a large break transient, whether it be from full power, from hot standby, or hot shutdown, is characterized by a large and rapid release of mass and energy from the RCS into the surrounding containment building. Conse-quently, -the RCS rapidly depressurizes and experiences a near complete loss of primary system coolant. Detailed large break LOCA computer analyses for full pow-er initial conditions have shown that the mass and energy release during the blow-down phase of an accident will be sufficient to pressurize the containment above the Hi-1 (trip setpoint 517 psia) containment pressure setpoint very early in the 14
i transient (generally in less than 2 seconds). From a hot standby or hot shutdown
?-
initial condition the containment pressurization rate will be slightly less than the full power condition because of the lower initial energy conditions. Nonethe-less, the large mass release through the double-ended quillotine break will cause the Hi-1 setpoint to be reached very early in time. Consequently, automatic _ actu-ation of the SI Systems will occur during the blowdown' phase of the transient.
I However, consistent with Appendix K full power LOCA analyses it was conservatively assumed that any SI delivered to che RCS during blowdown was entrained out the break.
Previous-analyses of a postulated LOCA from hot standby conditions have shown that
. heat transfer between the fuel rods and the RCS coolant during blowdown is very officient as a result of the large velocities associated with the RCS fluid that is swept out of the reactor vessel. Consequently, the clad does not heat-up above i
its initial temperature during the blowdown phase of the accident. Hence, the temperature of the clad following blowdown was assumed to be 425 degrees F.
Following the E0B, SI was allowed to enter the reactor vessel to begin refilling the lower plenum. Conservatively assuming that the lower plenum is empty follow-ing b1'owdown and employing a conservative SI flowrate of 5.51 cubic feet per sec-ond, it was calculatied that it would take approximately.166-seconds to r
completely refill the lower plenum. Taking' no credit for heat transfer between the clad and the surrounding steam environment, an adiabatic heat-up rate of 4.91 degrees F per second was conservatively calculated to occur at the core hot spot for a corresponding decay heat level of 0.1703 kw/ft (based on a 1,36* decay heat level and a full power core peaking factor of 2.15).
At this adiabatic heat-up
~
rate it was estimated that the core hot spot would experience a heat-up of approx-imately 814 degrees F during the refilling of the lower plenum. This would-raise the hot spot clad temperature to approximately 1239 degrees F.
15 1
e-w e
w e-
-r,
-,,r
--w m,-
y,-
-wi
-i-e-ym
During reflood, the core and downcomer liquid levels will rise together until the steam generation-in the core becomes sufficient to inhibit the core reflooding rate. Once the core reflooding rate starts to become inhibited the downcomer lev-el will rise at a faster rate. The ensuing pressure head which occurs as a result of the difference in downcomer and core liquid levels will drive the reflooding process. The degree to which the reflooding is inhibited is depender.t upon the decay heat level. Consequently, reflooding will be more inhibited for accidents occurring at full power conditions than for accidents occurring at hot standby or hot shutdown. To assess the rise in clad temperature during the.refloo'd portion of this hot standby LOCA two bounding cases for reflooding the core were consid-ered:
Case 1.
No degradation of the core reflooding rate due to steam generation was assumed; hence, the downcomer and core liquid levels were assumed.to rise at the same rate. The fuel rod was assumed to heat-up adi-abatically with no credit taken for any heat transfer from the hot spot clad to any surrounding steam or entrained droplets. Quenching of the hot spot was assumed to occur when the core liquid level was calculated to reach the core midplane.
Case 2.
Core reflooding was completely delayed until the pumped SI was calculated to completely fill the downcomer up to the cold leg elevation. Once this occurred the core was allowed to be filled. The i
fuel rod was assumed to heat-up adiabatically with no credit taken for any heat transfer from 16 1
4 r
-n
the hot spot clad to any surrounding steam or entrained droplets. Quenching of the hot spot was assumed to occur when the core liquid level was calculated to reach the core midplane.
For the lower bound, Case 1 described above, it was calculated that the liquid level would reach the core midplane approximately 90.43 seconds following the bot-tom of core recovery. This resulted in an additional clad temperature increase of 444 degrees F, due to the assumed adiabatic heat-up. Combined with the hot spot clad heat-up that was calculated for the refill portion of the transient, this resulted in a lower bound PCT of 1683 degrees F.
For the upper bound, Case 2 described above, it was calculated that the SI would require 97.07 seconds to completely refill the downcomer, and an additional 48.84 seconds to reflood the core to the midplane. This resulted in an additional clad temperature increase of 716 degrees F, due to the assumed adiabatic heat-up. Com-
.bined with the hot spot clad heat-up that was calculated for the refill portion of the transient, this resulted in an upper bound PCT of 1955 degrees F.
-In. summary, the overly conservative analysis described above calculated a PCT between 1683 and 1955 degrees F.
A detailed 10 CFR 50.46 Appendix K analysis of this hot shutdown condition would result in a PCT calculation somewhere between these bounding cases, if not l'ess than the 1683 degrees F lower bound. Nonethe-less, the upper bound 1955 degrees F PCT calculated by this conservative method is considerably less than the limiting UFSAR full power large break LOCA PCT of 2161 degrees F.
Hence, it is concluded that the ECCS systems available in hot standby operation are capable of mitigating the consequences of a large break LOCA without any operator action.
17 b
- b. Provide analyses of a large break loss of coolant accident during hot shutdown. Automatic actuation of safety injection should not be assumed unless
-required by the Technical Specifications. Justify operator response times for manual operation.
Response
The results of the hot standby LOCA 2n: 1 is described in the 7
preceding section bound the hot shutdown analysis results presented in this section. This is due to the fact that the decay heat level at hot shutdown is lower than for hot standby by 12.68*., due to the additional 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> that it was conservatively estimated to cool down tl'e plant to the 350 degrees F hot shutdown RCS condition. This translates into a 12.68*4 reduction in the hot spot adiabatic heat-up rate.
In addition the RCS initial temperature of 350 degrees F, results in an initial clad temperature at E0B which is 75 degrees cooler than the hot standby case. These differences result in a limiting PCT of 1684 degrees F compared with the limiting PCT of 1955 degrees F calculated for the hot standby case. Hence, the ECCS systems available during hot shutdown are capable of mitigating the consequences of a large break LOCA without any operator action. These results are easily bounded by the 2161 degrees F limiting PCT calculated for the full power large break LOCA analysis. Details of the hot shutdown large break analysis are described below.
