ML20212M499

Forwards Draft Safety Evaluation Re Steam Line Rupture Detection & Isolation Sys Provided to Util,Per NRC Ofc Ltr 43

ML20212M499
Person / Time
Site:	Fort Saint Vrain
Issue date:	03/06/1987
From:	Heitner K NRC
To:	NRC
References
NUDOCS 8703120043
Download: ML20212M499 (9)

Text

e . .

I  : t M I & (, 1 0'~e '

N of e., M '. - hoclTct Faer o+2 e

Rom , K. L, HtN ec & ut l P co e c.V M.unnyen Fc,;j+ s+, V < ct i n T 1 d _

dQ CG cu m< A

"~

TL. w hcud b& J c,cu m < &

hr tocew poJ,ded b % e.

F u '. a < L h v ie. c- go my n Colomd o e L a cc.-d a ne_e.

" w& N fE' it C64 Ice _Le.4-c Ho,+3 3 me r e y e d thd-

,on wo m 6 -e. c.o y e 4v

. -k e M R C. oc A L ocu\ PO Ws

%,1. Mci-~

D 3 870306 P h K 05000267 PDR 2 ,

A

,-l

-m+

. _ . . _ . , . . . . . . . . , _ _ _ . - . - , , .. . _. .. . = , -

.- 1 s g-

.~ j ' Y s,

f #" \

/ ENCLOSURE 1 SAFET[/. EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION

,/

. RELATING TO STEAM LINE RUPTURE DETECTION AND ISOLATION SYSTEM l

PUBLIC SERVICE C0F.PANY OF COLORADO

[ j FORT ST. VRAIN NUCLEAR GENERATING STATION  !

DOCKET NO. 50-267 (, /

, sd ~

l.0 I_NTRODUCTION AND SYSTEM DESCRIPTION By letter dated June 4,1986, Public Service Company of Colorado, the l licensee.for the Fort St. Vrain Nuclear Generating Station, has proposed to install a Steam Line Rupture Detection and Isolatior$ System (SLRDIS) j designed to detect rising temperatures in both the reactor building and L turbine building which will result from postulated breaks in high energy lines and initiate mitigating actions. Upon detection of rising tempera-tures in either building, the system will 1) initiate a reactor scram, .

. 2) trip the helium circulators in both primary loops, and 3) initiate clo-

! .sure of the valves in the secondary side high energy lines-in order to isolate them. Isolation of these lines within the specified time frame prevents further escape of high energy fluid in order to preclude an environ-mental condition which could adversely affect equipment required to bring the plant to a safe shutdown.

g (' '  ; ,

, .- .. )

. sensnr is a thermistor which cont. tins resistance ripidly with increaws in temperature. Each thermis:or is 200 feet long, and is coile d into three or four. wire loops. One thermistor in each resctor building sensor loop is l

located near one of the four walls of the building, with a similar arrange- 1 ment in the turbine building. Signals from.one thermistor loop in the

. .. 1 reactor building are fed into the "A" detection rack while signals from the other themistor in the second loop are fed into the "B" rack, and similarly for those in the turbine building. A high energy line break of sufficient magnitude in either the reactor or turbine building will heat the themistors, thereby reducing their resistancesto a point at which a signal will be generated causing isolation of high energy secon-i= dary side lines. Simultaneously, all four helium circulators are stopped.

-Isolation will occur if the resistance of at least two of the four ther-I mistors in two detector racks for either building are affected by the rate L

'of rise of the environmental temperature. A signal from only one thermis-tor will result 'in a low-level pre-trip alarm and a rate of rise alarm. A L

signal from both the "A" and "B" detectinn racks is required to initiate f isolation valve closure. There is also a trouble alam in the event of a

~

thermistor short-circuit or open-circuit condition.

f, The SLRDIS is designed to detect and isolate breaks in the main steam, hot and cold reheat steam lines where the break flow is equal to or in excess of that equivalent to 2% of a full offset break flow. It is expected that a break in either the feedwater, condensate, auxiliary steam, or extraction steam line will not release energy in sufficient quantity to cause the SLRDIS to isolate the secondary side high energy lines. For these line

