ML20198P051
| ML20198P051 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 05/27/1986 |
| From: | Holmes M, Johns J PUBLIC SERVICE CO. OF COLORADO |
| To: | |
| Shared Package | |
| ML20198N945 | List: |
| References | |
| EE-EQ-0014, EE-EQ-14, TAC-60421, NUDOCS 8606060227 | |
| Download: ML20198P051 (49) | |
Text
{{#Wiki_filter:1 EE-EQ-0014 ISSUE G i . SAFETY ANALYSIS REPORT STEAM LINE RUPTURE DETECTION / ISOLATION SYSTEM FORT ST. VRAIN NUCLEAR GEhERATING STATION 3 DOCKET 50-267 PUBLIC SERVICE COMPANY OF COLORADO Prepared by: Nuclear Licensing Department Nuclear Licensing and Fuels Division 4 Public Service Company of Colorado
- May 27, 1986 Approvals:
Su~pervisor, Nuclear Licensing - Engineering h psb hm Nuclear Licensing Manager 4 PDR
TABLE OF CONTENTS PAGE 1.0
SUMMARY
...................................................... 1
2.0 BACKGROUND
.................................................... 1 2.1 Purpose.................................................. 1 2.2 System Description ...................................... 2 2.3 System Criteria.......................................... 11 2.3.1 De s i g n Cr i te ri a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.3.2 Environmental Qualification ...................... 12 2.3.3 Seismic Qualification ............................ 12 2.4 Instrumentation Performance.............................. 12 2.5 Component Characteristics................................ 12 2.5.1 Sensors .......................................... 12 2.5.2 Temperature Monitors.............................. 13 2.5.3 Controllers ...................................... 14 2.6 Instrument Rack.......................................... 14 , 2.7 Tempe ra tu re P ro fi l e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.7.1 Postulated Pipe Rupture Scenarios ................ 16 2.7.2 Manually Isolated Leaks .......................... 17 2.8 Results of the 10CFR50.59 Safety Evaluation of SLRDIS.... 23 3 . 0 S A FETY ANAL Y S I S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 6 3.1 Instrumentation Design Bases ............................ 26 3.2 Systems Interaction...................................... 28 3.2.1 High Energy Line Breaks .......................... 28 3.2.2 Maximum Credible Accident ........................ 29 3.2.3 Design Basis Accident No. 2 ...................... 30 3.2.4 Fires ............................................ 31 3.2.5 Inadvertent Trips ................................ 31 3.2.6 Water and Steam Hammer Ef fects . . . . . . . . . . . . . . . . . . . . 42 4.0 SIGNIFICANT HAZARDS CONSIDERATION (10CFR50.92)................ 46
SAFETY ANALYSIS REPORT FORT ST. VRAIN STEAM LINE RUPTURE DETECTION / ISOLATION SYSTEM 1.0
SUMMARY
Public Service Company of Colorado (PSC) has connitted to install a Steam Line Rupture Detection / Isolation System (SLRDIS) for the purpose of automatic isolation of selected high energy steam pipe line breaks in the secondary coolant system. Rapid isolation of a postulated pipe rupture will limit the harsh environment for safety related electrical equipment to an acceptable level for its qualification per 10CFR50.49. In accordance with 10CFR50.59, PSC has determined (see Section . 2.8 for additional detail) that the installation and design function of the Steam Line Rupture Detection / Isolation System constitutes an unreviewed safety question because: (1) It increases the probability of occurrence of an interruption of forced circulation cooling with the consequences bounded by the 90 minute interruption of forced circulation cooling previously, analyzed in the FSAR. ~ (2) It reduces that margin of safety for assuring continued forced circulation cooling as defined in the basis for Technical Specification LC0 4.4.1 Plant Protective System Instrumentation. In accordance with 10CFR50.92, PSC has also determined (see Section 4.0) that the installation and design function of SLRDIS does not involve any significant hazards consideration in the operation of the facility.
2.0 BACKGROUND
2.1 Purpose The purpose of the Steam Line Rupture Detection / Isolation System is to detect and automatically isolate selected high energy line breaks in the secondary coolant system in both the Reactor and Turbine Buildings. The selected high energy lines are those whose rupture may render safety related electrical equipment inoperable before operator isolation due to exceeding design l
- temperature and/or humidity parameters. Leak detection results in alarms and automatic isolation of the selected high energy steam pipe lines of the secondary coolant system, thereby limiting the steam release into the buildings. This assures that the resulting building harsh environments, without any credit for operator action, are much less severe than those harsh environments previously established and accepted by the NRC based upon operator termination of the leak at 4 minutes.
2.2 System Description
Detection of a harsh temperature environment resulting from a high energy line break is accomplished by continuous monitoring of bulk average building temperatures in both the Reactor and Turbine Buildings. The SLRDIS has two Detection Racks located in the Control Room. Each Detection Rack receives input from four temperature sensing cables in the Reactor Building and four temperature sensing cables in the Turbine Building. The four temperature sensors in either building associated with one of the two Detection Racks are combined in a two-out-of-four trip logic. The Detection Racks process the incoming temperature signals to determine the temperature rate-of-rise for each channel (one channel per temperature sensing cable). The SLRDIS rate-of-rise calculation is made from each alarm temperature within a 1.7 second time period and then is compared to the rate-of-rise calculated 3.4 seconds before. This allows a true confirmation by spacing the confirming signals 3.4 seconds apart. Detection will then take place at the 5.1 second mark if all three previous time intervals confinn the rate-of-rise. An additional 2 seconds then is required before signals are sent to initiate isolation. Valve closure time would be in addition to the total 7.1 seconds. Initiation of a SLRDIS actuation occurs when two-out-of-four sensors (in each set of sensors in one building) exceed the high temperature rate-of-rise trip setpoint which causes a logic trip signal. The trip signal from either redundant Logic A or Logic B from one Detection Rack is then "and" gated, utiliiTng relay logic, with the similar Logic A or Logic B trip signal from the second Detection Rack. SatisTying the "and" relay trip logic requirements results in a final output trip sicnal to the PPS. This overall logic design results in a one-out-of-two taken twice type trip logic. A trip signal from a single SLRDIS Detection Rack only results in an alarm annunciation in the Control Room. 1 A fixed temperature alarm will occur on~a single sensor reaching the alarm trip setpoint. SLRDIS will detect and automatically isolate secondary coolant flow in the event of a rupture in the
high energy steam pipe lines (main steam, cold reheat, hot reheat, and auxiliary steam). SLRDIS is not designed to isolate feedwater, condensate, and extraction steam leaks nor the high energy steam line breaks which are less than the equivalent of 2% of a full offset rupture. In these latter cases, the fixed temperature alarm will alert the operators of a harsh environment condition. Operator manual isolation of the leak is assumed to begin 10 minutes after receipt of the alarm and allowing one minute per operator action. The sensor cable general locations are shown in Sketch 1. A logic diagram of the SLRDIS/PPS relationship is given on Figure . 1. Each thermistor cable independently acts as a zone temperature sensor and provides a resistive signal that decreases exponentially with increasing temperature. The input signal to the Detection Rack is based on a resistive signal determined by the length of the sensor cable reaching high temperature. Each set of the four signals are routed independently to channel Temperature Monitors of their dedicated Detection Rack such that each zone's "A" cable is input to the respective "A" Temperature Monitor, and so on for Cables B, C, and D as shown in Figure 1. Both ends of each sensor cable are connected to the associated Temperature Monitor in a " loop" configuration. A break in a sensor cable will not negate the capability for a valid high temperature signal from being produced by the remaining ends. The sensor break itself actuates a Trouble Alarm. The Temperature Monitors are capable of sensing the resistive signal from each cable and processing the input signals to determine temperature rate-of-rise. Each Temperature Monitor independently annunciates the following preset alarms: Low level pre-trip alarm (adjustable between 110F and 320F) Trouble alarm (for short or open circuit conditions) Rate-of-Rise Alarm and trip (adjustable between 20 F/ minute and 160 F/ minute.) The alarm contacts are connected to a Control Room annunciator window on control board I-05. Appropriate "reflash" provisions exist so that subsequent valid alarms are presented to the Control Room operator. The temperature from each sensor channel can be read out on one of the two steam line rupture Detection Racks located in the Control Room. The automatic isolation feature of the SLRDIS is provided by redundant microprocessor-based logic in each of the two Detection Racks. Each temperature monitor, upon actuation of the rate-of-rise alarm / trip for a channel, transfers this information through optical isolators to the two redundant (Logic A and Logic B) microprocessors. Each microprocessor combines the four cable alarms from any single zone into a two-out-of-four logic trip signal. Upon actuation, the trip logic scheme provides isolated relay contacts to the existing secondary coolant isolation valve ' circuits. The interface of this system with the existing valve controls and .the plant protective system (PPS) is such that it overrides other commands and does not preclude any prior manual or automatic isolation from occurring. A simplified diagram showing the PPS interface is shown in Figure 2. The SLRDIS provides a trip signal into the circulator trip logic of the PPS to each of the four circulators. The SLRDIS also provides a trip signal into additional valve actuation logic modules within PPS to initiate valve closures. Detection Racks I-93543 and I-93544 govern the tripping of the helium circulators and closure of the isolation valves for Loop 1 and Loop 2 as depicted on Table 1. In addition, the interface is such that an inhibit signal is input into the auto-start logic of the water turbine drives. These combined actions result in the trip of both loops and subsequent reactor scram on "two loop trouble." A Logic A or Logic B trip signal from one Detection Rack (I-93543 or I-93544T provides only one of the two required trip signals to the final output relay trip logic. A similar trip signal from Logic A or Logic B of the second Detection Rack (I-93544 or I-93543) REist also be present to satisfy the final output 7elay trip logic to the PPS. This trip logic design will preclude the closure of isolation valves or the tripping of the circulators in a loop for a single SLRDIS Detection Rack actuation. The system employs " transmission logic" in that it takes power to cause an isolation signal. This is consistent with the use of
" transmission logic" in the existing PPS Loop Shutdown and Circulator Trip Logic. Instrument power is provided from non-interruptible instrument buses IA and 18 as shown in Figure 1.
