ML20235R416

Draft Eg&G Technical Evaluation Rept for Plant Protective Sys Trip Setpoints for Fort St Vrain Nuclear Generating Station

ML20235R416
Person / Time
Site:	Fort Saint Vrain
Issue date:	10/31/1987
From:	Stachew J EG&G IDAHO, INC.
To:	NRC
Shared Package
ML20235R365	List: ML20235R362 ML20235R395 ML20235R416
References
CON-FIN-D-6023 EGG-NTA-7289, EGG-NTA-7289-DRF, TAC-47416, NUDOCS 8710080040
Download: ML20235R416 (37)

Text

n P' 09/30/87 TSF Doc 2009H Disk 0173I Job 38256- Proof _3 _ - EJLL EGG-NTA-7289 i

-l

, j 1

SA EG&G TECHNICAL EVALUATION REPORT FOR THE-PU4NT PROTECTIVE SYSTEM TRIP SETPOINTS FOR FORT ST. VRAIN NUCLEAR GENERATING STATION 1

l J. C. STACHEW Published October 1987 Idaho National Engineering Laboratory EG&G Idaho, Inc.

Idaho Falls, 10 83415 l

Prepared for the U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Under DOE Contract No. OE-AC07-761001570 FIN No. 06023

-87100B0040 071001 l

PDR ADOCK 05000267 e PDR j

P '09/30/87 TSF Doc 2009H Disk 01731 Job 38256 Proof 3 _ _,

JLL

.. ABSTRACT l l-This EG&G Idaho, Inc., report evaluates submittals provided by Public Service Company of Colorado for the Fort St. Vrain Nuclear Generating l

Station. The submittals are in response to requests that the trip f'

setpoints specified in the Technical Specifications should account for instrumentation uncertainties.

FOREWORD This report is supplied as part of the " Technical Assistance for Operating Reactors Licensing Actions," being conducted for the U.S. Nuclear Regulatory Commission, Washington D.C. , by EG&G Idaho, Inc. , NRC Technical Assistance.

The'U.S. Nuclear Regulatory Commission funded the work under DOE c.ontract No. DE-AC07-761001570 FIN No. D6023.

Docket No. 50-267 TAC No. 47416 11 i

i '

JP 09/30/87: TSF Doc 2009H Disk 01731 Job 38256- Proof 3 _ JLL CONTENTS

q. ,

11 CONTENTS ~'..............................................................

iii ABSTRACT ..............................................................

iii FOREWORD ..............................................................

1

1. INTRODUCTION .... ................................................

L-

-2. DISCUSSION AND EVALUATION .................................... ... 2 2.1 Methodology ........................... .................... 2 l 4

2.2 Evaluation of Reanalized Trip Setpoints'.................... 2 2.R.1 Primary Coolant Pressure - Low ..................... 2 2.2.2 Primary Coolant Pressure - High .................... 3 2.2.3 Superheat Header Temperature - Low ................. 6 2.2.4 Circulator Speed - Low ............................. 7 8.'

~

l 2.2.5 Fi xed Feedwate r Fl ow - Low . . . . . . . . . . . . . . . . . . . . . . . . .

2.2.6 . Loss of Circulator Bearing Water ................... 9 2.2.7 Circular Speed - High .............................. 10 2.2.8 N e u t r o n F l u x - H i g h . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . 11 2.3 Evaluation of Proposed Technical Spec ~ification Changes .... 12 2.3.1 Limiting Safety System Settings (LSSS)'

(Section 3.3) ...................................... 13 2.3.2 Protection System Instrumentation, Limiting Conditions .for Operation (LCOs) (Section 4.4.1) ... . 15

3. OTHER ACTIONS ASSOCIATED WITH THE PLANT PROTECTION SYSTEM INSTRUMENTATION ...................................... ...........

33

4.

SUMMARY

34

5. REFERENCES, ........ ..............................................

iii

P 09/30/87 TSF Doc 2009H Disk 01731 Job 38256 Proof 3 _ _ JLL TECHNICAL EVALUATION REPORT PLANT PROTECTIVE SYSTEM TRIP SETPOINTS FOR FORT ST. VRAIN NUCLEAR GENERATING STATION

1. INTRODUCTION By letters dated June 21, 1985,1 May 15, 1986,2 and August 28, 19873 the Public Service Company of Colorado (the Licensee) proposed numerous changes to the Technical Specifications (TS) for the Fort St. Vrhin Nuclear Generating Station. The primary purpose of the proposed changes was to modify the trip setpoints for the Plant Protection System (PPS) such that the values specified included a sufficient allowance for uncertainties associated with the instrument systems. Currently, the setpoints for the PPS are specified at the same values for which the safety analyses assumed mitigative actions would be initiated. The proposed changes result in revised trip' setpoints that include an additional margin of conservatism to account for instrumentation uncertainties. The revised.'.'

trip setpoints were determined using Instrument Society of American Standard 567.04-1982,4 "Setpoints for Nuclear Safety Q <ated Instrumentation Used in Nuclear Power Plants," as guidance.

As a result of the Licensee's evaluation program to determine appropriate values for instrumentation trip setpoints, the values for some trip functions were found to offer the potential for increased inadvertent scrams, loop shutdowns, or circulator trips. In these cases, the results of a reanalysis were provided to justify the use of trip setpoints that provide a greater margin between the trip setpoint value and normal operating conditions.

This Technical Evaluation Report provides an evaluation of the proposed trip shtpoints and the reanalysis provided to reduce potential for inadvertent safety actions, as transmitted in PSC's revised letter of August 28, 1987 and as supplemented by the earlier PSC submittals. The l earlier submittals by PSC were responded to by NRC letters dated January 24, 1986S and October 16, 1986.6 The NRC letter of January 24, i

l 1

.P 09/30/87 TSF Doc 2009H Disk 01738 Job 38256 Proof 3 _ JLL 1986 recommended thah the Technical Specifications for the trip setpoint '

reanalysis to account for instrumentation inaccuracy be separated from the format upgrade issues. The NRC letter of October 16, 1986 responded to the PSC submittal that made the requested separation (PSC letter of May 15, ,aug=

1986). This latter NRC letter was a request for additional information to Q" clarify seventeen issues in the Licensee's May 15, 1986 letter. The present PSC letter of August 28, 1987 continues to rely on information-presented in the earlier PSC letter of June' 21,1986.5 Many PPS functions presented in the PSC June 21, 1986 letter were deleted in the latest August 28, 1986 submittal. Again, this was per NRC direction to focus attention on only those PPS functions that are currently in the existing FSV Technical Specification,.

Finally, it is emphasized that the NRC evaluation of January 24, 1986, on the reanalized trip setpoints that were made to justify the use of a greater margin between the trip setpoint and normal operating conditions, has been relied upon and has essentially been duplicated here in this report. No independent evaluation was made related to which setpoint changes required additional safety analyses or the correctness of such added safety analysis. Only an update was made to bring the NRC discussion q in the January 24, 1986 submittal current with Rev. 5 to the Fort St. Vrain FSAR. .

Evaluation of the Licensee's justification for change was based I primarily on review against the Fort'St. Vrain FSAR, Rev. 5, S67.04-1982,4 the nghouse STS,7 the NRC Staff Oraft y fety j evaluation report n etter dated January 24, 1986, and other Licen ee 4

supplied documentation (PSC letters of June 21, 1985, May 15, 1986, August 28, 19873 and March 9, 19840 ).

I J

I i

l l

2 '

< > P 09/30/87 TSF. Doc 2009H- Disk 0173% Job 38256 Proof 3 _, JLL

2. DlSCUSSION AND EVALUATION rW hk 2.1 Methodology The. Licensee submittal of August 28, 1987 made proposed changes to Technical Specification Section 3.3 Limiting Safety System Settings, and

'4.4.1, Plant Protective System Instrumentation. These proposed changes were basically to. account for instrumentation inaccuracy in establishing the Trip Setpoints for scram, loop shutdown, and circulator trip functions. In addition to the previously specified "as left Trip Setpoint" an "as found Allowable Value" limit is also specified. The as.found

-Allowable Value limit is chosen to.. ensure'that the analysis value used in the safety analysis to initiate.the trip actions is not exceeded. The analysis value is that trip value used in the safety analysis which demonstrates the associated safety limit will not be exceeded or that 3 >

equipment protection is assured. By letter dated March 9,1984 '

("efe r - % the p censee provided a copy of a specification outlining N' i the reevaluation of the Plant Protectilli System setpoints to account for instrumentation inaccuracy. Thislicenseedocumentincorporatesthe requirements of ISA Standard 567.04-1982, for establishing trip setpoint values. Therefore,theycenseehasestablishedamethodologywhichis acceptable for determining trip setpoints and al.lowable values based on safety analyses for the Fort St. Vrain Nuclear Generating Station as documented in the FSAR.

