Text

Fort St Vrain Safe Shutdown from 82% Power, Technical Evaluation Rept
	ML20234C609
Person / Time
Site:	Fort Saint Vrain
Issue date:	06/04/1987
From:	Ball S, Moses D; OAK RIDGE NATIONAL LABORATORY
To:	; NRC
Shared Package
ML20234C612	List: ML20234C609; ML20235F508; ML20235F515; ML20235F528; ML20235F544;
References
	CON-FIN-A-9478 NUDOCS 8707060564
	Download: ML20234C609 (17)
	v • d • e

'

Enclosure 4 I

l 1

I TBCHNICAL EVALUATION REPORT FORT ST. VRAIN NUCLEAR GENERATING STATION DOCKET 50-267 i l

LICENSEE: PUBLIC SERVICE CO. OF COI4RADO l 1

FORT ST. VRAIN SAFE SHUTDOWN FROM 82% POWER l

PREPARED BY:

S. J. Ball D. L. Moses Oak Ridge National Laboratory Oak Ridge TN. 37831 June 4, 1987 NRC Lead Engineer: K. L. Heitr.er ,

Project: Selected Operating Reactors Issues (FIN A9478)

- -~ %

( ', .

< 8707o$oggy l9g -

~

i I

l i

l l

l

- - - - t*****************

NOTICE f This report was prepared as en account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumed any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report or represents that its use by such third party would .

not infringe privately owned rights, s****************************************************************************

~

Technical Evaluation Report - Fort St.' Vrain Safe Shutdown From 82* Power S. J. Ball D. L. Moses

1. Introduction ORNL has provided technical assistance to NRC in their evaluations and I analyses of issues raised in Fort St. Vrain's 1987 Power AscensionO Plan (P-87038).

Public Service Co. of Colorado (PSC) assertion that for long-term operation at l

' 35% power, a safe shutdown could be achieved even if all equipment exposed to a harsh environment in a worst-case high-energy line break (HELB) scenario were e.ssumed to fail.

From these studiss it was concluded that, for a worst-case permanent loss ,of forced circulation (LOFC) event, a long term cooldown 1 using only firewater coolant in the PCRV liner cooling system (LCS)Inasaddition,the ultimate heat sink would not result in significant fuel failure.

restart of coolant to the LCS after postulated prolonged downtimes would be both feasible and acceptable.

Upon successful implementation of the steam line rupture detection and isolation system (SLRDIS) at FSV, it was determined by analysis that the long term reactor power should be limited to values below 100%. This is due to previously undetected limitations in the shutdown cooling systems designed for use in emergencies. Because of the inability to simultaneously flood all six l

of the reheater sections of the steam generators in a loop (at least with the present flow capacity and piping arrangements), reheaters can no longer be counted on for emergency cooldowns following postulated 90 min duration LOTC events. If hot helium coolant from the core (following restart of .

circulation) were not cooled by the reheater bundles in several modules, the hot gas could impinge on the economizer-evaporator-superheater (EES) sections' tube bundles and cause failure of the tubing. Consequently, PSC' requested a change in the 7echnical Specifications to eliminate reliance on the use of the reheater sections for Safe Shutdown Cooling (P-87002).

A series of PSC analyses were submitted to NRC that justified long-term power operation at power levels between 82* and 87.5%, depending on which accident scenario was postulated. In the Environmental Qualification (EQ) case, it was claimed that 87.5% power operation could be justified by relying on only one firewater pump supplying coolant to only one of two (redundant)

EES sections (i.e., all six EES modules in one loop) following a 90 min LOFC event. The EQ event postulates only the use of equipment which is qualified to withstand the design basis earthquake, the maximum tornado and the most l

limiting HELB. In order to meet this goal, it was necessary to install two (one per loop) 6 in, vent pipes from the EES sections to provide for single The other failure proof venting during the once-through cooling mode.

scenarios involved only the use of equipment qualified to survive and operate 1

1 1

l 1

4 l

l l

1

. l following fires in non-congested cable areas per 10CrR50, Appendix R. For such fires, the emergency cooling flow sources can successfully accommodate cooldowns from power levels up to 83.2%. In January 1987, PSC formally requested permission to operate at power levels up to 82% (P-87038).

The ORNL technical assistance provided was mainly in two areas. The first involved confirmatory analyses of various scenarios using accident codes developed under both RES and NRR sponsorship. The second involved a detailed I review of the ability of the existing systems to supply sufficient ' water flow l to the helium circulator Pelton wheel drives and the EES sections of the steam. j generators during'the cooldown scenarios. Two other smaller tasks were

, included, investigations of possible structural and metallurgical failures le the steam generators (R. C. Owaltney), and an assessment of the potential for water hammer upon restart of coolant flow to' the hot tube bundles (C. R. Hammonds). A brief letter report on the latter of these smaller tasks j is provided in an attachment. i

2. Accident Scenario Analyses

{ 2.1 ORECA Code The original version of the ORNL ORECA code for simulating RTGR core i dynamics is described in ORNL/TM-5159 (1976). . Subsequent updates appeared 1 periodically in RES quarterly progress reports, and a detailed writeup on the ORECA code family was submitted to NRC in February 1985 as part of an -

assessment report of all ORNL HTGR accident codes. This latter report described three versions of ORECA: severe-accident- and " verification" versions of FSV simulations, and a source term study versioh for the 2240-MW(t) HTGR design. The ORECA-FSV versions have been used extensively by many different users in many different types of analyses, and have been verified for a variety of transients by comparisons with both plant data and other independent analyses. ORECA is considered to be a "best estimate" code; conservatisas are accounted for by means of sensitivity analysis.

The ORECA code used for this task was a modification of the severe accident sequence analysis (SASA) version. The modifications included an addition of a model of the flooded steam generator EES section, and a model to pred!ct stagnation or reverse flows within the worst-case refueling regions.

The latter feature had been developed as part of ORNL's assessment of PSC's proposed changes to the Tech Spec L.C.0. 4.1.9, which deals with concerns about fuel overheating in low-flow. low-power operating modes.

2.2 Model and Parameter Assumptions Specific input data for the analyses were provided by PSC and GA. The major assumptions used for the reference case were as follows:

2

._1_ _ -_ _ a..at..A ._ ' ' . _ _ _ _ _ _ - ..__ -_-

, ?

1. Equilibrium core region peaking factors (Max. = 1.83).

2. Maximum allowable region outlet temperature dispersions (during operation) consistent with 140 4.1.7. (The maximum mismatch value provided

[100 F) was increased by 50 F to allow for region outlet temperature measurement error.) Orifice positions were assumed fixed for the duration.

3. Long-term operating power (before shutdown) of 87.5*. This corresponds to the E0 case.

4. PSC-supplied estimate of EES cooling water flow (940 gps) following the l 90 min 14N. The helium coolant flow was assumed to be " manually controlled" l to limit EES water outlet temperatures to 250 F to prevent boiling. The capabilities of the Pelton wheel drive were not limiting.

1 5. EES (water-cooled) initial performance characteristics per GA's I SUPERHEAT code. The subsequent EES performance (with varying inlet temperatures and flows) was calculated using the ORNL code AWHEXI.

6. Flow to the 14S is not available for the duration.

2.3 Analysis Results l

ORNL analysis of the reference EQ case accident scenario resulted in predicted temperatures quite close to those provided by PSC. The ORNL predicted maximum fuel temperatures were somewhat lower than those. of PSC, .

while the mean core outlet temperatures were slightly higher. The ORECA '

maximum fuel temperature was 2560 F (1405 C) vs 2858 F (1570 C) per PSC, hence indicating less likelihood of fuel damage. The ORECA maximum average core ,

outlet gas temperature was 1625 F vs. approximately 1500 F per PSC. The - '

corresponding primary system pressures predicted were 425 psia (ORNL) vs.

325 psia (PSC) at the time of maximum core outlet temperature, so overall, the >

1 potential for damage to the (dry) reheater tube bundles would be somewhat 3

greater for the ORNL predictions. Comparisons of the results for . maximum fuel and average core outlet gas temperatures are shown in Fig.1, and.for primary system pressure response in Fig. 2. The " manually-controlled" values of primary helium flow are shown in Fig. 3, where the ORECA predictions give somewhat lower allewable flows to prevent boiling in the EES tubes.

Calculations of intra-region flow redistributions in the worst-case regions showed that there was no intra-region flow stagnation (or flow reversals) during the cooldown.

Sensitivity analyses were also done to assess both calculational and operational margins for error. For an assumed 20% reduction in the available EES cooling water flow, the predicted maximum fuel temperature was only 2685 F (1475 C), still well below temperatures causing significant failure rates. Variations in the heat transfer performance of the water-cooled EES were made within reasonable bounds, and had very little impact on the resulting peak temperatures predicted, as did the assurption of ISS failure.

Various assumptions about the response of the operators in controlling helium flow were also found to be unimportant, although the assumption of a failure to avoid boiling and subsequent choking of the flow was not evaluated. It is 3

l l

1

,1 -

1 l

reasonable to assume that the recovery time from such a complication (shutting off the helium flow temporarily to reestablish EES water flow) would not be excessive.

Another assessment of the " safety margin" available was done by compounding several uncertainties and/or conservative assumptions to see what it would take for the predicted maximum fuel temperature to approach 2900 F (1600 C). In this case, power for the EQ case was increased by 5% (to 91.9%) to account for measurement error, EES cooling water flow was decreased by 25% (to 705 gpe), and the restart of forced cooling was delayed an additional 20 min. (to 110 min). The resulting peak fuel temperature was 2830 F (1555 C), with some refueling regions experiencing reversed flow. The maximum average core outlet temperature predic'ed was 1730 F. This indicates that substantial margin for error is available before there would be any concern for significant fuel damage.

Calculations of the " Appendix R" reference case, with power limited to 83.2% and EES open loop cooling water flow limited to 700 rps (P-87158),

showed even milder transients than did the E0 cases. The maximua predicted fuel temperature temperature was 2460 was 1650 F. F (1350 C) and the maximum everage core outlet gas

3. Water Supply to the Helium Circulator Pelton Wheels and Steam Generators 3.1 Introduction and Background '

This portion of the technical evaluation is directed to resolving restart dssues arising out of Reportable occurrence (RO) 50-267/86-026 and related to t.be adequacy of the seismically qualified Class I Safe Shutdown Cooling Systes at Fort St. Vrain. The adequacy of the Class I water supply for Safe Shutdown i Cooling was initially brought into question as the result of deficiencies identified during startup testing as reported in tJnusual Event Report (UER) 50-267/76-05. The particular deficiencies identified in both UER 50-267/76-05 and Ro 50-267/86-026 relate to the provision of facility firewater to Class 1 piping in the Fort St. Vrain secondary cooling systes.

To accomplish Safe Shutdown Cooling, Cletss I firewster has to be supplied with sufficient pressure and flow rate to drive one helium circulator water turbine at required speed and to flood one section of the steam generator economizer-evaporator-superheater (EES) with sufficient cooling capacity to maintain the maximum fuel temperature below 2900 F. In addition, Safe ,

l Shutdown Cooling should prevent the surface temperatures of the steam generator tubes and of the helium circulator components from reaching values that could challenge reactor coolant boundary integrity or the capability to perform long-term cooling. Similarly Safe Shutdown Cooling should preclude primary system pressure from increasing to the point of lifting the safety relief valves. The sufficiency of the Class I firewster supply to the steam generator EES is dependent on the backpressure in the steam generator, and the 4

w

I

. .- t 1

EES backpressure is a function of the downstream piping resistance to EES i

outlet flow and of whether boiling occurs in the EES tubing after forced l cooling of the reactor core is restored. l l

The two steam generatcr EES sections are the only primary system heat exchangers capable of supporting Safe Shutdown Cooling. This observation is based on the recent finding, as reported in RO 50-267/86-020, that the resistance in the firewater flow path to the steam generator reheater sections was too high to permit adequate flow for Safe Shutdown Cooling. Previously, Updated FSAR Section 10.3.10 had claimed that the two reheater sections each provided a Class I firewater cooldown capability from full power conditions and that was fully redundant to the EES cooldown espability on firewster.

Recent analyses reported in Attachment 4 of P-86682 indicate that firewater cooling through a single reheater section module (where one module of six in each section is the most that can be flooded) will provide effective Saft Shutdown Cooling capability only from 39% of rated reactor power and with a 90 minute interruption of forced cooling.

As reported in UER 50-267/76-05A (final supplement) and more recently amplified and clarified in the licensee's response to a request for additional information (PSC Response 6, Attachment to P-87110), testing in 1976 demonstrated that each circulator could apparently be driven at speeds exceeding 700 rpm with 1000 rpm or more supplied to the steam generator ECS.

This was achieved by:

(1) fully opening the bypass valves PV-22129 and PV-2229 in the lines from the EES outlet to the bypass flash tank and pre-flash tank, respectively, thereby reducing EES backpressure to 50-60 psig; and (2) by physically modifying the discharge flow paths in several valves )

(RV-21257 through HV-21260) upstream of the Pelton wheel water turbine to reduce pressure drops and thereby increase flow capacity to the respective water turbines. i 1

1 h'o testing was performed to quantify reheater flooding with simulated firewater in the 1976 tests. Preoperational testing in 1973 had identified limitations to reheater flooding on condensate, but the results of the preoperational tests and analysis were not effectively documented. There fore, the simulated firewster tests that are reported in UER 50-267/76-05 did not include tests or analysis of reheater flooding because the potential problem had not been recognized by PSC.

However, a related event, described in UER 50-267/76-09, identified the fact that the initial analysis of the firewater cooldown had used nominal instead of design power peaking factors. To prevent flow reversal or flow stagnation in the reactor core during the firewater cooldown from power levels greater than 70% of rated, UER 50-267/76-09B indicated the need to install emergency 5

. E 1

water booster pumps in the piping insediately upstream of the circulator water turbine so as to increase primary system helium flow from an apparently achievable 2% to between 3 and 44. Subsequently, NRC imposed the requirement to assume a 90 minute delay in establishing firewster flow and Safe Shutdown Cooling following the Design Basis Earthquake or Maximum Tornado (the Class I events).

In September 1986, as noted in RO 50-267/86-026, a reanalysis of the design basis Class ! Safe Shutdown Cooling transient (Updated FSAR Sections 10.3.9 and 14.4.2.2) was performed in support of Environmental Qualification. Per the licensee event' report, the reanalysis indicated:

...that restart of forced circulation at 3% of rated, approximately 1-1/2 hours after a scram from 105% power, will cause steaming and a large pressure increase in the steam generator EES and discharge piping. Under these conditions, secondary flow would be significantly reduced due to the limited capacity of the firewater pumps. Due to this reduction in secondary coolant ficw, the heat removal rate computed in the r$AR analysis would not be achievable.

More recently, the confirmatory analysis (Attachment 1 to P-87053) of other

, FSAR cooldown transients has shown that the original TSAR analysis of the Class I Safe Shutdown Cooling transient assuming an immediate start of firewater (i.e., without assuming the 90 minute delay as currently required) also overpredicts the firewster heat removal capacity through the EES by at ,

least a factor of two, specifically, an assumed 180 x IOS BTU /hr in the original most analysis recent versus an apparently achievable 86.7 x 10* BTU /hr from the analysis.

For the case of the 90 minute delay In restoring forced cooling (i.e., the current design basis Class I Safe Shutdown Cooling transient), the limiting heat load is stated to be 73.5 x 108 BTU /hr in attachment I to P-87053; howeve;. the achievable firewster heat'ramoval capacity is not provided for khe 90 minute delay in restarting forced cooling.

It should boiling in be thethe EESsame ones the steam generator EES is pre-cooled to prevent tLoes.

~

I Thus, the attempted resolution to UERs 50-267/76-05 and 50-267/76-09 were 1 inadequate because the associated testing and analyses did not adequately address secondary side pressure and flow conditions that must be attained in

. the EES during Shutdown Coolingboth the original and the current version of the Class I Safe scenario.

Also, the attempted resolutions to both of the 1976 UERs using firewater. failed to address the cooling capability of the reheater sections Therefore, this portion of the technical evaluation assesses ,

the adequacy of the recent calculations submitted by PSC and the need for further analysis or testing. As indicated previously, this technical .

evaluation focuses on the performance of the Class I Safe Shutdown Cooling system in accommodating the Design Basis Earthquake and Maximum Tornado (Updated TSAR Sections 10.3.9. and 14.4.2.2).

6

. ~

9 3.2 Review of the New Class I Firewster Flowpath Calculations in Recent PSC Submittels

)

The results of PSC's recent analysis have been documented in several submittels.

i The cover letters to the PSC submittals use the terminology " Safe

! Shutdown Cooling" to refer to the scenarios addressed in the various sets of subcontractor calculations that are attached to these documents. These either the reactor or turbine building and following major fires noncongested cable' areas.

Emergency core cooling following the design basis Qualification per 10CTR50.49. with the analysis to address Environmental seismic event is incorporated Attachment 4 to P-87002 provides the safety analysis supporting a proposed change to the Fort St. Vrain Technical Specifications. This change is to eliminate reliance on the reheater section of the steas generator for Safe Shutdown Cooling and to require instead full reliance on the EES section for

! the firewster cooldown from power levels up to 82% of rated reactor power .

Adequate firewater flow to the EES section of one steam generator and to one EES backpressure with the use of seismically qualified s the eteosphere from each EES discharge header. In addition, as shown in Figure III-l of Attachment 4 to P-87002, a new seismically qualified (Class I) firewater and flow path the emergency has been condensate installed between the firewater discharge header header.

valves that have been installed for remote operation outside the turbineThe break in that building. building in order to avoid a harsh environment in case The new firewater piping to the emergency condensate header meets both the seismic and environmental (10CFR50.49) qualification requirements for Safe Shutdown Cooling.

Analyses presented in Attachment I to P-86683, Attachment 2 to P-87055, and the Attachments to P-87171 have been submitted by PSC to demonstrate the firewater supply capanility for the new Class I firewater flow path. The Attachment using condensate to P-87171 includewater to drive a circulator the results turbine. of a simulated firewater flow; This test and an ;

accompanying sensitivity analysis were submitted by PSC to demonstrate an !

! adequate capability to produce a primary system helium flow of 3.8% of full load at a firewster flow that is less than that which is estimated available. to be ;

Sensitivity analyses show that increasing flow to the EES section does not significantly degrade the suction pressure and flow available to the emergency water booster pump upstream of the circulator water turbine drive. I The firewster flow analysis and the flow sensitivity studies were performed using a computer code developed by Proto-Power Corporation and described in Attachment 6 to P-87055.

The theory and methods used in the pressure drop 1 I

7 \

l l

c j l

l J

l program have been reviewed and appear to be both reasonable and consistent with other steady-state methods for flow and pressure drop calculations. j The same Proto-Power Corporation computer code described in Attachment 6 to P-87055 has also been modified and used, as reported in Attachment 9 to P-86682, to calculate the EES flooding time for pre-cooling the EES to subcooled outlet flow conditions prior to restart of the helium circulators on {

water turbine drive. As discussed in Attachment 9 to P-86682, the firewster !

flow and pressure drop computer code was solved iteratively in a quasi-static manner with a heat transfer code simulating the EES tube thermal performance.

The quasi-static analysis yielded a 14 minute floodiv time for the EES. The flocdir.g time was reported to have been conservativuy confirmed by a calculation by GA Technologies as cited in PSC response 7 in Attachment I to i P-80 55. As discussed in the Ai.tachments to P-86682 P-86683, and P-87055, CA Technologies reportedly checked the steam generator steady-state flow and

)

pressure drop results with the S11PERHEAT code. Also, as discussed in Attachment 5 to P-86682. GA perfonned limited checking of other steady-state I firewater flow calculations, but not the Safe Shutdown Cooling flow path, using the SNIFFS flow network computer code and hand calculations. Since no complete set of alternate calculations are available for either the steady-state firewater flow caleplations or the EES flooding (pre-cooling) {'

time calculations, we recommend that NRC should perform an audit of the Proto-Power Corporation calculations. Such an audit is needed to assure that the' type of problems with inadequate verification checking encountered in .

LIERS 50-267/76-05 and 50-267/76-09 does not recur for RO 50-267/86-026.