, , . - - - - - - -- ,- r
Testing is facilitated in the two-out-of-four configuration by conversion to a two-out-of-three configuration during test of one sensing channel. The Temperature Monitors, logic and associated circuitry are mounted in the Steam Line Rupture Detection Racks located in the Control Room. Physical and electrical separation between is redundant portions maintained by appropriate 4 compartmentalization. The temperature sensing and ' trip signal functions are designed in accordance with single failure criteria and will initiate the valve closures shown in Table 1 within 2 seconds following the detection of a pipe rupture.
- . ,n, . - , . - n.. - - , , -, , - . . - - . , , . . , , . - - - -
Et ACTOR auk T g g,wg St g
- h. b l I l
- _- fl e t t /_
- f L e 9 2 4' (L e ges' C_ 496 /
fL esp
- fLeseW ttetsf
,gy, m et ... .' . TUR6tli 8btA
*L tL e e n, , taxe seew :As rs gT;g*gp< s taua at e. e .__J ggg gg7ygg,gggg
.coi-etc.ea was r-r gar.'-c* t t'-0 4 97534s tit -
E L * '* d jn ! FAA) TE'95N1 b' jjg> '. ' .' "...n W MJTE-""sj ', TI-9M*f CPNr) ' a >
*T E-SMu9 (atW fE 91141F'R) it-9sseum) re-9399 pAa)
TE*'M " ((- E' 8 ' *' fI 9pmFAA) TE-9399E re-9ttso tatAA) TI 15 39, 9,M35."y TE 959g6 DEA 80 TI 99965 it-949% w t'***d at a ++ r' ELEVATION LOOKING E AS1" f t 9998 TE 9M98 TE-93999
- 1 l-yg.9 5940 %l l . ; TE-95938 mie s.m m t
,tt- N ! I !
TE.-9 59 39 - _. (- TE 959% it 999E _e p l
"-'"? ! l
_._e l _l_ __. l_ e . . , _ wru.umm it *93953 _, --l - . _ _ ._ _ I i meru, sm
=
_ _L*:5. r !_ r _g tr4Mn 78 -'" 8 ' -" 1, an, zo.It I i _g _g it 93995 7 _-e ft-959 __e P O G G G O G GX9 @ M SKETCH 1 6 --
Figure 1 Steam Lins Ruptura D:tection Isolation Instrumentation REacron et.txi TURBlME BLDG. RE ACTOR GLOG. TURBlME BLDG Sgwa,ons.goug t SENsons Zontt SEMsom-Z0ME l tE%oM ZokEE
'MST INS". INST. INST BUSI BUS Z 0V51 8952 l
LOOPl g Loop i toopg t.00 P Z l l TEME TEMM TEMM q - - , _ TEMP TEMP
-- _ _ r -r TErdP r ---
TEMP q lTEMM li p.MowiTOR McNiT06 . + HOWITOR Mou? TOR D
*> l i>+MoutTDM McMiMR *
- MouiTOR MousToR +>
A a C A B C O l l l l l , I l l l l l I l l - j l l 1 - l l 111 li l j !!! , i l' l A B A S
- LOGIC LOGIC + + LOGIC LOGIC +
l (2 CUT O F aq) (g ggrop y) (E OUT OF (1.Ouf 0F 4) L_ _ _ _ _ _ _ _ . __ ___ a L._ _ __ _'t)_ _ _ __ _ _ __ J SLPDtS RA4K SLRDISRACK I-9354'5 1935W CR 93i308 LR 35the CR 95tt&A , , CR 93119A ,
,, CR 931315 CR*9 3tSM A , , , CR 99135A , ,,CA-95tS78 T T l l l l l [ [_l PPS e PPS PPS PPS LOGnc B LOGIC 8 LOGtc 8 logic a VALVE TRIP VALVE TRIP CIRC.TM lp CRC. T Rip LOOPl LOOP E LOOP l LOOP L T T T F
l I LJ __ __ r PP6 PPS PPS ppg LOGtC A LAGnC A LOGlc A LosiC A VALVE TRIP - VALVE TRn* CIRC. TRIP CIRC.TMtP LOOPI LOOP L LOOPl LOOP 1 l
FIGURE 2: SLRoiS AND APS RELATIONSHIP INPUTS FROM INPUTS FROM EXISTING SLRo S INSTRUMENTATION INSTRUMENTATION f A f A 000 0000
" " P 1rir,ry STEAM LINE CIRCULATOR guprygg Trip (ONE PER CIRCULATOR)
DETECTION LOGIC RACKS EXISTING PPS Logic A or_ B (I-9310) of I-93543 and VALVE Logic A or B ACTUATION LOGIC (NEW) ofI-935k yyy u o o t a t J EXISTING AODITIONAL OUTPUTS OUTPUTS l I l l
TABLE 1 TAG SLRDIS ACTUATION _ RESET NO. LOOP DESCRIPTION LOGIC METHOD (2 ) ACTION SV-2105 1 CIRC 1A SPEED CONT (1) LOOP 1 CT A&B (3)" SV-2106 2 CIRC IC SPEED CONT (1) LOOP 2 CT A&B SV-2109 1 CIRC 1A WATER TURB CONT (1) LOOP 1 CT A&B SV-2110 2 CIRC IC WATER TURB CONT I:1) LOOP 2 CT A&B SV-2111 1 CIRC 18 S"EED CONT il LOOP 1 CT A&B SV-2112 2 CIRC ID l'O J CONT I LOOP 2 CT A&B SV-2115 1 CIRC IB b.h.R TURB CONT I l LOOP 1 CT A&B SV-2116 2 CIRC 10 WATER TURB CONT I, LOOP 2 CT A&B HV-2109-1 1 CIRC 1A WATER TURB SUP LOOP 1 CT A&B (3) HV-2110-1 2 CIRC IC WATER TURB SUP LOOP 2 CT A&B HV-2115-1 1 CIRC IB WATER TURB SUP LOOP 1 CT A&B HV-2116-1 2 CIRC 10 WATER TURB SUP LOOP 2 CT A&B HV-2109-2 .1 CIRC IA WATER TURB DISCH I; LOOP 1 CT A&B (3) HV-2110-2 2 CIRC IC WATER TUR6 DISCH I, LOOP 2 CT A&B HV-2115-2 1 CIRC IB WATER TURB DISCH i
, LOOP 1 CT A&B HV-2116-2 2 CIRC ID WATER TURB DISCH I, LOOP 2 CT A&B HV-2201 1 FW INLET 1 LOOP 1 XCR (3)
HV-2202 2 FW INLET 1 LOOP 2 XCR FV-2205 1 FW CONTROL (1 LOOP 1 XCR '(3) FV-2206 2 FW CONTROL (1 LOOP 2 XCR HV-2203 1 EMER FW INLET (1) LOOP 1 XCR (3) HV-2204 2 EMER FW INLET (1) LOOP 2 XCR HV-2223 1 SHT STM STOP CHECK (1) LOOP 1 CT A&B (3)" HV-2224 2 SHT STM STOP CHECK (1) LOOP 2 CT A&B PV-2229 1 SHT STM BYPASS (1) LOOP 1 XCR (4) PV-2230 2 SHT STM BYPASS (1) LOOP 2 XCR (5 ) HV-2292 2 SHT STM STARTUP BYPASS (1 LOOP 2 XCR (5) HV-2293 1 SHT STM STARTUP BYPASS (1)) LOOP 1 XCR ( 4) HV-2241 1 RHT STM BYPASS (1) LOOP 1 XCR (4 HV-2242 2 RHT STM BYPASS (1) LOOP 2 XCR ( 5)) PV-2243 1 RHT STM BYP PRESS RATIO (1) LOOP 1 XCR (4) CONT PV-2244 2 RHT STM BYP PRESS RATIO (1) LOOP 2 XCR (5) CONT
S TABLE 1 (CONTINUED) TAG SLRDIS ACTUATION RESET
- NO. LOOP DESCRIPTION LOGIC METHOD (2 ) ACTION HV-2249 1 CIRC 1A TURB TRIP LOOP 1 CT HV-2250 2 (3)
CIRC IC TURB TRIP LOOP 2 CT
- HV-2251 1 CIRC 18 TURB TRIP LOOP 1 CT "
HV-2252 2 CIRC 10 TURB TRIP LOOP 2 CT " HV-2253 1 RHT STOP-CHECK (1) LOOP 1 XCR (4) HV-2254 2 RHT STOP-CHECK (1) LOOP 2 XCR (5) PCV-5201 - AUX STM TO 150 PSIG HOR (1) LOOP 2 XCR (7) PCV-5213 - AUX STM TO CRH (1) LOOP 1 XCR (6) PCV-5214 CRH TO 150 PSIG HDR LOOP 1 XCR ) PCV-5214 CRH TO 150 PSIG HDR LOOP 1 XCR ) PCV-5214 CRH TO 150 PSIG HOR LOOP 2 XCR ) PCV-5305 - 150 PSIG HDR TO DA (1) LOOP 2 XCR (7) 4 i (1) Panel I-93543 Logic A o_r,B r and Panel 1-93544 Logic A y B. (2) XCR indicates valve is actuated thru an XCR Hodule in PPS. ] CT indicates valve is actuated thru Circulator Trip Logic portion of PPS. l (3) Requires:
- a. Return of temperature rate of rise to below setpoint
! b. Reset of microprocessor at monitoring and control rack I-93543 (Loop 1) i' or I-93544 (Loop 2)
- c. Reset via existing methods to recover from Circulator Trip (or other existing logic in PPS) l ( 4) Requires:
- a. Return of temperature rate of rise to below setpoint
- b. Reset of microprocessor at monitoring and control rack I-93543 (Loop 1)
- c. Reset of XCR'svia HS-93375A and HS-933758 for Loop 1 valves on main control board (I-05).
(5) Requires:
- a. Return of temperature rate of rise to below setpoint