I Attachment 3 to the licensee's letter of June 21, 1985, provided a I 1

Significant Hazards Consideration Analysis that addresses the results of l new analyses for selected safety functions. The conclusions of this analysis was previously evaluated by the NRC Staff in Reference 5 and has been updated to be current with FSAR Rev. 5 and has been incorporated with 4 the present fin'ings d of evaluation of the PSC August 28, 1987 submittal. l

.s 3

P 09/30/87 TSF Doc 2009H Disk 01738 Job 38256 Proof 3 _

JLL 2.2 Evaluation of Reanalyzed Trip Setooints ,

h 2.2.1 Primary Coolant Pressure - Low The setpoint for the low primary coolant pressure scram is programmed with load-(circulator inlet temperature) to initiate scram when reactor coolant pressure is 50 psi below normal. The low primary coolant pressure scram provides protection for inadequate core cooling that could result in temperature limits being exceeded. For rapid depressurization accidents, a scram would occur instantaneously, and changes in the low pressure setpoint would not have an impact on the consequences of the accident.

l Two cases were reanalyzed based on the assumption that a scram occurs  ;

at a pressure of 90 psi below normal. The first case reanalyzed was the offset rupture of a 2-inch line in the helium purification regeneration ,

piping, as currently analyzed in FSAR Sections 4.3.3 and 14.8. For this l

~ '

accident, which is assumed to occur at 100% power, and as currently - ~

)

I analyzed a scram occurs at 50 psi below normal pressure in about 120 sec, primary coclant flow is 97% of rated, and the peak core average outlet temperature is 13 F above normal. Under the reanalysis assumption that a scram does not occur until primary coolant pressure is 90 psi below normal, f primary coolant flow will have been reduced to.92.5% of rated in 220 sec.

Ar.d the core average outlet-temperature peaks at 44*F above normal. After I i

the reactor scram, core average outlet temperature decreases with continued l 1

core cooling. '

The second case reanalyzed was the effect of continued plant operation l at both 100% and at 25% power with reduced primary coolant pressure just ]

above the assumed scram value of 90 psi below normal. For these two conditions, circulator speed increases in response to the decreased helium inventory; however the core power-to-flow ratio only changes by 0.01 at both 25 and 100% power. The impact on helium temperature at the inlet to the steam 2enerators is an increase of 9 F at 100% power and 2 F at 25%

power.  % a p'*

}

4 l

L

P 09/30/87. TSF Doc 2009H Disk 01731 -Job 38256 Proof 3~ JLL It was concluded that, since neither a safety limit nor an equipment-4 design limit is exceeded, the assumption of a lower primary coolant pressure for. initiation of a reactor scram is acceptable.

Based on the review of these results, it. is concluded that this analysis provides an acceptable basis to justify a lower trip setpoint for this safety function. With the allowance for instrument uncertainty the j new trip setpoint is 68.6 psi below normal primary coolant pressure. ]

2.2.2. Primary Coolant Pressure - High

-]

The present setpoint for the high primary coolant pressure scram is j programmed with load (circulator inlet temperature) to initiate a scram  !

1

- when the' reactor coolant pressure is 7.5% (approximately 53 psi) above l normal. The high primary coolant pressure scram and preselected steam generator dump are a backup for the primary coolant troisture monitor scram and dump of a leaking steam generator. The FSAR Section 14.5.3 safety - * .

analyses address six accident cases related to steam ingress with various

]

postulated failures of the protection system. Of the six accident cases analyzed, only four involve safety actions initiated on high primary coolant pressure. Each case was reanalyzed as follows based on tho

)

assumption of a high pressure scram at 70 psi above normal. '

1. FSAR 14.5.3.2 Case 2 - Subheader Rupture and Wrono Loop Dump. It is assumed that the moisture monitors initiate a scram; however the wrong loop is dumped. The only safety action initiated on  ;

high pressure is the initiation of the steam generator depressurization program which reduces steam ingress by lowering steam generator pressure. The current analysis indicates that the safety action is initiated af ter about 80 sec, with a total steam' ingress of 14,890 lb of which 180 lb react with core graphite. With the assumption of a higher pressure trip (70 psi above normal) the depressurization program is initiated at 120 sec with a total steam ingress of 15,000 lb and there is no change in the amount that reacts with core graphite.

v 5

JLL P 09/30/87 TSF Doc 2009H Disk 01731 Job 38256 Proof 3 _ _

2. FSAR 14.5.3.4 Case 4 - Subheader Runture with Moisture Monitor Failure and Correct Loop Dump. It is assumed that no safety actions are initiated by the moisture monitors. On high primary coolant pressure, a reactor scram is initiated, and the preselected loop dump isolates the leaking steam generator. The current analysis indicates that there is a scram and steam generator dump in 95 sec, with a total steam ingress of 2,160 lb of which 855 lb react with core graphite. With the assumption of a higher pressure trip ,('70 psi above normal) safety action is initiated in 157 see with a total steam ingress of 3,200 lb of which 1,112 lb react with core graphite.

3. FSAR 14.5.3.4 Case 5 - Subheader Rupture with Moisture Monitor Failure and Wrong Loop Dump. This case is the same as (2) above; however, it is assumed that the intact loop is dumped. The current analysis indicates a total steam ingress of 16,040 lb of which 900 lb react with core graphite. With the assumption of a-higher pressure trip, the total steam ingress is 15,600 lb of which 1,162 lb react with core graphite.

Although the reanalysis shows a lower total steam ingress, it was noted that the original analysis was , conservative since it assumed that the leakage was terminated 30 min after the time a scram was initiated, rather than 30 min after the time of the accident.

4. FSAR 14.5.3.4 Case 6 - Subheader Rupture with Moisture Monitor Failure, Correct Loop Isolation and Failure to Dump. This case is the same as (2) above; however, it is assumed that the f aulty steam generator is isolated only, not dumped. Thus, the only .

diffe'rence between this case and case (2) is that the entire 6,000 lb inventory of the steam generator is assumed to enter the primary coolant system. In the current analysis, the total steam ingress is 8,080 lb of which 919 lb react with core graphite.

6 l

1 P; 09/30/87- TSF Doc 2009H Disk 01737 Job 38256: Proof 3 JLL

);

With the assumption of a higher value for the high' pressure trip, the total; steam ingress is 9;200 lb of which 1,200 lb reacts with~

, core graphite.

I The overall impact of the. change.from 53 psi to 70 psi above normal for'the'high primary coolant' pressure trip is an increase of about 30% in 1 a.' the amount of moisture.that reacts with core graphite in those' cases for which multiple failures of the protective system are assumed. While the impact of: increased steam /graphit.e reaction was not specifically analyzed, J the present: analysis of steam graphite reaction as noted in FSAR Section 14.5.2.2, demonstrates that these effects are not safety l l

significant with regard to- the structural integrity of graphite core .]

support posts, bottom reflector blocks, or core support blocks. In -I addition, there would not be a safety significant change in the effect on fuel particles or potential fission product release to the primary coolant

' system. More importantly, the consequences of increased steam ingress do not result-1n any significant change in the peak primary coolant pressure - .'

which could challenge the primary coolant system relief valve rupture disc.

Based only on the review of the reanalysis results, this analysis

,. appears to provide an acceptable basis to justify a higher value to establish the setpoint for the high primary coolant pressure scram. With the allowance for instrument uncertainty, the new trip setpoint is $46 psi above normal primary coolant pressure.

2.2.3, Superheat Header Temperature - Low Low super' heat header temperature initiates a loop shutdown at a setpoint of 800*F coincident with high differential temperature between

loop 1 and 2 at a setpoint of 50'F. This-provides protection to preclude a floodout of the' steam generators due to an increase in feedwater flow or a reductionein helium flow to a loop. It is assumed that the trip on loop superheat temperature is initiated at a superheat temperature of 780 F with a differential between loops of 65 F or greater. The impacts of these assumptions were considered for two cases: 30% power and 100% power.