In Attachment 4 to P-87002, PSC states that the new Class I flowpath also meets the single failure criterion for both active and passive failures. To accommodate a single passive failure Attachment 4 to P-87002 addresses reliance on the original firewster flow path in System 45 (the Fire Protection System) that is the basis for the Sefe Shutdown Cooling results reported in FSAR Section 10.3.9, 10.3.10, and 14.4.2.2. In Attachment 4 to P-87002, the firewater system flow is assumed to be routed to the emergency feedwater header to accommodate a single passive failure, but the requirement to use this flow path is based on a single passive failure that, consistent with NRC policy given in SECY-77-439, is assumed not to occur until. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after emergency cooling has been initiated. This alternate flew path has not been analyzed in calculations subaitted by PSC.

Active single failures in the preferred new flow path, as illustrated in Figure III-l of Attachment 4 to P-87002, are assumed to be If.mited to " failure to function of an electrical component of the two valves (EV-4518 and RV-4519) in the (new) line (that) can be compensated for quickly by a manual action in a mild environment." Mechanical failures of these valves failing to open have not been addressed.

8 f

Ia

i e

'. j

- 1 I

I If either HV-4518 or HV-4519 were to fail to open, alternate flow paths exist .

via the firewater system to either the emergency condensate header supply or ]

the emergency feedwater header, which was alluded to above. The alternate !

flow path to the emergency condensate header is the original preferred !

flowpath for Safe Shutdown Cooling as described in FSAR Section 10.3.9 and 14.4.2.2. A review of the recent PSC analyses that use this original flow path is presented in the following section of this report.

l 3.3 Review of the Original Class Flowpath Calculations in Recent PSC Submittels ,

i There was no attempt to clarify in the recent PSC submittals that the original FSAR Class I cooling configuration is most closely analogous either to the

" emergency cooling with EES using firewater pump (open loop)," as shown in i Fig. A-1 of Attachment 5 to P-86682, or to the " firewater flow diagram for Appendix R Train B case, open loop " as shown in Fig. 2.4 of Attachment 2 to P-85055. Both of these configurations represent firewster supply via the coergency condensate header as assumed in the Class I performance and safety analysis reported in Updated FSAR Sections 10.3.9 and 14.4.2.2.

In the configuration cited in Attachment 5 to P-86682, about 100 rpm of fluid is assumed to be vented to the atmosphere via an electromatic valve (PV-22162) located downstream of the steam generator EES, and the rest of the flow is ,

l vented to the condenser through the desuperheater and flash tank. Per FSAR -

Section 10.3.9, the original Class I event scenario assumed venting from j ruptured non-Class I piping downstream of the steam bypass valves to the i desuperheater. The licensee did not specify which of these configurations presents the higher backpressure to the steam generator EES and thereby produces the lower flow from the firewater supply system; however, use of the newly installed and seismically qualified six inch vent lines off the EES outlet piping to the atmosphere allows for lower EES backpressure. The maximum fuel temperature calculated in the recent analysis (Attachment 5 to P-86682) is 2511 F for a cooldown from 77.9% of rated reactor power. The firewater flow rate to the EES is calculated to be 829 gpa with an EES backpressure of 107 psia at the steam generator ring header and 87.3 psia at i the mainstream bypass valve (PV-22129). Water exiting the EES is subcooled.

Similarly, in the configuration cited in Attachment 2 to P-85055, flow throu'g'h the open loop (i.e., atmospheric venting via the newly installed six inch vent lines) lasts for only five hours, after which the loop is assumed to be closed in the Appendix R Train B Case (See Fig. 2.5 in Attachment 2 to P-85055). In the open loop configuration, the firewater flow is 996 gps, but is reduced to 789 gpm in the closed loop. The steam generator EES backpressure at the outlet is " controlled" to 76 psia (open loop) for the first five hours and 97.8 psia (closed loop) thereafter; presumably, the quoted pressures are at the steam bypass valve. The maximum fuel temperature is calculated to be 2644 F following shutdown cooling from a power level of 87.5%.

9

l 1

In addition, as reported in Attachment I to P-87053, the analysis of the l firewater cooldown from 83.2% of rated reactor power without an interruption in forced cooling indicated that the FSAR Section 14.4.2.1 values for maximum ,

i helium temperature (and thereby maximum fuel temperature) can be achieved with i 795 gpm of 80 F firewater flow against a steam generator backpressure of

. J 83.1 psia at the steam bypass valve. This result is analogous to that for' the j original class I firewster cooldown scenario with no delay in restoring forced l cooling, as assumed by PSC prior to the NRC's imposing the assumed 90 minute delay in 1978. As noted in Section 3.1 above, the firewater cooling capacity for this event should be the same as the current Class I firewater cooldown i scenario with the 90 minute delay in restoring forced cooling. The major difference between the analysis in Attachment I to P-87053 and the current class I event scenario would be core conditions and maximum helium temperature obtained after the 90 minute delay in restoring forced cooling of the core.

3.4 Findings and Recommendations The new Class I flow path, which was installed to meet the requirements for environmental qualifications of electrical equipment per 10CFR50.49, has been shown by calculations to provide a sufficient flow of fireweter following l shutdown from 87.5% of rated reactor power to drive one helium circulator at j up to 3.8% of rated helium flow and to flood one ERS section of the steam l generator with subcooled flow. This flow of firewster is capable of flooding I the EES in an estimated 14 minutes prior to restart of forced cooling of the i

reactor core following a 90 minute interruption of forced cooling. This flow '

of firewster has been calculated to maintain the maximum temperature below 2900 F and to prevent lifting of the primary safety valves. However, the analysis of the new flow path has not adequately addressed single active failures due to a mechanical failure to open either of the two new valves in the new Class I flow path. Only electrical failures have been addressed.

Thus, the original Class I flow path must also be addressed for Safe Shutdown Cooling.

Although the original Class I Safe Shutdown Cooling scenario (i.e., 90 minute delay in restoring forced' cooling via the emergency condensate supply header -

following the Design Basis. Earthquake or Maximus Tornado) is not exactly duplicated in any of the new analyses, the results from similar analy's es allow us to conclude that the original configuration for accommodating the Class I event can be utilized from 82% of rated reactor power without exceeding a maximum fuel temperature of 2900 F. PSC should perform an explicit confirmatory analysis of the Class I scenario to demonstrate that this is indeed the case for accommodating single active failures in the new Class I flowpath.

Also, with regard to meeting the single failure criterion, we conclude that a confirmatory analysis is needed to demonstrate the capability of the alternate 10

l r

flow path via the emergency feedwater header. As shown in Figure 4-la, Attachment 2 to P-87055, the maximum fuel temperature is calculated to peak below 2900 F at about five hours into the firewater cooldown using the new class I flow path. By extrapolation of the data in the cited figure, the ,

maximum fuel temperature would still exceed 2200 F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months into the firewster cooldown. This tendency to cool slowly is confirmed by the results given in Updated FSAR Figure 14.4-6 where these results are now recognized to l

' be non conservative. Therefore, confirmatory analyses are needed to assure adequate flow and continued decrease in the fuel temperature after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months assuming a single passive failure.

In add 4 tion, since the failure to r'esolve issues raised initially by UERs 50-267/76-05 and 50-267/76-09 can apparently be traced to unreviewed or inadequately reviewed analyses of the firewster supply capability, assurance should be obtained that current analyses comply with the provisions for verification checking in design control per 10CFR50, Appendix B Section III and ANSI /ASME N45.2.ll. Since design reviews are apparently the least effective measure for verification checking, as evidenced by the findings of RO 50-267/86-026, the use of independent checks by alternate calculations and of checking by comparison to applicable plant test data should be emphasized. 1 As indicated in Section 3.2 above, NRC should perform an audit of the !

I calculations performed by PSC and its subcontractors, particularly if design !

reviews have been the primary mechanism to achieve nominal compliance with IOCFR50, Appendix B and ANSI /ASME N45.2.11.

4. conclusions Results of the accident analyses indicate that for both the "EQ" and

" Appendix R" scenarios, (which are both low-probability events), there is substantial margin ir the existing emergency cooling systems to provide for a safe shutdown. The analyses assumed that suitable procedures and training would be in place to assure that the operators would first implement the appropriate cooling water supply, and then manually control the primary coolant flow to avoid steaming and choking in the EES. We recossend that NRC confirms that suitable procedures and training are established.

PSC's analyses of the seismically and environmentally qualified firewster flowpath for Safe Shutdown Cooling indicate that adequate firewater flow can be obtained to avoid fuel damage and component damage following shutdown from 82% of rated reactor power and assuming a 90 min delay in restart of forced cooling of the reactor core. Pre-cooling of the steam generator EES section with firewater is calculated to take about 14 min to ' assure subcooled firewater flow at the EES outlet after forced cooling is restarted. Based on results of other recent analyses, single active failures in the new Class I flowpath are judged to be accommodated by using the original Class I firewater flow path to the emergency condensate header. Single passive failures, which are assumed not to occur until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the firewater cooldown is 11

. l s

W initiated, are to be accommodated by an alternate flowpath through the emergency feedwater header, but specific analyses of this capability have not been presented by PSC. Based on our review of the PSC analyses and of previous reportable events related to the adequacy of the Class I firewater cooldown capability, we recommend that the following confirmatory actions be t aken:

l i

o NRC should perform an audit of the PSC calculations to confirm the adequacy of verification checking per 10CTR50, Appendix B,Section III. This action is necessitated by findings of inadequate verification checking from previous reportable events that should have been resolved by analysis of the firewater flow capability for Safe Shutdown Cooling.

o pSC should perform an explicit confirmatory analysis to demonstrate that the original class I firewater flow path accommodates a single active failure in the new Class I firewater flow path. The confirmatory analysis needs to address EES pre-cooling times and long term cooling capability.

o PSC should perform an explicit confirmatory analysis to demonstrate that the alternate flow path via the emergency feedwater header j accommodates a single passive failure in the preferred flow path via the emergency condensate header.

12

}

ATTACEMENT

' Internal Correspondence ,

UARTIN MARIETTA ENERGY SYSTEwS,INC.

March 25, 1987

[ S. ",J. Ball Fire Water Cooldown Induced Water Hammer in Fort St. Vrain Steam Generators

Reference:

" Analysis of the Capability of the Fort St. Vrain Steam Generators to Withstand the Fire Water Cooldown Transient Following an Appendix 'R Fire," Rev.1, NLI-86-0649 As you requested, Jack Dixon and I reviewed the portion of the reference document regarding structural effects of water hammer. The report was qualitative and brief, but we agree with the following two assertions.

1. Water hammer caused by the collapse of a pocket of steam surrounded by incoming cold water is unlikely due to the steam generator design.

2. Water hammer forces in the steam generator tubes are significantly reduced by the pressure wave restriction at the entrance to the tubes.

However, we do not have enough information to comment on the water hammer- '

like forces produced by the cooling water sweeping throuFh the steam

generator nor on the effect on the generator of an external pressure wave being largely absorbed at the generator tube entrance.

We have experience 10 calculating structural response to water hammer loads including fluid ente;ing a dry systee and in performing confirmatory analyses of power ret,etor piping systems for the NRC. If the NRC would like ;

to pursue this matter; further, we will discuss schedules and cost with you. '

If you have any questions, do not hesitate to contact ce.

C. R. Hammond,1000, MS-332, ORNL (4-6499) - NoRC cc: J. R. Dixon R. W. Glass T. W. P!ckel W. C. Stoddart file - CRH A

j N .4 N WE, M

. . - l

e

' j 4.,,.

I J

i

'" ~' '

f ' v . '. '( ti

~ ' A F' R E's F'o'it' 4.s '. - t 'v u '.e ' .',' u v v'.'.' .' ,'

1 3 . .

1

! I i j

?8 , - - -

' -I

/, \

l g I a 2-y ~

6 2.2 0 2___e g

eq / 1 gv 1.6 u l w$ #% 1

! _j% \

gc

$2

< r N N 1 g

,,_ ; a

\ N N N*

os i w 06

\

\ 1%.

O.4 - .

- 4 0.2 l o 2 4 6 8 !

i TlWE (HOUM) j Iks. Fuel Temp: ORECA O PSC 4 Core Outlet Temp: ORECA+ PSC A l

.s .

-v: g,v7t',~pp --~ r 7.- ~.--w m- * ~ - ---:-~---.- - ~ ~ ~ - - . . -

. ._ --_ = -__-_____ __ _ _ _

. ,4 s .' ' ' F 5. 2 PRESSURE PE5PONSE C0r00moes

?f 0 I

pan 1&*M~

t t q,', -* _ _ _

i-. '

_. .\ '! t i l 600 -. ,

k 550 .

?

. '( .

4 Y ,

D 1

$ 500 E

l n 450 -m9- em

% I 400 -

- w i

\

~

._._a MO^

0 2 4 6 8 T1WE (HOURS)

O PPfSSURE + PSC PRE 57URE 1

L l

FIG. 3 CONTROLLED PRIMARY FLOW EQ COOLDOWN 2.2 W i 1.8 ,

/

1.6

'^

??

/ /

y' 0.6 ig p/

g y

! 0.6 ---

0.4 0.2 1

0' ' "' '

O 2 4 6 8 l T1WE (HOURS) l C CRNLATOR FLOW + PSC FLOW

e

+. \

DISTRIBUTION E. Chan Docket No. 50-267 JR 2 i M dosk et File NRC PDR Wocal'PDR PD4 RF Mr. R. O. Williams , Jr. T. Murley D. Crutchfield Vice President, Nuclear Operations F. Miraglia F. Schroeder Public Service Company of Colorado J. A. Calvo P. Noonan )

P. O. Box 840 K. Heitrer OGC-Bethesda )

Denver, Colorado 80201-0840 E. Jordan J. Partlow l I

ACRS (10) South Texas Pf

Dear Mr. Williams:

W. Patton J. Jaudon, RIV J. Gagliardo, RIV E. Johnson, RIV

SUBJECT:

AUTHORIZATION FOR INTERIM OPERATION OF FORT ST. VRAIN AT 82 PERCENT OF FULL POWER 4 By this letter, the Commission is authorizing operation of Fort St. Vrain to ,

exceed 35 percent of full power. In accordance with the commitments contained in your letter dated January 30, 1987 (P-87038) which describes your power ascension plans, you are not authorized to exceed 82 percent of full power.

In support of your request to operate the plant at this higher power level, you have made numerous submittals as referenced in the enclosed Safety Evaluations. These submittals have been reviewed by the staff and by our contractor, Oak Ridge National Laboratory (ORNL). The evaluation performed by ORNL is summarized in their Technical Evaluation Report (TER) (Enclosure 4).

ORNL reviewed the flow of fire water to the steam generator and evaluated your thermal hydraulic analysis of the cooldown process. Their independent model cal-culations confirm that Safe Shutdown Cooling can be accomplished from 82 percent ;

of full power without fuel damage. The staff reviewed your analyses concerning ,

the behavior of the steam generator materials and structures during the Safe l Shutdown Cooling. The staff's evaluations have shown your analyses are acceptable (Enclosures 1 through 3).

Your commitments set out in Enclosure 2 to NRC's letter of April 6,1987 remain unchanged.

Sincerely, Original signed by 1'homas E. Eurley Thomas E. Murley, Director Office of Nuclear Reactor Regulation

Enclosures:

As stated cc w/ enclosure:

See next page ,

PD4 'X H PD4 '}{H b PD4 [ D s A% RR KHeitner:as PNoonan JACalvo F roeder DC tchfield FM1D lia 06/1r/87 06/ts/8 06/1!i/87 06 /87 %/(/87 87 Of OGC-Bethesda DP j@ . RR 06/ w/87 M J Dek

/87 urley

/ S /87 M.\co m f.w E /.p r h M. H U%te pM/hDfh ~

Q .

, Mr. R. O. Williams 4 Public Service Company of Colorado Fort St. Vrain cc:

Mr. D. W. Warembourg, Manager Albert J. Hazle, Director l Nuclear Engineering Division Radiation Control Division' j Public Service Company Department of Health l of Colorado 4210 East lith Avenue l P. O. Box 840 Denver, Colorado 80220 Denver, Colorado 80201 Mr. David Alberstein, 14/159A Mr. R. O. Williams, Acting Manager GA Technologies, Inc. Nuclear Production Division Post Office Box 85608 Public Service Company of Colorado 1 San Diego, California 92138 16805 Weld County Road 19-1/2 !

Platteville, Colorado 80651 l

Mr. H. L. Brey, Manager 4 Nuclear Licensing and Fuel Division Mr. P. F. Tomlinson, Manager l Public Service Company of Colorado Quality Assurance Division P. O. Box 840 Public Service Company of Colorado Denver, Colorado 80201 16805 Weld County Road 19-1/2 Platteville, Colorado 80651 Senior Resident Inspector U.S. Nuclear Regulatory Commission Mr. R. F. Walker P. 0. Box 840 Public Service Company of Colorado Platteville, Colorado 80651 Post Office Box 840 Denver, Colorado 80201-0840 Kelley, Stansfield & 0'Donnell Public Service Company Building Commitment Control Program Room 900 Coordinator 550 15th Street Public Service Company of Colorado i Denver, Colorado 80202 2420 W. 26th Ave. Suite 100-D l Denver, Colorado 80211 '

Regional Administrator, Region IV U.S. Nuclear Regulatory Commission 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 Chairman, Board of County Commissioners '

of Weld County, Colorado )

Greeley, Colorado 80631 Regional Representative Radiation Programs Environmental Protection Agency 1 Denver Place 999 18th Street, Suite 1300 Denver, Colorado 80202-2413 I

I

._m.

. s

/o .* sttog'o, UNITED STATES

. !" #% NUCLEAR REGULATORY COMMISSION

{ /o $ WASHINGTON. D. C. 20555

%, l Enclosure 1 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO SAFE EMERGENCY SHUTDOWNS (REACTOR SYSTEMS)

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION DOCKET NO. 50-267

1. 0 INTRODUCTION In Fort St. Vrain License Event Report (LER) #86-026, dated October 17, 1986, the Public Service Company of Colorado (PSC) reported that the Safe Shutdown Cooling System for removing the decay heat following the postulated " Design Basis Earthquake" or " Maximum Tornado" accidents was inadequate. PSC stated in this LER that if one of these two accidents were to occur while the reactor was operating at 105% power, and if, as postulated in Section 10.3.9 of the FSAR, the functions of all non-seismic, non-Category 1 components were lost and the primary helium coolant flow was assumed interrupted for 90 minutes to allow for manual realignments, the safe shutdown cooling system would be unable to keep the fuel temperature below the 2900* F limit.

Further this LER states that the analysis for the removal of decay heat by the Safe Shutdown Cooling System, "did not consider firewater pump capacity nor the associated steam generator inlet or discharge piping configurations."

For the corrective action in the LER, the PSC committed to reanalyzing this Safe Shutdown Cooling System and providing an acceptable methed to remove the decay heat and cool the plant without fuel temperatures exceeding 2900 F.

In the two-loop Fort St. Vrain plant each loop has six steam generator modules which have parallel secondary coolant flow paths. Each steam generator has two sections, i.e. , an economizer-evaporator-superheater (EES) section and a reheater section.

The reheater sections of the steam generators are much smaller than the EES sections; so their use seemed logical for removing the smaller decay heat load. However, the reheaters are designed for steam, not water, so their cross sectional flow area is relatively high. The consequence of this is that the firewater pumps have only enough flow capacity to flood one or two reheator sections, rather than all six as previously assumed. PSC's re-analysis showed that this partial flooding would not provide enough heat transfer area; so PSC concluded that the reheater sections should not be used for the Safe Shutdown Cooling.

Instead, PSC proposed to use the EES sections by initially venting them to the atmosphere. However, the available vent path was not redundant or seismically qualified, so new 6 inch vent lines had to be installed. Even YNVl$OSC& y

6 l

. with these new vent lines PSC found that the fuel temperature could not be kept below the 2900 F limit for the Safe Shutdown Cooling accident scenario from 105% reactor power.

PSC had analyses done to determine from what power level safe, emergency shutdowns could be accomplished for all of these accident scenarios. These analyses, which PSC submitted to the NRC, showed that, depending on the accident scenario, the fuel temperature can be kept below the 2900 F limit during emergency shutdowns after long-term operation at power levels up to and including 82 percent power.

2.0 EVALUATION The NRC had the Oak Ridge National Laboratory evaluate all of these sub- i mittals. The technical evaluation report (TER) on this evaluation is Enclosure 4. Three parts of the TER pertain to this Safety Evaluation (SE).

