ML12023A187
ML12023A187 | |
Person / Time | |
---|---|
Site: | Palisades ![]() |
Issue date: | 01/17/2012 |
From: | Entergy Nuclear Operations |
To: | Office of Nuclear Reactor Regulation |
References | |
EA-PSA-SDP-D11-2-11-07, Rev. 2 | |
Download: ML12023A187 (96) | |
Text
SEA-PSA-SDP-D1 1-2-11-07 Revision: 2 Date: 01/17/2012 Entergy Number of Pages: 154
Title:
SDP Assessment of DC Panel DIl-2 Fault Approval: See signature page.
Purpose This engineering analysis assesses the significance of the dc panel fault and subsequent plant trip that occurred on 09/25/2011. Inadequate maintenance work instructions led to a short within dc panel ED-1I-
- 2. Contrary to intended design, the fuse between ED-1 1-2 and dc bus ED-1 OLED-1 OR failed to provide adequate protection and did not isolate the panel from the bus. This resulted in the loss of ED-1OL/ED-1OR and subsequent plant trip.
Conclusion Based on reviews of the event timeline, plant design and response, operator responses, plant-specific thermal-hydraulic analyses, potential human errors and logic model quantification, the following conclusions were reached:
- Plant risk during the event increased. The increase in the conditional core damage probability given the dc panel ED-1 1-2 fault and subsequent plant trip is evaluated to be 4.3E-6, and is considered WHITE.
" The risk increase is driven by scenarios in which the lost train of dc power is not recovered. When combined with other failures, this could result in a loss of secondary side cooling via the steam generators, failure to refill the condensate storage tank to provide long term cooling, failure to cool down and transition to shutdown cooling, and the failure of once-through-cooling as a last resort for decay heat removal, and ultimately core damage.
- The risk increase is also comprised of scenarios in which charging pumps are not isolated in time to prevent a challenge to pressurizer safety relief valves, resulting in a potential loss of coolant accident ifone or more relief valves sticks open. Failures to mitigate this consequential event can then lead to core damage.
" A stuck open pressurizer safety relief valve is classified as an above core, vapor space LOCA.
For these scenarios, as long as secondary side cooling is available for decay heat removal the transient does not necessarily require high pressure safety injection to preclude core damage. If auxiliary feedwater remains available, the core survives the initial blowdown and inventory
makeup from charging is sufficient to maintain primary coolant system inventory and preclude core damage. Long term heat removal via the steam generators (or transition to shutdown cooling) then becomes a success path, even when a SRV sticks open - provided a nominal level of inventory makeup is available (e.g., via charging with SIRWT inventory conserved by terminating sprays, or via HPSI in recirculation mode once SIRWT inventory is depleted).
- Realistic and justifiable human error probabilities were used for fault-related recoveries. Use of conservative human error probabilities increases the conditional core damage probability. The increase in delta conditional core damage probability is 6.OE-06 for the event, and is still considered WHITE.
- Steam generator overfill was precluded during this event by isolating steam to the turbine driven auxiliary feedwater pump and limiting flow from AFW pump P-8C via flow control valves. Failure to do so could have resulted in steam generator overfill and the loss of the turbine driven auxiliary feedwater pump. The failure to restore the pump if needed was considered and did not contribute significantly to the risk.
Note: This engineering analysisis not a 10 CFR §50.2 design basis analysisand the results and conclusionsof this analysisdo not supersede those of any design basis analyses of record. The biases and degree of conservatism embodied in the methods, inputs and assumptionsof this analysis may not be appropriateto support allplant activities. An appropriatelevel of engineeringrigor commensurate with the safety significance of the topic under considerationis ensured in this analysisby conformance with all applicableEntergy procedures.
Table of Contents 1.0 PURPOSE .......................................................................................................................................... 4
2.0 CONCLUSION
................................................................................................................................... 4
3.0 BACKGROUND
................................................................................................................................. 5 3.1 Event Summary .............................................................................................................................. 5 3.2 Maintenance Initiating Event Summary .................................................................................... 5 3.3 Latent Coordination Issue Summary ......................................................................................... 6 3.4 Evaluation Context .......................................................................................................................... 6 3.5 Key Factors Impacting Plant Response .................................................................................... 7 4.0 INPUT ................................................................................................................................................. 9 4.1 PRA Tools and Models Input ..................................................................................................... 9 4.2 Plant Configuration Input ......................................................................................................... 11 4.3 Plant Design and Operation Event-Specific Input ................................................................... 11 5.0 ASSUMPTIONS ............................................................................................................................... 15 5.1 Major Assumptions ....................................................................................................................... 15 5.2 Minor Assumptions ....................................................................................................................... 17 6.0 METHODOLOGY ............................................................................................................................. 18 6.1 Thermal-Hydraulic Model ......................................................................................................... 18 6.2 Logic Model .................................................................................................................................. 18 6.3 Human Error Probabilities ...................................................................................................... 20 6.4 Pressurizer Safety Relief Valve Failure Probability ................................................................. 27 6.5 Significance Determ ination Color Criteria ............................................................................... 28 7.0 ANALYSIS ....................................................................................................................................... 29 7.1 Evaluation of Increased Plant Risk ......................................................................................... 29 7.2 Sensitivity Studies ......................................................................................................................... 33
8.0 REFERENCES
................................................................................................................................. 35 9.0 ATTACHMENTS .............................................................................................................................. 36
1.0 PURPOSE This engineering analysis assesses the significance of the dc panel fault and subsequent plant trip that occurred on 09/25/2011. Inadequate maintenance work instructions led to a short within dc panel ED 2. Contrary to intended design, the fuse between ED-1 1-2 and dc bus ED-1OL/ED-1OR failed to provide adequate protection and did not isolate the panel from the bus. This resulted in the loss of ED-10IL/ED-1OR and subsequent plant trip.
Specifically, this analysis evaluates the conditional core damage probability given the fault event, fault propagation, impacted components, and potential recoveries. The conditional core damage probability includes consideration of additional random component failures and recovery actions that might have been unsuccessful. This analysis addresses the dc panel ED-1 1-2 fault. Only the single (internal) initiating event under the conditions that occurred is evaluated. This analysis does not address accident initiators from other internal events, internal flooding, or external events (high winds, tornadoes, internal fires, etc).
2.0 CONCLUSION
Based on reviews of the event timeline, plant design and response, operator responses, plant-specific thermal-hydraulic analyses, potential human errors and logic model quantification, the following conclusions were reached:
- Plant risk during the event increased. The increase in the conditional core damage probability given the dc panel ED-1 1-2 fault and subsequent plant trip is evaluated to be 4.3E-6, and is considered WHITE.
" The risk increase is driven by scenarios in which the lost train of dc power is not recovered. When combined with other failures, this could result in a loss of secondary side cooling via the steam generators, failure to refill the condensate storage tank to provide long term cooling, failure to cool down and transition to shutdown cooling, and the failure of once-through-cooling as a last resort for decay heat removal, and ultimately core damage.
" The risk increase is also comprised of scenarios in which charging pumps are not isolated in time to prevent a challenge to pressurizer safety relief valves, resulting in a potential loss of coolant accident if one or more relief valves sticks open. Failures to mitigate this consequential event can then lead to core damage.