Mode 4 Initial Conditions 18
The analysis' consisted of the following assumptions regarding the initial conditions ~ of the plant during hot shutdown (Mode 4 operation):
1.
The RCS fluid is isothermal at a temperature of 350 degrees F and a pressure of 1000 psig.
2.
The core and metal sensible heat above 350 degrees F has been removed.
3.
13ua plant was brought from full power to Mode 4 operation at a-cooldown rate of 50 degrees F per hour.
This was conservatively estimated to require 3.94 hours0.00109 days <br />0.0261 hours <br />1.554233e-4 weeks <br />3.5767e-5 months <br />, whereas actual plant operations indicate that this procedure generally requires a minimum of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and usually requires 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> based on historical data from 1985.
4.
The decay heat level was conservatively-based on 120% of the 1971 ANS standard and determined to be 1.19% of full power after 3.94 hours0.00109 days <br />0.0261 hours <br />1.554233e-4 weeks <br />3.5767e-5 months <br />. Full' power is conservatively estimated to be 102% of nominal uprated full power.
5.
The ECCS system is assumed to be configured as follows:
a.
Accumulators are isolated.
19
b.
_One ECCS subsystem is operable and available for automatic SI.
c.- Pressurizer Low-Low pressure setpoint is blocked by the P-11 interlock. The containment Hi-1 pressure setpoint is t '
available for automatic actuation of 'he t
Safety Injection system.
In order for the requirements in 5(b) and 5(c) above to be fully met by the plant Technical Specifications, three revisions to the Specifications are necessary. Each proposed change is discussed in a separate picagraph below._
The current Table 3.3-3 in the Technical Specifications does not require that the high pressure SI signal (Hi-1) be armed and actuate SI if the Hi-1 setpoint is exceeded for Mode 4. The proposed revision to Specification Table 3.3-3, as presented in Attachment 2, reflects. the actual operating practice of arming the Hi-1 setpoint instrumentation in Mode 4.,
as well as in Modes 1,2, and 3.
The related Table 4.3-2 has also'been revised. Manual SI actuation is also available.
The current Technical Specification 3.5.3(c) requires that there be at least one operable ECCS' subsystem available for delivery to the RCS in Mode 4 upon manual realignment of the flow path. The subsystem must contain one operable ~ centrifugal charging pump,.and one operable low head safety. injection pump. The proposed revision to Technical Specification 3.5.3, presented in Attachment 2, reflects the actual 2
20
plant operating' practice of maintaining an operable flow path capable of automatically transferring fluid to the RCS from the RWST.
Hot Shutdown Accident Analysis a
The hot shutdown accident analysisJemployed the same methodology as the hot standby analysis, with the exception that a worst single failure of the pumped SI was not assumed. This was done in accordance with NUREG 0452 Rev. 4, which specifies that a worst single failure assumption is not required when analyzing Mode 4 accident scenarios for ECCS evaluation. The results of this analysis are described in detail below.
Due to the fact that there will not be any clad heat-up during blowdown the clad temperature at E0B was 350 degrees F.
Following E0B, 166 seconds were required to completely refill the lower plenum. An adiabatic heat-up rate of 4.28 degrees.F per second was conservatively calculated to occur at the core hot spot for a corresponding decay heat
. level of 0.1478 kw/ft (based on a 1.19 T. decay heat level and a full power peaking factor of 2.15).
At this adiabatic heat-up rate the core
~
hot spot would experience a heat-up of approximately 709 degrees F during the refilling of the lower plenum. This would raise the hot spot clad temperature to approximately 1059 degrees F.
The adiabatic heat-up of the fuel rods during reflood was assessed by considering the two~ bounding reflood scenarios outlined in the hot standby analysis. For the lower bound case, Case 1, it was calculated that the liquid level would_ reach the core midplane 90.43 seconds following the bottom of core recever;. This resulted in an additional T
21
clad temperature increase of'387 degrees F, and a final PCT of
-1446 degrees F.
I For the upper' bound case, Case 2, it' was calculated that the liquid level would reach the core midplane 145.91 seconds following the bottom of core recovery. This resulted in an additional clad temperature increase of 625 degrees F, and final PCT of 1684 degrees F.
.In summary, the overly conservative analyis described above calculated a PCT between 1446 and 1684 degrees F.
A detailed 10 CFR 50.46 Appendix K. analysis' of this hot shutdown condition would result in a -
PCT calculation somewhere between these bounding cases, if not less than the 1446 degrees F. lower bound. The hot shutdown upper bound PCT of 1684 degrees F-is bounded by the hot standby upper bound PCT of 1955 degrees F, and is considerably less than the limiting 2161 degrees F PCT that was calculated for the full power analysis. Hence, it is concluded that the ECCS systems available in hot shutdown operation are capable of citigating the consequences of a large break LOCA without any operator action.
4 22
- c. Provide analyses of small break loss of coolant accident when the reactor is at 1000 psig and the accumulators are isolated in accordance with the Technical Specifications.
Justify operator response time if required to restore the isolated accumulators. Justify that operator training and and procedures contain instructions to restore isolated accumulators if required to mitigate small break LOCA.
Response
Small Break LOCA Initial Conditions At 1000 psig the RCS is assumed to be operating with an average coolant temper-ature of 425 degrees F and be in a hot standby Mode of operation. Assuming an expedited cooldown at a rate of approximately 50 degrees F per hour it is conser-vatively estimated that it will have taken at least 2.44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> to get to this con-dition. Hence, the core will be releasing a small amount of power to the RCS due to fission product decay. Based on 120*. of the 1971 ANS Decay Heat Standard it.is conservatively estimated that: the core decay heat level will be 1.36*. of full pow-er.
Small Break LOCA Accident Analysis At an RCS pressure of 1000 psig or below the accumulators are assumed to be iso-lated from the RCS and are not available for automatic injection into the RCS. In addition the Pressurizer Low-Low pressure setpoint alarm is disabled as a result of the RCS pressure being below 1990 psig leaving the Containment Hi-1 pressure 23 i
setpoint as the only signal availabic for automatic SI actuation. Analyses have shown that the Hi-1 containment pressure setpoint would easily be reached in the event of a large break LOCA and for larger small break LOCA's. For break sizes less than two inches in diameter, however, the Hi-1 containment pressure setpoint may not be reached; requiring the operator to manual'ly initiate Safety Injection.
