TXX-4086, Forwards Addl Info Re TMI Item II.F.2, Instrumentation for Detection of Inadequate Core Cooling & Justification for Proposed Implementation Schedule for Heated Junction Thermocouple Sys
| ML20083F855 | |
| Person / Time | |
|---|---|
| Site: | Comanche Peak  |
| Issue date: | 01/03/1984 |
| From: | Gary R TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC) |
| To: | Youngblood B Office of Nuclear Reactor Regulation |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737 TXX-4086, NUDOCS 8401100394 | |
| Download: ML20083F855 (37) | |
Text
c TEXAS UTILITIES GENERATING CO.TilnNY Log # TXX-4086 File # 907 m ninmuwen mu_mrsm.,*" **
.mi.tf.^."7.....,
January 3, 1984 ANO GENEAA4 M4MA41R Director of Nuclear Reactor Regulation Attention: Mr. B. J. Youngblood, Chief Licensing Branch No. 1 Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C.
20555
SUBJECT:
COMANCHE PEAK STEAM ELECTRIC STATION DOCKET N05. 50-445 AND 50-446 COMPLIANCE WITH TMI ACTION PLAN ITEM II.F.2 REF:
B. J. Youngblood letter to R. J. Gary of October 7,1983
Dear Sir:
The referenced letter requested that TU provide additional information concerning TMI Action Plan Item II.F.2, " Instrumentation for Detection of Inadequate Core Cooling" and the justification for the proposed implementation schedule for the Heated Junction Thermocouple (HJTC)
System. The requested information is hereby submitted in the attached report which was prepared in response to the referenced request.
It should be noted that the implementation of the Comanche Peak Steam Electric Station (CPSES) instrumentation for detection of inadequate core cooling will be completed prior to fuel load except for the HJTC System. The implementation of the HJTC System is scheduled for orior to startup following the first refueling outage.
The backfits required by all the NUREG-0737 items are part of an NRC staff plan to improve safety at power reactors.
Just as operating plants have been allowed to continue operation while NUREG-0737 items are being implemented, CPSES should be issued an Operating License and allowed to operate while reasonable efforts are expended to implement
)
applicable and appropriate NUREG-0737 items. Specifically, CPSES should be issued an operating license and allowed to operate while implementation of the HJTC System continues.
Respectfully,
R.
. Gary DRW/grr M'
8401100394 840103 PDR ADOCK 05000445 A
PDR 8/yo
I TEXAS UfILITIES SERVICES E4C.
OCHANCHE PEAK STEAM EIE TRIC STATION RESPONSE '10 NUREG-0737 ITEM II.F.2 INS'IREMENIATION FOR DETECTION OF INADEQJATE CORE (DOLING December 5, 1983
TABIE OF (DNTENTS Page List of Figures lii List of Tables iv 1.0 INIBODUCTION 1
- 2. O SYSTEM EUiCTIONS-2 2.1 Definition of ICC 2
2.2 Functional Requirements 4
3.0 INN'" ION DESCRIPTION 5
3.1 Core (boling mnitor System 5
3.1.1 (bre Exit t ermocauples 5
3.1.2 Saturation Margin mnitor 9
3.2 Heated Junction termoccuple System 9
3.3 Instrtznentation Displays And Alarms 15 3.3.1 Core Cooling mnitor System 16 3.3.2 Heated Junction hermocouple System 16 3.3.3 System Failure Alarms 19 3.4 Computer Ebnctions 19 3.5 Equipnent Qualification 20 3.5.1 Core (boling 2nitor System 20 3.5.2 Heated Junction termoccuple System 22 3.5.3 Criteria and Str.ndards 23 4.0 SYSTEM APPLICATICN 24
- 5. 0 SYSTEM IMPLENENTATION 26 6.0 SYSTEM DOClFBUATION 27
- 7. 0 CONCIUSION 31 REFERENCEE 32 11
I LIST CF FIGURES 1
Figure Page i
1.
CORE EXIT WERMOO'XPJ AND HEATED JUNCTION WERMOCOUPLE IOCATIONS (PIAN VIEW) 6 2.
0]RE EXIT THERMOCOUPLE AND HEATED JUNCTION E ERMOOOUPLE IOCATIONS (EIEVATICN VIEW) 7 3.
ICC MONITORDU SYSTEM SENSOR IOCATIONS 10 4.
ICC MONI'IURING SYSTDi TRAIN A SIGt&L PROCESSHG AND DISPIAYS (TRAIN B SIMIIAR) 11 5.
HJIC SENSOR ELECTRICAL DIMFJM 12 6.
CORE COOLING MONITOR SYSTDi 'IRAIN A CONTROL BOARD DISPIAYS (TRAIN B SIMIIAR) 17 7.
HEATED JUNCTION THERM 0000PLE SYSTEM (DNEROL BOARD DISPLAY (TRAIN A & B) 18 1
9 iii
.u.
e LIST T BBIIlS Table Page I.
SMGES IN PIOGRESSION OF ICC EVENr 3
II.
CORE COOLING MONITOR SIGNAL SPECIFICATION 8
SUMMARY
III.
DOCIMENmTION CHECKLIST PCR REVIEW OF CPSES ICC INSTIDENTATION SYSTEM 28 i
iv
1.0 INTRODUCTION
Sis report responds to the documentation requirements of NUREG-0737 Item II.F.2, " Instrumentation for Detection of Inadequate (bre (boling."
he report describes (1) the instrmentation system to be used at the Commche Peak Steam Electric Station (CPSES) for nonitoring of inadequate core cooling (IOC) conditons, (2) the status of implementa-tion of the system, md (3) the status of conformmce to the associated system requirements.
Functional design requirements of the ICC monitoring system me described in Section 2.0.
Section 3.0 provides a final design descrip-tion of the system instrumentation and its various functional emponents. Se methods in which the system will be applied for operator use at CPSES are briefly described in Section 4.0.
Se proposed system impleentation status is discussed in Section 5.0.
The status of conformmce to system description docmentation requirements is delineated in Section 6.0.
1
2 2.0 SYSTEM EU4CIIOtG
'Ihe principal function of the Inadequate Core Cooling (ICC) monitoring instrumentation system is to govide redundant capability to monitor the approach to, existence of and recovery from ICC. The system is designed to govide the reactor operator with clear, easy-to-interpret indications of reactor coolant inventory conditions during the various developnental stages of any transient event which gogresses slowly enough such that ICC can be avoided by operator intervention. 'Ihus, use of the system is limited gimarily to slow-transient mnditions similar to those postulated to occur in conjuncticn with a small break loss of coolant accident (IDCA). A small treak IOCA is considered to be my rupture of the reactor coolant system (RCS)2 pressure boundary havirg a total cross-sec'.onal area less than 6.0 in and causing reduction in Iressurizer liquid level and pressure beyond the restoration capacity of the normal diarging system.
2.1 Definition of ICC For purposes of discussion in this report, ICC is defined as a high-temperature condition anywhere within the active reactor core requiring operator action to restore cooling before core damage cccurs.
In accordance with 10CFR50.46(b)(1), an acceptable criterion for the inception of ICC is a calculated maximum fuel element cladding temperature in excess of 2200*F. Time allowance for decisive operator interaction to gevent ICC, in contrast to automatic actuation of Engineering Safeguard Features (ESF's), requires that the system transient mnditions fall within the typical range of limited consequences due to a snall break IDCA. 'Iherefore, the functional requirements of the ICC monitoring system @ ply Erimarily to small break IOCA events, with the added consideraticn that the system will survive more rapid transient conditions (i.e., a large break IDCA) in order to nonitor subsequent post-accident recovery.