" A stuck open pressurizer safety relief valve is classified as an above core, vapor space LOCA.
For these scenarios, as long as secondary side cooling is available for decay heat removal the transient does not necessarily require high pressure safety injection to preclude core damage. If auxiliary feedwater remains available, the core survives the initial blowdown and inventory makeup from charging is sufficient to maintain primary coolant system inventory and preclude core damage. Long term heat removal via the steam generators (or transition to shutdown cooling) then becomes a success path, even when a SRV sticks open - provided a nominal level of inventory makeup is available (e.g., via charging with SIRWT inventory conserved by terminating sprays, or via HPSI in recirculation mode once SIRWT inventory is depleted).
" Realistic and justifiable human error probabilities were used for fault-related recoveries. Use of conservative human error probabilities increases the conditional core damage probability. The increase in delta conditional core damage probability is 6.OE-06 for the event, and is still considered WHITE.
Steam generator overfill was precluded during this event by isolating steam to the turbine driven auxiliary feedwater pump and limiting flow from AFW pump P-8C via flow control valves. Failure to do so could have resulted in steam generator overfill and the loss of the turbine driven auxiliary feedwater pump. The failure to restore the pump if needed was considered and did not contribute significantly to the risk.
3.0 BACKGROUND
3.1 Event Summary On 09/25/2011, Palisades experienced an automatic reactor trip due to loss of power to 2 of 4 reactor protection system channels due to loss of power to preferred ac buses EY-1 0 and EY-30. Loss of power to dc bus ED-10L/ED-10R and consequently preferred ac buses EY-10 and EY-30 was the result of maintenance activities in dc panel ED-1 1-2. The maintenance activities caused a short in ED-1 1-2 and actuation of shunt trip breaker 72-01 on over-current protection. The consequence of these events was loss of power to dc buses ED-1 OL and ED-1 OR and loss of power from preferred ac buses EY-1 0 and EY-30.
No actual safety consequences resulted from this event. System response was as expected given a loss of one train of dc power. Right channel safety injection initiated immediately. Left channel safety injection initiated when EY-30 was placed on the bypass regulator. High and low pressure safety injection operated but did not inject since primary coolant system pressure remained above shutoff head. The opposite train of dc power remained available throughout the event.
The significant grounding event on dc panel ED-1 1-2 disclosed a latent coordination issue: the shunt trip breaker 72-01 opened, disconnecting the battery from the dc bus. The event also caused an internal fault in in-service #1 charger ED-15. The combination of events de-energized the dc bus resulting in loss of power to dc panels ED-11-1, ED- 11-2, #1 inverter ED-06 and #3 inverter ED-08. Loss of power to the inverters resulted in loss of power to two preferred ac panels (EY-1 0 and EY-30). Opening of breaker 72-01 was not expected as the design for this breaker required that breaker operation only be available via remote push button.
See Attachment 01 for a detailed event time line.
3.2 Maintenance Initiating Event Summary Breaker 72-120 was the first breaker removed from panel ED-1 1-2. Upon removal, a small air gap between the positive bus tie stab and the line side positive connection on breaker 72-119 was noted. An initial attempt was made to tighten the connection and close the identified air gap. The termination screw was found to be tight. The air gap was a result of a cross threaded screw, preventing the termination to be made tight. Following the removal of breakers 72-119, 72-121, and 72-123 the decision was made to remove the positive and negative copper connection stabs used to connect breakers 72-119 and 72-120 to the vertical bus; and to re-tap the damaged threads located on the copper connection stab as a result of the cross threaded screw.
As the positive copper connection stab was being removed, the repairman perceived a small arc which startled him resulting in a loss of control to the positive copper connection stand stab. The positive copper connection stab rotated downward and contacted the negative copper connection stab creating a direct short of the positive and negative dc bus within the ED-1 1-2 panel. Subsequently the reactor tripped following a loss of power to ED-1 1-2 panel.
Figures.3-1 and 3-2 below show the configuration of dc panel ED-1 1-2 just prior to and following the event.
Since the event was the result of a maintenance activity, personnel qualified to determine the extent of condition with respect to the fault and electrical component failures were present to carry out the recovery actions. Buses ED-10L and ED-10R were re-energized from station battery ED-01 within about 50 minutes.
Figure 3-1: DC Panel ED-11-2 -Just Prior to Event Figure 3-1: DC Panel ED-11 After Fault Event 3.3 Latent Coordination Issue Summary See Attachment 02 for a discussion of expected and actual dc breaker and fuse coordination.
3.4 Evaluation Context The 09/25/2011 event revealed two performance deficiencies: (1) inadequate work instructions that led to a maintenance-induced dc panel fault, and (2) inadequate breaker/fuse coordination between a dc panel and bus that led to propagation of the dc panel fault to the dc bus.
A human performance deficiency (inadequate work instructions) caused a fault of sufficient magnitude to expose the latent breaker coordination deficiency. The short circuit current at the dc panel was sufficient to actuate dc breaker 72-01 internal trip function. The breaker actuation is a coordination issue since the fuse from dc panel ED-11-2 should have isolated the fault condition from dc bus ED-1OL/D1O-R.
Actuation of breaker 72-01 removed the battery as one source of power to dc bus ED-1OL/ED-1OR and contributed to the total loss of power to the bus.
This analysis evaluates the risk incurred during the post-event response. The human performance deficiency created a condition in which breaker 72-01 opened. Therefore this analysis models breaker 72-01 as open (unless successfully restored). The evaluation models the reactor trip event as a direct consequence of the human performance event, by setting the transient event frequency to unity.
The consequence of the human performance deficiency alone (without the breaker coordination deficiency) would have been isolation of the dc panel from the dc bus with the bus and the remaining loads continuing to be energized. However, the active (latent) trip mechanism in breaker 72-01 resulted in disruption of the existing coordination.
Breaker 72-01 opened prior to fuse FUZ/D1 1-2 resulting in disconnection of battery ED-01 from bus ED-10R. Subsequently an internal fault in the in-service #1 battery charger ED-15 actuated to disconnect the panel fault from ac power supply MCC #1. Additionally the panel fault also caused at least one breaker to open: breaker 72-37 to #1 inverter ED-06 supplying preferred ac bus EY-10.
Recovery from this event required identification of the fault condition (obvious in this case) and removal of the fault and or isolation of the fault from the dc bus. Once the fault was isolated individual components (battery chargers and inverters) were assessed for operability to allow restoration of power to the dc bus.
Initially, preferred ac bus EY-30 was restored by aligning power to it from the bypass regulator (redundant to the inverter and supplied by instrument ac panel EY-01). Next, buses ED-1 OR & ED-1 OL were declared operable and re-energized from the battery by closing breaker 72-01. Once the dc bus was energized, power to preferred ac bus EY-30 was transferred back to #3 inverter ED-08 being supplied by the dc bus and power was restored to preferred ac bus EY-1 0 by aligning it to the bypass regulator. At this point the dc bus and both preferred ac buses were re-energized with portions of dc panel ED-1 1-2 not available.
3.5 Key Factors Impacting Plant Response Based on the plant response to the ED-1 1-2 fault event, a review of the following factors represents an opportunity for improved operations and engineering training. The plant response and sensitivities discussed below are considered to be within the knowledge base of operations and engineering.
However, the degree of sensitivity and the operational implications are worth noting here.
