W3P83-0847, Forwards Description of Inadequate Core Cooling Instrumentation,Including Evaluation of Compliance W/ Specific Requirements of NUREG-0737,Item II.F.2,per Ser. Info Will Be Incorporated in Amend 32 to FSAR

Forwards Description of Inadequate Core Cooling Instrumentation,Including Evaluation of Compliance W/ Specific Requirements of NUREG-0737,Item II.F.2,per Ser. Info Will Be Incorporated in Amend 32 to FSAR

ML20072H361
Person / Time
Site:	Waterford
Issue date:	03/25/1983
From:	Maurin L LOUISIANA POWER & LIGHT CO.
To:	Knighton G Office of Nuclear Reactor Regulation
References
RTR-NUREG-0737, RTR-NUREG-737, TASK-2.F.2, TASK-TM W3P83-0847, W3P83-847, NUDOCS 8303290407
Download: ML20072H361 (35)

Text

9 4

/

4 I OUISIANA / 142 DELARONDE STREET POW E R & L1G H T/ P O BOX 6008

• NEW ORLEANS. LOUIStANA 70174 * (504) 366-2345

$ EON sysSEO L V. MAURIN Vice President Nuclear Operations March 25, 1983 W3P83-0847 3-A1.01.04 3-A19.09.09.02 Q-3-B55 Director of Nuclear Reactor Regulation Attention: Mr. G. Knighton, Chief Licensing Branch No. 3 Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C.

20555

SUBJECT:

Waterford SES Unit 3 Docket No. 50-382 NUREG-0737, Item II.F.2 Inadequate Core Cooling Instrumentation

Dear Sir:

The Waterford SER asks that LP&L provide documentation of the Inadequate Core Cooling (ICC) Instrumentation at Waterford 3 prior to issuance of an operating license. Enclosed please find a description of the ICC Instrumentation in-cluding an evaluation of compliance with the specific requirements of NUREG-0737, item II.F.2.

This information will also be included in Amendment 32 of the FSAR.

Should you have any questions or comments in this matter please contact me or Mike Meisner at (504) 363-8938.

Yours very truly, v

Ybhit L. V. Maurin LVM/MJM/ssd Attachment cc:

W. M. Stevenson, E. L. Blake, J. Wilson, T. L. Huang 8303290407 830325 PDR ADOCK 05000382 E

PDR

.s RESPONSE TO SECTION II.F.2 0F NUREG-0737 INADEQUATE CORE COOLING INSTRUMENTATION TABLE OF CONTENTS Snction Title h

1.0 INTRODUCTION

1 1.1 Definition of ICC 1

1.2 Description of ICC Event Progression 1

1.3 Summary of Sensor Evaluations 3

2.0 FUNCTION DESCRIPTION OF ICCI 5

2.1 Interval 1 - Approach to Saturation 5

2.2 Interval 2 - Approach to Core Uncovery 5

2.3 Interval 3 - Core Uncovery 6

2.4 Interval 4 - Recovery from ICC 6

, 3.0 ICCI SENSOR DESIGN DESCRIPTION 7

3.1 Saturation Margin Monitor 7

3.2 Heated Junction Thermocouple System 7

3.3 Core Exit Thermocouple System 9

4.0 SIGNAL PROCESSING AND DISPLAY 16 4.1 QSPDS Processing 16 4.2 QSPDS Display 20 5.0 SYSTEM VERIFICATION TESTING 23 5.1 RTD and Pressurizer Pressure Sensors 23 5.2 HJTC System 23 5.3 CETs 23 6.0 ICCI SYSTEM QUALIFICATION 24 7.0 OPERATING INSTRUCTIONS 25 F.0 COMPARISON OF DOCUMENTATION REQUIREMENTS WITH THIS REPORT 26 9.0 SCHEDULE FOR ICCI IMPLEMENTATION 32

10.0 REFERENCES

33

.~

i RESPONSE TO SECTION II.F.2 0F NUREG-0737 INADEQUATE CORE COOLING INSTRUMENTATION

1.0 INTRODUCTION

This document provides the response to the requirements of Section II.F.2 of NUREG-0737 (Ref. 1) related to inadequate core cooling instrumentation (ICCI).

Included is a description of the activities conducted by LP&L and the C-E Owners Group (CEOG) to define and implement an ICCI system for Waterford 3.

The report describes the instrumentation package selected by LP&L to provide an indication of the approach to, the existence of, and the recovery from inadequate core cooling (ICC).

The ICCI system design is based on typical accident events which progress toward the defined state of ICC.

1.1 Definition of ICC The criteria for the existence of ICC is based on the potential for significant core damage and fission product release to occur.

ICC is defined to exist if the fuel clad temperature reaches or exceeds 1

2200*F.

This is the licensing clad temperature limit for design basis events analyzed in the FSAR.

ICC can occur only if there is a significant loss of water inventory from the Reactor Coolant System (RCS) so that the coolant level drops below the top of the core.

1.2 Description of ICC Event Progression The evaluation of the instrument sensors to determine ICC is based on events which. proceed slowly enough for the operator to observe and make use of the instrument displays. A small break LOCA illustrates the progression of such an event which can lead to ICC.

Figure 1-1 shows the representative behavior of the two-phase mixture level, RCS pressure, steam and clad temperatures with time for this event.

The event progression is divided into four intervals shown in the figure. Any event which leads to ICC l

progresses through these intervals.

The ICCI package is designed to provide j

information about each interval and therefore covers the entire event j

progression.