Analyses described in Section 15.6 of the CPSES FSAR indicate that the calculated maximun fuel element claMing temperature for any postulated small break IOCA would not exceed 1800*F. 'Iherefore, it is not expected that a small bredc IOCA could lead to a condition of ICC sin multiple system failures would be required (e.g., loss of all high gessure safety injection in addition to the snall break IOCA). However, for purposes of ICC monitoring system design md evaluation, it has been assumed that functional requirements include the full sequence of conditions from the onset of a small break IOCA during rurmal reactor operation, through the gradual loss of coolant inventory, leadire to and causing ICC, to restoration of core cooling md subsequent coolant recirculation under stable, controlled conditions. The assumed successive stages in the gogression of an ICC event are defined in Table I.
3 TABIE I.
STAGES IN PROGRESSION OF ICC EVENT Coolant Stage Inventory ICC Bounding No.
Cbnditions Phase Description Condition 1
Decreasing Approach to Depressurization of ICS
, Occurrence of and loss of subcooling coolant satu-ration 2
Decreasing Approach to Increasing voids in Initiation of upper plentun; descreasing are mcovery two-phase mixture level above core 3
Decreasing Approach to Decreasing two-pham Minimtzn covery or Existence mixture level in core; of core of increasing core tempera-tures 4
Increasing Recovery frcxn Increasirg two-pham mix-Cmpletion of ture level 'in core; restora-core recovery tion of core coolirg 5
Increasing Recovery from Increasing two-phase mix-Vessel refilled ture level above core 6
Stable kcovery from (bolant inventory restored; Iong-term forced existence of stable, con-recirculation trolled conditions
l l
4 2.2 Functional Ibquirements
'Ib govide redundant monitoring capability over the entire range of conditions during an ICC event, the selected parmeters to be monitored at CPSES are the gimary ICS saturation margin (representative of the degree of subcooling), the " collapsed" water level in the reactor vessel upper head md plene regions (representative of RCS inventory), and the RCS temperature at various core exit locations (representative of cnre temperatures). At the onset of a snall break IOCA, an indication of reduced margin to saturation (loss of subcooling) will govide the earliest advmce warning of impending conditions which could leal to ICC. The resulting occurrence of saturation conditions will mark the end of Stage 1 (see Table I) and the beginning of Stge 2 in the event progression.
During Stage 2, voids will occur in the upper head md plenum regions due to continued loss of coolant mass. The corresponding reduction in collapsed water level in these regions will indicate the extent of coolmt loss and the trend of changes in coolant inventory prior to ptential core uncovery. If the event is allowed to gogress, core uncovery will occur (Stage 3).
We beginning of Stage 3 does not intnediately bnply the existence of ICC conditions. As the decreasing level of the two-phase steanV' water mixture (or froth region) falls below the top of the active core (just below the monitoring range of collapsed water level in the upper plenum), adequate core cooling will continue as long as the top of the froth region covers the top of the core. Overheating of the core will begin only when the froth region falls below the top of the core. Se extent of overheating will be indicated by the nonitored core exit temperatures. Analyses described in Ibf.1 lead to the conclusion that a core exit temperature reading of 1200*F is a satisfactory criterion for determining whether the threshold of impending ICC has been reached. 21s criterion is assmed to safely represent maximm fuel cladding tempratures 41ich are lower than the mininun criterion (2200*F) for the existence of ICC.
We beginning of Stage 4, the start of recovery from ICC, is marked by the change to a continuous increase in two-phase mixture level due to the addition of safety injection water. mis reversal in t!e trend of coolant inventory conditions will be irtiicated 61 a return from superheated to saturated or subcooled conditions and by a reduction in core exit temperatures. Complete reccuery of the core, l
the initiation of Stage 5, will be indicated by the restoration of monitored collapsed water level in the uppe plenum. When the collapsed water level reaches the maximm, correspanding to full restoration of reactor coolant inventory to the level re. mired for l
continuous recirculation, Stage 6 of the ICC event will begin. This l
final stage represents the sustained existence of stable, controlled reactor cooling conditions. After this stage is accmplished, all ICC nonitoring parameters should give contircus indication of these stable conditions.
5 3.0 INSMMNPATIN DI:SCRIPTIN The ICC monitoring system at CPSES employs two separate types of instru-mentation systems to monitor the paraneters discussed above. The Core Cboling 2nitor (Cm) instrtmentation system is designed to perform two functions. Output from this system pewides indication of the reactor coolant temperature at various core exit locations and also indicates the ICS saturation margin. The Heated Junction Thermomuple (HJTC) instru-maitation system is employed to nonitor the collapsed water level in the upper head and plenum regions of the reactor vessel. These instrinnentation systems me described below.
3.1 Cbre cooling 2nitor System Two gialified, redundant CIM's me used for ICC monitoring in each reactor unit at CPSES. Each CCM is designed to indicate core exit thermomuple temperatures (CET function) aid to nonitor the ICS saturation margin (SPN function).
3.1.1 (bre Exit 1hermocouples Tb provide input temperature data to the CCM microprocessor, the NSSS-supplied array of fifty Gr's have been divided into two aparate, redundant trains with each set of CET's having a distribution regrementative of all four gladrants of the reactor core exit rea. The planar locations of the CET's with respect to core fuel assembly position are illustrated in Fig.1. All CEr's are axially located just above the t%per Cbre Plate as illustrated in Fig.
2.
Also illustrated in Figs.1 and 2 are the relative locations of the HJIC Irobe assemblies and corresponding sensor positions, respectively, which are described later.
Each 3r is a Type K (chromel-altnel) thermocouple contained within an altainum-aride insulated, stainless steel sheathed cable (1/8-in. 00).
Each cable passes through one of four vessel head penetrations (located 90 degrees apart and near the core periphery) which contain pressure-boundary sealing assemblies. Figure 1 includes indication of the hem! penetration assigruents for the various thermomuple cables, separated into groups of either twelve or thirteen cables per penetration.
Above the vessel head, the CET cables are grouped into two separate trains. Each train is routed to a separate reference junction box which contains three platinum resistance temperature detectors (RTD's) for reference temperature measurements. These reference measurements permit the transition from chromel-alumel leads to copper conductors for signal transmission to the CCM microprocessor.
The GP signals are used in the (IM to monitor coolant temperatures over the entire range including normal operation conditions and extending to beyond accident extremes. The design input / output useful range limits and systen accuracy are listed Table II. Each tM---suple is periodi-cally chedted for open or shorted mnditions, aid the signal is adjusted to accotmt for the irmtainment cold reference junction conditions based on the reference RfD measurements. 1he highest, valid CEP signal is displayed on the Cbntrol Ibard and is also employed by the microprocessor to i
determine the ICS saturation margin.
6
\\5 270*
I I
2 3
4 6
7 8
9 10 ll 12 13 14 15 A
Tl T26 T2 A-4 B-4 B-4 8
C T27 T3 T28 T4 T29 T5 T30 A-4 B-4 B-4 A-4 A-4 A-l A-l g
T6 T31 T7 T32 T8 T33 T9 S-4 A-4 A-3 A-4 B-4 A-l 8-l F
T34 TIO T35 Til T36 Tl2 T37 G
B-3 8-3 A-3 8-1 0-1 B-l B-l 180* H gf3
{,8 <,
Tl4 T39 TIS T40 T16 T41 Tl7 a
B-3 A-3 A-3 B-3 B-3 A-l B-1 K
T42 TI8 T43 Tl9 T44 T2O T45 L
A-3 8-2 A-2 B-2 A-2 A-2 A-1
/ M T21 T46 T22 T47 T23 T48 T24 N
B-3 A-3 B-2 A-2 B-2 A-2 B-l l
P T49 T25 T50 R
A-2 8-2 8-2 90*
LEGEND T34.CET ID NO.