The alarms available to the operator for LOCA detection include containment radi-ation alarms and sump high 1avel alarm. The containment atmosphere is monitored by the containment gaseous and particulate radiation monitor, the manipulator crane area radiation monitor, and the containment high and low range area radi-ation monitors. Break flow from a one inch break is on the order of 500 gpm and a two inch break would have a flow of about 2000 gpm. These breaks would be expected to set off the containment radiation alarms very soon after the initiation of the smallest of the small breaks.
In addition to these alarms, the operator would also be alerted to a LOCA by decreasing RCS pressure and decreasing pressurizer level. Hence, the operator will have a large array of indications tha a LOCA has occurred.
A detailed Small Break LOCA analysis for a three loop plant similar to North Anna for a two inch break from full power initial conditions, without any pumped safety injection or accumulators, has shown that core uncovery will not occur until approximately 1327 seconds (22.12 minutes) into the transient. It should be noted that the time to core uncovery will be significantly greater than 1327 seconds for a similar SBLOCA from hot standby or hot shutdown as a result of the lower decay heat level and the lower break flow rates. This time will increase even more for breaks less than two inches. As a result of this analysis it is concluded that the operator will have more than 22 minutes to diagnose the LOCA and to manually actu-ate SI.
24
e.-
~.
f Actuation of SI prior to core uncovery will in general preclude the possibility of any core uncovery later in the transient. There is, however, the possibility that some partial, yet limited, core uncovery could occur.
If such.a partial core uncovery should occur, SI alone, without the aid of accumulators, will be suffi-cient to recover the the core. It should be noted that detailed SBLOCA hot channel
[
analyses from full power conditions have shown that during partial core uncoveries that steam cooling h~at transfer between any exposed fuel rods and the exiting e
i-steam is quite efficient and will limit ary clad heat-up that may occur below the 1749 degrees F limit calculated for a SBLOCA from full power conditions.
I l
The consequences of a temporary core uncovery condition will be mitigated even further by operator action. Once a LOCA is identified the plant operators will monitor core. exit thermocouples and the Reactor Vessel Level Indicating System
' (RVLIS).. In the event that~ core exit.thermocouples exceed 700 degrees F or the
~
- RVLIS system indicates any core uncov ry the operators will depressurize the e
I steam generator secondary sides.In order to establish a stable heat sink for the transfer of decay heat from the RCS.. This will result in a more rapid depressuri-
)
zation of the RCS. Consequently, safety injection flow will increase and the core i
j.
recovery will be accelerated.
i 2
1 i
4 4
25 4
g Y3'*-e.ey-g w<-w.g,er w,--wwg3--g-w
+,,,,
- yny-g3--wNt--
wy-r ay r--g g--9-e-,w-,-
+y7,q43,
r-g-g-
-+e--
7N-em-g.p-.emr-9--eye-ami
,e-We-*-y9,p.g m w-p-_ve-9
--.2--e-em,g-pym+
z-
Question 3. (Section 3.1.3.3.1 of Reference 1)
The minimum DNBR from uncontrolled control rod withdrawal from subcritical was shown to be acceptable for one or two reactor coolant pumps in operation. The analyses included the effect of a positive moderator coefficient which would be permitted by the Technical Specifications in modes 1 and 2 below 70% power. The analyses were not demonstrated to be bounding for all shutdown conditions.
Therefore, provide the following information:
- a. Justify that the analyses which were performed at the reactor temperature for hot zero power would conservatively bound events at lower temperatures.
Respcsase:
The effects of low temperature on the rod withdrawal from subcritical event have been examined previously by Virginia Electric and Power Company. The results of our review are summarized as follows:
a.
Reduced temperatures result in a larger negative doppler temperature coefficient and a lower reactivity insertion rate due to rod withdrawal. Both of these effects tend to reduce the magnitude of the transient.
26
_... -. ~
1._.
4
- b. The ' moderator temperature coefficient becomes more positive 4
i at reduced temperatures. However, for North Anna, the Technical Specifications limit the moderator coefficient to values which
~
are'1ess positive than assumed in the accident analysis for
- modes 1 and 2.
Below mode 2, the source range reactor trips will be operable (see the response to parts b. and c., below).
In the event of a rod withdrawal,.the source range trips would therefore terminate'the event prior to the generation of
}
significant core power. The value of the moderator coefficient would have no impact on the transient for such an event.
- c. Reduced temperatures could potentially increase the effective high flux trip setpoints due to the effects of increased attenuation of the signal received by the plant's excore i
detectors.
Studies performed by Virginia Electric and Power l
Company and documented in Reference 4, however, have shown that.
~
i the results for the rod withdrawal from subcritical event are f
insensitive to the power range flux trip setpoint. Therefore t
the analysis performed at Hot Zero Power remains bounding.
- d. Reduced reactor temperatures will result in a benefit from the standpoint of Departure from Nucleate Boiling (DNB).
As a result of these considerations, it can be concluded that the analysis of the i
rod withdrawal from subcritical event at hot zero power bounds those events occur-ing at lower temperatures.
d
(
f f
27 f
a e
ive-.--
ryr
- y 4n---er
m--
_-,,-.----------.-.---,---.-------.,----,--.,----v
.,-.,~4---
- b. The analyses take credit Ltc reactor trip from the power range high neutron flux channels. The power range high neutron flux channels are not required to be operable during shutdown by the Technical Specifications. The source range and intermediate range channels are required to be operable; however, the Technical Specification Basis (Page B2-4) states that no credit was taken for these trips.
Technical Specification Table 3.3-2 states that delay times for the source and intermediate trip functions are not applicable.
Correct this apparent inconsistency between the Technical Specifications and the safety analysis as required by 10 CFR 50.36.
d
Response
In response to this concern and to the concerns raised in Part c. below, we are proposing changes to Tables 3.3-1 and 3.3-2 of the Technical Specifications which will a) require two source range channels to be operable in modes 3-5 whenever the rods are energized and capable of being withdrawn and b) require response time testing for the source range channels. Under the revised tables, the source range trip will not be blocked during a startup until the power range channels are available. As such, the intermediate range trips are redundant and no credit is taken for them in the safety analyses.
