ML20070S452
| ML20070S452 | |
| Person / Time | |
|---|---|
| Site: | Perry  |
| Issue date: | 01/26/1983 |
| From: | Edelman M CLEVELAND ELECTRIC ILLUMINATING CO. |
| To: | Youngblood B Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8302040400 | |
| Download: ML20070S452 (78) | |
Text
,
i t,u u t i.
L. I. 3.
)f f
f f E
f f f )}
- 2
[5
\\f 6 i s a'
+'c14 b r-ilLJn3 1
it
- c. u i n: o m
P.O. Box 5000 - CLEVELAND, oHlo 44101 - TELEPHONE (216) 622-9800 - lLLUMINATING BLDG.
- 55 PUBLICSOUARE Serving The Best Location in the Nation MURRAY R. EDELMAN VICE PRESIDENT NUCUAR January 26, 1983 PY-CEI/NRC-0006 L Mr. B. J. Youngblood, Chier Licensing Branch No. 1 Division of Licensing U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Perry Nuclear Power Plant Docket Nos. 50-440; 50-441 ATWS Mitigation Design Features SER Outstanding Issue No. 20 and Confirmatory Issue Nos. 26 and 27
Dear Mr. Youngblood:
This letter and its attachments provide the details cf the ATWS mitigation design modifications for Perry, described in our letter dated August 13, 1982 from D. R. Davidson to A. Schwencer. Draft FSAR change pages are provided to describe the modifications to the Standby Liquid Control System and Scram Discharge Volume and the new Redundant Reactivity Control System.
These changes will be incorporated in the next FSAR amendment.
Please let me know if you have any questions.
Very truly yours, Murray R. Edelman Vice President Nuclear Group MRE:kh r
cc:
Ja" Silberg, Esq.
l John Stefano Max Gildner N. Fioravante G. Thomas J. Mauck OS l
8302040400 830126 PDR ADOCK 05000440 E
PDR L
flow is diverted to the drives by closing the appropriate stabilizing valves, at the same time opening the drive directional control and exhaust solenoid valves.
Thus, flow through the drive pressure control valve is always constant.
Flow indicators in the drive water header and in the line downstream from the stabiliziag valves allow the flow rate through the stabilizing valves to be adjusted when necessary. Differential pressure between the reactor vessel and the drive pressure stage is indicated in the control room.
4.6.1.1.2.4.2.4 Cooling Water Header The cooling water header is located downstream from the drive / cooling pressure valve. The drive / cooling pressure control valve is manually adjusted from the control room to produce the required drive / cooling water pressure balance.
The flow through the flow control valve is virtually constant. Therefore, once adjusted, the drive / cooling pressure control valve will maintain the correct drive pressure and cooling water pressure, independent of reactor vessel pressure.
Changes in setting of the pressure control valves are required only to adjust for changes in the cooling requirements of the drives, as the drive seal characteristics change with time. A flow indicator in the control room monitors cooling water flow.
A differential pressure indicator in the control room indicates the difference between reactor vessel pressure and drive cooling water pressure. Although the drives can function without cooling water, seal life is shortened by long term exposure to reactor temperatures. The temperature of each drive is indicated and recorded, and excessive temperatures are annunciated in the control room.
4.6.1.1.2.4.2.5 Scram Discharge Volume (SDV)
The scram discharge volume consists of header piping which connects to each HCU and drains into an instrument volume. The header piping is sized to receive and contain all the water discharged by the drives during a scraz, independent of the instrument volume. Each of the two sets of headers has it's own directly-connected scram discharge instrument volume (SDIV) attached to the low point of the header piping.
The large diameter pipe of the instrument volume j
serves as a vertical extension of the SDV (though no credit is taken for it in detemining SDV requirementu).
4.6-13
l During normal plant operation the scram discharge volume is empty, and vented to atmosphere through its open vent and drain valve. When a scram occurs, upon a signal from the safety circuit these vent and drain valves are closed to conserve reactor water. Redundant vent and drain valves are provided to assure against loss of reactor coolant from the SDV following a scram. Lights in the control room indicate the position of these valves.
During a scram, the scram discharge volume partly fills with water discharged from above the drive pistons. After scram is completed, the control rod drive seal leakage from the reactor continues to flow into the scram discharge volume until the discharge volume pressure equals the reactor vessel pressure. A check valve in each HCU prevents reverse flow from the scram discharge header volume to the drive. When the initial scram signal is cleared fece the reactor protection system, the scram discharge volume signal is overridden with a keylock override switch, and the scram discharge volume is drained and returned to atmospheric pressure.
Remote manual switches in the pilot valve solenoid circuits allow the discharge volume vent and drain valves to be tested without disturbing the reactor protection system. Closing the scram discharge volume valves allows the outlet scram valve seats to be leak-tested by timing the accumulation of leakage inside the scram discharge volume.
Each instrument volume is monitored by level switches and by transmitter activated trip units (see Figure 4.6-5).
Two level switches and two trip units in a one-out-of-two twice logic will provide redundant and diverse inputs to the RPS to initiate a reactor scram when water in each instrument volume exceeds that l
preset high water level. Furthermore, alarms and rod blocks will also provide warnings at lower water levels to control room operators if the instrument volume is not completely empty.
l l
4.6-14
4.6.1.1.2.5.4 Alternate Rod Insertion (ARI)
The Alternate Rod Insertion feature is designed to increase the reliability of the Control Rod Drive system scram function. ARI provides for insertion of reactor control rods by depressurizing the scram air header through valves which are redundant and diverse from the reactor protection system scram valves.
The Redundant Reactivity Control System (RRCS) (see Section 7.6.1.12), signal to insert control rods results in energizing the eight ARI valves shown on Figure 4.6-5.
Two valves in series with the backup scram valves also have parallel functioning check valves to assure venting of air from the air supply line in the event one or more of the ARI valves. fails. Four valves provide for venting of the A and B HCU scram valve pilot air headers to atmosphere to depressurize the headers and scram all rods.
Two additional valves vent the scram air header which serves the scram discharge volume drain and vent lines, closing those valves and isolating the SDV.
4.6-19a
TABLE OF CONTENTS (Continued)
Section Title Page 7.6.1.6 Recirculation Pump Tri,o (RPT) System -
Instrumentation and Ceatrols 7.6-18 7.6.1.7' Fuel Pool Cooling System (FPC) -
Instrumentation and Controls 7.6-19 7.6.1.8 Containment Atmosphere Monitoring System -
Instrumentation and Controls 7.6-23 7.6.1.9 Fuel Handling Area Ventilation System 7.6-23 7.6.1.10 Of_f-Gas Building Exhaust System 7.6-25 7.6.1.11 Safety Relief Valve - Relief Function -
Instrumentation & Controls 7.6-27 7.6.1.12 Redundant Reactivity Control System -
Inatrumentation & Controls.
,J.6-27 7.6.1.13 Design Basis 7.6-26 7.6.1.14 Final System Drawings 7.6-31 7.6.2 ANALYSIS 7.6-31 7.6.2.1 Safety Related Systems - Instrumentation and Controls 7.6-31 7.5.2.2 Conformance to 10CFR 50, Appendix A -
General Design Criteria (GDC) 7'.6-31 7.6.2.3 Conformance to IEEE Standards 7.6-32 7.6.2.4 Conformance to NRC Regulatory Guides 7.6-37 7.7 CONTROL SYSTEMS NOT REQUIRED FOR SAFETY 7.7-1 7.
7.1 DESCRIPTION
7.7-1 7.7.1.1 Reactor Vessel Head Seal Leak Detection 7.7-1 7.7.1.2 Rod Control and Information System (RC&IS) -
Instrumentation and Controls 7.7-2 7.7.1.3 Recirculation Flow Control System -
Instrumentation and Controls 7.7-18 7.7.1.4 Feedwater Control System - Instrumentation and Controls 7.7-26 7.7.1.5 Steam Bypass and Pressure Regulating System -
l Instrumentation and Controls 7.7-30 7.7.1.6 Re fue ling Interlocks - Instrumentation and Controls 7.7-37 7.7.1.7 Design Differences 7.7-39 7.7.1.8 Process Computer System - Instrumentation 7.7-39 7.7.1.9 Reactor Water Cleanup System 7.7-39g 7.7.1.10 Process Sampling System 7.7-39g 7.7.1.11 Gaseous Radwaste System 7.7-39g 7.7.2 ANALYSIS 7.7-39g l
r I
7-iii l
LIST OF FIGURES Figure No.
Title 7.6-7 Containment Atmosphere Monitoring System, Unit 1 (sheet 1 of 2) r 7.6-7 Containment Atmosphere Monitoring System Unit 2 (sheet 2 of 2) 7.6-8 RRCS Initiation Logic 7.6-9 RRCS - ARI Valves 7.6-10 RRCS Separation Block Diagram 7.' 7 -1 Control Rod Drive Hydraulic System Functional Control
^
Diagram (6 sheets) i l
7-va
bb.
Containment Vacuum Relief System - instrumentation and controls provide valve actuation signals and position indication in the control room for each valve in the vacuum relief lines.
Drywell Vacuum Relief System - instrumentation and controls provide position cc.
indication and actuation signals to the valves in the vacuum relief lines.
dd.
Standby Power Support Systems - instrumentation and controls ensure the adequacy and availability of the diesel fuel oil and starting air systems.
Manual controls for diesel startup are provided locally at the diesel generators and remotely in the control room.
Redundant Reacti"ity Control System - instrumentation and controls provide ee.
detection and actuation logic for input to the Recirculation System, Feedwater System and the Alternate Rod Insertion function in order to mitigate the potential consequences of an Anticipated Transient Without Scram. (See Section 15.8 and Appendix 15C) 7.1.2 IDENTIFICATION OF SAFETY CRITERIA Instrumentation and control equipment design are based on the need to have the system perform its intended function while meeting the requirements of applicable General Design Criteria (GDC), Regulatory Guides, industry standards, and other documents. Refer to Sections 7.2, 7.3, 7.4, 7.5, and 7.6 for discussion of design bases for each safety related system.
7.1.2.1 Regulatory Requirements The plant safety related systems have been examined with respect to specific regulatory requirements which are applicable to the instrumentation and controls of these systems. These regulatory requirements include:
Title 10 Code of Federal Regulations, Part 50 a.
b.
Industry codes and Standards c.
Regulatory Guides 1
7.1-6
'~
The specific regulatory requirements pertaining to each system's instrumentation and control is specified in Table 7.1-3.
For a discussion of the degree of conformance, see the individual systems analysis portions in Sections 7.2,~7.3, 7.4, 7.5 and 7.6.
r
+
6 e.-
I I
s P
J' l
l I
?
I 7.1-6a oc l
s
TABLE 7.1-1 (Continued)
CE GE Design Supply Others Safety-Related Display Instrumentation X
X X
Ali Othe.- Safety Related Systems Process Radiation Monitoring System X
Neutron Monitoring System X
X Intermediate Range Monitor (IRM)
Average Power Range Monitor (APRM)
Local Power Range Monitor (LPRM)
Leak Detection X
X X
Rod Pattern Control System (RPCS)
X X
Recirculation Pump Trip (RPT)
X X
Fuel Pool Cooling System (FPCS)
X Fuel Handling Area Ventilation System X
Off-Cas Building Exhaust X
Plant Cooling Systems X
Containment Atmosphere Monitoring System X
High Pressure - Low Pressure Systems Interlocks X
X Redundant Reactivity Control System X
X 2
7.1-18
l l
i l
i 7.2 REACTOR TRIP SYSTEM - REACTOR PROTECTION SYSTEM (RPS) 7.