7

P- 09/30/87 TSF Doc'2009H Disk 0173I Job 38256 Proof 3 JLL There are two basic' considerations that'are applicable to this safety

[ equipment protection function. First the trip should be initiated prior to reaching floodout temperatures. Since.the saturation temperature at normal i

operating pressure of 2400 psig is 660*F, the assumption of 780*F for mitigative. action provides an adequate margin of safety prior to reaching '

the saturation temperature. The second consideration is that' loop shutdown I

should occur before a turbine trip is initiated on low main steam '

temperature. This turbine protection is initiated when the main steam temperature (i.e., the temperature of the combined loop steam flow) falls to 800*F. j l

i Since the superheat header temperature for each loop is maintained by controlling primary coolant flow in that loop, a malfunction resulting in low superheat temperature for one loop would not result in a change in superheat temperature for the other loop. At 30% power, steam temperature is controlled at about 880 F. Therefore, if loop isolation occurs at a l superheat header temperature of 780*F, the temperature difference will be .~.

100 F. The turbine mixed inlet steam temperature will then be 830 F, which assures that the loop temperature difference will satisfy that portion of the trip logic and loop isolation will occur prior to the occurrence of a turbine trip on low main steam temperature. At 100% p:wer, steam temperature is controlied at 2000 F. For this case, tne temperature difference between loops is 220 F, and the main steam temperature is 890'F when the trip occurs. Thus, the available margins are greater than at 30%

power. -

Based on this review, it is concluded that this analysis provides an n acceptable basis to justify a change in the bases for determining the setpoint for these protection system channels. With the allowance for instrument uncertainty, the new trip setpoints are 798'F for low superheat j header temperature at a 44.8*F dif ferential temperatu$ between loops.

l IDMFT 8

i

p~

NMg -

P 09/30/87' TSF. -

Doc 2009H Disk 0173I Job 38256 Proof 3 a _ JLL 0;i .

. Circulator Speed - Low l@%;[;hh2.4

\ ,,

j> , s .t 1 1 , , . m The setpoint for the low circulator speed circulator trip is 1910 rpn1

.s

• ' below normal, as~ programmed by load (feedwater flow)'. The circulator trip  ;

a results -in a reductiori in plant load when operating at full' load condi ti on s,- Also the low feedwater flow setpoint, which is programmed by circulator speed, is lowered to preclude a trip of the operating 7p circulator. Unoer conditions for single circulator operation the. ratio of 1 (a f.j 1 circulator speed to feedwater flow is about a factor of. two greater than I during normal operation. l

,x L V.

Foramalfuhtionresultingin~alossofcirculatorspeed,the coastdown from rated speed of the circulator by 25% (2390 rpm) is only a matter of.'a few seconds. For the reanalyzed case, it was assumed that a trip does not occur until a reduction of circulator speed occurs to p ,1 2390 rpm below normal. At part lead conditions, the time to reach this value is 'about 4 seconds. In addition, the trip includes a fixed 5 second-s, ,

d(iay to a. void spurious trips due to changes in circulator ' speed during i

.normalioperation, in contrast, the response of the steam generator X' superheat header temperature to changes in helium flow is about tv D< - 30 seconds. Therefore, it was concluded that the assumption of a

? circulator trip at 2390 rpm below normal is acceotable.

Based on this review, it is concluded that this analysis provides an acceptable basis to justify a change in the bases for determining the trip i i

setpoint for these protective system channels. With the allowance for 1 i

instrumentation uncertainties, the trip setpoint is 1850 rpm below normal j as. programmed by feedwater flow.

j I

i 2.2.5~ Fixed Feedwater Flow - Low {'

n -

p Because of the draf t SER N.rtnsmitted to pSC by letter dated January 24, 1986,5 thissetpbotisnotbeingchangedintheproposed amendment request (Reference 2). The discussion below is enclosed only for completeness and pertains to the PSC letter of June 21, 1985.

1. : ' DRAFT 9

e, i o

a__--__-________-__---- _ - _ - _ _ _ _ - - __ _ 1

~

• l .1 .

- P 09 30/87 9JSF Dt,6 2009H Disk 017 i Job 382S6' Proof 3 m _

JLL y>g y Thelsetpointforthefixedlowfecd.ater fibw circulator trip, is 20%

/ o/ y.

.m , A o ..t -

of rated feedwater flow. Since b:'th c/imdators'in a loop neJtnged on t e low flow, this results in a loop shyt3own, which provides protection p against steam" generator operation at Obe temperatures above design vaMs.

( q) '

, e

[, . s

\,

il Two basic operatinpccf it'Idns were addressed in the revised anaIys, s' t~ /. ,

tol support an assumption that thg.ff y[d low feedwater flow tIrip occur /at g-

,e .

5% of rated feedwater flow 1 ine f3rst,, , qr4 F ndid+ on, addressed a sudden total t ( i loss of feedwater flow to a stear.(generitor dUr.ing bott. one and tugicop ,1 '

l operation. L% der such conditions feedwater ' fiow is rehced to zero # low I -

t  :

instantaneously. Due to albuilt-in 5 sec, delay, loop isolation occurs t i

s. . / 'f h y, i; [,' vi,'k 5'sec following the oce drence of these events. Under 9.is condit'on ,the ,/ ' L 3

5.-

.( '

consequences of these events are the same as indicLied by the origir4 FS,Jt 4(t

'xdnalysis,andtubetemperaturesremainbelowdesignlimits.

i ,..

4-

's  %

The secon4J condition addressed was continued operatisn at reduced /1 . 5 feet. water flow. However, under this condition, the minim h freedwater flo y .'

rate considered was 14% of rated flow. With regard to static boiling _ p sbabilit'y conditions, it i$noted that even if unstable boiMj conditions 4 < r ,

are encoutered at flow rates below 16.6%, the maximum htlium ten.perature l'

available at the<Superheat Tl inlet would be less than 957'F, and, thus, could not result in significantly exceeding the maximum allowable temperature'af,952 F at the limiting tube !w:ation. Whilejtisnotedthat s t this analysd 'is ($nservative, since ' ti postuYates that a hit; gar, streak 1

e could' penetrate the entire EES bundie frm top to bottom wiQ pio inixing, it a

cannot be co'ncluded that this analysi 5 justifies an assumpti(n of loop <

isolation at feedwater flows as low as 5% of rated flow.

1 , ,

Based on this analysis, an :cteptable basis his not been set forth to support the proposed change in :he low ' fesater flow trip setpoint.

t c l

' 2,2.6 lbss of Circulator de3 ring Wateri '

1 , /

v e

+

l The circulator trip on the loss of t ha, ring wate? t is initiated when the , e l

' bearing water differential pressure, J1th respect to primary coolant

\

V

~

/ l

}

i 4"

10 (

/ l F.,. i

)

h, t r to  ;

P_

l.

e

'P '09/30/87L TSF- Doc 2009H' Disk 01738 Job 38256 Proof'3 .JLL-pressure, is' reduced to'a low differential pressure of.475 psid. This providss protection for the circulator bearings on a' loss of the normal and  !

1 backup bearing water supply. systems. In addition to a trip of the helium  !

circulator,'the protective action includes the actuation of the bearing water accumulators to provide a source of bearing water during circulator coastdown and operation of the circulator brake and seal system, as well as isolation.of the circulator auxiliary system service lines. The.latter 1 ensures the integrity of the primary coolant system when the dynamic seal a provided.by the bearing water sys.t'em is not available.

The reanalysis of the operation of the loss of bearing water l protection was undertaken based on.the assumption that the safety action is initiated at a differential pressure of 450 psid. From prior testing of the bearing water system, the minimum differential pressure during a transient response of the system was 375 psid. From this data it is cuncluded that a 25 psid reduction in the trip setpoint would result in a transientjminimumdifferentialpressureof350psid. Based on this value, .

analyses and tests demonstrate that the bearing acceptance criterion of a minimum clearance of 0.001 inches will be maintained.

1. Based on this review, it is concluded that an acceptable basis has y9

( '!'

been provided to justify a lower setpoint for this safety action. With an allowance for instrument uncertainty, the new trip setpoint is 459 psid.

l \

2.2.7 Circulator Speed - High

'] . The setpoint for the trip of the helium circulator steam turbine drive i f',$, is 11,000 rpm. This provides protection to assure that the circulator does i

f not exceed the design speed limit of 13,500 rpm. For steam line ruptures l . down stream of the circulator steam turbine, the maximum speed is 13,264 rpm with*no control action or overspeed trip. Therefore, this event does not establish a limit for an acceptable high speed setpoint.

l. With the presently assumed overspeed trip value, the maximum transient overspeed for a icss of restraining torque event (compressor section blade 11

1 l

P 09/30/87 TSF Doc 2009H Disk 01731 Job 38256 Proof 3 _ _ JLL  !

i shedding) is 13,050 rpm. Reanalysis with an assumed cverspeed trip value  !

of 11,500 rpm results in a maximum transient overspeed of 13,267 rpm.