B-3 -HEAD PENETRATION ASSIGNMENT l
l h
HJTC PROBE 1
FIG. I CORE EXIT THERMOCOUPLE AND HEATED JUNCTION THERMOCOUPLE LOCATIONS (PLAN VIEW)
7 T
T
-MATING SURFACE V
y q UPPER HEAD REGION t
g UPPER SUPPORT PLATE 1
v//////////A-UPPER PLENUM REGION s
OUTLET +--
Y Y
INLET T
T T
T Mn_
t ewe a e a a n
- UPPER CORE PLATE CORE LEGEND:
V-HJTC SENSORS (8 PER TRAIN)
- -CORE EXIT THERMOCOUPLES (25 PER TRAIN)
FIG. 2 CORE EXIT THERMOCOUPLE AND HEATED JUNCTION THERMOCOUPLE LOCATIONS (ELEVATION VIEW)
8 TABIE II.
CORE COOLING MONITOR SIGNAL SPECIFICATION
SUMMARY
NO. PER RANGE PARAMETER TRAIN DESCRIPTION Input:
Coolant Pressure 1
0 - 1700 PSIG Pressurizer Pressure 1
1700 - 2500 PSIG Hot Ieg Temperature 2
50 - 695'F Cold Ieg Temperature 2
50 - 695'F Core Exit T/C Temperature 25 50 - 2300*F Cold Junction Temperature 3
50 - 500*F Output:
Saturation Margin 1
300*F Subcool to 300*F Superheat Highest Gore Exit T/C 1
50 - 2300*F Signal Data Sets 2
Engineering Units System:
Accuracy
+2.5*F Resolution 0.1*F y,
y---,s-+,-n
+
-,my--.,,
,-m
.---,-,,_,,p.
--om-
,., + ---~
i 9
3.1. 2.
Saturation Margin mnitor In addition to the highest CET temperature, the SH function of the CD4 l
makes use of various other ICS measurements for which signal flow paths are j
indicated in Figures 3 and 4.
Also indicated in Figures 3 and 4 are the signal flow paths frcm the HJIC instruments described later. Redundant, diverse temperature measurements are provided by RfD's located such that each SMM train employs the hot or cold leg RCS temperature frcm each of the four reactor coolant loops. As illustrated in Fig. 3, Train A employs the hot leg temperatures frc n Icops 1 and 2 and the cold leg temperatures fram Icops 3 and 4; Train B employs the cold leg temperatures from Icops 1 and 2 and the hot leg temperatures frcxn Icops 3 and 4.
Also employed are the hot leg BCS wide-range pressure measurements (Icop 1 for Train A and Icop 4 for Train B) and redundant narrow-range pressurizer pressure measurement >
Wese temperature and gessure measurements are used in conjunction wie s stored steam-table algorithu to compute the saturation margin.
(bnservatively,.the amputation is based upon the highest valid BCS temperature and the lowest valid RCS pressure. Sus, under normal operating subcooled conditions, the SMll output signal represents the minimum possible margin to saturation.
In the event of depressurizatim due to a small break IOCA, this output signal will provide the earliest indication of the existence of saturation conditions.
3.2 Heated Junction termocouple System
'Ib provide redundant capability for measurement of the reactor coolant inventory in the upper head and plenum regions of the reactor vessel, CPSES is in the process of installing a Heated Junction Thermocouple (HJIC) system supplied by Combustion Ehgineering, Inc. (C-E). Functionally, this system represents a selected alternative to the cmmonly-referenced Reactor Vessel Ievel Indicating System (RVLIS). It is also synonymous to the mmetimes referenced Reactor Vessel Ievel 2nitoring System (RVIMS). The principal function of the HJrC system is to obtain m unambigtous, direct indication of the existence of coolant voids (and hence an indication of reduced RCS coolant inventory) in the vessel space above the reactor core. h e HJIC measurements will assist in the timely detection of the approach to ICC and subsequent restoration of optimal core cooling in the event that an ICC condition should occur.
We basic measuring device of the HJIC system is a gobe assembly consisting of a ntsnber of thermocouple sensors with individual splash shields distributed axially at elected locations inside a mparator tube. We purpose of the separator tube is to create a single-phase collapsed water level inside the tube while a steam-water two-@ase mixture may exist in the surrounding mediun outside the tube. Each sensor consists of two chromel-altanel thermocouple junctions positioned approximately 4.5 inches apart, the lower one of which is heated by an inconel electric coil. Figure 5 illustrates the electrical arrangement of an HJ10 sensor. We principle of measurement corresponds to the temperature differential between the heated md tnheated thernocouple junctions as affected by the heat transfer characteristics of the sensor-inmersion medium inside the separator tube.
In a normal operating state where the sensor is innersed in a subcooled liquid medium (water), the temperature difference is quite small ( ul00*F) due to the relatively high heat transfer capability of water. However, when the collapsed water level falls below the heated junction, the reduced heat transfer capability of the surrounding medium (containing steam) causes the
.e 10 INSOE t
TRAIN A CONTAMENT **-j i
s l HJTC-A(8) f
- CET-A(25)
,x j
Tee-A y
Tcs-A
.* Tua.A lPncs-A j
}
l S C j
. - Przn-A 3
2 s
R3 RCP 3
4
- r pgp
-j s e 1 j
S G i
A.
~
. s -
INSDE TRAIN B CONTA4N e
, ::JTC-g(8) l
.j
{-Tn4 3 27-9(25) 1 3
)
Tns-g TC2-B
{."a 8
{ SG J
S S j
- -Przn-8 3
2 l
l l
3 2
REACTOR f
f VESSEL
^
RCP RCP 4
?
92R N
S 9 S G s
N.
4 x
'l m
l FIG. 3 ICC MONITORING SYSTEM SENSOR LOCATIONS l
s I
y
,,-----r,
.-,,,,,-,,-----,,w--
n-,v,,.., -.. - - -, - -, - _, - - -,,,, ~, - -,, - - -,
-,,,,n-,
l g______q I
l
-*OUTSIDE HEATER I [
l CONTAINMENT
]
CONTROLLER r
i I
HJTC l
i_
l HJTC-A (8)
MICROPROCESSOR HJTC 3l i
LED CET-A (25) l
- (TRAIN A )
i yl 1
TC4 - A l
I_
l Tc3-A l'_
l TH2-A l
~
i THi-A l
I
-l 4
i#
I PRCS-A l
I l
o y
o I
PPZR-A SYSTEM
% LEVEL ERF COMPUTER FAILURE
/TMAX (SIGNAL DATA)
I I
I ALARM DISPLAY I
I i
i I
CCM i
)
i TSAT l C
=
l
('F)
I i
i 1
I CCM I
I i
MICROPROCESSOR I
I
=
l
( TRAIN A )
8
=
l I
l g
I
=
I i
l l
=
]
CCM i
]
g
=
CET l
4 I
('FMAX) l-o o
y SYSTEM PLANT PROC. ERF I
I
]
l FAILURE COMPUTER COMPUTER l
ALARM (SIGNAL (TSAT/
CONTROL BOARD j
DATA)
SIGNAL DATA)
DISPLAYS i
1 t
FIG. 4 ICC MONITORING SYSTEM TRAIN A SIGNAL i
r PROCESSING AND DISPLAYS (TRAIN B SIMILAR) i 1
12 INCONEL COPPER CHROMEL
, ALUMEL ALUMEL B
CHROMEL l
l COPPER V(A-8) = T (UNHEATED JUNCTION)
V(C-B) = T (HEATED JUNCTION)
V(A-C)= oT FIG.5 HJTC SENSOR ELECTRICAL DIAGRAM
i.
13 temperature at the bottan of the sensor to rise, producing a mch larger temperature difference (as much as mveral hundred degrees). R us, the~
measured temperature difference, AT, provides direct indication of the presence of water voids in the sensor-innersion meditan. Changes in reactor coolat inventory above the reactor core can be monitored based on results obtained from the local,' direct measurements by different sensors within the probe assembly.