2.1 DESCRIPTION
7.2.1.1
System Description
a.
RPS Function The RPS is designed to cause rapid insertion of control rods (scram) to shut down the reactor when specific variables exceed predetermined limits.
A completely separate and diverse system, the Redundant Reactivity Control System, is provided to mitigate the effects of a postulated Anticipated Transient Without Scram - see Section 7.6.1.12.
b.
RPS Operation Schematic arrangements of RPS mechanical equipment and information displayed to the operator are shown in Figure 7.2-1 (RPS IED). The RPS instrumentation is shown in Table 7.2-1.
Sensor channel arrangements are shown in Figure 7.2-1.
RPS elementary digrams are listed in Section 1.7.1; plant layout drawings are shown in Section 1.2.
The RPS power supply is discussed in Chapter 8.
l l
l The RPS instrumentation is divided into trip channels, trip logics, and trip actuator logics.
During normal operation, all trip channel relays essential to safety are energized; channels, logics, and actuators are energized, l
l There are at least four trip channels for each variable. The trip channels are designated as A, C, B, and D.
Each trip channel is associated with the trip logic of the same designation.
7.2-1
Trip logics A and C outputs are combined in a one-out-of-two logic arrangement to control the "A" pilot scram valve solenoid in each of the four rod groups (a rod group consists of approximately 25 percent of the total of control rods). Trip logic B and D control the "B" pilot scram valve solenoids in each of the four rod groups.
7.2-la I
of the two steam lines associated with that logic to cause a trip of that logic. Closure of at least one valve in three or more steam lines is required to initiate a scram.
At plant shutdown and during plant startup, a bypass is required for the main steam line isolation valve closure scram trip in order to properly reset the Reactor Protection System. This bypass is in effect when the mode switch is in the SHUTDOWN, REFUEL or STARTUP position.
The bypass allows plant operation when the main steam line isolation valves are closed during low power operation. The operating bypass is removed when the mode switch is placed in RUN.
Diversity of trip initiation due to main steam isolation is provided by reactor vessel high pressure and reactor power trip signals.
8.
Scram Discharge Volume Water Level Water displaced by the control rod drive pistons during a scram goes to the scram discharge volume.
If the scram discharge volume fills with l
water so that insufficient capacity remains for the water displaced l
during a scram, control rod movement would be hindered during a scram.
i To prevent this situation, the reactor is scrammed when the water level l
in the discharge volume is high enough to verify that the volume is filling up, yet low enough to ensure that the remaining capacity in the discharge volume can accommodate a scram.
Four non-indicating float type level switches (one for each channel) provide scram discharge volume (SDV) high water level inputs to the four RPS channels.
In addition, a level transmitter and trip tinit for each channel provide redundant SDV high water level inputs to the RPS.
I This arrangement provides diversity, as well as redundancy, to assure that no single event can prevent a scram caused by high SDV water level.
7.2-10
The scram discharge volume high water level trip bypass is controlled by the manual operation of four keylocked bypass switches and the model switch. The mode switch must be in the SHUTDOWN or REFUEL position to allow manual bypass of this trip. This bypass allows the operator to reset the Reactor Protection System scram relays so that the scram 7.2-10a
The sensor test involves applying a test dignal to each RPS sensor or trip unit in turn and observing the trip channel trip results. The test signals can be applied to the processing sensing instrumentation (pressure and differential pressure) through calibration taps.
A test of individual scram discharge volume water level sensors can be performed during full power operation by valving out the sensor and injecting water into a test tap.
At plant snutdown, the level sensors may l
be calibrated by introducing a fixed volume of water into the discharge volume and observing that all_ level sensors operate at the specified trip l
points.
4 During plant operation, the operator can set the turbine stop valve or MSIV closure logic test switch in test position and actuate the other valve which completes the respective channel trip with annunciation and computer logging. The operator can then confirm that the main steam line isolation and turbine stop valve limit switches operate during valve motion, from full open to full closed and vice versa, by comparing the time that the RPS channel trip occurs with the time that the valve position indicator lights in the control room signal that the valve is fully open and fully closed.
This test does not confirm the exact set point, but does provide the operator with an indication that the limit switch operates between the limiting positions of the valve. During reactor shutdown, calibration of the main steam line isolation and turbine stop valve limit switch set point at a valve position of less than or equal to 10 percent closure is possible by physical observation of the valve stem.
During reactor operation, a test and calibration of the individual EHC oil line pressure sensors associated with turbine control valve fast closure when the plant is operating above 40 percent of rated power may be accomplished by valving one sensor out-of-service at a time and introducing l
a test pressure input.
Testing and calibration of the main steam line high rndiation monitors can be performed during full power operation by removing the individual monitors and inserting them into a calibration source.
7.2-28
TABLE 7.2-1 REACTOR PROTECTION SYSTEM INSTRUMENTATION Normal Number Scram Instrument of Function Instrument Range Channels Reactor Vessel Pressure 0-1,500 psig 4
High Pressure Sensor Drywell High Pressure 0-5 psig 4
Pressure Sensor Reactor Vessel Level, 60 in 4
Low Water Sensor Level 3 Reactor Vessel Level 0-60 in 4
High Water Sensor Level 8 Scram Discharge Level 0-150 in H O 4(1) l 2
Volume High Sensor Water Level Turbine Stop Position 0-100%
4(1)
Valve Closure Sensor Turbine Control Pressure 250-3,000 4
Valve Fast Sensor psig Closure i
Main Steam Line Position 0-100%
4(2) l Isolation Valve Sensor l
Closure l
Neutron Monitoring See Section 8
l System 7.6.1.1.5 l
Main Steam Line Gamma 1-106 cpm 4
High Radiation Detector Bvpass Function
[
l Discharge Volume N/A N/A l
High Water Level l
Trip Bypass j
l
[
1 1
7.2-31 l
1 l
l automatically opens if high water level is detected in the suppression pool.
Two level transmitters monitor suppression pool water level and either transmitter can initiate opening of the suppression pool suction valve. To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other closes.
The HPCS provides makeup water to the reactor until the vessel water level reaches the high level trip (trip level 8) at which time the injection valve M0F004 is automatically closed even if a high drywell pressure signal still exists. The pump will continue to run on minimum flow recirculation. The injection valve will automatically reopen if vessel level again drops to the low level (trip level 2) initiation point.
The HPCS pump motor and injection valve are providei with manual override controls. These controls permit the reactor operator to manually control the system following automatic initiation.
7.3.1.1.1.2.
Automatic Depressurization System (ADS) - Instrumentation and Controls a.
ADS System Function The Automatic Depressurization System is designed to provide automatic depressurization of the reactor vessel by activating eight safety relief valves. These valves vent steam to the suppression pool in the event that the HPCS cannot maintain the reactor water level f)llowing a LOCA. ADS I
reduces the reactor pressure so that flow from the RHRS-LPCI mode and LPCS, can inject into the reactor vessel in time to cool the core and limit fuel barrier temperature. Refer also to Section 6.3.2.
Refer to Section 7.6.1.11 for the relief function of the safety relief valves.
1 b.
ADS Operation Schematic arrangements of system mechanical equipment are shown in Figure 5.1-3.
ADS component control logic is shown in Figure 7.3-3.
Elementary diagrams are listed in Section 1.7.1.
Plant layout drawings are shown in Section 1.2.
Operator information displays are shown in Figure 5.1-3 and Figure 7.3-3.
7.3-5 1
~
The following variables provide inputs to the CRVICS logics for initiation of reactor vessel and drywell isolation, as well as the initiation or trip of other plant functions when predetermined limits are exceeded.
Combinations of these variables, as necessary, provide initiation of various isolating and initiating functions as described in Table 6.2-32 and below:
1.
Reactor Vessel Low Water Level A low water level in the reactor vessel could indicate that reactor coolant is being lost through a breach in the reactor coolant pressure boundary and that the core is in danger of becoming overheated as the reactor coolant inventory diminishes.
Reactor vessel low water level initiates closure of various valves.
The closure of these valves is intended to isolate a breach of the pipelines, conserve reactor coolant by closing off process lines, and limit the escape of radioactive materials from the containment through process lines that communicate with the primary coolant boundary or containment.
Reactor vessel water level is monitored by four redundant level transmitters grouped in two sets.
Each instrument provides a low water level input to one of the four CRVICS trip channels.
Three reactor vessel low water level isolation trip settings are used
~
to complete the isolation of the containment and the' reactor vessels.
The first (and highest) level 3 reactor vessel low water level isolation trip setting initiates closure of RHR isoltion valves, the second reactor vessel low water level (level 2) initiates closure of all valves in major process pipeline except the main steam lines and drains the drywell fan cooler cooling water isolation valves and the isolation valves for the MSIVs air supply. The main steam lines are left open to allow the removal of heat from the reactor core. The third, and lowest (level 1) reactor vessel low water level, completes the isolation of the containment and pressure vessel by initiating closure of the main steam line isolation valves, main steam line drain valves, drywell fan cooler cooling water isolation valves and the isolation valves for the MSIVs air supply.
7.3-14
7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.
6.1 DESCRIPTION
Section 7.6 describes the instrumentation and control systems required for safety not discussed in other sections. The systems includes Process Radiation Monitoring System a.
b.
High Pressure / Low Pressure Systems Interlocks c.
Leak Detection System (LDS) d.
Neutron Monitoring System (NMS)-(IRM, LPRM, APRM) e'.
Rod Pattern Control System (RPCS) f.
Recirculation Pump Trip System (RPT) g.
Fuel Pool Cooling System h.
Containment Atmosphere Monitoring System i.
Fuel Handling Area Ventilation System j.
Off-Gas Building Exhaust System k.
Safety Relief Valve-Relief Function 1.
Redundant Reactivity Control System (RRCS) l The sources which supply power to the safety related systems described in this section originate from onsite ac and/or de safety related buses or, as in the case of the fail-safe logic NMS and portions of the LDS, from the non-safety related RPS MG sets.
Refer to Chapter 8 for a complete description of the safety related systems power sources.
7.6.1.1 Process Radiation Monitoring System - Instrumentation and Controls The safety related portions of the process radiation monitoring system are described in Sections 7.2.1 and 7.3.1.
The main steam line and containment ventilation exhaust radiation monitoring systems and all other systems are discussed in Section 11.5.
7.6-1
The current signals from the LPRM detectors are transmitted to the LPRM amplifiers in the control room through coaxial cable. The amplifier is a linear current amplifier whose voltage output is proportional to the current input and therefore proportional to the magnitude of the neutron flux. Low level output signals are provided that are suitable as an input to the computer, recorders, etc.
The output of each LPRM amplifier is isolated to prevent interference of the signal by inadvertent grounding or application of stray voltage at the signal terminal point.
When a central control rod is selected for movement, the output signals from the amplifiers associated with the nearest 16 LPRM detectors are displayed on reactor control panel meter ~s.
