ML20216G951
| ML20216G951 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 06/24/1987 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20216B323 | List: |
| References | |
| TAC-60421, NUDOCS 8707010222 | |
| Download: ML20216G951 (4) | |
Text
E.
e
/
o UNITED STATES
~,,
E
- 8. '
NUCLEAR REGULATORY COMMISSION n
h WASHINGTON, D, C. 20555
\\***,+/
=
ENCLOSURE 1 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO STEAM LINE RUPTURE DETECTION AND ISOLATION SYSTEM' PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN NUCLEAR GENERATING STATION.
DOCKET NO. 50-267 1
l
- 1. 0 INTRODUCTION AND SYSTEM DESCRIPTION By letters dated June 4 and 10, July 25, October 27 and December 19, 1986, Public Service Company of Colorado, the licensee for the Fort St.
Vrain~ Nuclear Generating Station, proposed to install a Steam Line Rupture Detection and Isolation System (SLRDIS).
The SLRDIS is designed
.to detect rapidly rising tmperatures in both the reactor building and turbine building which wouid result from postulated breaks in high energy 1
lines and then initiate mitigating actions.
Upon detection of rapidly l
rising temperatures in either building, the system is intended to:
- 1) initiate a reactor scram, 2) trip the helium circulators in both primary loops, and 3) initiate closure of the valves in the secondary side high energy lines in order to isolate them.
Isolation of these lines within a specified time frame prevents further escape of high energy fluid in order to preclude creation of environmental conditions which could adversely affect equipment required to bring the plant to a safe shutdown.
The SLRDIS is relatively simple in design and. consists of two sensor loops in the reactor and turbine buildings, each containing four sensors.
Each sensor is a thermistor which changes resistance rapidly with increases in temperature.
Each thermistor is 200 feet long and is coiled l
into three or four wire loops.
One thermistor in each reactor building sensor loop is located near one of the four walls of the building, with a similar arrangement in the turbine building.
Signals from one thermistor on each wall of the reactor building are fed into the "A" detection rack while signals from the other thermistor on each wall are fed into the "B" rack. A similar arrangement is used in the turbine building.
A high energy line break of sufficient magnitude in either the reactor or turbine building will rapidly heat the thermistors, thereby reducing their resistances.
This will generate a signal causing isolation of the high energy secondary coolant system lines.
Simultaneously, all four helium circulators are stopped.
Isolation will occur if the resistance of at least two of the four thermistors in two detector racks for either building are affected by the rate of rise of the environmental temperature.
A signal from only one thermistor will result in a low-level pre-trip alarm and a rate of rise alarm.
A signal from both j
the "A" and "B" detection racks is required to initiate isolation valve
(
closure.
There is also a trouble alarm in the event of a thermistor j
short-circuit or open-circuit condition.
8707010222 B70624 PDR ADOCK 05000267 P
PDR 1
,i
~
The SLRDIS is designed to detect and isolate to breaks in the main steam, hot and cold reheat steam lines where the size of the break flow is equal
]
to or in excess of that equivalent to 2% of a full offset break f. low.
It is expected that a break in the condensate, auxiliary steam, or extraction
)
steam line will not release energy in sufficient quantity to cause the SLRDIS to isolate the secondary side high energy lines.
For these line breaks', the pre-alarm trip signal (135 F) will alert the operators to take necessary corrective actions manually.
Feedwater line breaks will release sufficient energy to actuate the sensors and cause a rate-of-rise trip.
However, the SLRDIS system is not designed to isolate the feedwater system automatically.
This must be done manually by'the operators, following the SLRDIS system actuation.
In addition, the licensee proposes to maintain the functional capability of the temperature elements and temperature alarms.of the existing Steam Pipe Ruptu"e Detection System (SPRDS) as an additional system to alert the operator to a pipe rupture in the reactor building which may not cause the SLRDIS to react.
The licensee committed to reasonably maintain and test this instrumentation consistent with simila.r instrumentation including periodic calibration (once per refueling outage, not to exceed 18 months) and corrective maintenance in a reason-able time interval.
This instrumentation,'however, will not be covered by Tei:hnical Specifications.
SLRDIS operability is ensured by the Technical Specifications, which will be covered by a separate Safety Evaluation.
2.0 EVALUATION 2.1 Single Failure The staff has reviewed the capability of the SLRDIS to perform its function in the event of a single failure.
A single thermistor can fail in an "open" or "short" condition; this will cause actuation of a trouble alarm.
Alternatively, a failure of a single thermistor detection loop would change the SLRDIS actuation logic from 2-out-of-4 to 2-out-of-3 for initiation of the isolation signal.
While this is not desirable, the time of thermistor inoperability is limited by the Technical Specifications so as to minimize operation without a full complement of operable thermistors.
l The SLRDIS detection racks themselves may fail in a manner which generates a spurious signal.
In such an event, while an alarm is received, isolation of the lines monitored by the SLRDIS will not occur until a signal is received from the other rack.
