ML20154A160
| ML20154A160 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 08/31/1988 |
| From: | Gongaware B, Leach C, Tuley C WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML19297G891 | List: |
| References | |
| WCAP-11884, NUDOCS 8809120094 | |
| Download: ML20154A160 (118) | |
Text
{{#Wiki_filter:e a WESTINGHOUSE CLASS 3 WCAP-11884 4 IMPLEMEdTATION OF TiiE STFAM GENERATOR leW LOW LEVil REACTOR TRIP TIME DELAY AND ENVIRONMENTAL ALLOWANCE MOLIFIER IN THE CALLAWAY PLAf;T Authors: C. i. Leach, B. L. Gongaware, C. R. Tuley, L. E. Erin, S. Miranda August, 1988 Approved: v v DN Approved: - y Manager, Manager, instrumentstion and Transient Analygic I Control Systems Licensing Approved-Mafiagery Y ' b Process Control Equipment Prepared by: Westinghouse Electric Co. Power Systems Division l Nuclear Safety Department , f
~.
Westinghouse Electric Corporation Power Systems Division 94 esos P. O. Box 355
$$$91,$$ocK0500gfpp Pittsburgh, Pennsylvania 15?30 )
P l
1 TABLE OF CONTENTS ,i , ,. Title Ecut Acronyms 111
# Li'.t of Tables v l List of Ftaures vii 1
1.0 INTRODUCTION
1-1 2.0 SAFETY ANALYSIS CESIGN BASIS 2.1 Introduction 2-1 2.2 TTD/EAM Basic Fanctinnal Description 2-3 2.3 Safety Analyses and Evaluations 26 2.3.1 S/G Low Low Level Trip Setpoint and Time Delay Safaty Analysis Limit Determination 2-7 2.3.2 Verification of Design Basis Safety Analyses 2-15 2.3.3 Analy21s Results, Sequence of Events Tables and Transient Behavior vs. Time Plots 2-27 ,, 2.4 Conclusions 2 28
,. 3.0 I&C DESIGN INFORMATION 3-1 3.1 EAM Functional Implementatier, 3-1 3.1.1 Functional Description 3-1 3.1.2 Implementation Descripti:n 3-1 3.2 TTD Functional Implementation 3-2 5 3.2.1 Functional Description 32 3.2.2 Implementation Description 3-3 3.3 Alarms, Annunciators, Indicators, and Status Lights 34
/
7 3.4 Hardware Description 3o6 3.4.1 Printed Circuit Card Descriptions 3-6 3.4.2 Reliability 3-8 , 3.5 Equipnient Qualification 39 3.5.1 Program Description 3-9 3.5.2 EQ Documentation 3-10 3.6 Surveillar ce Testing 3-12 3.6.1 Test Capability 3-12 3.6.2 Test Methodology 3-15 3.7 Applicable I&C Criteria 3-17 3.7.1 Nuclear Regulatory Comission 3 17 t 3.7.2 IEEE Standards 3-20 3.7.3 Compliance with IEEE Std. 279-1971 3-21 3.8 Conclusions 3 28 4.0 PROTECTION SYSTEM SETPOINT STUDY 4-1 5.0 RE.cERENCES 5-1 , 9 11 t g I
O
, ACRONYMS AC Alternating Current . ATWS Anticipated Transient Without Scram EAM Enfironmental Allowance Modifier 3
EQDP Equipment Qualificttion Data Package EQTR Equipment Qualification Test Report GDC General Design Criteria HFP Mot Full Power IEEE Institute of Electronics and Eltetrical Engineers LOCA Loss of Coolant Accident LONF Loss of Normal Feedwater MTBF Mean Time Between Failures NAI Annunciator Interface Card NAL Comparator Card NCT Channel Test Card NMT Haster Test Card NPL PROM Logf.c Card NRC Nuclear Regulatory Comission OBE Operating Basis Earthquake OFA Optimized Fuel Assembly PHTC Positive Moderator Temperature Coefficient , PROM Programable Read Only Memory R/E Resistance to Voltage RCS Reactor Coolant System RG Regulatory Guide RTO Resistance Temperature Detector RTP Rated Thermal Power S/G Steam Generator SAL Safety Analysis Limit SER Safety Evaluation Report d O 9 iii L
^
ACRONYMS (cont.) SHE Significant Hazards Evaluation . SS: Sefe Shutdown Earthquake SSPS Solid State Protection System TRAP Trip Reduction and Assessment Program TTD Trip Time Delay V5 Vantage-5 Fuel Ascambly WOG Westinghouse Owners Group - WRD Water Reactoi' Division l t
. u l
l l r l l te - i I f
l SECTION 2.0 LIST OF TABLES Table 2.3.I Analysis Assumptions Table I Case I Sequence of Events: Loss of Normal Feedwater to Four Steam Generators for 10% RTP Interlock Time Delay Table II Case !! Sequence of Events: Loss of Normal Feedwater to One Steam Generator for 10% RTP Interlock Time Deltiy
; Table III case III Sequence of Events:
loss of Normal feedwater to Four Steam . Generators for 20% RTP Interlock Time Delay Table IV Casa IV Sequence of Events:
~
Loss of Normal Feedwater to One Steam Generator for 20% RTP Interlock Time Delay d Table V Case V Sequence of Events: Full Power loss of Nonemergency AC Power to the Station Auxiliaries for S/G Low-Low Level ; Trip Setpoint = 0% of Span Tabel VI Case VI Sequence of Events: Full Power Loss of Normal Feedwater to Four Steam Generators for S/G Low Low Level Trip Setpoint = Of. of Span ' Table VII Case VII Sequence of Events: Feedline Break with Offsite Power for 20% RTP Interlock Time Delay t f y
._ . ~
- i. '
SECTION 4.0 LIST OF TABLES
, i Table 4 1 Steam Generator Water Level - Low Low --
"Normal" Table 4 2 Steam Generator Water Level - Low Low --
"Adverse" Table 4-3 Containment Pressure - EAM Table 4 4 Delta T (Power - 1 & Power -2)
Table 4-5 Callaway EAM/TTD Table 4 6 Westinghouse Protection System STS Setpoint inputs Callaway EAM/TTD 1 1 A 1 i vi i i j .- i e d
SECTION 2.0 LIST OF FIGURES Ccse I: Loss of Normal Feedwater to Four Steam Generators for 10% Power Interlock
~
Figure I.1 Nuclear Powsr Reactor Coolant Mass Flow Rate Steam Generator Pressure Figure 1.2 Reactor Coolant Temperature Figure 1.3 Pressurizer Pressure and Water Volume Case II: Loss of Normal feedwater to One Steam Generator for 10% Power Interlock Figure 11.1 Nuclear Power Reactor Coolant Mass Flow Rate Steam Generator Pressure Figure II.2 Reactor Coolant Temperature : Figure II.3 Pressurizer Pressure and Water Volume Case III: Loss of Normal Feedwater to Four Steam Generators for 20% Power Interlock Figure III.) Nuclear Power Reactor Coolant Mass Flow Rate e Steam Generator Pressure Figure III.2 Reactor Coolant Temperature Figure III.3 Pressurizer Pressure and Water Volume Case IV: Less of Normal Feedwater to One Steam Generator for 20% Power Interlock Figure IV.1 Nuclear Pcwer Reactor Coolant Mass Flow Rate Steam Generator Pressure Figure IV.2 Reactor Coolant Temperature Figure IV.3 Pressurizer Pressure and Water Volume vii
LIST OF FIGURES - CONT. Case V: FSAR Chapter 15.2.6 Loss of Nonemergency AC Power to the Station Auxiliaries Figure V.1 Nuc1 car Power Reactor Coolant Mass Flow Rate -
~
Steam Generator Pressure Figure V.2 Reactor Coolant Temperature Figure V.3 Pressurizer Pressure and Water Volume Case VI: FSAR Chapter 15.2.7 Loss of Nomal Feedwater Figure VI.1 Nuclear Power Reactor Coolant Mass Flow Rate Steam Generator Pressure Figure VI.2 Reactor Coolant Temperature Figure VI.3 Pressurizar Pressure and Water Volume Case VII: Feedline Break with Offsite Power 20% Power Inter 1cck Time Delay for 2/4 Logic Figure VII.1 Nuclear Power i Core Heat Flux - Total' Core Reactivity [ figure VII.2 Pressurizer Pressure and Water Volume
- Figure VII.3 Reactor Coolant Mass Flowrate i Feedwater Line Break Flow ;
Figure VII.4 Reactor Coolant Temperature Figure VII.5 Steam Generator Shell Pressure i r l 1 I viii .- 9
- t SECTION 3.0 LIST OF FIGURES ,
s
. Figure 1 EM/TTD Logic Diagram Figure 2 EM Logic Diagram Figure 3 Possible Delay Time vs. Power Level Figure 4 TTD Logic Diagram Figure 5 EM/TTD Test Logic 4.
I
?
t 1 l 4 e ., t l I r
- e I
s. ix
- i i
j
= , - _ , , . , , - . - . . - - , - . . _ , - - , . - - - - - . . . , -----. -
- . - - . . .,-.-~,---,,------n-
1.0 INTRODUCTION
,- To address inadvertent feedwater related trips associated with low-low steam generator water level, the protection system may be I modified, in accordan:e with IEEE Std. ?79-1971, with the addition of the Environmental Allowance Modifier (EAM) and the Trip Time Delay (TTD) circuitry. The EAM will distinguish between normal and adverse containment environments and enable an adverse environment steam generator low low level trip setpoint only when an adverse containment environment is present. The TTD will reduce inadvertent reactor trips by delaying the trip, providing time for level transients to stabilize and for water level to be restored. The delay is determinsd according to the power level of the p1&nt and the number of steam generators with inventories below the low low level trip setpoint.
e 11 ! s. i
2.0 SAFETY ANALYSIS DESIGN BASIS 2.1 Introduction The Steam Generator Low-Low level Reactor Trip Environmental Allowance Modifier (EAM) and Trip Time Delay (TTD) conceptual designs are the result of the Westinghouse Owners Group Trip Reduction and Assessment Program (WOG-TRAP) to develop a means to reduce the frequency of unnecessary feedwater-related reactor trips. The development of these concepts is documented in WCAP-ll342-P A (Reference 1) and WCAP-ll325 P A (Reference 2), respectively. In ' January 1988, the NRC issued Safety Evaluation Reports (SERs) approving TTD/EAM conceptual designs of WCAP-ll325-P-A and WCAP-11342-P A for Westinghouse FWRs. As documented in the SERs, NRC approval f s based on the review cf s conceptual design for each system, representative functional requirements, description of the ! safety analysis methodology and generic safety analysis results. The SERs also list the licensing submittt.lt that will be required by the NRC for review of plant-specific designs. As described in detail in Section 3 of this report, the Callaway Plant design is a Westinghouse analog implementation of the TT0/EAM logic located in each S/G Low Low Level protection set, upstream of the SSPS logic. The puroose of this report is to provide safety analysis support, consistent with the repirements specified in the SERs, for the implement 2 tion of the TTD/EAM concepts in the Callaway Plant. This report provides:
- 1. Basic functional description of the Callaway Plant TTD/EAM design
- 2. Results of calculations performed, consistent with the WCAP ll325 P A approved methodology, to develop the Safety Analysis Limits (SALs) for the S/G Low Low Level, power level dependent trip time delays 4
21
- 3. Results of calculations performed to develop. the SALs for the S/G Low-Low level normal and harsh (high temperature) containment environment trip setpoints -
~
- 4. Evaluation of the impacts of the SALs specified above on ~
the following non LOCA safety analysis design bases:
- 1. FSAR Chapter 15 (excluding S/G Tube Rupture)
- 11. FSAR Chapter 6 Steamline Break Mass / Energy Releases Inside Containment i
111. Steamline Break Mass / Energy Releases Outside Containment
- 5. Evaluation of the impact of the SALs specified above on the following LOCA safety analysis design bases:
- 1. FSAR Chapter 15
- 11. Rod Ejection Mass / Energy Releases for Dose Calculations '
111. Reactor Vessel and loop Blowdown Forces iv. Post-LOCA Long term Core Cooling Suberiticality Requirement
- v. Post LOCA Hotleg Switchover Time 4
22
2.2 TTD/EAM Basic Functional Description The conceptual design of WCAP-11342 P-A (EAM) may be described as an automatic switch that raises the Steam Generator Low Low Level trip setpoint (to increase the environmental error allowance in the setpoint) whenever a harsh environment is indicated by detection of an elevated containment pressure. The EAM can reduce the frequency of unnecessary feedwater-related reactor trips by increasing the difference between the nominal steam generator water level and the low low level trip setpoint during normal operation. The S/G Low low Level trip setpoint is automatically raised to include the full environmental error allowance for protection during accidents which produce a harsh containment environment. Once the low-low water level trip setpoint (either the normal environment setpoint or the har.sh environment setpoint) is reachec, the TTD acts to delay reactor trip, main feedwater isolation and auxiliary feedwater system actuation to allow time for operator g corrective action or for natural stabilization of shrink / swell water level transients. The TTD i.e designed for low power er startup
, operations. The conceptual design of WCAP-11325 P A (TTD) may be generally described as a system of pre detemined programed trip delay times that are based upon (1) the prevailing power level at the tiina a low low level trip setpoint is reached, and by (2) the number of stean generators that are affected.