The four LPRM detector signals from 'esch of the four LPRM assemblies are displayed on 16 separate meters. The operator can readily obtain readings of all the LPRM amplifiers by selecting the control rods in order.
The trip circuits for the LPRM provide trip signals to activate lights, instrument inoperative signals, and annunciators. These trip cirduits use the 24 Vdc power supply and are set to trip on loss of power. They also trip when power is not available for the LPRM amplifiers. Table 7.6-2 indicates the trips.
Each LPRM channel may be individually bypassed. When the maximum number of bypassed LPRMs associated with any APRM channel has been exceeded, an inoperative trip is generated by that APRM.
Each individual chamber of the assembly is a moisture proof, pressure-sealed unit.
The chambers are designed to operate at 5750 F and 1250 psig.
l The detectors, cables and connectors are designed to remain accurately functional for drywell temperatures up to 3300F and 100 percent relative humidity.
i I
l I
7.6-13 l
1
Power for the LPRM is supplied by the two RPS buses. Approximately half of the LPRMs are supplied from each bus. Each LPRM amplifier has a separate power supply (ICPS) in the control room, which furnishes the detector polarizing potential. This power supp1.y is adjustable from 75 to 200 Vdc.
The maximum current output is three milliamps. This ensures that the chambers can be operated in the saturated region at the maximum specified neutron fluxes. For maximum variation in the input voltage or line frequency, and over extended ranges of temperature and humidity, the output voltage varies no more than two volts. Each page of amplifiers is supplied operating voltages from a separate low voltage power supply.
7.6.1.4.3 Average Power Range Monitor (APRM) a.
APRM Function The function of the APRM is to average signals from the LPRM,
.avide a flow reference reactor scram when neutron flux exceeds predet rm.ed flux.
APRM signal levels are sent to the Redundant Reactivity Control System logic if additional reactivity control is necessary following an ATWS event. The use of this signal is discussed in Section 7.6.1.12.3.5.3.
b.
APRM Operation l
The APRM has eight redundant channels. Each channel uses input signals from l
l a number of LPRM channels. Four APRM channels are associated with each trip system of the RPS.
The APRM channel uses electronic equipment that averages the output signals from a selected set of LPRMs, trip units that actuate automatic devices, and signal readout equipment. Each APRM channel can average the output signals Jcom as many as 24 LPRMs. Assignment of LPRMs to an APRM follows the pattern shown in Figure 7.6-6.
Position A is the bottom position, Positions B and C are above Position A, and Position D is the topmost LPRM detector position. The pattern provides LPRM signals from all four core axial LPRM detector positions.
7.6-14
7.6.1.12 Redundant Reactivity Control System (RRCS) - Instrumentation &
Controls 7.6.1.12.1 RRCS Function The Redundant Reactivity Control System is a system designed to mitigate the potential consequences of an Anticipated Transient Without Scram (ATWS) event.
The system consists of control panels, their associated ATWS detection and actuation logic and the necessary interface logic for those systems required to perform specific functions in response to an ATWS event.
7.6.1.12.2 RRCS Operation and Recirculation Pump Trip (RPT)
The RRCS consists of reactor pressure and reactor water level sensors, solid state logic, control room cabinets and indications, and interfaces with several systems actuated to mitigate an ATWS event (Figure 7.6-8).
The solid state logic is divided into Divisions 1 and 2, each of which is subdivided into Channels A and B.
The logic is energized to trip, and both Channels A and B of either division must be tripped in order to initiate the RRCS protective actions. The system can be manually initiated by depressing two pushbuttons (tripping both Channels A and B) in the same division.
This manual initiation function is designed so that no single operator action can result in an inadvertent initiation. The pushbutton's collar must be rotated to arm the switch before depressing will trip the logic. The manual initiation pushbuttons are located in the control room near the RPS manual scram pushbuttons. There are four RRCS
~
~
manual initiation pushbuttons.
The RRCS sensors monitor reactor dome pressure and reactor water level. The logic will cause the immediate energization of the Alternate Rod Insertion valves when either the reactor vessel high dome pressure trip setpoint or low water level 2 setpoint is reached, or the manual pushbuttons are armed and depressed.
Energization of the RRCS ARI valves depressurizes the scram air header independent of the logic and vent valves of the RPS system (Figure 7.6-9).
The valves are sized to allow insertion of all control rods to begin within 15 seconds.
The RRCS sensors and logic are also designed to automatically initiate the RPT logic whenever the reactor pressure or the reactor water level reaches the RCCS 7.6-27b
sensor settings. The low reactor water level 2 signal will completely trip the Recirculation Pumps by tripping the 13.8 Kv supply breakers and the Low Frequency Motor Genera' tor (LFMG) supply breakers. The high vessel pressure signal will trip the 13.8 Kv supply breakers and transfer the Recirculation Pumps to the LFMC I
sets. The LFMG supply breakers will then be tripped and feedwater runback will be initiated if the APRM upscale remains for 25 seconds. The RPT is a Class lE system. Manual RRCS initiation does not initiate RPT feedwater runback.
The RRCS is continually checked by a solid state microprocessor based self-test system. This self-test system checks the RRCS sensors, logic, protective devices and itself.
Nuclear Boiler System instrumentation is provided to monitor reactor vessel high I
dome pressure and low vessel water level.
The sensors, transducers, and trip units are Class lE, independent from the RPS, and environmentally qualified to j
perform their protective function during ATWS events.
The APRM's provide a downscale trip signal to the RRCS permissive logic. This signal is Class lE and contains all available channels of input. APRM signals from NMS Divisions 1 and 2 are routed to RRCS Division 1 through isolators, and APRM signals from NMS Division 3 and 4 are sent to RRCS Division 2 through isolators (see Figure 7.6-10).
Loss of power to an APRM channel or an APRM INOP condition will result in an RRCS permissive signal. Bypassing an APRM channel will prevent the bypassed APRM's "not downscale" or INOP trip from supplying a permissive.
Each RRCS channel can be manually reset by depressing the RRCS reset pushbuttons (four, one for each tripped channel) provided that ARPM power is downscale and seal-in period has elapsed. When the RRCS is reset the following seal-in signals are broken:
a.
Reactor water cleanup isolation b.
Low water level 2 recirculation trips 7.6-27c
c.
Manual initiation d.
High reactor pressure recirculation trips and feedwater runback signal.
The RRCS ARI function is reset by the RRCS ARI reset pushbuttons. This second set of four pushbuttons (one for each channel) will enable the reset of the ARI logic 30 seconds after initiation of ARI provided that initiating signals have cleared. This 30-second time delay before the ARI reset permissive appears is designed to assure that the RRCS ARI scram goes to completion.
The RRCS is a two-divisional system (Figure 7.6-10).
Separation is; maintained between the redundant portions of the system to assure compliance with the separation and single failure criteria. Two channels in a given division are kept separate until they terminate or a common device. This separation is done to satisfy the single failure criterion. The two divisions of RRCS logic are designed so that either can cause LFMG trip and feedwater runback when a sufficient power reduction has not occurred. There is no RRCS bypass or operating bypass. The RRCS meets IEEE 279-1971 and Regulatory Guide 1.75, Rev. 1.
7.6.1.13 Design Basis The safety related systems described in Section 7.5 are designed to provide timely protective action inputs to other safety systems to protect against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the reactor coolant pressure boundary.
Chapter 15 and Appendix 15A identify and evaluate events that jeopardize the fuel barrier and reactor coolant pressure boundary. The methods of assessing barrier damage and radioactive material releases, along with the methods by which abnormal events are identified, are also presented in Chapter 15.
The station conditions which require protective actions are described in Chapter 15 and Appendix 15A.
7.6-27d
a.
Variables Monitored to Provide Protective Actions The following variables are monitored in order to provide protective action inputs:
1.
High Pressure / Low Pressure Interlocks (a) Reactor pressure 2.
Leak Detection System (a) RCIC area temperatures - differential and ambient (b) RCIC steam line flow rate 7.6-27e
d 8.
Fuel Handling Area Ventilation System (a) Charcoal Filter Inlet Hi Radiation 9.
Off-cas Building Exhaust System This system has no automatic protective actions.,
10.
Safety Relief Valves - Relief Function (a) Reactor Vessel Pressure 11.
Redundant Reactivity Control System (a) Reactor Pressure (b) Reactor Vessel Water Level (c) Reactor Power The plant conditions which require protective action involving the safety related systems discussed in Section 7.6 are described in Chapter 15 and Appendix 15A.
l b.
Location and Minimum Number of Sensors See technical specifications for the minimum number of sensors required to monitor safety related variables. The IRM and LPRM detectors are the only
' sensors which have spatial dependence.
c.
Prudent Operational Limits Operational limits for each safety related variable trip setting are selected with sufficient operating levels so that a spurious safety system initiation is avoided.
It is then verified by analysis that the release of i
7.6-29
d radioactive materials, following postulated gross failurer of the fuel or nuclear system process barrier, is kept within acceptable bounds.
d.
Margin The margin between operational limits and the limiting conditions of operation of the safety related systems are those parameters as '.isted in technical specifications.
e.
Levels Levels requiring protective action are established in technical specifications.
i s
i l
t i
7.6-29a
-~
4.
Fires To protect the safety systems in tha event of a postulated fire, the components have been separated by distance or fire barriers. The use of separation and fire barriers ensures that, even though some portion of the system may be affected, the safety function will not be prevented. See Section 9.5.1.
5.
LOCA The safety related systems components described in Section 7.6 Iccated inside the' drywell and functionally required during and/or 'following a LOCA have been environmentally qualified to remain functional as discussed an Section 3.11.
6.
Pipe Break Outside Containment Protection for these components is described in Section 3.6.
7.
Missiles Protection for safety related components is described in Section 3.5.
h.
Minimum Performance Requirements 4
Minimum performance requirements for safety related systems instrumentation and controls are provided in the technical specifications.
7.6.1.14 Final System Drawings The final system drawings including piping and instrumentation diagrams (P&ID),
functional control diagrams (FCD)/ control logic diagrams and instrument and electrical drawings (IED), have been provided or referenced for the safety related systems in this section.
7.6-31
=
Electrical interconnection and elementary diagrams are listed in Section 1.7.1.
7,6.2 ANALYSIS 7.6.2.1 Safety Related Syste'as - Instrumentation and Controls Chapter 15 evaluates the individual and combined capabilities of the safety related systems described in Section 7.6.
The safety related systems described in Section 7.6 are designed such that a loss of instreament air, a plant load rejection, or a turbine trip will not prevent the completion of the safety function.
i Analysis for Safety Relief valves is covered in ADS analysis in Section 5.2.2.
7.6.2.2 Conformance to 10 CFR 50, Appendix A - General Desian Criteria (GDC)
The following is a discussion of conformance to those General Design Criteria which apply specifically to the safety related systems described in Section 7.6.
Refer to Section 7.1.2.2 for a discussion of General Design Criteria which apply equally to all safety related systems.
j GDC's for the NMS and Process Radiation Monitoring System are discussed in Sections 7.2.2.1 and 7.3.2.1.1.
a.
Criterion 12 - Suppression of Reactor Power Oscillations The NMS provides protective actions to the RPS to assure that fuel design limits are not exceeded.
b.
Criterion 21 The RRCS is designed for high functional reliability and its logic can be tested for the safety functions to be performed. No single failure in this 7.6-32
two divisional, four channel protection system will result in the loss of the protective functions.
c.