The fourth part, which is on possible structural and metallurgical failures l

in the steam generators, is the subject of a separate safety evaluation.

i The NRC staff has reviewed the ORNL TER and agrees with ORNL's evaluations l and conclusions, except as addressed below.

The first of the three parts is the evaluation of the calculations of the maximum fuel temperature that will be obtained after these postulated accidents. This evaluation was made by using the Oak Ridge developed ORECA computer program to independently calculate these temperatures. As can be seen in the TER the ORECA calculations show that 82% is a conservative power level for a limiting fuel temperature of 2900 F. We concur with this finding in the ORNL TER that the 82% power limit proposed by the licensee is acceptable.

The second of the three parts in the ORNL TER that pertain to this SE is the evaluation of the ability of the existing systems to supply sufficient water flow to both the helium circulator pelton wheel drives and the EES sections of the steam generators during these emergency cooldowns. The final con-clusion of this lengthy review is that for these scenarios, "there is substantial margin in the existing cooling systems to provide for a safe shutdown." This conclusion is contingent on several items, two of which with we concur and restate as follows:

1. There are operating procedures for these accidents and that the operators have been trained to follow them.

I 2. PSC should perform an explicit analysis to demonstrate that the original Class I firewater flow path can accommodate a single active failure in the new Class I firewater flow path when the required EES pre-cooling times and the long term cooling are accounted for.

Another contingency in the ORNL TER findings is for the NRC to perform an audit or do confirmatory analyses of the PSC flow calculations. However, the staff believes that with the satisfactory agreement between PSC's cal-

. , culated results and the results of the firewater flow test, which are i

' j 1

j i

l reported in Reference 2 and mentioned on page 7 of the TER, no confirmatory I analyses are required. (However, the staff has requested NRC Region IV to {

l perform an audit of the licensee's independent verification of these j l calculations.)

~

The remaining contingency in the TER findings and conclusions is concerned with a passive failure after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of cooling. However, PSC's calcu- ,

lations show that after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of cooling adequate flow can be obtained l from a redundant flow path. Based upon these calculations, the staff finds )

that a passive failure can be accommodated.

By letter dated June 24, 1987, the licensee has stated that: )

(1) operating procedures have been provided for the postulated " Design Basis Earthquake," " Maximum Tornado," and " Appendix R Fire" accidents and the operators are trained to follow them; and (2) all of the redundant firewater flow paths can accommodate a single active failure up to 83.2 percent power. (This includes EES pre-cooling times and long-term cooling.)

On this basis we conclude that the first, second, and fourth conditions j described above provide an acceptable basis to satisfying the requirements of the second part of the ORNL TER, and that the licensee has shown that i the existing systems can supply sufficient water duriing emergency ;

cooldowns.

The third of the three parts in the TER that pertain to this SE is the evaluation of the possibility of water hammer that would prevent these emergency cooldowns. The ORNL TER agrees with the licensee's con-clusions that a water hammer is unlikely because of the steam generator !

design, and water hammer forces would be reduced by the restriction of j the tube entrances. The staff further notes that steam generator i modules are designed for an inlet pressure of about 3180 psia fj (Table 4.2-7 of the FSV FSAR). By contrast, the firewater pumps have a total design head of only 140 psia (Section 9.12.3.3 of the FSV FSAR). l It is difficult to conceive how the low pressure output of the pump !

can cause damage to a system designed for over 20 times that pressure.

Hence, the staff concludes that it is highly unlikely that a water hammer will preclude a safe shutdown.

3. 0 CONCLUSIONS !

The staff finds that the Fort St. Vrain reactor can be shutdown after prolonged operation at 82 percent of the licensed power without having the i fuel temperature exceed the 2900 F limit. Thus the staff finds that l operation at 82 percent power is acceptable. !

l l

l

9

4.0 REFERENCES

1. SECY-77-439 dated August 17, 1979.

2. Letter from H. L. Brey, Public Service Company of Colorado, to J. A. Calvo, USNRC, dated May 4, 1987.

Principal contributor: E. Lantz, RSB Dated: July 2,1987 i

i

___------------i---_----m

E Enclosure 2 7

!v orog'o UNITED STATES l' q 7 NUCLEAR REGULATORY COMMISSION g

E W ASHINGTON. D. C. 20555 o

- - - - SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION l RELATING TO SAFE EMERGENCY SHUTDOWNS (STEAM GENERATOR MATERIALS)

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION LICENSE DPR-34, DOCKET NO. 50-267 l 1. 0 INTRODUCTION By letter P-87002 dated January 15, 1987, the Public Service Company of Colorado (the licensee) proposed to eliminate reliance on only the reheater section of the steam generator for safe shutdown cooling at the Fort St.

t Vrain Nuclear Generating Station. The change is necessary to support safe shutdown cooling from power levels above thirty-nine percent.

The licensee performed analyses confirming that one reheater section was not adequate to provide firewater safe shutdown cooling after a 1 -hour inter-ruption of forced cooling (10FC) with the Fort St. Vrain reactor operating at 105% power. The fuel temperature was estimated to peak at 3024 F from this power level, exceeding the 2900 F temperature limit established in the Final Safety Analysis Report (FSAR). Further analyses indicated that safe shutdown cooling could be performed with one EES section supplied with firewater after a 1 -hour 10FC from power levels up to 87.5% without exceeding a fuel temperature of 2900 F.

The purpose of this Safety Evaluation is to assess the capability of the steam generator to maintain structural integrity for firewater safe shutdown cooling from 87.5% reactor power utilizing the EES section from one steam generator following 1\ hour 10FC. An evaluation of this transient was reported in General Atomics (GA) Document 909269 N/C, attached to letter P-86683, Public Service Company of Colorado, dated December 30, 1986. The primary system pressure and the hot module inlet helium temperature were calculated as shown in Figures 4-4a and 4-Sa, respectively. The primary pressure was shown to 5

decrease to about 600 psia during the initial phase of 10FC, abruptly increasing to about 640 psia on initiation of circulation, then abruptly decreasing to about 350 psia for the remainder of the 10-hour period. The helium inlet temperature was calculated to increase to about 1300 F during the flow interruption and further increase to 1500 F after the start of forced flow, ;

then gradually decrease to about 300*F during the next 8-hour period. The I temperature was calculated to remain above 1400 F for a 1 -hour period.

I 2.0 EVALUATION 1

l The steam generator modules were designed, fabricated and inspected to the l requirements of the ASME Boiler and Pressure Vessel Code, 1965 Edition, 1

$~109 LB C ffp $

including Winter 1966 Addenda, and the Standard Code for Power Piping, USAS B31.1, 1967 Edition. The ASME Code was supplemented by the following Code Cases: 1319, 1325-3, 1330-1, 1331-4, 1342-1, 1351, 1352, 1361, 1362-1, 1383 and 1389.

The layout for the steam generator modules consists of five sections of helically fabricated tubing. Referring to GA Document 909190A, the reheater and superheater II were constructed with 1 in. 0.D. by 0.205-in. wall Sanicro-31 tubing; the superheater I and evaporator were constructed with 1-in. 0.D. by 0.125-in. wall 2\ Cr - 1 Mo alloy; and the economizer was constructed with 1-in. 0.D by 0.187-in, wall Cr- Ho alloy tubing. The l feedwater inlet was constructed with 1.25-in. 0.0. by 0.187-inch wall plain carbon steel tubing.

GA Document 909190A records the result of a structural evaluation of the most critical regions of the steam generator during a single cycle cooldown from power using firewater in one reheater module. It was shown that this one time event would not violate the integrity of the pressure boundary, provided the local helium temperature was limited to 1350 F maximum and not remain above ,

1300 F for more than one hour. Creep buckling collapse of the steam generator tubes was identified as the principal failure mode and the primary stress loading for this event. Specific phonomena of concern were the surface strains caused by thermal shock in the cold-worked material of the reheater tube at small-radius bends, and the plastic strain accumulation in the tube l bundle due to local yielding and elastic follow-up.

The creep buckling computer program (BUCKLE) was used to calculate tube ,

collapse time; that is, the time for the tube ovality to attain the value !

which caused the maximum local stress to equal the material yield stress. The program uses constant values for temperature and external pressure. The study showed that the most critical steam generator tube for creep buckling above 1330 F was the economizer at the feedwater inlet. At temperatures below i 1330 F, the carbon steel feedwater inlet tube was identified as the most l critical material. l I

The results of a structural evaluation of the critical regions of the steam s I

generator during a single cycle cooldown from 105% power using firewater in the EES tube bundles were presented in GA Document 909204 N/C. The local helium temperature and pressure varied during the event: for the first 1\ hour l period, the temperature was less than 1300*F and the pressure peaked at 700 psig; for approximately 2-hours following the initial period, the temperature peaked at 1660 F and the pressure decreased to 350 psig. The structural evaluation showed that the reheater tubes would not undergo creep buckling collapse failure during a single firewater cooldown event provided that the reactor power level was limited so that the maximum helium temperature was less {

than 1660 F for a period less than 20-hours, and the maximum helium pressure l

l 1

l l b i

was not more than 350 psig. Further, the evaluation showed that creep i buckling collapse would not be a viable mode of failure at 1500 F. The calculated collapse time in hours for reheater tubes with 12% cold-worked ovality were calculated at 196 hours0.00227 days 0.0544 hours 3.240741e-4 weeks 7.4578e-5 months for a temperature of 1500 F and pressure of 822 psig.

After reviewing the analyses presented on the capability of the steam generator to withstand the firewater cooldown transient following a 1\ hour 10FC, the staff (and consultants) expressed specific structural and metal-lurgical concerns to the licensee. A summary of the licensee's response l is presented below: i a) The structural effect of introducing firewater into the hot steam generator was addressed. A review of the original design calculations indicated compliance with ASME mechanical limits and fatigue usage ;

factors. The introduction of cold water would result in a strain of 0.49% compared to an estimated end-of-life ductility of 8% for Sanicro-31.

b) The potential for either vapor-lock or water-hammer was addressed in Attachment 9 to letter P-86682. After reviewing the geometry, design, heat transfer and hydraulic characteristics of the EES section, it was concluded that with one firewater pump operating and the primary coolant flow rate controlled, flow could be established and maintained in all modules without either vapor-iock or water-hammer (flow stoppage) in any of the modules.

c) The concern was raised that a rapid increase in system pressure could occur if steam bubbles were to form in a steam generator tube during cooldown, resulting from the expansion of flashing water. Emergency procedures preclude this condition. Once the steam generator is flooded, '

helium flow is controlled to maintain adequately subcooled liquid at the steam generator outlet.

d) Concern was expressed on the metallurgical effect of prior service on properties of the steam generator tubes. Sanicro-31 (Alloy 800H) tubes are potentially subject to metallurgical change, including recrystallize-tion, sensitization, and precipitation aging, which may have a negative influence on the fatigue life, fracture toughness, and ductility. The loss of fatigue life is not a concern as the transient would be single-cycle event resulting in plant shutdown. Extensive long term experience with the material in welded construction in elevated temperature service, together with considerable laboratory data, indicate that Sanicro-31 retains sufficient toughness to assure notch-ductile behavior under the loading rates applicable to the cooldown transients. The reduction in residual ductility, however, raised concern about the tubes ability to service the thermal shock and increased bending loads caused by the cold firewater flowing through the hot tubes. Reports were submitted showing that the tubes and their welds have ample margin to survive the cooldown transient at any point in the plant's life. Additionally, sensitization to stress corrosion cracking does not present a problem due to the short duration of the transients.

l

The second group of materials (2\Cr-1Mo, \Cr- Mo, and plain carbon steel) may be subject to corrosion when exposed to the chemically untreated i firewater for extended periods. The corrosion rate could be enhanced by erosion caused by particulate found in the fire water. For the low flow velocities involved and for the length of the cooldown, corrosion of these tubes is not expected to be significant.

The licensee has reported two steam generator leaks. The first leak occurred in November 1977, in Loop 1 and the second occurred in December 1982, in Loop 2. The leaks were estimated to be 0.003 inch in diameter.

They were located in the Sanicro-31 material in the superheater II section of the steam generator.

Sections of the Sanicro-31 tubes were removed for metallurgical examination during the plugging operation. The Fe-Cr-Ni oxide on the surface had an average thickness of 0.008 inch with no evidence of pitting, cracking or corrosion / erosion damage. The metallographic structures of the Sanicro-31 ;

alloy was considered to be typical as received, fine grained with evidence of some cold-work, free from carbide precipitation. The material showed no sign of significant metallurgical degradation from service. The licensee concluded that the cause of leakage could not be determined and was random in cccurrence.

The properties of cold-worked and recrystallized Sanicro-31 (Alloy 800H) were reported in Volumes I and II of EPRI-HTGR 86-03, " Properties of Recrystallized Alloy 800H and Associated HTGR Steam Generator Design Implications," July 1986.

It was found that at 1350'F, 20% cold-worked material would recrystallize to about 35% by volume in a design life of 30 years. Recrystallization would lower the rupture strength and increase the creep crack growth rate for a given applied stress and temperature. The kinetics of the recrystallization process and the effect on the metallurgical properties of Sanicro-31 were calculated for the Fort St. Vrain steam generator in Volume II of the referenced report.

3.0 CONCLUSION

S We conclude from our review of the materials of construction and the analyses submitted by the licensee that the Fort St. Vrain steam generator is capable of mairstaining structural integrity during a firewater safe shutdown cooling transient from 87.5% reactor power using the evaporator-economizer-superheater (EES) section for cooling following an 1\-hour interruption of forced cooling (10FC). The conclusion in part is based on the analyses of the transient showing a maximum inlet helium temperature of 1500 F at a pressure of 350 psia. The temperature was estimated to remain above 1400 F for a period of 1\-hours during this single event. This transient condition represents the worst case conditions for an emergency plant shutdown. Under almost all other conditions, when high pressure feedwater is available, both the reheater and EES portions of the steam generator are flooded. This would cause the materials in the steam generator to be adequately cooled and, not subjected to high temperatures.

In this analysis, the demonstration of material and structural integrity assures that the steam generator can remove heat from the reactor core l

1

1 i l

under a severe transient. Thus, under severe transient conditions, the i fuel temperature can be maintained under accepted temperature limits, and l

the plant can be safely shutdown.

Principal Contributor: F. Litton, METB Dated: July 2,1987 l

I

'o UNITED STATES l ' 3 .,,,

N NUCLEAR REGULATORY COMMISSION W ASHINGTON, D. C. 20555

( $

Enclosure 3 s !

%...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO THE EFFECT OF FIREWATER C00LDOWN ON STEAM GENERATOR STRUCTURAL INTEGRITY j PUBLIC SERVICE COMPANY OF COLORADO I

FORT ST. VRAIN NUCLEAR GENERATING STATION I

! DOCKET N0. 50-267 i l

l

1.0 INTRODUCTION

On December 30, 1986, Public Service Company of Colorado (PSC) submitted a letter (Ref. 1) with an attached analysis to justify operation of Fort St. Vrain, at 82% power. Safe operation at this level is based on a proposal to circulate available plant firewater through the Evaporator and Economizer /Superheater (EES) tube bundles of the steam generator modules in an event requiring safe shutdown of the plant. This would permit safe i shutdown cooling following a ninety (90) minute interruption of forced :

helium circulation. Attachment 7 (Ref. 2) to the letter represents the structural evaluation of the most critical regions of the steam generators during a single cycle cooldown from 82% power. The objective of this eval-uation was to show that the primary pressure boundary of the steam gener-ator will remain intact even when firewater is used in the EES tube bundles to cool down the reactor from a more conservative 100% power condition. The primary analysis for structural integrity of the steam generator is based on creep collapse. Creep collapse, is considered to be the only conceivable mode of failure for the hottest steam generator tubes under the conditions analyzed.

2.0 EVALUATION Three regions within the steam generator modules were determined to be of l concern during this event: 1. the reheater tubes and their supports;

2. the EES tubes and'their supports. The superheater tubes consists of two sets of tubes, labeled Superheater I and Superheater II. Of these, I the latter are the most affected. 3. The Superheater II downcomer and its support.

The critical region comprises the reheater tubes. During EES cooldown conditions these tubes have uniform temperatures and low internal pressures, so that the interaction loads between tubes and the tube support plates are low. However, there is a time interval of about 90 minutes during which the helium flow is stopped. In this interval the reheater and the EES tubes are purged of water / steam inventory, and are l $%7 Od] f

\

i in fa::t vented to the atmosphere, so that the internal pressure in these tubes is essentially atmospheric. The helium pressure peaks at 700 psig and the metal temperature drops from 1000 F to 780*F. These tubes are therefore under net compressive radial loading. This external pressure, combined with the hottest helium temperature impinging on the tubes indicates that a likely mode of failure for the reheater tubes is by creep buckling and collapse.* General Atomics (GA) has performed an evaluation of the reheater tubes subject to these. conditions using the GA BUCKLE computer program (Ref. 3). The basis for this program (Ref. 4) was reviewed and found to be reasonably acceptable. The program was verified by comparison with the solutions for two test problems involving creep collapse, obtained by using the widely available program MARC-General Purpose Finite Element Program (Ref. 8). GA provided this verification (Ref. 5) and has shown that there is reasonable agreement between the two sets of solutions. We find this acceptable.

The evaluation consisted of an analysis of a straight tube of nominal diameter and wall thickness, and the maximum allowable small-radius-bend manufacturing ovality, subjected to external pressure at high temperature.

For evaluation of the creep buckling / collapse of a cross-section, GA stated that in this case the analysis of a straight tube is conservative as compared to the analysis of a curved tube since the tubes do not experience restraint of thermal expansion and any bending moments in the bends are therefore minimal. (The tube bundle and its support structure were stated to be at the same temperature.) Likewise bending moments due to safe shutdown earthquake (SSE) and low level vibration were determined also to be minimal. The additional ovalization due to such moments is therefore also insignificant, and a tube bend is therefore more resistant to external pressu'e than a straight tube. However, if the bending loads had been significai t, then the effect of the additional tube ovality caused by bending of an already curved tube would have required evaluation.

We find these argunnts acceptable.

The program determines the creep buckling time for a straight cylindrical tube with initial ovality, subjected to constant externni pressure and constant material temperature. The criterion for determining that buckling has occurred is that the highest stressed point in the tube cross-section has reached a stress level equal to the yield stress of the material at temperature. This is a conservative criterion for thicker tubes such as the reheater tubes, which have a diameter-to-wall-thickness ratio of eight. Such tubes were shown not to buckle at stress levels below the yield stress. We find this procedure acceptable.

Since the program uses constant values of external pressure and tempera-ture, a parametric study was performed to determine the time for achieving the yield stress level for various combinations of pressure and tempera-ture. It was thus determined that the creep collapse time at 1660 F and 350 psig exceeds 20 hrs. This is a conservative result since the time

^The term " buckling and collapse" does not imply sudden, catastrophic deformation under creep conditions. Rather, it describes time dependent deformation. It is thus characterized by a time limit instead of a load limit.

1 1

interval at which the actual tube experiences this temperature during the l cooldown event is considerably shorter. This value of temperature repre- i sents the maximum temperature experienced by the tube after helium circu-lation is restarted. After about 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months it was shown to achieve a value of approximately 350 F, after which there is a further decay with time.

Likewise, the external pressure was shown to drop to about 300 psi, after which it remained approximately constant. Thus, the actual creep collapse time appears to be much longer than 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months , and certainly much longer than needed to achieve cold shut down. However, prior creep fatigue ,

damage can affect the creep-collapse failure mode if the prior accumulated l; creep-fatigue damage is high. GA has therefore stated that the fatigue analysis performed and reported in the original steam generator design report (Ref. 6) showed low fatigue damage even in those regions of the steam generator where there were significant cyclic loads. Since the l thermal loads in the reheater are low it is expected that there will not ;

be any significant creep-fatigue damage in the reheater tubes, particularly .

adjacent to the small radius bends where the maximum ovality is expected !

to occur. Creep-fatigue damage will therefore not likely affect signifi- j cantly the predicted creep-collapse times. We find this acceptable. ;

The reheater tubes and their supports are basically at the same temperature '

during EES firewater cooldown. The interaction loads between the tubes and the tube support structures due to restrained thermal expansion are l therefore minimal. Likewise, the stresses due to combined SSE loading, dead weight, internal pressure and helium flow drag loads were shown in Ref. 6 to satisfy the ASME Code,Section III, requirements for primary I stresses at 100% power. During the firewater cooldown, the stresses due to pressure and thermal effects were determined to be lower than the stresses at 100% power, while at the same time the allowable primary stress was higher, since this is a one time, short term plant event. GA has therefore provided reasonable assurance that an SSE occurring during firewater cooldown will not fail the reheater tubes. We find this accept-able.