The Callaway TTD design is based on the introduction of two unique nominal power bistable setpoints of 10% and 20% Rated Themal Powcr (3565 MWt) and the addition of a 2/4 steam generator trip logic to the existing 1/4 loop logic. The delta-T channels, used for thermal overpower and overtemperature protection, will provide a correlation to power level and will be compared to the 10% and 20% nominal power bistable setpoints. These bistables will enable the transmission of the low low level signal at the expiration of the enabled TTD delays 23
if steam generator water level hss not been recovered. These 10% and 20% nominal power level bistable setpoints are well within the power . level range defined by the NRC in the WCAP-ll325 P-A SER for plant specific applicotions. Consistent with the WCAP-ll325-P-A . methodology, appropriate Safety Analysis Limits will therefore be determined for: 1/4 Steam Generator Logic Indicated Power s 10% of Rated Thermal Power (RTP) 1/4 Steam Generator Logic Indicated Power 5 20% of RTP and > 10% of RTP 2/4 Steam Generator Logic, l Indicated Power i 10% of RTP l 2/4 Steam Generator Logic. Indicated Power i 20% of RTP and > 10% of RTP l l No time delays are considered in this report for indicated power - levels greater than 20% of RTF. When the low low level trip setpoint, as determined via the EAM logic, is reached, all trip delay timers are actuated. As indicated above, the magnitude of the trip delay for each timer is pre set according to the power range with which it is interlocked and with the low low level logic path in which it is placed (e.g., low low level in a single steam generator or low low level in more than one steamgenerator). If a low-low level condition is detected in one steam generator, then only the timer that is in the single low-low level logic path and interlocked in the appropriate power range can satisfy the logic for .. transmission of the trip signal at the expiration of its trip delay. If, at any time during this trip delay, a low low level condition is .. 24
\
detected in a second steam generator, then the timer that is in the multiple low-low level logic path and interlocked in the appropriate power range can also satisfy the logic for transmission of the trip signal at the expiration of its trip delay. Since, at any given I power level, the trip dalay setpoint for two or more low steam generators will be shorter than the trip delay setpoint for one low steam generator, reactor trip will occur at the end of the shorter effective trip delay, thus provid'ing timely protective action for the more severe transient. Since all timers are actuated (at the same instant) by a single low-low level trip signal, it is possible for a second steam generator to reach its low low level trip setpoint after the appropriate multiple low low level trip delay has expired. In that cr.se, the reactor trip signal would be transmitted without further delay. If the power level decreases during a trip delay interval, this logic does not permit the lengthening of effective trip delays, which could re, ult from switching to timers interlocked with lower power ranges. If power level increases, which may occur for a positive moderstor temperature coefficient, the effective trip delays are shortened as higher interlocking power ranges become effective. If the water levels in all steam generators are not restored before the expiration of the shortest enabled trip delay, than the EAM/TTD logic routes the low low level trip signal into the SSPS channel logic. This system of (1) pre determined trip setpoints which are dependent oncontainmentenvironmentconditions,(2)powerlatches,(3) pre detemined trip delay setpoints that are interlocked with power level and protection logic paths, and (4) simultaneous start of all trip delay timers, is consistent with the approved conceptual designs and methodology for plant specific irrplementation presented in WCAP 11325 P A and WCAP ll342 P A. A detailed description of the .. specific hardware modifications and protection system logic upstream of the SSPS is provided in Section 3. 25
, 2.3 Safety Analyses and Evaluations Analysis / Evaluation Basis: .
The safety analyses and evaluttions discussed in this report were . performed with respect to the most recent design and licensing basis documentation prepared by Westinghouse for the Callaway Plant. The associated references are Rev. OL-2 of the Callaway FSAR and WCAP10961-P(References 3and4,respectively). Safety analysis I methodology used for new analyses and sensitivity studies is consistent with that applied for References 3 and 4, unless otherwise noted in this report. 1 o 100% Core Rated Thermal Power - 3565 MWt l 100% NSSS Power - 3579 MWt o A maximum positive moderator temperature coefficient of +5 ! pcm/*F for power levels below 70% Rated Thermal Power, ramping linearly to 0 pcm/'F f.om 70% to 100% Rated Thermi Power. . o Maximum Heat Flux Hot Channel Factor for V5 Fuel, Fq(z) - 2.50 . OFA Fuel, Fq(z) - 2.32 o Maximum HFP Nuclear Enthalpy Rise Hot Channel Factor for V5 Fuel - 1.65 l OFA Fuel - 1.50 l o 0FA/V-5 Transition Cores and Full V 5 Cores 1 o 15% maximum plant total steam generator tube plugging, not to exceed 15% in any single steam generator. 26
2.3.1 S/G Low Low Level Trip Setpoint and Time Delay Safety Analysis Limit Detemination Implementation of the TTD/EAM in the Callaway Plant will require acdtfication of the existing S/G Low-Low Level protection system setpoints and the introduction of time delays. Consistent with the approved analysis methodology of WCAP-11325 P-A, analyses have been done to detemine revised SALs for input to the S/G Low Low Level Technical Specification limits. As described in Section 2.2,10% and 20% RTP interlock time delays are introduced for the Callaway Plant TTD design. Associated with these interlocks will be a maximum allowable delay on the transmission of the S/G Low Low Level tr/r signal. Callaway specific Loss of hormal Feedwater analyses have been perfomed to provide the safety analysis limits for 1/4 and 2/4 logic time delays at the specified power interlocks. Additionally, the FSAR safety analyses which assume protective functions :'esulting from the S/G Low low Level signal have been analyzed assuming a S/G Low Low Level setpoint
,- of 0% of span. The following cases were analyzed to determine S/G Low Low Level trip setpoint and time delay SALs:
Case I: Loss of Nomal Feedwater to Four Steam Generators for 10% RTP Interlock Time Delay, S/G Low Low Level Trip Setpoint - 0% of Span Case !!: Loss of Normal Feedwater to One Steam Gencrator for 10% RTP Interlock Time Delay, i S/G Low Low Level Trip Setpoint - 0% of Span i Case III: Loss of Normal Feedwater to Four Steam Generators for 20% RTP interlock Time Delay,
,, S/G Low Low Leve'l Trik Setpoint - 0% of Span 1
27 I
Case IV: Loss of Normal Feedwater to One Steam Generator for 20% RTP Interlock Time Delay, S/G Low-Low Level Trip Setpoint - 0% of Span Case V: Full Power Loss of Non Emergency AC Power to the Station Auxiliaries, , S/G Low Low Level Trip Setpoint - 0% of Span Case VI: Full Power loss of Nomal Feedwater to Four Steam Steam Generators, S/G Low Low Level Trip Setpoint - 0% of Span Case VII: Feedline Break with Offsite Power, 20% RTP Interlock Time Delay for 2/4 Logic. S/G Low Low Level Trip Setpoint = 0% of Span Note: FSAR Chapter 15.2.8 (Reference 3) Full Power Feedwater System Pipe Break with and without offsite power, the remaining FSAR transient which assumes protective functions from the S/G Low Low Level signal, is already analyzed for a trip setpoint of 0% of span
- (See FSAR Section 15.2.8.2.1 andTable15.0-4). ,
2.3.1.1 Cases I through IV Analysis Assumptions Cases I through IV are Loss of Normal Feedwater transients analyzed to determine the Safety Analysis Limits for the S/G Low Low Level trip time delays and trip setpoints. These casos are analogeus to the generic studies performed for WCAP ll325 P A to arrive at 1/4 and 2/4 logic curves of time delay versus power level. Cases I through IV are performed specifically for the 10% and 20% RTP interlock time delays. The key analysis assumptions used for these cases are as follows. Analysis results are discussed in Section 2.3.3. 1
.. l l
28
- l. Initial Conditions Consistent with the WCAP ll325 P A analysis methodology, appropriate power level dependent initial conditions were assumed for Cases I through IV. See Table 2.3.1.
- 2. Decay Heat Consistent with the WCAP ll325 P A analysis methodology, all cases have used the ANS 1979 Decay Heat model (Reference 5). The analyses assumption considers a power rampdown rate from full l power of 5% per minute prior to the initiation of the loss of !
normal feedwater transients. This assumption is consistent with the maximum power coastdown rate documented in the Callaway FSAR Sections 7.7.2.4 and 10.4.7.2.3 (Reference 3).
- 3. Uncertainties Of particular importance to Cases I through IV is the uncertainty in power level indication since this function is integral to the TTD design. Cases I, !!, !!! and It!, performed to arrive at time delay SALs for the 10% and 20% RTP interlocks, assumed initial power levels of 19% and 29% of 3565 MWt, respectively. This assumption accounts for a maximtm uncertainty in power level indication of 9% of RTP. Power level indication errors and uncertainties are discussed in Section 4.
i
- 4. S/G Low Low Level Trip Setpoint t
The S/G Low tow Level trip setpoint assumed in these analyses is 0% of span. O4 P 29
- 5. S/G Low Low Level Trip Time Delays
~
The total S/G Low-Low Level trip time delays assumed in Cases I ~ through IV include the SAL for the power interlock time delays , and an additional 2 second allowance for the time'beteeen receipt of the signal and when the control rods are free to drop.
- 6. 1/4 Loop Loss of Normal Feedw&ter Cases II and IV assume a loss of normal feedwater to one steam generator. The loss of normal feedwater to one steam generator is not explicitly analyzed for the current Callaway FSAR since it is not necessary for any setpoint determination and its consequencee. given the current plant automatic protection o system, are bounded by those shown in the FSAR for lo:s of normal feedwater to all four steam generators. WCAP ll325 P A introduced the analysis of loss of feedwater to one steam e generator to support the concept of using 2/4 loop protection logic and 1/4 loop protection logic to respond to low level conditions in one or more steam generators. -
~
l
- 7. ModeratorTemperatureCoefficiant(MTC)
As indicated in Section 2.3, the analyses and evaluations of this report continue to support the design assumptions of the licensing basis analyses. One of these design assumptions is the maximum positive MTC as a function of power level. Characteristic of a loss of normal feedwater event analyzed assuming a positive MTC is an increase in nuclear power prior to reactor trip, which aggravates the consequences of the event. As previously described, the Callaway TTD design is intended for application at or below 20% indicated power. At these power levels, the design limit for most positive MTC is +5.0 - pcm/'F. Therefore, the TTD safety analysis design basir cust consider the effects of the most limiting MTC assumption. - 2 10
?
[ 1 i ja.c Consistent with the WCAP-11325 P A approved analysis methodology,
) Cases I through IV assume an essentially constant power transient
, up to the time of reactor trip. The assumed power levels l correspond to the two TTD bisttble setpoints plus the 9% 4 allowance for uncertainties and errors. [ : j
~
. ?
I B E l i ! s l
- )a,e I !
1 i , i l l. ( l .. r i I l I 2 11 i t
l l 2.3.1.2 Cases V and VI Analys(s As.tumptions Cases V and VI were performed to update the Callaway FSAR analyses to include the revised S/G Low LW L& vel trip setpoint of 0% of span. . The results of these analyses are discussed in Sections 2.3.2 and 2.3.3. Key assumptions mada in these an.;1yses are discussed beluw. l l 1. Initial Conditions
- a l Tnese transients were perfonned at the same full power inittii
conditions as tr.a FSAR Chapter 1S.2.6 and 15.7.7 enalyses. See l Table 2.3.1. l l ?. Decay Heat Cases Y and VI have incorporated the ANS 1979 Decay 't.t model l assuming long term full power operation. l l 3. Uncerttinties and Allowances t i . l Initial condition and protection Syst*m uncertainties and 4.110wt.nces are the same as assumtd for the FSAR Chapter 15.2.6 I and 15.2.7 analyses except as described below.
- 4. S/G Low !.ow Level Trip Setpoint l
To support the mininum setpoint study determination of a S/G l Low Low Level trip setpoint for romat containment envircwental conditions, the safety analy* Wamption for cases V and VI is 0% of span. The associated #Mt.'lon System Setpoint Study revisions are orovided in Sect W. 4. t.' \ - -
- 5. S/G Low Ltw level Trip Time Delay Fell power safety analyses do r.ot incorporato a S/G Low Low Level
,o trip time delay other tiian t,he 2 second delay specified in FSAR Table 15.0 4 to account for the time from receipt of the signal to the time when control rods are free to drop.
- 6. Moderator Temperature Coefficient (MfC)
Cases V and VI, consistent with the design assumptions listed in the forward to Section 2.3, have assumed a most positive MTC at i full power conditions to be 0 pcm/'F. 2.3.1.3 Case VII Analysis Assumptions Case VII was performed to verify that that SAls for the S/G Low-Low Level power interlock time delays do not invalidate the conclusions
~ stated in FSAR Chapter 15.2.8 regarding the lieitting Feedline Break transient results. The results of this Case are discusted in
, Sections 2.3.2 and 2.3.3. Key analysis assumptions are discussed below.
- 1. Initial Conditions Consistent with the WCAP-11325 P A analysis eethodology, appropriate power level dependent initial conditions were assumed for Case VII. See Table 2.3.1.
l
~ .
a 2-13 l
- 2. Decay Heat Consistent with the WCAP-11325eP A analys1s methodology, Case VII 4
used the ANS 1979 Decay Heat Model (Reference 5). The analysis , assumption considers a power rampdown rate from full power of 5% ' per Mnute prior to the initiation of the feedline break transient. This assumption is consistent with the maximum power coastdown rate documented in the Callaway FSAR Sections 7.7.2.4 and 10.4.7.2.3 (Reference 3).
- 3. Uncertainties As with Cases III and IV, the initial core power level assumption for Case VII is 29% of 3565 MWt. This assumption accounts for a maximum uncertainty in power level indication af 9% of Rated Thennal Pcwer (RTP).
- 4. S/G Low low Level Trip Setpoint The S/G Low Low Level trip setpoint assumed in Case VII is 0% of '
span. This assumption is consistent with the FSAR Chapter 15.2.8 Feedline Break analysis assumption. Tne FSAR feedline break trip
- setpoint assumption of 0% of span accounts for the possibility of ,
a harsh containment environment resulting from the feedline break ' accidsnt. 1
- 5. S/G Low Low Level Trip Time Delay The total S/G Low Low Level trip time delay assumed in Case VII includes the SAL for the 20% RTP interlock time delay and an additional 2 second allowance for the time between receipt of the signal and when the control rods are free to drop. The total
- time delay for Case VII corresponds to that assumed for Cases III .-
! and IV. 2 14 i
. 6. Moderator Temperature Coefficient (MTC)
Case VII assumes a moderator temperature coefficient of +5 pcm/*F.