Criterion 24 The RRCS protection system interfaces with control systems through isolation devices. Specifically, the RRCS signals to the recirculation system pump and LFMG breakers and the signal to the feedwater system to initiate runback both pass through isolators. This assures that electrical failures in the control systems cannot propagate back into the RRCS system and therefore cannot prevent other channels in the RRCS divisions from performing their protective functions.
d.
Criteria 30, 34, 35 The leak detection system provides means for detecting the source of reactor coolant leakage.
l l
7.6-32a
4.
Equipment Qualification (IEEE Standard 279, Paragraph 4.4)
All safety related equipment as defined in Sections 3.10 and 3.11 is designed to meet its performance requirements under the postulated range of operational and environmental constraints. Detailed discussion of qualification is contained in Sections 3.10 and 3.11.
5.
Channel Integrity (IEEE Standard 279, Paragraph 4.5)
For a discussion of channel integrity for the safety related systems described in Section 7.6 under all extremes of conditions described in Section 7.6.1, refer to Sections 3.10, 3.11,'8.2.1and 8.3.1.
6.
Channel Independence (IEEE Standard 279, Paragraph 4.6)
System channel independence is :naintained by application of the PNPP separation criteria as described in Section 8.3.1.4.
7.
Control and Protection System Interaction (IEEE Standard 279, Paragraph 4.7)
There are no control and protection system ir.;eractions for the systems described in Section 7.6 except for the Redundant Reactivity Control System.
The transmission of signals from RRCS protection system equipment for control system use is aceemplished through isolation devices which are classified as part of the: protection system and meet all the requirements of this stardard. No credible failure at these isolators will prevent the associated protection system channel from meeting its design requirements.
7.6-34
__.m__
13.
Indication of Bypasses (IEEE Standard 279, Paragraph 4.13)
For a discussion of automatic bypass indication for the safety related systems described in Section 7.6, refer to Section 7.1.2.4 (Regulatory Guide 1.47).
14.
Access to Neans for Bypassing (IEEE Standard 279, Paragraph 4.14)
Access to bypassing any safety action or function is under administrative control. The operator is alerted to bypasses as described in Section 7.1.2.4, Regulatory,Cuide 1.47.
The Redundant Reactivity Control System cannot be manually bypassed.
- 15. Multiple Set Points (IEEE Standard 277, Paragraph 4.15)
The Nuclesr Monitoring System has the APRM setdown function wherein the system auto-select a more restrictive scram trip setpoint when the reactor mode switch is not in the run mode. Also, the IRM range switch establishes a more restrictive scram setpoint whenever it is ranged downward, in order to compensate for decreasing neutron flux in the core and to keep the scram trip setpoint within one decade of the actual flux level. The devices used to prevent improper use of less restrictive setpoints are designed in accordance with criteria regarding performance and reliability of protection system equipment.
There are no other multiple setpoints within the safety related systems described in Section 7.6.
16.
Completion of Protective Action Once it is Initiated (IEEE Standard 279, Paragraph 4.16)
Except as indicated below, each control logic for the safety related systems described in Section 7.6 seals-in electrically and remains energized or deenergized. After initial conditions return to normal, deliberate operator action is required to return (reset) the safety system logic to normal.
1 7.6-36 1
..,,.,. ~. _,,,,,.
,. -. _ ~ -.... - - -,,.-
1 d.
Regulatory Guide 1.53 - Application of the Single Failure Criterion to Nuclear. Power Plant Protection Systems See IEEE 279-1971, Paragraph 4.2, Section 7.6.2.3.
e.
Regulatory Guide 1.62 - Manual Initiation of Protective Actions The FPC system is manually initiated from the control room by actuation of system pump and valve controls.
Means are provided for manual initiation of the Redundant Reactivity Control System protective actions. -The alternate tod' insertion function is initiated upon depression of the RRCS manual initiation pushbutton. The RRCS LFMG transfer, recirculation pump trip, and feedwater runback are not initiated by manual initiation of the RRCS. These may be manually initiated at the respective system control panels using system breaker control
]
switches.
7.6-40
tr.
.I 3
,I!
s.
s ea
- g
-re s -
U
.n.,,,e.s 4
Ij l
l-I p:
i e
I 8
II i
)
l 1
l2 a
1 t
I g
I I
I l
a a
d I
O I
1.
5 I
1 i
> I 7
2 i
l
- I 8;i, i
O I-)
O
- s..'
3 n
g og'I g
1 :;S n
30 i
I
/i
't_
1
!.sil!
3 l
1 i 618 is6:!!
h ti I.
i I
l l
i 1
i 1-g i
lb i
l 4
4 4
I;
!=
l'! '; ! i!: i e i;
si it i 1:
I:
nli I'l [i i I
i l
3 I
e f
8 i
I I I
g 7
... ~.
.... ~. -
g-~q.w
.+
g9y-.
y.
re9
,-g--
g.
,d
.,-F+-
3B "A
RRCS DIV 1 ND F 'F162C ' EXH f
s hA RRCS DIV 2 a
ND BACKUP SCR AM ARIVALVES r,F162D '
VALVES-ENERGl2E ENERGlZE TO j,
TO VENT LINE VENT LINE
/
j F110B F110A F160B
-F160A
//
- TO HCU BANK B ND 0 % ssND d %
/sND w1%
// D 0%
si
//
ff YN !!
VN
//
r N
//
VN
//
d[
dl 2l 2lA f7
& TO HCU BANK A I
d p
{
j
{
f NSTRUMENT
/
d )A RRCS OlV 2
/f
/
'/
7 hB m
Fill F161B F161A f
s f
hA RRCS DIV 1 d
d ND ['a r,F162A F094
+
e u
[ y F009A JL fr
/s Q
y
//
[
F159 A
-s N
Y y
m M
a
/
2 r
_z z 00 W
r m -<
C W
P nZ O
Ek F089A i;
33E 2[
2;.
m N
o H
r*
g m
2
-4 4
mm y
v, g
-g F163B a r-E Z
,">2 m
H 1
r, F163A
~ s TD F010 SDV DRAIN VALVE AND F011 SDV VENT VALVE
5 I
.t V.
a
- s a
li!
i:vi 3
4
~
.I "E
g" g g
--E 2,
3 E
t 5
U.
E r
r! 'i dl' y ',l,c!
s ! !l> -
3 3
t p
.. b, i f ih r -
- nr re i
., h n s
n*1
! l-)*! a I
'4 it rIs :
-r e 63 I.;a f * !!$
- ty I
E UIf
- I Il I
gbinJim
. iuillfte
= < < < < < < < <
I gi
! !i 36 I
I I
{ sur j t rus ! >
l 3
i I
i it?! (
i I4I e I
t i
4' iji! !
4
[2 <1 qi e
jI i e
i e
a I
n.i I
,I
-f I
64
+
.b o
E:
C j
3'.
r g
-s s-i
, _f *h. r= '" I
.)k!
l i[35
,.!i r=-
).
i
.i N _-
V 4d l,.
w..,
m,
-- - A
- l. _
i i
l ix f
_.. a!p.! ---..e i e..
i
+
.=
..L.L J y
i
!~~.
~
f : :*"* r.
j.
@I-
,.- - t 'I,
.s i
e e
I
<, {.;. hLD 3
JE 3
l a
l i
!,l i ;
i 4
.i.
e l
t ! l!,% i
- -)
a 5
N f-1J N<
4 l
! i It
.4 s.. ~...
~.
IIQ
~d;. a, m:pd ~q.!LIU ii.~ ii.'.i.
!jVj
-t I
,---- i G I
w.a I' i;t..
1 i
n.
n-
.,c.
4 h
" ~ - 'r: }
..y._..
~ d
- -Y k!~;- --
r--
N.! !
j Q
l3 lN.
E.'
's 4
i:! :
't y k.II.
14 8 u
.i.l..
ici ji g
m m -
i.
d
,p 9
.-w 9
.s-..
~
.s
=>
s N
s N
qs s
e o,W' 2
s.-
normal plant electrica - p5wer supply.. As the pump / motor speed approaches rated full load speed, it is' automatically tripped. When-the pump / motor speed coastdown is'about 25 percent of rated full load speed,.' the pump / motor will be,reenergized from the LFMG set and driven at about 25 percent rated full load speed.
Preceding initiation of the pump / motor, th$ plant operator may manually start the LFMG set.
If the s
s
^
LFMG set is not operating when the pump / motor itart is initiated, the s
LFMG will be automatically started.
)
i If pump / motor st'a c is intiated at higher reactor power levels, the LFMG set will not start automatically, and the pump / motor'will ec-*inur to operate at rated full load speed.
-Q Certain triffunctiond, as shown in Figure 7.7-4, will trip the pump / motor and automatically transfer it to the LFMG set.
Other trip-functions will trip the pump / motor without transfer to the LFMG set.
In addition to the normal drive motor trips, a high vessel pressure or
~
s low vessel level signals from the Redundant Reactivity Control System, Section 7.6.1.12, will initiate a recirculation pump motor trip. Each trip sensor and channel is separate and independent from the reactor protection system, and includes a testability feature that will allow.
testing of each trip sensor while the recirculation system is in s -
operation.
The abnormal position-of the test switch is annunciated.
2.
Low-Frequency Motor-Generator (LI$0) Set
.c The LFMG set consists of a 16 pole a-c induction mon [(c'iving a 4 pole a-c synchronous generator. This arrangement provides one-fourth normal plant frequency at the output of the generator.
The generator exciter is directly connected to generator to provide a brushless' excitation system.
The voltage regulator for the excitation system is located in the auxiliary relay panel which is separate from the LFMG set.
7.7-20
A The feedwater flow control instrumentation measures the water level in the reactor vessel, the feedwater flow rate into the reactor vessel, and the steam flow rate from the reactor vessel. During automatic operation, these three measurements are used for controlling feedwater flow.
The optimum reactor vessel water level is determined by the requirements of the steam separators. The separators limit water carry-over in the steam going to the turbines and limit steam carry under-in water returning to the core. The water level in the reactor vessel is maintained within 12 in, of the setpoint value decing normal operation and within the high and low level trip setpoints during normal plant maneavering transients. This control capability is cchieved during plant maneuvering transients.
This control capability is achieved during plant load changes by balancing the mass flow rate of feedwater to the reactor vessel with the steam flow from the reactor vessel.
The Redundant Reactivity Control System in its automatic mode can initiate a feedwater runback, reducing flow to O percent within 15 seconds. This runback is independent of the feedwater control operating mode, and overrides the loss-of-signal interlock which prohibits change of feedpump output under loss of control signal conditions. Control of the feedwater system can be regained by the operator 30 seconds after the runback begins.
This runback is discussed in Section 7.6.1.12.
ATWS alarm lights are provided on the front of the feedwater control panel.
The following is a discussion of the variables sensed for system operation:
1.
Reactor Vessel Water Level Reactor vessel narrow range water level is measured by three identical, independent sensing systems.
For each channel, a differential pressure transmitter senses the difference between the pressure caused by a constant reference column of water and the pressure caused by the variable height of water in the reactor vessel. The differential pressure transmitter is installed on lines that serve other systems.
7.7-26 a
l Two of the differential pressure signals are used for indication and control and the third for indication only.
