ML20198P035

Proposed Tech Specs Incorporating Requirements for Steam Line Rupture Detection/Isolation Sys

ML20198P035
Person / Time
Site:	Fort Saint Vrain
Issue date:	06/04/1986
From:	PUBLIC SERVICE CO. OF COLORADO
To:
Shared Package
ML20198N945	List: ML20198N940 ML20198P013 ML20198P035 ML20198P051
References
TAC-60421, NUDOCS 8606060223
Download: ML20198P035 (27)

Text

ATTACHMENT 1

SUMMARY

OF PROPOSED CHANGES U

8606060223 860404 PDR ADOCK 05000267 P

PDR Attachment I to P-86227

SUMMARY

OF PROPOSED CHANGES SECTION DESCRIPTION LC0 4.4.1

1. TABLE 4.4-2.

Deleted line items 1 and 2 as they relate to the Steam Pipe Rupture Detection System whose PPS trip functions are being deleted.

The Steam Line Rupture Detection /

Isolation System (SLRDIS) replaces protection provided by the Steam Pipe Rupture Detection System under the PCRV and in the pipe cavities for each loop.

2. TABLE 4.4-3.

Added line item nos. 10a, 10b, 10c, and 10d in the format of the Technical Specification Upgrade Program for TRIP SETPOINTS for CIRCULATOR TRIP (pg 4.4-6a) and OPERABILITY REQUIREMENTS for CIRCULATOR TRIP (pg 4.4-5b) for the Steam Line Rupture Detection / Isolation System. The new format has a column labelled ' ACTION' which has requirements when specifications of the OPERABILITY REQUIREMENTS are not met. The applicable ACTION statements are shown on pg 4.4-6c.

3. NOTES FOR TABLES 4.4-1 through 4.4-4 (continued)-pg4.4-8and4.4-9. Notes (j) and (s) are deleted as they are related only to the Steam Pipe Rupture Detection Instrumentation whose PPS trip functions are being deleted.

Basis for LC0 4.4.1

1. Page 4.4-12, Two-Loop Trouble. The operation of SLRDIS to effectively override a simultaneous two loop shutdown inhibit is described in this basis.

2. Page 4.4-12, High Temperature.

Deleted reference to the Steam Pipe Rupture Detection System.

3. Loop Shutdown Inputs-Shutdown of Both Circulators is moved from pg 4.4-13 to new page 4.4-12a.

4. Loop Shutdown Inputs-Basis for Steam Pipe Rupture in Reactor Building has been deleted.

5. Circulator Shutdown Inputs (except circulator speed high on water turbines) paragraph moved to new page 4.4-12a.

Added paragraphs on Steam Leak Detection in the Reactor Building on pages 4.4-12a and 4.4-12b.

Paragraph on Steam Leak Detection in the Turbine Building added on page 4.4-13 and remainder of that page reformatted to account for deletion of Steam Pipe Rupture Detection System.

SR 5.4.1

1. Basis for SR 5.4.1 expanded to discuss basis for surveillance on SLRDIS.

Inserted on pg 5.4-2.

2. Table 5.4-2.

Line item I was deleted as it is related to the Steam Pipe Rupture (Pipe Cavity) channel which is no longer s

required.

3. Table 5.4-2.

Line item 2 was deleted as it is related to the Steam Pipe Rupture (Under PCRV) channel which is no longer required.

4. Table 5.4-3.

Added line item nos. 8a, 8b, 8c and 8d in the format of the Technical Specification Upgrade Program for Surveillance Requirements on the Steam Line Rupture Detection / Isolation System which is to be installed as part of this Technical Specification Amendment.

e ATTACHMENT 2 PROPOSED CHANGES

i Fort St. Vrain 01 Technical Specificatio'ns Amendment #

Page 4.4-4 Specification LCO 4.4.1 Table 4.4-2 INSTRUMENT OPERATING REQUIREMENTS FOR PLANT PROTECTIVE SYSTEM, LOOP SHUTDOWN MINIMUM DEGREE PERMIS-MINIMUM OF SIBLE TRIP OPERABLE REDUN-BYPASS NA FUNCTIONAL UNIT SETTING CHANNELS DANCY CONDITIONS la. Deleted Ib. Deleted Ic. Deleted Id. Deleted le. Deleted If. Deleted s