~
1.3.2 Yarification of Design Basis Safety Analyses The analyses described in Section 2.3.1 established Safety Analysis Limits for the S/G Low Low Level signal delay times knd trip setpoint. The purpose of this section is to document the evaluation of these Safety Analysis 1.imits on the design basis safety antlyses outlined in Section 2.1. Safety analyses affected by the SALs determined in the Section 2.3.1 analyses ere those which assume reactor trip, main feedwater isolation, and auxiliary feede:ater initiation to result from reaching the S/G Low-Low Level trip setpoint. For Callaway, these are: FSAR Chapter 15.2.6 Loss of Non emergency AC Power to the Station Auxiliaries FSAR Chapter 15.2.7 Loss of Normal Feedwater Flow FSAR Chapter 15.2.8 ' Feedoter System Pipe Break ! WCAP 10961-P (Reference 5) , Steamline Brsak Mass / Energy Releases Outside Containment l Evaluations of the effects of the S/G Low Low Level time delay and trip setpoint SALs on these transients follow. l 4
*O l
1 2-15
2.3.2.1 Loss of Non emergency AC Power to the Station Auxiliaries Loss of non-emergency AC power to the station auxiliaries is analyzed for the Callaway Plant FSAR in Chapter 15.2.6. The Condition 11 , accident postulates the loss of all power to the station auxiliaries ~ due to a complete loss of the offsite grid accompanied by a turbine . generator trip or due to loss of the onsite AC distribution system. Two consequences of this event are loss of forced reactor coolant flow and loss of normal feedwater due to the loss of power to the reactor coolant pumps and the condensate pumps, respectively. The FSAR Loss of Non emergency AC Power analysis it performed to demonstrate the adequacy of the reactor protection system, the engineered safeguards systems (e.g., the auxiliary feedwater system) and natural circulation to remove long tenn decay heat and prevent u:essive heatup of the RCS with i,:sible resultant RCS overpressurization or loss'of RCS water inventory. The FSAR safety analysis assumpions for loss of non emergency AC power are conservatively che.sen to maximize the resulting primary side heat up transient aN, therefore, the dependency on the auxiliary feedwater sy', tem to ade(lately remove decay heat. For this ,
- reason, no credit i', taken for the immediate control rod insertion '
! which would occu upon loss of power to the contro' rod drive i j ' mechanisms or the initiation of auxiliary feedwater from two diesel - ! powered motor-driven auxiliary feedwater pumps within 1 minute of the l receipt of a loss of power signal. Instead, actuation of these ' l safety features is assumed to occur due to the eventual receipt of i ! the S/G Low Low Level trip signal as a result of the loss of normal l feedwater to the steam generators. i i The TTD/EAM logic is designed to avoid unnecessary feedwater related reactor trips on S/G Low Low Level. Since, in the event of an actual loss of non emergency AC power, plant protection design provides for I a reactor trip in advance of reaching the S/G Low Low Leval setpoint, , j - [ 2 16 ! 1
.- - _ - , _ , _ -_-v - . _ . -
WESTINGHOUSE PROPRIETARY CLASS ? the TTD/EAM would not delay rep.ctor trip upon loss of AC power to the station auxiliaries. However, since the FSAR conserv.atively assumes reactor trip to occur on S/G Low-Low Level, it is appropriate to
, evaluate the effects of the introduction of the TTD/EAM logic on the FSAR Chapter 15.2.6 transient under the same analysis assumptions. ~
The limiting loss of AC power case presented in the FSAR is performed at full poner. Case V was analyzed at full power initial conditions to provide FSAR transient results which incorporate a safety analysis trip setpoint assumption of 0% of span. The assumed total trip time delay is 2 seconds which is consistent with the assumption documented in FSAR Table 15.01 (Reference 3) and is appropriate for initial condition p?wer levels above the maximum TTD power level interlocb Therefore, thtro is no effect on the FSAR case due to the TTO logic. The results of this case are shown in Table V and Figures V.1 through V.3 of Section 2.3.3. The transient results indicate that the natural circulation and auxiliary feedwater heat removal capacity are Difficient to offset the core decay heat and that the pressurizer l does not fill. These transient characteristics ensure that the , applicable Condition II acceptance criteria 3re met. The effect of the TTD/EAM logic on postulated part-power loss of AC cases must be evaluated as well. Case V sufficiently addresses the effect of the E4i on part power cases since, for the same trip setpoint, assuming ne additional time delays, the full power FSAR
- case bounds cases initiated at low
- er power 1cvels. The remaining required verification involves the time delay enabled by the TTD logic at indicated power levels below the m4ximum power TTD interlock setpoint. [
., ja.C 2 17 1
l i 2.3.2.2 Loss af Normal Feedwater Flow Loss of normal feedwater is analyzed far the Callaway Plant in FSAR Chapter 15.2.7. This Condition II accident postulates a loss of - normal feedwater to all steam generators. The FSAR loss of normal feedwater analysis is performed +,o demonstrate the adequacy of the reactor protection system and engineered safeguards systems (e.g., the auxiliary feedwater Jystem) in rensving long tsrm decay he.'t and I preventing excessive heatup of the RCS with possible ratuicant ovtepressurization or loss of RCS water inventory. The FSAR safety analysis assumptions era conserestively chosen to maximize the resulting primary side heat up transient and, therefore, the
- dependency on the auxiliary feedwater system to adequately remove decay heat. The FSAR transient assumes full power initial conditions and accident protection due to receipt of the S/G tow Low Level trip s igr.al .
Case VI was analyzed at full power initial conditioni to provide FSAR Chapter 15.2.7 transient results which incorporate a safety analysis trip setpoint assumption of 0% of span. The assumed total trip time 1 delay is 2 saconds which is consistent with the essumption documented in FSAF. Table 15.0 4 and is appropriate for initial condition power * , levels above the maximum TTD power level interlock. The results of this case are shown in Table VI and Figures VI.1 through VI.3 of Section 2.3.3. The transient results indicate that the auxiliary feedwater heat removal capacity is sufficient to offset the corv decay heat and that the pressurizer does not fill. These transient characteristics ensure that the appitcable Condition II acceptance f
' criteria are met, d
9 . l 2-18 i l l _ -. --.
Consistent with the WCAP ll325 P-A safety analysis methodology,
. explicit analysis of part power loss of normal feedwater cases with S/G Low Low Level trip time delays are performed. These are Cases I y through IV as described in Section 2.3.1. The safety analysis acceptance criteria applied to complete loss of normal feedwater transients are applied to partial loss of normal feedwater. Case I analyzes the part power loss of normal feedwater to four steam generators to determine the safety analysis limit for the TTD 2/4 steam generator logic,10% RTP interlock time delay. The analysis assumed a trip time delay, in addition to the 2 second time delay documented in FSAR Table 15.0 4, of 240 seconds. Thi safety analysis assumption for total trip time delay is, therefore, 242 seconds. The results of Case I are provided in Table I and Figures 1.1 through I.3 of Section 2.3.3. The results indicate that the auxiliary feedwater heat removal capability is sufficient to remme the de:ay heat and the pressurizer do:s not fill. These transient characteristics ensure that all applicable Condition !! safety analysis acceptance criteria are met.
Case 11 analyzes the part power loss of normal feedwater to one steam
' generator to determine the safety enalysis iimit for the TTO 1/4 steam generator logic,10% RTP power interlock time delay. The analysis assumed a trip time delay, in addition to the 2 second time delay documented in FSAR Table 15.0 4, of 240 seconds. The safety analysis assumption for total trip tire delay is, therefore, 242 seconds. The results of Case !! are provided in Table !! and figures II.1 through 11.3 of Section 2.3.3. The results indicate that case
!! is bounded by Case I and; therefore, all applicable Condition !!
safety analysis acceptance criteria are met. 2 19 I
Case III analyzes the partopower loss of normal feedwater to four steam generators to determine the safety analysis limit for the TTD 2/4 steam generator logic, 20% RTP interlock time delay. The analysis assumed a trip time delay, in addition to the 2 second time , delay documented in FSAR Table 15.0 4, of 130 seconds. The safety analysis assumption for total trip time delay is, therefore, 132 . seconds. The results of Case !!! are provided in Table III and Figures 111.1 through !!I.3 of Section 2.3.3. The results indicate l that the auxiliary feedwater heat removal capability is sufficient to l remove the decay heat and the pressurizer does not fill. These l transient characteristics ensure that all applicable Condittor !! safety analysis acceptance criteria are met. Case IV analyzes the part. power loss of normal feedwater to one steam generator to determine the safety analysis limit for the TTD 1/4 steam generator logic, 20% RTP interlock time delay. The trip time delay assumed in Case !!! was also assumed in Case IV. The safety analysis assumption for total trip time delay is, therefore,132 seconds. The results of Case IV are provided in Table IV and Figures IV.1 through IV.3 of Section 2.3.3. The results indicate that Case IV is bounded by Case Ill and; therefore, all applicable Condition !! safety analysis acceptance criteria are met. - Assuming the TT0/EAM protection system logic, Cases I and !!. . perf*srmed at 19% RTP, bound corresponding cases initiated at lower power levels. Cases !!! and !Y, performed at 29% RTP, bound corresponding cases between 19% and 29% RTP. Case VI, the limiting loss of normal feedwater transient, performed at full power, bounds cases initiated at power levels greater than 29% of RTP. , 2 20 _ - _ - - - - - - - - - - - J
2.3.2.3 Feedwater System Pipe Break 4
.' A Reactor Coolant System heatup caused by a main feedwater 1tne rupture is a Condition IV transient analyzcd for the Callaway Plant in FSAR Chapter 15.2.8. Results of the feedline Break transient, with and without offsite power, are presented in the FSAR to assure that the primary system remains intact, no core damage occurs due to overheating, and consequently, the radiation release limits of 10 CFR 100 are not exceeded. The FSAR transients are performed assuming 4
full power initial conditions. For the present protection system, this assumptien . maximizes the resulting heat up transient. Acceptable FSAR transient results demonstrate that:
- 1. Peak transient RCS and Steam Generator pressures are less than 1101, of design pressures,
- 11. Sufficient liquid in the RCS is maintained so that the core
- remains in place and geometrically intact with no loss of core cooling capability. This critt.rion is met by ensuring l
hot leg saturation does not occur. The Feeditne Break transients presented in the Callaway FSAR assume
- reactor trip, main feodwater isolation and actuatien of auxiliary feedwater to occur due to recv;pt of a S/G Low Low Level trip signal. Each of these safety feature actuations is essential for the '
successful mitigation of the accident consequences as u,nservatively predicted by the safety analyses. Red insertion due to automa'.ic i reactor trip terminates the nuclear power contribution to the primary heatup. Automatic main feedmater isolation is necessary, duk % the feedline check valve location downstream of the auxiliary feldwater connection, to insure delivery of auxiliary feedwater to the intset - j loop steam generators. The delivery of auxiliary feedeter is I
,, essential for the removal of core decay heat and, therefore, the prevention of fuel damage and core uncovery.
1 I 2 21 i
f j The FSAR Feedline Break safety analysis assumption for the S/G
-l Low Low Leyt:1 trip setpoint is 0% cf span. Unlike loss of . <
non e:aergency AC power and loss Of normal feedwater, the FSAR feedline break transient is postulated to result in harsh containment - environment conditions. The current Technical Specification S/G Lew low level trip setpoint is based on the feedline break SAL and includes the full environmental allowance. With introduction of the t EAM, the harsh environment trip setpoint will continue to be determined on this basis. The trip time delay assumed in the FSAR , Feedlice Break walyses is 2 seccnda, as documented in Table 15.0 4.
- Because the FSAR cases are performed at full power conditions, no additional delays are imposed by the TYO. Therefore, reanalysis ol' l the Feedline Break cases (with and without offsite power) presented
; in the FSAR is not necessary.
t It must also be verified, however, that imposition of trip delays at
- part-pcwer ao not invalidate the FSAR conclusions regarding the
; consequences of the feedline break transient. Case VII assumed power i dependent initial conditions, trip time delay consistent with Cases
!!! and IV and the availabliity of offsite cowr.r. The results of '
this case are shown in Table VII and Figures VII.1 through VII.5 of Section 2.3.3. The transitnt results indicate that the auxiliary
- feedwater heat removal capacity is sufficient to ensure that the Condition IV acceptance criteria are met, cssuming the applicable I trip time delay, j
i (
; l 1
l4 e 4
.. i J
2 22 Ja.c
( Ja.c The limiting FSAR analysis ' results for the feedline break transient remain the full power cases provided for FSAR Chapter 15.2.8 in Reference 3. 2.3.2.4 Stenmline Break Mass / Energy Releases Outside Containment The Westinghouse 30eamline Break mass / energy releases outside , contain:nent, documented in WCAP 10961 P (Reference 4), were calculated assuming the availability of the S/G Low Low Level signal. The cases applicable to the Callaway Plant are designated as "Category 1" in Reference 4. The power levels examined in Reference 4 are 70% and 100% of 3411 HWt core power (the results have been l verified to be applicable for Callaway uprated to 3565 MWt core power), Analyses of lower power levels were not performed in WCAP-10961-P since, for the same protection system assumptions, icwer initial power levels yield less limiting mass / energy releases. Given that the implementation of the TTO in the Callaway Flant introduces no time delays at indicated power levels greater than 20% RTP and j that the Reference 4 analyses are applicable for a trip setpoint SAL of 0% of span, the results of the 100% and 70% cases presented in
- Reference 4 for Category 1 plants remain applicable for the Callaway S/G Low Low Level SALs determined in Section 2.3.1.
( t 2 r
! ^
Ja,C l Therefore, the infomation provided in Reference 4 applicable to the Callaway plant remains valid for the Callaway S/G Low Low Level SALs l determined in Section 2.3.1. i 2-23 ! g.
2.3.2.5 Balance of the Safety Analysis Design Basis Calculations Safety analysis design basis calculations which do not assume the - actuation of automatic protection features by means of.the S/G , I
- Low Low Level trip signal are unaffected by the S/G Low-Low Level setpoint SAls. For these accidents, the conclusions in the FSAR are unaffected as are the FSAR predicted transient behaviors. The FSAR transients fn this category are listed below.
FSAR SECTION ACCIDENT 15.1.1 Feedwater System Malfunctions that Result in a Decrease in Feedwater Temperature 15.1.2 Feedwater System Malfunctions that Result in an increasc in Feedwater Flow 15.1.3 Excessive increase in Secondary Steam Flow 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.5 Steam System Piping Failure 15.2.2 Loss of External Electrical Load . 15.2.3 Turbine Trip 15.2.4 Inadvertent Closure of Main Steam Isolation Valves 15.2.5 Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip 15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.2 Complete loss of Forced Reactor Coolant Flow 15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.4 Reactor Coolant Pump Shaft Break 15.4.1 Uncontrolled RCCA Bank Withdrawal from a i Subtritical or Low Power Startup Condition 'l 2-24 l 1 i l l
15.4.2 Uncontrolled RCCA Bank Withdrawal at Power
, 15.4.3 RCCA Misoperation 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature 15.4.6 CVCS Malfunction that Results in a Decrease in Boron Concentration of the Reactor Coolant 15.4.7 Inadvertent Leading and Operation with a Fuel Assembly in Improper Position 15.4.8 Spectrum of RCCA Ejection Accidents 15.5.1 Inadwertent Operation of the Emergency Core Cooling System During Power Operation 15.5.2 CVCS Malfunction that increases Reactor Coolant Inventory 15.6.1 Inadvertent. Opening of a Pressurizer Safety or Relief Valve 15.6.5 Less of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary
. 6.2.1.4 Mass and Energy Release Analysis for Postulated Secondary Pipe Ruptures Inside Containment 4
i 1 i *. l l 2 25 l
i Additional safety analysis design basis calculations which do not assume actuation of protection features to result from the S/G Low Low level trip signal include the following: ' Rod Ejection Mass / Energy Releases for Dose Calculations ' Reactor Vessel and Loop Blowdown Forces Post LOCA Long-term Core Cooling Hot Leg Switchover Time to Preven,t Post LOCA Boron Precipitation In cenclusion, evaluations and analyses of the safety analysis design basis transients listed in Section 2.1 support the acceptability of the fc11owing S/G Low-Low Level trip setpoint and time delay safety analysis limits: , Trip Setpoint 0% of Span 2/4 Steam Generator Logic, 10% RTP Interlock Time Delay 240 seconds - 1/4 Steam Generator Logic. 10% RTP Interlock Time Delay 240 seconds 2/4 Steam Generator Logic, 20% RTP Interlock Time Delay 130 seconds ' i 1/4 Steam Generator Logic, 20% RTP Interlock Time Delay 130 seconds i .- i 2 26
2.3.3 Analysis Results Sequence of Events Tables and Transient Behavior vs. Ttee Plots
~
e P O G 2-27
TattE 2.3.1 as4LY315 e55 p ii m it!Tiel C M ITID45
?
