B14005, SDC Auto-Closure Interlock Removal at Millstone Unit 2

From kanterella
Jump to navigation Jump to search
SDC Auto-Closure Interlock Removal at Millstone Unit 2
ML20092A070
Person / Time
Site: Millstone Dominion icon.png
Issue date: 12/31/1991
From:
NORTHEAST UTILITIES SERVICE CO.
To:
Shared Package
ML20092A051 List:
References
B14005, NUSCO-175, NUDOCS 9202060504
Download: ML20092A070 (39)
v • d • e


Text

. - _ ..

Docket No. 50-331  !

B14005 Attachnient 2 Millstone Nuclear Power Station, Unit No. 2 Plent-Specific Analysis for the Shutdown Cooling System Autoclosure Interlock Deletion-l' i-L l'

l January 1992 ,

92020'60504 DR 920130 ADOCK 05000336 PDR

NUSCO 175 l

SDC Auto-Closure Interlock Removal at Millstone Unit 2 Probabilistic Risk Assessment Section -

Northeast Utilities Service Co.

December 1991 e

DISCLAIMER

~

l l

The information contained in this topical report was prepared for -

the. specific requirements of Northeast Utilities Service Company (NUSCO) and its affiliated companies, and may contain materials subject to privately owned rights. Any use of all or any portion of the information, analyses, methodology or data contained in this topical report by third parties shall be undertaken at such party's sole risk. NUSCO and its affiliated companies hereby disclaim any liability (including but not limited to tort, contract, statute, or course of dealing) or wartanty (whether express or implied) for the accuracy, completeness, suitability for a particular purpose of merchantability of the information.

I

}

.-- ~ .. . ._ , - . .-. . . . . .- .. - .-.- ~ ~ - . ..

'. .s 4

TABLE OF CONTENTS I

Pa r.e 1.0 -INTRODUCTION . . . . . . . .. . . . . . . . . . . . . . . . . . 2 ,

2.0: BACKCROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3.0 SCOPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 4.C -PRA ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . . . 7.

5.0 CONCLUSION

S, INSICHTS, AND RECOMMENDATIONS . . . . . . . . . . . .31 1 :

s

-17VR4X,08D-

_ . . _ -._2__. ._ _ , . . , _ , . , . _ . _ .

. . . - - - . - . _. 4 - _ .. .

c: ,7

.. M : ,. . .

x

%@: 2 1.Cf= INTRODUCTION The~ purpose, of this analysis is to investigate the risk impact of removing

= .

-the' auto' closure interlock (ACI) from the. shutdown cooling system (SDCS)

. suction valves 2-SI-651 and 2-SI-652 at Mi llstone Po nt i Nuc ear l Power Station Unit 2 (MP2). In place of the ACI, an alarm will be provided in the control room. The alarm will cause the annunciator to light and sound i a horn'when.either of the va?.ves is not fully closed with the reactor coo!. ant system (RCS)-at high pressure;

Figure 1 is' based on information provided in References 1 and 2. It is a

-Sinplified;P&ID of SDC which illustrates-components associated with this

_ design' change. The pressure transmitters PT103 and=PT103-1 generate the  ;

hir,h pressure signals that-will close the isolation valves. Note that the vajves are'shown in their power operation (Mode-1) position.  !

TTh.* ACE fr: designed to minimize the likelihood of failing to close the SDC ia.lation valves durin6 P lant' heat up. In addition, the ACI prevents the GDCS, vl.ose design: pressure is approximately 500 psi, from being overpress-lurized'due to transients'during shutdown. When the plant is shutdown and

~

Lthe_-SDCS'ia aligned to the RCS,- the SDCS is subjected to the same pressure

&c the RCS. If:a transient were to occur that increased RCS pressure, the

. pressure within the SDCS would'also rise. As a result, the ACI would

- operate and closc isolation valves 2-SI-651 and 2-51-652. Given'an adequate response time, the AcI will prevent the SDCS-from exceeding its design pressure. lit is;this interlock function that is proposed to be replaced by an alarm.

U s

.(.

.17VR4X.08D w- _

._ =

"i! -4

..d .t f

r l

. . ~

- Z gk gz M

, n. R '- Q- O '

E- 84- t 8 o . .. n. - .- , . .;

- PZR PRESS P y.. 'PZR PRESS .

g$ g$ 3 PT103 w PT103-1 ad' .

SPECCHAN3E w@Q:

@ 2-SI-441

!bo -

W  :,:

-i w

h to

-l FG b

& 2 j- b::

u a u 1.5*  !

g F P'

  1. 2 2-SI-469 R 2-SI-4 6 8  ;

2-SI-65 2 2-SI-651 g 2-SI-709 '

FL FL D OUTSIDE 2-St-440 HIGH m * - LOW s -

3 r PRESS ' l ' PRESS COMTAINMENT . j  % ~

LL .

i i

l i

SOURCE: PSID 25203-26015 LC- LOCKED CLCSED.

FL- FAILS LOCKED t

FIGURE 1 GlMPi_lFIED P&lD OF SDC SUCTION PATH 1

1 i

, - _ , m, ,-m.. -

. _ _ . _ , . . _ . . _ _.- - ~ . _ . . . . . . . . _ . . . . . _ . _ _ _ _ . _ _ - -

.g -

4 1

2.0 BACKGROUND

Loss of SDC during shutdown operation has been a concern to the Regulators and the Industry for a considerable period of time. Thase events have continued to occur at a rate of several per year in spite of ibe increased attention given. (References 3 and 4.)

A major contributor to the loss of decay heat removal events has been the spurious actuation of ACI. The Electric Power Research Institute (EPRI) 1 l

and the Nuclear Regulatory Commission (NRC) h'.ve analyzed loss of decay heat removal events at pressurized water reactors (References 5 and 6). l The results reported indicate 130 loss of decay heat removal events for the period between 1976 and 1983.  !

Table 1 (extracted from Reference 6) summarizes these 130 events by the categories which cause loss of.the decay heat removal function. Of the 130 i

events, 37 events have been caused by the automatic closure of the suction-isolacion valves. That is, 28.5 percent of the loss of decay heat rewoval events have been caused by the inadvertent actuation of the ACI.

Table 1*

Categories of Total DHR System Failures at U.S. PWRs, 1976 1963, When Required to Operate (Loss of Function)

Automatic Closure of Suction /-

Isolation Valves 37 (28.5)

Loss of Inventory

  • Inadequate RCS Inventory -

.Resulting in Loss of DHR Pump Suction ,26 (20.0)

  • Loss of RCS Inventory through DHR System Necessitating Shutdown of DHR System 10 (7.7)

Component Failures

  • Shutdown or Failure of DIR Pump 21 (16.2)
  • Inability to Open Suction /

Isolation Valve 8 (6.1).