The intervals of an ICC event progression are described in Table 1-1.

Interval 1 is characterized by a reduction in RCS subcooling until saturation occurs.

This can occur by depressurization or by increasing the temperature of the RCS. During Interval 2, the co'olant level in the reactor vessel falls to the top of the core as a result of a loss of I

coolant inventory.

In Interval 3 the two-phase mixture level drops below the top of the core to its lowest level during the event progression.

During this time the clad temperature increases and produces an increasing superheated steam temperature at the core exit.

The final Interval 4 is the recovery from ICC.

The two-phase level increases above the top of the core l

causing the clad and core exit steam temperatures to decrease.

Complete recovery occurs when the reactor vessel is filled again (depending on break i

size) and RCS subcooling is established.

TABLE l-1 Definition of ICC Event Progression Intervals 1

Interval No.

ICC Phase Bounding Parameter Description 1

Approach to Reduction in RCS Sub-Depressurization of RCS to cooling until saturation pressure of hot saturation occurs leg temperature or heatup to saturation temperature at safety valve pressure.

2 Approach to Falling collapsed Loss of coolant inventory water level above from RCS with boiling from core continued depressurization and/or decay heat.

3 Approach to Two-phase mixture Core uncovery causes clad and/or level falls below heatup and production of existence of top of core resulting superheated steam at core in clad heacup exit.

4 Recovery from Two-phase level rises Coolant addition by ECCS above top of core as raises water level and RCS refills cools fuel.

Recovery from ICC is complete when reactor vessel is full or when stable, controllable conditions exist.

f l

2

n 1.3 Summary of Sensor Evaluations Several Sensors have been evaluated for use in an ICCI System.

The results of this evaluation are presented in CEN-il7 (Ref. 2).

Based on this and other studies performed by the CEOG, LP&L has selected the following sensors for an ICCI package:

1) Hot and cold leg resistance temperature detectors (RTDs)

2) Pressurizer presrure

3) Heated junction thermocouples (HJTCs)

4) Unheated junction thermocouples (UHJTCs)

5) Core exit thermocouples (CETs) 3

INTERVAL NUMBER

l:

3 h

4 1--+

2 s

s e

s HOT ROD PEAK CLAD TEMP e

i 1600 2400 36 -

\\

y LEVEL g

k 1400 2000 30 -

I

\\

t

-+

24 i

1 1200 1600

.1 i

u.

5 ul VTOP OF CORE l 5

5 5

l -l i

g 18 -

1200to -

1000 m o

/b L

{

?

5

~

l

/

12 h 800 800 I

' BOTTOM OF CORE j

6 I

?

400 600 CORE AVERAGE EXIT TEMP i

SATURATION TEMPERAT 0

I I

O

@0 0

800 1600 2400 3200 4000 TIME, SECONDS Figure 1-1 DEFINITION OF INTERVALS IN EVENT PROGRESSION 4

4 2.0 FUNCTIONAL DESCRIPTION OF ICCI 2

This section gives a functional description of the parameters which, when measured and displayed, provide the operator with advanced warning of the approach to, existence of and recovery from ICC.

The key parameters for each interval of the ICC event progression are identified.

2.1 Interval 1 - Approach to Saturation As described before, Intaryal 1 is the loss of RCS subcooling until saturation conditions are reached.

The parameters measured to detect subcooling are the RCS coolant temperature and pressurizer pressure. With this information, the amount of subcooling and the occurrence of saturation conditions can be determined.

Temperature is measured in the hot and cold legs, at the core exit, and in the reactor vessel upper head region.

The measurement range extends so that saturation can be determined from shutdown cooling conditions up to the pressurizer safety valve setpoint pressure.

The response time is adequate for the operator to obtain information during those events which proceed slowly enough for him to observe and take actions based on the indication.

2.2 Interval 2 - Approach to Core Uncovery During Interval 2, the RCS remains at saturation conditions as coolant

~,

inventory is lost and the coolant level in the reactor vessel decreases.

In order to track the continued progression of the event, an indication of th.e loss of inventory (liquid mass) prior to core uncovery is required. This is achieved by measuring the collapsed liquid level in the reactor vessel above the fuel alignment plate.

The collapsed level is the level that results when all the voids (steam bubbles) in a two-phase mixture are collapsed.

Measurement of the collapsed level, rather than the two-phase level, is more desirable since it provides a direct indication of the amount of liquid mass that exists in the reactor vessel above the core.

The collapsed level is measured over the range of fluid conditions from shutdown cooling to saturation at the pressurizer safety valve setpoint pressure.

The level measurement range extends from the top of the reactor vessel to the top of the fuel alignment plate.

The response time is short enough to track the level during a small break LOCA.

The measurement resolution is sufficient to indicate the progression of the event and the consequences of any mitigating action.

l l

5

4 2.3 Interval 3 - Core Uncovery Interval 3 is characterized by an increasing fuel clad temperature caused by the two-phase mixture level falling below the top of the core.

As the clad temperature increases, steam leaving the core becomes superheated.

The amount and trend of the steam superheat provides an indication of the clad temperature and therefore, an indication of the approach to, or existence of ICC.

Indication of the trend (increasing or decreasing) of the clad temperature is more important to the operator than information on the absolute value of the clad temperature since the trend tells him if conditions are getting better'or worse.

The core exit steam temperature is measured by thermocouples at an elevation just above the fuel alignment plate.

The temperature range extends from saturation at shutdown cooling conditions to greater than the maximum predicted core average steam exit temperature which occurs when the peak clad temperature reaches 2200*F.