The narrow range level signal from one of the two control channels can be selected by the operator as the signal to be used for feedwater control. A third narrow range level sensing channel is used in conjunction with the two control channels to provide failure tolerant trips of the main turbine and feed pump prime movers. All three narrow range reactor level signals and reactor pressure are in:licated in the control room. A fourth level sensing system (wide range) provides level information i
l l
7.7-26a
- f a
9.3.5 STANDBY LIQUID CONTROL (SLC) SYSTEM 9.3.5.1 Design Bases 9.3.5.1.1 Safety Design Bases The standby liquid control (SLC) system has a safety related function and is designed as a Seismic Category I system.
It will meet the following safety design bases:
Backup capability for reactivity control is provided, independent of a.
~
normal reactivity control provisions in the nuclear reactor, to be able to shut down the reactor if the normal control ever becomes inoperative.
b.
The backup system has the capacity for controlling the reactivity difference between the steady-state rated operating condition of the reactor with voids and the cold shutdown condition, including shutdown
.1 margin, to assure complete shutdown from the most reactive condition at any time in core life.
The time required for actuation and effectiveness of the backup control c.
is consistent with the nuclear reactivity rate of change predicted l
between rated operating and cold shutdown conditions. A fast scram of the reactor or operational control of fast reactivity transients is not specified to be accomplished by this system.
However, its performance also ensures compliance with criteria imposed for postulated anticipated transients without scram.
i d.
Means are provided by which.ne functional performance capability of the backup control system components can be verified periodically under conditions approaching actual use requirements.
Demineralized water, I'
rather than the actual neutron absorber solution, can be injected into the reactor to test the operation of all components of the redundant
(
l control system.
l l
9.3-18
The neutron absorber will be dispersed within the reactor core in e.
sufficient quantity to provide a reasonable margin for leakage or imperfect mixing.
f.
The system is reliable to a degree consistent with its role as a special safety system; the possibility of unintentional or accidental shutdown of the reactor by this system is minimized.
9.3.5.2
System Description
The standby liquid control system (see Figure 9.3-19) is manually initiated in the main control room to pump a boron neutron absorber solution into the reactor if the operator determines the reactor cannot be shut down or kept shut down with the control rods. Once the operator decision for initiation of the SLC system is made, the design intent is to simplify the manual process by providing a keylocked switch. This prevents inadvertent injection of neutron absorber by the SLC system. However, the reactor scram function of the Control Rod Drive system (Section 4.6.1.1.2.5) backed up by the Alternate Rod Insertion function is expected to assure prompt shutdown of the reactor when required.
A keylocked switch for each pump provided in the control room to assure positive action from the main control room should the need arise.
Procedural controls are applied to the operation of the keylocked control room switches.
The SLC system is needed only in the improbable event that not enough control rods can be inserted in the reactor core to accomplish shutdown and cooldown in the normal manner.
The boron solution tank, the test water tank, the two positive displacement pumps, the two explosive valves, the two motor operated tank shutoff valves, and associated local valves and controls are located in the containment. The solution is pumped into the HPCS piping downstream of a check valve.
It enters the reactor vessel and is discharged from the HPCS core spray spargers radially over the top of the core (see Section 6.3.2 for a description of the HPCS system design) so that it mixes with the cooling water rising through the core (see Sections 5.3, 3.9.3 and 3.9.5).
9.3-19
The bcron absorbs thermal neutrons and thereby terminates the nuclear fission chain reaction in the uranium fuel.
The specified neutron absorber solution is sodium pentaborate (Na2 10 16 10H O).
It is prepared by dissolving stoichiometric quantities of B 0 2
borax and boric acid in demineralized water. An air sparger is provided in the tank for mixing. To prevent system plugging, the tank outlet is raised above the bottom of the tank.
In operating states, when it is possible to make the reactor critical, the SLC system will be able to deliver enough sodium pentaborate solution into the reactor (see Figure 9.3-20) to assure reactor shutdown. This is accomplished by placing sodium pentaborate solution in the SLC tank and filling with demineralized water to at least the low level alarm point. The solution can be diluted with water to within six inches of the overflow level volume to allow for evaporation losses or to lower the saturation temperature. A boron solution mixing tank is provided outside containment to permit preparation of additional batches for transfer into the SLCS storage tank within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, if needed.
The minimum temperature of the fluid in the tank and piping will be consistent with that obtained from Figure 9.3-20 for the solution temperature. The saturation temperature of the recommended solution is 590F at the low level alarm volume and a lower temperature at six inches below the tank overflow volume. The' equipment cantaining the solution is installed in a room in which the air temperature is to be maintained within the range of 700 to 1000F. An electrical resistance heater system provides a backup heat source which maintains the solution temperature at 750F (automatic operation) to 850F (automatic shutoff) to prevent precipitation of the sodium pentaborate from the solution during storage. High or low temperature, or high or low liquid level, causes an alarm in the control room.
There are two pumps for boron solution injection in the SLCS operation. Each positive displacement pump is sized to inject 43 gpm of solution into the reactor.
9.3-20
The pump and system design pressure between the explosive valves and the pump discharge is 1,400 psig. The two relief valves are set slightly under 1,400 psig. To prevent bypass flow from one pump in case of relief valve failure in the line from the other pump, a check valve is installed downstream of each relief valve line in the pump discharge pipe.
l 9.3-20a
The minimum average concentration of natural boron required in the reactor core to provide adequate shutdown margin, after operation of the SLC system, is 660 ppm (parts per million). Calculation of the minimum quantity of sodium pentaborate to be injected into the reactor is based on the required 660 ppm average concentration in the reactor coolant including recirculation loops, at 680F and reactor water level at level 8.
This result is increased by l
25 percent to allow for imperfect mixing and leakage. Additional sodium pentaborate is provided to accommodate dilution by the RHR system in the shutdown cooling mode.
This concentration will be achieved if the solution is prepared as defined in Section 9.3.5.2 and maintained above saturation temperature. The storage tank is located in an area where the minimum environmental temperature is 700F.
Cooldown of the nuclear system will require cpproximately 6 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> depending on the use of main condenser and various shutdown cooling systems to remove the thermal energy stored in the reactor, cooling water, and associated equipment. The controlled limit for the reactor vessel cooldown is 1000F per hour, and normal operating temperature is approximately 5500F.
The SLC system equipment essential for injection of neutron absorber solution into the reactor is designed as Seismic Category I for withstanding the specified earthquake loadings (see Section 3.8).
The system piping and equipment are designed, installed, and tested in accordance with requirements stated in Section 3.6.
9.3-23
only required under an extremely low probability event where all of the control rods are assumed to be inoperable while the reactor is at normal full power operation. Therefore, the protection provided is considered over and above that required to meet the intent of APCSB 3-1 and MEB 3-1.
This system is used in special plant capability demonstration events cited in Appendix A of Chapter 15, specifically Events 51, 52, and 53, which are extremely low probability non-design basis postulated incidents. The analyses given there demonstrate additional plant safety consideration far beyond conservative assumptions.
9.3.5.4 Inspection and Testing Requirements Operational testing of the SLC system is performed in at least two parts to avoid inadvertently injecting boron into the reactor.
With the valves to the reactor and from the storage tank closed and the valves to and from the test tank opened, demineralized water in the test tank can be recirculate 6 by locally starting either pump from the local rack. This test can be accomplished with the reactor operating without affecting the ability of the other pump to inject borated water in response to an initiation signal.
During a refueling or maintenance outage, the injection portion of the system
'can be functionally tes'ted.by valving the suction line to the test tank and actuating the system from the control room.
System operation is indicated in the control room.
After functional tests, the iajection valve shear plugs and explosive charges must be replaced and all the valves returned to the normal positions as indicated in Figure 9.3-19.
9.3-27
i After closing a local locked-open valve to the teactor, leakage through the injection valves can be detected by opening valves at a test connection in the line between the isolation check valves. Position indicator lights in the T
9.3-27a
MASTER TABLE OF CONTFNTS (Continued)
Section Title Pane 15.7.4 FUEL HANDLING ACCIDENT OUTSIDE CONTAINMENT 15.7-21 15.7.5 SPENT FUEL CASK DROP ACCIDENTS 15.7-30 15.7.6 FUEL HANDLING ACCIDENT INSIDE CONTAINMENT 15.7-31 15.
7.7 REFERENCES
FOR SECTION 15.7 15.7-38 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS) 15.8-1 15.8.1 CAPABILITIES OF PRESENT BWR DESIGN TO ACCOMMODATE ATWS 15.8-1 APPENDIX 15A PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS APP. 15A TAB APPENDIX 15B CENERIC ROD WITHDRAWAL ERROR ANALYSIS APP. 15B TAB APPENDIX 15C ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)
APP.15CTABl 16.0 TECHNICAL SPECIFICATIONS 16.0-1 17.2 CUALITY ASSURANCE DURING THE OPERATIONS PHASE 17.2-1 17.2.1 ORGANIZATION 17.2-1 l
17.2.2 QUALITY ASSURANCE PROGRAM 17.2-15 17.2.3 DESICN CONTROL 17.2-19 17.2.4 PROCUREMENT DOCUMENT CONTROL 17.2-22 17.2.5 INSTRUCTIONS, PROCEDURES AND DRAWINGS 17.2-25 17.2.6 DOCUMENT CONTROL 17.2-28 l
17.2.7 CONTROL OF PURCHASED MATERIAL, EQUIPMENT l
AND SERVICES 17.2-31 17.2.8 IDENTIFICATION AND CONTROL OF MATERIALS,
(
PARTS, AND COMPONENTS 17.2-39 17.2.9 CONTROL OF SPECIAL PROCESSES 17.2-40 17.2.10 INSPECTION 17.2-43 l
t 17.2.11 TEST CONTROL 17.2-46 I
i l
XXV
TABLE OF CONTENTS (Continued)
Section Title Page 15.7.4 FUEL HANDLING ACCIDENT OUTSIDE CONTAINMENT 15.7-21 15.7.4.1 Identification of Causes and Frequency Classification 15 7-21 15.7.4.2 Sequence of Events and Systems Operation 15.7-21 15.7.4.3 Core and System Performance 15.7-23 15.7.4.4 Barrier Performance 15.7-27 15.7.4.5 Radiological Consequences 15.7-28 15.7.5 SPENT FUEL CASK DROP ACCIDENTS 15.7-30 15.7.5.1 Cask Drop from Transport Vehicle 15.7-30 15.7.5,.2
. Cask Drop from Crane 15 7-31 15.7.6 FUEL HANDLING ACCIDENT INSIDE CONTAINMENT 15.7-31 15.7.6.1 Identification of Causes and Frequency Classification 15.7-31 15.7.6.2 Sequence of Events and Systems Operations 15.7-32 15.7.6.3 Core and System Performance 15.7-33 15.7.6.4 Radiological Consequences 15.7-33 15.
7.7 REFERENCES
FOR SECTION 15.7 15.7-38 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS) 15.8-1 15.8.1 CAPABILITIES OF PRESENT BWR DESIGN TO ACCOMMODATE ATWS 15.8-1 APPENDIX 15A PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS APP.15A TAB APPENDIX 15B GENERIC ROD WITHDRAWAL ERROR ANALYSIS APP.15B TAB APPENDIX 15C ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)
APP.15C TAB 1
l i
15-viii
15.8 OTHER TRANSIENTS The NRC is considering means to reduce future risk to the public from a postulated event of no reactor scram following an anticipated transient, i e.,
an ATWS.