  • Others _is (21.5)

TOTAL 130 (100.0)

  • This table has been extracted from Reference 6, 17VR4X.0$D

5 Removal of the ACI has several impacts on risk. As pointed out in the previous section, removal of the ACI benefits public safety (reduces public risk) by reducing the loss of decay heat removal events. !!owever, sin, the ACIs do participats in lowering the likelihood of interfacing system lOCAs (ISIDCAs) by automatically closing the SDC suction isolation valves during rende transition from mode 6 to mode 1, removal of the ACI may have a potentially negative benefit on the ISLOCA frequency. Finally, the plant response to overpressure transients during non-power operations will be atfected due to this change. The aitalysis that follows investigates the impact of the ACI removal on SDC unavailability, ISLOCA potential, and low 1 temperature overpressure (LTOP) transients.

q 17W 4X.08d

. .. . . . ~ . . . . ~ . . . . .. . . _. . . _ . . . . . . , . . . . ~ . . . . . . . . _ . . - . . - . -

4 6 ,

3.0 - SCOPE NRC, in an internal memo (Reference 7) expressed seven concerns in stating ,

the Reactor Systems Branch (RSB) position on requests for removal of tr.a ,

SDCS ACI, These seven concerns are:

i

1) The means available to-minimize interfacing .,ystems LOCA or event V concerns.
2) The alarms to alert the operator of an improperly positioned SDCS .

MOV.

3) The SDCS relief capacity must be adequate.
4) Means other than the ACI to ensure that both MOVs are closed.
5) Assurance. that the function of the open permissive circuitry is not

'affected by the proposed change. >

6) . Assurance that MOV position indication will remain available in-the

<ontrol-room regardless of the proposed change.

7) Assessment of the proposed change's effect on SDCS reliability, as well as or. Low Temperature overpressure (LTOP) concerns.

The'PRA analysis will address items (1), (3), and (7). The l'nvestigations on'other items will be limited in that other engineering disciplines will

provide final assurances and' verifications.

17VR4X,0$D

_ - - . . . ._.__.~.m.-- -

- - - - - _ . - . ~. _ _ _ , _ _ _ . _ _ . .,-_:.,,,_.-._.._.. ._ _..-_.:

- . .- -  :=. . -

/

4,0 PRA ANALYSIS 4.1 Interfacina Systems LDCA (Event V) Analy1Lg The MP2 event V analysis was revisited to examine the impact of ACI removal on event V freqtiency. Only the Event V frequency through the SDC suction path can potentially be affected due to ACI removal.

Based on MP2 valve configuration provided in Figure 1, an event V through the SDC suction path is defined as alignment of RCS and SDC during plant operation due to the failure of valves 2-SI-651 and 2-SI 652. Since the relief valve 2-SI-469 plays a enjor role in the detection of a failed 2-SI-652 valve, that valve is also included in the Event V sequence analysis- . The failure modes of suction isolation valves considered are:

  • CATASTROPilIC RUPTURE
  • LEFT OPEN BY THE OPEPATOR
  • SPURIOUS OPENING Figure 2 provides an event tree showing different combinations of events that can lead to event V sequences. Not all sequences on Figure 2 are credible A large number of sequences are extremely low in frequency so that they can be disregarded. The paragraphs that follow develops screen-ing values for branch fractions and perform a screening type evaluation to simplify the event tree and compare the ISLOCA frequency through the SDC suction path with and without the ACI, I

17VR4X.0BD

_ m, A p - g,. _.eW-a a- %0_ , ~ , ._ .eE s,,. a 4 , 2-a,&,

t I,

I

[ ..,.... . 2 ;?2 2-T T t *2 E L M Q & C. ,,

p n

3

. ..h.h...h.h. e . .............

lv ll t

. i [

h

-1 - o e s E $

=

r t . . s

.r t s e' t t a.I e . h t :r) o t 2 eI .  : a g.

t. t t- - t - t ty . -

sg S  ? E  ; n g n p p s n p 3 E_, n .t n s 3 n a

g g eb I *

  • s e

? # I E a t t t o

s  ! 9 s t 8

jl .h 9

!: [ h e .

9 i "  ?

i t

u I

l l

_ .. -, ,_. ..._. _ __ _ _...._ . _ _ . . - _ ._m _ _ _ _ __ _ _ _ _ _ . . . _ - -.. . . _ _ -

4 9

4.1.1 Inadvertent oneninn of 2-S1 652 Several defenses exist against inadvertent opening of 2 SI-652. The unit

~

operating procedure OP.2319 (Ref. 8 " Shutdown Cooling") instructs the operator to close the SDC inlet valves 2 SI-651 and 2 SI-tis 2, These valves are key locked to shut. Further, the same procedure instructs disconnect-ing of a switch to remove power from the brector to valvo 2-SI 652.

The probability jf_failing to remove power from-2-SI-652 by the operator is assigned a value of 1.6 x 10~3 based on analysis provided in WCAp-11736-A (Ref. 9). If the power is not removed from the MOV 2-SI-652, then an inadvertent opening can result from inadvertent closure of a contact pairs.

Concurrent spurious closure of at least two contact pairs must occur for spurious closure. Assuming a 10'7/ hour rate for spurious contact closure, Reference 10 estimates the annual frequency of 2-SI 652 spuriously opening to be approximately 8 x 10-10 per year.

The other mechanis'n of inadvertent opening is the coincidence of the events

" power not removed from valve 2-SI-652," " key locked hand switch turned to OPEN position (operator error)," and "Open prevent interlock spuriously closes." The frequency of this scenario is also extremely low.

Therefore, inadvertent opening of 2 SI 652 is not considered as a credible failure and that branch is eliminated from the event tree.

4.1.2 2 SI-652 Catastrophic Failure Based on failure rate of 10-7/ hour (Ref. 11) the frequency of catastrophic rupture of 2-SI 652 is estimated to be 8.76 x 10-* per year.

o l'

17VR4X.08D 1

l 2 - . . - .- .. - - - -

10 4.1.3 Erequency of 2-SI-652 "LEFT OPEN" This sequence is ccnaidored insignificant due to a varietyLof raasons.

. They are as follows:

  • OP 2319 (Ref. 8) instructs the operator to close isolation valves 2 SI-651 and 2-SI-652. This failure mode would require operator error of omission. The probability of that event is assumed to be
3. 2 x 10-8 following the assessment for MP3 RHR ACI removal (Ref. 9, WCAP-11736-A).
  • Operator fails to perform Leak Rate Test " Containment Leak Test -

Type C (LLRT)" (OPS Form 2605D 1) according to the operating proce-dure.