A single instrument bus failure will incapacitate either the "A" or "B" logic in both racks and change the sensing logic from 2-out-of-4 in each rack to 2-out-of-2.
Such a condition would still permit SLRDIS actuation.
However, the technical specifications severely limit operation with half the thermistors disabled as would occur on failure of an instrument bus.
Further, the racks are equipped with a self-test system which continuously monitors the online status of the rack, and will alarm a failure upon detection.
The above design features ensure that the SLRDIS function is not lost even though a signal from both racks is required for valve closure.
The staff, therefore, finds that the SLRDIS design assures its proper function in the event of a single failure.
l 2.2 SLRDIS Actuation as a Result of Accidents other than a High Energy Line Break The staff also performt:d a review to determine the impact of-accidents, other than a high energy line break, on the SLRDIS.
For the design 1
basis maximum credible accident, in which the primary coolant (helium) is emitted from a ruptured 2-inch pipe leading to the helium purifica-I tion system from the Prestressed Concrete Reactor Vessel (PCRV) head, j
the' licensee determined that the SLRDIS would not be actuated, nor would this accident create a harsh environment.
For Design Basis Accident No. 2, involving a failure of both closures 1
in the bottom head access penetration, the temperature in the reactor building may rise rapidly to 600'F, tripping the SLRDIS in the process.
The original accident analysis assumed that forced circula-l tion cooling would be interrupted for five minutes until automatically
)
reestablished by the use of feedwater and the Pelton drives on the i
helium circulators.
The licensee reanalyzed this accident based on a j
required delay time of 60 minutes for the operator to restart the forced circulation cooling following SLRDIS actuation.
The reanalysis j
showed that this was an acceptable post-accident scenario.
The licensee also noted that a-fire could activate both of the SLRDIS detection racks, resulting in isolation of the high energy steam lines and interruption of forced circulation cooling.
Some of the valves closed by the SLRDIS are included in the Fire Protection Shutdown System and must be reopened within 90 minutes to permit forced circulation cooling.
The licensee stated that both the plant a
and the SLRDIS designs permit the reestablishment of forced circula-tion cooling under these circumstances.
The licensee further noted that an inadvertent trip to either SLRDIS detection rack as a result of hardware failure or operator error would satisfy'only one of the two trips signals required to activate the SLRDIS.
In this case, only an alarm annunciation would occur as previously discussed.
During surveillance or maintenance on the final output relay trip logic, a short-circuit caused by an operator's single error could result in an inadvertent operation of the valves in a single SLRDIS loop and subsequent tripping of the helium circu-lators in that loop.
The other primary cooling loop, however, would continue to function.
In addition, the licensee conducted analyses to confirm that neither the building heating systems nor loss of HVAC systems would affect building temperatures in a manner which would activate the SLRDIS.
The staff therefore, finds that the licensee has adequately considered the impact of other accidents on the SLRDIS and confirmed appropriate opera-bility of the system for those events.
)
y.
I 2.3 Diagnosis of Event The staff reviewed the means available to determine the event occurring in order to alert the operator to a possible SLRDIS i
actuation.
The licensee noted that a number of indications are provided which would aid the operator in diagnosing the particular event taking place.
For example, if PCRV pressure is not decreasing, the event is not a primary coolant leak.
Shift personnel would be able to inform the control room if a fire, localized steam leak or surveillance test had caused the SLRDIS to trip by observations in the plant.
Smoke detectors and fire suppression system actuation would indicate the presence.of a fire.
The SLRDIS detection racks provide indication of the specific channels and zones which have tripped.
Indications of only localized high building temperature
~
upon SLRDIS alarm would be a sign that a major steam leak had not occurred.
The staff, therefore, finds that adequate means are available to assess the causes of SLRDIS actuations.
2.4 IffectsofWaterandSteamHammer The licensee reported that a portion of the boiler feedwater system had been reanalyzed to determine the effects of closure of the isolation valves to both steam generator loops as a result of SLRDIS actuation.
The licensee stated that while SLRDIS actuation may result in a fluid transient, and consequential dynamic ' responses in -
excess of manufacturer's rated loads on certain restraints, the boiler feedwater system piping pressure boundary will be adequately maintained.
The staff, therefore, finds that the effects of water and steam hammer have been properly considered in the design of the SLRDIS.
3.0 CONCLUSION
Based on the above, the staff concludes that the SLRDIS meets the.
requirements of 10 CFR Part 50, Appendix A, General Design Criteria (GDC) 20 for design of engineering safety feature detection and actuation systems and the requirements of GDC 4 for assuring plant safety following postulated pipe breaks.
Thus, the system is capable of ensuring that environmental conditions within the reactor and turbine buildings will i
not exceed the accepted essential equipment environmental qualification envelope following postulated secondary side high energy line breaks.
The staff, therefore, finds the SLRDIS to be acceptable.
Principal Contributor:
N. Wagner, PEICSB Date*
i