- CU8E fa nal ! YESSEL Tav; 'ptACTDE VESSEL ' FPE55U#II[p ' P9[57jB!I[R * (([De8T[R ! 81DOEMf9E 8 5/$ 105-195 ! TfD ?
PenE11 t FI ' C:K:Lhut FLCs ' rnE55'JRE
- usTEE VWE ' itstaafurt ! itivt M TURE ! LEVEL TRIP ' T!!IE CELAY '
? .
igpl ' Ipsial ! (T!31 8 ( FI ' CCEFFICIEWT ! II ef Spe=1 * (wcl '
! Ipcel F) ! '
! 8 ! ! !
! C#5E I ! If1 of 3565 'Tt ! 57t.5 t 382. 630 '
2290 ' 6% ' 267 ! t ' 8 ' 240 '
. e
. . e. e e
e
! ! -? '
! ! o ! ! '
! Ca5E !! ! 191 of 3563 Nt ! 370.5 '
382. 630 2200 696 ' 267 ! 0 ! O ! 200 ? e e . . . .' . e e . . .
! ! s ! ! ' ! CASE Ill ! 291 ef 3563 Nt ! 373.6 ! 3t2. 6 0 '
2290 ! 731 ' 297 ! 8 ! # ! 130 ?
? ! ! ! ' '
! ! ! e ! '
! Ca5EIV ' 291 of 3363 N t ? 373.6 ! 382. 630 '
2295 ! 731 ! 297 ? O ! t 130 ?
. . e
. e. e. e.
? ?
? ! ! l !
! Cage f ! 1921 of 3563 N t ? 383.4 '
352. 630 ! 2290 ! t175 ! 446 ? 9 ! 0 ! 0 ?
' Ca5E ft ' 1021 et 3563 N t
- 395.1 ! 3f2. 630 '
2299 1175 ' 486 ! 0 ! 0 ' O !
? ' CASE VII ' 292 of 3345 Nt ! 373.6 ! 392,630 '
2290 731 ? 297 ! +5 ! 0 ! 130 ? .*:
. . . . . .' . e e e e 8
We 5ections 2.3.1.1 and 2.3.2.2 for a dio sesien of the effects of positive IITC.
TABLE I TIME SEQUENCE OF EVENTS FOR CASE I: LOSS OF NORMAL FEEDWATER TO FOUR STEAM GENERATORS FOR 10% RTP INTERLOCK EX1A1 Time (see) Main feedwater flow stops 10.0 S/G Low Low Level setpoint reached 337.9 Low Low Level trip signal transmitted 577.9 Rods begin to drop 579.9 First peak water level in pressurizer occurs 582.0 One motor driven auxiliary feedwater pump starts 637.9 Feedwater lines are purged and cold auxiliary feedwater is : delivered to two steam generators 872 i i i Core decay heat plus pu p ' heat decreases to auxiliary ' l feedwater heat rem 6 val capacity -900 ; Second peak water level in ; pressurizer occurs 2992 < I l
, i, 8 9 I
1 ; I
TABLE 11 TIME SE0VENCE OF EVENTS FOR CASE II: LOSS OF NORMAL. FEE 0 WATER TO ONE STEAM GENERATOR FOR 10% RTP INTERLOCK M Time (seel Main feedwater flow stops to one steam generator 0.0 S/G Low Low Level setpoint reached in the faulted loop 310.7 Low Low Level trip signal transmitted 550.7 l Rods begin to drop 552.7 l First peak water level in l pressurizer occurs 555.0 l .
' One motor driven auxiliary feedwater pump starts 610.7 feedwater lines are purged and cold auxiliary feedwater is delivered to two steam generators 844 Core decay heat generation plus pump heat is exceeded by auxiliary feedwater heat removal capacity 844 Second peak water level in pressurtzer occurs 2304 Oe
TABLE !!! TIME SEQUENCE OF EVENTS FOR CASE !!!: LOSS OF NORMAL FEE 0 WATER TO FOUR STEAM GENERATORS FOR 20% RTP INTERLOCK , Event Time fsec) Main feedwater flow stops 10.0 5/G Low tew Level setpoint reachad 218.25 in all S/Gs ; 1 First peak water level in pressurizer occurs 286.0 Low Low Level trip signal transmitted 348.25 Rods begin to drop 350.25 One motor driven auxiliary
, feedwater pump starts 408.25 ,
Feedwater lines are purged and cold auxiliary feedwater is delivered to two steam generators 642,0 t i Core decay heat generation plus i pump heat is exceeded by auxiliary feedwater heat removal capacity 642.0 Second peak water level it. I pressurizer occurs 2816 4 , t i
?
TABLE IV TIME SEQUENCE OF EVENTS FOR CASE IV: LOSS OF NORMAL FEEDWATER TO ONE STEAM EENERATOR FOR 20% RTP INTERLOCK inni Time (see) Main feedwater flow stops 0.0 S/G Lew Low Level setpoint reached in faulted steam generator .202.4 Low Low Level trip signal transmitted 332.4 Rods begin to drop 334.4 First peak water level in pressurizer occurs 335.0 One motor driven auxiliary feedwater pump starts 392.4 l l Feedwater lines are pnged and cold auxiliary feedwater is
- delivered to two steam generators 626.0 l
Core decay heat generation plus pump heat is exceeded by auxiliary feedwater heat removal capacity 626.0 Second peak water level in prest.urizer occurs 1894
TABLE V
. TIME SEQUENCE OF EVENTS FOR CASE V:
FSAR CHAPTER 15.2.6 LOSS OF NON EMERGENCY AC POWER TO THE STATION AUXILIARIES r Event Time (see) Main feedwater flow stops 10.0 S/G Low Low Level setpoint reached 61.3 ' in all S/Gs Low Low level trip signal transmitted 61.3 Rods begin to drop 63.3 AC power is lost and reactor coolant pumps begin cuastdown 65.3
, First peak water level in i pressurizer occurs 74.0 l r
One motor driven auxiliary feedwater pump starts i 121.3 i Feedwater lines are purged and cold auxiliary feedwater is ; i delivered to two steam generators 355.0 t i l Core decay heat plus pump heat decreases to auxiliary , feedwater heat removal capacity -1630 l Second peak water level in I
.. pressuriter occurs 1670 l f
l
I l TABLE VI l . I TIME SEQUENCE OF EVENTS FOR CASE VI: FSAR CHAPTER 15.2.7 LOSS OF NOFML FEEDWATER Lunt Time fsee) Main feedwater flow stops 10.0
$/G Low Low Level setpoint reached 61.1 Low. tow Level trip signal transmitted 61.1 Rods begin to drop 63.1 First peak water level in pressurizer occurs 66.0
' One motor driven auxiliary feedwater pump starts 121.1 Feedwater lines are purged and cold auxiliary feedwater is delivered to two steam generators 355.0 Core decay heat generation plus pump heat is exceeded by auxiliary feedwater heat removal capacity 355.0
)
l 1 Second peak water Itvel in pressurizer occurs 2972
d TABLE VI! TIME SEQUENCE OF EVENTS FOR CASE VII: FEE 0LINE BREAK WITH OFFSITE POWER 20% RTP INTERLOCK TIME DELAY FOR 2/4 LOGIC Inni 11pe fieei EAM enables harsh environment $/G Low Low Level trip setpoint <10.0 Feedwater control system malfunction occurs due to harsh environment 10.0 ' Steam generator safety valve setpoint reached (first occurrence) 77.0
$/G Low low Level setpoint reached in ruptured steam generater 203.9 t l.ow tow Level trip signal transmitted 333.9 Rods begin to drop. Doable ended fee M ter line rupture blowdown is assumed to begin 335.9 Low Steamline Pressure setpoint reached in ruptured steam generator 349.9 :
All rain stearline and feedline isolation valves close on Low Steamline Pressure 356.9 ,
.. I
! I f f I
TABLEyll(cont.)
, TIME SEQUENCE OF EVENTS FOR CASE VII:
FEEDLINE BREAK WITH 0FFSITE POWER 20% RTP INTERLOCK TIME DELAY FOR 2/4 LOGIC EXAal Time faec) Pressurizer water relief begins 424.0 Cold auxiliary feedwater is delivered to intact steam generators -478 Steam generator safety valve setpcint reached in intact steam generators (second occurrence) 700 Core decay beat plus pump heat decreases to auxiliary feedweter heat removal capacity 840 O 1 9' s
j e t g B J N 4r P I Y dB gNCg b E% ong g 0 i i i s 6 e 8 s 4 6 e H 8 e 8 e i
* .e .C 0
.n -8 .s .M M 3
a i s
.i a
9 i. i. i s e i i.. i , ci , i, i i T M . E ( S s y E e8 . C O N D S
)
N F G s V e - O E C i i. i i. T RE N NL i OLA R AE SA A O SR L S T L S O FP C s R LO A t a
. ..a S O P OW F L .
T F R WE I L G A E E A N S R .R U W O A R A MRS V TR E Y Q M R EE E A A ! P
?L E AC . L A
W NT i C E TF R DOR N T A E A S T D N O W S EO TC R A ! AO 9 T E _ E TN MLA R S N T l1 lIil ; ,: ' ' ( l I f l , l i
O Pse. 640. 64 E e.0..
'8 ees.
m HOT LEG , ,) s 8 COLO LES a see. u sw. 9 , ,,, ,, ... ...
=
g FN. R see. 860. IP) sas. SN. IE "9 NOI LE8 s gg, a kN. s - (; 644. CobO LEG l
' sn. ~
h see.,e a set i ,a 3,s i,4 TE>E (SECONDS) 4 CALL AWAY PL ANT _ e Assures motor-drJven auxJ2Jany feedwater pusc A suppJJos !Jow FZGVRE !.2 , to steam generators B and C (Loops 2 AND 3), REACTOR COOLANT TEMPERATURE TRANSEENT FOR LOSS 0? NORMAL FEEDWATER TO ALL STEAM GEh?RATORS
( J4 M . stes.
- 34N.
E bH. - - stsa.
$ SIN.
hE""- IW. Isee. I?M. - ISN. ilN.le ~s a-sat set tel 10 8 7068. Ie40. W 16 N . t leN . f I
*c l >N . i 1000.
. s.-
eN. , s ee. ev. , i.e ii i.: ici is. l L TZME (SECOCS) e I
^
CtLL AWA Y PL A4T
. (
FZGURE !.3 l PRESSURIZER PRESS @E ANO WATER [
\ YOLUME TRANSZENTS VOR LOSS OF NORMAL FEEDWATtR TO A LL ,5 TEA M fFNF*4A 701F, j i
1.4 t I., O.
'I ..
gh
. 95 - U ..
o g .,
,, ,,, t., ... ...
a ... I h!$ i. , - - - I4 - l ss
l E
o 1 l i ..
,, ,,, . .. r ,,.
llt'. < l lete. I,00. #
% ,988.
k g m. 600. 46d. ' BN. T!NE (SECO@S) bdbbdkdY bdkY )" staw it. : NVCLEAR POWER. MACTOR COOLANT MASS PLOW RATE A@ STEAM GENERATOR PRESSURE TRANSZENTS FOR I. CSS OF Nt RMAL.FEEDWAT R
\ fi ONE STCgM SENERATOR _
o n- - vw e c. m ,~, , , , -
o too. w. 640. I644. .' ** HOT LEG COLO LEG g w. t; u. . i "' is ... . ... ... Pse. 640. 444. SN.
' HOT LEG ,
us. g, COLO LEG
-l ue.
- s. ... ,, ... ...
=
tu.
&M. , MS.
444. SM. N, W-HOT LEG y 5 , M8. a ,,,, COLO LEG LM.
, y8 ... ,98 .48 .48 7:ME (SECONOS)
.. CALLAWAY PLANT M Assumes motor-drJVen auxi2bary gzgyng 33,y feedwater pump A supp1309 flow to steam generators B and C REACTOR COOLANT TEMPERATURE (LOOPS 2 AND 3) TRANSZENT FOR LOSS OF NOMAL FEEDWATER TO ONE STEAM GENERATOR
9 I Q MM. '
, MM .
e... asse. ases. A ales, 3000. ,
\ Mt.
64 lese. i I1788. 1688. I
- gge ggt get tal 18 4
*~-
4 ates. '
~
tees. f 16es. 14 H . E inte.
\
. N' 1968.
see.
'gge 33l g'g2 335 334 TIME (SECONDS) t CAL LA WA Y PL ANT .)
F:GLRT ZZ.3 PRESSURZZER PRESSVRE AND WATER VOLUME TRANSZENTS FOR LOSS OF NORMAL FEROWATER TO ONE
) STEAM GENCRATOR l
I
! l
'( ,I ,1 hg Ba$
mh da n$ l
- 4 g g k4 J
gbg J ' =EgUg b lk a s 6 i 1 l i s 1 s a o 4 s s e s e n H 4 e - . . s
- 2 4 .
4 s 2 4 _. ' s. H H
. .a s
,a . .s ,- 2 I s
- . 8 g .
e s t oi i , s t f T . _ Z M E 3 ( s , 2 S e a N E F G U C O E i O N T R E ML N D R O L A SA AE S
)
i A O T SR s , 5 L S O C e s R FP
~
L S LO F A Q O P OW Z G _L L T F R WE V A E E A N S R .R R W A g M O S A E s e R U TR Y e8 . s M Z G A R EE A Z P E N L E NT AC .Z L . E R P T R DO 2 h A E E AS R T T O N TC O W S EO R ! S T E AO A ML E N A _ R T S N T
< . ' . lil)\ )
700. 108. ste. s49. {
. sw.
8"'
$ts HOT LEG j g 9w sea. _
us. COLO LEG sa
$N.
h "' eis ist les ses isi
=
7H.o 600., slf. s... IE, s**. HOT LEG kQ* see. lJ
~ s -
$40.
COLO LES d sM. 9 508. a'e nel 162 Isl led TIME (SECONDS) l l N Assumes atotor~dr$Ven EUX3 3 AEPY l teedweter pump A supp2ies tJod FIGURE ZZZ.2
~ to steam generators 8 and C \
(LOOPS 2 AND 3) REACTOR CQQLANT TEMPERATURE l TRAN3ZENT FOR LOSS OF 1 NORMAL FEE 0 WATER 70 ALL STEAM GE.*lERA TORS
MM. 21H . DeH.
. 35H . s _
2NG.
; g 3lH.
gg s. 148. Isos. 17H . I4H. 15H. - les 103 188 Isl le8 teH . less. d 1602. Idee. E I Me. I He . see.
$N.
des. Is' lel 132 335 3g4 TIME (SECONOS) CALL AWAY PLANT FIGURE ZZZ.3 PRESSURIZER PRESSURE AND WATER VOLUME TRANSEENTS FOR LOSS OF NORMAL FEE 0 WATER TO ALL STEAta CENERATORS l \
ii \ l1 1 ll 1
. ~ ' .