2a. Deleted 2b. Deleted 2c. Deleted 2d. Deleted 3a. Loop 1 Shutdown 2

1 None Logic 3b.

Loop 2 Shutdown 2

1 None Logic 4a.

Circulator 1A and IB Circulators 2

1 None Shutdown - Loop 1A and 18 Shutdown Logic Shutdown 4b.

Circulator IC and ID Circulators 2

1 None Shutdown - Loop IC and 10 Shutdown Logic Shutdown

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-6a Specification LCO 4.4.1 Table 4.4-3 (Continued)

PLANT PROTECTIVE SYSTEM. TRIP SETFOINTS - CIRCULATOR TRIP TRIP ALLOWA8LE NO.

FUNCTIONAL UNIT SETPOINT VALUE 10a. Steam Leak Detection s 52.3 degrees F s 52.8 degrees F Turbine Butiding per minute per minute Loop 1 rate of rise rate of rise 10b. Steam Leak Detection s 52.3 degrees F s 52.8 degrees F Reactor Building per minute per minute Loop 1 rate of rise rate of rise loc. Steam Leak Detection s 52.3 degrees F s 52.8 degrees F Turoine Building per minute per minute Loop 2 rate of rise rate of rise 10d. Steam Leak Detection 5 52.3 degrees F s 52.8 degrees F Reactor Butiding per minute per minute Loop 2 rate of rise rate of rise 1

Fort St. Vrain 01 Technical Specifications Amendment #

Page 4.4-6b Specification LCO 4.4.1 Table 4.4-3 (Continued)

PLANT PROTECTIVE SYSTEM, OPERABILITY REQUIREMENTS - CIRCULATOR TRIP TOTAL CHANNELS MINIMUM FUNCTIONAL NO. OF TO CHANNELS NO.

UNIT CHANNELS TRIP OPERABLE APPLICABILITY ACTION 10a. Steam Leak 4

2 3

Note 1 1,2,3,4,5 Detection Turbine Building Loop 1 10b. Steam Leak 4

2 3

Note 1 1,2,3,4,5 Detection Reactor Building Loop 1 10c. Steam Leak 4

2 3

Note 1 1,2,3,4,5 Detection Turbine Building Loop 2 10d. Steam Leak 4

2 3

Note 1 1,2,3,4,5 Detection Reactor Building Loop 2 Note:

1. The reactor shall not be operated at power (above 2% rated thermal. power) except as provided by these requirements and their associated ACTION statements.

Fort St. Vrain 01 Technical Specifications Amendment 0 Page 4.4-6c Table 4.4-3 (Continued)

ACTION STATEMENTS (for 10a, 10b, 10c and 10d Only)

ACTION 1 -

With the number of channels OPERABLE one less than the Total Number of Channels, operation at power may continue provided the inoperable channel is placed in bypass within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or reduce power to below 2% within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

If the inoperable channel is bypassed, the desirability of maintaining this channel in the bypassed condition shall be reviewed in accordance with Specification 7.1.2.

The channel shall be returned to OPERABLE status no later than during the next reactor shutdown.

ACTION 2 -

With the number of channels OPERABLE one less than the Minimum Channels OPERABLE, place the inoperable channels in bypass and reduce power to below 2% within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Operation at power may continue if at least 3 OPERABLE channels are placed in service.

ACTION 3 -

With inoperable channels or loops other than as provided in ACTION 1 and 2 above, reduce power to below 2% within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The requirement to shutdown affected helium circulators provided in the introduction of Specification 4.4.1 does not apply.

ACTION 4 -

With any one valve actuated by SLRDIS or electrical wiring and circuits -used to actuate that valve inoperable, restore the valve and/or associated components to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or reduce power to below 2% within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

ACTION 5 -

With two or more valves actuated by SLRDIS

'or electrical wiring and circuits used to actuate those valves inoperable, restore the valves and/or associated components to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or reduce power to below 2% within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

4

Fort St. Vrain #1 Technical Specifications Amendment #.

Page 4.4-8 Speciff'estion LCO 4.4.1 NOTES FOR TA8LES 4.4-1 THROUGH 4.4-4 (a) See Spectff cation L5553.3 for trip setting.