The range for processing of the thermocouple output extends to 2300*F, although reduced accuracy is expected at the higher temperatures.

2.4 Interval 4 - Recovery from ICC Interval 4. recovery from the ICC event, begins af ter the two-phase mixture level in the core reaches a minimum and starts to increase.

The increasing mixture level results in a decreasing core exit steam temperature until saturation temperature is reached when the core is completely covered.

Measurement of the collapsed water level above the core provides continuous monitoring of.the increasing inventory and recovery from ICC.

Finally, subcooling of the RCS is re-established.

The parameters which indicate the recovery from ICC during Interval 4 are the same as those discussed for the first three intervals. Thus, the entire ICC event progression can be monitored by the operator.

6

3.0 ICCI SENSOR DESIGN DESCRIPTION The following instruments have been selected by LP&L to make up the ICCI System in response to NUREG-0737. This instrument package meets the functional requirements described in Section 2.

1) Saturation Margin Monitor (SMM)

2) Heated Junction Thermocouple (HJTC) System

3) Core Exit Thermocouple (CET) System Figure 3-1 shows a functional diagram for the ICCI System. Each instrument system consists of two safety grade channels from the sensors through the display.

3.1 Saturation Margin Monitor The SMM is a two-channel, on-line system which provides a continuous indication of the RCS margin from saturation conditions (subcooled or superheated).

It can be used to inform the operator of the approach to saturation and the existence of core uncovery.

RCS pressure input to the SMM is provided by two (one per channel) wide range safety grade pressurizer pressure channels.

RCS temperature inputs are provided by hot and cold leg RTD's, maximum unheated junction thermocouple (UHJTC) temperature from the upper head region, and the representative (maximum) core exit thermocouple temperature.

The sensor inputs to the SMM are summarized below.

Input Range Pressurizer Pressure 15-3000 psia Cold Leg Temperature (Ch. A-Loop 1A, 2A)

(Ch. B-Loop 1B, 2B) 50-750*F Hot Leg Temperature (Ch. A-Loop 1)

(Ch. B-Loop 2) 50-750*F Maximum UHJTC Temperature (from upper head) 100-1200*F*

Representative CET Temperature 100-1650*F*

3.2 Heated Junction Thermocouple System The principal function of the HJTC System is to measure the water inventory in the reactor vessel above the fuel alignment plate.

This is done at discrete elevations by monitoring the temperature difference between adjacent heated and unheated thermocouples.

OThermocouples continue to function and provide input beyond this range.

Although the accuracy is reduced, the correct temperature trend is maintained.

7

s The HJTC sensor, shown in Figure 3-2, consists of two thermocouple junctions separated by several inches and a splash shield.

One of the junctions is heated by an electric coil.

When the heated junction is surrounded by a fluid of relatively good heat transfer properties (liquid), the temperature i

difference between the two thermocouple junctions is small (90*F).

When the heated junction is surrounded by a fluid of poor heat transfer properties (steam), the temperature difference is large (500*F). Thus, by monitoring the temperature difference between adjacent heated and unheated thermocouples, it can be determined if an individual HJTC sensor is covered by liquid or surrounded by steam.

The splash shield protects the heated junction from spurious cooling by water running down the sensor sheath or entrained water droplets.

Eight HJTC sensors are placed at specific elevations inside a separator tube to make up a probe assembly. The purpose of the separator tube is to create a collapsed water level'inside while a two-phase mixture exists outside the tube.

When the collapsed water level falls below a heated junction elevation, its temperature and the sensor differential temperature increase above a predetermined setpoint value.

The sensor is then identified as l

being uncovered (i.e., surrounded by steam).

At Waterford 3, a " split probe" configuration is used.

This refers to the separator tube which is divided into two independent separator tubes, one on top of the other, each of which creates a collapsed level inside it (see Figure 3-3).

A divider disk inside the separator tube located at the i

elevation of the upper guide structure support plate hydraulically isolates the two regions.

Thus, the collapsed water level is measured in the upper i

plenum as well as, and separately from, the collapsed water level in the upper head.

Each portion of the split probe has 8 holes of 13/64 inch diameter near both the top and the bottom.

This provides approximately the same flow area for water drainage as was used and verified to be adequate in the Phase II tests of the HJTC probe assembly (Reference 3).

l Two independent HJTC split probe assemblies are installed in the reactor vessel.

They are located near the periphery of the upper guide structure and away from the hot legs.

Each probe assembly is housed within a stainless steel guide tube which protects it from hydraulic loads and serves as a guide path for the probe. A third tube, between the upper guide structure support plate and the fuel alignment plate, provides additional support and attaches the entire assembly to a control element assembly shroud. The guide and support tubes are perforated along their entire length with 3/8 inch holes. Additionally, slots in these tubes are positioned relative to the holes in the separator tube so as to prevent i

steam bubbles from entering the probe at the bottom and entrained water droplets'from entering the top.

The response to question 10 in CEN-181 (Ref. 4) provides more details on this arrangement.

The axial location of each HJTC sensor is shown in Figure 3-4.

The location of the sensors is identical for both of the instrument probe assemblies.

Thus, failure of any one sensor does not decrease the measurement resolution since a sensor at the same elevation in the second probe provides the same information.

Three sensors are located in the top head region and five in the upper plenum.

In each region, sensors are placed as high and as low as possible to inform the operator when the region is completely full or empty.

l Sensors in between provide additional resolution and information on the progress of the collapsed level during an ICC event.