~
hug g,$
-E iE,h IQ ga dE *,$
fung h E a {j 3 g4U b YE3 g 1 1 7
- s. *
- i. e s
4 6
. . 1 s
-- 4
.e * . ,e .N .H .s 3 .
e
. l.
a a e t. n
- t e
2 ,- 4
, s ,
, i
, s ,
t T , Z M E ( S , 2 i E , , , C , a , O N . D .
- S
)
N . s e _ F G U . s i. OE C i RN E ML T
- OL R AE O A SA
- SR OS T NS O R FP C
. s e
E LO F A . e i. O Z L + DF PR OW W G L T A EN SE RD V R W . AO A A MR S TR E Y MU GA R EE A I P EL N E AC NT V
. L A
EF T i N - RE R OO R T AE A S T0 N TC OW ES EO RA AO T E N ML A CT S T N
a _ _ res. 5 ens. See. See. g 4 0. y een. HOT LEB y
"- , L us. .' s m, COLD LEG f
O s,s. See.,s e ... ,, ... ... g
=
ten. 60s. Me. ( 648. M sas. , 800. HOT LEO q M See. N %8. COLO LEG E! se, - o ,- ... ,, ,6 ...
. = m.
6C8.
. g Sea.
640. SJG. HOT LEG {een. b-1 See. m, COLO LEG M d us. Sec. TIME (SECONDS) l .. l CALLAWAY PLANT n Assumes motor-driven aux 22$ary feedwater pumQ A supplies flow p3gygg g y, y to steam generators B and C } (LO@S 2 AND 3) REACTOR COOLANT TEMPERATURE i TRANSEENT FOR LOSS OF NORMAL FEEDWATER TO ONE STEAM GENERATOR
- MM. -
E - Moe. H!a. --
, g a:M.
sim. E sees. IW. q tese. 17eo. I 18H. IlH. ige :: 3,2 ges ise PeH. 4 4 lu lose. f , 16 H .
. I**
{ Itos. h lose. y _ S see.
~
SH. E 18E 801 1 ,2 335 gge TIME (SECONO3) CALLAWAY PLANT FIGURE IV.3 PRESSVRZZER PRESSURE AND WATER VOLUME TRANSZENTS FOR LOSS OF NORMAL FEEDWATER TO ONE STEAM GENERATOR
t : .. . REACTOR COOLANT MASD FLOW RATE NULT. EAR PONER STEAN GD4ERATOR PfESSURES tYRAC1EDN OF NOMINAL) (PSIA) (FRAcTI0d OF INITIALi~ 1 1 .I .f i. l. i. i
. . . . . _ r l .
s l s si
=- =_
c H 4 J g - g T- t. v. - ( gE *! - - gxP um s.
, =>
g =m I eBP3 o M 2 r ; -
= *m E ~ r . -*
- Wg3,, O y Cs b
' k C K i o b 23 b h 3 3gk$ fil -t t O M%M hn .s r-m b I R o X , 03 UE - ITI Mn 23 89 o D .b o I T' b M
=
1H. Ste. see.
* ' "'** HOT LEG v aas.
b 2 # 689. 9w Q . h u
' 6M.'
COLD LEG i , ,,, . ,,, ...
=
?H.'
4H. M8.
* **** HOT LEG M $N.
&Q 00.
u j fas n**' COLO LEG t Ud EM.
* * 'es is, 3,2 ,el ,se l TIME (SECONOS)
I l l I 0 Assumes motor-driven auxaJisrY CALLAWAY PLANT '
^
teedwater pumD A supp:tes flow to steam generators B and C FIGURE V.2 (LOOPS 2 AND 3) . l REACTOR COOLANT TEMPERATUR" TRANSZENT FOR LOSS OF l AC PCWEr4 l (
3 mee. - g an. stee. noe.< saan. AIN. , asse. sees. h N less. IPN. I6os. 15M 1e . ,-- set it' ges se s 4 aces, t en. d ises.
. E s
g 14M.
. t He.
H le**. to oes. - se8 tot 102 tel 188 TIME ("r"0NDS) C ALL AWA Y P;. ANT FIGVRE V.3 PRESSURIZER PRESSURC AND WATER
. YOLUME TRANSEENTS FOR LOSS
\ OF AC POWER .
4 REACTOR COOLANT STEAM GENERATOR PRE 3SURES MASS FLOW RATE MEAR M (PSIA) VRACTION OF INITIALI (FRACTION of NOMINAL)
?
2
? ?
2 2
?
2 .*553 y 5 y .- y ? L i . . r 4
-* L i L ~
= T L
i k 5 5 N I a, =-
, s s 1* c 8 SExP -6 ar te s n o @mn r 8'.
=- -
=
o *
- F D bp3 Q I
"93E@ $ E p===- 1 (
<g, " -
m ;l ; xBa*=e l .Em m H
$r-mbo - r-r3
$m =~0 0
m
,Z u n 0 O n
W t-1~mI u8 mE r- h Dy %
-4 l
=
g 7ss. I E .... l k .sa. HOT LEG J j .* y ses. l Ell 600.
~
. p COLO LEG ga see.
u 570. 500. -- tes ist set ist is* l l l t
- 100.
# see.
. 8.
I
}% e40. HOT LEG ,
~
Nm sie. y,< 9 .... L.$$8. ... COLO LEG g s4s. g u" 525 500. Is8 ist ist iss iss TIME (SECONOS) l l l l i j ..
,, c LL A WAY PL ANT N Assumes motor ~ariven aux 21Jary feedwater pump A supp12es tJaw FIGURE VI.2 to steam generators S and C (LOOOS 2 AND 3) REACTOR COOLANT TEMPERATURE TRAh'3ZENT FOR LOSS OF NORMAL FEEDWATER TO ALL STEAM GENERATORS
J l J l 1 2688. 2598. I 4H. 2iH. / #
. 2208.
alte. 2908. I 'J 2. 10H. 17N. 1698.
'
- 8 gge ist let 135 18 2008. -
1888. 8 g 1698. N
$ 1498. [ . 1r 1208.
l s en. eff.
... I., ... l., l..
TIME (SECONDS) CALLAWAY PL ANT FIGURE VI.3 PRESSURZZER PRESSURE AND WATER VOLUME TRANSEENTS FOR LOSS OF NORMAL FEEDWATER TO ALL STEAM GENERATORS
1.6 3 1.2 l-Eg
.e
=b
.~ Eg .e YM Eu ad
.3 i 1
e. les tel 1e2 135 le8 l.4 3 8.3
$ t.
el s .e gs .e g Ib uu
.3 s.
les tel sea ses age
. .e1 f
.e, g
t .e, \
.es h
.e4 4
G .es y -m l l .07
.es les let sea lel 194 TIME (SECONDS)
CA LL A WA Y PL ANT FIGlE1E VZZ.i NUCLEAR POWER. CORE HEAT FLUX AND TOTAL CORE REACTIVITY TRANSZENTS FOR MAIN FEEDWATER LINE RVPTURE WZ1H OFFSZTE POWER AVAILABLE
l 4
. I =rs=,.
- e. -
2400. 2543. ANs. 3108. 2004. IW. g lese, im. Isse. , 1594. 108 183 le? ISI 124 i C l .s m e. lese. Isas. s~ ,4u. E 1790 . theC. Ma.
~
198 101 132 gg6 39 4 TZME (SECONOS) CALL AWA Y PL ANT ' FIGURE VII.2 PRESSURIZER PRESSURE AND WATER VOLUME TRANSIENTS FOR VtIN FEEDWATER LINE RUPTURE WZTH OFFSITE POWER AVAILABLE t
N g t.4
$3 .2
' d0 l3b h
I V 2g .s U 4 u
*I g ,. ,., . ... ...
*L D z
\ u-l W* u-k N u-h b o-
. e
? .u - - o$, *-' ...
. .u -
l
. .u -
l g p ;5 -u - Q -u - 3p p1 1E lE %d TZME (SECONDS) CALLA WA Y PL ANT '
' FIGURE VII.3 REACTOR COOLANT MASS FLOW RATE AND FEEDWATER LINE BREAK FLOW TRANSIENTS FOR MAIN FEEDWATER LINE RVPTURE WITH OFFSITE POWER AVAILABLE
tes.' SATURATION us. / r y lg g ,g ..e. G f o' see.
***- HOT LEG ,
R ~-
. u W /
- d us.
COLO LEG E44.
&?e.
" 'ges ist se2 sel 168 TN.'
SATURATZON ess. / g$E .<e. le 'a S*** HOT LEG N see. j yF $ . sos, a g ,,,, COLO LEG E20.
** ,e ist se2 ist te8 7N. - ~ k SA TURA TION 2 648. / f M see.
fI'see., i ste SH HOT LEG , ; a@ m g m 54e. m i
,,,, COLD LEG EPs.
le8 lel le2 set is8 TZME (SECONDS) t CAL L A WA Y PL. ANT FZGURE VIZ.4 REACTOR COOLANT TEMPERATURE TRANS!ENT FOR MAIN FEEDWATER LINE RVPTLE ? WITH OFFSITE POWER AVAILABLE
o t l i
%H l
nee. LOOPS 2, 3, AND 4 im. j' p g iwe .
.8.
e.. g
.- m.
LOOF 1 - FAULTED LOOP 29e.
' e.
198 ISI 102 ISI 198
~
n TZME (SECONDS) i 1 I CALLAWAY PLAhr r FZGVRE YZZ.5 STEAM GENERATOR SHELL PRESSVRE TRANSEENT FOR MAIN FEEDWATER LZNE RVPTURE WITH OFFSITE POWER AVAZLABLE
I 2.4 Conclusions
~
Safety analysis support for the implementation of the TTD/EAM in the
, Callaway Plant is provided by analyses and evaluations, as described ,
in Section 2.3.1, of the following S/G Low-Low Level trip setpoint i and time delay safety analysis limits: Trip Setpoint 0% of Span 2/4 Steam Generator Logic, 10% RTP Interlock Time Delay 240 seconds 1/4 Steam Generator Logic, 10% RTP Interlock Time Delay 240 seconds : 2/4 Steam Generator Logic, 20% RTP Interlock Time Delay 130 seconds 1/4 Steam Generator Logic,
, 20% RTP Interlock Time Delay 130 seconds .
l
. i Safety analysis design basis calculations which do not assume ,
actuation of protecticn features to result from the S/G Low Low Level [ trip setpoint are unaffected by these SALs. These calculations are !
- discussed in Section 2.3.2.S. Transients which do rely on the S/G ;
- Low low Level trip were analyzed and evaluated in Sections 2.3.2.1 -
l 2.3.2.4. A sumary of results follows, i i l Loss of Normal Feedwater: i Cases I, II, !!! and IV were analyzed to support Technical j Specification time delays for the S/G Low Low Level TTD protection l _ logic power interlocks of 10% and 20% RTF. These part power cases . ! assumed loss of normal feedwater to one steam generator and four ( i steam generators at transient initial conditions which account for a 9% uncertainty in power level indication. 2 28 i i
--,y, --
. , - - - , - c - .-, . , . . - __y, , -------,----r- ,. ,,, ,,,-.-- ,---,,- ,---y
I l l As the results indicate, the loss of normal feedwater to four steam generator cases (I and III) have incorporated time delays which , i utilize analysis margin made available by the reduced power - assumption and the ANS 1979 Decay Heat Model, without violating the . applicable Condition II acceeptance criteria. The delays assumed in - these analyses, above the 2 second; allocated from the time of signal transmission to when the rods are free to drop, are as follows: Case I: LONF to 4 S/Gs for 10% RTP Interlock Delay - 240 sec. Case III: LONF to 4 S/Gs for 20% RTP Interlock Delay 130 sec. Analyses assuming power levels and time delays corresponding to Cases I and III were performed in Cases II and IV, respectively for the loss of normal feedwater to one steam generator. The results for Cases II and IV illustrate the additional margin to the safety analysis acceptance criteria of the partial loss of normal feedwater transient relative to the complete loss of normal feedwater transient. Therefore, a conservative safety analysis limit for the 10% RTP . interlock for either the 1/4 or 2/4 logic would be 240 teconds and a - conservative safety analysis limit for the 20% RTP intarlock for either the 1/4 or 2/4 logic would be 130 seconds. These safety analysis limits are incorporated into the Protection System $etpoint Study in order to account for instrument and measurment uncurtainties and to determino the ast.ociated maximum allowable Technical Specification time delays for the 10% and 20% RTP interlocks. The safety analyses will support any 1/4 or 2/4 logic tine delays for the 10% and 20% RTP interlocks which are less than or equal to the 240 and 130 second safety analysis limits,, minus setpoint study adjustments, respectively. The Protection System Setpoint Study revision is found in Section 4. The full power complete loss of 2 29
normal feedwater transient was also analyzed. Case VI provides revised
, results for the FSAR transient incorporating the S/G Low Low Level trip ~
setpoint SAL of 0% of span and the ANS 1979 Decay Heat Model. The balance of the safety analysis support for tha trip setpoint and time delay SALs is provided by evaluation of other transients which assume l protection from S/G Low Lott Level. These transients are identified in Section 2.3 as Loss of Non-emergency AC Power, Feedline Break, and Steamline Break Mas / Energy Release Outside Containment. The impact of the proposed TTD on these transients is discussed in Section 2.3.2 and is summarized below. Loss of Non-emergency AC Power: Case V provides revised FSAR results for the full power loss of Non-emergency AC Power transient assuming the trip setpoir;t of 0% of span and ANS 1979 Cecay Heat. Consistent with the approved safety analysis nethodology of WCAP-11320 P-A, the impact of trip time delays at part power conditions has been evaluated and found to be acceptable.
; , Steamlina Break Mass / Energy R11 ease:
Results of a sensitivity study discussed in Section 2.3.2.4 indicate that the Reference 4, Category 1 steamline break mass / energy release data continues to be applicable to the Callaway Plant assuming the above S/G Low Low Level trip setpoint and time delay SALs. Feedlins Break: Conclusions regarding feedline break are made on the basis of the Case Vl! analysis results and the FSAR Chapter 15.2.8 Feedline Break cases. The FSAR cases assume 0% span and, therefore, do not require reanalysis. Case VII provides confirmation that introduction of the S/G Low Low Level time delay at part-pnwer does not invalidate the conclusions presented in the FSAR for the feedline Break transient. Case VII analyzed the feedline l break transient at 29% RTP incorporating the associated TfD safety
.t 2 30
\
analysis limit for trip delay time of 130 seconds. The analysis results indicate that all applicable safety analysis acceptance , criteria are met- Case VII is a sample case which illustrates that acceptable feedline Break transient results are achieved at . part powers using the time delays determined through analysis of the - complete loss of normal feedwater tran-ient. No further part-power analyses are performed for verification. This case confirms the ' conclusions presented in WCAP-11325 P A and WCAP-ll342-P A that acceptable part-power feedline Break transient results support the TTD/EAM modifications to the S/G Low Low Level protection system. In summary, the safety analysis design basis calculations outlined in Section 2.1 have been evaluated or reperformed to support the Callaway implementation of the TTD and EAM concepts as reviewed and approved by the NRC in WCAP ll325 P A and WCAP-ll342-P A, respectively. Analyses and evaluations were performed to provide the safety analysis basis for Technical Specification limits on the TTD time delays and the EAM normal environment trip setpoint. The applicable safety analysis limits are listed at the beginning of this section. The resulting Protection System Setpoint Study revisions - are provided in Section 4. o m 2 31 l
.. 3.0 I&C DESIGN INFORMATION Two design modifications established by WCAP-11342-P-A, "Modification of the Steam Generator Low-Low Level Trip Setpoint to Reduce Feedwater Related Trips" (Ref.1), and WCAP ll325-P-A, "Steam Generator Low Water Level Protection System Modifications to Reduce Feedsater Kelated Trips" (Ref. 2), to address inadvertent reactor trips due to steam generator low-low level are, as shown in Figure 1, the Environmental Allowance Modifier (EAM) and the Trip Time Delay (TTD). The following is, on a protectica set basis, a functional and implementation description of each.