(b) Two thersecouples from each loop, total of four, constitute one channel.

For each channel, two thereocouples must be operable in at least one operating loop for that channel to be considered operable.

(c) With one primary coolant high level moisture monitor tripped, trips of either loop primary coolant moisture monitors will cause full scras. Hence, number of operable channels (1) minus minimue number required to cause scrae (0) equals one, the minimum degree of redundancy.

(d) Both 480 volt buses IA and IC loss of voltage for no, longer than 35 seconds.

~

(e) One channel conststs of one undervoltage relay from each of the two 480 volt buses (two undervoltage relays per channel).

These relays fati open which is the direction required to initiate 4 scram.

(f) The inoperable channel must be in the tripped condition, unless the trip of the channel will cause the protective action to occur.

Failure to trip the inoperable channel requires taking the appropriate corrective action as listed on Pages 4.4-1 and 4.4-2 within the specified time limit.

(g) RWP bypass permitted if the bypass also causes associated single enannel scram.

(h) Permissible Bypass Conditions:

I. Any circulator buffer seal malfunction.

II. Loop hot reneat header high activity.

III. As stated in LCO 4.9.2.

(j) Deleted.

(k) One operable helium circulator inlet thermocouple in an operable loop is required for the enannel to be considered operaole.

j (m) Low Power RWP bistable resets at 44 after reactor power initially exceeds 55.

(n) Power range RWP bistables autcmatically reset at 1C% after reactor power is cecreased from greater than 3C%. The RWP may be manually reset cetween 10% and 30% power.

(p) Item 7a. must be accomoanied by item 7c for loon 1 shutdown.

Item 7b.

must be accompanied by item 7c for loop 2 shutdown.

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-9 NOTES FOR TA8LES 4.4-1 through 4.4-4 (Continued) r) Separate instrumentation is provided on each circulator for this functional unit. Only the affected helium circulator shall be shut down within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> if the indicated requirements are not met, s) Deleted.

t) A primary coolant dew point moisture monitor shall not be considered operable unless the following conditions are met:

1)

Reactor Power Range Minimum Sample Flow

~

5tartbp to 25 1 Sec/sec.

> 25 - 55 5 sec/sec.

55 - 205 15 sec/sec.

> 205 - 355 30 sec/sec.

> 355 -1005 50 sec/sec.

2) Minimum flow of item 1) is alarmed in tre control room and the alarm is set in accordance with tre power ranges speci fied.

3) The ambient temperatures indicated by both temporary thermocouples mounted on the flow sensors in penetrations 81 and 83 are less tnan 185'F,

4) Fixed alarms of I sec/see and 75 sec/see are operable.

)

~

Fort St. Vrain #1 Technical Specifications Amendment #

Page 4.4-12 Plant Electrical System Power Loss requires a scram to prevent any power-to-flow mismatches from occurring. A 30-second delay is provided following a power loss before the scram is initiated to allow the emergency diesel generator to start.

If it does start, the scram is avoided.

Two-Loop Trouble.

Operation on one loop at a maximum of about SOE power may continue following the shutdown of the other loop (unless preceded by scram as in the case of high motsture.)

Onset of trouble in the remaining loop (two-loop trouble) results in a scram.

Trouble is defined as a signal which normally initiates a loop shutdown.

Similarly, simultaneous shutdown signals to both loops result in shutdown of one of the two loops only and a reactor scram. However, actuation of both Steam Line Rupture Detection / Isolation System (SLRDIS) loops, effectively shuts down both loops because it sencs an actuation logic signal to all four circulator trip logic cnannels. The consequences of a two-loop _ shutdown and subsecuent loss of forced circulation have been analyzed and found to be acceptable. The consequences are bounded by an thterruption of forced circulation cooling accident described in FSAR Section 14.4.2.2, Safe Shutdown Cooling.

High Temperature in the pipe cavity would indicate the presence of an undetected steam leak. A steam leak or pipe rupture under the PCRV within the support ring would also be detectable in the pipe cavity, therefore only ore set of sensors and logic is required to monitor both areas. The setpoint has caen set above the temperature that would be expected to occur in the pipe cavity if the steam leak were detected.