Note tNat this leak rate test is applicable to 2-SI-651 only. It is not applicable to 2-SI-652. However, because of this test, a fully open 2 SI-652 would most likely be detected during the leak test of 2-SI-651.

  • If the valve 2-SI-652 is open and the pressure is increased beyond the ACI setpoint, SDC will automatically isolate through the closing of 2-SI-652 and 2-SI 651. Even after the ACI deletion, the proposed alarm vill let the operator know that 2-SI-652 or 2-SI-651 is open.
  • xelief valve 2-SI-469 will open when pressure is increased beyond 300 psi while 2-SI-652 is open. Liftir- of this relief valve should be known to Operations since the relief valve discharges to the primary drain tank which alarms on temperature. . pressure and level.

Further, the_above normal RCS leak rate will eventually alert the operator of an unusual condition.

Considering the above, *2-SI-652 LEFT OPEN" path is not considered credible.

I l

UVR4X.08D l

11 4.1.4 Relief Valve 2-SI-469

~

If for one reasen or another 2 SI-652 fails, then the relief va.ve 2-SI-469 will be subjected to RCS pressure. The set point cf this relief valve-is 300 psi and its discharge gets routed to the primary drain tank (PDT).

There are temperature, pressure, and level alarms associated with the Priisary Drain Tank.

The mechanical failure of the passive relief valve to lif t is relatively low. Alarm failure is also of low probability due to the diversity of 1

alarms associated with PDT. The dominant failure mode f the relief valve j as a defense against an ISLDCA will therefore be " Operator Failure to Recognize Lifted RV Based on PDT alarm." A screening value of 10'3 is assigned to this operator failure. This probability is justified consider-i ins other diverse means of detecting loss of inventory during plant l i

startup. Such inventory imbalances warn the operator of an unusual

- condition and require.the operator to suspend any increases in reactor power or RCS pressurization.

4.1.5 Inadvertent-Ontning pf 2-SI-6Si Since power is not removed from the 2-SI-651 as is the case for 2-SI-652, the probability of inadvertent opening of 2-SI-651 is relatively high compared to that of 2-SI-652.

Several mechanisms that can lead to the inadvertent opening of the valve are as follows:

.

  • All threc motor start relay contacts (42-0) short. The probability of such an event will be (P (contact pair transfers closed))3 and is i

.tegligible.

  • 1 Contact pair 1-7 associated with the overpressure interlock coil transfers closed AND contact pair 2 of the handswitch transfers closed AND locking circuitry contact 42+0/b transfers open. Again the probability of this scenario is extremely low.

17VR4X,08D 4

y- - -~ s y ,p,~ m,<,,s- -.gn.-,- ,n.g .. , - , - - - - n .g,- g_.,'w.,_,-

- - , , , .m,, ,.-.w, - - , , - - - - -

  • 12
  • The operator inadvertently opens the key locked shut valve AND the overpressure interlock malfunctions. This scenario is also of ex.

tremely low probability.

4.1.6 LEFT OPEE 2-SI-651 (With ACI)

Three different defenses exist to prevent reaching power operation with a LEFT OPEN 2-SI 651 valve. They are:

  • Unit operating procedure OP 2319 which instructs the operator to close 2 SI-651. A probability of 3.2 x 10'3 is assigned for the failure of this event (Ref. 9).
  • The same procedure requires a leak test of 2-SI-651. The probability of omission of this step is also assigned a probability of 3.2 x 10'3,
  • The SDC ACI will automatically close 2-SI 651 upon the receipt of high pressure signal. Failure to close upon receipt of the high pressure signal is assigned a screening probability value of 1 x 10-'.

Af ter considering the dependency among the above defenses, the probability of event "2-SI-651 MOV LEFT OPEN" has been estimated to be 3.2 x 10'7 (Ref. 10).

4.1.7 LEFT OPEN 2-SI-651 (Without ACI)

The probabilities in Section 4.1.6 will change if the ACI is deleted. The SDC ACI which acts to a domatically isolate 2-SI-651 will now be replaced by a manual action who- the operator will close 2-SI-651 upon the receipt of an alarm.

Reference 10 recalculated the probability of the "2-SI-651 LEFT OPEN" event for the case where the ACI is replaced by an alarm. This new probability is 4. 2 .x 10'7 17W4L CeD

.13 4.1,8 Carastrophie Failure of 2-SI-(d_1 The probability of the catastrophic failure of 2-SI-651 following the catastrophic failure of 2-SI-652 will be based on the failure rate 1 x-10-7 per hour used for 2 SI-652. It is assumed that the valve 2-SI-651 is exposed to the high RCS pressure'upon 2-SI-652 failure. The: failure 4 probability is given by the-expression: l t

AT

. where A is the failure rate (- 1 x 10-' per hour) and T is '.he exposure time'.

L The average exposure time of the valve 2-SI 651 subsequent to 2-S1-652 failure will depend upon the function of the relief valve. If RV 2-SI-469 did successfully lift and the operators correctly identified the failed 2 SI-652,-then the reactor will be shutdown. Even if the operators did not

= recognize the exact cause of the -RCS leakage , leakage beyond the tech spec allowable rate for unidentified leakage would necessitate a prompt shut-down. Therefore ,-' following Ref. 10, a hour exJosure time will be

- assumed. The-failure probability will be 3.6 x 10'6 (- 36 x 1 x 10'7) .

On the other hand, -if the relief valve failed to lif t, 2-SI-651 may be ex-

- posed to the high RCS pressure on the average half of the Refuel Cycle.

Therefore, the failure probability will be 6.57 x 10** (~ b x (1.5 x -

8760)(10-7)}.

4 1.9 ISLOCA Frecuency The event trees (Figures 3 and 4)- illustrate the credible ISIDCA scenarios through.the SDC suction path'with and without the ACI feature.

The total ISLOCA . frequency: for the "with ACI" case is 4.01 x 10 per year -

~

compared to the total frequency. of 4 10 x 10-' for the "without- ACI and y

j with Alarm" case.

l 17VR4X.08D l.

L . .__ _ . . ..

.1 l 14 Based on the. absolute magnitudes of the above frequetales and the insignif-icant change in_the frequencies,uit is concluded that the impact of the ACI-

~

removal on the ISLOCA frequency is insignificant.

4' 2 Loss ~of Shutdown Cooline System

-The SDC ACI removal is encouraged due to its hiS h contribution to loss of SDC events. 'The' industry experience leaves no doubt in the fact that the AC1: is a major cause for loss of SDC events during shutdown.