~7

.. ..=

b< 3 p , r._ _ -b

.fl:

_y 't in (

h .6 '.J s a 0 ,

braaks,.the> pre-alarm _ trip sii;nal {! 35' F) will' ,t l.Jrt ' t h" i.;w.itors. to t .le nocessary cUrrective actinns manually. !w .tddi t ion. th bo osee propm.d

-b

' ~ Jtn maintain fur.ctional capability of the tem;mrature elebtints and tempera-1 ture alarms of the existing Steam Pipe Rupture Detection System (SPRDS) as.

an additional _ system to alert the operator to a pipe rupture which may not cause the SLRDIS to react. The licensee conm tted to_ reasonably maintain

~

and test this instrumentation consistent with similar instrumentation i including periodic calibration (o'nce per refueling outage noc'.to: exceed.

u I = 18 months) and corrective maintenance in a reasonable time interval; this F-p instrumentation, however, will not be covered -by Technical Specifications.

SLRDIS operability is ensured by the Technical Specifications.

2.0 EVALUATIONJ 2.1 Single Failure The staff has reviewed the capability.of the SLRDIS to perform its function in the event of a single failure. A single thermistor-can .

fail in an "open" or "short" condition; this will cause actuation of a trouble alarm. Alternatively, a failure of a single thermistor de-tection loop would change the SLRDIS actuation logic from 2-out-of-4 to 2-out-of-3 for initiation of the isolation signal. While this is not desirable, the time of thernistor inoperability is limited by the Technical Specifications 50 as to minimize operation without a full complement of operable thermistors, i

f. < ? ?M

(.in '.4

.a ..

A-

n. .w iri -- --

- . - . . . . . . . . - _ _ - - - _ _ - - _ ~ - - - _ - - _ - - - - -

(

:y i.'

.r-.. ...

O '. .,.'

pJt{

-iha Sl WI S d. t .n.t inti ' racks t.hmawives fail in a -narm.tr whid: inne r.U.es .

4 o _ spurmus ' signal . In such an ev.nt, while an alarm is rc.:eivec, isolation of the lines ernnitored by the SLRDIS wi11 not, occur until a

-signal is received from the'other rack. Atsingle-instrument--bus failure will incapacitate either the "A" or "B" logic .in both ~ racks and change the sensing logic to 2-out-of-4 in each' rack to 2-out-of-2.

~

Such a condition would permit SLRDIS actuation. However, the 'techni-s

. cal specification 3 severely limit operation with half the.thermisters

'e d ' . .

' disabled as would occur on failure of instrument bus. Further, the racks are equipped with a self-test . system which continuously monitors the online status' of the rack, and will alarm.a failure upon detection.

The above design features ensure that the SLRDIS function is not lost.

even though a signal from both racks'is required for valve closure.

The staff, therefore. finds that the SLRDIS' design assures its' proper function in the event of a single failure.

2.2 SLRDIS Actuation as a Result of Accidents other than a High 2nergy Line Break The staff performed a review to determine the impact on SLRDIS of accidents, other than a high energy line break. For the design basis maximum credible accident, in which the primary coolant (helium) is emitted from a ruptured 2-inch pipe leading -to the helium purifica-tion system from the Prestressed Concrete Reactor Vessel (PCRV) head, the licensee determined that the SLRDIS would not be actuated, nor would this accident create a harsh environment.

t'~~

0(N

.k? D P s

.,, '~

0~

-%. 4. k-Vx '~  ::;

O f

purification system from _the Prestressed Concrete Reactor-Vessel (PCRV) head, the licensee determined that the' SLRDIS would not be actuated, nor Would this accident create a harsh environment.

i For Design Basis ' Accident No. 2 invo'lving a~ failure of both closures in the bottom head access penetration, the temperature in the -reactor building may rise rapidly to 600F, tripping the SLRDIS in the process.

The original accident analysis assumed that' forced circulation cooling

would.be interrupted for five minutes until' automatically reestablished by the use of feedwater and- the 'Pelton drives- on the helium ' circulators.