Identification of these factors was an indirect result of the risk assessment. Presentation here is for background purposes only. These factors underscore the complexity of the loss of dc event and provide a context for the successful operator actions during the event.
Note: all temperatures, pressures, levels and percentages are considered approximate in the discussions below.
3.5.1 Sensitivity of PZR level to PCS temperature changes PCS temperature changes significantly impact pressurizer level.
For example, based on a PCS volume of 81,500 gallons (10,900 ft3, FSAR Table 4-1) and the density change in water from 5250 F to 544 F at 2060 psia (47.1 Ibm/ft3 to 48.3 Ibm/ft ), PCS volume changes by 109 gallons/0 F. Based on volumes of 809 ft3 and 593.7 ft3 at levels of 57%
and 42%, respectively [1], there are 107 gallons/%. This results in 1.02%/°F.
During this event from 16:03 to 16:15, PCS temperature increased from 529*F to 544°F. Even with charging and letdown isolated (charging was isolated at 15:57, with pressurizer level at
-80%; controlled bleedoff at 5 gpm), pressurizer level increased from 85% to 101.5% due to thermal expansion (see Attachment 01).
The observed increase agrees reasonably well with a prediction based the rates calculated above (i.e., 1.02%/°F and 107 gallons/%):
85% + (544°F - 529°F) * (1.02%/°F) - 5 gpm
- 12 min / 107gal/% = 100%.
3.5.2 Sensitivity of PCS level and SG level to relatively cold makeup water Heatup of makeup water after entering PCS increases the effective volumetric makeup rate.
For example, 73 gpm at 110'F charged into the system is 95 gpm when heated to 535°F, based on the density change in water from 1 10°F to 535°F at 2060 psia (62.2 Ibm/ft3 to 47.7 Ibm/ft3). A similar sensitivity is present for AFW pumped to the SGs. For example, 330 gpm indicated flow is effectively 435 gpm, based on the density change in water from 110°F to 535°F at 1000 psia (62.0 Ibm/ft3 to 47.0 Ibm/ft3).
3.5.3 Sensitivity of AFW flow split to differences in SG pressure Relatively small differences in SG pressure lead to significant differences in AFW flow to each SG when flow control valves are not available to regulate flow.
For example, with P-8B in service with CV-0727 and CV-0749 full open, and with E-50A pressure at 948 psig and E-50B pressure at 945 psig, the flow split is 179 gpm to E-50A and 187 gpm to E-50B.
However, with E-50A pressure at 860 psig and E-50B pressure at 958 psig, the flow split is 379 gpm to E-50A and 0 gpm to E-50B (see Attachment 10). Steam generator pressure differences are attributable to differences in main steam safety valve characteristics and the P-8B steam supply source (from E-50A).
3.5.4 Sensitivity of PCS temperature to relatively cold AFW makeup to SGs when ADVs not available When ADVs are not available to control PCS temperature, excess AFW significantly decreases PCS temperature. For example during this event, PCS temperature lowered from 540°F to 527°F primarily due to excess AFW addition (700 gpm total).
3.5.5 MSSV operation during relatively benign SG overpressure events Depending on heat input to the steam generators, MSSVs can provide a throttling action and produce a system response similar to ADV operation.
MSSVs initially open to -70% when the setpoint is reached. If pressure continues to rise, MSSVs gradually open further and open fully when pressure reaches -2.5% above set pressure. As pressure is reduced, MSSVs remain open but close to -25% when pressure lowers to -2.8%
below set pressure, and close fully when pressure lowers to -3% below set pressure.
For example, the first set of MSSVs open to -70% at 985 psig. As pressure is reduced, MSSVs close to -25% when pressure lowers to 957 psig and fully close when pressure lowers to 955 psig. This precludes the severe saw-tooth steam generator pressure response that may be familiar from FSAR Chapter 14 analyses (e.g., loss of normal feedwater).
4.0 INPUT Inputs are grouped into three categories:
(1) PRA software tools, existing PRA models and evaluations (2) Plant configuration just prior to the event (3) Plant design and operational inputs from the event PRA tools and models input generally define the starting point of the logic model analysis.
Plant configuration inputs define the relevant equipment configuration just prior to and during the maintenance activity that led to the event.
Plant design and operation inputs describe several key design aspects and operation of the plant in response to the event. This is not intended to be an exhaustive description of the plant response (see 1 for a detailed timeline.
4.1 PRA Tools and Models Input 4.1.1 The SAPHIRE software application is used for PRA model quantification. Table 4-1 lists the file specifics.
Table 4-1: SAPHIRE Application (Ref. [2])
Filename I Date ITime I Size ISAPHIRE-7-27-852878059.exe 1 6/24/2008 11:48a 1 18,303 KB 4.1.2 The CAFTA software application is used for creating and viewing PRA model logic. The baseline CAFTA model serves as the starting point of the core damage fault tree model evaluated in this analysis. Table 4-2 below lists the baseline CAFTA files.
Table 4-2: CAFTA Model (Ref. [3])
Filename Description Date Time Size - KB PSAR2c.be PSAR2c CAFTA Basic Event File 6/26/2006 1:42p 1,248 PSAR2c.caf PSAR2c CAFTA Fault Tree File 6/26/2006 1:36p 449 PSAR2c.gt PSAR2c CAFTA Gate Type File 6/24/2006 1:31p 1,024 PSAR2c.tc PSAR2c CAFTA Type Code File 5/27/2004 9:03a 30 PSAR2c CAFTA Files.zip PSAR2c CAFTA zip file 6/29/2006 8:47a 289
4.1.3 The SAPHIRE project model is used for PRA model quantification. Table 4-3 lists the PSAR2c SAPHIRE project file used as the initial data set for this analysis.
Table 4-3: SAPHIRE Quantification (Ref. [3])
Filename Date Time Size - KB Description Caf2Sap PSAR2c.txt 6/29/2006 8:59a 11 Text rules file used by caf2sap.exe to create MAR-D files.
caf2sap.exe 3/24/2003 8:16a 28 Visual basic application for creating SAPHIRE MAR-D fault tree files.
Creation of Rules File 6/26/2006 2:42p 2,162 EXCEL spreadsheet that creates the *.txt rules file PSAR2c.xls for SAPHIRE MAR-D fault tree assembly.
PSAR2c FTree Logic.ftl 6/29/2006 9:16a 3,421 MAR-D fault tree file created from the PSAR2c I_ I I I CAFTA master fault tree.
SAPHIRE v7.26 PSAR2c 6/29/2006 9:43a 1,099 Above listed supporting files.