1 1

A structural investigation of the Superheater II helical bundle under combined sustained and thermal expansion loading was also performed.

The stresses under firewater cooldown were determined by multiplying the full power operation stresses by the ratios of the corresponding thermal and mechanical loads for the two conditions. The full power operation stresses were obtained from Ref. 6. The pressures and tube wall thermal gradients are icwer under firewater cooldown than those under full power operation. However, the loads resulting from tube and tube-support plate interaction increase due to restrained thermal expansion. The stresses due to this interaction are, however, classified as secondary and are therefore not required to be evaluated for faulted conditions. GA has evaluated the primary stresses in the tubes when subjected to combined flow induced vibration, dead weight, SSE and pressure loading and has determined that the ASME Section III limit at temperature as stated in Ref. 7 is satisfied. Although not required, GA has also evaluated the combined total primary plus-secondary stresses, to verify that even under upset conditions, the required stress limit at 385 F* is also satisfied.

This stress limit was obtained from Ref. 7, which is applicable at Uhis is the peak tube surface temperature.

o 1 temperatures below 800 F. The EES tube-support plate stresses were also i stated to be within design allowables at the firewater cooling tempera- l tures. We find these evaluations acceptable, j For the Superheater downcomer and its support structure, GA has stated i that during full power operation the differences in temperature are very small, and will not cause significant differential thermal expansion. The temperatures, as well as the pressure in the downcomer, during firewater cooldown are considerably lower, while the SSE stress remains the same.

Because of the lower temperature the stress limit also increases, so that j the safety margins increase considerably as compared to those at full power operation. Thus, on the basis of a comparison of the temperatures used for analysis at 100% power with those predicted during firewater cooldown, GA determined that the stress limits would not be exceeded under this condition. We find this acceptable.

l

3.0 CONCLUSION

The results of the structural evaluation by GA of the most severely loaded regions of the steam generator, during a single cycle of cooldown from power using plant firewater, hes shown that the most critical region is in the reheater. GA has demonstrated that the reheater tubes will not 1 experience collapse due to creep during.such a cooldown. cycle, including 1-1/2 hours of interrupted forced circulation, provided that the power level is limited so that the maximum helium temperature is less than 1660 F for less than 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months and the corresponding maximum helium pres-I sure is no more than 350 psig. GA has also demonstrated that in other i regions, such as the Superheater II tubes and the Superheater downcomer, i the stresses are below the corresponding ASME Section III design limits.

We find these demonstrations acceptable.

4.0 REFERENCES

1. Letter No. P-86683, from D. W. Warenburg, PSC, to H. N. Berkow, NRC, dated December 30, 1986.

2. Lewis, A. G., "Effect of Firewater Cooldown Using EES Bundle on Steam l

Generator Structural Integrity." GA Documents 909204/NC and 909204/A, December 4, 1986 and June 5, 1987.

3. Almajian, A. T. , " Buckle 'Jsers Manual." GA Document 909410/NC, April 1987.

4 Pan, Y. S. " Creep Buckling of thin Walled Circular Shells Subject to Radial Pressure and Thermal Gradients," J. of Applied Mech., March 1971, pp. 206-216.

5. Almajian, A. T., " Verification Report for the BUCKLE Computer Program."

GA Document 909438/NC, May 28, 1987.

6. GA Report No. GADR-9, " Stress Report for Fort St. Vrain Steam Generator," October 1, 1970.

l l

7. ASME B & PV Section III Summer 1968 Edition, including Code Case 1342-1.

8. " MARC General Purpose Finite Element Program," MARC Analysis Corp.,

Palo Alto, California, March 1983.

Date: July 2,1987 Principal Contributor: Mark Hartzman, MEB l

l l

l

Enclosure 4 1

l I

TECHNICAL EVALUATION REPORT.

FONT ST. VRAIN NUCLEAR GENERATING STATION DOCKET 50-267 I

l LICENSEE: PUBLIC SERVICE CO. OF C014RADO i

FORT ST. VRAIN SAFE SHUTDOWN FROM 82% POWER 1 i

l I

PREPARED BY:

S. J. Ball D. L. Moses l Oak Ridge National Laboratory Oak Ridge, TN. 37831 June 4, 1987 l

1- NRC Lead Engineer: K. L. Heitner Project: Selected Operating Reactors Issues (FIN A9478) 1 .

i l

~ ~

l n

a I

I l l i

\

NOTICE ,

This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumed any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report or represents that its use by such third party would .

not infringe privately owned rights.

\

Technical Evaluation Report - Fort St.' Vrain Safe Shutdown From 82% Power S. J. Ball D. L. Moses

1. Introduction ORNL has provided technical assistance to NRC in their evaluations and ;

analyses of issues raised in Fort St. Vrain's 1987 Power Ascension l ORNL had previously performed analyses which confirmed the Plan (P-87038). {

Public Service Co. of Colorado (PSC) assertion that for long-term operation at 35% power, a safe shutdown could be achieved even if all equipment exposed to l a harsh environment in a worst-case high-energy line break (RELB) scenario were assumed to fail.

From these studies it was concluded that, for a worst-case pennanent loss ,of forced circulation (14FC) event, a long term cooldown l using only firewster coolant in the PCRV liner cooling system (LCS)Inasaddition, the ultimate heat sink would not result in significant fuel failure.

restart of coolant to the LCS after postulated prolonged downtimes would be l both feasible and acceptable.

Upon successful implementation of the steam line rupture detection and isolation system (SLRDIS) at FSV, it was determined by analysis that the long term reactor power should be limited to values below 100%. This is due to previously undetected limitations in the shutdown cooling systems designed for use in emergencies. Because of the inability to simultaneously flood all six l

of the reheater sections of the steam generators in a loop (at least with the l present flow capacity and piping arrangements), reheaters can no longer be counted on for emergency cooldowns following postulated 90 min duration 14FC events. If hot helium coolant from the core (following restart of .

l circulation) were not cooled by the reheater bundles in several modules, the '

hot gas could impinge on the economizer-evaporator-superheater (EES) sections' tube bundles nnd cause failure of the tubing. Consequently, PSC requested a change in the Technical Specifications to eliminate reliance on the use of the reheater sections for Safe Shutdown Cooling (P-87002).

A series of PSC analyses were submitted to NRC that justified long-term power operation at power levels between 82% and 87.5%, depending on which accident scenario was postulated. In the Environmental Qualification (EQ) case, it was claimed that 87.5* power operation could be justified by relying .

on only one firewster pump supplying coolant to only one of two (redundant) '

EES sections (i.e., all six EES modules in one loop) following a 90 min LOFC event. The EQ event postulates only the use of equipment which is qualified to withstand the design basis earthquake, the maximum tornado and the most limiting HELB. In order to meet this goal, it was necessary to install two (one per loop) 6 in. vent pipes from the EES sections to provide for single The other failure proof venting during the once-through cooling mode.

scenarios involved only the use of equipment qualified to survive and operate 1

a i

9 i

l following fires in non-congested cable areas per 10CFR50, Appendix R. For ;

such fires, the emergency cooling flow sources can successfully accommodate cooldowns from power levels up to 83.24. In January 1987, PSC formally requested permission to operate at power levels up to 82% (p-87038).

The ORNL technical assistance provided was mainly in two areas. The i first involved confirmatory analyses of various scenarios using accident codes j developed under both RES and NRR sponsorship. The second involved a detailed review of the ability of the existing systems to supply sufficient water flow to the helium circulator Pelton wheel drives and the EES sections of the steam generators during 'the cooldown scenarios. Two other smaller tasks were

, included, investigations of possible structural and metallurgical failures in j the steam generators (R. C. Owaltney), and an assessment of the potential for i water hammer upon restart of coolant flow to the hot tube bundles I (C. R- Hammonds) . A brief letter report on the latter of these smaller tasks is provided in an attachment.

l

2. Accident Scenario Analyses 2.1 ORECA Code i The original version of the ORNL ORECA code for simulating HTGR core dynamics is described in ORNI/TM-5159 (1976). Subsequent updates appeared periodically in RE3 quarterly progress reports, and a detailed writeup on the l ORECA code family was submitted to NRC in February 1985 as part of an -

assessment report of all ORNL HTGR accident codes. This latter report described three versions of ORECA: severe-accident and " verification" versions of FSV simulations, and a source term study version for the 2240HHW(t) HTGR design. The ORECA-TSV versions have been used extensively by many different users in many different types of analyses, and have been verified for a variety of transients by comparisons with both plant data and other independent analyses. ORECA is considered to be a "best estimate" code; conserv .tisms are accounted for by means of sensitivity analysis.

The ORECA code used for this task was a modification of the severe accident sequence analysis (SASA) version. The modifications included an addition of a model of the flooded steam generator EES section, and a model to predict stagnation or reverse flows within the worst-case refueling regions.

The latter feature had been developed as part of ORNL's assessment of PSC's proposed changes to the Tech Spec L.C.O. 4.1.9, which deals with concerns about fuel overheating in low-flow, low-power operating modes.

2.2 Model and Parameter Assumptions Specific input data for the analyses were provided by PSC and GA. The major assumptions used for the reference case were as follows:

2 l

L

% e i 4

1

1. Equilibrium core region peaking factors (Max.

1.83).

2. Maximum allowable region outlet temperature dispersions (during operation) consistent with LCO 4.1.7. (The maximum mismatch value provided

[100 F) was increased by 50 F to allow for region outlet temperature measurement error.) Orifice positions were assumed fixed for the duration. l

3. Long-term operating power (before shutdown) of 87.5%. This corresponds to the E0 case.

4. PSC-supplied estimate of EES cooling water flow (940 gps) following the 90 min 14ft. The helium coolant flow was assumed to be " manually controlled" l I

to limit EES water outlet temperatures to 250 F to prevent boiling. The capabilities of the Pelton wheel drive were not limiting.

3 5. EES (water-cooled) initial performance characteristics per GA's 8

SUPERHEAT code. The subsequent EES performance (with varying inlet temperatures and flows) was calculated using the ORNL code AWHEXI. I

6. Flow to the 145 is not available for the duration.

2.3 Analysis Results ORNL analysis of the reference EQ case accident scenario resulted in j predicted temperatures quite close to those provided by PSC. The ORNL !

I predicted maximum fuel temperatures were somewhat lower than those. of PSC, while the mean core outlet temperatures were slightly higher. The ORECA maximum fuel temperature was 2560 F (1405 C) vs 2858 F (1570 C) per PSC, hence indicating less likelihood of fuel damage. The ORECA maximum average core outlet gas temperature was 1625 F vs. approximately 1500 F per PSC. The -

corresponding primary system pressures predicted were 425 psia (ORNL) vs.

325 psia (PSC) at the time of maximum core outlet temperature, so overall, the potential for damage to the (dry) reheater tube bundles would be somewhat i

greater for the ORNL predictions. Comparisons of the results for . maximum fuel l :

and average core outlet gas temperatures are shown in Fig.1, and.for primary system pressure response in Fig. 2. The " manually-controlled" values of primary helium flow are shown in Fig. 3, where the ORECA predictions give ;

somewhat lower allowable flows to prevent boiling in the EES tubes. i calculations of intra-region flow redistributions in the worst-case regions showed that there was no intra-region flow stagnation (or flow reversals) during the cooldown.

Sensitivity analyses were also done to assess both calculational and j operational margins for error. For an assumed 20% reduction in the available i EES cooling water flow, the predicted maximum fuel temperature was only l 2685 F (1475 C), still well below temperatures causing significant failure rates. Variations in the heat transfer performance of the water-cooled EES were made within reasonable bounds, and had very little impact on the

)

resulting peak temperatures predicted, as did the assumption of ISS failure, various assumptions about the response of the operators in controlling helium flow were elso found to be unimportant, although the assumption of a failure to avoid boiling and subsequent choking of the flow was not evaluated. It is 3

i l

)

i l

. i I

reasonable to assume that the recovery time from such a complication (shut ting off the helium flow temporarily to reestablish EES water flow) would not be excessive.

Another assessment of the " safety margin" available was done by compounding several uncertainties and/or conservative assumptions to see what it would take for the predicted maximum fuel temperature to approach 2900 F (1600 C). In this case, power for the EQ case was increased by 5% (to 91.9%) to account for measurement error, EES cooling water flow was l decreased by 25% (to 705 rps), and the restart of forced cooling was delayed !

an additional 20 min. (to 110 min). The resulting peak fuel temperature was !

2830 F (1555 C), with some refueling regions experiencing reversed flow. The maximum average core outlet temperature predic'ed was 1730 F. This indicates that substantial margin for error is available before there would be any concern for significant fuel damage. 1 Calculations of the " Appendix R" reference case, with power limited to j 83.2% and EES open loop cooling water flow limited to 700 rpm (P-87158), l showed even milder transients than did the E0 cases. The maximum predicted fuel temperature was 2460 F (1350 C) and the maximum everage core outlet gas temperature was 1650 F.

3. Water Supply to the Helium Circulator Pelton Wheels and Steam Cenerators 3.1 Introduction and Background '

This portion of the technical evaluation is directed to resolving restart issues arising out of Reportable Occurrence (RO) 50-267/86-026 and related to the adequacy of the seismically qualified class i Safe Shutdown Cooling Systes at Fort St. Vrain. The adequacy of the class I water supply for Safe Shutdown Cooling was initially brought into question as the result of deficiencies identified during startup testing as reported in Unusual Event Report (UER) 50-267/76-05. The particular deficiencies identified in both UER 50-267/76-05 and RO 50-267/86-026 relate to the provision of facility firewater to Class I piping in the Fort St. Vrain secondary cooling syntes.

To accomplish Safe Shutdown Cooling, Class I firewster has to be supplied with sufficient pressure and flow rate to drive one helium circulator water turbine at required speed and to flood one section of the steam generator economizer-evaporator-superheater (EES) with sufficient cooling capacity to maintain the maximum fuel temperature below 2900 F. In addition, Safe Shutdown Cooling should prevent the surface temperatures of the steam generator tubes and of the belium circulator components from reaching values that could challenge reactor coolant boundary integrity or the capability to perform long-term cooling. Similarly, Safe Shutdown Cooling should preclude primary system pressure from increasing to the point of lifting the safety relief valves. The sufficiency of the Class I firewater supply to the steam generator EES is dependent on the backpressure in the steam generator, and the 4

EES backpressure is a function of the downstream piping resistance to EES outlet flow and of whether boiling occurs in the EES tubing after forced cooling of the reactor core is restored.

The two steam generator EES sections are the only primary system heat exchangers capable of supporting Safe Shutdown Cooling. This observation is based on the recent finding, as reported in Ro 50-267/86-020, that the resistance in the firewater flow path to the steam generator reheater sections was too high to permit adequate flow for Safe Shutdown Cooling. Previously, Updated FSAR Section 10.3.10 had claimed that the two rebeater sections each provided a Class I firewater cooldown capability from full power conditions and that was fully redundant to the EES cooldown capability on firewster.

Recent analyses reported in Attachment 4 of P-86682 indicate that firewater cooling through a single reheater section rodule (where one module of six in each section is the most that can be flooded) will provide effective Safe Shutdown Cooling cepability only from 39% of rated reactor power and with a 90 minute interruption of forced cooling.

As reported in UER 50-267/76-05A (final supplement and more recently amplified and clarified in the licensee's response)to a request for additional information (PSC Response 6, Attachment to P-87110), testing in 1976 demonstrated that each circulator could apparently be driven at speeds exceeding This 700 rpmby:

was achieved with 1000 rpm or more supplied to the steam generator EES.

(1) fully opening the bypass valves PV-22129 and PV-2229 in the lines from the EES outlet to the bypass flash tank and pre-f, lash tank, respectively, thereby reducing EES backpressure to 50-60 psig; and (2) by physically modifying the discharge flow paths in several valves (RV-21257 through HV-21260) upstream of the Pelton wheel water turbine to reduce pressure drops and thereby increase flow capacity to the respective water turbines.

h*o testing was performed to quantify reheater flooding with simulated firewater in the 1976 tests. Preoperational testing in 1973 had identified limitations to reheater flooding on condensate, but the results of the preoperational tests and analysis were not effectively documented. Therefore, the simulated firewster tests that are reported in UER 50-267/76-05 did not include tests or analysis of reheater flooding because the potential problem had not been recognized by PSC.

However, a related event, described in UER 50-267/76-09, identified the fact that the initial analysis of the firewster cooldown had used nominal instead of design power peaking factors. To prevent flow reversal or flow stagnation in the reactor core during the firewater cooldown from power levels greater than 70% of rated, UER 50-267/76-093 indicated the need to install emergency 5

i l

water booster pumps in the piping immediately upstream of the circulator water turbine so as to increase primary system helium flow from an apparently achievable 2% to between 3 and 4%. Subsequently, NRC imposed the requirement to assume a 90 minute delay in establishing firewater flow and Safe Shutdown Cooling following the Design Basis Earthquake or Maximum Tornado (the Class I events).

In September 1986, as noted in RO S0-267/86-026, a reenalysis of the design basis Class I Safe Shutdown Cooling transient (Updated FSAR Sections 10.3.9 and 14.4.2.!!) was performed in support of Environmental Qualification. Per l the license,s event ' report, the reanalysis indicated:

i

...that restart of forced circulation at 3% of rated, approximately 1-1/2 hours after a scram from 105% power, will cause steaming and a large pressure increase in the steam generator EES and discharge piping. Under these conditions, secondary flow would be significantly reduced due to the limited capacity of the firewater pumps. Due to this reduction in i secondary coolant flow, the heat removal rate computed in the FSAR analysis would not be achievable.

I More recently, the confirmatory analysis (Attachment I to P-87053) of other

. PSAR cooldown transients has shown that the original FSAR analysis of the Class I Safe Shutdown Cooling transient assuming an immediate start of fireweter (i.e., without assuming the 90 minute delay as currently required) also overpredicts the firewster heat removal capacity through the EES by at .

least a factor of two, specifically, an assumed 180 x 108 BTU /hr in the original most recentanalysis versus an apparently achievable 86.7 x 10e BTU /hr from the analysis.

For the case of the 90 minute delay in restoring forced cooling (i.e., the current design basis Class I Safe Shutdown Cooling transient), the limiting heat load is stated to be 73.5 x 10e BTU /hr in attachment I to P-87053; however, the achievable firewater heat' removal capacity is not provided for the 90 minute delay in restarting forced cooling.

It should boiling in be thethe EESsame once the steam generator EES is pre-cooled to prevent tubes.

Thus, the attempted resolution to UERs 50-267/76-05 and 50-267/76-09 were inadequate because the associated testing and analyses did not adequately address secondary side pressure and flow conditions that must be attained in the EES during both the original and the current version of the Class I Safe Shutdown Cooling scenario. Also, the attempted resolutions to both of the 1976 UERs failed to address the cooling capability of the reheater sections using firewster.

Therefore, this portion of the technical evaluation assesses the adequacy of the recent calculations submitted by PSC and the need for further analysis or testing. As indicated previously, this technical evaluation focuses on the performance of the Class I Safe Shutdown Cooling system in accommodating the Design Basis Earthquake and Maximum Tornado (Updated FSAR Sections 10.3.9. and 14.4.2.2).

6

9 3.2 Feview of the New Class I Firewster Flowpath Calculations in Recent PSC Submittels The results of PSC's recent analysis have been documented in several submittals.

The cover letters to the PSC submittals use the terminology " Safe Shutdown Cooling" to refer to the scenarios addressed in the various sets of !

subcontractor calculations that are attached to these documents. These scenarios include emergency core cooling following high energy line breaks in either the reactor noncongested or turbine building and following major fires in the cable ' areas.

Emergency core cooling following the design basis Qualification per 10CFR50.49. with the analysis to address Environmental seismic event is incorporated change to the Fort St. Vrain Technical Specifications. Attachment 4 This change is to 1 eliminate reliance on the reheater section of the steam generator for Safe Shutdown Cooling and to require instead full reliance on the EES section for the firewater cooldown from power levels up to 82% of rated reactor power.