Based on these analyses, it is extrapolated that an assumed overspeed trip at 11,700 rpm would result in a maximum transient overspeed of 13,370 rpm or less.

i Based on this analysis, it is concluded that an assumed overspeed trip value of 11,700 rpm provides an acceptable basis for determining the trip setpoint for this protection function. With the allowance for instrument )

I uncertainty, the overspeed trip setpoint is 11,495 rpm.

2.2.8 Neutron Flux - High The setpoint for the high neutron flux scram is 140% of rated thermal power. As a consequence of uncertainties in the reactor power measurement, the setpoint for the high neutron flux scram has been administratively l

controlled and adjusted at conservative values based on indicated reactor .'

power. The licensee provided curves that are currently being used to control the setpoint for the high neutron flux scram as well as the high neutron flux rod withdrawal prohibit. In the PSC June 21, 1985, letter, the licensee proposed to delete the values for the trip setpoints for the protective actions and to note that these settings are to be established for each fuel cycle and implemented based upon the approval of the Nuclear Facility Safety Committee. The staff found that this proposal was unacceptable since these changes potentially could create an unreviewed safety cuestion. Therefore the curves which define inese setpoints were to have been retained in the subsequent PSC resubmittal of May 15, 1986.

However, the high neutron flux rod withdrawal prohibit curve was not included in the PSC May 15, 1986, resubmittal. In the latest PSC submittal 3

of August 28, 19,87 the setpoint curve was included for the high neutron flux scram. Th'e Linear Channel-High Power RWP (Channels 3, 4 and 5) was deleted in this last submittal per NRC direction to focus on only PPS functions that exist in the current FSV Technical Specifications, g

12

P 09/30/87 TSF : Doc 2009H. ' Disk 01731 Job-38256 Proof 3 _ _ JLL Based on the above evaluation, it is concluded that the neutron flux-high scram trip setpoint and allowable value presented in TS Figure 3.3-1 meets the intentLof accommodating instrumentation inaccuracy.

2.3- Evaluation of proposed Technical Specification Changes 2.3.1 Limiting Safety System Settings (LSSS) (Section 3.3)

The Licensee letter of~Augus.t* 28, 19873 proposed changes to Technical Specification Section 3.3, Limiting Safety System Settings.

Proposed revision: were on TS pp. 3.3-1, 3.3-2a, 2b, 2c, 3.3-3a, 3b, 3.3-4, 3.3-5, 3.3-6, 3.3-7, 3.3-8, and 3.3-9. These revised pages replaced existing pp.- 3.3-1, 2, 3, 4, 5, 6, 7 and 8.

The added definitions for Trip Setpoint and Allowable Value on TS p. 3.3-1 clariffthem as the least conservative "as lef t" and "as found" value respectively, for a channel to be cons.dered operable.

• p In Table 3.3.-1, Limiting Safety System Settings, a Trip Setpoint and Allowable Value are specified for each scram, loop shutdown / steam water I dump, and pressure relief trip function. Figures 3.3-1 and 3.3-2 were added for the Linear Channel-High Neutron Flux ,and Primary Coolant

' Pressure-Programmed Low and High. Figure 3.3-1 accounts for the detector decalibration for Cycle 4 as a function of indicated thermal power.

Figure 3.3-2 gives the allowable hig'h and low primary coolant pressure l programmed with circulator inlet temperature. These setpoints and l

allowable values are as presented by PSC in their letter of June 21, 1985 6

l and as updated to respond to the NRC letters of October 16, 1986 and November 28, 1986.11 These latter NRC letters recommended that PSC distinguish between all Trip Setpoints and Allowable Values by accounting for setpoint tolerance and instrumentation drift based on the annual or refueling interval measured drift.

On pp. 3.3-4 to 3.3-9 the Basis for Specification LSSS 3.3 is given.

The setpoint methodology for determining Trip Setpoints and Allowable 13 L__-_-_____-_____-__-__-_ _ _ _ - _ _ _ _ _ _ _ _ _ _ . _ _ _

P 09/30/87 TSF Doc 2009H Disk 0173! Job 38256 Proof 3 _ JLL Values is described as well as the basis for each limiting safety system

. parameter. The basis descriptions are consistent with FSAR,  !

Sect ons7. 2.3, 7.1.2.4 and 7.1.2.5 and the licensing basis and discussion pres in' Attachment 4 to the PSC letter of June 21, 1985.1 Based on the above evaluation and the evaluations of Section 2.1 and 2.2 of this report, it is judged that the proposed changes are acceptable with the following exceptions.

. b Reheat Steam Temperature-High M In Table 3.3-1, Item 1.b) and.. Table 4.4-1 (Part'1), Item 5, Reheat Steam Temperature-High scram, the allowable value is $1067'F whereas in the PCS letter of May 15, 1986 this value is $1061*F. The transmittal letter (of PSC letter of August 28, 1987) does not call out this change. Nor is this change addressed anywhere else in the attachment.

. Mmary Coolant Pressure vs. Circulator Inlet Temperature -

In Figure 3.3-2, Primary Coolant Pressure vs. Circulator Inlet i Temperature, in the most upper left and most lower right legend block, the first entry should be " Allowable Value" not just the word " Allowable."

This change was made in the PSC submittal of May 15, 1986 per NRC direction in letter dated January 24, 1986 but was lef t off in the latest submittal.

1 l

NRC Reouest 3  !

The PSC response in letter dated August 28, 1987,3 resolves the ,

major discrepancy in Case 2 of 14,580 lb in FSAR Table 14.5-3 versus I

~20,000 lb in FSAR Figure 14.5-2 and -

PSC states:

i

" Allowance should be made for graphic artists' tolerance in transcribing l- data to curves. Other possible causes of minor apparent discrepancies are that in some cases the steam graphite reaction may not be completed at the 1

%I S.

Ulbd i 14

Job 38256 Proof 3 JLL PI09/30/87 TSF ' Doc.2009H ' Disk 01731 time of cut-off.at.the right side'of the figures, and/or the drainage of water from the steam generator into the PCRV may not have been completed at

.that time."

sFSAR Table 14.5-3, Cases 3, 5, and 6 still differ from their

' respective Figures 14'.5-3, 14.5-5, and 14.5-6 in the value of " Steam in Primary Coolant System (See below):

FSAR Section 14.5 fli TsSLt l4.S ~ $ $ TEVt IV !_S.L Total H 0 Total H 0 01fference I .of-Inleakage Inleakage Reacted and Reacted Figure-Steam in PCS Case (ib) (ib) (1b) (1b) 3 6,240* 185 6,055 4800 (Figure 14.5-3) 5 16,040 900 15,140 15,800 (Figure 14.5-Sa or b) ,,

6 8,080 919 7,161 6,800 (Figure 14.5-6)

> These differences in " steam in the primary coolant. system" between FSAR Table 14.5-3 and the FSAR Figures are much larger than what should be

" allowed for graphic artists' tolerance," and since the Figure values for Cases 3 and 6 are still decreasing at the time of cut-off at the right side of the figures, the figure values would deviate by even more than indicated j in the above table. PSC should make the " steam in the primary coolant system" consistent between the Table 14.5-3 and Figure values for Cases 3, 5, and 6.

Reactor Vessel Pressure Limiting Safety System setting i In Table 3:3-1, Items 2.c), 2.d), and 2.e) for all entries in the Trip l Setpoint and Allowable Value columns there is a plus and minus setpoint and a single allowable value. This does not agree with STS practice or with 7

the following PSC statements of STS practice and NRC guidance (see p.1 of Attachment 3 to PSC letter dated June 21,1985):

1i 15

~PL 09/30/87 :.TSF' Doc'2009H Disk.01731 Job.38256 Proof 3' _ ___ JLL "Setpoints in the STS are defined as limits with either greater than or less than, in contrast to the tolerances with plus or -

minus used by PSC 'In addition, PSC defined a reportable occurrence as' exceeding as Absolute Value, as opposed to an Allowable-Value. As a result, 'in their letter The Commission recommended that FSV PPS setpoints.be specified in terms of an 1 Allowable Value and a Trip Setpoint, " expressed as either greater than or less than as well as equal to the value specified."

PSC should-re-evaluate the above T. rip Setpoint and Allowable values accommodating the quoted NRC guidance.

Basis for Specification LSSS 3.3  !