'As illustrated by Table 1, of 130 total loss of DHR events which occurred

~during the period between 1976-1983, 37 events were attributed to the automatic closure of suction isolation valves. Using References 5. 6, 7, and 9 as bases, it-is concluded-that the removal of the ACI feature will provide a significant benefit (operational and safety) to the plant.

I l-l l .--

r i

.. j i

l I

1MR4X,08D l

l l

!~ -

a ...a_. ~ =+n- a .a v.-.. x. a- -s --- - , , , , s- g n1 x - _ .- .a 9 -

2 4 ,

A 9'

I i r . . .......

~

  • t E'f f . ss.Es.9s r- s g ee 9

g r , i , . . . . -

r [

jh I I I E. I. B.. E. I.

. . E. .

u I "

j. I lt*

t e  : s su u, au ss 1 i d

)2 j< $:- E.-ZI

1 -3 }EjE.i,

  • g N

I i I i 1 4

.)

I Sj

) b3 I

i i 11 .

n j

~

k 3 o a}' a k

W l

i-l l

> y _m., .~ t + >,.a.--- a~a .w a . a- n n -. a a~a..+... -.--<s.,. s a:.-ux-a .a -- --a s a - ..u.--an a. x . . . .

.'.9 q,

i I

" r . . . . . . . .

! . . . . . , F EE . I.N. 8, 8, , 8, H .

I 6 4 4 s e s ; e e g, I. I I F. I E  % .

E!I . . E. I. i. .

t 7

=  !

jl g T 4 ,- t t j

- 4 La 14 4t sz!

i $ 3EUEI 3Ei[$ ,

i 1 I

i.  !.

'l I I  ?

I Il

}

I If g

l 4

3- -

ot.s 31 3IIEi [j W

k I. .s

, . . ~ . .-. - . -.....-.- -. ..- .- . . - - - - - - .

17 The risk to_the public due to loss of shutdown cooling during shutdown events is expected to be' reduced due to removal of the ACI.-

. 4.3 Overoressure Transienta -

+

Equipment malfunctions, procedural deficiencies, and incorrect operator actions during startup can lead to pressure transients in the P.CS while the SDC is in operation. These pressure transients are of concern because (a)'the SDC may be subjected'to pressures exceeding its design pressure,

- and (b) the RCS may be subjected to pressures that exceed the allowable -

-limits at low temperatures. .

The response to the _ overpressure transients and the potential for overpressure transients may be altered due to the removal of the ACI. This section identifies events whose potential or response may be affected by the ACI removal.

4.3.1 Method of Analysis In the sections that follow, a lar6e number of overpressure transient events are investigated. Several aspects of there overpressure transients are considered.

First of all,1the-potential (initiating event frequency) for an .

overpressure accident will be examined. This investigation will be plant specific in that.the shutdown operating _ procedures and practices have-a significant impact on most of the initia. ors considered. If the investiga- 4 g . tion of this potential reveals _that the frequency of the overpressure transient under consideration is negligibly low, that is, the initiator is

.not' credible for MP2,,then further analysis of that initiator will not be performed.

p If-the frequency of an overpressure transient is relatively high, either based on the industry experience or the MP2 operating history, the impor-p tance of ACI to that-initiator, either as a contributor to the initiator or-as a part of the mitigating system, will be investigated. This will be 17VR4X.08D l

l-ll

18 cotopared against the role of the ALARM and the OPERATOR RESl'ONS5' that will t replace the ACI. 1 4.3.0 ,remature

  • Oneninc of the SDCS Several procedural steps, precautions and interlocks exist to prevent a scenario where the operator would align the RCS with SDC prior to suffi-cient depressurization of the system. These are as follows:
  • Several precautions in unit operating procedure OP 2207 (Ref. 12)

" plant Cooldown" emphasize that the SDC system shall not be exposed to RCS pressures exceeding 265 psia.

  • SDC suction valves are equipped with a prevent open interlock. The I function of the interlock is to prevent the opening of the SDC valves  ;

if the RCS pressure is higher than 280 psia. The operation of these interlocks will not be affected by ACI removal.

  • Valve 2-Sl-652 is key locked and power is removed from it. There-fore, accidental or inadvertent operation is not possible. Valve 2-SI-651 is also key locked. However, power is available at the breaker. These two valves are in series and premature opening of the SDCS requires opening of both these valves.

In consideration of the above, premature opening of the SDCS is consicered a scenario with negligibly low frequency.

4.3.3 Rod Withdrawal A prerequisite of the Unit 2 operating procedure OP 2207 requires that the control element drive cechanisms (CEDM) be de-energized before the cooldova from hot standby to cold shutdown is initiated. The CEDMs are de-energized by either setting the motor generator (MC) output breakers open and tagged by , ,a Shif t Supervisor or by de-energizing the coil power programmers for all control element assemblies and tagging by the instrument and Control Department Head.

17VF.4X . 08D

19 Witharawal of rods in Modes 4, 5, and 6 is not credible since control rod drives are de-energized whenever the RCS boron concentration is loss than the refueling concentration of 1720 ppm per Technical Specifications (MNP2 FSAR, Reference 13). Therefore, the potential for this accident and therefore, the impact of ACI removal is negligible.

4.3.4 Failure to Isn] ate SDCS Juring Start Un During the startup, the operators are required to close the suction isolation valves 2-SI 651 and 2-SI 652 (Reference 14). Failure to isolate the SDCs during startup, _if not detected early, will lead to overpressuriz-ation of the low pressure SDC piping.

Several operator errors must occur in order to fail to isolate SDCS during startup. They are:

  • Operator fails to-close 2-SI-651 and 2 SI 652 per operating procedure OP 2319
  • Operator fails to perform leak rata test of 2-SI-651.
  • Operator fails to detect via the open relief valve 2-SI 469 discharg-ing into the primary drain tank, which has alarms.
  • Operator fails to detect due to loss of RCS inventory during startup.

Based on analysis performed in Reference 10, the probability of the sce-nario will be of the order of 10-10 and, therefore, is considered insignif-icant from a risk perspective.

4.3.5 Pressurizer Heater Actuation This transient has no measurable impact on the LTOP risk when ACI is replaced by an alarm. The basis for this conclusion are as follows:

  • Pressurizer heater actuation (inadvertent) during shutdown, should it occur, will lead to a slow developing transient. Therefore, the 17VRAX.08D

t 20 Alarm (new) will be as timely as ACI in preserving the SDC integrity.

That is, the operator response time introduced when the ACI is re-moved will not be a factor in isolating the SDC.

  • The shutdown operating procedure (OP2319) is utilized to mir.imize inadvertent energizing of the pressurizer heaters.

