ML20205G437

Handwritten Memo Forwarding Draft Safety Evaluation Re Steam Line Rupture Detection & Isolation Sys.Sys Capable of Ensuring That Conditions in Reactor & Turbine Bldgs Do Not Exceed Accepted Essential Equipment Qualification Envelope

ML20205G437
Person / Time
Site:	Fort Saint Vrain
Issue date:	03/25/1987
From:	Heitner K NRC
To:	NRC
References
NUDOCS 8703310456
Download: ML20205G437 (9)

Text

~

eg .

.m

..~

l Q f, g g y % , g a n _ y ,

Da e ,, au n

& k N , Dochef 12ter i on n o m ', K. L, Her b ec f- ut Mannyen L -ProAe&

Fo .

st Va , m O Pr$a c%d^ D,m W r

%\oda 00 c u vm of a .r _

C_ a s< s t n kr \osen 9,~0 0, d e 1 4o % e.

l Futolei %rvtc e G~mpony c, ;

r Colomd o , im a cu acncx.

mi% NRR OSL ce_ Le.4lvc Ho,+3 w e. r e q u erk ikd o u. o c o v i 0 -e_ c_og i e r- 40

, s e. N R c_ an J L ocal Pp 6 's "X,1,1ts .

~ 8703310456 870325 hDR ADOCK 05000267 PDR

. . , . - , , . , . . , , . . . . , . . - . - - . . . _ , . _ , - _ ~ _ _ - . . - - - - . - - - - - _ . - - - . . - - . - . . - . , , - - . _ . . , _ .

V;F W O$h .,l J ENCLOSURE 1 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO STEAM LINE RUPTURE DETECTION AND ISOLATION SYSTEM PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION DOCKET NO. 50-267

1.0 INTRODUCTION

AND SYSTEM DESCRIPTION By letter dated June 4,1986, Public Service Company of Colorado, the licensee for the Fort St. Vrain Nuclear Generating Station, has proposed to install a Steas.. Line Rupture Detection and Isolation System (SLRDIS) designed to detect rising temperatures in both the reactor building and turbine building which will result from postulated breaks in high energy lines and initiate mitigating actions. Upon detection of rising tempera-tures in either building, the system will 1) initiate a reactor scram,

2) trip the helium circulators in both primary loops,.and 3) initiate clo-sure of the valves in the secondary side high energy lines in order to isolate them. Isolation of these lines within the specified time frame prevents further escape of high energy fluid in order to preclude an en-vironmental condition which could adversely affect equipment required to bring the plant to a safe shutdown.

The SLRDIS is relatively simple in design and consists of two sensor loops in the reactor and turbine buildings, each containing four sensors. Each

BRiui sensor is a thermistor which changes resistance rapidly with increases in temperature. Each thermistor is 200 feet long and is coiled into three or four wire loops. One thermistor in each reactor building sensor loop is located near one of the four walls of the building, with a similar arrange-ment in the turbine building. Signals from one thermistor loop in the reactor building are fed into the "A" detection rack while signals from the thermistors in the second loop are fed into the "B" rack. The thermis-tors in the turbine building are arranged in a similar manner. A high energy line break of sufficient' magnitude in either the reactor or turbine building will heat the thermistors, rapidly, thereby reducing their resis-tances so that a' rate-of-rise signal will be generated causing isolation of high energy secondary side pipe lines. Simultaneously, all four helium circulators will be stopped. Isolation will occur if the resistance of at least two of the four thermistors in two detector racks for either building are sufficiently affected by the rate of rise of the environmental tempera-ture. A signal from only one thermistor will result in a low-level pre-trip alarm and a rate of rise alarm. A signal from both the "A" and "B" detec-tion racks is required to initiate isolation valve closure. There is also a trouble alarm in the event of a thermistor short-circuit or open-circuit condition.

The SLRDIS is designed to detect and isolate breaks in the main steam, hot .

and cold reheat steam lines where the break flow is equal to or in excess of that equivalent to 27, of a full offset break flow. It is expected that a break in either the condensate, auxiliary steam, or extraction steam line will not release energy in sufficient quantity to cause the SLRDIS to isolate the secondary side high energy lines. For these line breaks, the

~

3-OD5 p"?

Udn.

- fj pre-alann trip signal (135 F) will alert the operators to take necessary corrective actions manually. Feedwater line breaks will release sufficient energy to actuate the sensors and cause a rate-of-rise trip. However, the SLRDIS system is not designed to isolate the feedwater system automatically; this must be done manually, by the operators, following the SLRDIS system actuation. In addition, the licensee proposes to maintain functional-capability of the-temperature elements and temperature alarms of the existing Steam Pipe Rupture Detection System (SPRDS) as an additional system to alert the operator to a pipe rupture in the reactor building which may not cause the SLRDIS to react. The licensee committed to reason-ably maintain and test this instrumentation consistent with similar instru-mentation including periodic calibration (once per refueling outage, not to exceed 18 months) and corrective maintenance in a reasonable time inter-val; this instrumentation, however, will not be covered by Technical Speci-fications. SLRDIS operability is ensured by the Technical Specifications.