'l Under the heading!" General Methodology" on p. 3.3-5, the phrase "the greater value of" is applicable to the subsequent Items a., b., and c. but shouldn't be. Items a. , b. , and c. should be cumulative.

• Also in the first two paragraphs, p.'1/3-5, there appear to be two definitions of how the " Allowable' Value" is separated from the " Analysis Value." The first is:

"The remaining three factors contributing to instrument error and  !

1 used to determine the Allowable Values are: j

-The greater value of:

a. Accuracy of components not calibrated when the setpoint is ,

1 measured; or actual drift data from calibrations.

b. Accura'cy of test equipment used to calibrate instruments, and

c. Design drift allowances (including environmental effects) on equipment accuracy."

n r 7' dd 16 l

D P 09/30/87::TSF Doc"2009H Disk 01731 '. Job 38256 Proof 3i .JLL'

}..> ,

L _.

.The .second . is;:

1 "A " total inaccuracy" value which was calculated, based on the 4

a

refueling surveillance frequenc'y, was used to determine.the margin between the Analysis Value and the Allowable Value."

Also per ISA Standard S67.04-1982, in Item a., the accuracy and drift  !

should be accounted for not accuracy or drift of the subject components. )

The last paragraph of'p. 3.3-5 states:

"The Trip Setpoint was determined by accounting for the " total I inaccuracy" of that portion of the instrument channel not tested during the monthly functional test plus the drift of that portion of the instrument channel which is tested during the monthly functional test. The value obtained by adding these factors is the margin between the Analysis Value and the Trip Setpoint." - .

This is not per the ISA Standard 567.04-1982 nor per the NRC guidance most recently'given in letter dated November 26, 1986 of "We recommend that you propose TS based on the annual (or refueling interval) allowable values." Also this present PSC distinction cont.inues to ignore the

~

reco mendation made in the NRC letter dated October 16, 1986 in which it was emphasized that the separation between " Allowable Value" and " Trip Setpoint" per the ISA 567.04 Standard is to segregate that part of the instrumentation inaccuracy that is subject to change with time, namely drift. The " inaccuracy" of the channel not: tested during the monthly f functional test is usually a fixed known value that doesn't change and '

should not be part of the separation between " Allowable Value" and " Trip

.Setpoint." ' \

Basis For' Helium _ Circulator Penetration Interspace Pressure On p. 3.3-9 in the basis for the helium circulator penetration interspace pressure, the third sentence reads:

. ne

>> e WiDi i 17

PL 09/30/87 TSF Doc-2009H- Disk 01731 Job 38256~ ' Proof 3 _, JLL j i

"The _ rupture discs would burst in the pressure range of j 809psig(-2%)to842psig(+2%). The safety valves-would open in the range of 781~ psig (-3%) to 829 psig (+3%) and would relieve at full capacity at 886 psig (10% accumulation)." ,

]

Whereas in Table 3.3-1, p. 3.3-2c, Item 2.d), the Trip Setpoint is

. quoted as "825 psig plus or minus 17 psi." _The Lower limit burst pressure i is thus 809' psig in the basis but 825 psig - 17 psi = 808 psig in the Table. These values should be consistent. If the 17 psi is a conservative round0 for 2% of 825 psig (namely 16.5 psi) on the low limit side then for consistency, 16 psi should be used for the high limit side for a value of 825 + 2% of 841 psig. It is recommended that the Table values be left as i is but the basis value 'ae changed f rom 809 psig to 808 psig.

Basis For Steam Generator Penetration Interspace Pressure D. i Same comment as for the Helium Circulator Penetration Interspace -

Pressure on 808 psig versus 809 psig for the -2% lower limit on the 825 psig trip setpoint. 4 2.3.2 Protection System Instrumentation, Limiting Conditions for Operation (LCOs) (Section 4.4.1j The Licensee letter of August 28, 1987 3proposed changes to

s. Technical Specification Section 4.4.1, protection System Instrumentation, Limiting Conditions for Operation. Proposed revisions were on TS pp. 4.4-1, 2, 3a , 3b, 3c , 4a , 4b, 4c, 4d, Sa , 5b, Sc, 7a , 7b, 8,10,10a ,

10b, 10c, 11, lla, 12, 12a, 12b, 12c, and 13. These revised pages replaced i existing pp. 4.4-1 through 4.4-8, 4.4-10, 11, 12, and 13. Existing pp. 4.4-6a, 6b, and 6c on the Steam Line Rupture Detection and Isolation System (SLRDIS)'are unchanged as is D. 4.4-9.

The added definitions on p. 4.4-1 of Trip Setpoint and Allowable Value are as discussed earlier (Section 2.3.1 of this report) to distinguish between "as left" and "as found" values, respectively. p 18 I  !

P. 09/30/87 TSF Doc's009H' Disk 01731 Job 38256 Proof 3 _ _

JLL On p. 4.4-2, clarification is made that LCOs 4.2.10 and 4.2.11 apply duringthetimethatthePPSlmoisturemonitortripsaredisabled. This'is

.just a reminder to the operators since LCOs 4.2.10 and 4.2.11 would apply

'with or without this clarification. The action for. inoperable channels for

. Table 4.4.3 g[Uow provides a choice of either reactor shutdown or circulator shutdown rather than the previous requirement of just circulator shutdown. Reactor shutdown is a more stringent action than just circulator shutdown and is'therefore acceptable.

In' Tables 4.4-1,'4.4-2, 4.4-3, and 4.4-4 reformatting was provided by ,

splitting each Table into Part 1, containing Trip Setpoint and Allowable {

Value, and Part 2, containing Minimum Operable Channels, Minimum Degree of l l

Redundancy, and Permissible Bypass Conditions. Primarily, the changes are {

to account for 1' instrumentation inaccuracy as presented by PSC in their )

letter of June 21, 1985 and as updated to respond to the NRC letters of )

L October'16,-19866 and November 26, 1986.11 These latter NRC letters 'l recommended that PSC distinguish between all Trip Setpoints and Allowable . . i Values by accounting for setpoint tolerance and instrumentation drift based on the annual or refueling interval measured drift. l On pp. 4.4-10, 10a, 10b, 10c, 11, lla, 12, 12a, 12b, 12c and 13 the Basis for specification 4.4.1 is given. The setpoint methodology for i determining Trip Setpoints and Allowable Values is as described for the i LSSS basis in the previous section of this report (2.3.1). Each trip for scram, loop shutdcwn, circulator trip, and rod withdrawal prohibit functions are described and are consistent with FSAR Section 7.1.2.3, I 7.1.2.4, 7.1.2.5, and 7.1.2.6 and the licensing basis and discussion j presented in Attachment 4 to the PSC letter of June 21, 1985.1 Several of the proposed changes in Section 4.4.1 are not directly associated with' accounting for instrumentation inaccuracy. Some of these other changes have already been discussed for p. 4.4-2. The remaining items are discussed below.

19 t

. _ _ = - _ ._.

l

'P 09/30/87 .TSF . Doc 2009H Disk 01731 Job 38256 Proof 3 JLL l inLTable 4.4-1 (Part 1), Item'10, Plant Electrical System-Loss, l Note (d) was deleted from the Trip Setting column and replaced with the

Trip Setpoint and Allowable Value and correspondingly note (d) was deleted on p. 4_.4-8 otesforTables4.4-hugh4.4-4. Also for this same scram function,. note (e) on p. 4,4-8 was updated to correctly describe the ]

undervoltage system design. Note (e) appears for the Plant Electrical

' l System-LosshramfunctioninTable4.4-1,Part2,underMinimumOperable l Channels. Updating of Note (e) is consistent with the FSAR Rev. 5 y description of the Plant Electrica1 System-Loss scram function in {

Section 7.1.2.3 and FSAR Table 7.1-2 and is therefore acceptable. {18l f In Table 4.4-1, Part 2 Item 4., Primary Coolant Moisture High Level Monitor and Loop Monitor, under Permissible Bypass Conditions, the existing "none" and note. (h) were clarified as note (h2) for the High Level Monitor and note (hl) for the Loop Monitor. Addition of note (h2) for the High )'

Level Monitor just recognizes an existing Permissible Bypass Condition in LCO 4.9.2. Note (hl) is unchanged from the previous Permissible Bypass .

Condition note-(h) for the Loop Monitor.