{

Fort St. Vrain 01 Technical Specifications Amendment #

Page 4.4-12a I

l b) Loop Shutdown Inputs I

Shutdown of Both Circulators is a loop shutdown input which is necesse y to insure proper action of the reactor protective (scram) system (through the two-loop trouble scram) in the event l

of the loss of all circulators and low feedwater flow.

The remaining loop shutdown inputs are equipment protection items which are included Decause their malfunction could prevent a scram due to loss of the two-loop trouble scram input.

c) Circulator Shutdown Inputs l

Circulator Shutdown Inputs (except circulator speed high on water turbines) are equipment protection items which are tied to two loop trouble through the loop shutdown system. These items are included in Table 4.4-3 because a malfunction could prevent a scram due to loss of the two loop trouble scram input.

Circulator speed high on water turbines is included to assure continued core cooling capability on loss of steam drive.

Steam Leak Detection in the Reactor Building is required for equipment Qualification of Safe Shutdown Cooling Systems.

The ALLOWABLE VALUE is set at s 52.8 degrees F per minute rate of rise in order to prevent exceeding the harsh environment temperature profile to which the safe shutdown electrical equipment is qualified, per the requirements of 10CFR50.49.

A setpoint calculation analysis performed per ISA Standard 567.04 and RG1.105 results in the stated ALLOWABLE VALUE and TRIP SETPOINT as specified in the LCO and this basis. The TRIP SETPOINT has been established with sufficient margin between the technical specification limit for the process variable and the nominal TRIP SETPOINT to allow for 1) inaccuracy of the instruments; 2) uncertainties in the calibration; 3) instrument 4

drif t that could occur during the interval between calibrations; and 4) inaccuracies due to ambient temperature changes, vibration and other environmental conditions. The TRIP SETPOINT is set at s 52.3 degrees F per minute rate of rise until such time as the drift characteristics of the detection system are better understood from actual plant operating experience and the assumptions used in the setpoint analysis are verified, a

SLRDIS design incorporates two panels, each with its own set of sensors for the Reactor and Turbine Buildings and dual logic trains in each panel. The SLRDIS design preserves the single failure concept.

A single failure will neither cause nor 4'

prevent SLRDIS actuation in the event of a high energy line break. The probability of an inadvertent actuation is extremely small due to the matrix logic employed for circulator trip and valve actuation. The SLRDIS panels are referred to as " loops";

however, due to the way the outputs of the panels are combined to provide protective action and satisfy the, single failure concepts the SLRDIS loops do not correspond to primary or t

secondary loops.

Fort St. Vrain 01 Technical Specifications Amendment 0 Page 4.4-12b For each SLRDIS loop, the OPERABILITY requirements and their respective ACTIONS represent good operating practices and judgment for a four channel detection system with a 2 of 4 coincidence trip logic. The fourth channel may be placed in bypass for test and/or maintenance purposes while preserving a 2 of 3 coincidence logic OPERABLE.

The Steam Line Rupture Detection / Isolation System as designed and installed has spare channels available for input. Any of the available channels may be selected for input signal processing provided the surveillances are current on the channels used. The SLRDIS is required to be OPERABLE only at power (above 2% rated thermal power). Analyses with rated reactor power at 2% demonstrate that automatic actuation of SLRDIS is not likely to occur during a high energy line break lasting until it is manually terminated at one hour following initiation. The temperatures as analyzed in both the reactor and turbine buildings stay well below the temperature for which the equipment is qualified.

The ACTION statements for SLRDIS allow 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to take specified actions for inoperable SLRDIS detection and information processing equipment; 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed for an inoperable valve and associated equipment.

High energy line break analysis for er.vironmental qualification assumes the worst-case single active failure.

Thus, a

single valve inoperable for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is within the bounds of analysis.

When two or more valves and/or associated equipment is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is allowed to restore the inoperable equipment.

Repairs may be performed while the plant is at

power, thus minimizing thermal cycling of plant and installed equipment.

Fort St. Vrain #1 Technical Specifications Amendment #

)

1 Page 4.4-13 Steam Leak Detection i n_ the Turbine Buildinj is required for equipment qualification of Safe Shutdown Cooling Systems. Thus, the 11mits and basis are the same as discussed in the basis for steam leak detection in the reactor building.

d) Rod Withdraw pechibit Inputs Startup Channel Countrate-Low is provided to prevent control rod withdrawal and reactor startup without adequate neutron flus

'ndication.