In addition to the thermocouple differential temperature, the system design output information provides separately the unheated juncticn temperature, i
indicative of the local reactor coolant temperature, and the heated junction temperature which is used for control of power to the heater coil.
]
As illustrated in Figures 3 and 4, the output signals from each IUIC sensor are transnitted by a five-wire cable (two chranel plus one altanel l
thermocouple ed two copper heater power wires) leading from the gobe assenbly to microprocessor-based control equipnent located.in the Control Ecom. (blel junction compensation ed malog-to-digital conversion are performed on the thermocouple signals. In addition to the heated junction, unheated junction and differential' temperatures, the microprocessor output signals include the heater controller setpoint (regulating sener sensitivity), the auctioneered highest reactor coolant temperature in the i
upper head region, and the computed reactor coolant inventories (% level) in the upper hem and plenum regions. Also included me separate condition status signals indicating whether ead sensor is covered (in a liquid j
medium) or is uncovered (in a vapor medium). Rese data se J1 transmitted in full duplex digital form to the CPSES anergency Response F Tility (ERF) computer system via a serial, asynchronous fiber optic data. ink. In addition, the latter signals are transnitted separately to a series of Light Bnitting Diodes (LED's) contained in a (bntrol Board display module to give continous indication to reactor operators regarding the water-covery status I
of each sensor. Also, available for auxiliary system use me malog output signals to indicate percentage water levels in the upper head and plenum regions and an associated Control Baard annunciator alarm signal.
Se' HJIC system includes two identical probe assemblies (forming separate 4
Trains A and B) located 180* apart md near the reactor core periphery, each in the proximity of the cold leg inlets, illustrated in Fig.1. Se HJIC probe assemblies are designed to be rugged structural msnbers in the reactor t
vessel, such that their structural integrity is not threatened by transient conditions considered in the structural design of reactor vessel internals, Likewise, the probe assemblies are designed to cause negligible impact upon the thermal-hydraulic daracteristics of the reactor system. Each gobe is housed in a stainless steel structure which is designed to provide adequate gobe support and to gotect the gobe unsors from danaJ ng effects due to i
i flow induced loads.
As indicated in Fig. 2, each probe assembly contains eight sensors functionally separated into two sections a) that two sensors are located in l
the typer head region (above the Upper Support Plate), and six sensors are located in the upper plenum region (between the Upper Core Plate and the Upper Support Plate). B is " split-probe" design was selected because of i.
the limited hydraulic transport between the upper pleum and head regions.
tus, changes in coolant inventory within the two regions can be detected 4
separately and independently.
4 m~
,_-.,__-._.,,______._.,m._,
- _7_,
N A'u
'pu 1m y.
14 Wis design also minimizes effects of differences in static pressure between the upper head md plenum regions which depend upon the status of Peactor (bolant Pump (RCP) operation. Due to the relatively snall coolant flow in the upper head region of the reactor vessel, FCP operation will have to significant effect upon the two-phase resa3nse in this region. Therefore, the HJIC measurenent in the upper head region is expected to be the same regardless of whether or not the PCP's are running.
In the upper plenum region, however, static gessure differences caused by the forced circulation due to PCP operation can reduce the capability of the separator tube to create a representative single-phase collapsed water level. With the FCP's running, the HJ7C measurenent in the upper plenum region may tend to mderestimate the reactor coolant inventory since the static pressure in the upper portion of this regicn (just below the Upper Support Plate) is exp3cted to be greater than that in the lower prtion (just above the Upper Care Plate). Wus, operatim procedures will require that the HJIC upper plenum measurements be disregarded until all FCP's are tripped during a snall break wCA.
We axial locations (relative to the heated thermocouple junctions) of the HJIC sensors within each probe assembly were selected to optimize the instrument capability to provide useful information to the operator regarding changes in reactor ccolant inventory. %e top sensor is located as high as practicable in the gaper head region (approximately 49 in. above the vessel head matirg surface). Uncovery of this senscc will prwide the operator with early indication of the beginning of reduction of coolant inventory in the upper head region.
We second sensor in the upper head region is located just above (approxi-mately 0.25 in.) the vessel head matire surface. Eis surface marks tre top of the orifice holes around the periphery of the downcomer mnulus sich allows coolant t ansprt between the upper head regicn and the core-inlet region in the lower plenun of the reactor vessel. Berefore, uncovery of the second sensor would effectively indicate loss of the canplete coolant inventory in the upper head region available for reactor core cooling.
We remaining six sensors are located in the upper plenun region to prwide more detailed information regarding changes in oJolant inventory Wich have a direct effect upon core cooliry. One sensor is located as high as practicable (approximately 4.5 in. below the Upper Support Plate). Uncovery of this sensor would provide early irdication that the approach to ICC has begun due to loss of coolant inventory in the upper plenum region.
Wree sensors are located axially proximate to the reactor vessel hot leg, at levels correspanding to the top, middle, and bottom (61, 47, and 33 in.,
respectively, abwe the Upper Core Plate). These sensors are intendM to govide the operator with more detailed information during approach to ICC when the rate of loss in coolant inventory may change rapidly. Unewery of the sensor Eroximate to the top of the hot leg wauld indicate the impending loss of natural reactor coolant circulation. Subsequent uncovery of the middle and bottom sensors in the tot leg region would indicate the approach of corditions in which no nore coolant will drain fran reactor coolant
15 piping into the vessel, after which the rate of approach to ICC may increase significantly.
'lo govide maximum continuity of information during the final stages of the approach to ICC, the lower two sensors in the upper plens region are located at approximately equal axial intervals in the space between the bottcm of the hot leg and the Upper (bre Plate. The higher sensor is positioned 11 in. below the hot leg md 22 in. abwe the Upper (bre Plate.
Se lower sensor is located as clom as practicable to the top of the core (22 in. below the hot leg and 11 in, above the Upper 03re Plate). Chccvery of this bottcm sensor would indicate that the approach to IO' has proceeded to the point that core uncovery is inminent. Subsequent ICC monitoring prior to refilling of the upper plenun region must rely upon output signals from the CCM as discussed geviously.
%e HJIC probe design has undergone extensive tests performed by C-E to demonstrate its capability to perform its intended function. Proof of principle testing of the thermocouple sensar respanm is described in Ref.
2.
Wis initial series of tests (Phase I) demonstrated the ability of the probe assembly to create and measure m effective collapsed water level in a two-@ase mixture. A second series of tests (Phase II), described in Ief.
3, was performed to exanine probe assembly behavior under fluid conditions similar to thom mticipated to exist in a IWR during stealy-state operations and during transients. %ese tests demonstrated that the probe assembly is capable of measuring coolant inventory in a reactor vessel. A final series of testing (Phase III) was performed to ex:mine werall HJ1C system response mder simulated single-@am md two-phase fluid conditions representative of those to which the probe assembly might be exp3 sed during a loss-of-coolant inventory event in a IWR vessel (Ref. 4). Dese tests verified capability of the HJTC systen to measure and display coolant inventory abwe the reactor oore, thus indicating the status md trend of inventory changes during m accident.
Further information regarding the design of the HJIC system and its application as part of an ICC monitoring system may be founci in Refs. 5 and 6.
Use of the HJIC system in Westinghouse designed reactors, such as CPSES, is described in Bef. 7.
Specific applications of the design concepts, and necessary reactor vessel nodifications, described in Ref. 7 have been performed at CPSES with cooperative interface support by C-E and W.
- 3. 3 Instrmentation Displays md Alarms As indicated in Fig. 4, the ICC monitoring system instrmentation includes three displays (for each mparate train) located cn the ICS portion of the (bntrol Board to continuously provide the reactor operator with clear, easy-to-interpret visual indication of reactor care caoling conditions.