3.1 EAM Functional Implementation t 3.1.1 Functional Description The EAM distinguishes between a normal (containment pressure below the EAM setpoint) or an adverse containment environment (containment pressure above the EAM setpoint) and enables a higher adverse
, einvtronmer.t steam generator low low level trip setpoint when an
, adverse containment condition is sensed by elevated containment pressure. The adverse environment level setpoint is higher due to the inclusion of instrument uncertainties related to the harsh environment. Otherwise, a lower setpoint is used in conjunction with a normal invironment. Consequently, the frequency of unnecessary steam generator low-low level related trips will be decreased by increasing the operating margin, the distance between the nominal steam generator level and the narmal environment low low level trip , setpoint. 3.1.2 Implementation 0 ascription As shown in Figure 2, the EAM utilizes input signals from the existing containment pressure and steam generator level I i 31
transmitters. A single comparator card is added to each of the four existing containment pressure channels to enable the steam generator
~~
low-low level setpoint corresponding to an adverse environment. The EAM circuitry is designed with a latch in feature that will ensure , that this setpoint remains enabled once an adverse environment has been detected. In order to disable the adverse environment setpoint, it is required that containment pressure decrease below its setpoint and that the switch be manually reset. In addition, the latch-in feature has been interlocked with the EAM comparator channel test switch (Figure 5) [ 1 Ja,c The existing steam generator low low level comparator cards operate with a setpoint corresponding to an adverse environment. Eight new l steam generator level double comparator cards (two per protection set I with each double comparator card handling two steam generators) will be added. These double ecmparator cards will operate with a setpoint l associated with a normal environment. - l . 3.2 TTD Functional Implementation I 3.2.1 Functional Description The Trip Time Delay may be generally described as a system of pre deiermined programmed trip delay times that are based upon the l prevailing power level at the time a low low level setpoint is reached and upon the number of steam generators that are affected. These delay times are longer at low power versus high. power (Figure 3). This correlates to the use of timers, each with a preset value, which detain the actuation of the reactor trip, main feedwater - isolation, and initiation of auxiljary feedwater so that steam 32
get.erator level anomalies such as shrink / swell transients may
. naturally stabilize. ~
3.2.2 Implementation Description . As shown in Figure 1, the input to the TTD circuitry is the EAM logic output and power level. In order to deterrine power level, the TTD utilizes the Delta T signal from the Thermal Overpower and Overttmperature protection channels. Four new dual comparator cards (one per protection set), with setpoints corresponding to two power levels (10% and 20%), are added to the existing Delta-T channel. These dual comparator cards enable the appropriate timer associated with the power level at the time a steam generator low low level condition is detected. As shown in Figure 4, once the TTD receives a steam generator low low level signal from the EAM circuitry, all four timers are started, The timer that determines the celay of the trip actuation signal d
!- ' depends on the applicable logic fulfilled for each timer (en enabled
. condition). The effecti.e time delay of the trip signal will be the shortest delay of all the enabled timers. Timer A is the effective timer with the conditions of a icw low level signal in any one steam generator and the power level below the low power setpoint of 10%.
Timer !! is the effective timer with power levels between the low power (10%) and high power (20%) setpoints coincident with a low low level signal in any one steam generator. Timer C is the effective tirer at power levels less than 10% with a low low level signal in two or more steam generators. Finally, timer D is the effective timer with low-low level signals in two or more steam generators coincident with the power level between 10% and 20%. For power ' levels above the 20% power setpoint, all time delays are bypassed. thus, the latched-in reactor trip signal is not delayed by t'e TTD l circuitry. i 33
Note that, since all timers are started by a single low-low level
~
trip signal, it is possible for a second steam generator to reach its . , low-low level trip setpoint after the appropriate multiple low-low , level trip delay has expired. In that case, the reactor trip signal - would be transmitted without further delay. Timers, once enabled, must be latched in until all steam generator level signals in a protection set are restored to levels above the low low leval setpoint, Restoration of all steam generator levels to levels above the lowslow level setpoint will terminate the timing, reset the timers to their prwdetermined values, and reset the trip logic signals. In sumary, timer B is interlocked with the low power setpoint. Timer C is interlocked with the two out of four steam generator low low level logic and timer D is interlo:ked with both the two out of four level signals as well as the low power setpoint. Moreover, above the 20% power setpoint, there is no TTD delay of the trip actuation signal. ' 3.3 Alarms Annunciators, Indicators, and Status Lights Alarms, annunciators, indicators, and status lights are necessary to provide the operator with accurate, coeplete, and timely information pertinent to the protection system status. Status lights and control board indicators provide the operator with specific information with respect to which individual channels generated the alarm and/or trip condition. Presetitly, for the steam generator low low level protection system, sixteen instrumentation channels (one per steam genirator, per protection set) are provided. Each levwl channel is configured with a Listable trip status light which is illuminated on . the control board anytime that an enabled bistabl.e trip setpoint has been reached. An alarm and annunciator (one per steam generator) is - 34
- e _ - , -
provided to infntm the operatcr that at least one level channel has dropped below its trip setpoint. If more than one level channci for-any one steam generator has fallen below its trf p setpoint, a "first
. out" rtactor trip alarm and annunciator is 5.rovided to alert the ~
operator that a reacter trip has c::urred. After the EAM/TTD modification has been installed, all of the existing alarms, annunciators, and status lights will continue to function as described. However, since these signals originate at the SSPS voting circuitry, they will not be actuated until all applicab!e time delays inave expired. Additional alarms and annunciate.rs are provided with the EAM/TTD hardware modification. These are to inform the operator that an adverse environment and/or a stm generator water low low len1 has been detected. A new low lcw let91 alarm will be provided for each steam generator to signify thtt the uter level in at least one char.nel has dropped below the low low level setpoint in that steam gsnerator(
.' la,c The operator may then observe the individual channel
, su wenerator level indicatcrs to detercine [
Ja,c Finally, a comon alarm and annunciator vill he , provided to indicate the presence of an adverse envir amen;. The input to this window is derived from the fot.r containment press re j channels (one per protecticn set). The operator reay then observe the individual channel containment pressure indicators to determine which channel (s) hava the adverse steam generator low low level setooint enabled. 9 3-5 m_ .
l 3.4 Hardware Description ' 3.4.1 Printed Ciicult Card Descriptions '. Presented below is a list of the printed circuit cards tnat are - required for the EAM/TTD modification. A description of each card will follow.
- 1. NCT - Channel Test Card
- 2. NMT - M4 ster Test Card
- 3. NAL - Comparator Card (single, double, and dual comparator cards)
- 4. NAI - Annunciator Interface Card
- 5. NPL - PROM Logic Card WCT - Channel Test Card Each process protection instrument channel can be tested while the plant is operating and on-line. This is accomplished with the -
- channel test card by means of switching the outputs of the measuring
~
device to monitoring points and disconnecting the associtted trip , outputs. This card has test jacks (for signal injection), test ' points, and proving lamps to verify bistable operation when the channel is in the test mode. NMT - Master Test Card The NMT card is used in con,4 unction with the NCT card to provide for specialized test features. Specifically, this card allows for t various testing modes which include on line testing, transmitter calibration, time response, and RTD cross-calibration.
~
i b 36
NAL Comparator Card (sirigle, double, and dual comparator cards) The NAL card receives an input signal and provides an output trip
. signal by c0 paring the input voltage with an internally adjustable setpoint voltage. Provision is made so tant either an increasing (high) or decreasing (low) volt:ee can initiate action. A deadband adjustment range of 0.5 percent to 20 percent of input span is provided for rsset action.
NAl - Annunciator Interface Card The NAl card provides an interface bitween the T300 Series Comparator (NAL) Card and a remote device that requires a contact closure. This card contains comparator driven relay coils whase contacts are used to interface with contrcl board alarms, annunciatcrs, and status lights. This card also serves as a qualified isolation device for interface with nonsafety systems. NPL - PROM Logic Card '
." b
~
The NPL card is a solid state logic card using eight Programable , . Read Only Mcmory (PROM) modules to perform legic functions, e.g., OR, , AND, and timing functions. Logic functient are irplemented by five input, eight output, 256 bit PROMS. Each of the outputs is configured to a particular function of the inputs by cambining the miniterms of the desired function. The liPL timer niodule plugs into the PROM sockets on the NPL card and provides an adjustable range of time delays from 20 milliseconds to 21 minutes and 12 seconds, c. 3-7
a 3.4.2 Reliability
~
The crimary element of the availability of each modulJ in the system - is its Mean Time Between Failures (HTBF). MTBF data is derived . from the sum of the failure rates of all the individual components ' that make up the printed circuit card. It can also be ceasuttd by observing actual failure histories of modules in service or test set ups. Reliability is addressed for the active printed circuit cards which are used to provide for a protective action. The fo11 ewing are the active cards to be added for EAM/TTO and the corresponding MTBFs Elvd MTBF(hoursl NAL a,b,c NPL These MTBF values are comparable with the saluer, of all of tla cther , cards used in the 7300 Series Process Protection System. The MTBF - values of the components being added for the EAM/TTD modification are sufficiently high sech that the reliability of the protection syster, is not degraded. e 38
3.5 Equipment Qualification
. 3.5.1 Program Oescription All new hardware utilized for the EAM/TTD modification was previously qualified as part of the 7300 Series Process Protection System. The qualification testing of the 7300 Series Process .'rotection System, per Westinghouse WCAP 8587 methodology, has demonstrated the equipment's capability to perform its designated safety related functions when subjected to the seismic and environmental condittens specified in the WCAP 8587 supplements for the 7300 Series Process Protection System.
3.5.1.1 Environmental Testing (IEEE Std. 323 1974) The hardware was tested under both ' normal" and ".5 normal' environmental 3 conditions. Na. Tal: Temperature and 60 80 Degrees F Rslative Humidity (Ranges) 30 50 % R.H. l Abnormal: l l Temperature and 82 Degrees F, 95% R.H. Relative H e.idity (Test Points) 120 Degrees F, 35% P..H. 3.5.1.2 Seismic Testing (IEEE Std. 344-1975) The 7300 Series Process Protection Equipment was subjected to multi axis, multi frequency inputs in accord 6nce with Regulatory Guide 1.100. The seismic testing demonstrated the capability of the 7300 Process Protection System to reliably and accurately perform its safety-related functions before, during and after a seismic event. The equipment was subjected to both Operating Basis Earthquakes (OBEs) and Safe Shutdown Earthquake (SSi) events. 0-9 t
3.5.2 EQ Documentation The overall equipment qualification documentation consists of three sets of documents: *
- 1. WCAP 8587, "Methodology for Qualifying Westinghouse WRD Supplied NSSS Safety Related Electrical Equipment" (Non Proprietary), describes the Westinghouse program for addressing the requirements of IEEE Std. 323 1974, 'IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations". The NRC has reviewed and approved WCAP 8587 per the SF.R dated November 30, 1983. Revision 6 A of 'dCAP-8587 includes t5c cover letter of the SER which specifically references the individual WCAP supplements also approved by the SER.
- 2. WCAP 8587, Supplement 1, "Equipment Qualification Data j Packages (EQDPs)', is a compilation of the individual EQDPs provided for each item of equipment qualified per a ,
WCAP 3587 program. Westinghouse developed the EQDP format - in order to comply with Section 8 of IEEE Std. 323 1974. .
, Each EQDP suuarizes the equipment performance requirements
- and accer,tance criteria (Section 1) and qualification program plans to be employed, whether by test (Section 2),
, experience (Section 3), by analysis (Section 4) or by some combination of these methods. Upon completioin of the equipment's qualification program, the EQDP is issued to ! sumarize the specific test / analysis procedures and results. The EQDP addressing the qualification of the 7300 Series Process Protection System is ESE 13. All EQDPs are designated "Westinghouse Class 3'; these serve as the non proprietary "varitons" of the EQTRs. - 3-10
j
- 3. WCAP-8687 is the compilation of the individual Equipment Qualification Test Reports (EQTRs) and is supplement 2 to )
. WCAP 8587. Each IQTR details the qualification testing ;
~
and/or analysis procecures and results. All EQTRs are
- designated "Westinghouse Proprietary Class 2" and are considered proprietary to Westinghouse, The EQTRs for the 7300 Process Protection System are referenced as WCAP 8687, Supplement 2- :
- 1. E13A, "Process Protection System (Seismic Testing)",
- 2. E13B, ' Process Protection System (Environmental and Supplemental Seismic Testing)",
- 3. E13C, ' Process Protection System (Seismic and Environmental Testing of Printed Circuit Cards)", -
- 4. [13D, ' Process Protection System (Supplemental Testing 3 of Power Supplies and Circuit Breakers)".
9 6 i i l 4 9 3-11 s t
l 3.6 Surveillance Testing 3.6.1 Test Capability
- The 7300 System EM/TTD modification has been configured to provide surveillance test capability (Figure 5). The EM/TTD steam generator level protection channels receive input signals from the steam generator level, Delta T (from Thermal Overpower and Overtemperature protection)andcontainmentpressurechannels. The test scheme has been designed such that the EM/TTD steam generator level channels may be removed from service, one at a time, and tested [
Ja.c In ordar to provide for safe and efficient testing, a number of test interlocks have been designed into the protection systam. The interlocks relative to EM/TTD are associated with steam generator - level, Delta-T, and containment pressure signals. The interlocks are , describet i., detail below. - EAM/TTD Steam Generator level The stehm generator level portion of the EM/TTD steam generator level channel is removed from service for test purposes by forcing a trip output signal for every comparator - associated with a particular 1eral transmitter. This is done via card edge test switches on an NCT printed cir;.uit card. The test circuitry is designed such that tripping the appropriate comparator test switch outputs will automatically ,
. i 3-12
disconnect the associated level transmitters, insert test
, signal injection points, and insert proving lights downstream of all level comparators. Operation of the level comparators is verified by varying the test injection sigels and observing cperation cf the comparator proving lights located on NCT card ;
- edges.