The'~ licensee' reanalyzed this accident to allow a delay time of 60 minutes for. the operator to restart the forced circulation cooling.

The licensee also noted that a fire could activate both of the SLRDIS detection racks, resulting in isolation of the high energy steam lines and interruption of forced circulation cooling. Some of the valves closed by-the SLRDIS are included in the Fire Detection Shutdown System and must be reopened within- 90 minutes to permit forced circu-lation cooling ~. The licensee stated that both the plant and the p SLRDIS designs permit the reestablishment of forced circulation cooling ii

. under these circumstances.

I r

The licensee further noted that an inadvertent trip to either SLRDIS detection rack as a result of hardwere failure nr operator crror wnld eat 't.f:/ only nne of the twn trips signals required ?o ac tiva te

'll *A A r *w 6: I MP

_ ..m__-.--..-.__.___------------- - - - - - - . . -

x . - , .

6 g m W

-6.  ?.

t -

L .. . ,

oL

,the.SLRDIS. In'this case, only an alarm ~ annunciation would occur as

previously. discussed. During surveil. lance or maintenanc'e on the

~

final output relay trip-logic, a short-circuit caused by operator error could result in an inadvertent operation of the valves in a single SLRDIS loop an'd subsequent tripping of th'e-helium circulators in'that loop. The other primary cooling loop, however, 'would continue to function.

.c,

. In addition, the' licensee conducted analyses to confirm that neither the building heating systems-nor loss of HVAC systems would affect building temperatures'in a-manner which would activate the SLRDIS.

~

The staff, therefore, finds that the licensee has adequately considered

.the impact of other accidents on the SLRDIS and confirmed appropriate operability'of:the system for those events.

2.3 :D_iagnosis of Event r

The staff reviewed the means available to determine the event l occurring in order to ale'rt'_the operator -to a possible SLRDIS actuation. The

-licensee noted that a number of indications are provided which world -

aid the-operator in diagnosing the particular event takinc place. If PCRV pressure is not. decreasing the event is not a primary coolant leak. : Shift personnel wnuld be able to-inform tha control room if a fire, localized stear: leak or surveiilance test had can.su; the SLRDIS

[.M.* /t ; y

<* mb ) )

w- ey- y- o c- -

y -7

s

., y . !* p '

s y L . . . .

to trip tr ob se rv.i' i em in 'L me. N mie detector- .u. t it ,m pression syster, actuation v.ould i r at i r.' !.e t he presena of a fir.

The SLRDIS detection rach provide indication of the specific channels and zones which have tripped. Indications of only localized high building temperature would be a sign that a major steam leak had not occurred. The staff, therefore, finds that adequate means are avail-able to assess the causes of SLRDIS actuations.

2.4 Effects of Water and Steam Hammer The licensee reported that a portinn of the boiler feedwater system had been reanalyzed to determine the ef fects of closure of the isola-tion valves to both steam generator loops as a result of SLRDIS actua-tion. The licensee stated that while SLRDIS actuation may result in

, a fluid transient, and consequential dynamic responses in excess of manufacturer's rated loads on certain restraints, the boiler feedwater system piping pressure boundary will be 6dequately maintained. The f

staff, therefore, finds that the effects of water and steam hammer have been properly considered in the design of the SLRDIS.

3.0 CONCLUSION

Based on the above, the staff concludes that the SLRDIS meets the require-ments of General Design Criteria (GDC) 20 for design of engineering safety feature detection and actuation systems and the requirements of GDC 4 L s f',

I

r Nt

~S

- 1, in, ' .

or assurir:" pian *. :Mety t ollowinq postoli:ted pipe breah. Thur, th-sys ten i<, c. p.itil. rei ensurtral that environinental coralitiens eithin the reactor (!nd turbine buildings will not exceed the accepted essenti41 equip- ,

l ment environmental qualification envelope following postulated secondary l side high energy line breaks. The staff, therefore, finds the SLRDIS to be accepta.ble.

jdTT q p

^# 5 ,

e

.e

_ _ _ _ _ _ - - -