Ftree Files.zip I I 4.1.4 Table 4-4 defines the house event configuration used in both the base case and maintenance configuration case for this engineering analysis:
Table 4-4: House Event Configuration House Event House Event A-HSE-CST-MAKEUP F 1-HSE-M2LEFT-INS T C-HSE-P-52A-STBY T 1-HSE-M2RGHT-INS F C-HSE-P-52B-STBY T M-HSE-P-2A-TRIP T C-HSE-P-52C-STBY F M-HSE-P-2B-TRIP F D-HSE-CHGR1-INS T M-HSE-SJAEI-INS T D-HSE-CHGR2-INS T M-HSE-SJAE2-INS F D-HSE-CHGR3-INS T U-HSE-P-7A-STBY T D-HSE-CHGR4-tNS F U-HSE-P-7B-STBY F E-HSE-AIR-GT-75F T U-HSE-P-7C-STBY F E-HSE-AIR-LT-75F F X-HSE-2SG-BLDN 1 E-HSE-BYPASS-REG T X-HSE-2SG-BLDN-A 1 E-HSE-EDG11-DEM T X-HSE-2SG-BLDN-B 1 E-HSE-EDG11-RUN T X-HSE-SGA-BLDN 1 E-HSE-EDG12-DEM T X-HSE-SGB-BLDN 1 E-HSE-EDG12-RUN T Y-HSE-LOOP1A-BRK T I-HSE-C-2AC-INS T Y-HSE-LOOP1B-BRK F I-HSE-C-2B-INS F Y-HSE-LOOP2A-BRK F I-HSE-F-12A-INS T Y-HSE-LOOP2B-BRK F I-HSE-F-12B-INS F Y-HSE-RAS-POST F I-HSE-F-5A-INS T Y-HSE-RAS-PRE F I-HSE-F-5B-INS F X-HSE-DOOR-167B T X-HSE-DOOR-167 T Note: D-HSE-CHRGR3-INS is set to True to allow faults on ED-1 1-2, 72-01 and battery chargers #1 and
- 3 to fail ED-1OL and ED-10R. Charger #3 is not faulted, but is initially set to True to create the loss of dc to the bus and allow consideration of recovery of power to the bus as it was the standby charger.
4.2 Plant Configuration Input 4.2.1 Start-up power to bus 1 F EA-23 breaker 252-302 out of service.
At the time of the loss of dc event, breaker 252-302 was out of service and cooling tower pump P-39A was powered from breaker 252-301 via station power transformer 1-3 EX-05. As a result, breaker 252-302 is modeled as out of service in this analysis. In the logic model, since the event results in a loss of condenser vacuum and cooling tower pumps support only maintaining condenser vacuum, there is little risk increase associated with this pre-existing condition.
4.2.2 Feedwater purity air compressors C-903A and C-903B aligned to plant instrument air.
At the time of the loss of dc event, feedwater purity air compressors C-903A and C-903B were cross-tied to instrument air via CV-1221. This alignment was a contingency. Work planning recognized instrument air compressor standby start may not work if dc power was lost due to the maintenance activity.
C-903A and C-903B are powered from MCC #91 by bus 1E. The loss of dc event resulted in a safety injection signal, subsequent bus 1E load shed and loss of power to C-903A and C-903B.
This may have contributed to the transient in instrument air header pressure. Instrument air was not lost during the event (ONP-7.1 was entered for low header pressure). Since instrument air was not lost as a result of the event, instrument air failures are not modeled as an initial condition for the event. Normal instrument air out of service events are included (see Assumption 5.1.5).
Note: Feedwater purity air is not credited as a backup to instrument air in the logic model.
4.3 Plant Design and Operation Event-Specific Input Event-specific consequential failures and impacts are discussed below. Section 6.3 provides additional information regarding credited recoveries and Attachment 07 provides modeling detail. Events listed in 7 that are intentionally failed because of the event, are annotated with "(event consequential failure)" and those failed but recovered are annotated with "(event consequential failure - surrogate for recovery HEP)".
4.3.1 Logic Model Consequential Failures Event-related consequential failures described in Section 3.1 are captured in the logic model with the following basic events.
Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment Manual isolation of steam supply renders P-8B unavailable without additional operator action.
- 1 battery charger ED-15 D-BCMT-ED-15 Charger damaged and not recovered during event.
- 3 battery charger ED-1 7 D-BCMT-ED-17 Alternate charger used to supply #1 battery ED-01 and dc buses ED-1OL and ED-1 OR.
Modeled components are breakers 72-119, 72-129 and 72-136. 72-119 never restored, treated as unrecovered. 72-129 and 72-136 recovered as a result of restoration of power to ED-10L/ED-IOR without any additional actions.
Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment
(#3 battery charger ED-17) D-HSE-CHGR3-INS House flag to allow crediting of alignment of alternate battery charger.
shunt tnip breaker 72-01 D-HSMC-HS-72-01 Restores E-l ED-10L and ED-10R and allows charging of #1 battery ED-01.
(charging pumps) G-PMOA-TRIP-PUMP Operator action event added to model challenge to PZR SRVs.
2400 v ac bus 1E P-BIMK-EA-13 Captures loss of bus 1E due to loadshed on safety injection signal.
preferred ac bus EY-10 P-PAMK-EY-10 Captures loss of preferred ac bus restore EY-10.
preferred ac bus EY-30 P-PAMK-EY-30 Captures loss of preferred ac bus restore EY-30.
- 1 inverter ED-06 n/a Not required to be failed or restored, since EY-10 modeled as
- npowered from bypass regulator only.
4.3.2 Operation of the atmospheric dump valves (ADVs) via quick open and manual control is unavailable until power is restored to preferred ac bus EY-10.
The loss of dc event resulted in loss of power to the inverter that supplies preferred ac bus EY-1 0.
Power can be restored by restoring power to the dc bus and re-energizing the inverter or aligning the bypass regulator to re-energize the preferred ac bus. EY-1 0 was placed on bypass regulator at 16:46, one hour forty minutes into the event.
4.3.3 Automatic start of auxiliary feedwater pump P-8A is unavailable until power is restored to dc panel ED-i 1-1. However, P-8A remained available for manual start from the control room or locally. After restoration of power to ED-11-1, P-8A is capable of automatic start on auxiliary feedwater actuation signal. If dc panel ED-1 1-1 power is restored prior to restoration of preferred ac panel EY-10 or EY-30 with P-8A running a spurious low suction pressure trip would occur.
The loss of dc event resulted in loss of power to EY-10, EY-30 and ED-11-1. Loss of EY-10 and EY-30 brings in the AFW pump low suction pressure trip. However, loss of power to ED-11 -1 prevents relaying this signal to the P-8A start circuit. Since ED-1 1A remained available, P-8A remained available on manual start from control room or locally under this condition.
Restoring power to either preferred ac bus clears the low suction pressure trip signal: the power supplies are redundant and either provides appropriate power to the low suction pressure trip logic.
4.3.4 Auxiliary feedwater pump P-8B starts and runs (mechanical governor maintains normal turbine/pump speed) on loss of left channel dc until manual isolation or control is restored on recovery of left channel dc power. AFW P-8A/B flow control valves open fully on loss of preferred ac buses EY-10 and EY-30.
The loss of dc event de-energized left channel dc power and preferred ac power buses EY-1 0 and EY-30. Loss of left channel dc power starts P-8B. Loss of preferred ac power buses EY-10 and EY-30 opens flow control valves full open. Steam supply to P-8B was manually isolated at 16:03. P-8B flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.
4.3.5 Auxiliary feedwater pump P-8C starts on auxiliary feedwater actuation signal given P-8A failure to deliver required flow (due to loss of left channel dc). Flow control valves set to 165 gpm to each steam generator since right channel dc available.
The loss of dc event de-energized left channel dc power. Right channel dc power remained available and started P-8C, with flow control valves controlling to 165 gpm to each steam generator. P-8C flow to E-50A was isolated due to overfill concerns at 15:44. P-8C flow to E-50B was isolated at 16:09 due to adequate E-50B level.