- b. Reset microorocessor at monitoring and control rack I-93544 (Loop 2)
- c. Reset of XCR's via HS-93376A and HS-933768 for Loop 2 valves on main control board (I-05)
(6) Requires *
- a. Return of temperature rate of rise to below setpoint l
- b. Reset of microprocessor at monitoring and control rack 1-93543 (Loop 1) '
- c. Reset of XCR's via HS-93377A and HS-933778 for Loop comon valves on main control board (I-06)
(7) Requires:
- a. Return of temperature rate of rise to below setpoint
, b. Reset of microprocessor at monitoring and control rack I-93544 (Loop 2) i
- c. Reset of XCR's via HS-93378A and HS-933788 for Loop comon valves
- on main control board (I-06)
~
i j
-r,, , - - , . - - . - . - , - - , - _ - , , , - - . _ _ - , - - _ - - _ , , - _ , . . , , - - . . n--_.,.._- _--_-.,----,--,_..,,--__,n,__~. . - _ .
2.3 System Criteria , 2.3.1 Design Standards The sensor and signal processing system meets the following design standards: Institute of Electrical and Electronic Engineers Short Name as Date of Identification Used Herein Issue of the Document IEEE-279 1971 Criteria for Protection Systems for Nuclear Fower Generating Stations IEEE-308 1974 Criteria for Class IE Power Systems for Nuclear Power Generating Stations IEEE-323 1974 Qualifying Class 1E Equipment for Nuclear Power Generating Stations IEEE-338 1975 Standard Criteria for Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection System IEEE-344 1975 Recommended Practices for Seismic Qualification of Class IE Equip-ment Nuclear Power Generating Stations IEEE-379 1977 Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Class 1E Systems IEEE-384 1977 Standard Criteria for Independence of Class 1E Equipment and Circuits The interface with the existing PPS and valving is comensurate with the existing plant design standards. j 2.3.2 Environmental Qualification The instrumentation provided to accomplish the detection and provide the isolation signal is environmentally qualified to IEEE-323. Service conditions appropriate for the instrumentation locations have been used. 2.3.3 Seismic Qualification
- The instrumentation provided to accomolish the isolation is seismically qualified to IEEE-344 to withstand both the Design Basis Earthquake (DBE) and the Operating Basis Earthquake (0BE). Response spectra appropriate for the instrumentation locations have been used. Acceptance criteria include no loss
- of function or improper safety action during or after the seismic event.
2.4 Instrumentation Performance Instrumentation Range: Fixed Temperature Range - 110F to 320F Rate-of-Rise Range - 20F/ Min to 160F/ Min System accuracy (including sensor): 13% Sensor accuracy: 11% System response time to trip: 2 seconds subsequent to satisfying the temperature rate-of-rise trip signal over three consecutive 1.7 second sampling intervals. ! 2.5 Component Characteristics i , . 2.5.1 Sensors Type: Thermistor cable (Lengths of 200 feet). Cable Assembly: 0.09" diameter stainless steel jacket (0.016" thickness), thermistor (powder ceramic) core, 20 AWG nickel center conductor. Both ends of the stainless steel jacket are sealed to prevent entry of moisture. l 4 1
v
Enclosure:
Contains Raychem environmentally qualified splices. 2.5.2 Temperature Monitors Type: Solid state thermistor cable Temperature Monitor. Each monitor accepts up to 7 thermistor cable inputs (2 operational and
; 5 spare).
1 Characteristics: Temperature Monitors are designed to convert a resistance value from a - - thermistor, compute rate-of-rise of input signal, and initiate logic output into the 2-out-of-4 logic matrix when the measured rate-of-rise exceeds the trip setpoint.
! The monitors are dual adjustable setpoint i units for high temperature (pre-alarm and l ala rm/ trip) .
Overall accuracy (including sensor): +3%. i l Repeatability: +1%. 1 Monitors are furnished with open circuit
! supervision and short circuit discrimination.
4 Monitors include " cable test" circuitry. I Local Control Individual windows for each thermistor Board cable input are provided.
- Annunciation
- a. Low level pre-trip alarm (adjustable between 110F and 320F).
- b. Trouble - short or open circuit.
- c. Rate-of-Rise alarm and trip
- (adjustable between 20F/ min and 160F/ min) i e
1
All annunciation windows have reflash capability, with silence-acknowledge-test buttons. Spares are provided for at least 5 more cables per Temperature Monitor. Output: Appropriate optically isolated outputs to the logic A and logic B microprocessor logic controllers are processed. Dry relay contacts, for use in Control Room alarms that combines annunciation points from all cables are utilized. An RS232 port for future use in data logger monitoring is provided. 2.5.3 Controllers Type: Microprocessor based. Programmed to trip on 2-out-of-4 transmission logic (energize to actuate) from either temperature zone. Capable of tripping on 2-out-of-3 logic in a single zone when one cable in the zone is in the test mode. Loss of an instrument bus still maintains redundant trip logic availability. Output: Relay contacts for use in output valve* control. Failure / cable test alarm contacts for use in Control Room alarm. 2.6 Instrument Rack Type: Free standing rack, for mounting on a concrete floor. l Seismically qualified per IEEE-344, ! including contents. Rack Contents: All necessary temperature monitors, controllers, output relays, controls and displays. J
/
. Electrical Rack, including input / output cabling wire-
. Separation: ways, is compartmentalized to provide for electrical separation and isolation between divisions per IEEE-384.
i i
/
{ o I 1 l 1 .i i I r I 0
\
, - , - , . - . . . , _ , _ . . . _ , . ~ . , . . '. . . , , . , . ,
2.7 Temperature Profiles 2.7.1 Postulated Pipe Rupture Scenarios Postulated HELBs from 2% of offset rupture to full offset rupture flows were analyzed for temination by SLRDIS (see Figure 3). These analyses were performed using the following criteria:
- Identify and terminate those secondary coolant pipe ruptures which must be automatically isolated to protect the Safe Shutdown electrical equipment.