In Table 4.4-2 (Part 2), p. 4.4-4d, Item 7c., High Differential Temperature Between Loop 1 and Leop 2, the Permissible Bypass Condition has been changed form "none" to "less than 30% rated. power." This change is acceptable as High Differential Temperature Between Loop 1 and Loop 2 is a coincident requirement [see Footnote (4) on p. 4.4-8] for Item 7a., Low Superheat deader Temperature, Loop 1, and for Item 76., Low Superneat Header. Temperature, Loop 2. As the existing Fort St. Vrain TS Permissible Bypass Conditions for Items 7a. and 7b. are both "less than 30% rated power," it is only consistent that the coincidence requirement, Item 7c.,

have the same Permissible Bypass Condition.

The "*" fo6tnote has been celeted for Circulator Speed-High Water under the "m,inimum operable channels" and " minimum degree of redundancy,"

Table 4.4-3 (Part 2), Item 9. A request for additional information (RAI) on this item was submitted as Item 15 to the Enclosure of NRC letter dated October 16, 1986.6 PSC's response in letter dated August 28, 1987 stated GQ. ?

N U 20 l

P 09/30/87 T5F Doc 2009H Disk 01731 Job 38256 Proof 3 _ _ JLL that removal of the footnote is more conservative as the applicability is now to have channels operable for each circulator versus the one per loop allowed with the footnote. PSC determined that the previous allowed flexibility of operable channels for only one circulator per loop would not I have been exercised and so celeted the footnote. This deletion is in the conservative direction and removes a flexibility that in retrospect was

(

l unwarranted and therefore the celetion is acceptable.

In Table 4.4-4, Part 2, Items 3a. and 3b. , Linear Channel-High Power RWP (Channels 3, 4, and 5 anc Channels 6, 7, and 8), under " permissible Bypass Conditions" "none" was changed to "above 30% rated power." If this RWP function is bypassed above 30% rated power but the Interlock Sequence Switch is left in the Low Pcwer Position, then the block on outward rod motion is defeated even though it shouldn't be. This change is therefore unacceptable.

Other minor editoria' changes (commas, hyphens, consistency in titles, ^.

• capitalization, etc.) have been mace but were not specifically listed in the " summary of proposed changes." These editorial changes are acceptable as are the expanded bases of the scram, loop shutdown, circulator trip, and RWP functions.

Based on the above evaluations and evaluations of Section 2.1 and 2.2 of this report, it is judged that the changes to TS Section 4.4.1 are acceptable with the following exceptions.

Linear Channel-H3h Power RWP (Channels 3, 4. and 5 and thannels 6, 7, and_8_1 In Table 4.4-4, Part 2, Items 3a. and 3 ,, inear Channel-High Power RWP (Channels 3, 4, and 5 and Channels 6, 7, .d 8), under " permissible Bypass Conditioh," the bypass condition shoula remain as "none" and not as the proposed "above 30% rated power."

@ 5 7'"'

s 21

(

'P' 09/30/87 TSF: Doc 2009H - Disk 01731 Job 38256- Proof 3 JLL NRC Request (6' PSCresponsetothisNRCRequest(tojustifywhytheHighDifferential Temperature b,etween Loop 1 and t. cop oop[Shutdownfunctionisnotin the' FSARf clarified that it. is discussed in FSAR Section 7.1.2.4 as a comparator circuit between the two loops and an interlock. Also footnote

"$)"in'TSTable4'.4-2,Part2, Items 7a.,7b.,and7c.andp.4.4-8 states that: mv

[

'" Item'7a. must be accompanied by Item 7c. for Loop 1 Qutdownp Item 7b. must be accompanied by Item 7c for Loop 2 shutdown."

6NL1 This is the, clear indication in either the Technical Specifications or FSAR that coincidence is required with High Differential Temperature L BetweenLoop1andLoop2toget[oopfhutdownontheLowSuperheatHeader Temperature trip for either loop 1 or Loop 2. It is recommended that when . .'

the FSAR is revised to add the trip setpoint for the High Differential ,

Temperature Between Loop 1 and Loop 2, that FSAR Section 7.1.2.4 be clarified to explicitly state the coincidence requirement.

NRC Request 7, Deletion of.' Curve for Circular Soced-Low In NRC letter dated October 16, 1986, request for additional information umber 7, PSC was asked to justify deletion of reference to Figures 4.4-la and 4.4-lb for the circulator Speed-Low trip. PSC's response was to see their response to NRC request 4. In their Response 4, PSC referenced discussion with the NRC Staff in the July 30, 1986 telecon.

PSC stated:

3

,. -2 M l

22 l

[:

4 "

.PJ 09/30/87 TSF- Doc.-2009H Disk 0173I Job 38256 Proof 3'_ ,__ . J LL "In-a followup telecon, the.NRC staff provided PSC with the

' direction f. hat'the revised' amendment request should only include-those: paramekers 'which 'now exist in the present Technical

' Specifications. In addition, those new parameters.would not have had approved surveillance requirements-had we included them,"

This direction is acceptable for the response to the following listed

<- NRC requests as all of these functions are not in the existing FSV.

Technical Specifications: '

RD "CT 4, Wide Range Channel Rate of Change-High, Ultfil:I

,. 7 5, Primary Coolant Moisture High Level Monitor and Loop Monitor, 8, . Programmed Feedwater Flow-Low, 9, Rod Wir.hdrawal Prohibits for Startup Channel Rate of Change-High- '

and Wide Range Channel Rate of Change-Hfgh,

.10, Rod Withdrawal Prohibit for Linear Channel-High power RWP (above  ;

30% power) and .j i

12, RWP Multiple Rod Pair Withdrawal.

However, Circulator Speed-Low for. the circulator trip is in the existing FSV Technical Specifications and the programmed curve should be supplied as has been done for other existing FSV functions that had programmed curves [for example, Primary Coolant Pressure - Programmed Low in Table 3.3-1, Item 1.c) and Primary Coolant Pressure-Programmed High in Table 3.3-1, Item 2.a)].

g r, -

si i

l 23 1-

NRC Request 8 PSC's response to this request was to "see PSC Response 4." PSC Response 4 was basically that trip functions not in the existing FSV Technical Specifications were left out of PSC's August 28, 1987 submittal.

While this reference to Response 4 is appropriate for the Programmed Feedwater Flow-Low f unction, it is not appropriate for the question posed in the last sentence of the NRC Request 8, namely:

"Also, the NRC letter of January 24, 1986, did request additional analyses for the Fixed Feedwater Flow-Low setpoint, but PSC did not provide or mention these latter analyses in u ->v t ~ >

their letter." Q, g W {

The NRC letter of January 24, 1986,5 Enclosure 3, raised the concern that there was no apparent safety analysis to justify bypass at less than 30 percent power on circulator trips on fixed feedwater

• flow-low, This concern and the parallel concern for the Programmed Feedwater Flow-Low function (when it is >ubmitted) remain unanswered.

NRC Request 13 Rod Withdrawal Prohibit (RWP) at 30% Rated Thermal Power (RTp)

The Licensee's position regarding not providing instrumentation inaccuracy for the $30% of rated power RWP setpoint remains unacceptable.

P.6, Attachment 3 to the PSC letter of June 21, 1985,l stated that the rod withdrawal prohibits were not analyzed as part of the program to comply with the guidance of the ISA Standard S67.04, because no credit is taken for them in accident analyses. This Licensee position was challenged in NRC letter dated,0ctober 16, 1968 which requested additional information to clarify why, at'least, the 530% of rated power RWP setpoint does not require instrument uncertainty to be taken into account, P.4.4-6a, Table 4.4-4 (Part 1) and to also, re-evaluate the other RWPs to ensure that if they were deleted, an operator single failure in positioning r~r ' Y

'a 24

P 09/30/87 .TSFu Doc 2009H- -Disk 01731 Job 38256 Proof 3' .