The trip logic is selected to be above the background noise level.

Linear Channel (55 Power) directs the coerator's attention to either a downscale failure of a power range channel or improper positioning of the !.S.S.

Linear Channel (305 Pewer) is provided to prevent control rod withdrawal if reactor power exceeds the I.S.S.

limit for the

" Low Power" position.

Fort St. Vrain 01 Technical' Specifications Amendment #

Page 5.4-2 Calibration frequency of the instrument channels listed in Tables 5.4.1, 5.4.2, 5.4.3, 5.4.4 are divided into three categories:

passive type indicating devices that can be compared with like units on a continuous basis; semiconductor devices and detectors that may drift or lose sensitivity; and on-off sensors which must be tripped by an external source to determine their setpoint.

Drift tests by GGA on transducers similar to the reactor pressure transducers (FSAR Section 7.3.3.2) indicate insignificant long term drif t.

Therefore a once per refueling cycle calibration was selected for passive devices (thermo-couples, pressure transducers, etc.).

Devices incorporating semiconductors, particularly amplifiers, will be also calibrated on a once per refueling cycle basis, and any drift in response or bistable setpoint will be discovered from the test program.

Drift of electronic apparatus is not the only consideration in determining a calibration frequency; for example, the change in power distribution and loss of detector chamber sensitivity require that the nuclear powe'r range system be calibrated every month. On-off sensors are calibrated and tested on a once per refueling cycle basis.

The Surveillance Requirements for the Steam Line Rupture Detection / Isolation System instrumentation in Table 5.4-3 include provisions for CHANNEL CALIBRATION, CHANNEL FUNCTIONAL TEST and an ACTUATION LOGIC TEST.

The frequency 'of CHANNEL C\\LIBRATION, REFUELING, is consistent with the interval for testing and calibrating similar detectors (heat sensitive cabling used for fire detection). The manufacturer of the instrumentation recommends an 18 month interval for test / calibration of the electronics portion of the Steam Line Rupture Detection / Isolation System, thus, the CHANNEL FUNCTIONAL TEST is specified for that interval. The ACTUATION LOGIC TEST is specified for a REFUELING interval. The potential for an inadvertent actuation during testing suggests that logic testing be performed only when the plant is in SHUTDOWN. Thus, the surveillance requirements are specified for REFUELING but not to exceed 18 months.

s

Fort St. Vrain #1 Technical Specifications s

Amendment #

Page 5.4-6 0

9 3

_I i_

a O

8 0

8 e

3 m

a t

s 5

t 1

a C

i U

5 N

C S

5 I

3 E

i.

i

?

a b

5 5

c

~4

lage s.4-2 fCont'dt teigtMuM IRf QUt hCit S F064 Cilf Cks. cat lBAAitonIS AalD TESillac Of Loop ='I sysIEm C_hannel p scrietion

{tangtjRD freauency ste e "'

I 3.

Circulator IA a rid 4

lest M

a.

18 tripped Pulse test and verify proper indicatieps.

b.

lest R

b. Trip both circulators to test loop saputdanas.

4.

Circula tor IC and a.

lest M

10 tripped

a. Pulse test and verify proper indications.

b.

lest H

b. Irly both circulators to test loop shutdown.

5.

Steam Gesieratur a.

lest M

renetsation pressure

a. Pressure switches actuated by pressure appiled.

b.

lost M

b. Pulse test each channel with another channel tripped and verify proper indications,

c. Calibrate H

c. Mnown pressure applied at sensor to adjust trip.

6.

flehea t steader

a. Check D

AcLevity

a. Comparison of three separate Indicators in each 3 cop, b.

lest M

b. Pulse tett each channel with another channel tripped and verify proper indications.

c. Calibrate R

c. Expose sensor to known radiation source and adjust trips and indicators.

1 O

ean, d5 3 7 M 3

Ln

• (n OM A 3 08

• 9 Mw N

V O -*-

O3 ende a

De M

l o

3 44 I

f

Fort St. Vrain 01 Technical Specifications Amendment #

Page 5.4-10a Table 5.4-3 (Continued)

CIRCULATOR TRIP SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS

-CHANNEL CHANNEL ACTUATION FUNCTIONAL ' CHANNEL CALIBRA-FUNCTIONAL LOGIC NO.