P-8C flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.
4.3.6 Power from bus 1E is lost on a safety injection signal and is not available until re-energized by operators.
The loss of dc event de-energized preferred ac power buses EY-1 0 and EY-30. This combination of failures is sufficient to generate a spurious right channel safety injection signal. The safety injection signal results in load shed of bus 1E. This is a design feature of the plant and is addressed by both operator training and procedural guidance.
Loss of bus 1E results in loss of feedwater purity air compressors, which were aligned to instrument air prior to the event. See Input 4.2.2.
Power was restored to bus 1E at 15:49, about -45 minutes into the event. On restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02.
4.3.7 Initial charging flow was 93 gpm. About 30 minutes into the event charging flow was reduced to 73 gpm.
The loss of dc event resulted in failure of the in-service channel A pressurizer level, heater and pressure control circuits. With no power to level control channel A the control program defaulted to maximum flow from the operating pumps (93 gpm: P-55A - 53 gpm; P-55B - 40 gpm).
At approximately 30 minutes into the event operators switched pressurizer pressure control to channel B to enable pressurizer spray. Operators also switched pressurizer level control to channel B. With channel 'B' in service charging flow reduced to the minimum flow from operating pumps (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm).
Had channel 'B' level control been in service at the time of the event, automatic level control of charging flow would have remained available. In service charging pump flow would have been reduced to minimum flow at time zero (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm). No credit for this configuration is taken in the analysis.
4.3.8 Absent additional electrical failures, loss of any two preferred ac buses de-energizes all control rod clutch power supplies. If there are no mechanical failures, all control rods insert.
The loss of dc event de-energized preferred ac power buses EY-10 and EY-30. Loss of EY-30 de-energized control rod clutch power supplies #1 and #2. Loss of EY-10 and EY-30 resulted in multiple 2 out of 4 RPS channel signals (e.g., low steam generator water level, low steam generator pressure) that de-energized clutch power supplies #3 and #4. Therefore, all control rod clutch power supplies de-energized. All control rods inserted.
All other combinations of loss of two preferred ac buses result in either direct loss of clutch power
supply, generation of multiple 2 out of 4 RPS channel signals, or combinations of these. As a result, loss of any two preferred ac buses interrupts all control rod clutch power supplies.
Given the loss of one dc channel de-energizes all clutch power supplies, many types of electrical RPS failures are eliminated (i.e., have no consequence). This reduces probability of electrical RPS failures (ATWS events).
This analysis leaves the ATWS event tree and RPS electrical failure probability unchanged, which represents a conservatism with respect the evaluation of the loss of dc event. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries).
5.0 ASSUMPTIONS Assumptions in this engineering analysis are classified as major or minor. Major assumptions are those that may (but not necessarily) impact results by a factor of 2 or more. Minor assumptions are those that impact results by a factor of less than 2. These assumptions are specific to this engineering analysis.
Assumptions of other risk evaluations (e.g., full power internal events, etc.) are unchanged unless specifically noted.
5.1 Major Assumptions 5.1.1 The logic model does not credit transition to shutdown cooling following a stuck open pressurizer safety relief valve.
Basis: The transfer event tree for sequences with potential stuck open pressurizer safety relief valves (XFR-SBLOCA-SRV) includes a heading for successful transition to shutdown cooling (SD). To conservatively envelope sequences in which successful transition is not likely, sequences involving transition to shutdown cooling following a stuck open PZR SRV are not credited.
Bias: This assumption is considered conservative as sequences with a stuck open PZR SRV that could reach shutdown cooling are quantified as unsuccessful.
5.1.2 The logic model does not credit charging pumps for mitigation of a stuck open pressurizer safety relief valve LOCA as it is not considered in the current success criteria.
Basis: A stuck open SRV results in a containment high pressure signal and start of containment spray pumps. If spray pumps are tripped in a reasonable amount of time, safety injection and refueling water tank (SIRWT) inventory is sufficient for charging makeup to last the entire 24 mission time. Availability of AFW is necessary for crediting charging makeup to meet the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time (see Attachment 05).
Bias: This assumption is considered conservative since sequences in which tripping spray pumps could avoid the need for HPSI are not credited.
5.1.3 The logic model considers dc panel ED-1 1-2 breaker 72-119 unavailable throughout the event.
Basis: Portions of ED-1 1-2 loads were restored at 15:57 by restoration of power to ED-10IJED-1OR. However, maintenance activities on several breakers within the panel were ongoing for an extended period of time. Three ED-1 1-2 breakers are modeled in the PRA: 72-119 (instrument air compressor control circuits), 72-126 (service water valves to containment control circuits) and 72-136 (EDG 1-1 control circuits). Restoration of power to ED-1 1-2 restored power to breakers 72-129 and 72-136. However breaker 72-119 remained unavailable throughout the event.
Bias: This assumption is considered neutral since it reflects actual plant configuration during the event.
5.1.4 The logic model requires two out of three service water pumps to support containment heat removal for sequences in which pressurizer safety relief valves function normally and reseat after a demand.
Basis: The logic model considers containment heat removal can be accomplished by operation of containment air coolers or containment sprays. Successful operation of containment air coolers requires one of three air coolers to maintain containment pressure below capacity. Successful operation of containment sprays requires one of three containment spray pumps and one of two shutdown cooling heat exchangers. Service water is required to remove heat from heat exchangers via the component cooling water system to the ultimate heat sink (Lake Michigan).
Two of three service water pumps are required for containment air coolers, since a single pump cannot support containment and shutdown cooling heat removal requirements. However, containment heat removal requirements are based on a double steam generator blowdown in containment and shutdown cooling heat removal requirements are based on decay heat requirements.
For success branches with non-stuck open relief valves and with continuous charging and secondary side heat removal, PZR SRVs are chattering and relieving excess makeup.
Containment heat removal is required to maintain containment pressure less than design.
If containment high pressure occurs due to the chattering relief valve, SIRWT inventory is depleted, charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In these sequences, containment heat removal is retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
For all of these sequences, containment heat loads are lower than for a double steam generator blowdown such that a single service water pump would likely meet heat loads.
Bias: This assumption is considered conservative. Two of three service water pumps are modeled as required for containment heat removal when a single pump is likely adequate. An examination of cutsets for the affected sequence (21-02) indicates this assumption increases the CCDP by as much as 1.OE-07.
5.1.5 The logic model considers normal equipment maintenance unavailabilities.
Basis: It is known that certain equipment was not out of service due to maintenance at the start of the event. However, it is possible that under other circumstances this equipment may have been out of service for maintenance. For equipment known to be in-service (i.e., not tagged out for maintenance), basic events representing average maintenance unavailability were left in the model.
Bias: This assumption is considered conservative because inclusion of maintenance unavailability events for components known to be not tagged out for maintenance may increase the risk result. For example, events representing P-8C out of service due to maintenance may be included in the cutset solution despite P-8C not having been out for maintenance at the start of the actual event.
5.2 Minor Assumptions 5.2.1 The logic model initial condition is a loss of main condenser with a concurrent loss of dc power on buses ED-1OL and ED-1 OR.