- Impose those single active failures which are considered to have the most deleterious impact upon each pipe rupture accident. Failures of simple check valves and the check valve portion of stop check valves are considered passive failures.
- Apply existing plant protection and control system actions, with the exception that no credit has been taken for actions of the existing Steam Pipe Rupture Detection System, whose PF5 trip functions are being deleted.
- Apply the temperature sensing Steam Line Rupture Detection / Isolation System to be installed in both the Reactor and Turbine Buildings, which will initiate the actions listed in Section 2.2. The temperature sensing and trip signal functions are designed in accordance with the FSV single failure criteria, and will initiate the action within 2 seconds of the setpoint being reached. A rupture air velocity of 5 feet per second is conservatively assumed.
Input a Reactor Scram for all automatically isolated pipe ruptures.
- No operator action taken within the first 10 minutes.
- Auxiliary boilers are never in service above 65% reactor power.
Components which are environmentally qualified can be assumed to function correctly unless they are the object of a single active failure.
- Components which are not environmentally qualified can be assumed to function correctly, provided that they perform their function before being exposed to a harsh environment and are not the object of a single active failure. It is not necessary to assume structural failure of such '
components, unless they are the object of an imposed rupture accident. The resultant pipe rupture mass / energy releases were determined using the FLASH /GA computer code. Conservative estimates of the timing of protection system actions and mitigating control , system actions were assumed, based upon the anticipated system - response from system transient analyses in Design Criteria DC-5-2, the FSAR, and on engineering judgement. Building heatup and temperature response was determined by the CONTEMPT-G computer code using the FLASH /GA release rates. The resultant temperature profiles for the accident scenarios either isolated by SLRDIS or manually isolated following receipt of a SL RDIS pre-trip temperature alarm were used to produce composite temperature profile curves shown in Figures 4 and 5 and depicted in Table 2 for the Reactor and Turbine Buildings, respectively. These profiles are- based upon setpoint analysis values of 55 degrees F per minute (rate-of-rise) and 135 degrees F (pre-trip alarm). The results indicate peak bulk building temperatures of 371 degrees F and 3c0 degrees F are reached for the Reactor and Turbine Buildings, respectively. 2.7.2 Manually Isolated Leaks Those postulated pipe ruptures which are not isolated by SLRDIS were analyzed to demonstrate that these HELBs can be adequately isolated by the operator (see Figures 4 and 5). The analyses were based upon the following criteria: No operator action taken until time 10 minutes following ' actuation of the SLRDIS low level pre-trip alarm. 1 minute per each operator action thereafter from the 'v Control Room. , f All instrumentation the operator must relay r,n to provide indication of the pipe rupture (assuming.a single failure) s
?
l
* .S a ,
,- . w , -- --- - - - , , - -,-r' s sw
will either be environmentally qualified if they are exposed to the harsh environment or located in a mild environment.
- Impose those single active failures which are considered to have the most deleterious impact upon each pipe rupture accident.
Those HELB pipe ruptures which may affect redundant equipment but neither trip SLRDIS nor actuate the 1.ow level pre-trip alarm will be detected by the operators and isolatea by l operator action at one hour. - 9 i f l 5 ? I
.1 i
i ? a
-,, L- , . ,, , , -- . - . - . . . .. . , . - _ , . . , , . . - -
is i II ,i .
! !!!!! I ! !; ! ! ! E i!!u, rir s'!
lierisi i t !I!? 11 'I !iil
!,. ii l!!l3"ii'l!l"!!!!!I!'! -
l s ji i -! :'rei ! I e 2,3hiiaesirtsgr.yr!I%l$!!s!'a-i*!iz,Juj,r:16!!!,!;l'!8
.i r ;
i
-sa- irir i= fi 5 id!!!! 5!!E i!iIIIllI!!!NI;4 !! !! g giliie ll! .1::g[ri:gr: Iii !;!!!!!.
> i i z 1!!ir sis'!rsiissrisiis!Is! ti .:#= !ri su!Iil-!!!!.i!!
! fi!.l2 3 t taiif i 2:=rs eeeeee eeeeee e e e e e eeo eeeeee oee e e 5
I if i i ! 8- !.I 5=i
. , sE 1 si g 5 2 .'s 3 ! !. !. ,r *e is e =
- t3:v5A !:. s!Jes'[hI f
e ,le1=8:i. .r-a
.. a " ' I f a~ = s
=== ..:dem. .
***44si12"- ,o L, W*
$3 v
3! L 2 a 7 3- .y e
= , , -
=
t y z l I o/ II - o y 0 es e _ L. g g gl a yo fg e\s be e4: .- 1
" " w, z
- c. ;
y
, ,sg
- s. .si m p
II 1
.y. !
I w_ e e e. _ -
~
5
$m 5 0 0 : 0 - *
't
. _ v e a e 1 :s o _Hil "l l :@P.L .= C M 2
1 _@ _ p " gP 9V -- C=
-g; { gi
- i ;
ge g O y ###8 l in ye o _Nj l e do d - - gO e - r All 3xu V g g, d V "- _ U' U" g 1-es " m
= ,si r * . _
2 y
=s. i 8 o! e
\\ i , $ ,;___ ____: "
n
'l lil' , a, r-- y
. ___s_____ .,,
s e ai .
-rc - i s , _.
m, o o e o c
~ ~
[. ,_ 'l " N l _.
.. ___8____ '
li gc e e e m l - 19 d
FIGURE 4 COMPOSITE SUNNARY OF LARGE AtID SMALL LEAKS ALARNED OR DETECTED BY REACTOR BUILDIllG SLRDIS T 400 E - SCEHARIO N _ P HRH-2 j*,*,,_' " i g'*h" " y 300- ~
. '\ , nS-3 l-A -
Calf-19 p,44,g\ g _ , ,- -
,p9' f
\ ' \, ~~ mi-i ~~
0 8 \ i S 200 - l
- i
/ - CRil-12
,o P -
g, /
's . i .3 gg,,_4 H
\"e\N f15-14F
' ~
E
,p ~ / '- ^
g Q, .=., ;g y's=.5- - ns-A E
- ~
..y CRil-16 100_ _
CRil-14F CRil-19 D - NS-14F E _ G , CRil-14F F 0- i i i iiin i i i iini i i iisin i isinn i isiini 10
-3 10
-2 ~I 2 10 i 10 10 TIME - MINUTES
p:IG U R E 5 COMPOSITE
SUMMARY
OF LARGE AND SMALL LEAKS ALARMED OR DETECTED BY TURBINE BUILDING SLRDIS T 400 E - SCENARIO M _ p HRH-1 MS-1 h300-- cag_g A T -
I
-3 g -
/ y CRH-11 0 /
I z. S 200 a - As-1 g3 S P - e"I / I ..