4.3,6 Startun of an Inan_tive LOOP Vhen the RCPs have been stoppen, the steam generator water may remain at a relatively constant temperature greater than the RCS temperature. When a sI 5nificant difference between the SC temperature and the RCS temperature exists, if an RCS pum. is inadvertently started, the sudden heat input to the RCS will result in a rapid increase in the RCS temperature.

The probability of occurrence of the above accident is minimized due to several operating practices. During plant cooldown (OP 2207) (Refer-ence 12), the unit operating procedure OP 2207 instructs the operator to reduce the number of running RCPs to two. The same operating procedure instruers the operator to secure the two remaining RCPs when the RCS temperature is approximately 230*F and heat removal by steam from the S/Os is stalled. Further, )P 2207 instructs the operator to verify that all RCPs are secured and their circuit breakers are racked down. In addition, operators are instructed to TAG all RCP circuit breakers QE RACKDOWN and TAC all 6.9-kV feeder circuit breakers.

During plant heat up, unit operating procedure OP 2291 (Reference 14) in-structs the operator to TERMINATE shutdown cooling prior to exceeding RCS pressure of 265 psia and to start two RCPs and start the third pump after reaching 200*F.

Based on the above sequence of events for (i) securing RCP pumps, (ii) aligning SDC with RCS, (iii) terminating SDC, and (iv) starting RCPs, the likelihood of an inadvertent operation of an RCP when the SDC is l

l aligned to the RCS is minimized, if not eliminated.

l l

l AnMAX.00D

4 21 Several other factors mitigate the potential of occurrence of this tran-sient. They are:

  • For an inadvertent RCP transient to cause a pressure spike, the RCS PORVs would have to fall to lift. During shutdown, two PORVs are available to relieve pressure.
  • A pressure spike cannot occur unless the reactor is water solid. The ,

actual events that took place at Turkey Point Unit 4 supports this notion (Reference 5). If there is a steam space in the pressurizer, that will collapse to accommodate the RCS coolant expansion due to _

heat up.

Another point that is noteworthy is as follows. If an overpresbure transient occurs due to an inadvertent RCP startup when the reactor is water solid, the pressure rise rate is rapid in comparison t.o the time taken to isolate SDC. Note that the SDC isolation MvVs need 1 2 minutes to close (with ACI). (or 10 minutes without ACI). By that time the pressure transient would already have occu:ted. Therefore, consequences will not be different in the SDC for the with and without ACI cases.

Further, also note that the potential consequences of overpressurizing the RCS is independent of SDC/RCS isolation. In fact, for the RCS, the conce-quences can be worro for the case where ACI etfectively isolates the SDC from RCS because of the loss of additional pressure relief paths. -

4.3.7 loss of SDCS Cooline Train q- The ovarpressure transient considered in this section is loss of SDCS cooling due to losses of equipment such na heat exchangers, service water, or pumps, rather than SDCS isolation events due to inadvertent ACI actuation.

Plant heat up rate subsequent to the loss of SDCS cooling event, and hence

% the rate of change of RCT/SDC pressure and temperature, is dependent upon the decay heat rate at the time of the event.

17VR4X,08D

2?

Due to the following reasons, the impact of removing the ACI is considered insignificant for this transient: l l

l j

  • Unless the event occurs soon after aligning the SDC when the decay -i heat levels are high, the transient will be relatively slow. For transients in which the pressure rise rate is relatively slow, re-placing the ACI by an alarm (to be installed) requiring operator action will not have a significant impact. l l

= Since SDC stays aligned to the RCS if the ACI (or the Alarm 4 Opera-tor Action) fails, the SDC RVs will be available to mitigate the transient.

  • 1rrespective of whether the SDC wac isolated or not, the PORVs (2 redundant trains) will alro be available to mitigate the transient.

4.3.8 Openine of Accumulator Discharre Igplation Valveu .

The nominal operating pressure of the MP2 Safety injection Tanks (SIT) is 215 psig. Therefore, discharge of the SIT tanks into the RCS cannot over-pressurize the SDC. The SDC ACI removal has no impact since this transient cannot occur. Further, per cooldown procedure OP 2297, several steps are taken to prevent discharge of SIT tanks to the RCS.

4.3.9 Letdown Isolation The plant behavior following a letdown isolation event was modeled and analyzed using an ovent tree to an extent that allows analysis of the

! impact of SDC ACI removal (Reference 10). The event tree analysis used approximate order of magnitude analysis for probabilities to show that the l

ACI removal has minimal impact.

l 4.3.10 Charrinn Pump Actuati2D Inadvertent actuation of charging pumps has the potential to create overpressure transients. This transient is not analyzed further due to the

-following:

17VR4X,080

23

  • t.t MP2, the capacity of a single charging pump is 44 gpm. Therefore, even if all chree charging pumps are operating, the maximum flow rate into the RCS cannot exceed 132 gt..n. This flow rate is low compared to the p0RV capacities, A single PORV can easily accommodate pres-sure rise associated with inventory input to the RCS.
  • In addition to above, the capacity of the relief valve 2-SI-468 on the SDC suction path is 222 gpm and far exceeds the total capacity of all three charging pumps.
  • As indicated by LER #90-015-91 (Reference 15), MP2 has had an event where all three charging pumps started. During this event only 50 gallons of inventory was added to the system and the operator 1

stabilized the plant using AOP 2571 (ieference 16). I 4.3.11 EqLeJv Iniection Pumn Actuation i

l In the cvent that one or both safety injection (SI) pumps inadvertently 1 actuate when the plant is shutdown and SDC is aligned to the RCS, a i significant mass input overpressure transient can occur. Unlike the charging pumps whose capacity is 44 gpm per pump, the three safety injec-tion pumps at MP2 have a design flow of 315 gpm per pump. Although the PORVs are capable of handling this mass input,- the relief valves on the SDC suction line are inadequate to prevent overpressurization due to inadver-tent safety injection.

The event trees in Figures 5 and 6 model the response of the plant and the operator to an inadvertent 31 actuation event and illustrate how the frequency of the end states may change when the ACI is replaced by an AIARM

! . and an Operator action.

The basis for choosing en initiating event frequency of 9.91 per year and the basis for_other probabilities used in the event trees in Figures 5 and 6 are provided in Reference 10.