Basis: The initial plant response was consistent with a loss of main condenser event. Loss of power to the dc buses replicates the event given the lack of coordination between protective devices. Loss of EY-10 and EY-30 result in 2 of 4 SG pressure sensors reading low. Given EY-40 and ED-21 remain available, a right channel main steam isolation signal occurs. SV-0502 and SV-0513 energize to isolate air supply to, and SV-0514 and SV-0508 energize to vent air from, main steam isolation valves CV-0501 and CV-0510, respectively. Main steam isolation valves close.
Bias: This assumption is considered neutral since it represents a reasonable and appropriate initial condition for the logic models.
5.2.2 The logic model considers power to the dc bus from pre-event in-service #1 battery charger ED-06 unavailable throughout the event.
Basis: Full power to the dc bus from the in-service battery charger #1 failed at the time of the event due to an internal fault. The fault occurred because the charger output breaker remained closed. This is consistent with the actual event.
As a result of the fault condition, the in-service battery charger was isolated from the dc bus and not restored during the event response for an extended period of time. The alternate battery charger was placed in service to restore battery capacity. Whether fuses or internal breakers opened does not alter the consequence of the charger isolation.
Bias: This assumption is considered neutral since it represents the actual #1 battery charger condition over the event time period of interest.
5.2.3 The logic model considers turbine-driven auxiliary feedwater pump P-8B unavailable due to steam supply isolation at time zero, requiring operator action to restore it to service.
Basis: Pump P-8B initially operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels. During the event response with both auxiliary feedwater pumps in operation, steam generator E-50A level increased >90%. Given continued successful operation of pump P-8C and steam generator E-50B level > 60%, operators elected to isolate the steam supply to pump P-8B. Once isolated, operator action would have been required to restore P-8B to service if P-8C subsequently failed or pump P-8A failed after manual start or restoration of dc power.
While the direction to isolate P-8B was given at 15:31, actual isolation occurred at 16:03 - about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in to the event. Palisades MAAP runs [3] indicate one hour of P-8B operation extends to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> the time required for resumption of decay heat removal to prevent core damage.
Bias: This assumption is considered neutral. P-8B operated successfully and was subsequently isolated. By assuming P-8B is unavailable due to steam supply isolation, the logic model includes time-zero failures requiring restoration in the cutset solution despite successful operation of P-8B at time-zero. This is consistent with the failure memory approach.
5.2.4 Timeline event times and plant parameters in Attachment 01 and referenced throughout this analysis are approximate and reflect the best known information at this time.
Basis: The PRA group Ops representative developed and independently verified the event timeline and associated plant parameters. The PRA group Ops representative is a former Palisades SRO and has served as a Palisades Shift Manager and Operations Superintendent.
The timeline was developed using process information (PI) data, plant process computer data (PPC), operator logs (eSOMS), and control room recorder instrumentation. The timeline was verified by extensive on-shift crew interviews/discussions, the Ops reconstruction meeting, and crew peer check of indicated event times, parameters, and crew motivation/awareness.
Given loss of instrumentation during the event, uncertainties in the PI data, and necessary interpretation of operator log event times, the exact timing of some events may never be definitively known. Wherever specific times are used or discussed, the analysis considers that the times are approximate and may have been different.
Bias: This assumption is considered neutral since it represents the best known information at this time. This assumption is considered minor since timeline uncertainty has been considered in the analysis and bounded where necessary.
6.0 METHODOLOGY 6.1 Thermal-Hydraulic Model See Attachment 05 for the MAAP thermal-hydraulic methods and analyses.
6.2 Logic Model 6.2.1 Transient with Loss of Main Condenser Event Tree The transient induced by a loss of one train of dc power follows closely a transient with main condenser unavailable with the additional components lost due to the event set as failed (primarily ED-10L and ED-10R). Loss of EY-10 and EY-30 results in (spurious) 2 of 4 low steam generator pressure signals and (with EY-40 available) generates a right channel main steam isolation signal. This closes both main steam isolation valves, isolating the condenser. Therefore, the transient with loss of main condenser (LOMC) event tree was selected as the starting point for this analysis.
Given the event, the initiating event frequency IE_LOMC is set to unity - casting the results from core damage frequency to conditional core damage probability. Equipment out of service prior to the event (breaker 252-302) is set to failed (True). Equipment impacted by the dc fault event is set to failed (True or recovery HEP). Normal maintenance unavailabilities are used. The HEP for alignment of the bypass regulator to a preferred instrument ac bus is corrected to be consistent with the human reliability analysis.
See Attachment 07 for a listing of event-specific change sets used in this analysis.
A significant aspect of this event involved the potential challenge to the pressurizer safety relief valves. A transfer event tree representing a loss of coolant accident due to a stuck open relief valve is added to capture the risk due to failures to mitigate this consequential event. See Attachment 06 for a schematic representation of the event trees.
The event tree for transient with loss of main condenser (TR-MCND) is modified to address the challenge to pressurizer safety relief valves. Heading RXC is not changed and represents failure of reactor trip and the model of record ATWS sequences. Heading CONS-LOCA-FT represents the transfer to the pressurizer safety relief valve LOCA event tree (XFR-SBLOCA-SRV). All sequences in which the operator
fails to trip charging pumps prior to challenging the SRVs are transferred. Therefore the entry condition for XFR-SBLOCA-SRV is that PZR SRVs have been lifted. The remaining non-transferred sequences represent the model of record sequences for the transient with loss of main condenser tree.
6.2.2 Transfer ATWS Event Tree Heading RXC and ATWS transfer event tree (XFR-ATWS) have not been changed. These sequences represent the model of record ATWS sequences. Given the loss of one channel of dc interrupts all clutch power supplies, many electrical RPS failures are eliminated. Leaving the ATWS event tree unchanged represents a conservatism with respect to the evaluation of the loss of dc event. See Input 4.3.8. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries).
6.2.3 Transfer PZR SRV LOCA Event Tree The transfer event tree for pressurizer safety relief valve LOCA (XFR-SBLOCA-SRV) is structured consistent with the model of record success criteria for PZR SRV LOCAs. Heading 2HP asks if secondary cooling is available via the steam generators. If so, high pressure safety injection is not required for decay heat removal if long term secondary side cooling is available and the PZR SRVs do not stick open. If not, the transient progresses as a loss of secondary heat sink and once-through-cooling is required.
If secondary cooling is available, it is important to determine if an actual LOCA has occurred, versus successful opening and closing of the SRVs. Safety relief valve failures are captured by headings PZR-SAFETIES-FTC.
Success branches on PZR-SAFETIES-FTC represent normal functioning safety relief valves - opening when required and closing when required. In these sequences, successful long term makeup to the condensate storage tank precludes core damage. No inventory makeup is required since relief valves are only relieving excess charging (if charging is never tripped). If long term cooling is not successful, once-through-cooling is required.
For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves) with continuous charging, SRVs are chattering and relieving excess makeup. Containment heat removal is required to maintain containment pressure less than design.
For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves), if containment high pressure occurs due to the relief valve discharge, SIRWT inventory is depleted, the charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In this case, containment heat removal is still retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. See Assumption 5.1.4.
For some plants, failure to re-close after several cycles of steam relief is considered to be less probable than failure to re-close after water relief. However, Palisades' safety relief valves have been tested/qualified for water relief so the failure probabilities remain the same (See Section 6.4).