Adequate firewater flow to the EES section of one steaa generator and to one circulator water turbine drive in the same loop is to be achieved by reducing EES backpressure with the use of seismically qualified six inch vent lines to the atmosphere from each EES discharge header. In addition, as shown in Figure III-l of Attachment 4 to P-87002, a new seismically qualified (Class I) firewater flow path has been installed between the firewater discharge header and the emergency condensate header.

The new flow path has only two isolation valves that have been installed for remote operation outside the turbine building break in in order that to avoid a harsh environment in case of a high energy line building.

The new firewater piping to the emergency condensate header meets both the seismic and environmental (10CFR50.49) qualification requirements for Safe Shutdown Cooling.

Analyses presented in Attachment I to P-86683, Attachment 2 to P-87055, and the Attachments to P-87171 have been submitted by PSC to demonstrate the firewster supply capability for the new Class I firewster flow path. The Attachment using condensate to P-87171 to drive a include circulatorthe results water of a simulated firewater flow te turbine.

This test and an accompanying sensitivity analysis were submitted by PSC to demonstrate an adequate capability to produce a primary system helium flae of 3.8% of full load at a firewater flow that is less than that which is estimated to available. be Sensitivity analyses show that increasing flow to the EES section does not significantly degrade the suction pressure and flow available to the emergency water booster pump upstream of the circulator water turbine drive.

The firewater flow analysis and the flow sensitivity studies were performed using a computer code developed by Proto-Power Corporation and described in Attachment 6 to P-87055. The theory and methods used in the pressure drop 7

1 E_

M program have been reviewed and appear to be both reasonable and consistent with other steady-state methods for flow and pressure drop calculations. )

The same Proto-Power Corporation computer code described in Attachment 6 to P-87055 has also been modified and used, as reported in Attachment 9 to P-86682, to calculate the EES flooding time for pre-cooling the EES to subcooled outlet flow conditions prior to restart of the helium circulators on water turbine drive. As discussed in Attachment 9 to P-86682, the firewster flow and pressure drop computer code was solved iteratively in a quasi-static manner with a heat transfer code simulating the EES tube thermal performance.

The quasi-static analysis yielded a 14 minute flooding time for the EES. The flooding time was reported to have been conservatively confirmed by a i calculation by GA Technologies as cited in PSC response 7 in Attachment I to !

P-87055. As discussed in the Attachments to P-86682 P-86683, and P-87055 GA Technologies reportedly checked the steam generator steady-state flow and I pressure drop results with the SUPERHEAT code. Also, as discussed in Attachment 5 to P-86682, GA performed limited checking of other steady-state j firewater flow calculations, but not the Safe Shutdown Cooling flow path, using the SNIFFS flow network computer code and hand calculations. Since no complete set of alternate calculations are available for either the steady-state firewater flow calculations or the EES flooding (pre-cooling) time calculations, we recommend that NRC should perform an audit of the Proto-Power Corporation calculations. Such an audit is needed to assure that the' type of problems with inadequate verification checking encountered in -

l IERs 50-267/76-05 and 50-267/76-09 does not recur for RO 50-267/86-026.

In Attachment 4 to P-87002, PSC states that the new Class I flowpath also meets the single failure criterion for both active and passive failures. To accommodate a single passive failure, Attachment 4 to P-87002 addresses reliance on the original firewater flow path in System 45 (the Fire Protection System) that is the basis for the Safe Shutdown Cooling results reported in FSAR Section 10. 3. 9, 10. 3.10, and 14. 4.2.2. In Attachment 4 to P-87002, the firewater system flow is assumed to be routed to the emergency feedwater header to accommodate a single passive failure, but the requirement to use this flow path is based on a single passive failure that, consistent with RRC policy given in SECY-77-439, is assumed not to occur until. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after emergency cooling has been initiated. This alternate flow path has not been analyzed in calculations submitted by PSC.

Active single failures in the preferred new flow path, as illustrated in Figure III-l of Attachment 4 to P-87002, are assumed to be limited to " failure to function of an electrical component of the two valves (HV-4518 and RV-4519) in the (new) line (that) can be compensated for quickly by a manual action in a mild environment." Mechanical failures of these valves failing to open have not been addressed.

8

1 1

. l I

I I

l If either HV-4fl8 or HV-4519 were to fail to open, alternate flow paths exist via the firewater system to either the emergency condensate header supply or the emergency feedwater header, which was alluded to above. The alternate flow path to the emergency condensate header is the original preferred flowpath for Safe Shutdown Cooling as described in FSAR Section 10.3.9 and 14.4.2.2. A review of the recent PSC analyses that use this original flow path is presented in the following section of this report.

3.3 Review of the Original Class Flowpath Calculations in Recent PSC Submittals There was no attempt to clarify in the recent PSC submittals that the original FSAR Class I cooling configuration is most closely analogous either to the

" emergency cooling with EES using firewster pump (open loop)," as shown in Fig. A-1 of Attachment 5 to P-86682, or to the "firewster flow diagram for Appendix R Train B case, open loop," as shown in Fig. 2.4 of Attachment 2 to P-85055. Both of these configurations represent firewater supply via the I emergency condensate header as assumed in the Class I performance and safety analysis reported in Updated FSAR Sections 10.3.9 and 14.4.2.2.

In the configuration cited in Attechment 5 to P-86682, about 100 gpm of fluid is assumed to be vented to the atmosphere via an electromatic valve (PV-22162) ,

l located downstream of the steam generator EES, and the rest of the flow is vented to the condenser through the desuperheater and flash tank. Per FSAR -

l Section 10.3.9 the original Class I event scenario assumed venting from ruptured non-Class I piping downstream of the ateam bypass valves to the i desuperheater. The licensee did not specify which of these configurations I presents the higher backpressure to the steam generator EES and thereby produces the lower flow from the firewater supply system; however, use of the newly installed and seismically qualified six inch vent lines off the EES outlet piping to the atmosphere allows for lower EES backpressure. The maximum fuel temperature calculated in the recent analysis (Attachment 5 .to P-86682) is 2511 F for a cooldown from 77.9% of rated reactor power. The firewater flow rate to the EES is calculated to be 829 gpa with an EES backpressure of 107 psia at the steam generator ring header and 87.3 psia at the mainstream bypass valve (PV-22129). Water exiting the EES is subcooled.

Similarly, in the configuration cited in Attachment 2 to P-85055, flow throu'g'h the open loop (i.e., atmospheric venting via the newly installed six inch vent lines) lasts for only five hours, after which the loop is assumed to be closed in the Appendix R Train B Case (See Fig. 2.5 in Attachment 2 to P-85055). In the open loop configuration, the firewater flow is 996 gpa, but is reduced to 789 gpm in the closed loop. The steam generator EES backpressure at the l

outlet is " controlled" to 76 psia (open loop) for the first five hours and 97.8 psia (closed loop) thereafter; presumably, the quoted pressures are at i

the steam bypass valve. The maximum fuel temperature is calculated to be 2644 F following shutdown cooling from a power level of 87.5%.

9

l l

In addition, as reported in Attachment I to P-87053, the analysis of the firewater cooldown from 83.2% of rated reactor power without an interruption in forced cooling indicated that the PSAR Section 14.4.2.1 values for maximum i helium temperature (and thereby maximum fuel temperature) can be achieved with '

795 gpm of 80 F firewater flow against a steam generator backpressure of l 83.1 psia at the steam bypass valve. This result is analogous to that for the ,

original Class I firewster cooldown scenario with no delay in restoring forced l cooling, as assumed by PSC prior to the NRC's imposing the assumed 90 minute delay in 1978. As noted in Section 3.1 above, the firewster cooling capacity for this event should be the same as the current Class I firewater cooldown scenario with the 90 sinute delay in restoring forced cooling. The najor difference between the analysis in Attachment I to P-87053 and the current Class I event scenario would be core conditions and maximum helium temperature obtained after the 90 minute delay in restoring forced cooling of the core.

l 3.4 Findings and Recommendations The new class I flow path, which was installed to meet the requirements for environmental qualifications of electrical equipment per IDCFR50.49, has been shown by calculations to provide a sufficient flow of firewster following shutdown from 87.5% of rated reactor power to drive one helium circulator at up to 3.8% of rated helium flow and to flood one EES section of the steam generator with subcooled flow. This flow of firewster is capable of flooding the EES in an estimated 14 minutes prior to restart of forced cooling of the reactor core following a 90 ainute interruption of forced cooling. This flow of firewater has been calculated to maintain the maximum temperature below 2900 F and to prevent lifting of the primary safety valves. However, the analysis of the new flow path has not adequately addressed single active failures due to a mechanical failure to open either of the two new valves in the new Class I flow path. Only electrical failures have been addressed.

Thus, the original Class I flow path must also be addressed for Safe Shutdown Cooling.

Although the original Class I Safe Shutdown Cooling scenario (i.e., 90 minute delay in restoring forced cooling via the emergency condensate supply header following the Design Basis Earthquake or Maximum Tornado) is not exactly duplicated in any of the new analyses, the results from similar analy'ses allow us to conclude that the original configuration for accommodating the Class I event can be utilized from 82% of rated reactor power without exceeding a maximum fuel temperature of 2900 F. PSC should perform an explicit l confirmatory analysis of the Class I scenario to demonstrate that this is

) indeed the case for accommodating single active failures in the new Class I flowpath.

Also, with regard to meeting the single failure criterion, we conclude that a confirmatory analysis is needed to demonstrate the capability of the alternate 10

_-n

l,

. 1 1

1 l

l I

flow path via the emergency feedwater header. As shown in Figure 4-la, i

Attachment 2 to P-87055, the maximum fuel temperature is calculated to peak I below 2900 F at about five hours into the firewater cooldown using the new class I flow path. By extrapolation of the data in the cited figure, the I l

maximum fuel temperature would still exceed 2200 F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months into the i firewster cooldown. This tendency to cool slowly is confirmed by the results given in Updated PSAR Figure 14.4-6 where these results are now recognized to

(

be non conservative. Therefore, confirmatory analyses are needed to assure adequate flow and continued decrease in the fuel temperature after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ;

assuming a single passive failure.

In addition, since the failure- to resolve issues raised initially by UERs 50-267/76-05 and 50-267/76-09 can apparently be traced to unreviewed or inadequately reviewed analyses of the fireweter supply capability, assurance should be obtained that current analyses comply with the provisions for verification checking in design control per 10CFR50, Appendix B, Section III and ANSI /ASKE N45.2. ll. Since design reviews are apparently the least effective measure for verification checking, as evidenced by the findings of l

RO 50-267/86-026, the use of independent checks by alternate calculations and of checking by comparison to applicable plant test data should be emphasized. i l l As indicated in Section 3.2 above, NRC should perform an audit of the l

calculations performed by PSC and its subcontractors, particularly if design i reviews have been the primary mechanism to achieve nominal compliance with IOCFR50, Appendix B and ANSI /ASME N45.2.11.

4. Conclusions Results of the accident analyses indiccte that for both the "EQ" and

" Appendix R" scenarios, (which are both low-probability events), there is substantial margin in the existing emergency cooling systeas to provide for a safe shutdown. The analyses assumed that suitable procedures and training would be in place to assure that the operators would first implement the appropriate cooling water supply, and then manually control the primary coolant flow to avoid steaming and choking in the EES. We recommend that NRC confirms that suitable procedures and training are established.

PSC's analyses of the seismically and environmentally qualified firewater flowpath for Safe Shutdown Cooling indicate that adequate firewater flow can be obtained to avoid fuel damage and component damage following shutdown from l

82% of rated reactor power and assuming a 90 min delay in restart of forced cooling of the reactor core. Pre-cooling of the ateam . generator EES section with firewater is calculated to take about 14 min to assure subcooled firewater flow at the EES outlet after forced cooling is restarted. Based on results of other recent analyses, single active failures in the new class I flowpath are judged to be accommodated by using the original Class I firewater flow path to the emergency condensate header. Single passive failures, which are assumed not to occur until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the firewater cooldown is l 11 1

1 a

l l

initiated, are to be accommodated by an alternate flowpath through the emergency feedwater header, but specific analyses of this capability have not been preserted by PSC. Based on our review of the PSC analyses and of previous reportable events related to the adequacy of the Class I firewater cooldown capability, we recommend that the following confirmatory actions be t aken:

o NRC should perform an audit of the PSC calculations to confirm the I adequacy of verification checking per 10CFR00, Appendix B, l Section III. This action is necessitated by findings of inadequate verification checking from previous reportable events that should have been resolved by analysis of the firewater flow capability for Safe Shutdown Cooling. l 1

o PSC should perform an explicit confirmatory analysis to demonstrate j that the original Class I firewater flow path accommodates a single j active failure in the new Class I firewater flow path. The l confirmatory analysis needs to address EES pre-cooling times and '

long tern cooling capability, o PSC should perform an explicit confirmatory analysis to demonstrate that the alternate flow path via the emergency feedwater header accommodates a single passive failure in the preferred flow path via the emergency condensate header.

1 l

12

t -

o

~

ATTACINENT Internal Correspondence ,

MA AflN WARIETT A ENERGY $Y$tEws,INC. J

4 arch 25. 1987 i S.;J. Ball Fire Water Cooldown Induced Water Hammer in Fort St. Vrain Steam Generators l

Reference:

" Analysis of the Capability of the Fort St. Vrain Steam Generators to Withstand the Fire Water Cooldown Transient Following an Appendix 'R Fire," Rev.1, NLI-86-0649 As you requested, Jack Dixon and I reviewed the portion of the reference document regarding structural effects of water haramer. The report was qualitative and brief, but we agree with the following two assertions.

1. Water hammer caused by the collapse of a pocket of steam surrounded by incoming cold water is unlikely due to the steam generator design.

2. Water hammer forces in the steam generator tubes are significantly reduced by the pressure wave restriction at the entrance to the tubes.

However, we do not have enough information to comment on the water hammer- '

like forces produced by the cooling water sweeping through the steam generator nor on the effect on the generator of an external pressure wave being largely absorbed at the generator tube entrance.

We have experience in calculating structural response to water hammer loads including fluid entering a dry system and in performing confirmatory analyses of power reactor piping systems for the NRC. If the NRC would like to pursue this matter further, we will discuss schedules and cost with you.

If you have any questions, do not hesitate to contact ce.

C $

C. R. Hammond,1000, MS-332, ORNL (4-6499) - NoRC cc: J. R. Dixon ft. W. Glass T. W. Pickel W. C. Stoddart File - CRH lj N N ,

A7

l i

. , .- - . ,.... -.,,...; i F ,, v . , T Ei A F, R E r sF o. . .r ,-i 4st -

tv v ,.svuvv....

i l l t ce --

./ h 25 gs; =

4

,(,r m

6 2.2 e

2- , ?

'5': 1e u

/

gy y w, -x e 1.6 gc - T N N

'2

\

g ,,- ; -1 U ' '

\

08 i w 06

\ -

1%.

0.4 - , %

0.2 0 2 4 6 8 T1WE (HOUF,)

Max. Fuel Temp: ORECA O PSC 4 Core Outlet Temp: ORECA+ PSC A

-2

.rg,v,7r',vp.? -- r vc - .t- :- -- -- - - - c -- .-- ::- : - -- ~ ~ ~ - - - - - -

l

'I'

. F /.,. 2 PRESSURE PE5PO!JSE l l E0 rootDown \

, ?! 0 . l l

1r)O 1 .

(p'

\i b_._ '

i 4..

i

' l

\ l t ' l )

\ i i 1 f/)O \ _ . ,i, '

p 1 : !

' E ,

w 660 .

l g ? '

D

$ 500 E

L 450 H%g 400 -

7 s

.%0

.30 0 0 2 4 6 8 TlWE (HOUR 3)

O PPESSURE + P7-C PRES"URE FIG. 3 CONTROLLED PRIMARY FLOW EQ C00LDOWN 2.2 '

W

" l l m / /

j 7 h '"' '

/ /

jl p'

xy

] [ -

0.8 i % g y

0.6 0.4 i

O.2

.~

.\ .

O" .O f .

C 2 4 6 8 0 CROGTOR FLOW + PSC FLOW

o I

DISTRIBUTION E. Chan Docket No. 50-267 JUL 21M Docket File LNR W DR Local PDR PD4 RF Mr. R. O. Williams, Jr. T. Murley D. Crutchfield Vice President, Nuclear Operations F. Miraglia F. Schroeder !

I Public Service Company of Colorado J..A. Calvo P. Noonan P. O. Box 840 K. Heitner 0GC-Bethesda Denver, Colorado 80201-0840 E. Jordan J. Partlow ACRS (10) South Texas Pf

Dear Mr. Williams:

W. Patton J. Jaudon, RIV J. Gagliardo, RIV E. Johnson, RIV

SUBJECT:

AUTHORIZATION FOR INTERIM OPERATION OF FORT ST. VRAIN AT 82 PERCENT OF FULL POWER By this letter, the Commission is authorizing operation of Fort St. Vrain to exceed 35 percent of full power. In accordance with the commitments contained .

in your letter dated January 30, 1987 (P-87038) which describes your power !

ascension plans, you are not authorized to exceed 82 percent of full power.

In support of your request to operate the plant at this higher power level, you have made numerous submittals as referenced in the enclosed Safety Evaluations. These submittals have been reviewed by the staff and by our ;

contractor, Oak Ridge National Laboratory (ORNL). The evaluation performed by ORNL is summarized in their Technical Evaluation Report (TER) (Enclosure 4).

ORNL reviewed the flow of fire water to the steam generator and evaluated your thermal hydraulic analysis of the cooldown process. Their independent model cal-culations confirm that Safe Shutdown Cooling can be accomplished from 82 percent of full power without fuel damage. The staff reviewed your analyses concerning l the behavior of the steam generator materials and structures during the Safe Shutdown Cooling. The staff's evaluations have shown your analyses are acceptable l

(Enclosures 1 through 3).

Your commitments set out in Enclosure 2 to NRC's letter of April 6,1987 remain unchanged.

Sincerely, Original signed by 1'homas E. Earley Thomas E. Murley, Director Office of Nuclear Reactor Regulation

Enclosures:

As stated cc w/ enclosure:

See next page PD4 ')( H PD4 }{ B b PD4 [ D RR KHeitner:as PNoonan JACalvo F roeder DC utchfield FM lia 06/15787 06/ts787 06/1f/87 06 /87 Q/ ( /87 Of /87 OGC-Bethesda DP hR .IERR

')W J %ek jurley 06/ w/87 /87 of/%/87 M.,\ c~~u.w f ro.,, h N CA h* b Y O O **~ -[ ? Q Q })cb q ) O- h

f

. Mr. R. O. Williams q Public Service Company of Colorado Fort St. Vrain l l

l cc:

Mr. D. W. Warembourg, Manager Albert J. Hazle, Director Nuclear Engineering Division Radiation Control Division Public Service Company Department of Health !

of Colorado 4210 East lith Avenue l P. O. Box 840 Denver, Colorado 80220 l Denver, Colorado 80201 l Mr. David Alberstein, 14/159A Mr. R. O. Williams, Acting Manager GA Technologies, Inc. Nuclear Production Division Post Office Box 85608 Public Service Company of Colorado i San Diego, California 92138 16805 Weld County Road 19-1/2 l Platteville, Colorado 80651 l Mr. H. L. Brey, Manager l Nuclear Licensing and Fuel Division Mr. P. F. Tomlinson, Manager ;

Public Service Company of Colorado Quality Assurance Division i P. O. Box 840 Public Service Company of Colorado l Denver, Colorado 80201 16805 Weld County Road 19-1/2 l Platteville, Colorado 80651

! Senior Resident Inspector !