%ese include CCM output analog meters to indicate the highest core exit temperature md the BCS saturation margin md a eries of IED's located close by to indicate the condition (covered or uncovered) of each HJIC sensor. We design and location of these qualified, dedicated displays have undergone hunan-factors malysis as part of the CPSES Control accm design review performed in resp 3nm to requirements of NUREG-0700. Use of these displays will not be inhibited by the actuation of other systen alarms during m emergency.
In addition to the dedicated Control Ibard displays, the (IN and HJIC instrunentation systems include, or provide for, other supplenentary types
16 of system information displays and system alarms. Wese various ICC monitoring system displays and alarms are described below.
3.3.1 Core Cooling Monitor System The CM microprocessor provides CEP and SMM output temperature signals in engineerirg units which are indicated by the side-by-side meters illustrated in Fig.
6.
Each meter covers the entire functional range of the correspnding instrument measurment. @e CET measurement (left-side meter) provides the maximum valid core exit temperature on a scale of 0-2300*F (50 degree minimm scale interval). Se SMM measurement (right-side meter) indicates the computed RCS saturation margin on a scale ranging from 300*F subcooled, to saturation (0*F), to 300*F superheated (10 degree minimum scale interval). During rormal reactor operations, each 004 meter indicator can be expected to always remain in the bottom-half portion of the scale, giving redundant indication of Mequate core cooling (i.e. CET readings significantly below the threshold for impending ICC and SMM readings well within the subcooling region). However, in the event of an mcident causing m approach to ICC conditions, the SMM readirg would rim to mid-scalc (0*F indicating saturation) or above (indicating the margin away from saturation in the superheated region). Subsequently, the CET reading would also rise (at a slower rate). As discussed geviously in Section 2.1, the threshold of impending ICC is considered to be a CEr reading of 1200*F. Since the monitored CEr reading represents the maximum neasured core exit temperature, it can be expected that adequate core cooling would exist as long as the CET ~
reading cbes not rise well into the top-half portion of the CEr scale.
In addition to the CET and SMM analog meters, the C04 provides capability for other supplementary information displays. As indicated in Fig. 4 and discussed later, the CC4 microprocessor transmits all input signal data, plus the computed saturation margin and the 021 instrument status, to the ERF cmputer, 2ese data are sent in engineering units as a continual, digital data stream at one-second intervals. Use of these data by the ERP cmputer includes the capability to cbtain on demand a readout of the CET temperatures as well as the computed saturation margin md the grameters used for its determination. Similarily, all input signal data are also tranmitted to the Plant Process computer. Bis cntpater govides capability to obtain on demand a hard-copy, spatially-oriented core map which indicates the measured temperature at each CEr location (see Fig.1).
A further display capability is provided by the CCM, whereby a fully-isolated instrument service p)rt can be used as an optional data-service connector.
If desired, a standard RS-232 ASCII cmputer terminal can be attached to this port. He output data received include all CET measurements and are formatted ard in ergineering units, similar to those tran s itted to the ERP computer. It can be seen in Fig.1 that the CET measurements in each train include nore than four thermocouples per wre qua$ rant. Due to this display capability in addition to that govided by the ERF computer system (discussed further below), no bac$ cup display is included to govide selective reading of CEr temperatures.
3.3.2 Heated Junction % ermocouple System As indicated in Fig. 4, the HJIC microprocessor output includes a set of sensor signals which control a series of LED indicators on the Control Board. Se LED's for both instrument trains are arranged in a display
17 n-2300 300
=
=.
2000
=
s 7
U Z
200 P
E T
R H
=
1 E
100
[
1500 T
T
=
D :
D
=
E E
O
=
G g
+
G 1000
~
F F
{
g l 00 U
=
B C-500 C
=
O 200
=_
O
=.
L
=
=~
=
O
~-300 CORE EXIT RCS TEMP SAT MARGIN l
l FIG. 6 CORE COOLING MONITOR SYSTEM TRAIN A CONTROL BOARD DISPLAYS (TRAIN 8 SIMILAR) r
18 n
'e'
'e:
1 L
I OAAEA SUAAQAT PLATE I
/
/
\\
/
\\ /
/
1
%g g
/ %
e w
w I
CORE
[
FIG.7 HEATED JUNCTION THERMOCOUPLE SYSTEM CONTROL BOARD DISPLAY ( TRAIN A & B)
19 module illustrated in Fig. 7.
We systen is designed such that the LED for each HJIC Eensor is on (red shining light) as long as the sensor is covered (i.e., innersed in a water medium). An uncovered sensor (representative of a surrounding void or vapor medium) is indicated when the corresponding LED is off. As the LED's turn off durig an approach to ICC coMitions, the display module clearly indicates the gogression of IUIC sensors becoming uncovered (i.e., the reduction in collapsed water level) in either of the upper head or p'len s regions.
In addition to the 02ntrol Board display nodule, the HJIC system includes other supplementary displays. We system electronics cabinet located in the (bntrol Ibom has transparent doors to allow visual observation of a digital readout module nounted on the microprocessor chassis. his module gives a demand readout of either computed percent coolant level or maximum coolant temperature.
3.3.3 System Failure Alarms As indicated ir Fig. 4, both the CCM and HJIC system microprocessors govide output alarms.o inform the reactor operator that a system failure has occurred. Each of these system failure alarms may be triggered by any of several types of failures including a defective sensor, signal-transnission device or micropxx:essor component. Failure alarms are discussed further in Section 3.5.
Both system microprocessors include output capability to actuate mnunciator alarms based on setpoint signal levels representirg the measured variables.
However, these alarm signals are not Iresently intended to be used, since the function of the ICC instrumentaticn will be to provide monitoring capability to the reactor operators.
3.4 Computer Functions In resInnse to requirements of NUREG-0696, CPSES is in the process of implementing an integrated, highly-reliable computer system as part of the Dnergency Besponse Facility (ERF). 21s system is designed to govide greater than 99 percent availability during normal reactor operations and during plant cooldown. Se EF ccxnputer system will be used to govide plant-status information to the Control Boom, Technical Support Center, aM Bnergency Operations Facility. Se system hardware includes dual PRIME 750 conputers, data acquisition system (DAS) equipnent, m integrated Terminal (bncentrator, and a ntsnber of high-resolution, human factor designed, color graphic display units. me DAS can process as many as 400 analcg and 600 digital data signals.
Part of the incoming data to the ERP computer system will include the CDs and HJIC system microprocessor output data, as indicated in Fig. 4.
The data transmitted from the CEM will include all CET measured temperatures, highest CET temperature, BCS pressure and pressurizer pressures, hot and cold leg RID temperatures, computed saturation margin md CD4 system status information. Se data provided by the HJIC system will include all heated and mhested thernoccuple temperatures, differential temperatures, sensor statuses, computed percent primary coolant level (inventory), highest thermocouple temperature md HJIC system status information. All incoming data are stored in a data bam which can be accessed for dispay of selected values.
20
. A portion of the ERP ccuputer system software is identified as the Safety Parameter Display System (SPDS). Bis system is designed to govide variable output denand displays on the color graphic display screens to inform the reactor operator of the numerous operational paranaters related to plant safety. Generally, the SPDS will indicate nuneric values and bar-graph representations (updated at 1-second intervals) and time-dependent trend values (based on 30-minute operating trends with updates at 6-semnd intervals). Se Cbre (boling trend information display will include the highest CET temperature, computed lowest saturation margin and HJTC-indicated minimma percent water level. Sese data will also be available, along with the RCP operational statuses, in the ICC monitoring display which is part of the Accident Indication Detection System (AIDS) portion of the SPDS. B is portion of the SPDS receives updates at 1-second intervals.