Failure branches in PZR-SAFETIES-FTC represent above-core, vapor space LOCAs requiring either secondary side heat removal and HPSI for makeup or once-through-cooling.
For failure branches on PZR-SAFETIES-FTC (stuck open relief valves), if charging is successful for inventory control, core damage is precluded provided secondary heat removal remains available (AFW and long term makeup to the condensate storage tank). This presumes containment sprays are secured such that SIRWT inventory remains available for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission. Recall Assumption 5.1.2 states that this success path is conservatively ignored. Therefore charging and HPSI recirculation are required for success.
If charging fails (or is not credited, as is the case), HPSI can prevent core damage with or without secondary side heat removal, with either:
" successful shutdown cooling (also not credited), or
" AFW and long term makeup to the condensate storage tank.
With secondary side heat removal, HPSI is successful by providing inventory makeup only - PORVs are not required for decay heat removal since secondary side heat removal is available.
Without secondary side heat removal, HPSI is successful by supporting once-through-cooling (i.e., with PORVs).
If HPSI is not successful, core damage results since either or both inventory make-up and decay heat removal capabilities are lost.
Again on all success paths with stuck open relief valves, the LOCA results in the need for HPSI, since the SIRWT may be depleted before either reaching shutdown cooling or before depleting condensate storage tank T-2. HPSI injection and recirculation (HPSI-SI and HPSI-REC) and containment heat removal are therefore required for both inventory makeup and containment cooling.
Above-core, vapor-space LOCA analyses that credit charging are described in Attachment 05. These are performed to demonstrate margin only, and are not used as new success criteria.
Event tree features of note include:
" Shutdown Cooling Transition to shutdown cooling following a stuck open pressurizer safety relief valve is not credited.
Event tree XFR-SBLOCA-SRV includes a heading for successful transition to shutdown cooling (SD). No sequences involving transition to shutdown cooling following a stuck open PZR SRV are credited in this analysis. See Assumption 5.1.1.
- Charging Pumps Utilization of charging pumps to avoid the need for high pressure safety injection is not credited.
A stuck open SRV results in a containment high pressure signal and start of containment spray pumps. If spray pumps are tripped in a reasonable amount of time, safety injection and refueling water tank (SIRWT) inventory is sufficient for makeup to last the entire 24 mission time. Since all sequences that involve a stuck open PZR SRV are modeled as requiring recirculation mode HPSI for inventory makeup, tripping spray pumps is not credited in this analysis. See Assumption 5.1.2.
6.3 Human Error Probabilities Table 6.1-1 summarizes human error probabilities used in this analysis. The following discussion provides the basis for chosen values. See Attachment 12 for HRA calculator output.
Procedure guidance and training exists and was utilized for recovery and restoration of impacted components. The use of screening values does not imply lack of adequate training or procedural guidance. The actions would occur as expected based on available procedures and training.
The context, system windows and performance shaping factors are considered to ensure values are appropriate and consistent with site HRA practices. The HEPs were reviewed to:
- 1) Evaluate if currently developed HEPs require adjustment for the specific event (higher probabilities by assigning higher stress, complexity of action, etc).
- 2) Evaluate screening HEPs to assure values assigned are appropriate.
Table 6.3-1: Recovery Human Error Probabilities Impacted Components Recovery Estimated Actual HEP ImpactedComponents RecoRecovery Time TD AFW pump P-8B(1) restore isolated steam supply 3 hrs 46 min (1852) 1.0E-02
- 1 battery charger ED-15 restore normal charger longer term not recovered
- 3 battery charger ED-17 restore alternate charger 4 hrs 27 min (1933) 1.0E-01 shunt trip breaker 72-01 restore battery ED-01 51 min (1557) 1.0E-01 charging pumps charging_______pumps ___
trip charging prevent pumps challenge to -SRVs 51 mi (1557) 6.8E-03 2400 v ac bus 1E restore bus 1E 43 min (1549) 2.6E-03 restore EY-10 via preferred ac bus EY-10 - bypass regulator 1 hr 40 min (1646) 3.3E-02 restore EY-30 via preferred ac bus EY-30 - bypass regulator 51 mi (1557)
- #3 inverter ED-08 1 hr 40 mi (1646)
- 1 inverter ED-06(2) restore EY-10 normal supply 50 hr 27 min not recovered
_________________________________________ (1733 9/27/11)
(1) P-8B restored to full operability at 1852. P-8B remained available via manual operation prior to 1852.
(2) EY-10 restored via alignment to bypass regulator. ED-06 not required with EY-10 on bypass regulator.
Turbine Driven AFW Pump P-8B Restoration of AFW pump P-8B uses a screening value of 1.OE-02.
Recovery is governed by ONP-2.3 and EOP Supplement 19 or SOP-12. Training is addressed in licensed operator qualification training on a two year periodicity. P-8B operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels.
During the event response with both auxiliary feedwater pumps in operation the level in steam generator E-50A increased to high levels (>90%). Given continued successful operation of pump P-8C and steam generator E-50B level greater than 60%, operators elected to isolate the steam supply to pump P-8B, to maintain P-8B restorable if needed (by avoiding steam generator E-50A overfill). Once isolated, local operator action would have been required to restore P-8B to service should the operating pump (P-8C) fail or pump P-8A fail. While the direction to isolate P-8B was given at 1531 the actual isolation occurred at 1603. See Assumption 5.2.3.
This screening value reflects the considerable time available, extensive training and detailed procedural guidance for restoration of P-8B steam supply. The value is considered conservative since manually opening P-8B steam supply valve CV-0522B was the only action required. EOP Supplement 19 steps to isolate the operator for manual control had already been performed as part of isolation of P-8B. The EOP
Supplement 19 actions are not needed to restore P-8B steam supply under manual control.
The model includes an HEP (1.5E-3) for failure to control flow to steam generator E-50A when P-8B is the source. This logic is included as a failure of pump P-8B due to steam generator overfill. Also, note P-8A remained available throughout the event from the control room and locally. See Section 4.3.3.
Note: To implement this recovery, the screening value of 1.OE-02 was logically OR'd with the random pump failure probability of 5.8E-02 resulting in a value of 6.8E-02 used for the surrogate event. See 7.
- 1 Battery Charger ED-15 Recovery of #1 battery charger ED-15 is not credited.
ED-15 was not fully restored for several days following the event.
- 3 Battery Charger ED-1 7 Alignment of #3 battery charger ED-17 uses a screening value of 1.0E-01.
Recovery is governed by ONP 2.3 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 4.6E-04. The analysis credits a system window of four hours (battery capacity), with time delay of 35 minutes and an execution time of 35 minutes.
This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.
Shunt Trip Breaker 72-01 Recovery of shut trip breaker 72-01 uses a screening value of 1.0E-01.
This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.
Trip Charging Pumps Prior to PZR SRV Challenge The HEP for tripping charging pumps prior to challenging pressurizer safety relief valves is 6.8E-03.
Recovery is governed by the in use EOP and ARP-4. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 2.6E-
- 03. The development is based on spurious charging and letdown failures that result in a challenge to the pressurizer safeties.
In response to rising pressurizer level and high level alarms (EK-0761 annunciator alarms at 62.75%
level; EK-0769 alarms at 75% level), operators are cued to trip all operating charging pumps. The action is not completed until other critical safety functions are verified (e.g., boration for reactivity control) and other conditions are met (e.g., throttling criteria for safety injection).