Table 3.3-2 of the Specifications will be revised to specify acceptable reactor trip system instrumentation response times of < 0.5 seconds for the source range 28
channels. This value is. consistent with the safety analysis assumptions and with the existing specification for the power range channel. Note that for the case of a' rod withdrawal from subcritical, several seconds would elapse between the time
~
when -the source range trip signal is generated (when the core is_at or just below critical) and the time when the protection is actually needed (significant power 1.
generation occurring)- see, for example Figures 15.2-1 to 15.2-3 in'the UFSAR.
The 0.5. second response time, which is used for consistency with with the other channels, is therefore more than adequate to protect against rod withdrawal events
-in modes 3-5. We have determined that response time testing of these' channels can be implemented with minimal difficulty.
e 29
c.
Analyses of inadvertent control rod withdrawal were performed for reactor pump operation, but were not performed for Residual Heat Removal Operation such as would be the case in modes 4 and 5.
Provide analyses of inadvertant control rod withdrawai in modes 4 and 5 or provide evidence that the event cannot occur.
Preventive measures at other plants include requirements that either (1) the control rods will be deenergized, (2) the reactor coolant pumps will be operating, or (3) the reactor will be sufficiently borated so that criticality cannot occur through control rod movement.
The preventive measures should be included in the Technical Specifications.
Response
During operating modes 1 and 2, all reactor coolant loops must be in operation in accordance with the Technical Specifications. For mode 3, at least one reactor coolant loop must be in operation. For modes 4 and 5, at least one reactor coolant loop or one of the two residual heat removal subsystems must be in operation. For the case of residual heat removal system operation, protec tion against DNBR<1.30 cannot be demonstrated for an uncontrolled rod withdrawal event when only the in'termediate or power range channels are assumed to function. The low core mass velocities realized under residual heat removal subsystem operation are outside the range of validity for the approved DNB correlations for North Anna.
We have reviewed the option of requiring the reactor trip breakers to be open 30
unless one or more reactor coolant pumps is operating, and have concluded that there are situations where rod withdrawal may be desired when only the residual l
heat removal subsystem is operating. For example, prudence may dictate withdrawal of the shutdown banks to provide protection against inadvertant criticality during boron dilution.
As a result, we are proposing revisions to Table 3.3-1 of the Technical Specifica-tions which will require that a minimum of two source range neutron flux channels be operable whenever the reactor trip system breakers are in the closed position and the control rod drive system is capable of rod withdrawal. (Under the current Specifications, operation with one channel may proceed providing thermal power is maintained below the P-6 permissive).
As discussed in Part b. above, we are also proposing an additional entry to Table 3.3-2 or the Technical Specifications to require a source range channel response time of < 0.5 seconds. This requirement is consistent with the current require-for the power range channels and will provide adequate response to prevent ment significant fission power generation following an uncontrolled control rod with-drceal.
The source range trip actuates on a 1 out of 2 channels coincidence requirement.
l General Design Criterion 21 of 10 CFR 50 Appendix A (Protection System Reliabil-ity and Testability) states that " redundancy and independence designed into the protection system shall be suf ficient to assure that (1) no single f ailure results in Icss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the 31
acceptable reliability of operation of the protection system can be otherwise dem-onstrated."
With the 1 out of 2 coincidence design, the single failure criterion cannot be met if one channel is out of service. Therefore an update to the Techni-cal Specification Table 3.3-1 is being proposed which would require that a minimum of 2 source range channels be operable with 1 channel to trip whenever the reactor trip breakers are in the closed position and thn control rod drive cystem is capa-ble of rod withdrawal. In.this way the possibility of a rod withdrawal event is precluded during those periods when the single failure criterion cannot be met for the source range trip.
. General Design Criterion 2 (Design Bases for Protection Against Natural Phenomena) requires that safety related systems be designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, etc.
The criterion further states that the design bases should reflect "the importance of the safety functions to be performed". We have considered the implications of this criterion for the source -
range channels at North Anna-which are not seismically qualified - arid have con-cluded seismic qualification of the channels need not be demonstrated to show ade-2-
quate protection against rod withdrawal events occurring at shutdown. By " adequate protection" we refer to meeting the ANS Condition II fuel integrity limits (which Westinghouse has shown equates to a W-3 DNBR >1.30 for our plants). The Condition II limits were established for relatively high frequency events (i.e. on the order of once per calendar year per plant). A significant seismic event, on the other hand, is considered a very low probability event for North Anna. We therefore conclude that seismic qualification for instrumentation relied upon only to main-tain the plant within Condition II limits during an anticipated transient (i.e.
rod withdrawal) is not required.
4 f
32
References:
- 1. ' Letter from W. L. Stewart (VP) to H. R. Denton (NRC), " Amendment to Operating Licenses NPF-4 and NPF-7, North Anna Power Station Unit Nos.1 and 2, Proposed Technical Specifications Changes'!, Serial
~ No.85-077, May 2,1985 (Core Power Uprate Request).
- 2. Westinghouse Owners Group, " Emergency Response Guidelines - High Pressure Version," Rev.1, September 1983.
- 3. Motley, F. S., et. al., "New Westinghouse Correlation WRB-1 for Predicting Critical Heat Flux in Rod Bundles With Mixing Vane Grids," WCAP-8762, July 1976 (Proprietary).
- 4. Letter from W. L. Stewart (VP) to H. R. Denton (NRC), " Virginia Electric and Power Company, North Anna Power Station Units 1.and 2, Proposed Technical Specification Changes", Serial No. 523A, February 14, 1985.
N i
33
ATTACILMENT 2 ADDITIONAL TECHNICAL SPECIFICATIONS Cl!ANGES January, 1986 i
l
NORTH ANNA UNIT 1 TECHNICAL SPECIFICATION
' CHANGES 1
LIMITING SAFETY SYSTEM SETTINGS BASES The Power Range Negative Rate Trip provides protection _for control rod drop accidents.
At high power, a rod drop accident could cause local flux peaking which could cause an unconservative local DNBR to exist.
The Power Range Negative Rate Trip will prevent this from occurring by tripping the reactor.