17VR4X,080 I

4 fNITIATI SDC ACI ~

PORV3 OPERATOR OPERATOR PORVs P.ELEASE RELEASE fK3 EVENT C#EN STOPS OPENS ' RESEAT MODE MODE PUMP PORV Pnog, IE RSV LTOP CA1 OA2' POR 9 90E43 OK 7.33E45 OK 1 CDE-02 1.71E45 OK

.t 2 67E41 2.37E-08 PDS12 3 M UI 961Eos PDS13 7.25E47 OK i39E D 1.01E49 PDS14 2 67E41 2ME47 PDS15

. 5.78E49 OK I 3MD 8.0SE.12 PDS16 210E41 1.54E49 PDS17 i 100E-02 1.71E49 OK 2 67E.o1 2.38E-12 PDS18 3 " 41 9 61E 10 PDS19 l

RGURE 5
inadvet Si during Shutdow, (wth ACg C$CAFTA' JAP 2ACNNADSI.TRE 10G491 t

[

t r'.' --

--_____.___u __ _ _ _ _ _ _ _ _ _ -..____2._r_. .-: -_. m, . .. -

INITIATl ALARM +OP PORVS OPERATOR OPERATOR PORVs RELEASE RELEASE NG EVENT ERATOR OPEN STOPS OPENS RESEAT MODE ~ MODE

- ACTION - PUMP , PORV ~. PROB.

IE RSV . COP OA1 OA2 POR 9.80E43 OK 7.26E45 OK 100E 02 1.69E o5 OK 13 E*3 2 67E-Ot 2.35E46 PDSt2 3ME4' 9.52E46 F;413 100E42 '

7.25E45 OK

'29E43 1.01E47 PDS14 2 67E41 2.64E45 PDSt5 1 00E-O? 5.78E47 OK IEE43 6 05E-10 PDS16 210E-01 1.54E47 PDS17 1.71E47 OK g31 ' ME# 2.3SE-t o POS18 1

3 *E~0' 9 61E-08 PDS19 FIGURE 6: Inadver. Si daring Shutdown (with alarm) CACAFTAWMCNNADS!2.TRE 10/2(91 1

1

ll

@ 26 i ~ Comparison lietyeen WITH ACI and WITHOUT ACI Caff.n As illustrated in Figures 5 and 6 the reduced reliability of " ALARM 4 OPERATOR ACTION" compared to the ACI is reflected 73 the increased-frequen-cies of plant states PDS14 through PDS19 by about twn orders of magnitude, ilowever, before judging this increase as significant, (a) the risk signifi.

cance of each of the PDSs and (b) the magnitudes of the frequencies need to be considered. It is emphasized that a PDS in the context of this analysis is not necessarily a core melt or significant damage to the plant. Rather, the sequences identified as PDSs are plant conditions which require further op.:ator actions in order to stabilize the plant.  !

l l

For reasons-such as " LIFTED PORV" or " SECURED S1 PUMP," the overpressure i transient has been arrested for the sequences, PDS12, PDS14, PDS15, PDS16,  !

l PDS17, and POS18. They are treated as insignificant in risk. j

, For PDS13, since.the ACI or the alarm resulted in the closure of the SDC  !

suction isolation valves, SDC integrity is assured. Ilowever, since the automatic and manual attempts to open the PORVs failed, the RCS integrity is not assured. Further operator actions to secure the injection pumps must be made. -This sequence may be-treated as a risk significant sequence, However, its frequency is educed by ACI removal.

The sequence frequency of PDS19 increases from 9.61 x 10 40 to 9.61 x 10.a when the-ACI is deleted. Further, this sequence is risk significant in that both automatic and manual actions to miticate the transient have ,

failed. The sum of the frequencies of the -risk significant sequences PDS13

-and PDS19 increases from 9,61 x 10~5 ,(9.61 x 10-6 + 9.61 x 10"0) per year for. the WITH ACI case to 9.62 x 10' (9.52 x 10 + 9.61 x 10'8) per year for the WITHOUT ACI. case. That is, when the ACT is-removed, the t.otal-frequency of the ' risk significant sequences increased by _one 10-a per ywar.

This is a negligible increase in' risk. In spite of this negligible increase in risk, the following investigations were performed as a part of ,

this analysis to minimize the increases in risk due to ACI removal.

  • Minimizivg inadvertent SI actuations.

17VR4X 080

4 27

  • Improving LTOPS reliability.

4.3,11.2 Minimizinn Inadvertent SI Pumn Actuations The initiating event frequency used in the event trees in Figures 5 and 5

(.91 per year) is based on a frequency of 9.125 per shutdown year. The purpose of this section is to summarize the investigation of steps taken to ininimize SI Pump actuations at MP2. In this discession, an SI Actuation should be interpreted as the inadvertent SI signal starting an SI pump or pumps and discharging into the RCS. An inadvertent SI event that does not 3, tart the SI pumps is not significant since an overpressure transient does not result.

The operating procedures at MP2 were reviewed in order to examine the precautions taken to prevent inadvertent SI pump discharges into RCS. They are as follows:

  • According te Unit 2 operating procedure OP 2297, when "SIAS BLOCK PERMISSIVE" is annunciated at approximately 1750 PSIA, the SIAS sisaal is blocked and one HPSI pump is disabled by tagging the pump breaker open and by closing its discharge valve om header isolation ,

vs Ives .

  • OP 2297 instructs the operator to VERIFY one HPSI train disabled -

prior to decreasing temperature below 275'F.

  • OP 2297 cautions the operators to not allow any work to commence or continue on the ESAS panel since this will prevent a HPSI pump start and possible overpressurization.

The above procedural steps and the cautionary statement assume that only a single SI pump maf start in the event of an inadvertent SI, and therefore, inadvertent actuation of the non-disabled SI train is minimized. Consider-ing the relatively small capacities of the charging pumps at MP2, disabling both HPSI trains is not recommended since an adverse ef fect on LOCA risk can result.

17VR4X.000 L -_ -. - - - _ _ - _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ - - - - _ - _ _ ___.m_._-___.________.._________m_.--_m .__ _.- a

28 4.3.11.3 Improvinn LTOP Reliability The frequency of the risk si 6nificant sequence IQS 13 is relatively high and could be reduced by improving LTOP reliability.,

As shown in Figure 7, the two trains of LTOP are independent. This figure is based on in2ormation provided in References 17-24. The 129 VAC and 125 VDC supplies to the two trains are also independent. Given that the two LTOP trains are independent, it is determined that the LTOP unavail-ability is dominated most likely by other common cause failures (CCFs).

Functionally Coupled CCFs Using References 17-24, fur.ctions or system hardware that could potentially fail both trains of UTOP vere irae s tigated. The support systems for instruments such as 129 VAC and 125 VDC were examined for shared dependen-cies. Such shared hardware were not found.