- his_3~
H _ /
! \ \ ,
, E s' \ ., &-_-L. ..;~. cRH-15 i
[b ',.,C Q$- F.-Ih.s
'd h, % ---- A ;
'.- TRF235-
_ 100 - , - i D - ! E _ G _ F 0- i iium iiium a iium i iiimi i iinm i s inm iiium ! 10
-4 10
-3 19
-2 ig -1 2 1g 3 1 10 10 TIME - MINUTES 4
TABLE 2 Sumary of Results and Composite Profiles for Turbine and Reactor Buildings Blowdown Scenario Pipe Ruoture Building Rate Teminatien HRH-1 Hot Reheat Turbine 100% SLRDIS M3 1 Main Steam Turbine 100% SLRDIS CRH-9 Cold Reheat Turbine 100% SLRDIS FW-3 Feedwater Turbine 100% Manual ** CRH-11 Cold Reheat Turbine 100% SLRDIS AS,1 Aux. Boiler Stm. Turbine 100% Manual
- HRH-3 Hot Reheat Turbine 25% SLRDIS CRH-15 Cold Reheat Turbine 25% SLRDIS CRH-13G Cold Reheat Turbine 1% Manual
- PRH-2 Hot Reheat Reactor 100% SLRDIS MS-2 Main Steam Reactor 100% SLRDIS MS-3 Main Steam Reactor 100% SLRDIS CRH-10 Cold Reheat Reactor 100% SLRDIS CRH-12 Cold Reheat Reactor 100% SLRDIS FW-6 Feedwater Reactor 100% Manual'*
CRH-16 Cold Reheat Reactor 25% SLRDIS MS-4 Main Steam Reactor 25% SLRDIS HRH 4 Not Steam Reactor 25% SLRDIS CRH-19 Cold Reheat Reactor 10% SLRDIS MS-14F Main Steam Reactor 2.5% Manual
- CRH-14F Cold Reheat Reactor 2% Manual *
**12 minutes after receipt *12 minutes after of 55 degrees F rate-of-rise receipt of 135 degrees F SLRDIS trip (not auto-isolated) SLRDIS alarm
2.8 Results of the 10CFR50.59 Safety Evaluation of SLRDIS The Safety Analysis which follows (Section 3.0) assesses the impact of SLRDIS on accidents or equipment malfunctions previously evaluated in the FSAR. Several accidents previously evaluated in the FSAR, besides a steam line rupture accident, result in high building temperatures with a rate-of-rise which could potentially actuate the SLRDIS. The SLRDIS would then isolate both secondary reactor cooling loops resulting in loss of motive power to the helium circulators and an interruption of forced circulation core cooling. Those accidents which could , potentially actuate the SLRDIS were evaluated to determine if the accident consequences are increased over those previously evaluated in the FSAR. The following Safety Analysis in Section 3.0 concludes that the consequences of those accidents, which could actuate the SLRDIS are not affected. (1) Has the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the FSAR been increased? Installatfor. of the SLfDIS increases the probability of occurrence of an interruption of forced circulation cooling due to the potential for two loop isolation by SLRDIS for high rate-of-rise building temperature conditions. The SLRDIS design is such that operator error during surveillance / maintenance of the final output relay trip logic or any short circuit in one Detection Rack will only, at worst case, cause actuation of the valves associated with a single loop or tri (single loop shutifown).p Aofsinglethe circulators in a sicgle SLRDIS Detect' loop ion Rack actuation, due to temperature conditions, only results in an alarm annunciation. No single failure / malfunction can resul t in the actuation of the SLRDIS safety function or preclude the safety function from occurring. For a SLRDIS actuation due to a HELB, fire or inadvertent actuation, recovery will be made as soon as practical but in any event forced circulation cooling will be restored within the 90 minute 10FC previously evaluated in FSAR sections 10.3.9 and 14.4.2.2. For an actuation due to DBA-2 recovery again will be made as soon as practical but in any event within 60 minutes. Actuation of SLRDIS does increase the immediate protective actions taken as a result of a high energy steam pipe rupture, fire or DBA-2,,but the accident consequences have not increased. The consequences of these actuations g- --* e - , - . . .
are bounded by the 1 1/2 hour interruption of forced circulation cooling followed by a firewater cooldown (Safe Shutdown Cooling, FSAR Section 14.4.2.2). (2) Has the possibility of an . accident or malfunction of a different type than any evaluated previously in the FSAR i been created? The required function of SLRDIS is to isolate both primary and secondary coolant loops in the event of a HELB resulting in an interruption of forced circulation cooling. The FSAR evaluates the consequences of an 10FC up to the bounding case of a " permanent loss" of forced circulation cooling (FSAR 14.10). Actuation of both SLRDIS Detection Racks for high rate-of-rise building temperature conditions does provide a new mechanism of entering into a previously FSAR analyzed accident or malfunction but does not in itself create a new accident. As stated in Item (1) above, recovery will be accom within the analyzed time limits (60 or 90 minutes)plished for an actuation of both SLRDIS Detection Racks resulting in two loop isolation. Recovery from SLRDIS actuation will be performed using feedwater or condensate for cooling. Firewater will only be utilized for core cooling in the event the other sources are not available. Since the consequences of an actuation of SLRDIS with two loop isolation are the same as.those of previous FSAR analyses (FSAR 14.4.2.2), no new accidents or malfunctions have been created. The Safety Analysis in Section 3.0 discusses the impact of an actuation of the SLRDIS on overall safety. (3) Has the margin of safety, as defined in the basis for any Technical Specification been reduced? A review was conducted to determine if the installation of the SLRDIS would result in a reduction of the margin of safety as defined in the basis for any Technical Specification or in the FSAR. Technical Specification 7.6 addresses exclusively the environmental qualification of safety-related electrical equipment. Installation of SLRDIS limits the harsh environment to which safety-related electrical equipment is exposed and to which it is qualified. Therefore, the margin 1 1
-, . . . , ~ , . . - . - - - - , - - . - -
of safety in the basis for environmental qualification has not been reduced. Environmental qualification of equipment is addressed in Fort St. Vrain FSAR Section 1.4. The harsh environments defined in the Reactor and Turbine Building which formerly served as the bases for equipment qualification are 4-minute operator terminated offset ruptures of steam piping. The SLRDIS function is to perform automatic detection and isolation of these postulated steam leaks without operator intervention such that the harsh environments do not exceed those previously defined for equipment qualification. It is, therefore, concluded that the installation of the SLRDIS does not reduce any margin of safety defined in the FSAR with respect to the basis for-environmental qualification of electrical equipment. Technical Specifications LC0 4.4.2 and LC0 4.4.6 deal with harsh environments for operation of safety-related equipment in the three-room control complex. The SLRDIS does not pPotect against harsh environments in the three-room control complex for a HELB. Therefore, the SLRDIS does not result in a reduction of a margin of safety in the basis for these Technical Specifications. The basis of LC0 4.4.1 - Plant Protective System Instrumentation - requires the plant protective system to automatically initiate protective functions to prevent established safety limits from being exceeded. In addition, other protective functions are provided to initiate protective actions to mitigate the consequences of accidents. The present PPS Loop Shutdown Logic design inhibits the automatic shutdown of both primary and secondary coolant loops. However, tripping of all four circulators can occur due to the PPS Circulator Trip Logic (for example, on low feedwater flow in which restart of the circulator on water turbine drive is inhibited resulting in loss of forced circulation of primary coolant). The interface of SLRDIS into the Circulator Trip Logic will override the existing design features to cause automatic shutdown of both primary and secondary coolant loops and inhibit the auto-start of the water turbine drives for a loss of forced circulation cooling. Therefore, this means of overriding the two loop shutdown inhibit reduces the I
margin of safety for assuring continued forced circulation cooling. 3.0 SAFETY ANALYSIS A review of the FSAR and Technical Specifications was conducted to detennine the effect of the SLRDIS on systems, components, equipment, tests or procedures described therein. The results are presented in the following sections, 3.1 Instrumentation Design Bases The principles of design, design bases, and the protective functions of the Plaat Protective System (PPS) are addressed in Section 7.1 of the FSAR. The PPS initiates automatic corrective actions upon the occurrence of the following:
- Equipment failures which require corrective action beyond the capability of the plant control system,
- Failure of the plant control system causing an abnormal condition,
- Misoperation which has resulted in a potentially unsafe condition.
The corrective actions are directed towards safe operation of the plant and protection of the core and equipment. The addition of the SLRDIS instrumentation is commensurate with the present system design described in the FSAR; however, the approach is different (i.e., two-out-of-four sensing logic) and more recent industry design standards have been utilized. The SLRDIS employs coincident logic to preclude inadvertent trips and " Transmission Logic" in that it requires power to cause an isolation trip signal. This is consistent with the Circulator Trip Logic in the PPS where the SLRDIS interface exists. In-operation maintenance / testing features are provided to assure operability of the system. Redundancy and independence is provided to assure that no single failure will cause the loss of the protective function or cause the protective action (two loop isolation) to occur.