No credit is taken for operation of the Power Range Negative Rate Trip for those control rod drop accidents for which the DNBR's will be greater than the applicable design limit'DNBR value for each fuel type.
Intermediate and Source Range, Nuclear Flux The Source and Intermediate Range, Nuclear Flux trips provide reactor core protection during shutdown (Modes 3, 4 and 5) when the reactor trip system
~
breakers are in the closed position.
The Source and Intermediate Range trips in addition ' to the Power Range trips provide core protection during reactor startup (Mode 2).
. Reactor startup is prohibited unless the Source, Intermediate and Power Range trips are operable in accordance with Specificati 75 3.1.1.
The Source Range Channels will initiate a reactor trip 3
at about 10 counts per second unless manually blocked when P-6 becomes active.
The Intermediate Range Channels will initiate a reactor trip at a current level proportional to approximately 25 percent of FATED THERMAL POWER unless manually blocked when P-10 becomes active.
In the accident analyses, bounding transient results are based on reactivity excursions frcm an initially critical condition, where the source range trip is assumed to be blocked. Accidents initiated from a subcritical condition would produce less severe results since the source range trip would provide core protection at a lower power level.
No credit was taken for operation of the trip associated with the Intermediate Range Channels in the accident analyses; however, their functional capability at the specified trip settings is required by this specification to enhance the overall. reliability of the Reactor Protection System.
Overtemperature AT The Overtemperature AT trip provides core protection to prevent DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided that the transient is slow with respect to piping transient delays frem the core to the temperature detectors (about 4 seconds),
and pressure is within the range between the High and Low Pressure reactor trips.
This setpoint includes corrections for changes in density and heat capacity of water with temperature and dynamic compensation for piping delays from the core to the loop temperature detectors.
With ncrmal axial power distribution, this reactor trip limit is always below the core safety limit as shown in Figure 2.1-1.
If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the reactor trip is automatically reduced according to the notations in Table 2.2-1.
NORTH ANNA - UNIT 1 B 2-4 Amendment No.
i
~ _ _
J TABLE 3.3 2O h
REACTOR TRIP SYSTEM INSTRUMENTATION'
'E MINIMUM 8
TtyrAL NO.
' CHANNELS CHANNELS APPLICABLE j @ FUNCTIONAL UNIT OF CllANNELS TO TRIP OPERABLE MODES ACTION 1.
Manual Reactor' Trip 2
1 2
1,'2-and~*
12 i
2.
Power Range, heutron Flux 4
2 3
.1, 2
2#
3.
Power Range, Neutron Flux 4
2 3
1, 2
_2)
High Positive Rate 4.
Power Range, Neutron Flux 4
2 3
1, 2 2#
High Negative. Rate ti 5.
Intermediate Range, Neutron Flux 2-1 2
1, 2 and
- 3
', " 6.
Source Range, Neutron Flux A.
Startup 2
.1 2
2##
4 B.
Shutdown 2
.1 2
3*,
4*,and 5*
13 C.
Shutdown 2~
0 1
3, 4 and 5 5
1 l
7.
Overtemperature AT Three Loop Operation
.3 2
2 1, 2 2#
Two Loop Operation 3
1**.
2 1, ' 2.
.9-1 4 y
- a g.
2 en i
TABLE 3.3-1 (Continued)
ACTION 9 -
With a channel associated with an operating loop inoperable, restore the inoperable channel to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; however, one channel associated with an operating loop may be bypassed for,up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per Specification 4.3.1.1.1.
1 ACTION 10 -
With one channel inoperable, restore the inoperable channel to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or reduce THERMAL POWER to below P-8 within the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Operation below P-8 may continue pursuant to ACTION 11.
ACTION'll -
With less than the Minimum Number of Channels; OPERABLE, operation may continue provided the inoperable channel is p eced in the tripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.
ACTION 12 -
With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, restore the inoperable channel tc OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in HOT STANDBY within the text 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and/or open the reactor trip breakers.
ACTION 13 -
With the' number of OPERABLE channels one less than the minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or open the reactor trip breakers within the next hour.
2 NORTH ANNA - UNIT 1 3/4 3-7 Amendment No.
TABLE 3.3-2 5
REACTOR TRIP SYSTEM INSTRUMENTATION RESPONSE TIMES
- n 5>
i FUNCTIONAL UNIT RESPONSE' TIME e
1.
Manual Reactor Trip NOT APPLICABLE:
U
]
2.
Power Range, Neutron Flux s 0.5 seconds
- 3.
Power Range, Neutron Flux, NOT APPLICABLE High Positive Rate
)
4.
Power Range, Neutron Flux, s 0.5' seconds
- High Negative Rate i
5.
Intermediate Range.-Neutron Flux NOT APPLICABLE 6.
Source Range, Neutron Flux
.s 0.5 seconds
- 7.
Overtemperature AT s 4.0 seconds
- Y 5
8.
Overpower AT NOT APPLICABLE 9.
Pressurizer Pressure--Low s 2.0 seconds j
10.
Pressurizer Pressure--High s 2.0 seconds 11.
Pressurizer Water Level--High NOT APPLICABLE j
Neutron detectors are exempt from response time testing. Response of the neutron flux signal i
E portion of the channel time shall be measured from detector output or input of first electronic.
component in' channel.
5 m
f
.if I
1
>s D'
. ~
y TABLE 3.3-3
.:o Ed ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION.
I
$z MINIMUM TOTAL NC.
CHANNELS CHANNEI.C -
APPLICABLE FUNCTIONAL UNIT OF CliANNELS '
TO TRIP OPERABLE MODES ACTION-1 z
U l.
SAFETY INJECTION, TURBINE TRIP AND FEEDWATER ISOLATION a.
Manual Initiation 2
1 2
1,2,3,4 18 --
b.
Automatic Actuation 2
1 2
1,2,3,4 13 i
c.
Containment 3
2 2
1, 2, 3, 4 14*
1 Pressure-High d.
Pressurizer 3
2 2
1, 2, 3 14*
Pressure-Low-Low s
v~
e.
Differential 1, 2, 3 Pressure Between 5
Steam Lines - High Three Loops 3/ steam line 2/ steam line' 2/ steam line 14*
l Operating twice and 1/3 i
steam lines
.)