The response time for the HJTC System is given in CEN-185, Supplement 3 (Ref. 5).

For a decreasing water level (drain), the response time is governed by the heat-up rate of the heated thermocouple which varies with pressure-(and heater power).

It is sufficiently short to inform the operator in a timely fashion that inventory has been lost.

For an increasing water level (refill), the response time is much shorter since quenching the heated thermocouple removes heat quickly.

A sensor heater power control system is used to protect the heated junction thermocouple from damage due to overheating. When an increasing heated junction temperature or sensor differential temperature exceed a preset value, the heater power is reduced until an acceptable stable temperature is l

reached. The power still remains high enough however, so Sat all sensors i

are capable of providing an uncovered signal. A more detailed description of the heater power control scheme is given in Reference 5.

3.3 Core Exit Thermocouple System The core exit thermocouple provide an indication of core uncovery and clad heatup. They measure the temperature of the steam at the core exit which j

becomes superheated as the two-phase mixture level falls below the top of I

the core. The CETs provide the operator with the important information on the trend of the clad heacup.

Type K (Chromel-Alumel) thermocouples are included within each of the 56 In-core Instrumentation (ICI) detector assemblies.

The junction of each thermocouple is located above the top of.the active fuel inside a tube which supports and shields the ICI detector assembly from hydraulic forces.

Figure 3-5 shows the axial arrangement of the CET in the calibration tube design used at Waterford.

The core locations for the CETs are shown in Figure 3-6.

The CETs will be qualification tested up to 1650*F.

Extrapolation of the s

data will provide calibration up to 1800*F. Although the absolute accuracy is reduced above this value, the CETs continue to provide accurate information on the trend of the clad temperature. Tests have shown that the CETs continue to function up to 2300*F. For the top-mounted instrumentation at Waterford 3, the thermocouples and thermocouple leads are exposed only to the core exit steam, not the higher cladding temperature.

From analysis of design basis events, the maximum steam temperature is less than 1800*F.

i 9

FIGURE 3-1 ICC INSTRUMENTATION SYSTEM hot j

T OTilER SENSOR cold INPUTS i

i cold I

SMH

^

PZR PRESSURE j

DISPLAY QSPDS CET CET y

PROCESSING DISPLAY CH A IlJTC IlJTC p

t HEATER CONTROLLER p

QSPDS SIGNAL PROCESSING A DISPLAY T

g hot cold b

cold I

PZR PRESSUllE 7q Tim ITC DISPLAY QSPDS CET CET y

y PROCESSING DISPLAY Cil B n

IlJTC i

IIJTC 8

OTilER SENSOR STRIP CHART llEATER CONTROLLER QSPDS SIGNAL PROCESSING B

FIGURE 3-2 I

l EJTC SENSOR e-l I

n*

EG /

ll ny nmanen M

a=

3 C

w Om b

y<

=>*

/

=

N

,a n

\\

=

"y w-a M

l 5

a l

5 2

E E

m E

E s l

I 11

FIGURE 3-3 HJTC SPLIT PROBE DESIGN CONFIGURATION HJTC UPPER SEPARATOR TUBE UPPER HEAD UGSSP 1R

/ /

Y / / /\\ V /

/

/

/- /

/

DIVIDER DISK HJTC LOWER UPPER PLENUM SEPARATOR TUBE 9

s CEA SHROUD --->

///

// / / / / / /

// //

12

FIGURE 3-4 HJTC SENSOR AXIAL LOCATIONS 0-.

I UPPER HEAD 29.

i

?

1 29.5 5

'"4 UGSSP 1" //

/ / /l V/

/

/

/

/

/

C

4 24 UPPER PLENUM C

l

)

21 C

/

21 in.

0 CEA SHROUD --->

20 8.. I J ;2.6 I

FAP

/ / /

// / / / / //

////

HJTC SENSOR LOCATION 13

~

kll 7

c'p o t

h ! [

G I

I O

s APPROXIMATE I

l

' THERMOCOUPLE s

l

V LOCATION IN l

l l

THIMBLE s

l l

SLOT s

f

~

s y

-l INSTRUMENT TUBE 1

i s

i I

l s

s l

I I

NNN k, l

\\ NN CALIBRATION TUBE

\\s/

N I

\\\\

f r

FUEL N

yy( )

/ ALIGNMENT N,

/

PLATE Y

N

)I

\\/

b BYPASS FLOWS -):

t

$/

l,.!x s

[i, -

N.

\\ !

! N

//

\\

CORE FLOW

/' \\

N

\\J UPPER END fit 1.tNG x.,

, h FIGURE 3-5 CORE EXIT TEMPERATURE MEASUREMENT SCHEME 14 1

4 6

I e

s O

O o

O o

e I

O o

o o

o o

0 O

o o

o O

O o

O O

O o

O O

o O

o-l o

O o

O O

O o

o O

O O

o O

O O

o O

o o

o o

O o

4 lo O

o o

O 6'

o THERMOCOUPLE LOCATION FIGURE 3-6 CORE EXIT THERMOCOUPLE CORE LOCATIONS 15

~

4.0 SIGNAL PROCESSING AND DISPLAY Safety grade signal processing and display of the ICC parameters is performed by the Qualified Safety Parameter Display System (QSPDS).

The QSPDS accepts sensor inputs, processes the signals, and transmits the output to its own alphanumeric display and to the plant computer.

All non-class lE inputs and the interface with the plant computer are isolated from the Class lE QSPDS equipment.