Se Control Ibom includes three screens where SPDS displays may be viewed.
Wo color graphic display units are part of the Supervisor Console. A third
" slave" CIE unit is located en the main (bntrol Board very ner to the dedicated ICC monitoring displays described previously.
Se ERF computer hardware and associated DAS are installed and operational.
Installation of the hardware equipnent, including train isolation devices, connecting the (IM to the system is complete. Developnent of the associated software for processing C(X data is scheduled for completion by Agil 1984.
E7FC system equipnent mr.,nents, ed. associated isolation devices, connecting to the ERP cxmputer system have not been ccupletely installed.
he schedule for complete installation and implementation of the HJIC system is discussed-in Section 5.0.
In addition to the newly-developed ERF computer system, the original Plant Process conputer will also provide useful output in response to ICC instranentation measurements. Bis tmit is a W P2500 computing system with hard-mpy printout hardware. All output signaTs frun the cot will also be transmitted to this computer. Part of the hard-mpy gintout from this system available on demand will include a spatially-oriented-core map
. illustrating all CEr temperature measurements and also corresponding temperature differences (i.e., average cold leg temperature subtracted from CET temperature).
3.5 Equipnent Qualification I
l To the extent feasible, the C01 and HJIC systems to be used for ICC monitoring at CPSES will be qualified, Class 1E systems. Se statuses of component qualification of these systems are described below.
3.5.1 Core (boling Monitoring Systen The 004 system components have been upgraded to be fully qualified for the design-basis post-accident envirorsnent, with one exception. This exception concerns only the theuimouple assemblies inside the reactor vessel. Se CET sensors themselves are the original thermocouples provided by the reactor vendor (W). Although them original sensors are not fully qualified, considerable redundancy exists due to the total number of sensors and their spatial distribution. 'Ib upgrade the system to the extent
. feasible, the CET data transmission components (including all cables and connectors, junction boxes, and containment penetrations) leading from the reactor vessel to ed including the dedicated Cbntrol Board displays have
21 been replaced with fully qualified equipnent. The CEr cables between the reactor vessel md the cold reference junction boxes have been replaced with fully qualified stainless-steel jacketed, mineral-insulated cable assemblies. We organic cable assemblies extending from the cold reference junction boxes to the control rom microprocessors and displays are also fully qualified.
We CCM system consists of two fully redundant trains from the ICS sensors through the dedicated displays. We two trains are fully independent and are energized by separate Class 1E pwer murces. Rysical separation, in accordance with Pegulatory Guide 1.?5, is maintained throughout the systan with the necessary exception of the upper head region of the reactor vessel.
Due to retrofit limitations and the need for repre.sentative distribution of each train of sensors into the areas of all four core exit $adrants, cables frm both trains nust share four vessel head penetrations (see Fig.1).
However, even within the passage through a head penetration, considerable separation exists due to the stainless-steel jacket of each separate mineral-insulated cable.
Above the reactor vessel, the CEr cables are bundled into mparate trains.
Complete train separation is achieved at the missle shield and is maintained through the C04 microprocessor and to the dedicated Cbntrol Ibard displays.
Qualified devices provide isolation in the data link between tM C04 trains and the ERF computer.
We C04 system microprocessors are mounted in cabinets located in an area of the Control Rom which is fully accessible for maintenance during normal operating md past-accident conditions. We cabinets md system electronics components are fully qualified for the Control Roan environment and for conditions during md following a Safe 91utdown Earthquake (SSE). We system has been installed and is ready for operation during normal operatirg and post-accident conditions. Ib further qualification gograms are planned for this system.
Multiple methods are available for checking the operational availability of each train of the CCM system. Various checking functions are autcmatically performed periodically by the microprocessors. A power failure or inability to activate a dead-man timer will trigger a systen status alarm. All input signals are checked for validity by automatic comparison with extreme paranetric range limits. Any sensor signals failing this test are flagged and excluded from pssible use in the saturation margin computation.
AltMugh not represented by the dedicated Control Board displays, such failed data are retained and pssed through the data stream to the ERF conputer. We occurrence of such sensor failure alm triggers an alarm. If for mme reason the saturation margin computation can not be performed (e.g., in the unlikely event of failure of all required input sensor signals of a given category), a system failure alarm is triggered.
Due to the designed checking functions of the C04 system, the existence of fully redundant dual trains of the system, and the diverse distributions of multiple sensors within each train, no single failure within the system can render the entire system incapable of performing its intended function.
Should a system failure lead to mor.itoring anbiguity or uncertainty regarding train availability, design test voltages simulating input sensor signals can be quickly accessed and applied, via a data / service port, to determine operability of each train. We microprocessor mftware includes a monitor procran to permit full functional testing. With the designed interval testing capabilities and the use of a conmon crnputer terminal
t (CRP), all processed signals can be monitored and reliable testing of the system can be performed to identify failed omnponents md make necessary l
replacements or adjustments.
A defective channel can administratively be removed from service by either i
of two methods. %e signal input wiring can simply be disconnected or, by connecting a CRP to the data / service port and using the internal monitoring i
E progran, selected signals may be deleted fran the data scan.
l l
3.S.2 Heated Junction termocouple System he HJIC system being installed at CPSES will also be a seismically and environmentally qualified, Class 1E system. %e system aanponents gocured from C-E are fully qualified according to the program described in Ref. 8.
Presently, these conponents include the IUIC gobe assenblies, the i
associated pressure-boundary equipaent extending fran the reactor vessel, and the system microprocessor and display equipnent. % e then. c,uple i
sensor data transnission cable assemblies extending fran the HJIC probe connectors'(at the reactor vessel gessure boundary) to and including the contairunent penetrations are currently in the procurement stage. However, these components will also be fully qualified for the harsh post-accident environnent. When system procurement and installation is canplete, all associated couponents, from the HJIC sensors to and including the dedicated display module, will be fully qualified.
%e IUIC system contains two identical and fully-redundant trains. As i
indicated in Figs.1 and 2, the two identical probe assemblies, each containing eight sensors, are located 180 degrees apart near the reactor core petiphery. Similar shysical separation of the two trains is maintained from the gobe assemblies to the separate microprocessors, ed to the dedicated (bntrol Board display. Qualified fiber optic cables provide train j
isolation in the data link between the microprocessors and the ERF computer.
%ese isolation devi'ces are accessible for maintenance during normal i
operations and post-accident conditions.
f he HJIC microprocessors are mounted in a two-bay cabinet located in an easily accessible area of the (bntrol Room. Qualified separation in the cabinet is provided by a steel barrier between the two bays. Each train is powered by a fully independent and separate Class 1E power s)urce.
Electronic maintenance on the cabinet contents can be performed during normal operating or post-accident conditions. %e cabinet and system electronics couponents are fully qualified for the (bntrol Boan environ-ment and for seismic conditions during and following an SSE.
During operations, the HJIC system will undergo periodic tests and
. calibration. System maintenance gocedures include a complete channel calibration cycle to be performed monthly.
In addition to periodic system checks, the operator can assess operability by performing cross-channel i
chedts in the event that an anbiguous indication should occur. Also, I
' operational availability is automatically checked by the microprocessor
+
itself. %e electronics circuitry of the microprocessor employs a " flying capacitor" technique to cbtain optimun isolation of the input signals. Ib single conponent failure will render the entire systen inoperative.
If a sensor thhh, couple should fail causing m open circuit, a full-scale capacitor input voltage will result, and a fault condition will be detected
,,, -,, _ _ _. _.. _. _. _ _,.. _.. ~. _, _. _.. _ _. _.. _. _ _.. - _ _ _ _ _ _ _ _, _ _ _, _
+
23 causing a failure alarm. Such a failure will be determined by an extrane differential temperature output ( AT) and will cause the failed sensor to be excluded fran future use.