Human Couplinct CCFs attributable to human couplings were examined. Likely candidates for human errors of omission are discussed below:

  • ',erator fails to change PORV set point from HIGH to LOV during plant -

cooldown, t

Several defenses exist against the above operator error. There are several procedural steps and precautions on changing the PORV set point from HICH to LOW. In addition, as illustrated by Figure 7, when the RCS temperature is less than 280*F and RCS pressure is less than 375 psia, " RESET TO LOW" will be annunciated on the control board. Given that procedural instructions, precautions, and alarms exist, the probability of this error is considered low.

17VR4X,083

TRANSMITTERS COMPARATORS LIM 1I ALARM / ACTION T A 115-1 A RESET Tv HIGH T A-115- i B TE-115 k280F C/L T A-115-2 v LOOP 1B RESET TO LGV T A-115 -3 Y280F v u-k 400 PSIA - (PORV)

P A- 103-1 RC 402 OPENS Y 375 PSIA PA-103-1 A PT 103-1 P A-103-1 B PZR 280 PSIA k P A-103-1 C AUTOCLOSUREINTERLOCK T A-125-1 RESETTO HIGH TA-125-1 A LTOP ALARM TE 125 Y280F C/L T A-12 5-2 v LOOP 2A RESETTOLGV T A.125-3 k280F v sr-A 400 PSIA (PORV)

P A-10' ,

RC 404 OPENS P A-103 A k 440 PSIA P A-103- B PT-103 P A- 10 3-C AUTOCLOSUREINTERLOCK FIGURE 7 LTOP & ACI ALARMS & ACTUATIONS

_ . . - . _ . ~ . . __ . . . __ . _ . _ _ . - . _ - _ . _ _

o i 30 l

  • Operator unintentionally disables LTOP capability. l 1

)

In spite of the Technical Snecifications and other precautiona.

industry experience and HP2 plant specific experience indicate that  !

the unintentional disabling of LTOP is a credible failure that may contribute to partial or t. cal failure of LTOP.

For example, during the set ...o described in IIR 85 910, both LTOPs were out of service at MP2 due to procedural deficiency. Specifical-ly, both PT 103 and PT 103 1 pressure transmitters usdJ in the two ,

indepen6ent LTOP trains were isolated and left in that state as a prerequir: e for the containment building integrated leak rato test (11JtT) . During this event, insufficient LTOP protection existed for up to 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

At MP3, during 1988 both trains of the overpressure protection systern were disabled due to an operator errer of conmission iReference 25).

Specifically, both logic trains for the overpressure prctectir n a sys-tem were disabled when the RPS panols were disabled.

The above examples show that operator errors of commission rather i than omission inay contribute to the failure of both 1. TOP trains.

activities that are carried out during shutdown may affect sig.

nificant portions of LTOP trains. It is concluded that. ensuring that the shutdown activities and procedures do not interfere with LTor performance may lead to an improved LTOP reliability.

I i

l l

[

t i 17Vii4X.08D l

v 0

31

5.0 CONCLUSION

S . INSICllTS, AND RECoddENDATIQMS This section suminarizes the findings of the PRA analysis and, whc appropriate, provides recommendations based on insights gained during the  ;

analysis. .

P 5.1 1stocA Amivais Removal of ACI and replacing it with the prog osed alarm has negligible .

impact on ISLOCA frequency for power operation. The impact on this

  • requency may be minimal to none. The following insights gained are considered significant.

t (i) - The existence of the relief va',ve 2 SI 469, and more importanulv its set point of 300 psig, results in the extremely low ISLOCA frequency associated with the SDC suction path. Note tnat, although the chosen set point for 2-SI 469 is 300 peig, the design basis set point for ,

this valve is 2300 psig. From an ISLOCA point of view, the 300 psig set point is superior to ( 2300.psig set point. This insight is considered significant and visi be included in the KP2 FSAR. <

(ii) The ' leak rate test (Urr) of the SDC isolation valve 2-51 651 is performed usually during the plant heat up rather t.han the plant couldown process. The ISLOCA frequency will not be significantly af+ .

fected even if the LRT is performed during plant cooldown, in which case this val will be cycled after the LRT. Ilowever, from a safety point of view, the LRT is preferred'during piant heet up.

' (iii) At MP2, the power to the suction isolation valves 8s temoved prior to reaching the mid loop operation with these'two valves placed in the

- OPEN position. The purpose of this action is to prevent ACI induced loss of SDC events, lloweser, this operating practice introduces the

. potentic) to leave the SDC isolation valves in the OPEN positinn after the midloop operation is comploced. khen the SDC ACI is

removed,thispotentiaN.'operatorerror,whichmaycontributetoan ISLOCA, will be eliminated.

UWl4X. 06D

..+,-,,,_sm ,,_w,.,,r. , , , _ _ , . . , , _ ,,.my., g ,_ , , . , , , , . , _ . _ _

F=.-

s. '

32 I

5.2 1 ors of SimLdovn Cooling ,

i Based upon industry experience, it is concluded that the frequency of loss _

of SDCS events could be reduced by approximately 28 percent when the ACI is removed. Inadvertent ACis that cause the loss of the SDC5 are risk significant if they occur during midloop operations. At M8??, the SDC isolation MOVs are de energized in the OPEN position during midloop operation. This operation practice minimizes the risk associated with the inadvertent ACI events.

i 5.3 overoressure Transients in summary, ACI removal at MP2 has a minimal impact on the risk usually attributed to ACI removal. Sp6cific insights on individual LTOP transients ars as f0110; : ,

i. Effect of ACI removal on the " premature opening of the SDCS" is i disregarded due to the low frequency of the initiator. That is, the interlocks and operating procedures reduce the likelihood of this  !

transient to a uinimum.

11. Effect on the " Inadvertent Rod Vithdrawal" accident is not analyzed i

in cetail due to the low likelihood of the accident.