The QSPDS is capable of providing to the operator important information on the performance of critical safety functions.

However, the discussion here is centered on the processing and display of the information related to ICC and the criteria given in NUREG-0737.

4.1 QSPDS Processing The QSPDS is a two-channel, seismically qualified, Class lE system which uses a microprocessor for ICC signal processing and alphanumeric display.

Each channel is electrically independent and physically separate from the other.

The system is designed to achieve an availability of 99%.

In general, the input signal processing performed by the QSPDS consists of:

4 1.

Checking that the sensor inputs are within their specified range.

2.

Converting the sensor inputs to engineering units for display.

3.

Calculating parameters from sensor inputs.

4.

Calculating and initiating alarms when a parameter exceeds a setpoint.

5.

Self diagnostic testing.

The QSPDS processing equipment includes operator interfaces for testing, calibration, and adjustments to be performed.

In addition, automatic on-line surveillance and diagnostic test capabilities are included.

These tests check for specified hardware and software malfunctions and alert the operator through the QSPDS display.

It is designed to facilitate the recognition and location of the source of the malfunction to the operator.

If in the remote chance that one QSPDS channel or individual sensor fails, the operator has the following information to identify the failure:

1.

QSPDS error codes and alarms.

2.

Additional sensor inputs for hot leg temperature, cold leg temperature, and pressurizer pressure on the control board separate frem the QSPDS.

3.

The HJTC and CET Systems have multiple sensors in each channel which the operator can use to correlate and check inputs.

4.

The HJTC sensor output can be tested by adjusting the heater 4

power.

4 l

16

The following sections describe in more detail the processing and display for each of the ICC instruments.

4.1.1 Saturation Margin Moniter The SMM/QSPDS calculates and displays both the temperature and pressure margin to saturation. The temperature saturation margin is the difference between the saturation temperature and the maximum temperature input. The pressure saturation margin is the difference between the minimum RCS pressure input and the saturation pressure. The saturation temperature is calculated using the minimum pressure input, a table of temperature and pressure values representing the saturation curve, and an interpolation routine. The saturation pressure is calculated similarly using the maximum temperature location, i.e., RTDs in the hot and cold legs, maximum of the top three unheated junction thermocouples (upper head region), and the representative CET temperature. The minimum temperature saturation margin from the RTDs and upper head is also calculated to give the operator the best indication of the RCS margin to saturation.

An audible and display alarm is initiated when the RCS (not including CET) temperature saturation margin falls below the setpoint value of 10*F subcooling.

An alarm is also initiated when the CET temperature saturation margin exceeds 10*F superheat.

No alarms are initiated based on the pressure margin.

The following information is displayed:

Parameters Display Range 1.

Temperature margin to 700"F Subcooled to saturation for each 2100 F Superheated temperature source (RTD, UHJTC, CET) 2.

Pressure margin to saturation 3000 psi subcooled~to for each temperature source 3000 psi superheat 3.

Temperature input values RTD - 50 to 750*F UHJTC - 32 to 2300 F OET - 32 to 2300 F 4.

Pressure input value 15 to 3000 psia The saturation margin is identified as subcooled or superheated on the display.

17

I 4.1.2 Heated Junction Thermocouple System A detailed description of the HJTC signal processing is included in CEN-185, Supplement 3 ("eference 5).

A brief description of i

the processing performed is given below.

1.

Determine if liquid exists at each of the HJTC sensor locations. When liquid surrounds the HJTC sensor, the differential temperature is small. When steam surrounds the sensor (i.e. the sensor is uncovered), the heated junction temperature increases and the sensor differential temperature becomes large. When the differential temperature.is greater than a predetermined setpoint value (200*F), the sensor is identified as being uncovered (see Figure 4-1).

The sensor is also identified as uncovered if the unheated junction temperature is above a setpoint value.

This setpoint is high enough (700*F) to ensure that steam surrounds the sensor.

It is used to maintain an uncovered signal if sensor heater power is completely cut off.

2.

Calculate percent liquid level for the upper head and upper plenum regions.

For the split probe design used at Waterford 3, the collapsed level in the upper head is measured independently from the collapsed level in the upper plenum.

The processing and display of the collapsed level is consistent with the manner in which it is measured.

That is, the percent liquid height in each region, which corresponds to the number of covered sensors in that region, is displayed separately.

3.

Provide sensor heater power control signal.

The sensor heater power is controlled to prevent damage to the sensor due to overheating.

The input to the control logic is the maximum heated junction temperature and the maximum sensor differential temperature from all sensors.

When the i

temperature (heated junction or differential) reaches a preset value, the power control signal is reduced linearly as a function of temperature (see Figure 4-2).

The minimum of the control signals derived from the heated junction and differential temperatures is used to reduce heater power.

The heater power to all sensors is reduced until the temperature of the uncovered sensor stabilizes at an acceptable value.

There is at all times, even when power is cutback, sufficient heater power to generate an uncovered signal if the collapsed water level falls below sensor.

4.

Initiate an alarm when any HJTC sensor becomes uncovered.

When any sensor differential temperature or unheated junction temperature exceeds the uncovered setpoint value, an audible and display alarm is initiated indicating that the collapsed level in the reactor vessel has decreased.

18

i i

5.

Perform fault condition and diagnostic testing. The system is designed to automatically detect and display several-specific fault conditions associated with the HJTC instrument.

These faults include open thermocouples and a loss of sensor heater power. The effect and detection of several fault conditions is discussed in Reference 7.