U.S. Nuclear Regulatory Commission Mr. R. F. Walker 1 P. 0. Box 840 Public Service Company of Colorado Platteville, Colorado 80651 Post Office Box 840 Denver, Colorado 80201-0840 Kelley, Stansfield & 0'Donnell Public Service Company Building Commitment Control Program Room 900 Coordinator 550 15th Street Public Service Company of Colorado Denver, Colorado 80202 2420 W. 26th Ave. Suite 100-D Denver, Colorado 80211 Regional Administrator, Region IV U.S. Nuclear Regulatory Commission 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 Chairman, Board of County Commissioners of Weld County, Colorado Greeley, Colorado 80631 Regional Representative Radiation Programs Environmental Protection. Agency 1 Denver Place 999 18th Street, Suite 1300 Denver, Colorado 80202-2413

fh 0(f C

/ 'o

~g UNITED STATES

["

.p g NUCLEAR REGULATORY COMMISSION WASHINGTON. D. C. 20555

/ Enclosure 1 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO SAFE EMERGENCY SHUTDOWNS (REACTOR SYSTEMS)

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION DOCKET NO. 50-267

1. 0 INTRODUCTION In Fort St. Vrain License Event Report (LER) #86-026, dated October 17, 1986, the Public Service Company of Colorado (PSC) reported that the Safe Shutdown Cooling System for removing the decay heat following the postulated " Design Basis Earthquake" or " Maximum Tornado" accidents was inadequate. PSC stated in this LER that if one of these two accidents were to occur while the reactor was operating at 105% power, and if, as postulated in Section 10.3.9 of the FSAR, the functions of all non-seismic, non-Category 1 components were lost and the primary holium coolant flow was assumed interrupted for 90 minutes to allow for manual realignments, the safe shutdown cooling system would be unable to keep the fuel temperature below the 2900 F limit.

Further this LER states that the analysis for the removal of decay heat by the Safe Shutdown Cooling System, "did not consider firewater pump capacity "

nor the associated steam generator inlet or discharge piping configurations.

For the corrective action in the LER, the PSC committed to reanalyzing this Safe Shutdown Cooling System and providing an acceptable method to remove the decay heat and cool the plant without fuel temperatures exceeding 2900 F.

In the two-loop Fort St. Vrain plant each loop has six steam generator modules which have parallel secondary coolant flow paths. Each steam generator has two sections, i.e. , an economizer-evaporator-superheater (EES) section and a reheater section.

The reheater sections of the steam generators are much smaller than the EES sections; so their use seemed logical for removing the smaller decay heat load. However, the reheaters are designed for steam, not water, so their cross sectional flow area is relatively high. The consequence of this is that the firewater pumps have only enough flow capacity to flood one or two reheater sections, rather than all six as previously assumed. PSC's re-analysis showed that this partial flooding would not provide enough heat transfer area; so PSC concluded that the reheater sections should not be used for the Safe Shutdown Cooling.

Instead, PSC proposed to use the EES sections by initially venting them to the atmosphere. Hewever, the available vent path was not redundant or seismically qualified, so new 6 inch vent lines had to be installed. Even g?O7 / 33 %g

6

. with these new vent lines PSC found that the fuel temperature could not be kept below the 2900 F limit for the Safe Shutdown Cooling accident scenario from 105% reactor power.

PSC had analyses done to determine from what power level safe, emergency shutdcwns could be accomplished for all of these accider,t scenarios. These i analyses, which PSC submitted to the NRC, showed that, cepending on the ;

accident scenario, the fuel temperature can be kept t'elow the 2900' F limit i during emergency shutdowns after long-term operation at power levels up to j and including 82 percent power.

2. 0 EVALUATION i

The NRC had the Oak Ridge National Laboratory evaluate all of these sub-mittals. The technical evaluation report (TER) on this evaluation is Enclosure 4. Three parts of the TER pertain to this Safety Evaluation (SE).

The fourth part, which is on possible structural and metallurgical failures j in the steam generators, is the subject of a separate safety evaluation. {

The NRC staff has reviewed the ORNL TER and agrees with ORNL's evaluations 1 and conclusions, except as addressed below.

The first of the three parts is the evaluation of the calculations of the 1 maximum fuel temperature that will be obtained after these postulated {

accidents. This evaluation was made by using the Oak Ridge developed.0RECA l computer program to independently calculate these temperatures. As can be seen in the TER the ORECA calculations show that 82% is a conservative power level for a limiting fuel temperature of 2900* F. We concur with this finding in the ORNL TER that the 82% power limit proposed by the licensee is acceptable.

The second of the three parts in the ORNL TER that pertain to this SE is the evaluation of the ability of the existing systems to supply sufficient water

! flow to both the helium circulator pelton wheel drives and the EES sections l of the steam generators during these emergency cooldowns. The final con-

clusion of this lengthy review is that for these scenarios, "there is substantial margin in the existing cooling systems to provide for a safe shutdown." This conclusion is contingent on several items, two of which l with we concur and restate as follows

1. There are operating procedures for these accidents and that the operators have been trained to follow them. i l 2. PSC should perform an explicit analysis to demonstrate that the original' Class I firewater flow path can accommodate a single active failure in the new Class I firewater flow path when the required EES pre-cooling times and the long term cooling are accounted for. )

Another contingency in the ORNL TER findings is for the NRC to perform an )

audit or do confirmatory analyses of the PSC flow calculations. However, the staff believes that with the satisfactory agreement between PSC's cal- ;

culated results and the results of the firewater flow test, which are i

I reported in Reference 2 and mentioned on page 7 of the TER, no confirmatory analyses are required. (However, the staff has requested NRC Region IV to perform an audit of the licensee's independent verification of these calculations.)

The remaining contingency in the TER findings and conclusions is concerned with a passive failure after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of cooling. However, PSC's calcu-lations show that after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of cooling adequate flow can be obtained from a redundant flow path. Based upon these calculations, the staff finds that a passive failure can be accommodated.

By letter dated June 24, 1987, the licensee has stated that:

(1) operating procedures have been provided for the postulated " Design Basis Earthquake," " Maximum Tornado," and " Appendix R Fire" accidents and the operators are trained to follow them; and (2) all of the redundant firewater flow paths can accomr.odate a single active failure up to 83.2 percent power. (This includes EES pre-cooling times and long-term cooling.)

On this basis we conclude that the first, second, and fourth conditions described above provide an acceptable basis to satisfying the requirements of the second part of the ORNL TER, and that the licensee has shown that the existing systems can supply sufficient water during emergency cooldowns.

The third of the three parts in the TER that pertain to this SE is the

~

evaluation of the possibility of water hammer that would prevent these emergency cooldowns. The ORNL TER agree:, with the licensee's con-clusions that a water hammer is unlikely because of the steam generator design, and water hammer forces would be reduced by the restriction of the tube entrances. The staff further notes that steam generator modules are designed for an inlet pressure of about 3180 psia (Table 4.2-7 of the FSV FSAR). By contrast, the firewater pumps have a total design head of only 140 psia (Section 9.12.3.3 of the FSV FSAR).

It is difficult to conceive how the low pressure output of the pump can cause damage to a system designed for over 20 times that pressure.

Hence, the staff concludes that it is highly unlikely that a water hammer will preclude a safe shutdown.

3.0 CONCLUSION

S The staff finds that the Fort St. Vrain reactor can be shutdown after prolonged operation at 82 percent of the licensed power without having the fuel temperature exceed the 2900 F limit. Thus the staff finds that operation at 82 percent power is acceptable.

4.0 REFERENCES

1. SECY-77-439 dated August 17, 1979.

2. Letter from H. L. Brey, Public Service Company of Colorado, to J. A. Calvo, USNRC, dated May 4,1987.

Principal contributor: E. Lantz, RSB l

Dated: July 2,1987 I

i

3 Enclosure 2_ ]

/, fps asog'o, ,

UNITED STATES ,

p .q g NUCLEAR REGULATORY COMMISSION .l j; WASHINGTON. D. C. 20555 j

\ ******/ - SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION ;

j T I RELATING T0 SAFE EMERGENCY SHUTDOWNS'(S'EAM GENERATOR MATERIALS)

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION LICENSE DPR-34, DOCKET NO. 50-267

1. 0 INTRODUCTION By letter P-87002 dated January 15,.1987, thePublicServiceCompany.ofl !

Colorado (the licensee) proposed to eliminate reliance on only the reheater i section of the steam generator for safe shutdown cooling at.the Fort St. j Vrain Nuclear Generating Station. The change is necessary to support safe ;

shutdown cooling from power levels above thirty-nine percent.

The licensee performed analyses confirming that one reheater section was not adequate to provide firewater safe shutdown cooling after a 1\-hour inter- !

ruption of forced cooling (10FC) with the Fort St. Vrain' reactor operating i at 105% power. The fuel temperature was estimated to peak at 3024'F from this power level, exceeding the 2900*F temperature limit established in the Final Safety Analysis Report (FSAR). Further analyses indicated that: {

safe shutdown cooling could be performed with one EES section supplied with !

firewater after a 1 -hour 10FC from power levels up to 87.5% without ,

exceeding a fuel temperature of 2900*F.

The purpose of this Safety Evaluation is to assess the capability of the steam l generator to maintain structural integrity for firewater safe shutdown cooling i from 87.5% reactor power utilizing the EES section from one steam generator following 1\ hour 10FC. An evaluation of this transient was reported in General Atomics (GA) Document 909269 N/C, attached to letter P-86683, Public Service Company of Colorado, dated December 30, 1986. The primary system pressure and the hot module inlet helium temperature were calculated as shown in Figures 4-4a and 4-Sa, respectively. The primary pressure was shown to decrease to about 600 psia during the initial phase of 10FC, abruptly increasing to about 640 psia on initiation of circulation, then abruptly decreasing to about 350 psia for the remainder of the 10-hour period. The helium inlet temperature was calculated to increase to~ about 1300'F during the flow interruption and further increase to 1500'F after the start of forced flow, then gradually decrease to about 300*F during the next 8-hour period. The temperature was calculated to remain above 1400'F for a 1\-hour period.

2. 0 EVALUATION The steam generator modules were designed, fabricated and inspected to the requirements of the ASME Boiler and Pressure Vessel Code, 1965 Edition,

-- yd")-/3 C y@h 6 '

i l

including Winter 1966 Addenda, and the Standard Code for Power Piping, USAS B31.1, 1967 Edition. The ASME Code was supplemented by the following Code Cases: 1319, 1325-3, 1330-1, 1331-4, 1342-1, 1351, 1352, 1361, 1362-1, 1383 and 1389.

The layout for the steam generator modules consists of five sections of helically fabricated tubing. Referring to GA Document 909190A, the reheater and superheater II were constructed with .1 in. 0.0. by 0.205-in. wall Sanicro-31 tubing; the superheater I and evaporator were constructed with 1-in. 0.D. by 0.125-in, wall 2% Cr - 1 Mo alloy; and the economizer was constructed with 1-in. 0.0 by 0.187-in, wall Cr-% Mo alloy tubing. The feedwater inlet was constructed with 1.25-in. 0.0. by 0.187-inch wall plain carbon steel tubing.

GA Document 909190A records the result of a structural evaluat'on of the most critical regions of the steam generator during a single cycle cooldown from power using firewater in one reheater module. It was shown that this one time ;

event would not violate the integrity of the pressure boundary, provided the local helium temperature was limited to 1350 F maximum and not remain above l

l 1300 F for more than one hour. Creep buckling collapse of the steam generator tubes was identified as the principal failure mode and the primary stress loading for this event. Specific phonomena of concern were the surface strains caused by thermal shock in the cold-worked material of the reheater tube at small-radius bends, and the plastic strain accumulation in the tube bundle due to local yielding and elastic follow-up.

The creep buckling computer program (BUCKLE) was used to calculate tube collapse time; that is, the time for the tube ovality to attain the value which caused the maximum local stress to equal the material yield stress. The program uses constant values for temperature and external pressure. The study showed that the most critical steam generator tube for creep buckling above 1330 F was the economizer at the feedwater inlet. At temperatures below 1330 F, the carbon steel feedwater inlet tube was identified as the most critical material. {

i The respits of a structural evaluation of the critical regions of the steam j generator during a single cycle cooldown from 105% power using firewater in !

,tne EES tube bundles were presented in GA Document 909204 N/C. The local

~ helium temperature and pressure varied during the event: for the first I hour period, the temperature was less than 1300*F and the pressure peaked at 700 psig; for approximately 2-hours following the initial period, the temperature peaked at 1660 F and the pressure decreased to 350 psig. The structural evaluation showed that the reheater tubes would not undergo creep buckling collapse failure during a single firewater cooldown event provided that the reactor power level was limited so that the maximum helium temperature was less than 1660 F for a period less than 20-hours, and the maximum helium pressure

was not more than 350 psig. Further, the evaluation showed that creep buckling collapse would not be a viable mode of failure at 1500 F. The calculated collapse time in hours for reheater tubes with 12% cold-worked ovality were calculated at 196 hours0.00227 days 0.0544 hours 3.240741e-4 weeks 7.4578e-5 months for a temperature of 1500 F and pressure of 822 psig.

l After reviewing the analyses presented on the capability of the steam generator to withstand the firewater cooldown transient following a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 10FC, the staff (and consultants) expressed specific structural and metal-lurgical concerns to the licensee. A summary of the licensee's response is presented below:

a) The structural effect of introducing firewater into the hot steam generator was addressed. A review of the original design calculations indicated compliance with ASME mechanical limits and fatigue usage factors. The introduction of cold water would result in a strain of 0.49% compared to an estimated end-of-life ductility of 8% for Sanicro-31.

b) The potential for either vapor-lock or water-hammer was addressed in Attachment 9 to letter P-86682. After reviewing the geometry, design, heat transfer and hydraulic characteristics of the EES section, it was concluded that with one firewater pump operating and the primary coolant flow rate controlled, flow could be established and maintained in all modules without either vapor-lock or water-hammer (flow stoppage) in any of the modules.

c) The concern was raised that a rapid increase in system pressure could occur if steam bubbles were to form in a steam generator tube during cooldown, resulting from the expansion of flashing water. Emergency procedures preclude this condition. Once the steam generator is flooded, '

helium flow is controlled to maintain adequately subcooled liquid at the steam generator outlet.

I d) Concern was expressed on the metallurgical effect of prior service on properties of the steam generator tubes. Sanicro-31 (Alloy 800H) tubes are potentially subject to metallurgical change, including recrystallize-tion, sensitization, and precipitation aging, which may have a negative influence on the fatigue life, fracture toughness, and ductility. The loss of fatigue life is not a concern as the transient would be single-cycle event resulting in plant shutdown. Extensive long term experience with the material in welded construction in elevated temperature service, together with considerable laboratory data, indicate that Sanicro-31 retains sufficient toughness to assure notch-ductile behavior under the loading rates applicable to the cooldown transients. The reduction in residual ductility, however, raised concern about the tubes ability to service the thermal shock and increased bending loads caused by the cold firewater flowing through the hot tubes. Reports were submitted showing that the tubes and their welds have ample margin to survive the cooldown transient at any point in the plant's life. Additionally, sensitization to stress corrosion cracking does not present a problem due to the short duration of the transients.

h

. 1 l

The second group of materials (2\Cr-1Mo, Cr- Mo, and plain carbon steel) l may be subject to corrosion when exposed to the chemically untreated !

firewater for extended periods. The corrosion rate could be enhanced by j erosion caused by particulate found in the fire water. For the low flow l velocities involved and for the length of the cooldown, corrosion of these l

l tubes is not expected to be significant. l l

The licensee has reported two steam generator leaks. The first leak l occurred in November 1977, in loop 1 and the second occurred in December l 1982, in Loop 2. The leaks were estimated to be 0.003 inch in diameter. !

They were located in the Sanicro-31 material in the superheater II section l of the steam generator. j Sections of the Sanicro-31 tubes were removed for metallurgical examination during the plugging operation. The Fe-Cr-Ni oxide on the surface had an average thickness of 0.008 inch with no evidence of pitting, cracking or corrosion / erosion damage. The metallographic structures of the Sanicro-31 alloy was considered to be typical as received, fine grained with evidence of l some cold-work, free from carbide precipitation. The material showed no sign j of significant metallurgical degradation from service. The licensee concluded !

that the cause of leakage could not be determined and was random in occurrence. l The properties of cold-worked and recrystallized Sanicro-31 (Alloy 800H) were l

, reported in Volumes I and II of EPRI-HTGR 86-03, " Properties of Recrystallized l Alloy 800H and Associated HTGR Steam Generator Design Implications," July 1986. l It was found that at 1350 F, 20% cold-worked material would recrystallize to about 35% by volume in a design life of 30 years. Recrystallization would lower the rupture strength and increase the creep crack growth rate for a l l given applied stress and temperature. The kinetics of the recrystallization process and the effect on the metallurgical properties of Sanicro-31 were calculated for the Fort St. Vrain steam generator in Volume II of the referenced report.

3. 0 CONCLUSIONS We conclude from our review of the materials of construction and the analyses submitted by the licensee that the Fort St. Vrain steam generator is capable of maintaining structural integrity during a firewater safe shutdown cooling transient from 87.5% reactor power using the evaporator-economizer-superheater (EES) section for cooling following an 1\-hour l

interruption of forced cooling (I0FC). The conclusion in part is based on i the analyses of the transient showing a maximum inlet helium temperature of 1500 F at a pressure of 350 psia. The temperature was estimated to remain above 1400 F for a period of 1 -hours during this single event. This l

transient condition represents the worst case conditions for an emergency plant shutdown. Under almost all other conditions, when high pressure feedwater is available, both the reheater and EES portions of the steam generator are flooded. This would cause the materials in the steam generator to be adequately cooled and, not subjected to high temperatures.

In this analysis, the demonstration of material and structural integrity assures that the steam generator can remove heat from the reactor core

under a severe transient. Thus, under severe transient conditions, the fuel temperature can be maintained under accepted temperature limits, and the plant can be safely shutdown.

Principal Contributor: F. Litton, METB i I

Dated: July 2,1987 )

l i

1 l

1

~ \

p Itto

+f jog UNITED STATES

! n NUCLEAR REGULATORY COMMISSION 7; : E WASHINGTON D. C. 20555 Enclosure 3 t '/

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR PEACTOR REGULATION l RELATING TO THE EFFECT OF FIREWATER C00LDOWN ON STEAM GENERATOR STRUCTURAL INTEGRITY' I

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION l

DOCKET NO. 50-267

1.0 INTRODUCTION

On December 30, 1986, Public Service Company of Colorado (PSC) submitted a letter (Ref. 1) with an attached analysis to justify operation of Fort St. Vrain, at 82% power. Safe operation at this level is based on a proposal to circulate available plant firewater through the Evaporator and Economizer /Superheater (EES) tube bundles of the steam generator modules in an event requiring safe shutdown of the plant. This would permit safe shutdown cooling following a ninety (90) minute interruption of forced helium circulation. Attachment 7 (Ref. 2) to the letter represents the structural evaluation of the most critical regions of the steam generators during a single cycle cooldown from 82% power. The objective of this eval-uation was to show that the primary pressure boundary of the steam gener- i ator will remain intact even when firewater is used in the Ef3 tube i bundles to cool down the reactor from a more conservative 100% power J condition. The primary analysis for structural integrity of the steam I generator is based on creep collapse. Creep collapse, is considered to i be the only conceivable mode of failure for the hottest steam generator tubes under the conditions analyzed. ,

2.0 EVALUATION Three regions within the steam generator modules were determined to be of concern during this event: 1. the reheater tubes and their supports;

2. the EES tubes and'their supports. The superheater tubes consists of two cets of tubes, labeled Superheater I and Superheater II. Of these, the latter are the most affected. 3. The Superheater 11 downcomer and its support.

The critical region cortprises the reheater tubes. During EES cooldown ;

conditions these tubes have uniform temperatures and low internal ;

pressures, so that the interaction loads between tubes and the tube support plates are low. However, there is a time interval of about 90 minutes during which the helium flow is stopped. In this interval the reheater and the EES tubes are purged of water / steam inventory, and are

$ ') O ONbb 5

1 i

in fact vented to the atmosphere, so that the internal pressure in these tubes is essentially atmospheric. The helium pressure peaks at 700 psig j and the metal temperature drops from 10009F to 780 F. These tubes are i therefore under net compressive radial loading. This external pressure, combined with the hottest helium temperature impinging on the tubes 1 indicates that a likely mode of failure for the reheater tubes is by l creep buckling and collapse.* General Atomics (GA) has performed an j evaluation of the reheater tubes subject to these conditions using the GA BUCKLE computer program (Ref. 3). The basis for this program (Ref. 4) was ,

reviewed and found to be reasonably acceptable. The program was verified {

by comparison with the solutions for two test problems involving creep <

collapse, obtained by using the widely available program MARC-General Purpose Finite Element Program (Ref. 8). GA provided this verification (Ref. 5) and has shown that there is reasonable agreement between the two sets of solutions. We find this acceptable.