JLt.

the Interlock Sequence Switch (ISS) would not bypass required reactor-protection trip functions. The NRC letter stated that:

"Without the rod withdrawal prohibit, high power operation

(>30%) could be commenced.with the . interlock sequence switch

}

~

(ISS) in the low power position with four scram functions and .!

two circulator trip. functions bypassed (FSAR Section 7 '1.2.8). wus s j As this is an operator single f ailure defeat of part of the i

reactor. protection system at high power, the 30% of rated power RWP appears to~be a required safety function-to prevent this occurrence. Therefore, at least this. function of the RWP should

'have had instrument uncertainty taken into account for the setpoint. Otherwise, additional safety analyses are required to u g

demonstrate safe operation with the above reactor protection system functions bypassed."

i The Licensee in' letter dated August 28, 19873 argued that backing .

off the 30% RWP.to accommodate instrument inaccuracies is inappropriate and i

unwarranted. The Licensee stated:

l l

"The ISS, as explained in FSAR Section 7.1.2.8, is an administratively controlled method for operating protection system bypasses during rise to power. In this regard it is similar to the BWR Reactor Mode Switch (NUREG 0123 Rev. 3). The 30% RWP is included as a second line of defense (or added reminder) to the reactor operator to place the ISS in the correct position prior to exceeding 30% reactor power. FSAR f Table 7.1-6 is an analysis of improper ISS settings and the l l

effect on rise to power.

i The underlying rationale for not applying instrumentation uncertainties to the RWP circuitry is that of avoiding the potential for ,

)

initiating protective actions when system conditions do not warrant it. To '

Ji 25 1

l 1

P 09/30/87 TSF Doc 2009H Disk 01738 Job 38256 Proof ~3._, _

JLL-

. apply uncertainties to these parameters, especially the 30% RWP, would mean-backing .off from'this value, thus resulting in a setpoint somewhat less .

than-30%. By.doing so, certain plant protective functi:ns would.be

" enabled" prior to system operating parameters (pressures, flows, l temperatures, etc.) being within normal oper ting conditions."

The Licensee further clarified that the linear and wide range nuclear instrument channels, which input signals proportionate to reactor power to

, the'RWP circuitry, are calibrated.against a secondary heat balance prior to reaching 30% power-(in the range of 26 to 28% power). And due to the accuracy of the secondary calorimetric and the RWP circuitry, reactor power

'would not exceed about 34% without. actuating the RWP. If the operator were to neglect placing the ISS in Power and exceed 30% power, it is highly unlikely that an accident would occur in this ' circumstance, due to the short time spent in the 30% to 34% power range before the RWP would be received during the rise-to power. Also, the Licensee states that the-Steam Line Rupture Detection / Isolation System (SLRDI3) is now relied on rather than the Hot Reheat Pressure-Low and Main Steam Pressure-Low scram parameters even though the later will continue to be in the Technical Specifications. Finally, the Licensee states that the turbine generator is  ;

brought on-line.with the external electrical grid at approximately 28%

reactor power, and this action needs to be-accomplished with stability without being encumbered with a rod withdraw prohibit setting in the same range, and re'ducing the RWP setting would also intrude into the 26% to 28%

range where-secon'dary heat balances are made (heat balances are less accurate.if performed at lower power levels).

The Licensee in its response has failed to consider several aspects relating to the $30% RWP setpoint. These aspects are as follows:

1. ThefuYdamentalquestioniswhetherornotthesafetyanalysis for protecting against accident situations remains valid if the operator were to inadvertently proceed to pcwer levels above 30%

RTP without positioning the ISS to the " power" position, BRMT I

26

= . . .

P 09/30/87 TSF Doc 2009H Disk 01731 ' Job 38256 Proof 3 JLL

.2. The FSV Interlock Sequence Switch-(ISS) and Reactor Mode Switch (RMS) do not provide the same level of protection against l

. inadvertent operation outside intended bounds as does the BWR 3

Reactor Mode-Switch or the PWR Reactor Protection System

~

J

. interlocks,'and i

3. The Licensee has argued about the difficulties of lowering the i RWP setpoint below 30% RTP but has not pursued increasing it above 30% RTP. ,

DRiM, Each of these aspects will be addressed' individually below. I

)

.The fundamental point of accounting for inaccuracy in the 30% RWP setpoint-is to guarantee that the safety analysis for the reactor trip system remains valid. This is the same rationale for pursuing accounting for instrumentation inaccuracy in the other reactor protection system (RPS) setpoints (scrams, loop shutdowns, ano circulator trips). Certainly, N*

accounting for inaccuracy in RPS setpoints, as has been done and as has been the' intent of this Technical Specification change effort, is of little consequence if the RPS function and setpoint is bypassed because the ISS is positioned to Low Power (530% RTP) when operation may actually be occurring at. Power. (>30% RTP). The RWP setpoint inaccuracy may permit operation in such an.unanalyzed condition the same as -if one of the other RPS setpoints had not been analyzed to account for its instrumentation inaccuracy, but with the ISS in the correct position". The Licensee stated that " accident consequences for power range accidents are analyzed at conservative upper po'wer limits" and that "the consequences of accidents occurring from lower power levels have not generally been analyzed." The Licensee needs to make this more precise. The power level at which the RPS functions, those that are bypassed in the Low Power ISS position, are needed should be well 1 defined. Simply performing accident analysis at conservative upper power limits while demonstrating the RPS trips are adequate to ensure protection at worst case conditions does not establish at what low power level the trips may be bypassed. Likewise stating that lowering the RWP 30% RTP j setpoint would cause difficulties because the I p--

U l 27 1

1

P '09/30/87 TSF Doc 2009H Disk 0173I Job'38256 Proof 3 _ 'JLL' turbine generator is brought-on-line at approximately 28% reactor power and 1th'at' secondary heat balances are made in the 26% to 28% power range does not constitute a valid basis for allowing potential single-failure defeat of RPS trips. The Licensee has also argued that not accounting for the

,30%

< RWP setpoint instrumentation inaccuracy may at most place the plant at risk in about a 4% power interval centered around 30% RTP and that it is-highly unl.ikely that an accident would initiate in this circumstance due to the short time spent in the 30% to 34% power range. This last argument is

--unacceptable as the accepted reactor protection system practice is to provide' protection over the full' allowable power range without exception.

The Licensee fu'rther argued that the ISS and RWP are included as a second line of defense (or added reminder).-~to the reactor operator to place the ISS in the correct-position prior to exceeding 30% reactor power. This Licensee argument is the exact reason that the $30% RWP setpoint should be rigorous and include instrumentation inaccuracy. It is the single operator error of not positioning the ISS to the power position while exceeding 30%

RTP that constitutes a sinole failure defeat of soine of the RPS functions. '

Per General Design Criteria 19 and 20 (see Appendix C, Rev. 5 of the FSV FSAR) and as argued by the Licensee in stating that these criteria are met, 3 the RPS has high functional reliability and redundancy to assure that no }

single failure will result in loss of the protection function. As will be discussed immediately below other reactor designs will result in automatic 1

scram if the operator attempts to go to higher power than that permitted by i the Reactor Mode Switch. As the FSV design does not provide for such automatic scram, the RWP provides the required backup.

The FSV ISS and RMS do not provide the same level of protection

< against inadvertent operation outside intended bounds as do BWR or PWR J systems. At FSV the operator may proceed to power levels above 30% RTP with the ISS in t,he Low Power position and thus defeat various RPS functions intend'ed to be operable above 30% RTP, This same situation does not exist in BWR and PWR designs. In a BWR the Reactor Mode Switch has four positions: Startup, Run, Shutdown, and Refueling. If the operator DMFT l

28 i

l 1____________ _ _

j

P 09/30/87 TSF Doc 2009H Disk 01731 Job 38256 Proof 3 _ _

JLL inadvertently tried to go to power with the RMS in Startup, the plant would automatically scram on the Intermediate Range Monitor-High trip. In l

contrast, at FSV the startup trip, the High Wide Range Channel Rate of Neutron Flux Change, is bypassed in the Low Power position of the ISS and therefore will not cause an automatic scram. In the PWR design, on increasing reactor power, the P-6 and P-10 interlocks allow manual block of the Source Range trip, the Intermediate Range trip, and the Low Setpoint Power Range trip. On increasing reactor power, the P-7, P-8 and P-9 interlocks automatically enables. reactor trips that are intended to be operable as various higher power levels are reached. The operator cannot defeat these automatically enable reactor trip function interlocks. At most, the operator could fail to block the startup trips when allowed but these would only cause automatic reactor scram as their setpoints were reached on progressing to higher powers. Because of this significant difference in the FSV design that allows the operator to inadvertently bypass certain reactor protective functions when they were intended to be

~

• operable, the RWP takes on an added safety significance for FSV to block

• outward rod motion when the ISS is not correctly positioned.

The Licensee has pursued and explained the difficulties of lowering the RWP setpoint below 30*; RTP but has not pursued increasing it above 30%

RTP. For other RPS trips the Licensee has perfprmed additional safety analysis to allow raising the involved setpoint so as to avoid inadvertent actuations when the instrument uncertainty is accounted for. Also, if the present 30*4 RWP setpoint is subject to the approximate 4% instrumentation uncertainty stated by the Licensee then the actual power may be at 26?; RTP when the 30?e RWP setpoint is actuated. This would appear to confuse the issues brought up by the Licensee of potentially interfering with bringing the turbine generator on-line at about 28% reactor power and doing secondary heat balances between 26*J and 28% reactor power. An all around more appropriate solution would appear to be doing additional safety analysis to raise the 30*f RTP RWP setpoint so that even af ter the 4%

instrumentation inaccuracy is accounted for, the setpoint is still sufficiently high (say 34*J RTP) 50 that interfering with the turbine generator and secondary heat balance is avoided.