UNIT CHECK TION TEST TEST APPLICABILITY 8a. Steam Leak N/A R(a)

R(b)(a)

R(c)

At Power

• Detection Turbine Building-Loco 1 8b. Steam Leak N/A R(a)

R(b)(a)

R(c)

At Power

• Detection Reactor Building Loop 1 1

8c. Steam Leak ~

N/A R(a)-

R(b)(a)

R(c)

At Pow r4 Detection Turbine Building Loop 2 8d. Steam Leak.

N/A R(a)

R(b)(a)

R(:)

At Power

• Detectio'n Reactor Building Loop 2 Notes to lines 8a. through 8d. above only:

./

(a) The calibrat' ion / test consists of verifying the rate of rise setpoint and checking for opens and shorts in the sensor cable.

(b) The clock in the SLRDIS CPU is checked against a known time standard.

(c) The logic shall be tested through tfe SLRDIS up to the existing PPS inclusive ef,the valve actuatfoq logic.

R - At least once per Refueling cycle, not to exceed 18 months.

Applicable only aboer 2% RATED THERMAL POWER.

4

.e 4

,Y t

e t

.., d, c. _ e.

I i

1 9

ATTACHMENT 3 SIGNIFICANT HAZARDS CONSIDERATION

SIGNIFICANT HAZARDS CONSIDERATION I. EVALUATION Based upor PSC Safety Analysis Report (EE-EQ-0014), Steam Line Rupture Detection / Isolation System (SLRDIS), it is concluded that the SLRDIS is capable of performing its intended function to detect and isolate major secondary coolant line ruptures of high energy steam pipe lines of the secondary cooling system without operator intervention.

The resulting harsh environments from a SLRDIS terminated leak are less severe than the harsh environment previously established on the basis of the operator manually terminating the leak at 4 minutes.

These operator terminated leaks previously established the harsh environments used for Fort St. Vrain equipment qualification.

The SLRDIS replaces the existing steam pipe rupture detection system. SLRDIS is designed to detect steam leaks in either the reactor or turbine buildings and isolate those leaks to preserve or maintain an environment in which electrical equipment is qualified.

This change in steam leak detection and automatic action provides more inclusive coverage of potential steam leaks and results in no change in the radiological consequences.

For certain steam leaks, the SLRDIS Syctem has a slower response than the existing system, but analysis demonstrates that equipment qualification is maintained.

Thus, the existing steam pipe rupture detection system will no longer be required.

Mpnual operator intervention for isolating HELBs in the feedwater, condensate and extraction steam systems and those line breaks not isolated by SLRDIS is adequate to assure that the resulting temperature profiles are enveloped by that to which the equipment will be qualified.

1.

Consequences of other accidents analyzed in the FSAR were examined for adverse impact as a result of the installation of the SLRDIS. Design Basis Accident No. 2,

" Rapid Depressurization/ Blowdown Accident",

was determined to have one assumption invalidated in that the SLRDIS could prevent initiation of forced circulation cooling at 5 minutes into the accident.

Reanalysis of the accident determined that forced circulation cooling could be delayed for at least 60 minutes without exceeding the conservative FSAR temperature for onset of fuel particle failure of 2900 degrees F, a temperature well below that at which rapid fuel deterioration is expected to occur.

This is more than ample time for the cperator to restore forced circulation cooling.

_ 2.

The potential for the SLRDIS to create new or different types of accidents not previously analyzed was examined.

The conclusion was that SLRDIS actuation initiated by a high energy line break, fires or primary coolant leaks may result in an interruption of forced circulation cooling.

It was further concluded that sufficient information is currently available in conjunction with new information available from the SLRDIS for the operator to properly diagnose and recover from the event by re-establishing forced circulation cooling within 60 minutes.

The 60 minute forced circulation recovery is the most limiting recovery time and is associated with DBA-2.

For all other accidents, 90 minutes is adequate time to restore forced circulation cooling prior to reaching 2900 degrees F.

Surveillance testing or faults associated with a single panel of the SLRDIS will not cause SLRDIS actuation.

3.

A review was conducted to determined if any margins of safety defined in the basis for a Technical Specification or in the FSAR were significantly decreased.