Two Loops
-3/ operating 2
/ steam 2/ operating 15 Operating steam line line twice steam line in either l
operating i
steam.line i
E.
f.
Steam Flow in Two 1, 2, 3 5
Steam Lines-High g:
1 i
.1
TABLE 4.3-2 5y ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION 2:
SURVEILLANCE REQUIREMENTS
$g CHANNEL MODES IN WilICH CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST REQUIRED e
3 H
1.
SAFETY INJECTION, TURBINE TRIP AND
~
FEEDWATER ISOLATION
- a. Manual Initiation N.A.
N.A.
M(1) 1, 2, 3, 4
- b. Automatic Actuation Logic N.A.
N.A.
M(2) 1, 2, 3, 4
- c. Containment Pressure-High S
R M
1, 2, 3, 4
- d. Pressurizer Pressure--Low-Low S
R M
1, 2, 3
- e. Differential Pressure S
R M
1, 2, 3 y
3:
Between Steam Lines-High
- f. Steam Flow in Two Steam S
R M
1, 2, 3 Lines--liigh Coincident with
~
T
--Low-Lov or Steam Line PSeSsure--Low 2.
- a. Manual Initiation N.A.
N.A.
M(1) 1, 2, 3, 4
- b. Automatic Actuation Logic N.A.
N.A.
M(2) 1, 2, 3, 4 I
- c. Containment Pressure--liigh-S R
M 1, 2, 3 y-High en O
t i.
EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - T
< 350*F avg LIMITING CONDITIONS FOR OPERATION 3.5.3 As a minimum, one ECCS subsystem comprised of the following. shall be OPERABLE:
a.
One OPERABLE centrifugal chargina amp #,
r b.
One OPERABLE low head safety injection pump #, and c.
An OPERABLE flow path capable of automatically transferring fluid to i
the reactor coolant system when taking suction from the refueling water storage tank or from the containment sump when the suction is transferred during the recirculation phase of operation or from the discharge of the outside recirculation spray putup.
APPLICABILITY: MODE 4.
l ACTION:
a.
With no ECCS subsystem OPERABLE because of the inoperability of either the ' centrifugal charging pump or the flow ' path from the refueling water storage tank, restore at least one ECCS subsystem to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in COLD SHUTDOWN within the next 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.
b.
With ~no ECT'i subsystem OPEMBLF because of the inoperability cf the low head safety injection pump, restore at least'one ECCS subsystem to OPERABLE status or maintain the Reactor Coolant System T less than 350*F by use of alternate heat removal methods.
"#8 4
- c.
- In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 vithin 90 days j
describing the circumstances of the actuation and the total 1
accumulated actuation cycles to date.
i
- A maximum number of one centrifugal charging pump and one low head safety injection pump shall be OPERABLE whenever the temperature of one or more of the RCS cold legs is less than or equal to 320*F.
l l
NORTH ANNA - UNIT 1 3/4 5-6 Amendment No.
I l
y
-Y-^-rw et--e--
tewyg--ryiw-wwrwwny
,r.wm9 7
ryg-yg,-it w
7-y9 mm-9 c.7. p e4rm-w yg m +4m-ww
- mm,.5aem.__g.-
ii 39---wpamq
.g,-o-em.-.,pn-
-y-m--
-eg_m--=.wp---m.
rye
A NORTH ANNA UNIT 2 TECHNICAL SPECIFICATION CHANGES 4
4 c-
-.m--.,
'c,-
+- --,- - - - -
f LIMITING SAFETY SYSTEM SETTINGS 1
BASES
+
Intermediate and Source Range, Nuclear Flux The Source and Intermediate Range, Nuclear Flux trips provide reactor core protection during shutdown (Modes 3, 4 and 5) when the reactor trip system breakers are in the closed position. The Source and Intermediate Range l
trips ~ in addition to the Power Range trips provide core protection during l
reactor startup (Mode 2).
Reactor startup is prohibited unless the Source, Intermediate and Power Range trips are operable in accordance with SpecificaticS5 3.1.1.
The Source Range Channels will initiate a reactor trip 3
at about 10 counts per second unless manually blocked when P-6 becomes active.
The Intermediate Range Channels will initiated a reactor trip at a current level proportional to approximately 25 percent of RATED THERMAL POWER unless manually blocked when P-10 becomes active.
In the accident analyses, bounding transient results are based on reactivity excursions from an initially critical condition, where the source range trip is assumed to be' blocked. Accidents initiated from a subcritical condition would produce less severe results since the source range trip would provide core protection at a lower power level.
No credit was taken for operation of the trip associated with the Intermediate Range Channels in the accident analyses; however, their functional capability at the specified trip settings 'is required by this specification to enhance the overall reliability of the Reactor Protection System.
Overtemperature Delta T The Overtemperature Delta T trip provides core protection to prevent DNB j
for all combinations of pressure, power, coolant temperature, and axial power distribution, provided that the transient is slow with respect to piping transit delays from the core to the temperature detectors (about 4 seconds),
and pressure is within the range between the High and Low Pressure reactor trips.
This setpoint includes corrections for changes in density and heat capacity of water with temperature and dynamic compensation for piping delays from the core to the loop temperature detectors.
With normal axial power i
distributien..this reactor trip limit is always below the core safety limit as shown in Figere 2.1-1.
If axial peaks are greater than design, as indicated by the differeiee between top and bottom power range nuclear detectors, the reactor trip is automatically reduced according to the notations in Table 2.2-1.
}
Operation with a reactor coolant loop out of service below the 3 loop P-8 set point does not require reactor protection system set point modification because the P-8 set point and associated trip will prevent DNB during 2 loop operation exclusive of the Overtemperature Delta T set point.
Two loop operation above the 3~1oop P-8 set point is permissible after resetting the a
K1, K2 and K3 inputs to the Overtemperature Delta T channels and raising the P-8 set point to its 2 loop value.
In this mode of operation, the P-8 interlock and trip functions as a High Neutron Flux trip at the reduced power level.
NORTH ANNA - UNIT 2 B 2-4 Amendment No.
l i
z TABLE 3.3-1 O
E!
REACTOR TRIP SYSTEM INSTRUMENTATION
!Ez**
MINIMUM 4
l TOTAL NO.
CilANNELS CHANNELS APPLICABLE.
5 FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES' ACTION
, H 1
w 1.