29 DWT

" Doc-2009H- Disk 01731 Job 38256 JLL

'P 09/30/87 -TSF Proof 3 _ _

, It is recommended that the Licensee re-evaluate the 530% RTP RWP setpoint to account for instrumentation inaccuracy as discussed above. As the 30% RWP.setpoint can be re-evaluated without the need.to delay the inclusion'of. Instrumentation inaccuracy in the other RPS trip setpoints, it is recommended that the 30'.' RWP setpoint re-evaluation be handled as a separate issue. In.the interim, the remaining RPS setpoints for which instrumentation inaccuracy has already been accounted for could be approved now for facility use,

. I 480 V AC Essential Bus Undervoltage Protection Trip Setpoints In PSC letter dated August 24, 1987 (P-87272),9 Attachment 2, p. 2, NRC Comment (1) and the PSC Response are:

"NRC Comment (1): j

" Tables 4.-4.5 anc 5.4.5 and associated notes were to be added to 'a i the-Technical Specifications. Reference [3] included these tables as Tables 3.3.1.5 and 4.3.1.5. We note that the time dial setting for Functional Unit 3 changed from 6 to 5 in the process...The licensee should verify the correct settings of these undervoltage relays and commit to hav.ing these tables and notes in the upgraded Electrical Technical Specifications. It should include nominal setpoints and allowable limits (where voltage and time tolerances ex'ist)."  !

PSC Response:

This comment is associated with the PPS Technical Specification l amendment and will be addressed as part of the PPS submittal." )

Contrary to PSC's stated response the only information on essential bus undervoltage is Item 10. of Table 4.4-1 (Part 1) where the Trip Setpoint, 3278 V and $31.5 seconds, and Allowable Value, 1266 V and  !

$35 second are listed. No Trip Setpoints, Delay Times, and Allowable 30 I ,

.P 09/30/87 TSF- Doc 2009H Disk 0173I Job 38256 Proof 3 _, JLL

Values are provided for gegraded v,oltage, loss of voltage automatic t,hrow t

over (ATO), or' loss.of voltage-D.G. jLtart, load'shed and load sequence.

'This latter information had been presented in Tables 3.3.145 and 4.3.1.5 of the November 30,'1985 Draft Technical Spec ~ifications 10 and is still required.

High: Reactor Building Temperature (Pipe Cavity)

.In Table 4.4 (Part 1), Item-12, P.4.4-3b, High Reactor Building Temperature (Pipe Cavity), the allowable value has been changed from 165 F, PSC letter of May 15, 1986, to 166 F. There is no explanation for this change. -

Low Superheat Header Temperature In Table 4.4-2 (Part 1), Items 7a. , 7b. , and 7c. , a footnote "(f')"

should be acded under the " Functional Unit" description for each entry: .

Low Superheat Header Temperature, Loop 1 and 2, and High Differential i Temperature Between Loop 1 and Loop 2. The footnote "(f)" indicates that j Low Superheat Header Temperature in a Loop is required coincident with High j Differential Temperature'Between Loop 1 and Loop 2 in order to get a scram. Although the footnote "(f)" appears in Table 4.4-2 (Part 2) for )

W these Functional Units, the footnote is also applicable to tac trip j information in Part 1 of Table 4,4-2.

Circulator Speed-Low l

In Table 4.4-3, Item 1., Circulator Speed-Low, tne allowable value of i 52035 rpm below normal was $1974 rpm below normal in the PSC letter of May 15, 1986.. As this function previously had drif t accounted for, it is ,

i not obvious why'the value has changed.

1 l

31

i P '09/30/87 .TSF . Doc 2009H Disk 01733 Job 38256 Proof 3 .JLL l Circulator Seal Malfunction In- Table'4.4-3 (Part 1), Item 8. , Circulator Seal Malfunction, the I l

i

. allowable value of $76.1" H2 O was 575.6" H 2 O in the PSC letter of

'May 15, 1986. As this function previously had drift accounted for, it is not' obvious why the'value-has changed.

3 7On= j Circulator Speed-High Water ' '

l l

In Table 4.4-3_(Part 1), Item 9. ,- Circulator Speed-High Water, the allowable value of $8,786 rpm was $8,670 rpm in the PSC letter of May 15, i 1986. As this function previously h'ad drift accounted for, it is obvious why the value has changed, i 1

. s' 9

l' l

32 L__-_-____--_--_-__

P 09/30/87 TSF. Doc 2009H Disk 01731 Job 38256 Proof 3 JLL

,. .4.

SUMMARY

An evaluation has been made of the PSC resubmittal of'May 15, 1986, on the proposed changes for the trip setpoints for the plant protective system. PSC's earlier letter of June 21, 1986, proposed a number of i

additional changes in the format of the Technical Specifications. These earlier changes were primarily a part of an overall upgrade program to provide an improved statement of requirements consistent with the format of Technical Specifications for light water reactors. yqp IM l The' staff had a number of comments (see NRC letter dated ,

January 24,1986) on the specifics.of these proposed changes that require resolution before action can be taken on the proposed changes. However,

-those changes related to trip setpoints are safety significant in that the current specification requirements do not include adequate margins for instrumentation uncertainty. Therefore, these changes were resubmitted in PSC's. letter of'May 15, 1986, as a proposed amendment to Appendix A of -.

Facility 0perating License, No. OPR-34.

Based on evaluation of PSC's resubmittal, it is concluded that additional information related to the trip setpoints for the plant protection systems is. reauired. The specific additional information required is enumerated in Section 3. The Fixed Feedwater Flow - Low setpoint change will be addressed in a separate review.

l l

DWT l 1

1 33

. P 09/30/87 TSF Doc 2009H Oisk 01731 Job 38256 Proof 3 _ _ JLL

5. REFERENCES

1. O. R. Lee letter to E. H. Johnson, " Proposed Changes to Sections 2.1, 3.3, 4.0, 5.0, LCO 4.4.1, and SR 5.4.1 of the Fort St. Vrain Technical Specifications," Public Service Company of Colcrado, June 21, 1985.

2. R. F. Walker letter to H. N. Berkow, " Technical Specification Change Request to the Plant Protective System Trip Setpoints," Public Service Company of Colorado, May 15, 1986.

3. R. O. ' Williams letter to Jose A. Calvo, " Technical Specification Change Request to the Plant Protective System Trip Setpoints," Public Service Company of Colorado, August 28, 1987.

4. ISA-567.04, "Setpoints for Nuclear Safety-Related Instrumentation Used in Nuclear Power Plants," 1982, Instrument Society of America.

5. H. N. Berkow letter to R. F. Walker, " Fort St. Vrain-Plant Protection System Trip Setpoints," Office of Nuclear Reactor Regulation, U.S.

Nuclear Regulatory Commission, January 24,. 1986.

6. Kenneth L. Heitner letter to R. O. Williams, " Request for Additional Information for Plant Protective System Trip Setpoints and Surveillance Requirements for Fort St. Vrain Nuclear Generating Station," Office of Nuclear Reactor Regulatory, U.S. Nuclear ~,*

Regulatory Commission, October 16, 1986.

7. NUREG-0452, Rev 4, Standard Technical Specifications for Westinghouse Pressurized Water Reactors, published by the Division of Licensing, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, Fall 1981.

8. D. Warembourg letter to J. T. Collins, "Fo.rt St. Vrain Plant Protective Syste.n Technical Specifications," Public Service Company of Colorado, March 9, 1984.

9. H. L. Brey lettcr to Jose Calvo,' " Final Draf t Upgrade Technical Specification Sections 3/4.8, Dated November 30, 1985," Public Service Company of Colorado, P-87272, August 24, 1987,

10. O. R. Lee ietter to H. N. Berkow, " Upgraded Tecnnical Specifications,"

Public Se'vice Company of Colorado, P-85448, November 27, 1985.

11. Kenneth L. Heitner letter to R. O. Williams, " Plant Protective System

$etpoints,".0ffice of Nuclear Reactor Regulation, U.S. Nuclear Regulator,vCommission, November 26, 1986.

34

- - _ - _ _ _ _ _ _ _ _ __ _ __ _ _ _ - _ _ _ _ .