The design of PNPP meets the design philosophy of Title 10 of the Code of Federal Regulations. However, the postulation of the " normal scram" failure of the ATWS can only be deduced if more than one " single failure criteria" is assumed. This philosophy of more than one " single failure criteria" is clearly beyond the spirit of 10 CFR 50 and the design basis events discussed in. Chapter.15. Consequently, the discussion of'ATWS (a beyond-design-basis- '
transient event) is discussed in Appendix 15C.
15.8-1
EVENT.47 REACTOR SHUTDOWN-FROM ANTICIPATED l
TR ANSIENT WITHOUT SCRAM STATES B, C, i
l STATES B. D STATES C,0 l j
I REACTOR ISOLATED FROM REACTOR p
PRESSURE MAIN CONDENSER TRANSFER CECAY HEAT RELIEF PROTECTION l
TO SUPPRESSION POOL SYSTEM CONTROL SYSTEM SYSTEM P
I I
l l
l
- - - ~
INCIDENT START HPCS, STANDBY RCf C SYSTEM DETECTION LIQUID ON LOW WATER NN CIRCUITRY CONTROL SYSTEM
' LEVEL RELIEF P
I I
MAINTAIN LIQUID RCICS
=
I I
h
(
[
RHRS-SHUTDOWN
(
PLANNED OPER ATIONS I
COOLING MODE n
CONTINUE SHUTDOWN Ykn' COOLING R H RS-SUPPR ESSION REMOVE DECAY P
Q o
POOL
_ HEAT FROM S$E m
COOLING MODE SUPPRESSION mN
$$n POOL p
C D
Q., p.
"mM M
rt O <
C OZ I
O
_gC grc l
hEh b
H M
CORE COOLING bM$
dE 5 1,$
6 888
=
o i
n D
n Ch4",
IR*
8,0. 8
- E;!!
o h
i 4
2 Q.
i i
APPENDIX 15C ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)
v, APPENDIX 15C TABLE OF CONTENTS Section Title Page 15C ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS) 15C-1 15C.1 IDENTIFICATION OF CAUSES 15C-1 15C.2 FREOUENCY CLASSIFICATION 15C-1 15C.3 SAFETY CRITERIA 15C-2 15C.4 INITIAL CONDITIONS CCMMON TO ALL EXAMINED CASES 15C-3 15C.5 DESCRIPTION OF SYSTEM AND EQUIPMENT DESICN EXCLUSIVELY FOR ATWS PREVENTION AND MITICATION 15C-3 15C.6 SCRAM DISCHARCE VOLUME MODIFICATIONS 15C-6 15C.7 ATWS EVENT AND RESULTS 15C-6 15C.7.2 SEQUENCE OF EVENTS FOR MSIV CLOSURE 15C-8 15C.7.3 SEQUENCE OF EVENTS FOR PRESSURE REGULATOR FAILURE - MAXIMUM DEMAND 15C-8 15C.7.4 SEQUENCE OF EVENTS FOR LOSS OF NORMAL A-C POWER 15C-8 15C.7.5 SEQUENCE OF EVENTS OF INADVERTENT OPEN RELIEF VALVE 15C-9 15C.7.6 SEQUENCE OF EVENTS FOR TURBINE TRIP 15C-9 15C.8 CONCLUSIONS 15C-9 15C-i
LIST OF TABLES Table Title Page 15C-1 Initial Operating' Conditions 15C-10 15C-2 Equipment Performance Characteristics 15C-11 15C-3 Perry MSIV Closure Without ARI 15C-13 15C-4 Perry Pressure Regulator Failure -
Maximum Steam Demand Without ARI 15C-14 15C-5 Perry Loss of Normal A-C Power Without ARI 15C-16 15C-6 Perry Inadvertent Opening of a Relief Valve Without ARI 15C-18 15C-7 Perry Turbine Trip Event Without ARI 15C-19 15C-8 Summary of AWTS Results - Perry, Base Cases Without ARI 2 Pump SLCS, For Manual SLCS Initiation 15C-20 I
i e
i 15C-ii I
m.
l
'l -
LIST OF FIGURES Figure Title
. 15C-2 Pressure Regulator Failure - Open 15C-3 Loss of Auxiliary Power 15C-4 Inadvertent Open of a Relief Valve 15C-5 Turbine Trip i
k i
i e
i 4
1 4
4
.i 15C-iii i.
~
l 1
)
15C ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)
The Nuclear Regulatory Commission is considering how to reduce the future risk to the public resulting from the postulated event of no reactor scram following an anticipated trartsient, i.e., an ATWS. The probability of an ATWS l
has been assessed to be significantly less than the probability of a design 1
basis event. NRC still requires the recirculation pump trip (RPT) feature for BWR. Detail discussion of this subject and a generic assessment of BWR mitigation of ATWS has been analyzed in depth in CE topical report NEDO-24222,
)
" Assessment of BWR Mitigation of ATWS".
Plant requirements for ATWS in addition to RPT have been discussed and proposed to NRC for their review. It is not clear what, if any, additional requirements will result from the review. Since Perry's construction condition and schedule do not warrant further delay, CEI voluntarily coaunits to implement design improvements such as the automatic Recirculation Pump Trip (RPT), Alternate Rod Insertion (ARI),
manual 86 CPM Standby Liquid Control System (SLCS) and others described in this section for the prevention and mitigation of ATWS.
15C.1 IDENTIFICATION OF CAUSES The BWR scram systems are highly reliably and redundant. They have been constantly improved over the years to ensure that the control rods will be inserted upon demand under all conditions of operation. Therefore, the only postulated failure to scram would be an unforeseen, undetected simultaneous failure in the scram function resulting in a significant number of control rods failing to insert into the core upon demand. Furthermore, consequences of concern will only occur if this failure to scram is combined simultaneously with a few particular plant transients. These particular plant f
l transients are also rare.
15C.2 FREQUENCY CLASSIFICATION l
l The probability of an ATWS event is extremely remote. An ATWS event has never happened.
1 15C-1 I
15C.3 SAFETY CRITERIA The equipment described in Section 15C.5 was designed to meet the following consequence criteria for an ATWS event.
1.
Primary System The calculated reactor coolant boundary transient pressure is to be limited such that the maximum primary stress anywhere in the boundary is no greater than that permitted by Level C Service Limits as defined in the ASME Code,Section III.
Piping components (e.g., pumps and valves) shall maintain structural integrity. Those components whose operation is required during or after the transient shall have the needed functional capability under the appropriate ATWS conditions.
2.
Fuel There must not be damage to the reactor fuel to the extent which would prevent long-term core cooling. Specifically, the coolable geometry shall be maintained with realistic assumptions in demonstrating how the fuel meets these criteria.
l 3.
Containment t
The calculated maximum containment pressure and temperature shall not exceed the design values. Furthermore, the BWR suppression pool temperatures shall also be limited to acceptable levels.
4.
Long-Term Shutdown Cooling i
The plant must be able to return to a safe cold shutdown condition without dependence upon control rod insertion and to maintain a cold shutdown condition indefinitely.
.. - _ -. _ _ _ _ - _ = _ _ - _ -.., _ _ _
5.
Radiological The calculated release of radioactivity from the fuel rods to the reactor coolant system must not exceed ten percent of the total radioactivity within the fuel rods.
15C.4 INITIAL CONDITIONS COMMON TO ALL EXAMINED CASES The ATWS analyses of Section 15C.7 use initial conditions that correspond to normal operation at 100 percent power.
They are shown in Table 15C-2.
15C.5 DESCRIPTION OF SYSTEM AND EQUIPMENT DESIGN EXCLUSIVELY FOR ATWS PREVENTION AND MITICATION The following is a summary of plant system and equipment design added or modified exclusively for the mitigation of an ATWS event.
The scram discharge volume design has also been modified to minimize ATWS probability (see Section 15C.6).
I.
The Redundant Reactivity Control System (RRCS)
The Redundant Reactivity Control System (RRCS) is the system which controls ATWS mitigation. This system consists of associated ATWS detection sensors (4 RPV dome high pressure sensors and 4 low vessel water level sensors) and 'the actuation logic to automatically initiate Alternate Rod Insertion (ARI), Recirculation Pump Trip (RPT), and Feedwater Runback.
I The ATWS detection sensors will also provide indication and alarm in the control room for the operator's action.
The RRCS is activated by either of the two divisions of the ATWS detection sensors which are independent from the ones used in RPS. The RRCS logic uses APRM signals (not downscale) following a time delay as confirmation of an ATWS event.
15C-3 l
l t
The RRCS design shall:
1.
Be Class IE, be electrically diverse from RPS, and meet IEEE-279.
2.
Meet IEEE 323-1974 and IEEE 344-1975, or be consistent with existing plant design requirements.
3.
Have manual initiation switches separate from the manual scram switches.
a.
Alternate Rod Insertion (ARI)
The function of the alternate rod insertion (ARI) system is to provide an electrically diverse scram logic to blow down the scram discharge air header through valves separate from the reactor protection system (RPS) scram valves, thereby providing a parallel path for control rod insertion. ARI consists of the redundant scram air header valves which are actuated by the ATWS detection sensors of the RRCS logic.
The ARI design shall:
1.
Require class IE d-c power; 2.
Be' Class IE and meet IEEE-279;
~
3.
Be independent from the plant RPS.
b.
Recirculation Pump Trip (RPT)
The recirculation pump motors are to be tripped by ATWS detection sensors of the RRCS logic. The purpose of the RPT design is to reduce thermal power level and limit pressure rise in the reactor vessel.
l l
l 15C-4
The RPT design shall:
1.
Meet IEEE 323-1974 and 344-1975, or be consistent with existing plant design requirements; 2.
Meet IEEE 279, 379 and 384 (except for the Low Frequency Motor /
Cenerator breakers);
3.
Provide for inservice testability (except for action of fina't breakers).
c.
Feedwater Runback Upon the receipt of a high pressure signal from the RRCS logic including confirmation of no-scram, feedwater flow is to be limited, thereby reducing power and steam discharge to the suppression pool.
The feedwater runback design shall:
1.
Use control grade equipment, and 2.
Provide manual operation override to allow an increase in feedwater flow, if needed and available.
II.
Standby Liquid Control System The standby liquid control system (SLCS) action is to be initiated manually a failure to scram condition in accordance with Emergency Instructions.
Simultanecas operation of both pumps at full capacity (86 gpm total) will control the nuclear fission chain reaction and thereby maintain suppression pool temperatures within specified limits.
The SLCS design shall:
1.
Provide a manual sodium pentaborate solution injection function for both loops simultaneously operated only from the Control Room; 15C-5
2.
Provide for replenishment capability of the SLCS tank with mixed sodium pentaborate solution from outside the containment; 3.
Provide capability for periodic functional tests; 4.
Assure that no single active logic component failure can prevent its function; and 5.
Meet IEEE 323-1974 and 344-1975 or be consistent with existing plant design requirements.