It was concluded that the SLRDIS isolating the secondary coolant system only causes a temporary interruption of forced circulation cooling in both loops. A recovery methodology exists and a recovery procedure will be developed to reestablish forced circulation cooling within the most limiting time associated with the DBA-2 accident - 60 minutes. Thus, it is concluded that the margin of safety is not significantly reduced.

II. CONCLUSION Based on the above evaluation, it is concluded that operation of Fort St. Vrain in accordance with the proposed char.ges will not (1) involve a s.ignificant increase in the probability or consequences of an accident previously evaluated, (2) create the possibility of a new or different kind of accident from any accident previously evaluated, or (3) involve a significant reduction in any margin of safety.

Therefore, this change will not create an undue risk to the health and safety of the public nor does it involve any significant hazards consideration.

4

ATTACHMENT 4 ANALYSIS VALUE DISCUSSION

ANALYSIS VALUE FUNCTION: Circulator Trip FUNCTION UNIT: Steam Line Rupture Detection / Isolation System (SLRDIS)

ANALYSIS VALUE: Less than or equal to 55 Degrees F:hrenheit per Minute Rate-of-Rise for Trip Less than or equal to 135 Degrees Fahrenheit for Alarm PRESENT TECH SPEC TRIP SETTING:

Currently not contained in the Technical Specifications. This is a new system for compliance with environmental qualification of electrical equipment as required by 10CFR50.49.

LICENSING BASIS:

The original commitment for environmental qualification of electrical equipment at Fort St. Vrain was made in response to AEC question 6.1 in 1971.

Initial approval of environmental qualification activities can be inferred from the

' issuance of an operating license in 1973 and subsequent additional environmental qualification work performed and approved by the NRC in License Amendment No. 18 dated 10-28-77. However, new requirements were issued by NRC for environmental qualification of electrical equipment starting in 1979.

Specifically, these are IE Bulletin 79.01B, 00R Guidelines, NUREG-0588 and finally 10CFR50.49. These new requirements and their interpretation have imposed requirements on the environmental qualification program not contained in the prior 1979 Fort St. Vrain environmental qualification program. These new requirements are (1) no operator intervention by the performance of manual actions for at least the first 10 minutes, (2) consideration of normal thermal aging prior to the accidental harsh environment, and (3) consideration of operability time over the total duration of the accident. SLRDIS is being installed to assure compliance with these new regulatory requirements.

The fixed temperature alarm function assures the operators are informed of harsh environments originating from pipe breaks of insufficient size to reach the SLRDIS rate-of-rise trip setpoint. )

SAFETY LIMIT:

None. The specific requirement is that the building bulk temperature-time histories satisfy those temperature-time histories utilized in the qualification test of equipment including consideration for aging and operability time.

LIMITING INITIATING EVENT: Full offset ruptures of either loop hot reheat steam piping in the Reactor Building or main hot reheat steam piping in the Turbine Building produce the highest air temperatures in these buildings. These peak bulk building temperatures are 371 degrees Fahrenheit for the Reactor Building and 360 degrees Fahrenheit for the Turbine Building (Ref. GA Document No. 908430 NC "FSV Buildin

Response

Analysis with Variable Heat Transfer Coefficients")g The above temperatures are based upon detection and isolation initiation by SLRDIS at 55 degrees Fahrenheit per minute building temperature bulk temperature rate-of-rise.

TRANSIENT OVERSHOOT:

Transient overshoot will be dependent on the magnitude of the break and the energy of the contained fluid.

For example, a complete offset rupture of a hot reheat steam pipe in either the Turbine Building or Reactor Building will produce building bulk temperature-rate-of-rise ramps in the first 8 seconds between 900 to over 3000 degrees F/ min. The corresponding temperature ramp as detected by the sensor will exceed 300 degrees F/ min which is well in excess of the 55 degrees F/ min. selected trip setpoint.

See

" Discussion" for further information on types of high energy lines and break sizes which SLRDIS is intended to detect and automatically initiate isolation.

TRANSIENT TIME RESPONSE:

The SLRDIS rate-of-rise calculates each alarm temperature within a 1.7 second time period and then compares this to the rate-of-rise calculated 3.4 seconds before. This allows a time confirmation by spacing the confirming signals 3.4 seconds apart.