2.0 EVALUATION 2.1 Single Failure The staff has reviewed the capability of the SLRDIS to perfonn its function in the event of a single failure. A single thermistor can fail in an "open" or "short" condition; this will cause actuation of a trouble alarm. Alternatively, a failure of a sing's thermistor de-tection loop would change the SLRDIS actuation logic from 2-cut-of-4 m.y,_. ,m..-9_._ ,_,..--._m7.- . .,__ _ _ _ _ . , _ . , . _ , . - - _ , . . . -

s BRAFT to 2-out-of-3 for initiation of the isolation signal. While this.is not desirable, the time of thermistor inoperability is limited by the Technical Specifications so as to minimize operation without a full complement of operable thermistors.

The SLRDIS detection racks themselves may fail in a manner which generates a spurious signal. In such an event, while an alam is received, isolation of the lines monitored by the SLRDIS will not occur until a signal is received from the other rack. A single instrument bus failure will incapacitate either the "A" or "B" logic in both racks and change the sensing logic to 2-out-of-4 in each rack to 2-out-of-2. Such a condition would still permit SLRDIS actuation.

However, the technical specifications severely limit operation with half the thermistors disabled as would occur on failure of an instru-ment bus. Further, the racks are equipped with a self-test system which continuously monitors the online status of the rack, and will alann a failure upon detection. The above design features ensure that the SLRDIS function is not lost even though a signal from both racks is required for valve closure. The staff, therefore, finds that the SLRDIS design assures its proper function in the event of a single failure.

2.2 SLRDIS Actuation as a Result of Accidents other than a High Energy Line Break i

The staff performed a review to determine the impact on SLRDIS of accidents, other than a' high energy line break. For the design basis l

l

DET maximum credible accident, in which the primary coolant (helium) is emitted from a ruptured 2-inch pipe leading to the helium purifica-tion system from the Prestressed Concrete Reactor Vessel (PCRV) head, the licensee determined that the SLRDIS would not be actuated, nor would this accident create a harsh environment.

For Design Basis Accident No. 2 involving a failure of both closures in the bottom head access penetration, the temperature in the reactor building may rise rapidly to 600"F, tripping the SLRDIS in the process.

The original accident analysis assumed that forced circulation cooling would be interrupted for five minutes until automatically reestablish-ed by the use of feedwater and the Pelton drives on the helium circu-lators. The licensee reanalyzed this accident to allow a delay time of 60 minutes for the operator to restart the forced circulation cooling.

The licensee also noted that a fire could activate both of the SLRDIS detection racks, resulting in isolation of the high energy steam lines i

and interruption of forced circulation cooling. Some of the valves closed by the SLRDIS are included in the Fire Detection Shutdown Sys-tem and must be reopened within 90 minutes to permit forced circula-tion cooling. The licensee stated that both the plant and the SLRDIS designs permit the reestablishment of forced circulation cooling under these circumstances.

The licensee further noted that an inadvertent trip to either SLRDIS i detection rack as a result of hardware failure or operator error l

1

[L kg would satisfy only one of the two trips signals required to activate the SLRDIS. In this case, only an alann annunciation would occur as previously discussed. During surveillance or maintenance on the final output relay trip logic, a short-circuit caused by operator error could result in an inadvertent operation of the valves in a single SLRDIS loop and subsequent tripping of the helium circulat' ors in that loop. The other primary cooling loop, however, would continue to function.

I i

In addition, the licensee conducted analyses to confirm that neither the building heating systems nor loss of HVAC systems would affect building temperatures in a manner which would activate the SLRDIS.

The staff, therefore, finds that the licensee has adequately consider-ed the impact of other accidents on the SLRDIS and confirmed appropri-ate operability of the system for those events.  ;

2.3 Diagnosis of Event The staff reviewed the means available to determine the event occurr-ing in order to alert the operator to a possible SLRDIS actuation.

The licensee noted that a number of indications are provided which would aid the operator in diagnosing the particular event taking place. If PCRV pressure is not decreasing, the event is not a pri-mary coolant leak. Shift personnel would be able to inform the con-trol room if a fire, localized steam leak or surveillance test had

t 7

f lY'~

Us uiJ - g caused the SLRDIS to trip by observations in the plant. Smoke detec-tors and fire suppression system actuation would indicate the presence of a fire. .The SLRDIS detection racks provide indication of the speci-fic channels and zones which have~ tripped. Indications of only local-ized high building temperature would be a sign that a major steam leak had not occurred. The staff, therefore, finds that adequate means are available to assess the causes of SLRDIS actuations.

2.4 Effects of Water and Steam Hammer The licensee reported that a portion of the boiler feedwater system had been reanalyzed to determine the effects of closure of the isola-tion valves to both steam generator loops as a result of SLRDIS actua-tion. The licensee stated that while SLRDIS actuation may result in a fluid transient, and consequential dynamic responses in excess of manufacturer's rated loads on certain restraints, the boiler feedwater system piping pressure boundary will be adequately maintained. The staff, therefore, finds that the effects of water and steam hammer have been properly considered in the design of the SLRDIS.

3.0 CONCLUSION

Based on the above, the staff concludes that the SLRDIS meets the require-ments of General Design Criteria (GDC) 20 for design of engineering safety feature detection and actuation systems and the requirements of GDC 4 for assuring plant safety following postulated pipe breaks. Thus, the system

'fL

• - I s dJ is capable of ensuring that environmental conditions within the reactor and turbine buildings will not exceed the accepted essential equipment environ-mental qualification envelope following postulated secondary side high'

-energy line breaks. The staff, therefore, finds the SLRDIS to be accept-able, f

a