15C.6 SCRAM DISCHARGE VOLUME MODIFICATIONS Additionally, control rod drive system scram discharge volume shall be modified to minimize the potential for failure of the scram function from unavailability of this volume. The design modification will consist of the addition of redundant instrument volume water level sensors to the control rod drive hydraulic system and instrument line piping modifications. The design change shall:
a.
Provide redundant lE sensors; b.
Provide redundant vent and drain valves.
15C.7 ATWS EVENT dND RESULTS' In order to study the reactor responses with the injection of the boron solution, the Alternate Rod Insertion (ARI) is deliberately ignored in this study, because with ARI, there is no need for boron injection.
Consequently, five anticipated events are selected as initiative transients since they can result in highest responses in comparison with the safety criteria. These initiating transients are:
a.
MSIV Closure Event - This transient when coupled with postulated normal scram system failure produces high RPV pressure, heat flux and suppression pool water temperature.
b.
Pressure Regulatory Failure, maximum demand - This transient, when coupled with postulated normal scram failure proceduces high RPV pressure, heat flux and suppression pool water temperature.
c.
Loss of Normal a-c Power - This transient, when coupled with postulated normal scram system failure, may produce high RPV pressure and suppression pool water temperature.
d.
Inadvertent opening of an S/R Valve - This transient, when coupled with postulated normal scram system failure, may produce the highest suppression pool veter temperature.
e.
Turbine Trip with Bypass - This transient is chosen because this is a reasonably probable and likely transient among the five transients chosen here. This transient, when coupled with postulated normal scram system failure, generally produces mild responses.
It is important to reiterate that the following results given in this study are purely hypothetical in the fact that ARI is ignored.
Since ARI is designed to provide an electrically diverse scram logic from normal scram logic, the ARI should have successfully inserted the control rods into the reactor if the normal scram logic is postulated to have failed.
15C.7.1 INITIAL CONDITIONS, AND PERFORMANCE CHARACTERISTICS USED IN ATWS ANALYSES (ARI IS INTENTIONALLY IGNORED)
Initital operating conditions used in the ATWS analyses for the Perry Nuclear Power Plant are listed in Table 15C-1.
They represent nominal and realistic settings / conditions even though the postulated conditions resulting in the ATWS events are totally unrealistic. The characteristics of the important equipment used to mitigate the consequences of the scram system failure are listed in Table 15C-2.
In all the transients analyzed and discussed hereafter, the scram system is postulated to have failed and ARI capability is not taken into account. The operators in the control room are assumed to activate the SLCS promptly 15C-7
following the postulated event based on information available from the APRM's, ATWS signals of the RRCS logic, and the Plant Emergency Instructions. For analysis purposes, it was assumed SLCS was activated within 2 minutes.
Sensitivity studies have shown that initiation within 4 minutes will provide adequate mitigation of the consequence of postulated ATWS events to meet the design criteria in Section 15C.3.
15C.7.2 SEQUENCE OF EVENTS FOR MSIV CLOSURE The sequence of events following MSIV closure is given in Table 15C-3.
In this event, all main steam lines are assumed to isolate starting from rated power condition with nominal valve closure speed (4 seconds).
Figure 15C-1 shows the case in which the normal scram system is postulated to fail, and the SLCS is manually initiated to shut down the plant. The scenario of this event is similar to that which is discussed in Section 3.3.1 of NEDO-24222, Volume II.
The result of this study is summarized in Table 15C-8.
15C.7.3 SEQUENCE OF EVENTS FOR PRESSURE RECULATOR FAILURE - MAXIMUM DEMAND The sequence of events following this pressure regulator failure is given in Table 15C-4.
Figure 15C-2 shows the initial portions of the event. When the scram system is postulated to fail, the SLCS is manually initiated to shut the reactor down. The scenario of this event is similar to that which is discussed in Section 3.3.9 of NEDO-24222, Volume II.
The result of this study is summarized in Table 15C-8.
15C.7.4 SEQUENCE OF EVENTS FOR LOSS OF NORMAL A-C POWER The listing of significant events during this event is provided in Table 15C-5.
There are two ways of initiating this event. These are loss of all auxiliary power transformers and loss of all grid connections. The main difference between the two approaches is that, in the latter, load rejection occurs at the outset of the transient which results in turbine generator trip.
In either case, MSIV closure takes place near 2 seconds. This is the earliest time isolation can occur and is based on relay-type RPS circuitry.
Since in 15C-8
loss of all grid connections the turbine trips first as opposed to MSIV closure in the loss of all auxiliary power transformers case, it turns out to Fi~ure 15C-3 be a less severe event in tarms of peak power and pressure.
g shows the cases of loss of all auxiliary power transformers. The scenario of this event is similar to that which is discussed in Section 3.3.11 of NEDO-24222, Volume II.
The result of this study is summarized in Table 15C-8.
15C.7.5 SEQUENCE OF EVENTS OF INADVERTENT OPEN RELIEF VALVE This event begins when one of the primary relief valves on the main steamlines inadvartently opens without influence from any other portion of the system.
All pressure levels in the reactoe coolant pressure boundary are at a nominal value prior to the event. The resulting sequence of events is shown in Table 15C-6.
The response of this transient is shown in Figure 15C-4.
The scenario of this event is similar to that which is discussed in Section 3.3.3 of NEDO-24222, Volume II.
The result of this study is summarized in Table 15C-8.
4 15C.7.6 SEQUENCE OF EVENTS FOR TURBINE TRIP The listi..g of significant events during this ATWS event is provided in Table 15C-7.
This abnormal transient event starts with an unexpected closure of all turbine stop valves (within about 0.1 second). Figure 15C-5 shows the case in which the SLCS is manually initiated to shut down the reactor. The 4
scenario of this event is similar to that which is discussed in Section 3.3.2 of NEDO-24222, Volume II.
The result of this study is summarized in Table 15C-8.
15C.8 CONCLUSIONS The Perry unique study presented here, along with the generic and parametric studies given in NEDO-24222 have shown that, with the implementation of the ATWS equipment committed by CEI, PNPP can withstand the consequence of an ATWS and still meet the safety criteria in Section 15C.3 even with the ARI ignored.
The summary of the ATWS study cases and results is given in Table 15C-8.
15C-9
J TABLE 15C-1 INITIAL OPERATING CONDITIONS Parameter Perry Dome Pressure (psig) 1025 Core Flow (MLB/h) (% NBR) 104.0/100 Average Flow / Bundle 0.139 (MLB/h-bundle)
Representative Vessel Diameter (in) 238 Representative Fuel Bundles 748 Power (Mwt)/(% NBR) 3579/100 Average Steam / Feed Flow per Bundle (1b/sec-bundle) 5.719 Initial Water Level (ft above Separator Skirt) 2.2 Initial Vessel Inventory (ibs/ full NBR FW Flow-Min) 616,300/2.40 Feedwater Temperature (O F) 420 Void Reactivity Coefficient (C/%)
-11 Doppler Coefficient (C/0 F)
-0.28 Sodium Pentaborate Solution Concentration in the Storage
>12 Tank (% by Weight) l Suppression Pool Volume (ft3)/(Full NBR Flow-Min) 117,105/28.5 Initial Suppession Pool Temperature (O F) 75 Condensate Storage Volume (Gal)/ Minutes of Rated Steamflow) 1,500,000/4.87 Condensate Storage Temperature (O F) 120 Service Water Temperature (O F) 70 Core Average Active Void Fraction (%)
42.0 15C-10
TABLE 15C-2 EQUIPMENT PERFORMANCE CHARACTERISTICS Parameter Perry Closure Time or MSIV (sec) 4 Relief Valve System Capacity (% NBR Steam Flow)/No. of 101.4/19 Valves)
Relief Valve Setpoint Range (psig) 1133/1153 Relief Valve and Sensor Time Delay (sec) 0.15 Relief Valve Closure Time Constant (sec) 0.2 Control Liquid Pump Start and Transport Time 30/30 (sec)/ Control Liquid Delay Inside Vessel (sec)
Control Liquid Injection Rate - Number % Flow per Pump 2x43/0.28 (gpm)/(% NER steamflow)
HPCS/RCIC Low Water Level Initiation Setpoint Level 2 HPCS Start Time (sec) 20 HPCS/RCIC High Water Level Shutoff Setpoint Level 8 HPCS Flow Rate (lb/sec/(% NBR Steam Flow) 362/8.46 RCIC Start Time (sec) 20 RCIC Flow Rate (ib/sec)/% NBR Steam Flow) 98.0/2.29 ATWS High Pressure RPT Setponit (psig) 1113
(
ATWS Dome Pressure Sensor and Logic Time Delay (sec) 0.53 I
ATWS Low Water Level RPT Setpoint Level 2 Recirculation Pump System Inertia Constant (sec) 5,5.1 Delay Before Start of ARI Control Rod Insertion (sec) 5,15 Control Rod Insertion Time During ARI (sec) 10 l
Time of Completed Feedwater Limit Action or Flow Shutoff 40 l
After Isolation (sec)
RHR Pool Cooling Capacity (BTU /sec 0 F)/(% NBR at 880/2.59 1000 F AT) 15C-11
TABLE 15C-2 (Cont'd)
Parameter Perry Water Level Setpoint Apove Which RHR Pool Cooling Level 1 is Allowed Boron Required for Hot Shutdown (ppe) 355 Setpoint for Low Water Level Closure of MSIV Level 1 Setpoint for Low Steamline Pressure Closure of MSIV (psig) 800 Vessel Level Setpoint for Trip of Drywell Fan Coolers Level 1 i
I i
l 15C-12 i
i
- =- -
TABLE 15C-3 PERRY MSIV CLOSURE WITHOUT ARI Sequence of Events Time Elapsed 1.
Nominal (4-sec) MSIV closure begins - all normal 0
scrams are assumed to fail.
2.
Pressure and power rise begins 0
3.
Relief valves lift 4 Seconds 4.
ATWS high pressure setpoint is reached (1113 psig),
4 Seconds recirculation pumps are tripped to LFMG.
Feedwater limit timed logic is activated. ARI logic would be initiated but is ignored.
5.
Some fuel may experience boiling transition 5 Seconds 6.
Vessel pressure peaks 7 Seconds 7.
Recirc runback initiated 25 Seconds 8.
ARI function ahich would terminate event is ignored 29 seconds 9.
ATWS logic initiates feedwater limit, " rips recirc 30 Seconds pumps off LFMG.
10.
Feedwater flow stops 45 Seconds 11.
Reactor water level drops to Level 2, initiates RCIC 50 Seconds and HPCS and containment isolation 12.
HPCS and RCIC flow starts 70 Seconds 13.
Operator initiates SLCS and subsequently SLCS valves 124 Seconds open and pumps start.
14.
Liquid control flow reaches core 184 Seconds 15.
Water level reaches minimum and begins to rise.
212 Seconds At all times, fuel remains covered 16.
Containment pressure reaches 2 psig 260 Seconds 17.
RHR flow begins (pool cooling) 11 Minutes 18.
Hot shutdown achieved 24 Minutes 19.
Peak containment pressure and pool temperature 28 Minutes 15C-13
TABLE 15C-4 PERRY PRESSURE REGULATOR FAILURE -
MAXIMUM STEAM DEMAND WITHOUT ARI Sequence of Events Time Elapsed 1.
Pressure regulator to maximum demand.
0 l
2.
Pressure and power begin to decrease.