6 Determine the maximum unheated thermocouple temperature from the top three sensors (upper head region).

The fluid temperature in the upper head is input to the SMM as described in Section 4.1.2.

The following information is displayed by the QSPDS:

Parameters Display Range 1.

Percent liquid level in upper head 0 - 100%

2.

Percent liquid level in upper plenum 0 - 100%

3.

Status of each HJTC sensor Covered / Uncovered 4.

Heated junction t'emperatures 32 - 2300 F 5.

Unheated junction temperatures 22 - 2300 F 6.

Differential temperatures

-2268 - +2268 F 7.

Heater power 0 - 100%

4.1.3 Core Exit Thermocouples The processing equipment for the CETs calculates the representative (maximum) CET~tempe'rature fram the valid available values input to the channel.

It also calculates the two highest valid CET temperatures in each quadrant. The representative CET temperature is calculated at the upper 95% of the distribution of valid CET temperatures with a 95% confidence level. Half of the CET temperatures'(28 CETs) from all four core quadrants are input and processed by each channel.

These temperatures are categorized into four quadrants and identified by their location above the core. Any temperatures that are out-of-range (thereby indicating a fault) based on statistical analysis are eliminated from the

~

calculations.

The representative CET temperature is input to the SMM calculations as described in Section 4.1.2.

An alarm is generated when the representative CET temperature exceeds a high temperature setpoint of 670*F.

The following information is displayed:

Parameter Display Range 1.

Representative CET temperature 32 - 2300"F 2.

Two highest CET temperatures 32 - 2300 F per quadrant (with identifier) 3.

All CET temperatures input to 32 - 2300 F channel (by quadrant with i

identifier) 19

+

e-

i

• 4.2 QSPDS Display The QSPDS displays present direct, reliable, and continuous safety grade information on demand from each of the ICCI components.

Existing alarm conditions and system faults are also shown. Human factors engineering is incorporated into the alphanumeric displays.

Paging capabilities are provided in order to group and display all the information more efficiently.

4 The QSPDS provides Class IE analog outputs for trending capabilities of the essential ICC detection parameters.

These outputs are connected to strip chart recorders for a time history record of the ICC parameters. This trend recording aids the operator in following the progression of the ICC event.

The following ICC parameters are trended:

1.

RCS temperature saturation margin 2.

CET temperature saturation margin 3.

Percent liquid level in the upper head 4.

Percent liquid level in the upper plenum 5.

Representative CET temperature The information from each of the ICCI components that are dinplayed by the QSPDS is given in Section 4.1.

i i

f v

20

FIGURl! Is-2 IIEATIIR POWER CONTROL LOGIC Still!CT MAX. TEMP.

T"I d i il l' 3 I

(VOLTS)

T 1

=

SELECT T,3 T

8 0

o s2 (MIN VAlllE OlffPilT TO PC llEATlin POWiin

' SUPPL.Y U

StiLECT MAX. AT AT,

, g 5

P l

AT a

2 p

2 (VOLTS) a s

l AT8 I

e' 0

T,g Ts2 (o )

p i

l l'C - CONTR01. SIGNAL TO IIEATER POWER SUPPLY P - CONTROI. SIGNAI.IIASIID ON MAXIMUM T g

H P - CONTROL SIGNAL BASED ON MAXIMUM AT T - IIEATED JUNCTION OltrPUT H

AT - SENSOR DIFFERIINTI AL TliHPERATURil T '1-SETPOINT WilERE POWER REDUCTION HEGINS Tsi n s T

T ' - SE'fPOINT WilERE POWER IS COMPI.ETEl.Y OFF 823 s2

IlJTC LEVEL LDCIC 6

' T" 3

UNCOVERED Il j

7H g

COVERED T ( F) s U

EITilER/OR 82 7

+

OlfrPlTr 1.EVEL 1.0GIC 33 IS ItEPHATED

+

DISPl.AY iFORI!ACH SliNSOR IN o

THli PR0lli!

fil AT T

~

~

H U

COVi! RED O

T8 AT( F) s HEAM JUNGIM MM l

'r y

T - UNHEATliu JUNCTION OlfrPUT g

AT - SliNSOR DIFFl!RENTIAL OtfrPtfr T, T' - SETPOINT VAI.UE S

S

5.0 SYSTEM VERIFICATION TESTING This section describes the tests that have been performed to verify the ICC sensor performance.

In some cases, operational experience can be used for sensor verification.

5.1 RTD and Pressurizer Pressure Sensors J

1 The hot and cold les RTDs and the pressurizer pressure sensors are standard NSSS instruments which have a well known response. No special verification 9

tests have been performed or are planned.

These senscrs provide reliable temperature and pressure inputs that are considered adequate for use in the ICCI system.

5.2 HJTC System t

The HJTC System is a new system developed to indicate the liquid inventory (collapsed level) above the core.

Since it is a new instrument system, an extensive testing program has been completed to verify its ability to indicate the liquid inventory existing above the core under conditions similar to what it may be exposed to during an ICC event.

The test program was divided into three phases. The phase I test series consisted of feasibility and proof-of-principle tests where the concept of using HJTCs as a water level measurement device was confirmed. The Phase I results are reported in CEN-185, Supplement 1 (Reference 6). The Phase II tests, documented in CEN-185, Supplement 2 (Reference 3), verified the performance of a complete HJTC probe assembly under thermal-hydraulic conditions representative of what might be encountered in a PWR.

Single phase, two-phase, and depressurization transients were conducted.