1 2
1, 2 and *
.12 2.,
Power Range, Neutron Flux 4
2 3
1, 2 2#
3.
Power Range, Neutron Flux 4
2 3
1, 2 2#.
liigh Positive Rate 4
1 4.
Power Range, Neutron Flux 4
2 3
1, 2 2#
High Negative Rat-5.
Intermediate Range, Neutron Flux 2
1 2
1, 2 and
- 3 6.
Source Range, Neutron Flux A.
Startup 2
1 2
2##
4 B.
Shutdown 2
1 2
3*,
4* and'5*
13 C.
Shutdown 2
0 1
3, 4 and 5 5
7.
Overtemperature AT Three Loop Operation 3
2 2
1, 2 7#
Two Loop Operation 3
1**
2 1, 2 9
a 8-i an i
4 l
J 1
1
d TABLE 3.3-1 (Continued)
ACTION 9'-
With a channel associated with an operating loop inoperable, restore.the inoperable channel to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; however, one channel associated with an operating loop may be bypassed for.up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per. Specification 4.3.1.1.1.
' ACTION 10 -
With one channel inoperable, restore the inoperable channel to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or reduce THERMAL POWER tc below P-8, (Block of Low Reactor Coolant Pump Flow and Reactor Coolant Pump Breaker Position) setpoint, within the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Operation below P-8, (Block of Low Reactor Coolant Pump Flow and Reactor Coolant Pump Breaker Position) setpoint, may j.
continue pursuant to ACTION 11.
ACTION 11 -
With less than the Minimum Number of Channels OPERABLE, operation may continue provided the inoperable channel is placed in the tripped condition within I hour.
ACTION 12 -
With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and/or open the reactor trip breakers.
ACTION 13 -
With the number of OPERABLE channels one less -than the minimum channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48-hours or open the reactor trip breakers within the
- text hour.
i i
i i
i l
I i-5 NORTH ANNA - UNIT 2 3/4 3-7 Amendment No.
l
L
.y TABLE 3.3-2 O
Ej REACTOR TRIP SYSTEM INSTRUMENTATION RESPONSE TIMES E
- 4
- FUNCTIONAL UNIT RESPONSE TIME l.
~NOT APPLICABLE' Ey 2.
Power Range, Neutron Flux s 0.5 seconds
- w 3.
Power Range, Neutron Flux.
NOT APPLICABLE High Positive Rate 4.
Power Range, Neutron Flux, s 0.5 seconds
- High Negative Rate 5.
Intermediate Range, Neutron Flux NOT APPLICABLE id 6.
Source Range, Neutron Flux s 0.5 seconds
- s~
y 7.
Overtemperature AT s 4.0 seconds
- o 8.
Overpower AT NOT APPLICABLE 9.
Pressurizer Pressure--Low s 2.0 seconds 10.
Pressurizer Pressure--High s 2.0 seconds 11.
Pressurizer Water Level--High NOT APPLICABLE
[
- Neutron detectors are exempt from response time. testing. Response of the neutron flux signal E,
portion of the channel time shall be measured from detector output or input of first electronic component in channel.
5 F
-b J
.. ~..
TABLE 3.3-3 mo ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO.
CHANNELS CHANNELS APPLICABLE e
FUNCTIONAL UNIT OF CilANNELS TO TRIP OPERABLE MODES ACTION c:
3!
1.
SAFETY INJECTION, TURBINE TRIP AND i
FEEDWATER ISOLATION sa a.
Manual Initiation 2
1
~2
.1, 2, 3, 4 18 j
b.
Automatic Actuation 2
1 2
1, 2,3,4 13 i
e c.
Containment 3
2 2
2,3,4 14*
!~
Pressure-High
,i d.
Pressurizer 3
2 2
1,2,3 14*
i Pressure-Low-Low e.
Differential 1, 2, 3 Pressure Between 5
Steam Lines - High Three Loops 3/ steam line 2/ steam line 2/ steam line 14*
Operating twice and 1/3 steam lines i
Two Loops 3/ operating 2
/ steam 2/ operating 15 Operating stsam line line twice steam line in either g
operating g
steam line j
I l
[
TABLE'4.3-2 2:
ENGINEEFED SAFETY FEATURE ACTUATION SYST'EM INSTRUMENTATION.
-O SURVEILLANCE REQUIREMENTS U
CHANNEL MODES IN.WHICH CHANNEL CHANNEL FUNCTIONAL
-SURVEILLANCE i
FUNCTIONAL UNIT CHECK CALIBRATION TEST REQUIRED 5
1.
SAFETY INJECTION, TURBINE TRIP AND 1
U FEEDWATER ISOLATION s
i w
- a. Manual Initiation N.A.
N.A.
M(1).
1, 2, 3, 4
- b. Automatic' Actuation Logic N.A.
N.A.
M(2) 1.2 3,4 1
- c. Containment Pressure-High S
R M(3) 1, 2, 3, 4 1
- d. Pressurizer Pressure--Low-Low S
R
.M 1, 2, 3
].
- e. Differential Pressure S
.R M
1, 2, 3 3:
Between Steam Lines-High t
[
- f. Steam Flow in Two Steam S
R M
1, 2, 3 Lines--High Coincident with 4
w T
--Low-Low or Steam Line i
PSe$sure--Low t
2.
l
- a. Manual Initiation N.A.
N.A.
M(1).
1, 2, 3, 4
)
]
- b. Automatic' Actuation Logic N.A.
N.A.
M(2) 1, 2, 3. 4 Y
g
- c. Containment Pressure--High-S R
M(3) 1, 2, 3 g
High
.n e
v
EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - T less than 350*F avg LIMITING CONDITION FOR OPERATION 3'.5.3 As a minimum, one ECCS subsystem comprised of the following shall be OPERABLE:
a.
One OPERABLE centrifugal charging pump #,
b.
One OPERABLE low head safety injection pump #, and c.
An OPERABLE flow path capable of automatically transferring fluid to the reactor coolant system when taking suction from the refueling water storage tank or from the containment sump when the suction is transferred during the recirculation phase of operation.
APPLICABILITY: MODE 4.
ACTION:
a.
With no ECCS subsystem OPERABLE because of the inoperability of either the centrifugal charging pump or the flow path from the refueling water storage tank, restore at least one ECCS subsystem to OPERABLE status within I hour or be in COLD SHUTDOWN within the next 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.
b.