0 l
3.
Low steamline pressure isolation setpoint reached 14 Seconds a.
MSIV closure.
b.
Scram normally initiated (assumed to fail).
4.
Pressure and power begin to rise.
18 Seconds 5.
Recire runback initiated.
20 Seconds 6.
Relief valves lift.
22 Seconds 7.
ATWS high pressure setpoint is reached (1113 psig).
22 Seconds Recirculation pumps are tripped to LFMC.
a.
b.
ARI logic would be initiated, but is ignored.
c.
Feedwater limit timed logic is activated.
8.
Vessel pressure peaks.
24 Seconds 9.
Some fuel experience boiling transition.
26 Seconds 10.
ARI function,which would terminate event,is ignored 47 Seconds 11.
ATWS logic initiates feedwater limit, trips recire 48 Seconds pumps off LFMG.
12.
Feedwater flow stops.
63 Seconds 13.
Reactor water level drops to Level 2.
69 Seconds a.
Initiates containment isolation.
b.
14.
89 Seconds 15.
Reactor water level reaches minimum and begins to rise.
115 seconds 16.
Operator initiates SLCS and subsequently SLCS valves 142 Seconds open andpumps start.
17.
Liquid control flow reaches core.
202 Seconds 18.
Containment pressure reaches 2 psig.
260 Seconds 15C-14 j
TABLE 15C-4 (Cont'd)
Secuence of Events Time Elansed
- 19. RHR flow begins (pool cooling) 11 Minutes 20.
Hot shutdown achieved 24 Minutes 21.
Containment temperature and pressure peak 27 Minutes c
o 9
l l
TABLE 15C-5 PERRY LOSS OF NORMAL A-C POWER WITHOUT ARI Sequence of Events Time Elapsed 1.
Loss of all auxiliary transformers 0
a.
Recirculation pumps trip b.
Condensate and feedwater pumps trip 2.
Pressure and power begin to fall 0
3.
Normal scram due to loss of a-c (assumed to fail) 2 Seconds 4.
MSIV's start to close due to loss of a-c power (and 2 Seconds initiated scram - also assumed to fail) 5.
Pressure and power begin to rise 5 Seconds 6.
S/RV valves lift at relief setpoints 7 Seconds 7.
ATWS high pressure setpont is reached (1113 psig) 7 Seconds a.
ARI logic would be initiated, but is ignored 8.
Vessel power peaks 7 Seconds 9.
Some fuel experiences boiling transition 8 Seconds 10.
Reactor water level drops to Level 2 21 Seconds a.
Initiates containment isolation b.
ARI function which would terminate event is ignored 32 Seconds 12.' HPCS and RCIC flow begins 41 Seconds 13.
Second lowest relief setpoint SRV closes and some 87 Seconds S/RV's(l) a~re assumed to switch to spring setpoints 14.
Reactor water level reches minimum and begins to rise.
90 Seconds Level inside the core shroud remains above the top of active fuel
Liquid control flow reaches core 187 Seconds 17.
Containment pressure reaches 2 psig 7 Minutes 15C-16
TABLE 15C-5 (Cont'd)
Sequence of Events Time Elapsed l
18.
RHR flow begins (pool cooling) 11 Minutes 19.
Hot shutdown achieved 25 Minutes 20.
Containment temperature and pressure peak 29 Minutes NOTES:
1.
The first two low low set relief valve groups and the ADS valves which are connected to the ADS supply still function in the relief mode.
/
TABLE 15C-6 PERRY INADVERTENT OPENING OF A RELIEF VALVE WITHOUT ARI Sequence of Events Time Elapsed 1.
Relief valve opens inadvertently and fails to close.
0 2.
Alarms sound at 950 F and operator initiates pool 2 Minutes cooling.
3.
Suppression pool temperature reaches 1100 F.
9 Minutes Operator attempts manual scram which is postulated l
to fail. Operator initiates RRCS logic.
4.
ARI function which would terminate event,is ignored.
9.5 Minutes 5.
Operator initiates SLCS and subsequently SLCS valves 11 Minutes open and pumps start.
6.
Liquid control flow reaches core.
12 Minutes 7.
Power is less than relief valve capacity.
34 Minutes 8.
Hot shutdown achieved.
36 Minutes 9.
Isolation on low steamline pressure (800 psig).
38.5 Minutes (l) 10.
Recirculation pumps tripped on low level.
43 Minutes 11.
Peak suppression pool temperature and pressure are 76 Minutes reached.
NOTE:
1.
Operator action is likely to have switched the reactor mode switch out of Run mode, deleting this action; however the course of the event is unaffected since the pressure controller has already shut down the turbine control and bypass valves.
TABLE 15C-7 PERRY TURBINE TRIP EVENT WITHOUT ARI Sequence of Events Time Elapsed 1.
Turbine trips, bypass opens - all normal scrams fail, 0
recirculation pumps are tripped 2.
Pressure and power rise begins 0
3.
Relief valves lift 2 Seconds 4.
ATWS high pressure setpoint is reached (1113 psig);
2 Seconds Feedwater timed logic is activated, ARI logic would be initiated but is ignored.
5.
Peak vessel pressure occurs 2 Seconds 6.
Some fuel experiences boiling transition 3 Seconds 7.
ARI function which would terminate event is ignored 27 Seconds 8.
ATWS logic timer initiates feedwater flow limit 27 Seconds 9.
Reactor water level drops to Level 2, initiates HPCS 51 Seconds and RCIC, and containment isolation 10.
HPCS and RCIC flow begins 71 Seconds i
11.
Operator initiates SLCS and subsequently SLCS valves 122 Seconds open and pumps start 182 Seconds 12.
Liquid. control. flow reaches core,
l l
13.
Reactor water level reaches minimum and begins to rise.
3.5 Minutes Fuel always remains covered 14.
RHR flow begins (pool cooling) 11 Minutes 15.
Hot shutdown achieved 23 Minutes 15C-19
I TABLE 15C-8
SUMMARY
OF ATWS RESULTS - PERRY, BASE CASES WITHOUT ARI 2 PUMP SLCS, FOR MANUAL SLCS INITIATION Maximum Maximum Maximum Maximum Average Pressure Supression Maximum Neutron Fuel Heat (Vessel Pool Containment Flux Flux Bottom)
Temperature Pressure Transient
(% NBR)
(% NBR)
(psig)
(O F)
(psig)
MSIV Closure 833 151 1304 168 7.6 Turbine Trip With 352 115 1210 113.5 1.8 Bypass Inadvertent Opening 100 100 1100 171.5 8.1 of an S/R Valve Loss of Normal a-c 361 100 1231 161 6.5 Power Pressure Regulator 366 141 1266 164.5 6.3 Failure - Maximum Steam Demand i
l 15C-20
N n"
F o
$t TE o
W
[t O
l 2
L 5l i
[i fI a
2 E#f, v
lI, f@
i h
i 6g g
t
[7 T.K_
1 r
h 2f5
!3 5 6'
o, sd
'[
o 6
p o
e d
3 h.
3
- k' i
b
.o O
s i
}
i
,?
o
,o o,
o.
o g
o 02 e
g 1
!b UB 1
I L
X
/
U U
\\
L 1 F 8 C
2 2
4 C C b
i f
i f
v 2
5 s.
I3 o,
v o,
s 7,
A. p, o
I o
^
l
- f 3
3 i
b o
i
? l
.o
- o 2
e 4
,j o
0.
o i
gE G ntE2 i
T2 M',.
a E
5:
o
- Etd, F
N
/
EEE c_
ME ;
/
dE%
s k=a gt
(
dE-5
'-I q
au d3@
N\\
$5]
~
A GDIE
[ ' ".
b5C d
h
~
s
_~- m a
~.A, a
E G
d g
H H
W W
s:
-s; d
rg d an a -
n e
l
- .' do y
~
e, z:
8 43 1&q ~
- l..,.
h.
.o
.o o
o o
R S
S o
'Y 031tM A % N01J OE
- 4 o o dG y
s g
l
/
RE-N a
w!
gNk 50Ig k
m l
E
[
!5Eg b
=-h W
. A<
WEv 8
_~,.3, N
8
_~do n
a18 J
G G
(
h W
W r
s=
>s=
O O
_W m
N N
d d
m__
_m m
~
~
^ ^5-2
,o
. ~
.o a
~
d R
8 9
retsai 3enssaw Pressure Regulator Failure-Open Figure 15C-2
S"
!!WM[Ent 3la"
- wr mac, m n iu_
, o.
i s
a
/n#
p _4p i.2
- a a u
g o.
h f f
l E
I Llu 1
)ivA/\\
S m
e-vvvvf u
8 pv E.
- o. 3
-2o.
o.p,,,,p.s i.2, o
o.3 o.p,,,p.,
i.2.,
f iin"aNil FLuum l' in' Uke %
a 12o' 3 CORE f rA E T FLONI%I 3 VESSEt. $1EAM FLOW IRET SLECOtLINGIBTU/LB) 33* E g trC5 FL5 I (F FWITED FM e0.
eo.
9.
e m
i g
$5w.
$ w.
I
% b kN bVfha#
p, o.t o.
a o
o.3 o.p,,,,,p.o i.2 o
o.3 o.p,,,,,p..
i.2.,
l x
ae l
L, 8R
?' ?
1 Pr a MW i
k 8
i i DONE PAE!SURE 1 VESSEL 6# IER LEVEL (Fil 2
2 W R SCNSE LEVEL Ifil 3
3 KT N IVIH IH 1,.)
.10.
g S
2 2
9d 1.2 0-g yvNwa r +.
w 1.
50.
3.
0.8' 20.
4 0.
1.
2.
3.
4.=e O.
1.
2.
3.
4.ee TIME ISECl TIME (SECI I NEUIRON FLUX III I FEEDWAT[F FLOW 2 RVE SUROCE HEAT FLUXt21 2 HELIEF VfLVE FLOW 120*
3 EORE Ital i FLOWi%I 3 VESSEL S1Em FLS4 120.
II' IRET 50fCSKlETBTU/LB) u trcs rL5 Z F"llRTED FW 5
5 5
i E.
M 80.
30, n
2 e
p et E
b 14 0.
go.
to N
~
m N
A 0.
5'-
2 u e ?
O'O.
i 4
E'-
e
- o 0
1.
3.
4.ee 2.
1.
2.
3.
- 4..se g
4 TIME ISECl TIE (SECl n
V (Dm 4
to ao G
- t) a:
f
=
E 5=
Eh_
9 W
BEE sa N5-gd"b
_i-d
)
awg
)
W = '"
9
'0 J'
- 1 dgg N
Esas RE.sn 3*E w=-
m.
$2W OWW
_~--,
e e
o i
g g
wog N
=
M W
W e
eC c;
e o
, -o 9
m n
r
- o
- c y
g u
. <- t o
R S.
S o
?2.
- ~-
.o o
o
.o
'Y 031tAl.@ Z IC13 Gm Gd 3E mg
)
-~ q) 50_u m
~
3$5 s-
)
_~-,
e
_,4 e
c -
e o-W W_
W E
e e
i
\\
d l
5 i
1' a
e
- o e
o 5
_ L....
m.
s,
-2 l
_-)
g 8
d d*
o (HISdl 38nss3Wd Turbine Trip Figure 15C-5