Phase III, reported in CEN-185, Supplement 3 (Reference 5), was the final testing of a prototype HJTC System. This included verification of the integral i

operation of the HJTC probe assembly, sensor heater power control, and signal processing. The conclusion of these tests was that the HJTC system is capable of measuring and displaying to the operator the water inventory above the core in a reactor vessel.

In addition to the testing described above, the CE Owners Group has completed a study to analyze the response of the HJTC System during various accidents. The purpose of the study is to quantify the effect that operation of the reactor coolant pumps during the transient has on the measured water level. A qualitative description of this effect is given in Reference 7.

The results of the study will also provide the basis for development of guidelines on the use of the HJTC System during accidents and in the emergency operating procedures.

5.3 CETs An evaluation has been conducted to verify the thermal-hydraulic performance of the CETs for use as an ICC detection sensor.

This study reviewed the CET response during normal PWR operation, simulated accidents in LOFT and Semiscale tests, and during the TMI-2 accident. Analyses of CET response were also performed for conditions representative of PWR core uncovery.

The evaluation concluded that the CETs are able to provide the reactor operator with information on the status and trend of fuel cladding heat-up during core uncovery.

en

9 6.0 ICCI SYSTEM QUALIFICATION The ICCI System (including the QSPDS) is environmentally and' seismically qualified. The instrumentation is designed such that they meet the appropriate stress criteria when subjected to normal and design basis accident loadings.

I Out-of-vessel components, i.e., cables and connectors, are environmentally qualified in accordance with IEEE-323-1974. Containment temperature and pressure profiles for the design basis accident are used where appropriate.

This equipment is also seismically qualified.

In addition, the HJTC System has been extensively tested and verified under conditions similar to what it may encounter during an ICC event (Ref. 5).

The CETs have also been tested and verified to function up to a temperature of 2300*F (Ref. 8).

l

/'

f 4

I i

t

(

24

7.0 OPERATING INSTRUCTIONS Guidelines for reactor operators to use to detect ICC and take corrective action have been developed by the CE Owners Group (Reference 9) and approved by the NRC for implementation (Reference 10).

These guidelines will be used to review and revise the plant emergency procedures for Waterford 3 in accordance with Supplement 1 to NUREG-0737.

The emergency procedure guidelines provide function oriented instructions for the detection of and recovery from ICC based on the SMM and CETs.

However, these guidelines do not currently incorporate information obtained from the HJTC System on water inventory above the core. The HJTC System will be used for the purpose of operator training and familiarization until instructions on its use have been incorporated into modified emergency operating procedures. Analysis of the HJTC response during potential ICC events will be used in developing this information.

The current event oriented emergency procedures address the use of the SMM and CITs as well as additional instrument indications for the detection of ICC.

These procedures will remain in effect until implementation of the function oriented procedures as described in the response to NUREG-0737, Supplement 1.

The operator instructions in the current emergency procedures for ICC relate to ensuring that the steam generator water level is sufficiently high to remove RCS heat and that the safety injection system is operating properly.

Specifically the operator is instructed to feed the steam generators using the main,feedwater pumps, the emergency feedwater pumps, or finally 'he condensate pumps.

If steam generator level and t

j pressure are being maintained, the operator is instructed to ensure that the charging pumps are delivering flow and that, if the pressure is low enough, the safety injection pumps are operating and delivering flow.

If no flow is 4

indicated in the safety injection lines to the cold legs, the operator is instructed to open the hot leg injection lines, s

I 25 i

.. -.. _., _. _ ~. _, _

i i

8.0 COMPARISON OF DOCUMENTATION REQUIREMENTS WITH THIS REPORT j

Tables 8-1 through 8-3 provide a point by point comparison of the documentation required by Item II.F.2 of NUREG-0737, the requirements of of Item II.F.2, and the Criteria of Appendix B of NUREG-0737 with the ICCI to be installed at Waterford 3.

26

Table 8-1 Comparison of ICCI to Documentation Recuirements of Item II.F.2 of NUREG 0737 Item

Response

in.

A description of the ICCI system is provided in Section 3.

New instrumentation to be added-includes the HJTC probe assemblies.

Display of the ICC parameters will be on the QSPDS.

Ib.

Existing instrumentation which can aid the operators in the detection of ICC is discussed in Reference 2.

Waterford 3 will use the SMM and CETs as part of the ICCI System.

i Ic.

The final ICCI System is as described in Section 3 and 4.

2.

The design analysis and testing performed to evaluate the ICCI is discussed in Reference 2 and Section 5.

3.

Additional instrumentation testing is discussed in Section 5.

System qualification testing is discussed in Section 6.

4.

This table evaluates the ICCI conformance to Item II.F.2 of NUREG-0737.

Table 8-2 evaluates conformance to Attachment 1 of Item II.F.2.

Table 8-3 evaluates conformance to Appendix B of NUREG-0737.

5.

Section 4 describes the processing and display of the ICC parameters which is incorporated into the QSPDS.

6.

Section 9 discusses the schedule for installation and implementation of the ICCI System.

7.

Guidelines for use of the ICCI are discussed in Section 7.

An ICCl functional description is given in Section 2.

i 27 4

-.,, - -. -, - -,.,, -., - ~ -, --

c

+

8.

Section 7 discusses the current emergency operating procedures and how they will be modified when the complete ICCI System is implemented.

9.

The following lists additional submittals that will be provided to support the final ICCI System.