The evaluation consisted of an analysis of a straight tube of nominal diameter and wall thickness, and the maximum allowable small-radius-bend manufacturing ovality, subjected to external pressure at high temperature.

For evaluation of the creep buckling / collapse of a cross-section, GA stated that in this case the analysis of a straight tube is conservative as compared to the analysis of a curved tube since the tubes do not experience restraint of thermal expansion and any bending moments in the bends are therefore minimal. (The tube bundle and its support structure were stated to be at the same temperature.) Likewise bending mornents due to safe shutdown earthquake (SSE) and low level vibration were determined also to be minimal. The additional ovalization due to such moments is therefore also insignificant, and a tube bend is therefore more resistant to external pressure than a straight tube. However, if the bending loads had been significant, then the effect of the additional tube ovality caused by bending of an already curved tube would have required evaluation.

We find these arguments acceptable.

The program determines the creep buckling time for a straight cylindrical tube with initial ovality, subjected to constant external pressure and constant material temperature. The criterion for determining that buckling has occurred is that the highest stressed point in the tube cross-section has reached a stress level equal to the yield stress of the material at temperature. This is a conservative criterion for thicker tubes such as the reheater tubes, which have a diameter-to-wall-thickness ratio of eight. Such tubes were shown not to buckle at stress levels, below the yield stress. We find this procedure acceptable. .

l Since the program uses constant values of external pressure and tempera- !

ture, a parametric study was performed to determine the time for achieving i the yield stress level for various combinations of pressure and tempera- l ture. It was thus determined that the creep collapse time at 1660*F and i 350 psig exceeds 20 hrs. This is a conservative result since the time i i l

^The term " buckling and collapse" does not imply sudden, catastrophic !

deformation under creep conditions. Rather, it describes time ;

dependent deformation. It is thus characterized by a time limit instead j of a load limit. 1

. 3 interval at which the actual tube experiences this temperature during the cooldown event is considerably shorter. This value of temperature repre-sents the maximum temperature experienced by the tube after helium circu-lation is restarted. After about 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months it was shown to achieve a value of approximately 350'F, after which there is a further decay with time.

Likewise, the external pressure was shown to drop to about 300 psi, after which it remained approximately constant. Thus, the actual creep collapse time appears to be much longer than 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months , and certainly much longer than needed to achieve cold shut down. However, prior creep fatigue damage can affect the creep-collapse failure mode if the prior accumulated '

creep-fatigue damage is high. GA has therefore stated that the fatigue analysis performed and reported in the original steam generator design report (Ref. 6) showed low fatigue damage even in those regions of the steam generator where there were significant cyclic loads. Since the thermal loads in the reheater are low it is expected that there will not -

be any significant creep-fatigue damage in the reheater tubes, particularly adjacent to the small radius bends where the maximum ovality is expected to occur. Creep-fatigue damage will therefore not likely affect signifi-cantly the predicted creep-collapse times. We find this acceptable.

The reheater tubes and their supports are basically at the same temperature during EES firewater cooldown. The interaction loads between the tubes and the tube support structures due to restrained thermal expansion are therefore minimal. Likewise, the stresses due to combined SSE loading, dead weight, internal pressure and helium flow drag loads were shown in Ref. 6 to satisfy the ASME Code,Section III, requirements for primary stresses at 100% power. During the firewater cooldown, the stresses due to pressure and thermal effects were determined to be lower than the stresses at 100% power, while at the same time the allowable primary stress was higher, since this is a one time, short term plant event. GA has therefore provided reasonable assurance that an SSE occurring during firewater cooldown will not f ail the reheater tubes. We find this accept-

~

able.

A structural investigation of the Superheater II helical bundle under combined sustained and thermal expansion loading was also performed.

The stresses under firewater cooldown were determined by multiplying the i full power operation stresses by the ratios of the corresponding thermal and mechanical loads for the two conditions. The full power operation stresses were obtained from Ref. 6. The pressures and tube wall thermal gradients are lower under firewater cooldown than those under full power operation. However, the loads resulting from tube and tube-support plate )

interaction increase due to restrained thermal expansion. The stresses i due to this interaction are, however, classified as secondary and are therefore not required to be evaluated for faulted conditions. GA has evaluated the primary stresses in the tubes when subjected to combined ,

flow induced vibration, dead weight, SSE and pressure leading and has i determined that the ASME Section III limit at teinperature as stated in ,

Ref. 7 is satisfied. Although not required, GA has also evaluated the i combined total primary plus-secondary stresses, to verify that even under upset conditions, the required stress limit at 385'F" is also satisfied.

This stress limit was obtained from Ref. 7, which is applicable at ITiils is the peak tube surface temperature. l

. i s

I temperatures below 800*F. The EES tube-support plate stresses were also stated to be within design allowables at the firewater cooling tempera- !

tures. We find these evaluations acceptable. i For the Superheater downcomer and its support structure,.GA has stated that during full power operation the differences 'in temperature are very small, and will not cause significant differential thermal expansion. The temperatures, as well as the pressure in the downcomer, during firewater cooldown are considerably lower, while the SSE stress remains the same.

Because of the lower temperature the stress limit also increases, so that the safety margins increase considerably as compared to those at full power operation. Thus, on the basis of a comparison of the temperatures used for analysis at 100% power with those predicted during firewater cooldown, GA determined that the stress limits would not be exceeded i under this condition. We find this acceptable. ,

3.0 CONCLUSION

The results of the structural evaluation by GA of the most severely loaded I regions of the steam generator, during a single cycle of cooldown from )

power using plant firewater, has shown that the most critical region is j in the reheater. GA has demonstrated that the reheater tubes will not !

experience collapse due to creep during such a cooldown cycle, including 1-1/2 hours of interrupted forced circulation, provided that the power level is limited so that the maximum helium temperature is less than 1660*F for less than 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months and the corresponding maximum helium pres-sure is no more than 350 psig. GA has also demonstrated that in other regions, such as the Superheater II tubes and the Superheater downcomer, the stresses are below the corresponding ASME Section III design limits. I We find these demonstrations acceptable.

4.0 REFERENCES

l

1. Letter No. P-86683, from D. W. Warenburg, PSC, to H. N. Berkow, NRC, dated December 30, 1986.

2. Lewis, A. G. , "Ef fect of Firewater Cooldown Using EES Bundle on Steam Generator Structural Integrity." GA Documents 909204/NC and 909204/A, ,

December 4,1986 and June 5,1987. l

3. Almajian, A. T. , " Buckle Users Manual." GA Document 909410/NC, April 1987.

4. Pan, Y. S, " Creep Buckling of thin Walled Circular Shells Subject to Radial Pressure and Thermal Gradients,".J. of Applied Mech., March 1971, pp. 206-216.

5. Almajian, A. T., " Verification Report for the BUCKLE Computer Program."

GA Document 909438/NC, May 28, 1987.

6. GA Report No. GADR-9, " Stress Report for Fort St. Vrain Steam Generator," October 1, 1970.

. 7. ASME B & PV Section III Summer 1968 Edition, including Code Case 1342-1.

" MARC General Purpose Finite Element Program," MARC Analysis Corp., I 8.

Palo Alto, California, March 1983. I

{

Date: July 2,1987 j Principal Contributor: Mark Hartzman, MEB l

)

l l

l

Enclosure 4 4 e

TECHNICAL EVALUATION REPORT l F0hT ST. VRAIN NUCLEAR GENERATING STATION i DOCKET 50-267 )

LICENSEE: PUBLIC SERVICE CO. OF COLORADO FORT ST. VRAIN SAFE SHUTDOWN FROM 82% POWER PREPARED BY: .

S. J. Ball D. L. Moses l l

Oak Ridge National Laboratory .

i Oak Ridge, TN. 37831 i I

June 4,1987 NRC Lead Engineer: K. L. Heitner Pro, Ject: Selected Operating Reactors Issues (FIN A9478) i O h /9

i I

- - - - i I

' NOTICE This report was prepared as an account of work sponsored by an agency of the 1 j

United States Government. Neither the United States Government nor any agency i thereof, or any of their exployees, makes any warranty, expressed or implied, or assumed any legal liability or responsibility for any third party's use, or i the results of such use, of any information, apparatus, product or process l disclosed in this report or represents that its use by such third party would .

not infringe privately owned rights. l 1

i 1

,a- vu g

i s

Technical Evaluation Report - Fort St.' Vrain Safe Shutdown From 82% Power S. J. Ball D. L. Moses

1. Introduction ORNL has provided technical assistance to NRC in their evaluations and analyses of issues raised in Fort St. Vrain's 1987 Power Ascension Plan (P-87038). ORNL had previously performed analyses which confirmed the !

Public Service Co. of Colorado (PSC) assertion that for long-term operation at l 35% power, a safe shutdown could be achieved even if all equipment exposed to a harsh environment in a worst-case high-energy line break (HELB) scenario !

were assumed to fail. From these studies it was concluded that, for a worst-case permanent loss ,of forced circulation (IDFC) event, a long ters cooldown ;

using only firewater coolant in the PCRV liner cooling system (LCS)Inas the' addition, ultimate heat sink would not result in significant fuel failure.

restart of coolant to the LCS after postulated prolonged downtimes would be both feasible and acceptable.

Upon successful implementation of the steam line rupture detection and isolation system (SLRDIS) at FSV, it was determined by analysis that the long '

term reactor power should be limited to values below 100t. This is due to ,

previously undetected limitations in the shutdown cooling systems designed for use in emergencies. Because of the inability to simultaneously flood all six of the reheater sections of the steam generators in a loop (at least with the present flow capacity and piping arrangements), reheaters can no longer be counted on for emergency cooldowns following postulated 90 min duration LOFC events. If hot helium coolant from the core (following restart of -

circulation) were not cooled by the reheater bundles in several modules, the hot gas could impinge on the economizer-evaporator-superheater (EES) sections' tube bundles and cause failure of the tubing. Consequently, PSC requested a change in the Technical Specifications to eliminate reliance on the use of the reheater sections for Safe Shutdown Cooling (P-87002).

A series of PSC analyses were submitted to NRC that justified long-term power operation at power levels between 82* and 87.5%, depending on which accident scenario was postulated. In the Environmental Qualification (EQ) case, it was clatmed that 87.5% power operation could be justified by relying on only one firewater pump supplying coolant to only one of two (redundant)

EES sections (i.e., all six EES modules in one loop) following a 90 min Lorc event. The EQ event postulates only the use of equipment which is qualified to withstand the design basis earthquake, the maximum tornado and the most limiting HELB. In order to meet this goal, it was necessary to install two (one per loop) 6 in. vent pipes from the EES sections to provide for single failure proof venting during the once-through cooling mode. The other scenarios involved only the use of equipment qualified to survive and operate 1

1

i I

W l

following fires in non-congested cable areas per 10CFR50, Appendix R. For such fires, the emergency cooling flow sources can successfully accommodate i cooldowns from power levels up to 83.24. In January 1987. PSC formally requested permission to operate at power levels up to 82% (P-87038). ;

1 The ORNL technical assistance provided was mainly in two areas. The j first involved confirmatory analyses of various scenarios using accident codes de, eloped under both RES and NRR sponsorship. The second involved a detailed review of the ability of the existing systems to supply sufficient ' water flow to the helium circulator Pelton whe el drives and the EES sections of the steam l generators during'the cooldown scenarios. Two other smaller tasks were l

, included, investigations of possible structural and metallurgical failures in the steam generators (R. C. Owaltney), and an assessment of the potential for water hammer upon restart of coolant flow to the hot tube bundles (C. R. Hammonds). A brief letter report on the latter of these smaller tasks i is provided in an attachment.

2. Accident Scenario Analyses !

2.1 ORECA Code l

The original version of the ORNL ORECA code for simulating HTGR core 1 dynamics is described in ORNL/TM-5159 (1976). Subsequent updates appeared periodically in RES quarterly progress reports, and a detailed writeup on the ORECA code family was submitted to NRC in February 1985 as part of an -

assessment report of all ORNL HTGR accident codes. This latter report described three versions of ORECA: severe-accident and " verification" versions of FSV simulations, and a source term study version for the 2240-MW(t) HTGR design. The ORECA-FSV versions have been used extensively by many different users in many different types of analyses, and have been verified for a variety of transients by comparisons with both plant data and other ,

independent analyses. ORECA is considered to be a "best estimate" code; l conservatism are accounted for by means of sensitivity analysis.

The ORECA code used for this task was a modification of the severe accident sequence analysis (SASA) version. The modifications included an addition of a model of the flooded steam generator EES section, and a model to predict stagnation or reverse flows within the worst-case refueling regions.

The latter feature had been developed as part of ORNL's assessment of PSC's proposed changes to the Tech Spec L.C.0. 4.1.9, which deals with concerns about fuel overbearing in low-flow, low-power operating modes.

2.2 Model and Parameter Assumptions Specific input data for the analyses were provided by PSC and GA. The major assumptions used for the reference case were as follows:

2

9 l

1. Equilibrium core region peaking factors (Max. = 1.83).

l 2. Maximum allowable region outlet temperature dispersions (during i

operation) consistent with 140 4.1.7. (The maximum mismatch value provided l

[100 F) was increased by 50 F to allow for region outlet temperature measurement error.) Orifice positions were assumed fixed for the duration.

3. Long-term operating power (before shutdown) of 87.5%. This corresponds to the EQ case.

4. PSC-supplied estimate of EES cooling water flow (940 gps) following the I 90 min 100C. The helium coolant flow was assumed to be " manually controlled" )

to limit EES water outlet temperatures to 250 F to prevent boiling. The capabilities of the Pelton wheel drive were not limiting. l 3 5. EES (water-cooled) initial performance characteristics per GA's SUPERHEAT code. The subsequent EES performance (with varying inlet temperatures and flows) was calculated using the ORNL code AWHEXI.

6. Flow to the IES is not available for the duration.

l 2.3 Analysis Results ORNL analysis of the reference EQ case accident scenario resulted in i predicted temperatures quite close to those provided by PSC. The ORNL l predicted maximum fuel temperatures were somewhat lower than those. of PSC, l while the mean core outlet temperatures were slightly higher. The ORECA l maximum fuel temperature was 2560 F (1405 C) vs 2858 r (1570 C) per PSC, hence ;

indicating less likelihood of fuel damage. The ORECA maximum average core ,

outlet gas temperature was 1625 r vs. approximately 1500 F per PSC. The -

l corresponding primary system pressures predicted were 425 psia (ORNL) vs.

325 psia (PSC) at the time of maximum core outlet temperature, so overall, the potential for damage to the (dry) reheater tube bundles would be somewhat l greater for the ORNL predictions. Comparisons of the results for . maximum fuel l and average core outlet gas temperatures are shown in fig.1, and.for primary '

system pressure response in Fig. 2. The " manually-controlled" values of primary helium flow are shown in rig. 3, where the ORBCA predictions give somewhat lower allowable flows to prevent boiling in the EES tubes.

Calculations of intra-region flow redistributions in the worst case regions showed that there was no intra-region flow stagnation (or flow reversals) during the cooldown.

Sensitivity analyses were also done to assess both calculational and operational margins for error. For an assumed 20% reduction in the available EES cooling water flow, the predicted maximum fuel temperature was only 2685 r (1475 C), still well below temperatures causing significant failure rates. Variations in the beat transfer performance of the water-cooled EES were made within reasonable bounds, and had very little impact on the resulting peak tempt raures predicted, as did the assurption of LCS failure.

Various assumptions uut the response of the operators in controlling helium flow were also found to be unimportant, although the assumption of a failure to avoid boiling and subsequent choking of the flow was not evaluated. It is 3

l l

reasonable to assume that the recovery time from such a complication (shutting off the helium flow temporarily to reestablish EES water flow) would not be excessive.

Another assessment of the " safety margin" available was done by compounding several uncertainties and/or conservative assumptions to see what it would take for the predicted maximum fuel temperature to approach 2900 F (1600 C). In this case, power for the EQ case was increased by St (to 91.9%) to account for measurement error, EES cooling water flow was decreased by 25% (to 705 gpe), and the restart of forced cooling was delayed an additional 20 min. (to 110 min). The resulting peak fuel temperature was i 2830 F (1555 C), with some refueling regions experiencing reversed f2ow. The '

maximum everage core outlet temperature predic'ed was 1730 F. This indicates that substantial margin for error is available before there would be any concern for significant fuel damage. ;

calculations of the " Appendix R" reference case, with power limited to 83.2% and RES open loop cooling water flow limited to 700 gpa (P-87158),

showed even milder transients than did the E0 cases. The maximum predicted fuel temperature was 2460 F (1350 C) and the maximum everage core outlet gas temperature was 1650 F.

l

3. Water Supply to the Helium Circulator Pelton Wheels and Steam Cenerators 3.1 Introduction and Background '

This portion of the technical evaluation is directed to resolving restart issues arising out of Reportable occurrence (RO) 50-267/86-026 and related to the adequacy of the seismically-qualified Class I Safe Shutdown Cooling System at Fort St. Vrain. The adequacy of the Class I water supply for Safe Shutdown Cooling was initially brought into question as the result of deficiencies identified during startup testing as reported in Unusual Event Report (UER) 50-267/76-05. The particular deficiencies identified in both UER 50-267/76-05 and RO 50-267/86-026 relate to the provision of facility firewater to Class I piping in the Fort St. Vrain secondary cooling system.

To accomplish Safe Shutdown Cooling, Class I firewster has to be supplied with sufficient pressure and flow rate to drive one helium circulator water turbine at required speed and to flood one section of the steam generator economiter-evaporator-superheater (EES) with sufficient cooling capacity to maintain the maximum fuel temperature below 2900 F. In addition, Safe Shutdown Cooling should prevent the surface temperatures of the steam generator tubes and of the bellum circulator components from reaching values that could challenge reactor coolant boundary integrity or the capability to perform long-term cooling. Similarly, Safe Shutdown Cooling should preclude primary system pressure from increasing to the point of lifting the safety relief valves. The sufficiency of the Class I firewster supply to the steam generator EES is dependent on the backpressure in the steam generator, and the 4

l w --~

9 EES backpressure is a function of the downstream piping resistance to EES outlet flow and of whether boiling occurs in the EES tubing after forced cooling of the reactor core is restored.

The two steam generator EES sections are the only primary system heat exchangers capable of supporting Safe Shutdown Cooling. This observation is based on the recent finding, as reported in RO 50-267/86-020, that the resistance in the firewater flow path to the steam generator reheater sections was too high to permit adequate flow for Safe Shutdown Cooling. Previously, Updated FSAR Section 10.3.10 had claimed that the two reheater sections each provided a Class I firewater cooldown capability from full power conditions and that was fully redundant to the EES cooldown capability on firewater.

Recent analyses reported in Attachment 4 of P-86682 indicate that fireweter cooling through a single reheater section module (where one module of six in cach section is the most that can be flooded) will provide effective Safe i Shutdown Cooling capability only from 39% of rated reactor power and with a 90 minute interruption of forced cooling.

As reported in UER 50-267/76-05A (final supplement and more recently amplified and clarified in tne licensee's response)to a request for additional information (PSC Response 6. Attachment to P-87110), testing in 1976 demonstrated that each circulator could apparently be driven at speeds exceeding 700 rpm with 1000 gpm or more supplied to the steam generator EES.

This was achieved by:

(1) fully opening the bypass valves PV-22129 and PV-2229 in the lines' I from the EES outlet to the bypass flash tank and pre-flash tank, respectively, thereby reducing EES backpressure to 50-60 psig; and (2) by physically modifying the discharge flow paths in several valves '

(NV-21257 through HV-21260) upstream of the Pelton wheel water turbine to reduce pressure drops and thereby increase flow capacity to the respective water turbines. '

No testing was performed to quantify reheater flooding with simulated firewater in the 1976 tests. Preoperational testing in 1973 had identified limitations to reheater flooding on condensate, but the results' of the preoperational tests and analysis were not effectively documented. Therefore, the simulated firewater tests that are reported in UER 50-267/76-05 did not include tests or analysis of reheater flooding because the potential problem had not been recognized by PSC.

However, a related event, described in UER 50-267/76-09, identified the fact that the initial analysis of the firewster cooldown had used nominel instead of design power peaking factors. To prevent flow reversal or flow stagnation ;

in the reactor core during the firewater cooldown from power levels greater i than 70% of rated, UER 50-267/76-09B indicated the need to install emergency 5

water booster pumps in the piping immediately upstream of the circulator water turbine so as to increase primary system helium flow from an apparently achievable 2* to between 3 and 44. Subsequently, NRC imposed the requirement to assume a 90 minute delay in establishing firewater flow and Safe Shutdown Cooling following the Design Basis Earthquake or Maximum Tornado (the class I events).