Detection will then take place at the 5.1 second mark if all three previous time intervals confirm the rate-of-rise.

An additional 2 seconds then is required before signals are sent to close the isolation valves.

Valve closure time would be in addition to the total 7.1 seconds.

PROCESS MEASUREMENT ACCURACY: Not applicable.

DISCUSSION:

The purpose of the Steam Line Rupture Detection / Isolation System is to detect and automatically isolate selected high energy line breaks in the secondary coolant system in both the Reactor and Turbine Buildings. Leak detection results in alarms and automatic isolation of the high energy steam pipe lines of.

i l

1 the secondary coolant system, thereby limiting the steam release into the buildings.

This assures that resulting building harsh environments without any credit for operator action are much less severe than those harsh environments previously established and accepted based upon operator termination of the leak at 4 minutes.

Detection of a high energy line break (HELB) is assured by continuous monitoring of area average temperatures in both the Reactor and Turbine Buildings.

Detection of a harsh temperature environment resulting from a high energy line break is accomplished by continuous monitoring of bulk average building temperatures in both the Reactor and Turbine Buildings. The SLRDIS has two detection racks located in the Control Room.

Each detection rack receives input from four temperature sensing cables in the Reactor Building and four temperature sensing cables in the Turbine Building.

The four temperature sensors in either building associated with one of the two detection racks are combined in a two-out-of-four trip logic. The detection racks process the incoming temperature signals to determine the temperature rate-of-rise for each channel (one channel per temperature sensing cable).

Initiation of a SLRDIS acutation occurs when two-out-of-four sensors (in each set of sensors in one building) exceed the high temperature rate-of-rise trip setpoint which cuases a logic trip signal. The trip signal from either redundant Logic A or Logic B from one detection rack is then "and" gated, utilizing relay logic, with the similar Logic A or Logic B trip signal from the second Detection Rack. Satisfying the 'and" relay logic requirements results in a final output trip signal to the PPS. This overall logic design results in a one-out-of-two taken twice type trip logic.

A trip signal from a single SLRDIS Detection Rack only results in an alarm annunciation in the Control Room. A fixed temperature alarm will occur on a single sensor reaching the alarm trip setpoint.

SLRDIS will detect and automatically isolate secondary coolant flow in the event of a rupture in the high energy steam pipe lines (main steam, cold reheat, hot reheat, and auxiliary steam).

SLRDIS is not designed to isolate feedwater, condensate, and extraction steam leaks nor the high energy steam line breaks which are less than the equivalent of 2 percent of a full offset rupture.

In these latter cases, the fixed temperature alarm will alert the operators of a harsh environment condition. Operator manual isolation of the leak is assumed to be completed 12 minutes after receipt of the alarm.

Each thermistor cable independently acts as a zone temperature sensor and provides a resistive signal that decreases exponentially with increasing temperature. B M h ends of each sensor cable are connected to the associated Temperature Monitor in a " loop" configuration.

A. _.

break in a sensor cable will not negate the capability for a valid high temperature signal from being produced by the remaining ends.

The sensor break itself actuates a Trouble Alarm.

The alarm contacts are connected to a Control Room anunciator window on control board I-05 that reads:

" Steam Line Rupture Detection Panel - Acknowledge". Appropriate "reflash" provisions exist so that subsequent valid alarms are presented to the Control Room operator.

The temperature from each sensor channel can be read out on the steam line rupture detection rack located in the Control Room.

The automatic isolation feature of the SLRDIS is provided by redundant microprocessor-based logic in each of the two detection racks.

Each cable monitor, upon actuation of the rate-of-rise alarm / trip, transfers this information through optical isolators to the two redundant (Logic A and Logic B) microprocessors.

Each microprocessor combines the four cable alarms from any single zone into a two-out-of-four logic trip signal. Upon SLRDIS actuation, the trip logic scheme provides isolated relay contacts to the existing secondary coolant isolation valve circuits.

The system employs " transmission logic" in that it takes power to cause an isolation signal.

This is consistent with the use of

" transmission logic" in the existing PPS Loop Shutdown and Circulator Trip Logic.

ATTACHMENT 5 STEAM LINE RUPTURE DETECTION / ISOLATION SYSTEM SAFETY ANALYSIS REPORT i

._.