The EM portion of the EAM/TTD steam generator level channel is removed from service for test purposes by enabling the EAM test interlock. The EAM test interlock will (
]a,c and insert ,
a test signal injectfon point and a proving light for the EAM temparator. Operation of the EAM comparator is verified by varying the test injection signal and observing operation of the comparator proving light located on the NCT cerd edge, it should also be noted that the latch in function for the EAM comparator has been incorporated into the EAM test interlock, [ 4
, jh.c l .
Through ad? nistrative control of an NMT card and the 7300 syster. "breakout tox", an addititnal variation of the EAM test interlock is possible. This testing scheme may be used to inject a test signal to the comparator [ [ i i Ja,c ; l The TTD portion of the EAM/TTD steam genrator levai channel is r eoved from service for test purposts by enabling the TTD test i 3 13
I interlock. The TTD test interlock will ( Ja.c and insert test sigt al injection - points and proving lights for the Delta-T comparators. Operation of the Delta-T comparators is verified by varying the ", test injection signal and observing operation of the comparator proving lights located on NCT card edges. Through administrative control of an NMT card and the 7300 ! system ' breakout box", an additional variation of the TTD test interlock is possibls. This testing scheme, again, may be used ; to inject test signals to these comparators [ '
)t.c Containment kressure -
A containment pressure transmitter is automatically removed from service for test purposes by 1) forcing a trip output l signal for every comparator associated with a particular pressure transmitter except for containment spray actuation, 2) forcing a bypass condition for the containment spray actuation ' comparator, and 3) enabling the EAM test interlock. The EAM test interlock will ( ] Ja.c and insert a test signal injection point and a proving light for the EAM comparator. ; 1 Delta-T The narrow riage hot leg and cold leg RTDs used to determine i 3-14
i Colta T are automatically removed from the thermal overpower and overtemperature protection channels whenever 1) a trip output o signal is forced for all of the comparators in that chinnel and
, 2) the TTD test interlock is enabled. The TTD tesi interlock will f Ja,c and insert test signal injection points and p.oving lights for the Delta T ,
comparators in the TTD circuitry. 3.6.2 Test Methodology 3.6.2.1 Monthly Tests As required in the Callaway Technical Specifications, periodic tests for the steam generator low low level channels are carried out on a ' quarterly basis in accordance with the Reactor Trip System (RTS) Instrumentation Surve111ence Requirements and on a monthly basis consistent with the Engineered Safety Features Actuation System (ESFAS) l Instrumentation Surveillance Requirements. Since the ESFAS j , surveillance requirements are more restrictive than those for the RTS, the EAM/TTD steam generator level channels will he tested on a monthly 4 basis. In order to test the EAM/TTD steam generator level channels, ( 1 1 4
- ]C The level channels may now be a
test 9d one at a time to verify one out of four operation, and with various combinations of two at a-time to verify two out-of-four operation. The EAM and Delta T comparators will also be tested at this time. [ a p i 3-15
, _ , _ , . _---,-~-7_ - - -, . _ ,
Ja.c After the normal environment comparators have been tested, monthly testing of the '. EAM/TTO timers is required for the surveillance testing to be complete, , Through the use of an NMT card and the 7300 Series System "breakout box", a variation of the ITD test interlock will be performed. This aforementioned test variation will allow injecting test signals to the Delta T comparators [ la,c Upon . simulation of a steam generator low low level, as previously described, the operability and accuracy of the PROM logic timer modules are verified. The timer operability test is necessary due to the failure modes of the NPL card; all but one of the failure modes were evaluated to be immediately detectable by the operator. The one exception is the , failure of a timer chip which could prevent a required trip signal from being actuated. The timer accuracy test is necessary dae to the Technical Specification corresponding to the testing of the process racks in the plant. The Callaway Technical Sper.ifications require the analog channel operational testing of the steam generator low low level channel on a monthly basis. This test is the injection of a simulated - signal into the channel as close to the sensor as practicable to verify operability of an alarm, interlock and/or trip functions, this test shall include adjustments as necessary of the alarm, interlock and/or trip setpoint such that the setpoints are within the required range and accuracy. Since the time delay of the TTD timers is considered to be a - , setpoint, the TTD timers will also be tested for accuracy as part of j the monthly channel tests. [ 3.6.2.2 Outage Tests [ Ja,C 3 16
l 3.7 Applicable !&C Criteria The following criteria apply to this system. 3.7.1 Nuclear Regulatory Commissior. 3.7.1.1 10CFR50, Appendix A General Design Criteria for Nuclear Power Plants Criterion 1 Quality Standards and Records Criterion 2 Design Bases for Protection Against Natural Phenomena Criterion 3 Fire Protection Criterion 4 Environmental and Dynamic i Effects Design Bases Criterion 10 Reactor Design Criterion 13 Instrumentation and Control , t Criterion 15 Reactor Coolant Syltem Design ! Criterion 19 Control Room Criterion 20 Protection System Functions I Criterion 21 Protection System Reliability and Testability . 3 17 f
Criterion 22 Protection System Endependence Criterion 23 Protection System Failure Modes Criterion 24 Separation of Protection and Control Systems Criterion 29 Protection Against Anticipated Operational Occurrences Criterion 34 Residual Heat Removal 3.7.1.2 10CFR50, Appendix B Quality Aseurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants 3.7.1.3 10CFR21 Reporting of Deferta and . Noncompliance 3.7.1.4 Regulatory Guides 1 Regulatory Guide 1.22 Periodic Testing of Protection System Actuation Functions Regulatory Ouide 1.38 Quality Assurance Requiremen't.s for Packaging, Shipping, Receiving, Storage, and Handling of items for Water Cooled Nuclear Power Plants 9 3-18
.T-
. _ _ _ _ _ . _ _ _ _ _ _ s
Regulatory Guide 1.47 Bypassed and inoperable Status Indication for Nuclear Poder
. Plant Safety Systems Regulatory Guide 1.53 Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems Regulatory Guide 1,62 Manual Initiation of Protective Actions Regulatory Guide 1.75 Physical Independence of Electric Systems Regulatory Guide 1.89 Qualification of Class IE Equipment for Nuclear Power Plants Regulatory Guide 1.100 Seismic Qualification of Electric Equipment for Nuclear , .' Power Plants Regulatory Guide 1.105 Instrueent Setpoints Regulatory Guide 1.118 Periodic Testing of Electric !
Power and Protection Systems r ., 3 19
3.7.2 Institute of Electrical and Electronic Engineers (IEEE) Standards . IEEE Std. 279 1971 Criteria for Protection Systems - for Nuclear Power Genertting Stations IEEE Std. 323 1974 Qualifying Class IE Equipoent for Nuclear Power Generating Stations IEEE Std. 338 1977 Criteria for Periodic Testing of Nuclear Pouer Generating Station safety Systems IEEE Std. 344 1975 Recommended Practices for Seismic Qualification of Class IE Equipment for Nuclear Power Generating Stations , IEEE Std. 379 1977 Application of the Single . Failure Criterion to Nuclear
- Power Generating Station Class IE Systems IEEE f.td. 384 1974 Criteria for Independence of Class IE Equipo.ent and Circuits 3 20
3.7.3 Compliance with IEEE Std. 279 1971
- The referenced criteria establish the minimum requirements for the safety related functional performance and reliability of the EAM/iTD in the protection system. The following is a discussion of the EAM/TTD compliance with Section 4 of IEEE Standard 279 1971, "Criteria for Protection Systems for Nuclear Power Generating Stations".
3.7.3.1 General Functional Requirement The EAM/TTD r.odification will not degrade the protection system capability to automatically initiate appropriate protective action whenever a condition monitored by the system reaches a preset level. 3.7.3.2 Single Failure Criterion For the EAM/TTD modification, the protection system single failure
- criterion is fulfilled through the use of a level input for each steam generater in each of the four protection sets. Should a single failure of either a protection set or a transmitter asso:iated with a steam generator occur, redundant hardware is available to provide the proper protective action at the system level.
3.7.3.3 Quality of Components and Modules The quality of the equipment associated with EAM/TTD is consistent with the quality of the current protection system equipment. The - - reliability of the equipment is discussed in Section 3.4.7. 3 21
3.7.3.4 Equipment Qualification Tho EAM/TTD equipment is environmentally and seismically qualified in accradance with the current Westinghouse qualification program. The '. methodology of this program is contained in WCAP 8537 Rev. 6 A,
' Methodology for Qualifying Westinghouse WRD Supplied NSSS Safety '.
Related Electrical Equipreent". This program has been developed and implemented in accordance with the requirements of IEEE Std. 344-1975, ' Recommended Practices for Seismic Qualification of Class IE Equipmen.t for Nuclear Power Generating Stations", and IEEE Std. ' 323-1974, ' Qualifying Class IE Equipment for Nuclear Power Generating Stations". More background is presented in Section 3.5. 3.7.3.5 Channel Integrity With the addition of the EAM/TTD components, the existing channel integrity continues to maintain necessary functional capability under extreme conditions (as applicable) relating to environment, energy supply, malfuctions, and accidents. 3.7.3.5 Channel Independence , With the addition of the EAM/TTD hardware, independence and physical separation between the four protection tets and train oriented signals continn to be maintained as sserited in callaway FSAR Section 7.1.2.2. Channel independence is maintaineo throughout the process protection system, extending from the sensor up to the Solid State Protection System at which point two independent Engineered Safety Feature Actuation System and Reactor Trip trains are maintained. Physical separation is used to achieve separation of redundant transmitters. Separation of wiring is achieved using separate wireways, cable trays, conduit runs, and containment 3 22
penetratione for cach redundant channel. Redundant process
. et.ulpment, including the EA'i/TTD hardware, is separated by locating modules in different protection cabinets. Each redundant protection channel set is energized from a separate ac power feed.
3.7.3.7 Contro~l and Pretection System Interaction ; For the EAM/TTD modification, there is no control and protection system interaction (i.e., only protection channels used for the EAM/TTD modification). All existing interfaces between the protection and control systems remain intact and are not affected by the modification, 3.7.3.8 Derivation of System Inputs The steam generator level, containment pressure, and narrow range temperature inputs continue to be derived from direct measures of the desired variable. There are no new protection system inputs required for the EAM/TTD modification. 3.7.3.9 Capability for Sensor Checks Means are provided for checking the operational availability of each system input sensor during reactor operation. The operational availability of each system input sensor during reactor operation is accomplished by cross checking between channels that bear a known relationship to each other and that have readouts available. The EAM/TTD modification will not impact existing schemes for verifying sensor availability. I
?
3 23 .
3.7.3.10 Capability for Test and Calibration Capability for test and calibration of the steam generator level channels including the EM/TTD modification is provided. These - channels have been configured to provide for overlap testing to verify total system operability. Testing is performed at the 7300 system instrumentation racks by individually introducing dumy input signals into the instrumentation channels and observing the tripping of the appropriate output bistables. Process analog output to the logic circuitry is interrupted during individual channel test by a test switch which, when thrown, inserts a proving lamp in the bistable output, and deenergizes the associated Solid State Protection System (SSPS) logic input. Each channel contains those switches and test points necessary to test the channel. Before starting any of these tests with the plant at power, all redundant reactor trip channels associated with the function to be tested must be in the nnrmal (untripped) niode in order to avoid spurious trips. A detailed description of periodic surveillance test features is l provided in Section 3.6. 1 3.7.3.11 Channel Bypass or Removal from Operation - Two options, coincidence logic or channel bypass, would satisfy tho intent cf this requirment. The protection system, including the EM/TTD modification, is designed so as to permit periodic testing of the steam generator level channels during reactor power operation without initiating a protective action, unless a trip condition actually exists. The coincidence logic in the Solid State Protection System (SSPSj required to initiatt a reactor trip fulfills the first option. The second option, operation with a channel in the bypass mode, is not anticipated and thus, not provided for in the protection system. - 3 24
3.7.3.12 Operating Bypasses Operating bypasses in the existing protection system are not impacted
. by the addition of the EAM/TTD modification.
3.7.3.13 Indication of Bypasses i f Indication of the bypasses in the existing protection system is not impacted by the addition of the EM/TTD modification. 3.7.3.14 Access to Means of Bypassing Access to means for b,vpassing in the existing protection system is l not impacted by the addition of the EAM/TTD modification. 3.7.3.15 Multiple Setpoints 1 By incorporating the EAM/TTD circuitry, there is a need for i l additional setpoints. Tha E4i modification requires four additional ! l icvel bistables (one per steam generator) per protection set. These bistables are for the low low steam generator level setpnint l associated with a normal containment environment. The existing bistable setpoints include an environm ntal allowance uncertainty and , will be used for the steam generator low low level correspanding to l-an adverse containment envircnment. For an adverse environment a ; containment pressure alarm and annunciator is provided to indicate { the more restrictive setpoint 15 to be enabled. Other positive means L of assuring that the teore restrictive sktpoint is used when necessary is provided by design verification, equipment qualification, installation testing, and periodic survelliance testing. . l t 3 25 f
i q l 4
)
3.7.3.16 .Cotopletion of Protective Action Once it is Initiated l The existing protection system is designed so that, once initiated, ' the protective action at the system level (SSPS) shall go to . 2 completion. Return to normal operation requires subsequent l deliberate operator action. These design features remain unaffected with the addition of the EAM/TTD circuitry. I 3.7.3.17 Hanual Initi6 tion L
, The existing protection system design for manual initiation of each I' protective action at the system level (for example, reactor trip, I
main feedwater isolation, auxiliary feedwater actuation, etc.) is j unaffected by the addition of the EAM/TTD circuitry. 3.7.3.18 Access to Setpoint Adjustments, Calibration, and Test Points I . The EAM/TTD as part of the protectio , system is designed to allow , 1 administrative control of access to all setpoint adjustments, rodule - 1 calibration adjustments, and test points. i 3.7.3.19 Identification of Protective Actions j The EAM/TTD modification is a part of the existing protection system i design which provides for the indication and identification of protective actions down to the channel invel through the use of annunciators, indicators, and status lights. ,1 t 3 26
( [ v i , 3.7.3.20 Information Read Out The existing protection system is designed to provide the operator
;l ,' .
with accurate, complete, and tir.ely information partinent to its own j status and generating station safety. TheEAM/TTDdesignprovides c for alams and annunciators in a manner which is consistent with the h , existing protectior system design, i l , j 3.7.3.21 System Repair j j The EAM/TTD circuitry, consistent with the existing protection j system, is designed to facilitate the recognition, location, I l replacement, repair, or adjusteent of malfunctioning components or modules. [ 3.7.3.22 Identification l All printed circuit cards utilized for the EAM/TTO modification are provided with labels which identify the proper protection cabinet, l card frame, and card slot locations for installation. This is in '
- accordance with the existing protection system technique for l' identification of equipment. l i
i
;l I
i : i 1 5 ( 3 27 1
. __. _ _ _ _ _ ~ _ - _ - _ . - _ , _ _ _ _ . _ _ _ _-_ J
l l 3.8 Conclusions i
- The incorporation of the Environmental Allowance Modifier (EAM) and -
l the Trip Time Delay (TTD) into the Callaway 7300 Process Protection ,
! System satisfies all applicable ILC safety requirements. All of the l components to be added in the EAM/TTD are comensurable with those used in the existing process protection system. There' fore, based on .