The SLRDIS system design with the one-out-of-two taken twice tripping logic to the PPS makes the system more desirable and far less susceptible to inadvertent actuation causing plant upsets. Potential failure modes were analyzed with the following results:
- Spurious Panel Actuation: A spurious panel actuation including an actuation of both Logic A and B will only cause an al a rm.
No tripping of valves or circulators will occur.
- Short Circuit: Any short circuit, in either panel can only cause, at worst, the trip of one loops circulators or valves.
There is no single short circuit that can cause the trip of both loops. In addition, there is no single short circuit or cpen circuit that can preclude the SLRDIS objective from being accomplished.
- Loss of an instrument bus: The loss of an instrument bus converts the scanner logic on each SLRDIS panel to a 2 out of 2, however, per Technical Specifications operators would be required to restore power or shut down. The loss of an instrument bus would not cause any isolation action to occur.
- Fire: A fire in either panel would not cause an IOFC, under any or all potential failure modes. At worst, a fire would cause a loop shutdown by shorting to ground the inputs to PPS valve trip and circulator trip logic.
- Technician Error: The worst case technician error is to short a particular circuit to ground. In that case, the results are the same as the short circuits discussed above. In addition, there is no possible combination of technician errors in one panel that can shut down both loops.
The addition of the SLRDIS instrumentation and interface with the PPS does not inhibit any existing automatic protective feature (with the exception of auto-start of the water turbine drives) in the scram, loop shutdown, circulator trip or rod withdrawal prohibit circuits. The installa. tion of SLRDIS replaces the existing Steam Pipe Rupture Detection System for the Reactor Building and is expdnded to provided protection against steam pipe ruptures in the Turbine Building. 1 l i 1
- ,---.r., -
3.2 Systems Interaction The purpose of the SLRDIS is to detect and automatically isolate pipe ruptures in selected portions of the secondary coolant system. However, primary coolant leakage, if of sufficient magnitude in the Reactor Building, could also trip this system. This in turn could result in secondary coolant flow isolation along with interruption of forced circulation. Two primary coolant leak accidents are analyzed in the Fort St. Vrain FSAR. These are the " Maximum Credible Accident" discussed in FSAR Section 14.8, and Design Basis Accident No. 2, " Rapid - Depressurization/ Blowdown" discussed in FSAR Section 14.11. These are analyzed in Sections 3.2.2 and 3.2.3 of this report. 3.2.1 High Energy Line Breaks High Energy Line Breaks are discussed and analyzed in various FSAR sections. FSAR Sections 7.3.10, 6.2, and 14.5.1 address pipe ruptures in the Reactor Building while Appendix I addresses pipe ruptures outside the Reactor Building. - As discussed in Section 2.0 " Background", the SLRDIS will detect and automatically isolate High Energy Line Breaks for which it is designed both in the Reactor and Turbine Buildings. ' Tne rapid isolation will result in a less severe environment (see Figures 4' and 5), than that in which manual isolation occurred at 4 minutes, to assure continued operation of the safety related electrical equipment for safe shutdown and decay heat removal. Following actuation of SLRDIS for a HELB, Safe Shutdown Cooling is restored within 90 minutes by providing boosted firewater to one helium circulator and firewater to one steam generator (last resort). This 90 minute interruption of forced circulation followed by Safe Shutdown Cooling has been previously analysed in FSAR Sections 10.3.9. and 14.4.2.2. The SLRDIS is not required to be operaole at power levels below 2% reactor power. The worst case event at 2% reactor power is the double offset rupture of the main steam piping in either the Reactor Building or the Turbine Building. This event was analyzed in each building assuming that the SLRDIS trip and alann functions were inoperable and that. the rupture was manually terminated at one hour. Analysis with the Contempt-G _.._r. - - - -
computer code demonstrates that the resultant building temperature profiles do not exceed those temperature profiles to which the safe shutdown electrical equipment will be environmentally qualified. Therefore, removing the SLRDIS from operation at power level below 2% reactor power is acceptable. 3.2.2 Maximum Credible Accident The Maximum Credible Accident results from multiple failures involving the helium purification system regeneration piping. The primary coolant leakage results from the postulated rupture of a 2 inch pipe which comes out of the PCRV top head and goes to the helium purification regeneration system located just below the refueling floor. The FSAR analysis assumes that no operator action is taken to mitigate the consequences of this event. FSAR Figures 14.8-2 and 14.8-3 show PCRV pressure and Reactor Building temperature with time. These figures are enclosed for reference. About 2 minutes into the accident, a reactor scram would occur on low programmed primary coolant pressure. Building temperature response is relatively slow reaching the peak temperature of about 175 degrees Fahrenheit at about 40 minutes into the accident. This analysis was very conservative in that it did not account for the Reactor Building's heat sinks or the mixing of the helium with the building's entire volume. GA Technologies Inc. reanalyzed the event using the CONTEMPT-G code which accounts for the heat sinks and volume mixing. The escaping primary coolant is considered to be mixed in the* building volume environment. The results of the reanalysis show that the maximum average temperature in the Reactor Building is about 94 degrees Fahrenheit as shown in Figure 6a (about 5 degrees above analysis ambient). The analyses also report a peak Reactor Building pressure of 1.0 inches w.g. at 1 minute (Figure 6b). The temperature is not considered to present a harsh environment and the temperature rate-of-rise will not result in actuation of SLRDIS nor result in the failure of unqualified electrical equipment. Since the electrical equipment is expected to remain operable, reactor cooldown is accomplished by continued forced circulation core cooling at a reduced helium density.
3.2.3 Design Basis Accident No. 2 The Design Basis Accident No. 2 " Rapid Depressurization/ Blowdown," results from a hypothetical sudden failure of both closures in the bottom head access penetration. Blowdown of the PCRV to atmospheric pressure is completed in about 2 minutes. A reactor scram would occur on low primary coolant pressure with forced circulation cooling being continued by auto-start of the Pelton drives using feedwater. For analysis purposes in FSAR Section 14.11, forced circulation cooling was asstmed to be interrupted with auto-start of the helium circulator Pelton wheels occurring 5 minutes into the accident. Building temperatures would quickly peak to greater than 600 degrees Fahrenheit with a rate-of-rise sufficient to trip SLRDIS. See the enclosed FSAR Figure 1.4-1,. This would result in isolation of all secondary coolant flow not permitting forced circulation cooling to be quickly re-established as assumed in the current FSAR accident analysis. The current FSAP analysis indicates a peak fuel temperature of 2600 degrees Fahrenheit, which is below the conservative FSAR temperature limit of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur. Design Basis Accident No. 2 has been reanalyzed using the RECA computer code. A delay time of 60 minutes was considered in. the reanalysis to allow for operator action to restart forced circulation cooling. Operator access to the Reactor or Turbine Building is not required. All required operations are performed remotely from the Control Room using environmentally qualified equipment when such equipment is located in the Reactor Building harsh environment. Region peaking factors of up to 1.83, as utilized in the current FSAR analysis and permitted by the Technical Specifications, were retained in the new analysis. A region temperature outlet mismatch of 100 degrees Fahrenheit was used. For the 100 degrees Fahrenheit region outlet mismatch and a 60 minute delay in restart of forced circulation, the maximum fuel temperature is 2810 degrees Fahrenheit. This maximum fuel temperature satisfies the conservative FSAR temperature limit of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur. Maximum fuel temperature versus delay time for the reanalyzed cases are shown in Figure 7. Average core outlet gas temperatures (Figure 7) are less than 2000 degrees Fahrenheit and therefore are acceptable regarding Class