1 111. Effect of ACI removal on the " Failure to Isolate SDCS During Start

. Up" overpressurs transient is not analyzed in detail due to the very lov likelihood of occurrence of this event. [

t i

iv, Effect of ACI removal on the " Inadvertent Pressurizer lleater Actua.

tion" event is not analyzed in detail due to the low probability of this event and allo dua > slow development of the transient. -

v. Effect'ot=ACI removal'on the "Startup of an-Inactive RCP loop" is c

minimal if noc negli &ible due to; low probability of occurrence, and i-a.

i l

l 17W6X .06D

=

l 33

b. mitigating systems (ACI or AhARM, Relief Valve, PORVs) availabic as defenses.
c. Consequences of the transient may be too rapid for either ACI or the ALARM to make a difference.

vi. Eit~ect of ACI removal on the " Loss of CDCS Cooling Train" tranatent is minimal due to relatively low pressure rise rate (unicas the transient occurs soon ofter aligning the SDC following shutdown), and availability of mitigating systems such as PORVs, SDC Relief Valves, in odottion to the ACI or the new ALARM. l l

vii. ACI remova. has no impact on the " Opening of Accumulator Isolation Valves" tras.ient due to relatively low operating pressure of the SIT tanks and due to many operating practices used to prevent SIT tank discharge into the RCS.

viii. ACI removal has an insignificant impact on the risk attributed to the

" Letdown Isolation, SDC Operable" transient due to multiple def enses such as the PORVs and the SDC relief valve 2-SI 468 in addition to ACI or the new AIARM. Adequacy of the capacity of 2 SI-468 (SDC relief valve, 222 gpm) with respect to the input from the charging pumps (44 gpm/ pump) is a key to the insignificant impact, ix. ACI removal has an insignificant impact on the " Charging Pump Actua-tion" Transient due to (a) adequate capacity of the relief valve 2-SI-468 compared to charging pumps and (b) PORV capability and operatcr cepability illustrated during a plant specific event.

x. The risk increase associated with the " Inadvertent S1 Pump .ictuation fransient" is negligible.

Other insights gained from this transient analysis are summarized in Sections 5.4 and 5.5.

i

- 17VR4X.06D

__.__.____.._____.____,_.____.___.__..____._m_

o b

34 5.4 LTOP Reliabi y The analysis of the inadvertent SI purnp actuntion transient above indicates the high inportance of LTOP reliability since it is the single defense to

- prevent RCS overpressurizat.lon apart. from the operator actions that are not proceduralized.

)

LTOP consists of two completely independent trains, but other common cause failures could play a major role in LTOP reliability. Based on further l examination, it is concluded that the Errors of Conunission, specifically, undesirable impacts on LTOP trains resulting from shutdown activities, most likely, is the single largest CCF contributor to LTOP unavailability. A review of procedures to minimize human errors of conunission that can potentially_ disable both trains of LTOP will be a cott beneficial. effort.

- It is emphasized that the above is simply an important insight gained during the study, and the risk attributed to this overpressure transient is

~

not significantly affected by the ACI removal. However, MP2 engineering reviewed existing procedures to verify that the potential for human errors of commission is minimized.

5.5 SDC Relief Valve 2-SI 468 Capacity It is concluded thae. the capacity of the SDC relief valve 2 SI-468 is adequate except for the overpressure transient where ona or innre Si pumps may actuate. The operating practices at MPX have minimized the potential for SI pump actuation as far as practicable and cannot be reduced further

- without adversely affecting the shutdown IDCA risk. MP2 Technical Specifi-cations surveillance section 4.5.3.2 requires that all but ons llPSI be disabled pitor to cooling down be.ow 275'P, In addition, procedure OP2207 also specifically directs this action (Step 4.22.5) and then cautions against allowing work that can cause a llPSI pump start until all pump 9 are disabled.

1 1h74X.00D '

i

~ .w --*,-x ..---,.,,-,s.,m-. ,,..,.cn , w_. , . , - , . , .- , , _ . , . , , , _ _ - . _ , , _ _ _ , _ _ _ _ , , _ , , , _ , . , , _ , , , , _ _ , . , , , . , _ , _ _ , , , , . , ,

b ,

f 33 h '

h REFERENCES r

(1) P&ID 25203-26015. "L.P. Safety Injection System," Sh. I of 3, j

Revision 7. -

(2) P61D 25203 2601$, 'L.P. Safety injection System," Sh. 3 of 3 i Revision 5.

(3) Ceneric Letter 8712 " Loss of RHR while the RCS is Partially Filled," USNRC, July 9, 1987 r

(4) Ceneric letter 8817, " Loss of Decay Heat Removal," USNRC, October 17, 1988, 1

(5) c. Vine, et al. " Residual Feat Removal Experience Review and Safety Analysis.- Pressurized Vater Reactors," NSAC 52, January 1983.

(6) U.S. Nuclear Regulatory Commission, Office for Analysis and Evalua- ,

tion of Operational Data, " Decay Heat Removal Problems at U.S. Pres.

surized Water Reactors," Case Study Report AEOD/C593, December 1985. 1 (7) Memorandum from B. W. Sheron, NRC to RSB members,

(8) OP 2310, " Millstone Unit 2 Operating Procedure for Shutdown Cooling."

(9) WCAP 11736-A, " Residual Heat Demoval System Auto Closure Interlock Removal Report for the Westinghouse Owner's Group," Rev. 9 9, October.

1989.

(10) Northeast Utilities calc. File V2-517-999 BE 'MP? SDC ACI Removal,"

3 Rev 9

-(11) Northeast Utilities Calc. File W2-517 787-RE (Revision 9),

" Interfacing Systems LOCA," July _8,1987.

I (12) MP2 Station Procedure OP 2207, " Plant Cooldown," Revision 16.

I 17VR4X,0$D

,4 O

36 Peferences (Continued)

(13) M111siet.c Nuclear Power Station Unit 2, Pinal Safety Analysis Report.

(14) OP 2201, "Mi'2 Unit Operating Proce6are - Plant lleat-Up," Revision 19.

(15) MP2 LER 90-015 01 " Inadvertent ECCE Actuatis, Update Report," 09 19-50, (16) AOP 2571, " Inadvertent ECCS Initiation," Revision 1.

(17) MP2 P61D 25203 28500 "TE-111Y, TE 115, and PT 1031 COLD LEG TEMP to Reactor LOOP Diagram," Sh. 750, Revision 5.

(18) MP2 P61D 25203-28500, "TE-111Y, TE 115, and PT 103 1 COLD LEC 7EMP to Reactor LOOP Diagram," Sh. 75D, Revision 1.

(19) HP2 P61D 25203-28500, "TE 121Y, TE 125, and PT 103 COLD LEG TEMP. to Reactor LOOP Diagram," Sh. 99D, Revision 1.

(20) MP2 P61D 25203 28500, Sh. 990, Revision 5.

(21) MP2 P61D 25203-28500, Sh. 998 Revision 11.

(22) MP2 P61D 25203 32007, Sh. 23, Revision 7.

(23) HP2 P61D 25203-32007, Sh. 24, Revision 6.

(24) HP2 P61D 25203-28500, Sh. 75B, Revision 7. 5 r

(25) MP3 LER 88-995, " Cold Overpressure Protection System Pails to Operate'T During Pressure Tr ansient," 02 18 88.

l I

l l

l 17VR4X.CBD L  ;

Retrieved from "https://kanterella.com/w/index.php?title=B14005,_SDC_Auto-Closure_Interlock_Removal_at_Millstone_Unit_2&oldid=3492738"