Report Submittal Date

1. HJTC Performance Analysis When Completed

2. Modification to emergency procedures Given in 3 below 3._ Response to NUREG-0737, Supplement 1 April 15, 1983

/

28

9 Table 8-2 Comparison of ICCI to Attachment 1 of II.F.2 Item

Response

1.

Waterford 3 has 56 CETs distributed uniformly across the top of the core.

Figure 3-6 shows the locations of the CETs.

2a.

A spatial CET temperature map is available on demand from the QSPDS display.

2b.

The maximum CET temperature calculated from a i

statistical analysis, is used as a representative temperature and is displayed continuously on demand.

2c.

The QSPDS provides direct readout of the CET l

temperatures.

The line printer provides hard-copy recogding. The display range is from 32 F to 2300 F.

2d.

Trending of the representative CET temperature is provided by an analog outpot from the QSPDS to a strip chart recorder.

2e, The QSPDS provides visual alarm capability as well as output to the plant annunciator for audible alarms.

2f.

The QSPDS incorporates human factors engineering.

3.

The QSPDS meets the requirements for a safety grade backup display system.

Both channels together display all CET temperatures.

4.

The QSPDS design incorporates human factors engineering in determining the types and locations of displays and alarms.

The use of these displays will be addressed in operating procedures, emergency procedures, and operator training.

5.

The ICCI is evaluated for conformance to Appendix B in Table 8-3.

6.

The QSPDS is an electrically independent Class IE System.

It meets the applicable display requirements as modified by NUREG-0737, Supplement 1.

7.

The ICCI is qualified as described in Section 6.

8.

The QSPDS is designed to provide an availability of 99%.

Availability of the ICCI is addressed in the Technical Specifications.

9.

The quality assurance provision of Appendix B, Item 5, will be applied to the ICCI.

29

o Table 8-3 Comparison of ICCI to Appendix B of NUREG-0737 Item

Response

1.

The ICCI is environmentally and seismically qualified as described in Section 6.

The isolation devices in the QSPDS are accessible for maintenance.

2.

The ICCI through the QSPDS display meets the single failure requirement.

If one channel should fail the self diagnostic capability of the QSPDS, as well as additional sensor displays aid the operator in determining which channel may have failed (Section 4.1).

3.

The ICCI through the QSPDS is powered by Class lE power sources.

4.

Availability of the ICCI is addressed in the Technical Specifications.

5.

The ICCI through the QSPDS meets quality assurance requirements.

The QSPDS provides continuous displays on demand.

6.

7.

The QSPDS provides trend recording with an analog strip chart.

8.

The QSPDS displays are clearly identified on the control panel and are human factor engineered.

9.

Output signals from the QSPDS to non-qualified equipment are transmitted through Class IE isolation devices.

10.

The operational availability of the ICCI can be checked as described in Section 4.1.

l l

11.

Servicing, testing, and calibration programs for the ICCI through the QSPDS shall be specified.

l 12.

The means for removing channels frcm service have been considered in the ICCI design.

30

o 13.

The design facilitates adminstrative control of access to all setpoint adjustments, calibration adjustments, and test points.

14.

The d'esign minimizes anomalous indications which might confuse operator.

15.

The design facilitates the recognition, location, replacement, repair or adjustment of malfunctioning components.

16.

The design directly measures the desired variables to the extent practical.

17.

The design incorporates this requirement to the extent practical.

18.

Periodic testing of the instrument channels will be incorporated.

31

9.0 SCHEDULE FOR ICCI IMPLEMENTATION The ICCI System, including the QSPDS, will be installed and operational at Waterford 3 prior to first cycle commercial operation on a schedule to be submitted in response to Supplement 1 of NUREG-0737.

However, the emergency procedures will not initially incorporate information obtained from the HJTC System. The emergency procedures will be revised and upgraded to include use of the ICCI as described in the response to Supplement 1 of NUREG-0737.

During first cycle operation, the HJTC System will be used for operator training and familiarization.

Instructions on the use of the HJTC will be developed and incorporated into the emergency proeddures prior to cycle two operation.

4 0

i O

I 32

(

l l

3 O

10.0 REFERENCES

l.

NUREG-0737, " Clarification of TMI Action Plan Requirements," NRC, Nov.

1980.

2.

CEN-117. " Inadequate Core Cooling - A Response to NRC IE Bulletin 79-06C, Item 5 for Combustion Engineering NSSS", Combustion Engineering, Oct. 1979.

3.

CEN-185, Supp. 2 " Heated Junction Thermocouple Phase II Test Report,",

Combustion Engineering, Nov. 1981.

4.

CEN-181, " Generic Responses to NRC Questions on the CE Inadequate Core Cooling Instrumentation", Combustion Engineering, Sept. 1981.

5.

CEN-185, Supp. 3 " Heated Junction Thermocouple Phase III Test Report,"

1 Combustion Engineering, Sept. 1982.

6.

CEN-185, Supp. 1, " Heated Junction Thermocouple Phase I Test Report,"

Combustion Engineering, Nov. 1981.

7.

Letter from K. Baskin (CEOG) to D. Crutchfield (NRC), June 1, 1982.

8.

Anderson, R.

L., Banda L.

A., Cain D.

G., "Incore Thermocouple Performance Under Simulated Accident Conditions", IEEE Nuclear Science Symposium, Vol. 28, 1980.

9.

CEN-152, Rev. 1, " Combustion Engineering Emergency Procedure Guidelines", July, 1982.

10.

Letter from D. G. Eisenhut (NRC) to R. W. Wells (CEOG), February 4, 1983.

l l

l l

33 l

, _ -