1 the information presented in this report, the proposed EAM/TTD
]
modification, as implemented in the 7300 Process Protection System, is deemed to be an acceptable means for reducing unnececessary reactor trips associated with the condition of a steam generator j low low water level. f t
) i i
e l 1
} .
l l 1 l i l i ! 1 i h I a 3 28 4
CALLAWAY WESTINGHOUSE 7300 SERIES BASED EAM/TTD FOR 4 LOOP PLANT PROTECTION EET I (TYPICAL FOR SE' I II III IV) wL w68 tv t T A-t a .. . 5'""
"""~r "'t" '"' '" U"'
@ ,- I I
'T
'7 w s= d I "Ji W @ l r- I %f o; 1 !
tw a(), a
)1 a s a ,
l__ , _ . - 1:m"r Orf R .Qs .R R i< -o H , 6, 6, v : %g Wh' )_ )_ )_ ()_ to tro toonc -
==n vo
. .% . . ,5
- = _=_ _.
T:l2ll?
\ - - -
.O. c- m svi CADE4 i
[ ~h
~
& [6[$[~
IE& & & l m
/z8 ... . .
. .n. c,....... ~ ~
ru e i. ens ,o sue
./
t,m,.eto.ne tme y ; v ......~. 2,. tense 2,. tasse 4,. trase
- 33. ;.""'.
? . .e 3
v..... et x- .- -c .a. =,.,,,
; 7...
r. l. y
~ ^^
, .....a.----
c can.s we==s. = E* *.n. , s, ,, .k,.e,, A ", ,""
=.n.::
;~ :.; :. = ~~
a == --== ID . .,,,,, g . .,e
. ,. m .e Figeste 1: EAM/TTD Logic Diagram euAsseir.:
CALLAWAY WESTINGHOUSE 7300 SERIES BASED EAM/TTD FOR 4 LOOP PLANT PROTECTION SET I (TYPICAL FOR SETS I II III IV)
\.
CIPs,a3orce w?
~3?"- .a . .m m -a L t O
i 1w F . 8 %.,e , , Ca.l! a
._t a }s _ _a_ 2 a a _
l ' :,',12 "' Orf fl .R
.Q R y . . . .
titra O , AMED .O t st% ,les)
" Cattlee.T ed F1.IStIs.3 CattI*E_ t
- s -- s iE g--
~ i- s l
w w, w u -
, ,= .: =., =. --..=..
. . =. .. = =,,. w,,. _ w~ v _ =,,. .
f.r.. 5
//
E I- 3 , -. m. . s = 2, s . ,- : , 1 1 i /~ . m ~~.. =-w > - f,....
.~- . m= t
. ,,.,. t t ,
surs= . o-- Figure 2: EAM Logic Diagram es2xseen 2 4 O
ay s I t% L. $p\w $' < s SWIl AYTO
----____ d
8!; 9. gj 51 -j S , m , i E8 , ll 1 e 3 i S' _. i ..
-l j
i . 4l1 j 1, tb ll$ $[lll N b p , y ,
. , 1s . . . .
.e e 9 j66 !!5 ti
, h~-~ s' -= , l ~ [ l ,i I - 3.f, l
* - 9 libiii 8~
'~ '1 1 am .-3
+
lgr ik~ -
- . ~
e l (( O - sm . .
. h.
C . y
>. W o c'q s
<a' J -, a' si
!sl 3
o {.; w5 W a rO- e # - 8 S'
- l. g-g m--
b, g! i g , 3 OU .J :T .! V il f) 13 y I
"6
!Eo i
i s-[ M^- lisx g i.j l!!rt W
- !< l t 5)c a
O i, gf { ,, ,. E C p i m g _ n i m .~ S j 3 -
,.yqs .
,l{~
1 L ", 7 i i 5s Y-i 3~
-- 3'
},{,llah,j 11;! k dl1 dij E
j1-{i1 jN .,! 11 !
.,!Si iih
!!c = 2
<-,--.:= __.-.- :::,= cv i g 8ll lll7--l,___ ::::ay ll.
- #p ll lirit;li i i i
t "I i 1 g
. 3 Gl3I I i
- kl k"g ' ~ ~ ~ '
I i WlWI i
. l l 5 l' g
j H~~ h i [A*HH h *-- ll 1 *I 3 rd I l lI e ;
= I L -. ,
i i j , , U l b l _t L*-- i i, ..
. g- I r
I [;HH 1 l i Im .. . .. c - -. s
, W;9 g y
;!"- *p ____J
} ,
1 ig ; e ---.q)-. g" _. 1 . s . n"-- -
?!- $- r -
I $ q S
)
'(
- g. .
i i
) (
M lg E E.i,H H- .g fh f= 5
" 4W ; I hyl*
j g sysr2.__i ~ r-
' E%id' i'ZIL .
- a w- n~
CONTAltNENT PRESSURE TEST I(PT INJECT a TP o TI '. a,e o .- fPS/
/ k -
se
- = s,c.
5( SI ml (5 l N zl (NeO)r -
"l pp D ENABLE SIGNAL FOR
.ALL FOUR S.G. LEVEL F H PB H' ADVERSE SETPOINT utl f, o - - -
Q - BISTABLES (SHEET I) CONTAINMENT PRESSURE BISTABLES ._ ,,, ADVERSE ENVIRONMENT LATCH-IN FUNCTION MET 2/' Figure 5(cont.): EAMiTTD Test Logic j esnx:
l l 4.0 PROTECTION SYSTEM SETPOINT STUDY
. 1
\
Instrument loop uncertainty calculations were performed to confirm i necessary Technical Specification values The methodclogy used is essentially the same as that noted in report, "Westinghouse Setpoint Methodology for Protection Systems - Callaway." Some minor differences can be noted in the treatment of RTD and R/E uncertainties which reflect the latest methods for use of Delta-T instead of Tavg. The implementation of the TTD requires that two sets of Vessel Delta-T and Time Delay setpoints be noted in the Technical Specifications, one set (Power - 1) for Vessel Delta-T less than or equal to the equivalent of 10.0 % Rated Thcfmal Power (RTP) and one set (Power - 2) for Vessel Delta T less than or equal to the equivalent of 20.0 % RTP. The inclusion of the EAM results in two trip setpoints for Steam Generator Water Low Low Level, one for a maximum containment ambient temperature of 230 0 F (Normal) and a 0second that reflects a maximum containment ambient temperature of 320 F (Adverse). The uncertainty analyses performed reflect these ubient conditions. Changes are required in t'ie Technical Specifications to reflect the addition of the EAM/TTD. Uncertainty calculations were performed and are documented in the following tables for: Steam Generator Water Low-Low Level -- Normal (containment ambient temperatures 80 to 230 F), Steam Generator Water Low Low Level -- Adverse (containment ambient temperatures 230 to 320 0F ), Containment Pressure - EAM (uncertainties used in coincidence with Steam Generator Water Low Low Level -- Adverse) Delta-T (Power - 1 and Power - 2) (Ves.;e1 Delta-T used in coincidenca with Steam ;enerator Water Low Low Level -- Normal orAdverse). It should be noted that the Reactor Protection $33. . and ESFAS time responses noted on Tables 3.3 2 and 3.3 5 for Steum Generator Water low Low Level ieflect the coincidence with Vessel Delta T greater than the equivalent of 20 % RTP. The time delays associated with the use of the TTD are noted on Tables t.2-1 a6d 3.3 4. The Trip Setpoints noted reflect the uncertainties associated with the generation of the time delays. 4-1 a
, e - - , _ - . , . , . . - - . - - , . , , _ . - - - . _ . .- _. .
TABLE 4-1 STEAM GENERATOR WATER LEVEL LOW LOW - "NORMAL"
. Parameter Allowance *
. Process Measurement Accuracy -- -- +a,c'
= Density variations with lord **
Primary Element Accuracy Sensor Calibration Accuracy Measurement & Test Equipment Accuracy Sensor Pressure Effects . Senior Temperature Effects Sensor Drift Environmental A11oaxnce Transmitter Reference Les Heatup (corresponds to 214 "f) Loop Insulation Resistance Rack Calibration Rack Accuracy Measurement & Test Equipment Accuracy Rack Comparator Setting Accuracy One input i
, Rack Temperature Effects Rack Drift P
- In % span (100 % span)
** Table 3-27 "Westinghouse Setpoint Methodology for Protection Systems - Callaway". ,
Channel Statistical A110wence -
- -+a,c I
t i i
TABLE 4-2 STEAM GENERATOR WATER LEVEL - LOW LOW - "ADVERSE" Parameter Allowance
- I
- Process Measurement Accuracy -- -- +a,c DenLity variations with load **
Primary Element Accuracy Sensor Calibration Accuracy Measurement & Test Equipment Accuracy , Sensor Pressure Effects Senser Temperature Effects Sensor Drift , Environmental Allowance Transmitter Reference Leg Hestup (corresponds to 265 0) F i Loop Insulation Resistance Ratk Calibration Rack Accuracy Measurement & Test Equipment Accuracy Rack Comparator Setting Accuracy One input Rack Temperature Effects Rack Drift i
- In % span (100 % span)
** Table 3-27 ' Westinghouse Setpoint Methodology for Protection Systems - Callaway".
Channel Statistical Allowance -
-- -- +ac e < mp t
l TABLE 4-3 CONTAINMENT PRESSURE - EAM Parameh.t Allowance *
+a c Process Measurement Accuracy Primary Element Accuracy S:nsor Calibration Accuracy t$easurement & Test Equipment Accuracy Sensor Pressure Effects !
Sensor Temperature Effects Sensor Drift Environmental Allowance Rack Calibration Rack Accuracy Measurement & Test Equipment Accuracy Rack Comparator Setting Accuracy One input
,- Rack Temperature Effects Rack Drift , (0.7 psig) ,
- In % span (69 psig)
Channel Statistica', Allowance -
- - +a,c e ,e r
TABLE 4-4 DELTA-T (POWER - 1 & POWER - 2) E.arameter Allowance *
. Pro ess Measurement Accuracy --
-- + a , c Primary Element Accuracy Sensor Calibration Acccraev
[ )+a,c Measurement & lest Equipment Accuracy Sensor Pressure Effects Sensor Temperature Effects Sensor Drift- ' [- )+a,c Environmental Allowance Loop Insulation Resistance (+ 0,7 0f )(100/87.0) Rack Calibration
-- -- +a,c Measurement & Test Equipment Accuracy
, [1 0.1 % of 120 O f sp.n - R/E converter]+a,c Rack Accuracy
- -- +a,c Rack Comparator Setting Accuracy One input Rack Temperature Effects Rack Drift
- In % Delta-T Span - 87 F0 = 150 % RTP J
9
TABLE 4-4 (Continued)
, DELTA-T (POWER - 1 & POWER - 2)
O Channel Statistical Allowance -
- - +a,c I
I i G 9 e O D h
1, ! [s "
.gll, a a
. =II:*i::: 5 liti est! jjjj:g .-
litt,
. ] :::: 1 3333*
=Es.E=I g :littg v .. ..
i ia :::::
, l e _I.
I g3 I is. 3 g3 i Il-
. l. .
3
-l]s !
s u
-1
=
34
- 1 IE =a i '
..s a.
1 i tj gs 13 m 2:
'. ! 3 EI i
g)
'g ?3
.l ,I .IA a
m
=21
~
!' '85j a13, 111' = idi i as,
,p. .
,l u
i,. . I I. l.
. I llng oilli
!11:1 -
illi ,
4 9 6 h fasti 46 estam festictie Sfttts 5ft gr1veigt gm f* i Mf Writ ALL0msti (l) ell) (l) (S) MM 81 81% IBIP STS Ab481ERALI mlanen ' p lanensmut 1111 til W W W W was tres' mm ens m
- . .e.s
$ $1(as gelat3 s'.1 L(sth
- LGP-L0r ** W" 14 0 $I I'O II'IO IN I I888 N O I 088* IS 0 I 0888 I4 I I ISe# I 3 tile stattate wita ustl . Lar-tew *aptant* te t 34 I8 II # l# I 8888 le 8 5 less W.4 8 toen u g 3 see. 3 3 gpg.; pus.9 46 It f .? f 88 IW 8 8?' le e 3 att to 4 5 Stp gg a 3 ett 3 4 cnta.T ** fate . 3 66 86 8.7 I 88 IW I 8?8 88 01I?P HI%SM St 4 5 BTP 4 4 pf atsget Paillet = Las 45 I0 I'I I II 88 M'8 IIP 4 I'I 884 3 0 M'8 0
. .2 e
G e I I I l t b 9 1 # J 9
WELTINGOUSE PROPRIEDUE CIASS 2 l l NCTMS F1:R TABIE 4-6
/ (1) A = (1HA)2 + (PEA)2 + (SPE)2 + (ggg)2 + (RIE)2
[ (2) S = SCA + SD
-+ac r (3) T1 = RCA + RMTE + RCSA + RD T2 = TA - (A + (S1)2 + (32) )/ - EA T3= ((RCAg + RMTE1 + RCSA1 > RD1 ) 2 +
(RCA2 + RMTE2 + RCSA2 + RD 2 ) }1/2 T = minimum of T1 , T2 or T3 (4) Z= (A)1/2 + EA (5) All values in % Span (6) This column provides the maximum value for a bistable assuming that the transmitter is not evaluated and the values for S, Z
,' and TA from this table are used in the following equation:
R = TA - Z - S. This implies that the transmitter is assumed to be at its maximum allowed calibration and drift deviation i in the non-conservative direction. With a bistable's Trip Setpoint found in excess of the value noted in this column, it is possible (but not known absolutely) that a channel would be considered inoperable. This must be tempered by the transmitter assumption noted above, i.e., the transmitter is assumed to be at its worst acceptable condition. Acronyms as defined in "Westinghouse Setpoint Methodology for Protection Systems - Callaway." I 8
- - - - - - - , . - . . n.. . . . , , . . . - - - - . , , ,. -.,.,- ,-.--- -.--c.-.
5.0 Reference s' l. WCAP-11342-P-A, Rev.1, Modification of the Steam Generator Lor Low Level Trip Setpoint to Reduce Feedwater-Related e Trips, April 1988.
- 2. WCAP-ll325-P-A, Rev.1, Westinghouse Owners' Group Trip Reduction and Assessment Program: Steam Generator Low Water Level Pro'ection System Modifications to Reduce Feedwater-Related Trips, February 1988.
- 3. Revision OL-2 of the Callaway Plant Final Safety Analysis Report ,
- 4. WCAP-10961-P, Steamline Break Mass / Energy Releases for Equipment Environmental Qualification Outside Containment -
Report to the Westinghouse Owners' Group High Energy Line Break / Superheated Blowdowns Outside Containment Subgroup. October 1985.
- 5. ANSI /ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 1979.
51 s t
, _ ____ __}}