In September 1986, as noted in RO 50-267/86-026, a reanalysis of the design i basis Class I Safe Shutdown Cooling transient (Updated FSAR Sections 10.3.9 and 14.4.2.2) was performed in support of Environmental Qualification. Per the licensee event ' report, the reanalysis indicated:

...that restart of forced circulation at 3% of rated, approximately 1-1/2 hours after a scram from 105* power, will cause steaming and a large pressure increase in the steam generator EES and discharge piping. Under these conditions, secondary flow would be significantly reduced due to the limited capacity of the firewater pumps. Due to this reduction in secondary coolant flow, the heat removal rate computed in the PSAR analysis would not be achievable. !

-j More recently, the confirmatory analysis (Attachment I to P-87053) of other FSAR cooldown transients has shown that the original FSAR analysis of the '

Class I Safe Shutdown Cooling transient assuming an immediate start of firewater (i.e., without assuming the 90 minute delay as currently required) i also overpredicts the firewater heat removal capacity through the EES by at . !

least a factor of two, specifically, an assumed 180 x 108 BTU /hr in the original analysis versus an apparently achievable 86.7 x 108 BTU /hr from the most recent analysis.

For the case of the 90 minute delay in restoring forced cooling (i.e., the current design basis Class I Safe Shutdown Cooling transient), the limiting heat load is stated to be 73.5 x 105 BTU /hr in attachment I to P-87053; however, the achievable firewater heat' removal capacity is not provided for the 90 minute delay in restarting forced cooling.

It should boiling in be thethe EESsame once the steam generator EES is pre-cooled to prevent tubes.

Thus, the attempted resolution to UERs 50-267/76-05 and 50-267/76-09 were inadequate because the associated testing and analyses did not adequately address secondary side pressure and flow conditions that must be attained in the EES during Shutdown Coolingboth the original and the current version of the Class I Safe scenario.

Also, the attempted ' resolutions to both of the 1976 UERs using firewster. failed to address the cooling capability of the reheater sections Therefore, this portion of the technical evaluation assesses the adequacy- of the recent calculations submitted by PSC and the need for further analysis or testing. As indicated previously, this technical evaluation focuses on the performance of the Class I Safe Shutdown Cooling system in accommodating the Design Basis Earthquake and Maximum Tornado (Updated FSAR Sections 10.3.9. and 14.4.2.2).

6 m__.________------^

1 9

3.2 Review of the New Class I Firewater Flowpath Calculations in Recent PSC Submittals The results of PSC's recent analysis have been documented in several submi t t els.

The cover letters to the PSC submittals use the terminology " Safe Shutdown Cooling" to refer to the scenarios addressed in the various sets of subcontractor calculations that are attached to these documents. These either the reactor or turbine building and following major fires noncongested cable ' areas.

seismic event Qualification per 10CFR50.49. is incorporated with the analysis to address Environm change to the Fort St. Vrain Technical Specifications. This change is to Attachment eliminate reliance on the reheater section of the steam generator for Safe Shutdown Cooling and to require instead full reliance on the EES section for the firewater cooldown from power levels up to 82% of rated reactor power .

Adequate firewater flow to the EES section of one steam generator and to one EES backpressure with the use of seismically qualified s the atmosphere from each EES discharge header. In addition, as shown in Figure III-l of Attachment 4 to P-87002, a new seismically qualified (Class I) firewater and flow path the emergency has beenheader.

condensate installed between the firewater discharge header valves that have been installed for remote operation outside the turbineThe break in that building. building in order to avoid a harsh environment in cas header meets both the seismic and environmental (10CFR50.49) q requirements for Safe Shutdown Cooling.

Analyses presented in Attachment I to P-86683, Attachment 2 to P-87055, and the Attachments to P-87171 have been submitted by PSC to demonstrate the firewater supply capability for the new Class I firewater flow path. The Attachment using condensate to P-87171 to drive a circulator includewater the results turbine. of a siarulated firewster flow This test and an accompanying sensitivity analysis were submitted by PSC to demonstrate an adequate capability to produce a primary system helium flow of 3.8% of full load at a firewater flow that is less than that which is estimated available. to be Sensitivity analyses show that increasing flow to the EES section does not significantly degrade the suction pressure and flow available to the emergency water booster pump upstream of the circulator water turbine drive.

The firewster flow analysis and the flow sensitivity studies were performed using a computer Attachment code developed by Proto-Power Corporation and described in 6 to P-87055.

The theory and methods used in the pressure drop 7

I_____._____-------------------------------------~~~ ~

program have been reviewed and appear to be both reasonable and consistent with other steady-state methods for flow and pressure drop calculations.

The same Proto-Power Corporation computer' code described in Attachment 6 to P-87055 has also beer, modified and used, as reported in Attachment 9 to l P-86682, to calculate the EES flooding time for pre-cooling the EES to subcooled outlet flow conditions prior to restart of the helium circulators on water turbine drive. As discussed in Attachment 9 to P-86682, the firewster k flow and pressure drop computer code was solved iteratively in a quasi-static l manner with a heat transfer code simulating the EES tube thermal performance.. )

The quasi-static analysis yielded a 14 minute flooding time for the ERS. The flooding time was reported to have been conservatively confirmed by a calculation by GA Technologies as cited in PSC response 7 in Attachment I to P-87055. As discussed in the Attachments to P-86682, P-86683, and P-87055 GA Technologies reportedly checked the steam generator steady-state flow and pressure drop results with the SUPERHEAT code. Also, as discussed in Attachment 5 to P-86682. GA performed limited checking of other steady-state firewater flow calculations, but not the Safe Shutdown Cooling flow path, using the SNIFFS flow network computer code and hand calculations. Since no complete set of alternate calculations are available for either the !

steady-state firewater flow calculations or the EES flooding (pre-cooling) time calculations, we recommend that NRC should perform an audit of the Proto-Power Corporation calculations. Such an audit is needed to assure that the type of problems with inadequate verification checking encountered in .

UERs 50-267/76-05 and 50-267/76-09 does not recur for Ro 50-267/86-026. I 1

In Attachment 4 to P-87002, PSC states that the new Class I flowpath also meets the single failure criterion for both active and passive failures. To acconnodate a single passive failure, Attachment 4 to P-87002 addresses reliance on the original firewater flow path in System 45 (the Fire Protection System) that is the basis for. the Safe Shutdown Cooling results reported in FSAR Section 10.3.9. 10.3.10, and 14.4.2.2. In Attachment 4 to P-87002, the firewater system flow is assumed to be routed to the emergency feedwater ;

header to accommodate a single passive failure, but the requirement to use l this flow path is based on a single passive failure that, consistent with NRC policy given in SECY-77-439, is assumed not to occur until. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after emergency cooling has been initiated. This alternate flow path has not been analyzed in calculations submitted by PSC.

Active single failures in the preferred new flow path, as illustrated in Figure III-l of Attachment 4 to P-87002, are assumed to be limited to " failure to function of an electrical component of the two valves (BV-4518 and HV-4519) in the (new) line (that) can be compensated for quickly by a manual action in a mild environment." Mechanical failures of these valves failing to open have not been addressed. '

8

I 2

If either HV-4518 or HV-4519 were to fail to open, alternate flow paths exist via the firewater system to either the emergency condensate header supply or the emergency feedwater header, which was alluded to above. The alternate

)

flow path to the emergency condensate header is the <.,riginal preferred j flowpath for Safe Shutdown Cooling as described in FSAR Section 10.3.9 and l 14.4.2.2. A review of the recent PSC analyses that use this original flow l path is presented in the following section of this report.

3.3 Review of the Original Class Flowpath Calculations in Recent PSC Submittals ,

i There was no attempt to clarify in the recent PSC submittals that the original !

FSAR Class I cooling configuration is most closely analogous either to the !

" emergency cooling with EES using firewater pump (open loop)," as shown in Fig. A-1 of Attachment 5 to p-86682, or to the " firewater flow diagram for !

Appendix R Train B case, open loop," as shown in Fig. 2.4 of Attachment 2 to P-85055. Both of these configurations represent fireweter supply via the '

emergency condensate header as assumed in the Class I performance and safety analysis reported in Updated FSAR Sections 10.3.9 and 14.4.2.2. l l

In the configuration cited in Attachment 5 to P-86682, about 100 gpm of fluid l

is assumed to be vented to the atmosphere via an electromatie valve (PV-22162) !

located downstream of the steam generator EES, and the rest of the flow is vented to the condenser through the desuperheater and flash tank. Per FSAR -

Section 10.3.9, the original class I event scenario assumed venting from ruptured non-Class I piping downstream of the steam bypass valves to the desuperheater. The licensee did not specify which of these configurations presents the higher backpressure to the steam generator EES and thereby produces the lower flow from the firewater supply system; however, use of the newly installed and seismically qualified six inch vent lines off the EES outlet piping to the atmosphere allows for lower EES backpressure. The maximum fuel temperature calculated in the recent analysis (Attachment 5 to P-86682) is 2511 F for a cooldown from 77.9% of rated reactor power. The firewater flow rate to the EES is calculated to be 829 gpm with an EES backpressure of 107 psia at the steam generator ring header and 87.3 psia at the mainstream bypass valve (PV-22129). Water exiting the EBS is subcooled.

~

Similarly, in the configuration cited in Attachment 2 to P-85055, flow throu'gh the open loop (i.e., atmospheric venting via the newly installed six inch vent lines) lasts for only five hours, after which the loop is assumed to be closed in the Appendix R Train B Case (See Fig. 2.5 in Attachment 2 to P-85055). In the open loop configuration, the firewater flow is 996 gpm, but is reduced to 789 gpm in the closed loop. The steam generator EES backpressure at the outlet is " controlled" to 76 psia (open loop) for the first five hours and 97.8 psia (closed loop) thereafter; presumably, the quoted pressures are at the steam bypass valve. The maximum fuel temperature is calculated to be 2644 F following shutdown cooling from a power level of 87.5%.

9

\ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

s In addition, as reported in Attachment I to P-87053, the analysis of the firewater cooldown from 83.2% of rated reactor power without an interruption in forced cooling indicated that the PSAR Section 14.4.2.1 values for maximum helium temperature (and thereby maximum fuel temperature) can be achieved with 795 gpm of 80 F firewater flow against a steam generator backpressure of .

83.1 psia at the steam bypass valve. This result is analogous to that for the original class I firewster cooldown scenario with no delay in restoring forced cooling, as assumed by PSC prior to the NRC's imposing the assumed 90 minute delay in 1978. As noted in Section 3.1 above, the firewater cooling capacity for this event should be the same as the current Class I firewater cooldown scenario with the 90 minute delay in restoring forced cooling. The major difference between the analysis in Attachment I to P-87053 and the current class I event scenario would be core conditions and maximum helium temperature obtained after the 90 minute delay in restoring forced cooling of the core.

3.4 F_indings and Recommendations The new class I flow path, which was installed to meet the requirements for environmental qualifications of electrical equipment per 10CTRSO.49, has been shown by calculations to provide a sufficient flow of firewater following shutdown from 87.5% of rated reactor power to drive one helium circulator at up to 3.8% of rated helium flow and to flood one EES section of the steam generator with subcooled flow. This flow of firewster is capable of flooding the EES in an estimated 14 minutes prior to restart of forced cooling of the reactor core following a 90 minute interruption of forced cooling. This flow of firewater has been calculated to maintain the maximum temperature below 2900 F and to prevent lifting of the primary safety valves. However, the analysis of the new flow path has not adequately addressed single active failures due to a mechanical failure to open either of the two new valves in the new Class I flow path. Only electrical failures have been addressed.

Thus, the original class I flow path must also be addressed for Safe Shutdown .

Cooling.

l Although the original Class I Safe Shutdown Cooling scenario (i.e., 90 minute delay in restoring forced cooling via the emergency condensate supply header following the Design Basis Earthquake or Maximum Tornado) is not exactly duplicated in any of the new analyses, the results from similar analy's es allow us to conclude that the original configuration for accommodating the Class I event can be utilized from 82% of rated reactor power without exceeding e l i

maximum fuel temperature of 2900 F. PSC should perform an explicit confirmatory analysis of the class I scenario to demonstrate that this is indeed the case for accommodating single active failures in the new Class I flowpath.

Also, with regard to meeting the single failure criterion, we conclude that a confirmatory analysis is needed to demonstrate the capability of the alternate 10 l

m

flow path via the energency feedwater header. As shown in Figure 4-la, At tachment 2 to P-87055, the maximum fuel temperature is calculated to peak below 2900 F et about five hours into the firewater cooldown using the new class I flow path. By extrapolation of the data in the cited figure, the maximum fuel temperature would still exceed 2200 F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months into the firewster cooldown. This tendency to cool slowly is confirmed by the results given in Updated FSAR Figure 14.4-6 where these results are now recognized to be non conservative. Therefore, confirmatory analyses are needed to assure adequate flow and continued decrease in the fuel temperature after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months assuming a single passive failure.

In addition, since the failure to r'esolve issues raised initially by UERs 50-267/76-05 and 50-267/76-09 can apparently be traced to unreviewed or inadequately reviewed analyses of the firewster supply capability, assurance should be obtained that current analyses comply with the provisions for verification checking in design control per 10CTR50, Appendix B,Section III and ANSI /ASME N45.2.11. Since design reviews are apparently the least effective measure for verification checking, as evidenced by the findings of RO 50-267/86-026, the use of independent checks by alternate calculations and of checking by comparison to applicable plant test data should be emphasized.

As indicated in Section 3.2 above NRC should perform an audit of the calculations performed by PSC and its subcontractors, particularly if design reviews have been the primary mechanism to achieve nominal compliance with IOCFR50, Appendix B and ANSI /ASMF N45.2.11.

4. Conclusions Results of the accident analyses indicate that for both the "EQ" and

" Appendix R" scenarios, (which are both low-probability events), there is substantial margin in the existing emergency cooling systems to provide for a safe shutdown. The analyses assumed that suitable procedures and training would be in place to assure that the operators would first implement the appropriate cooling water supply, and then manually control the primary coolant flow to avoid steaming and choking in the EES. We recommend that NRC confirms that suitable procedures and training are established.

PSC's analyses of the seismically and environmentally qualified firewater flowpath for Safe Shutdown Cooling indicate that adequate firewater flow can be obtained to avoid fuel damage and component damage following shutdown from 82% of rated reactor power and assuming a 90 min delay in restart of forced cooling of the reactor core. Pre-cooling of the steam generator EES section with firewater is calculated to take about 14 min to ' assure subcooled firewster flow at the EES outlet after forced cooling is restarted. Based on results of other recent analyses, single active failures in the new Class I flowpath are judged to be accommodated by using the original Class I firewater flow path to the emergency condensate header. Single passive failures, which are assumed not to occur until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the firewater cooldown is 11

e initiated, are to be accommodated by an alternate flowpath through the eme rgency feedwater header, but specific analyses of this capability have not been presented by PSC. Based on our review of the PSC analyses and of l previous reportable events related to the adequacy of the Class I firewater I cooldown capability, we recommend that the following confirmatory actions be t aken:

o NRC should perform an audit of the PSC calculations to confirm the -

adequacy of verification checking per 10CFR50, Appendix B, l Section III. This action is necessitated by findings of inadequate verification checking from previous reportable events that should have been resolved by analysis of the firewater flow capability for Safe Shutdown Cooling.

o PSC should perform an explicit confirmatory analysis to demonstrate that the original Class I firewater flow path accommodates a single active failure in the new class I firewater flow path. The confirmatory analysis needs to address EES pre-cooling times and long term cooling capability.

l o PSC should perform an explicit confirmatory analysis to demonstrate that the alternate flow path via the emergency feedwate. header accommodates a single passive failure in the preferred flow path via the emergency condensate header.

I i

l l

I 12

e ffgy.[*hrmgpgsrx ATTAQ0iENT

' Internal Correspondence ,

wARTIN wARIETT A (NERGY $YSTEtr$,INC.

March 25, 1987 l

[ S. " J. Ball Fire Water Cooldown Induced Water Hammer in Fort St. Vrain Steam Generators

Reference:

" Analysis of the Capability of the Fort St. Vrain Steam Generators to Withstand the Fire Water Cooldown Transient Following an Appendix 'R Fire," Rev.1 NLI-86-0649 As you requested, Jack Dixon and I reviewed the portion of the reference ;

j document regarding structural effects of water hammer. The report was

} qualitative and brief, but we agree with the following two assertions.

1. Water hammer caused by the collapse of a pocket of steam surrounded by incoming cold water is unlikely due to the steam generator design.

2. Water hammer forces in the steam generator tubes are significantly reduced by the pressure wave restriction at the entrance to the tubes.

However, we do not have enough information to comment on the water hammer-like forces produced by the cooling water sweeping through the steam generator nor on the effect on the generator of an external pressure wave being largely absorbed at the generator tube entrance.

We have experience in calculating structural response to water hammer loads including fluid entering a dry system and in performing confirmatory analyses of power reactor piping systems for the NRC. If the NRC would like to pursue this catter further, we w!11 discuss schedules and cost with you.

If you have any questions, do not hesitate to contact ce.

C. R. Hammond,1000, MS-332, ORNL (4-6499) - NoRC cc: J. R. Dixon R. W. Glass T. W. Pickel W. C. Stoddart File - CRH I- - n _ -- - - --- - 1

l.

.. e 6

6

, 'e ,

=r ea p D c e p *g e . e r- - a.,*. . = . = -

a f t. ;

Fiv. i i C.ed r' rs L 3 rb i J .L C. -

C,,. v u .i..,,u v v sei=

3 .

l ! ! l 26 , . -

^

-: ^

~.

/ l l

_r er1

= -t % _,

2*

k 2.2 gf e

W 2

[ -

7 gy 1.6 u/

"g 7 %

x x p .- T i2 -a g

\

x os x i x w 06

\ 1A.

0.4 -

,~m 0.2 0 2 4 6 8 TiwE (Hours)

Max. Fuel Temp: ORECA O PSC 4 Core Outlet Temp: ORECA+ PSCA

.s -

-v: r 7:q:- ,z-~.,---- m - -~--w m- ~ ~ -~-,-.~m...-----,--.

~.

... .. _.. - ..~,_._

J

4 .

c F/;. 2 PRESSURE RESPONSE C0 c00tD0*H

, ?! 0 g j 1

7ege) IHC --1 i

(.$0 -.\ - - -

j" !

I

, g

'\ ) I l

?

w; C. _l/ I'.t l l

' )

i t

w 550

\\

l I

y ! - l 3

$ 500 ;

i 450 L- m%

400 '

m 350 -

= .

300 0 2 4 6 8 TlWE (HOUM)

O PPESSURE + PC-C PRES 9URE FIG. 3 CONTROLLED PRIMARY FLOW EQ C00LDOWN 2.2 W

1.8 .

/ l 1.6

? * / /

jl .

] [ -

p' 0.8 l xy

(

y -

l 0.6 0.4 0.2

^

0' ' '

O 2 4 6 8 C Cm1LATOR FLOW + PSC FLOW

. . - . , .

ML20234C609

Contents

Text

Reference:

Dear Mr. Williams:

SUBJECT:

Enclosures:

4.0 REFERENCES

3.0 CONCLUSION

1.0 INTRODUCTION

3.0 CONCLUSION

4.0 REFERENCES

Reference:

Dear Mr. Williams:

SUBJECT:

Enclosures:

3.0 CONCLUSION

4.0 REFERENCES

1.0 INTRODUCTION

3.0 CONCLUSION

4.0 REFERENCES

,a- vu g

Reference:

Navigation menu

ML20234C609

Text

Reference:

Dear Mr. Williams:

SUBJECT:

Enclosures:

4.0 REFERENCES

3.0 CONCLUSION

1.0 INTRODUCTION

3.0 CONCLUSION

4.0 REFERENCES

Reference:

Dear Mr. Williams:

SUBJECT:

Enclosures:

3.0 CONCLUSION

4.0 REFERENCES

1.0 INTRODUCTION

3.0 CONCLUSION

4.0 REFERENCES

,a- vu g

Reference:

Navigation menu

Search