If a sensor heater should break, an snormally low AT fault condition will result and cause an alarm. Such a heater failure will exclude subsequent use of the sensor for indicating reactor coolant inventory, but the sensor will continue to measure local coolant tenperature. A heater failure will, however, cause temporary loss of three additional sensors since the heater power circuits in eadi probe assembly feed groups of four heaters connected in series. Such a failure can be corrected at the microprocessor to restore use of the three non-defective heaters. Continuity chedcs em quidcly identify the failed heater. '1he other three heaters can be easily restored to use by a simple change in wiring termination at the microprocessor. The end result of a single heater failure, which is unlikely to occur, is to lose.the capability of one sensor in one channel to indicate sensor covery or LECovery.
{
3.5.3 Criteria and Standards
'Ibe ICC monitoring system equipment described above has been, or is being, procured, mmufactured and installed in accordance with the quality assurance criteria and qualification standards listed below.
10CFR50 Apperrlix B, " Quality Assurance Criteria for Nuclear Ibwer Power Plants and Fuel Processing Plants" l
ANSI N45.2-1971, " Quality Assurance Program lhquirements for Nuclear Facilities" ANSI N45.2.9-1973, " Requirements for (bilection, Storage, and Maintenance of Quality. Assurance Records for Nuclear Power Plants" AtEI N45.2.11-1973, " Quality Assurance Requirements for the Design of Nuclear Power Plants" ANSI N45.2.13-1973, 02ality Assurance Requirements for (bntrol of Procurement of Items and Services for Nuclear Power Plants" NURECA588, Rev.1 " Interim Staff Position on Ehvironmental Qualifi-cation of Safety-Belated Electrical Equipnent" IEEE Std. 323-1974, "IEEE Standard for Qualifying Class 1E Etjuipnent for Nuclear Power Generating Stations" IEEE Std. 344-1975, "IEEE Reccamended Practices for Seismic Qualification of Class 1E Ekluipnent for Nuclear Ibwer Generating Stations" IEEE Std. 381-1977, "IEEE Standard Criteria for Type Tests of Class 1E Modules used in Nuclear Power Generating Stations" IEEE Std. 383-1974, "IEEE Standard for Type Test of Class 1E Electrical Cables, Field Splices and (bnnections for Nuclear Power Generating Stations" IEEE Std. 384-1977, "IEEE Standard Criteria for Independence of Class 1E Equipnent and Circuits"
24 4.0 SYSTEM APPLICATION The CPSES emergency gocedure, identified as FRC-0.1, "Ibsponse to -
Inadequate Cbre Cooling," is based on the HP-Basic version of the generic Westinghouse Owners Group Bnergency Ibsponse Guideline (ERG), FR-C.1.
Se intent of this generic guideline is to prwide systematic methods for restoring adequate core cooling md minimizing possible core damage in the event that ICC conditions should occur.
If ICC conditions are suspected, e.g., due to an indicated Icss of subcooling (reduced saturation margin), the initial operator action is to attempt to govide high-head safety injection (SI). If this attempt is successful, the operator is instructed to return to the energency procedure in effect when containment monitored conditions, CET temperature readings, and monitored secondary system conditions are normal.
If some source of high gessure water for SI cannot be ma$e available, the operator is instructed to reduce primary system pressure by depressurizing the mcondary system. Initially, this action will provide acctznulator injection to accmplish core recwery and then allow the low-head SI to govide long term core cooling. If depressurization of the gimary system cannot be accomplished in this manner arrl if CET temperatures exceeu 1200*F, the operator is instructed to depressurize the ICS using all available ICS vent paths. When the steps to Prc'cedure FRC 0.1 are successfully cmpleted, the operator will then return to the EG in effect to mnplete cooldcNn of the plant.
We generic ERG's assume the availability of RVLIS measurements, using the W system, in addition to CEr temperatures, to indicate ICC conditions. As described geviously, the HJIC system cbtained from C-E is being installed at CPSES to perform the RVLIS function, i.e., to indicate reactor water level. Due to differences in ginciple, some revisions to the plant-specific sergency Procedure FRC-0.1 are required to implement the HJIC system for indicating the approach to ICC. Rese revisions will be defined and incorporated when the HJTC system is empletely installed and made operational. Incorporation of these revisions will be accmplished in accordance with ODA-204, " Preparation of Bnergency Besponse Guidelines."
As noted above, CEF temperatures are employed bf reactor operators to diagnose the existence of ICC and determine appropriate respons actions.
Although the CEF measurements will continuously be recorded and displayed during all plant operations, they will will not be used regularly to affect operator actions during rormal reactor operations.
25 he use of CET's has been integratal into reactor operator training associated with the following classroom topics:
1.
CPSES Nuclear Systems, including the Incore Instrumentation System, Reactor Vessel md Internals, md Plant (bmputer 2.
Procedure Review, including Bnergency Procedures and Abnormal Procedures 3.
Transient md Accident Analysis, including Natural Circulation 4.
Mitigating (bre Danage In addition, the use of CET's has been incorporated into operator control Iban walkthroughs and simulator training. When the anergency Operating Procedures are revised to incorporate use of the HJIC system for manitoring the approach to ICC, the operator training subjects listed above will also be revised accordingly. his training will be scheduled as appropriate in support of the HJIC system implementation.
We ICC equipnent canponents, including the 004 and HJIC systems, have been designed to be capable of independent testing of instrument channels.
During reactor operations after system implementation is canplete, periodic testing of instrunent channels will be performed. Developnent of the surveillance test Irocedures to perform these periodic tests will employ IEEE 338-1977 as a guideline.
1 26 520 SYSTD4 IMPLEMENTATION
%e CCM system, including the CE7f and SMM instrumentation, is installed and fully operational. The part of the ICC monitorire instrumentation not yet completely installed is the HJIC system.
We schedule for implementation of the HJIC system has been re-evaluated, and efforts are in gogress to expedite installation of this system. %e reactor vessel internal support structures for the HJIC probe assemblies have been installed in Unit 1.
During initial reactor operations, plug gauges (dumy probes) will be used temporarily to occupy the spaces into which the actual gobe assemblies will be installed later. %ese plug gauges are designe3 to provide pressure boundary seals identical to those given by the upper prtions of the probe assemblies.
We Erincipal prtions of the HJIC system which are rot yet available for installation are the necessary in-containment cable assemblies and the associated containment electrical penetrations. %ese items are in the procurement phase. %e containment electrical penetrations are scheduled for delivery in the first quarter of 1984; however, delivery of the in-containment cable assemblies is not feasible prior to the fourth quarter of 1984.- After delivery, installation of the cable assemblies, and the instrment probes, will require access to the reactor cavity and vessel head areas. Werefore, installation of the HJIC system in Unit 1 is scheduled to be cmpleted during the first CPSES refueling outage, at which time the system will be made operational.
Prior to implementation during the first refueling outage, the CPSES Bnergency Operating Procedures will be revised to incorporate use of the HJIC system. (brresponding training for reactor operators will be scheduled as appropriate and should have no effect upon the system implementation schedule.
27 6.0 SYSTEM DOCLMENIATION
'1he intent of this status report is to govide resEnnse to the documentation requirerrants of NUREG-0737 Item II.F.2, including the associated Attachnent 1 and Appendix B.
Table III provides a checklist to faciliate review of the subnitted documentation to determine compliance with itemized requirements for the CPSES plant-specific ICC monitoring system. In Table III, the
" reference" coltann identifies sections of this report, and/or appropriate listed references giving generic descriptions, which provide information pertinent to the carresponding respons item. The coltzm labeled
" deviations" indicates tether or not the associated item for the CPSES system is known to be significantly different fran the corresponding item for generically approved systems. Information govided in the column labeled " schedule" indicates either that documentation for the associated item is considered to be complete or the time (date or goject developement event) when response to the item is expected to have been canpleted by an additional submittal. Generally, the items not noted as complete are considered to require further doctznentatica continoent upon full implementation of the IUIC system.