B thermal barrier insulation. The total amount of graphite oxidation due to air ingress for the 60 minute 10FC is 23 pounds. This amount of oxidation is not significant. It is concluded that while DBA-2 will result in a interruption of forced circulation cooling due to actuation of SLRDIS, sufficient time exists for the operators to restart forced circulation cooling with no change in the accident consequences. , 3.2.4 Fire The FSAR addresses a fire and the fire protection system in Section 9.12. A fire is a particular concern since it has the potential for activating both SLRDIS Detection Racks resulting in steam line isolation and interruption of forced circulation cooling. Under the 10CFR50 Appendix R Fire Protection Review for a fire in the congested cable area, cooldown is accomplished using the PCRV liner cooling system powered by the Alternate Cooling Method (ACM) system. For this postulated event, the fire results in a permanent loss of forced circulation cooling. Actuation of the both SLRDIS Detection Racks would not have an effect on the consequences of this fire as there is no need to operate any of the valves shut by the SLRDIS for liner cooling. For fires outside the congested cable areas, cooldown is accomplished by forced circulation cooling. Forced circulation must be reestablished within 90 minutes after interruption of furced circulation using either Fire Protection Shutdown Train A or Fire Protection Shutdown Train B. Actuation of the SLRDIS by a fire would automatically interrupt forced circulation by closing numerous valves, some of which are in the Fire Protection Shutdown Trains. These valves must be reopened within 90 minutes to permit forced circulation cooling. Plant and SLRDIS system designs are such that means exist to re-establish forced circulation cooling within 90 minutes. 3.2.5 Inadvertent Trips The design function of the SLRDIS causes a loss of forced circulation cooling by isolation of high energy steam pipe line portions of the secondary coolant system (both loops) in the event of a major secondary coolant leak. The design feature of l l
SLRDIS utilizing the one-out-of-two taken twice relay trip logic to the PPS is such that an inadvertent trip of either Detection Rack will only cause an alarm annunciation and satisfy only one-of-the-two required trip signals to the final output. relay trip logic. Such inadvertent trips may be the result of hardware failure or operator error during surveillance / maintenance testing. However, during surveillance / maintenance functions on the final output relay trip logic, operator error (short circuit) could result in the inadvertent actuation of a single loop's isolation valves or in the tripping of the circulators in a single loop. A spurious closure of the valves in a single loop would interrupt feedwater and steam flow in that loop. These conditions would in turn cause trip of both helium circulators in that loop on a combination of low circulator speed and low feedwater flow signals (FSAR 7.1). The other loop would continue to provide forced circulation cooling. A spurious trip of both circulators in a loop will cause a loop shutdown. Core cooling would continue with the single operating loop in both of these , situations. Events such as fires, primary coolant leaks, or localized steam leaks which cause high temperature building conditions may cause actuation of both SLRDIS Detection Racks resulting in an 10FC. However, no single failure will result in the isolation of both loops or preclude the safety function from occurring. Should the trip of both SLRDIS Detection Racks occur, the operator has sufficient information to diagnose that a major steam line rupture has not occurred and to re-establish forced circulation within analyzed time limits. There are a number of things that will aid the operator in the diagnosis of the type of event taking place. Normal PCRV pressure would be an indication it is not a primary coolant leak. Much of the available information would come from the affected building itself. The personnel on shift would be able to inform the Control Room if a fire, localized steam leak, or surveillance test had tripped the system. The presence of smoke alarms, fire suppression actuation and smoke would be an indication that it was a fire rather than a steam leak. The most important information available to the Control Room operator, in addition to the above, is that from the SLRDIS Detection Racks. The Detection Racks will show the specific channels and zones which have tripped. Continuous actual temperature readings are provided at the SLRDIS Detection Racks located in the Control Room. Since large volumes of either the Turbine or Reactor Buildings would essentially see the same l
environment for a major steam leak, absence of trips on other SLRDIS channels in the same building would be a sign in itself that a high rate of-rise temperature was isolated to a smaller arca. Fires woula be l'ocal, at least at the start, and thus should not trip the SLRDIS. Analyses have been performed for loss of HVAC in both the Reactor and Turbine Buildings. The results of the analyses demonstrated that the temperature rate-of-rise resulting from the loss of HVAC is sufficiently below the SLRDIS trip setpoint to preclude an inadvertent actuation. Analyses have also been performed to determine building temperature rate-of-rise due to opening / closing of building doors and the heating system. The analyses accounted for door location and sensor proximity. The results of the analyses demonstrate that the building temperature rate-of-rise (Reactor and Turbine) is well below that which is required to actuate SLRDIS. SLRDIS will not actuate for a drop in temnerature. One of the SLRDIS design objectives is to minimize the potential for inadvertent actuation of SLRDIS. As discussed in Section 3.1, the probability of an inadvertent SLRDIS actuation resulting in an interruption of forced circulation is extremely remote. In the event an inadvertent actuation were to occur, operators would take the necessary actions to identify the
- cause of SLRDIS actuation and restore forced circulation as soon as possible, but in any event within the 90 minutes previously evaluated in FSAR Section 14.4.2.2. In the event of an inadvertent actuation of SLRDIS, it will be apparent in a very short time that a severe steam line break accident has not occurred and operators can proceed to reset SLRDIS and recover forced circulation cooling from the control room. Since the interruption of forced circulation caused by inadvertent actuation of SLRDIS will not exceed 90 minutes, the consequences of this event are bounded by those previously evaluated in FSAR Section 14.4.2.2.
UPDATED FSAR Revision 2
. e I 7 i
I I x /
< I "l l
=
t ;/ l
+ o
$w 3/ l EI A3 / l 's a
L
- & / v o l , =. a e /
e5 l - g ', cs
= -
ky 316
' C C m v (
m t5 l C 3 -J-
- z = l o
O m = m -- l flj
" 5
@ @m Eta i
l gl _ 5 3== i i : - 23 F
\
Ell E ba& m \ 2~t mo
< I C'l C C.
w 1 m I ._C . = g z - ~ 3cm 5 \ '5 3 E i ; \ l =gg d \ tg '< O @
! \
\ H3 sa=
e \ g
= g - -
\ \
~
N \ s N - o N \ g N\g o ..e O O O o O O O C 4 a m 0 - j 1 (3.) 33nivv3dw31
- o G
*E OM g.a 600 .
"?
mg I I 500 - l l l I.00 - R=20' n l , I h n.2s* l g a.30- [ MO ' R=36.2 l
. N' f
~
\
accioNat souNDAAY l 200 l 4 l N AROUND PCRV l_ '-
.I
- e. e le i00 -
g l3 .ls 2 t g-5 l3 $iT el: 5g;
' ' ' ' l/ i i o
, , 3 f[ io is /2o 2s 3o TIME (tilN.)
Figure 1.4-2 Temperature of Reactor Building Atmosphere During Postulated Cold Reheat Steam Pipe Rupture Accident as a function of Distance "R" From Possible Source ' a of Steam Leak }
600 l l r I i i i i l I I soo - 1 I I
#1 Mi i'l s00 -
}*l
/
l 2 300 i I n 20' ll! E i t I I w a cn I g R 30' i 3 N 1 i R ' feo ' g 200 - 1 i I : R-Sa' i o g R=60' g
- 100 -
h lj R=70.2' l 41"l I 5I r 1 E l$ I ,%
- " la I ao o
e i i l i i ! 4 i I hk i o i 2 3 4 5 10 is 20 25 30 & TIME (MIN) "$
"E Figure 1.4-3 Temperature of Turbine Building Atmosphere During Postulated flot Relieat Steam Pipe Rupture Accident as a function of Distance "R" From Possible Source of Steam Leak i i
FSAR UPDATE 14.8-6 5 C U
~ u -
as d l:f an 3 5
"i 2 -
w i
- 5 700
- 600 -
U w h m 500 - W
=
L s
.00 300 O 4 8 12 16 20 24 TIME (MIN) 1 Figure 14.8-2 Heuum Leak Rate and Primary Coolant System Presure Fouowing the i Maximum Credible Accident (Helium Punficadon System Regeneration Line Multiple Fagure)
; 37 -
1 l
FSAR UPCATE 14.3-7 b a kT 35
- g am 52 .
R .2
.s .3
%=
3 2j
*1 .
.r ,
B 3
*4 2 8
to 3.1 a *: 2. m t5 g2
* .=
l= (#1
] "3 3 3.
~
~
= .- =
s..1 4 *
"O
$ $. I.
ta " $
- =3 et .5 .3 "5
<a 33 ax g ==
SS
- a. -.* -
1I= 25 3 3% 00 z<
-e a !
M
.V.
49 3 g i f I 4 E ;* a g * * '. 2 3-
,a
~
- 4 o.