With no ECCS subsystem OPERABLE because of the inoperability of the low head safety injection pump, restore at least one ECCS subsystem to OPERABLE status or maintain the Reactor Coolant System T less than 350*F by use of alternate heat removal methods.
""E c.
In the event the ECCS is actuated and injects water into the Reactor.
Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date.
The current value of the usage factor for each affected safety injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70.
- A maximum of one centrifugal charging pump and one low head safety injection pump shall be OPERABLE whenever the temperature of one or more of the RCS cold legs is less than or equal to 340*F.
NORTH ANNA - UNIT 2 3/4 5-6 Amendment No.
AITACHMENT 3 i
SAFETY EVALUATION OF ADDITIONAL TECHNICAL SPECIFICATIONS CHANGES January, 1986 l
4 In response to several Staff questions pertaining to our core uprate 11-cense _ amendment request. for North anna Units 1 and 2, Virginia Electric and Power Company is proposing severai changes to the Technical Specifi-cations. These changes are discussed in detail below.
Table 3.3-1, " Reactor Trip Instrumentation", has been updated to provide a greater level of redundancy for the source range neutron flux trip during shutdown modes.
Under the existing Table, only one source range channel need be operable with the reactor trip breakers closed in modes 3, 4, and 5 as long as power is above permissive P-6 (Intermediate Range Current
>10**-10 amps). Below P-6, operation may continue as long as the inoper-able channel is restored to operable status prior to increasing power above the P-6 setpoint. Under the revised table, two source range channels must be operable in modes 3-5 whenever the reactor trip breakers are closed and the control rod drive system is capable of rod withdrawal. The associated action for one less channel operable than specified requires restoration of the inoperable channel to operable status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or opening the reactor trip breakers within the next hour.
As a result of this change, redundant protection against the potential
~
effects of an uncontrolled rod withdrawal event is provided during the shutdown modes.
The source range trips will act to terminate such a withdrawal and restore the unit to a shutdown condition prior to the gen-eration of significant core power. For the case of reactor trip breakers open, the revised table specifies a minimum of one source range channel for indication purposes, consistent with the current table.
2
Table 3.3-2,
" Reactor Trip System Instrumentation Response Times", has also been amended to require response time testing for the source range neutron flux trip. Under the revised table a. response time of <0.5 seconds
- (excluding the neutron detector) is specified~for each channel. This re-quirement is consistent with the current requirement for the power range channels.
For the source range trip, this response time is adequate to prevent significant power generation following an uncontrolled rod with-drawal from shutdown, as discussed above.
The effect of the proposed changes to Tables 3.3-1 and 3.3-2 is to provide added assurance that the accident analysis of the uncontrolled rod with-drawal from subcritical event presented in the UFSAR remains bounding.
Therefore no unreviewed safety question as defined in 10 CFR 50.59 is created.
Specifically:
- a. The requirement to maintain a minimum of 2 source range channels operable whenever the reactor trip breakers are closed will ensure redundant protection against rod withdrawal events and will not increase the probability of their occurrence nor increase the consequenses of such an event. The added requirement for response time testing of the source range channels enhances the the_ reliability of the protection system.
)
- b. No new accident types are created by the proposed changes, which serve to enhsnce the reactor protection system surveillance program.
3 l
l L
- c. Since the UFSAR accident analyses remain bounding, no safety margins are reduced.
Technical Specification 3.3.2.1,
" Engineered Safety Feature Actuation System Instrumentation," Tables 3.3-3 and 4.3-2.have been modified to re-quire Safety Injection from a containment. pressure - high signal during Mode 4 operation.
Under the existing Tables, Safety Injection from a containment pressure - high signal is required only during Modes 1, 2, and 3 operation. The associated action for one less channel operable than the total number of channels is that operation with the inoperable channel may continue until the performance of the next operational test provided the inoperable channel is placed in the tripped condition within one hour.
As a result of these changes, a Safety Injection signal is available to mitigate a large break LOCA in both Modes 3 and 4 operation.
The other sources of a Safety Injection signal are blocked as necessary during the cooldown process.
These include the pressurizer low-low pressure signal (P-11 below 1990 psig) and the high steam line flow (P-12 below 541 degrees F).
Changing these tables provides more restrictive operating conditions and surveillance requirements.
Technical Specification 3.5.3, ECCS Subsystems - TAVG < 350 Degrees F, has also been amended to require an operable flow path capable of automatically transferring fluid to the RCS when taking suction from the RWST.
The amended Technical Specification makes the normal operating practice a re-4
quirement since 'the plant is routinely configured in this manner. Finally, this Technical Specification change provides more restrictive operating conditions.
The proposed changes to Specifications 3.3.2.1 and 3.5.3 provide assurance that the full power analysis of the loss of coolant accident presented in the UFSAR remains bounding.
Therefore no unreviewed safety question as defined in 10 CFR 50.59 is created. Specifically:
- a. The requirements to be imposed for Mode 4 operation will insure that the systems needed for mitigation of a LOCA are operable. Furthermore, the addition of these requirements will not increase the probability of a LOCA occurring nor increase the consequences of such an event. The added requirements merely formalize what is now standard operating practice,
- b. No new accident types are created by the proposed Technical Specification changes,
In fact, safety margins are increased because the changes provide more restrictive operating conditions.
It has also been determined that the additional Technical Specifications changes described above do not involve a significant hazards consideration as described in 10 CFR 50.92.
This determination was based on the fore-5
going safety evaluation and a review of those types of amendments which the NRC ccnsiders unlikely to involve significant hazards considerations.
Example 11'(48 FR 14870, 4/6/83) cites "a change that constitutes an ad-ditional limitation, restriction or control not presently included in the
~
technical specifications: for example, a more stringent surveillance re-quirement." The additional changes are being proposed to ensure consist-ency with the safety analysis during shutdown modes of operation.
They involve additional equipment operability and surveillance requirements for the shutdown modes and therefore clearly fall under the cited example.
As a result, the additional changes do not:
- a. Involve a significant increase in the probability or consequences of an accident previously evaluated, or
- b. Create the possibility of a new or different kind of accident than previously evaluated, or Involve a significant reduction in a margin of safety.
c.
6