-c
.y
28 TABIE III.
DOCtNENIATION CHECKLIST FOR REVIDi CF CPSES ICC INSTRIMENIATION SWIEM ITEM REFERENCE (S)
DEVIATIOtB SCHEDULE NUREG-0737 II.F.2 DOCLMENTATION RECUIRED:
1.
a.
Final design description of addi-Sec. 3.0 tional instruentation md displays Refs. 2-7 No Complete b.
Detailed description of existity instrmentation systems Sec. 3.1 No Complete c.
Description of empleted or planned Secs. 3.1, modifications 3.3-3.5 No
_ Complete 2.
Design analysis and evaluation of water inventory monitoring instrmentation ed Secs. 3.2, 3.3 test data to support Item 1 design Refs. 2-6 No Cmplete 3.
Description of tests (planned or com-pleted) for evaluation, qualification, and calibration of additional instru-Sees. 3.3, 3.5 mentation Befs. 2-6 No Cmplete 4.
Evaluation of c3nformance with NUREG-Sec. 6.0 0737 II.F.2 Attachment 1 and Appendix B Ref. 6 No Complete 5.
Description of cmputer functions associated with ICC monitoring Secs. 3.3, 3.4 No Complete 6.
Proposed schedule for installation, testing and calibration, and imple-mentation of new instrmentation or information displays Sees. 4.0, 5.0 No Complete 7.
Description of guidelines for use of ICC instrmentation and malyses Sec. 4.0 First used to develop them procedures Refs. 1, 5, 6 No Refueling 8.
Sumnary of operator instructions in current emergency procedures for ICC and description of modifications when final ICC monitoring system is imple-First mented Sec. 4.0 No Refueling 9.
Description md schedule for additional subnittals needed in support of final ICC system ad energency procedures Sec. 6.0 No Complete
/
29 TABIE III.
(Cbntinued)
ITEM REFERENCE (S)
DEVIATIONS SCHEIXLE NUREG-0737 II.F.2 ATTACHMENr 1 CRITERIA (CET'sl:
1.
Nunber and locations of CET's Sec. 3.1 No Canplete 2'.
a.
03re map availability for Secs. 3.1, indicating CEr temperatures 3.3, 3.4 No Canplete b.
Selective reading of CEP Secs. 3.1 temperatures 3.3, 3.4 No
_Canplete c.
Direct readout and hard-copf Secs. 3.1, of CET temperatures 3.3, 3.4 No Canplete d.
Availabilty of CET temperature time histories Sec. 3.4 No Complete e.
CET alarm system Sec. 3.3 No Canplete f.
Ihnne factor design of CET displays Secs. 3.3, 3.4 No Cm.plete 3.
Backup display of CET temperatures Secs. 3.3, 3.4 Yes Canplete 4.
a.
Use of CEP displays and alarms during normal and abnormal plant Secs. 3.3, conditions 3.4, 4.0 No Complete b.
Integration of CET use into emergency procedures Sec. 4.0 No Complete c.
Integration of CET use into operator training Sec. 4.0 No Complete d.
Effect of other alarms on CET use Sec. 3.3 No Complete 5.
Cbnformance of CET instrumenation to NUREG-0737 Appendix B Secs. 3. 5, 6.0 No Complete 6.
CET display channel per sources, independence and physical separation Sec. 3.5 No Complete 7.
Envirorsnental Qualification of CET Secs. 3.1, instrunentation 3.3-3.5 No (bmplete 8.
Availabilty of CET display channels Secs. 3.3-3.5 No Complete 9.
Quality Assurance provisions of CET instrunentation Sec. 3.5 No Complete
l
.W 30 TABIE III.
(Continued)
ITEM REFERENCE (S)
DEVIATIOtB SCHEDULE NUREG-4737 APPENDIX B CRITERIA (ICC INSTRLMENIATION):
1.
Environmental Qualification Sec. 3.5 No Cmplete 2.
Results of single ocuponent failure Sec. 3.5 No C m plete 3.
Class 1E power sources Sec. 3.5 No Complete 1
4.
Availability prior to an accident Sec. 3.5 No Complete 5.
Quality assurance requirements Sec. 3.5 No Cmplete 6.
Continuous indication displays Sees. 3.3,3.5 No Complete 7.
Recording of instrumentation outputs Sec. 3.4 No Cmplete 8.
Identification of displays Sec. 3.3 No Cbmplete
- - Channel isolation devices Secs. 3.4, 3.5 No Cmplete
- 10. Means for chedcing operational availability Secs. 3.4, 3.5 No Complete Secs. 3.4, 3.5 First
- 11. Servicing, testing, and calibration 4.0 No Refueling
- 12. 01annel removal from service Sec. 3.5 No Complete
- 13. Administrative control of access to setpoint adjustments, calibration and test points Sec. 3.5 No Complete
- 14. Minimization of anmalous indications Secs. 3.3, 3.4 No Cmplete
- 15. Response to existence of malfunctioning cmponents Sec. 3.5 No Complete
- 16. Sensor direct measurements Sec. 3.1 tb Cm plete
- 17. Application during rormal operations Secs. 3.3-3.5 First and accident conditions 4.0 No Ibfueling
- 18. Periodic testing of instrumentation First channels Sec. 4.0 Yes Befueling
--m._
,_....,,_,,_-me--._m_..
y-
/ p' 31 7.0 COtCIUSION Subject to completion of installation of the IUIC system md full implementation of this system in conjunction with the C04 system into the plant Bnergency Operating Procedures, it is concluded that all ICC monitoring instrtunentation requirements in respons to NURDG-0737 Item II.F.2 will be fulfilled for CPSES. 'Ihe combined ICC monitoring system, providing redundant measurements of ICS saturation margin, CEr temperatures, and rimary coolant inventory, will Irovide reactor operators with clear, t
easy-to-interpret indication of the approach to or existen of ICC conditions in a manner which is conducive to the maintenance or restoration of adequate core cooling so as to preclude or minimize reactor core danage in the event of a anall break IOCA.
a V
32 REFERENCES 1.
C. M. %ompson, et al., " Inadequate Core (boling Studies of Scenarios With Feedwater Available, Using the ICIRUMP Ccuputer Code,"
Westinghouse Electric (brporation, NCAP-9753, June 1980.
2.
" Heated Junction hermocouple Phase I Test Report," Cabustion Engineering, Inc., ON-185, S2pplement 1, Nwefber 1981.
3.
" Heated Junction %ermocouple Phase II Test Resort," Can%stion Engineering, Inc., CEN-185-P, Supplement 2-P, mvenber 1981.
4.
" Heated Junction %ermocouple Phase III Test Report," Cabustion Engineering, Inc., CEN-185-P, Supplement 3-P. September 1982.
5.-
" Evaluation of Instrumentation for Detection of Inadequate Core Cooling in Combustion Ehgineering Nuclear Steam Supply Sfstems", (bmbustion Engineering, inc., CEN-158-P, May 1981.
6.
R. L. Anderson, et al., " Inadequate (bre (boling Instrunentation Using Heated Junction termocouples for Reactor Vessel Ievel Measurement,"
Oak Ridge National Laboratory, ICREG/CR-2627 (ORNL/m-8268), March 1982.
7.
" Final Report to the Ad Hoc (banittee of Westinghouse Designed Plant Ownwers for Developing a HJIC System (bnceptual Installation Design,"
Combustion Ehgineering, Inc, G-NSPD-163, August 1981.
8.
" Qualification of Class IE Electrical Equipnent," Ccubustion Engineering, Inc., CENPD-255, Rev. 3, January 1982.
2