(J.) 1mntyv3dw31 SMielins (y sju3ns) Junsslud Smiclins
FIGURE Sa MCA, TOTAL REACTOR BUILDING TEMPERATURE WITH LEAKAGE 94 -
' ~
DISTAllCE g B N Tout I 93 - ' E - 11 - T - T 92 - E - N - ., i P _ i g E _ l 91 -- i T _ U R
- 90 -
2 89 - i i i i i i iii5 iiii 8 ' '' 0 5 le 15 20 25 30 TIME - MlliUTEt 1
-i
A FIGURE Sb MCA, TOTAL REACTOR BUILDING PRESSURE WITH LEAKAGE N 1.5 B - , 3 E
.N -
T _ p 1. 0 - p R - E _
- S s 0.s- -
N n - C H 11 0.0-2 - 0 . G A - y -0.5- iiii iiii i ii iiii iiii ie i i 20 25 30 E O 5 10 15 TIME - NINUTES l
3000
--- ~
_ MAN FUEL TEMP T *,.. - - nis 45at 66(di E -
~
! n ,, - a05 c'5hi o6f R i p - E R 2000 A -
- s'
T . a
. U -
- / ,
- R ..', 's
~
~ ,'
, E :
,.I I
D 1000- i E G --i:n:C:'f F h h h h 0 1 2 3 4 5 6 TIME AFTER REACTOR TRIP (HR) FIGURE 7 EQUILIBRIUf1 CORE,100 DEGREES F CORE ORIFICING' REGION OUTLET filSf1ATCH,DEPRESSURIZED, 60 MINUTE DELAY IN STARTING CIRCULATORS 1 4 ~
3.2.6 Water and Steam Hammer Effects A portion of the boiler feedwater system was re-analyzed to determine the effects of a water hammer (fluid transients) on the system piping due to the sudden closure of the flow and isolation valves to both steam generator loops. This portion of the overall piping system was selected based on the results of previous analyses performed for a single loop isolation by Sargent and Lundy and due to the introduction of SLRDIS isolation. In the analysis of the fluid transients, the dependent forcing functions were calculated from pressure and velocity data, by applying finite difference technipes to a thermo-hydraulic model of the system (see Figures 8 and 9). These forcing functions were then applied along individual' segments of a lumped mass, dynamic, stiffness model of the piping system from which the time history response was calculated to predict piping stresses and restraint loading. The output of the programmed model was maximum loads at the restraint nodes (including skewed boundary conditions) and maximum stresses in the piping segments (based on ANSI B31.1-1967 code requirements). The results of the fluid transients were compared to the allowable loads and stresses established in the previous Sargent and Lundy analyses based on combined dead weight, Operating Bases Earthquake (0BE) and sudden valve closure stresses. See Engineering Evaluation (EE-EQ-0017) of boiler feedwater fluid transients due to sudden closure of isolation and flow valves on both steam generator loops for a'dditional information. t The results show that with iterations in the analysis the maximum loads at the dynamic restrairit nodes were below the allowable load of the seismic restraints (snubbers and rigid). Iterations were performed in the dynamic response analysis following the initial analysis where certain restraints exceeded the manufacturers rated load. Each subsequent analysis considered these restraints not to act. After three iterations, the calculated load at all the restraints considered were less than the manufacturer's rated load. The maximum stresses calculated on the piping system were' also below the allowable stresses for combined dead. weight, OBE and sudden valve closures with a maximum displacement of 0.243 inches. Although the resultant fluid transient from SLRDIS actuation may result in dynamic responses in excess of
i . manufacturer's rated loads on certain restraints, the iterative' , analyses demonstrate that the boiler feedwater system piping is adequate te sustain the effects of the simultaneous cicsure of isolation and flow valves on both steam generator loops. The water hammer will not interfere with the decay heat removal
~
function of the secondary coolant system piping following SLRDIS actuation. l i t a r
! /
s s I 4 t h
< \
< l
FIGURE 8 Flu t t> nzau 6W er" W sm b t h 2 C -t ew ec.cxy rqssbum tWR. r T DV- 5"88 """*[ T - - --{ srANot Ndr cesse 7 ""
- N >d 0! C ' ca-T. e ees a .
rw.sut 4w.staa V v - Sit 98 r-3iot h HV . 3 6tli v-si,s-i 7 e % 9m (E-sior_ eav -3e9 47 av-s'ii 4
<~ - "TE ro -
,,o z.
Hv - 3 t l2D g ev-sis-e l l y -
~
l s- 18N g h ' pp.not v-n94 ru.ams pv.a m s
- v. haco AE .sans 64v-seso 77 P.14o's av aaot v-a *44 PE-tanc. rv-taac, rurTt A,t co.aestraoc6 recet_S.bt; 44C154s '_
85co. Sz75. 1Hbl. 387 6 - 547 3. Se af, ,
%%C8 SEs.
W #E. (PscAT szo z szo.z-4do 4 w .4 4.4o.4 44o.4 re ow 6a/ced zoom rsz s 7wo.
~
F4C A.> (kr .0 Wsb avv9 am, sz eo. sz oo. 79,2. , 7552.. l
T-. E E.- y 2 y 3 F
~
. i.'S'2sk N..oF !! n a I
t. 5 -
"O
] [ } d @
s 't w i'
~
a s yd - }1 w g pl!g,i
~
i g a 2 h- !!i 5 . 1 - l d@ h . j a* e g@ <
% @ ,m> +
k gg ~m l+j z w a f { a sig u e @ ! r 2 9 ai g @ 'g l @
, C 6@ c e g@ .
3 y p' L @ @ @ :. g5Y ! 2
?3 l 1
o ,t o -
; o e @ .
x r d<= - e ,e e a ~
~
g d. - $'A-l l
- , . . ~
l' . , , .~;.-. t '
4.0 SIGNIFICANT HAZARDS CONSIDERATION (10CFR50.92) Based upon the analyses, it is concluded that the SLRDIS is capable of performing its intended function to detect and isolate major line ruptures of high energy steam pipe lines of the secondary cooling sys' tem without operater intervention. The rapid isolation limits the harsh environment to which the safety-related electrical equipment is exposed and to which it is
, qualified.
Manual operator intervention for isolating HELBs in the
;feedwater, condensate, extraction steam systems and those line breaks not isolated by SLRDIS is adequate to assure that the resulting temperature profiles are enveloped by that to which the equipment will be qualified.
Consequences of other accidents analyzed in the FSAR were examined for adverse impact as a result of the installation of the SLRDIS. Design Basis Accident No. 2, " Rapid Depressurization/ Blowdown Accident," was determined to have one assumption invalidated in that the SLRDIS could prevent initiation of forced circulation cooling at 5 minutes into the accident. Reanalysis of the accident determined that forced circulation cooling could be delayed for at least 60 minutes without exceeding the conservative FSAR fuel temperature limit of 2900 degrees, a temperature well below that at which rapid fuel deterioration is expected to occur. This is more than sufficient time for the operator to restore forced circulation cooling. The potential for the SLRDIS to create new or different types of accidents not previously analyzed was examined. The conclusion was that the SLRDIS could result in interruption of forced circulation cooling through high rate-of-rise building temperature conditions which result in two loop isolation. It was further cCncluded that sufficient information is currently available in conjunction with new information available from the SLRDIS for the operator to properly diagnose and recover from the event by re-establishing forced circulation cooling within time limits analyzed in the FSAR. A review was conducted to determine if any margins of safety defined in the basis for a Technical Specification or in the FSAR were significantly decreased. It was concluded that the SLRDIS isolating the secondary coolant system only causes a temporary interruption of forced circulation cooling in both loops.
Recovery means exist to re-establish forced circulation cooling in ample time to mitigate the consequences of a pipe rupture. The installation of the SLRDIS will not significantly effect the risk to the health and safety of the public, nor involve any significant hazards because it is deemed not to: (1) Involve a significant increase in the probability or consequences of an accident previously evaluated. High rate-of-rise building temperature conditions will cause isolation of both loops and will result in an interruption of forced circulation core cooling which has been previously analyzed. System design precludes inadvertent actuation of both SLRDIS Detection Racks while limiting those accidents which potentially could actuate two loop isolation. (2) Create the possibility of a new or different kind of accident from any accident previously evaluated. The instal'lation of SLRDIS provides a new mechanism for entering into an accident previously analyzed in the FSAR and does not create a new or different kind of accident. (3) Involve a significant reduction in a margin of safety. The installation of SLRDIS and the interface with the plant protective system ensures rapid detection and isolation of major steam line ruptures to limit the harsh environment to which the safe shutdown electrical equipment is exposed. Isolation of.both secondary coolant loops is required to limit the energy release to the
' building. The two loop isolation through the tripping of all four circulations results in an interruption of forced circulation core cooling for which the consequences are bounded by the 1 1/2 hour interruption of forced circulation core cooling followed by a firewater cooldown.
. -.}}