The baseline HEP development considers two charging pumps operating (actual condition) andthe safeties opening at 100% pressurizer level (i.e., ignores the additional volume of the pressurizer head).
The baseline HEP development considers a 30 minute system window (T..) to determine the action is necessary and to complete it; a 2 minute delay time (Tdelay) before the cue is received, and a 2 minute manipulation time (TM) to complete the trip. Note the median response time (Ty,) is not used in the baseline HEP development methodology (CBDTM/THERP).
The baseline HEP development time line is:
TS 30.00 Minutes Figure 6.3-1: Charging Pump Trip Baseline HEP Development The actual event system window was 62 minutes, based on event initiation at 15:06 and predicted time to the irreversible damage state at 16:08 leading to lifting pressurizer safety relief valves at 16:15. The delay time was 22 minutes (15:28), based on available indication in the control room of pressurizer level greater than or equal to 62.8%. Manipulation time is not changed at 2 minutes. Median response time is based on the actual response time of 29 minutes: action completed at 15:57 - initial cue at 15:28. Combination method CBDTM/ASEP is used in order to incorporate a time correlation method for execution. See Attachments 01, 03 and 12.
This event-specific timeline is:
Figure 6.3-2: Charging Pump Trip Event Timeline In the actual event, predicted time to challenge pressurizer safeties (62 minutes) was much longer than in the baseline HEP development (30 minutes). In the actual event 40 minutes (62 minutes - 22 minutes) were available to detect the cue, diagnose the situation, recover from error and complete the action to trip
running charging pumps.
The critical safety function for adequate PCS boration (which requires charging flow) competed with charging pump trip. Once operators determined boration requirements were met, safety injection throttling criteria allowed termination of all charging flow. The competing priorities impact the median response time to take the action. A median (actual) response time of 29 minutes following receipt of the high pressurizer level cue was considered.
The baseline HEP development uses 'COMPLEX' versus 'SIMPLE' for cognitive response. The cognitive element is approximately a factor of 10 lower than the calculated execution error. Execution shaping factors are treated as 'SIMPLE'. This is a control room action and only requires the manipulation of hand switches. The baseline HEP development assigns 'LOW' stress to execution and low work load.
For this analysis, it is appropriate to consider a high work load which equates to moderate stress. This increases the HEP to 6.8E-03.
2400 V AC Bus 1E The HEP for restoration of bus 1E is 2.6E-03.
Recovery is governed by EOP Supplement 5 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. Loss of and restoration of bus 1E is an expected condition based on the event progression (safety injection signal), emphasized in training and well understood by the operators. The principal risk impact is the restoration of water to the condensate storage tank to support continued operation of the operating auxiliary feedwater pump. Should makeup to the condensate storage tank fail, other sources (service water and fire protection) can be connected to the auxiliary feedwater pump suction.
The baseline HEP development considers a system window (Tsw) of 1.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (based on maintaining CST level greater than 50% full given 71% initial level), a 30 minute delay time (Tdelay) to get to the point in procedures that directs the action, and a 5 minute manipulation (TM) time to complete the alignment.
In the actual plant response power was restored to bus 1E within -45 minutes. The actual time of completion was well within the time considered available to complete it. In addition, on restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02.
Preferred AC Bus EY-1 0 The HEP for recovery of preferred ac bus EY-1 0 via the bypass regulator is 3.3E-02.
Recovery is governed by ONP 24.1 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. A specific operator training Job Performance Measure has historically existed for this action. The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02, based the station black-out coping time.
The baseline HEP development considers a system window (Trw) of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (based on the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery depletion time in the context of battery supplying dc bus under SBO), a 60 minute delay time (Tdelay) to get to the point in procedures that directs the action, and a 30 minute manipulation (TM) time to complete the alignment. Note the median response time (T,) is not used in the baseline HEP development methodology (CBDTM/THERP).
The baseline HEP development time line is:
Figure 6.3-3: Align Bypass Regulator Baseline HEP Development Bus EY-10 was energized from the bypass regulator -100 minutes into the event. The earlier actual completion time is the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind.
The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.
The baseline HEP development considered execution shaping factor 'SIMPLE' versus 'COMPLEX' and
'LOW' stress. This analysis considers the execution as 'COMPLEX'. Given the high workload condition, a
'HIGH' stressor is applied, increasing the HEP to 3.3E-02.
Preferred AC Bus EY-30 Recovery of preferred ac bus EY-30 via normal power supply uses a screening value of 1.OE-01.
Recovery is governed by ONP 24.3 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02, based the station black-out coping time.
Bus EY-30 was energized from the bypass regulator -50 minutes into the event and from #3 inverter ED-08 -100 minutes into the event. The earlier actual completion times are the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind.
The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.
This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.
Note: Use of the screening HEP is conservative for cutsets that involve restoration of EY-30 only, since in these cutsets the HEP is independent. A cutset review indicates the contribution of cutsets involving restoration of only EY-30 is small. Therefore, a reduction of the screening HEP value for cutsets in which no dependency exists was not performed.
- 1 Inverter ED-06 Recovery of #1 inverter ED-06 is not credited.
ED-06 was not fully restored for several days following the event. Since restoration of EY-1 0 is via the bypass regulator, unavailability of ED-06 does not impact EY-10 or the results.
6.4 Pressurizer Safety Relief Valve Failure Probability The logic model considers the probability of pressurizer safety relief valve failure to re-close after passing steam or water to be represented by the current analysis of record fault tree PZR-SAFETIES-FTC. This captured in the logic model in event tree heading PZR-SRV-FTC-STM.
The model of record fault tree PZR-SAFETIES-FTC and basic event probabilities are given below.
Table 6.4-1: Pressurizer Safety Relief Valve Failure Probabilities Basic Event Probability W-RVCC-RV-20F3 1.340E-004 W-RVCC-RV-30F3 9.520E-005 W-RVMB-RV-1039 3.690E-003 W-RVMB-RV-1040 3.690E-003 W-RVMB-RV-1041 3.690E-003 NUREG/CR-6928 [4] gives a value of I.OE-01 for safety relief valve fail to close after passing liquid (SVV FTCL). However, this failure mode is not supported by EPIX data. The value was obtained by reviewing the fail to close data in the Westinghouse Savannah River Company database [5]. To approximate fail to close after passing liquid, the highest 95th percentiles for fail to close were identified from that source.
The highest values were approximately 1.OE-01. This value would be considered reasonable in the absence of any additional information.
Palisades' safety relief valves are Dresser safety valve model 31739A. The valves are totally enclosed pop-open-type valves, spring-loaded, self-actuating, and have backpressure compensation.
The valves are designed to prevent the reactor coolant system pressure from exceeding the design pressure by more than 10%. This meets the requirements of the ASME Boiler and Pressure Code,Section III. As-left lift pressure setpoints are: RV-1039 2565 psig (range: 2542 to 2588 psig), RV-1040 2525 psig (range: 2503 to 2547 psig), RV-1041 2485 psig (range 2463 to 2507 psig).
The valves are mounted on short vertical inlet pipes welded to the pressurizer safety valve nozzles, sitting almost directly on the pressurizer top head.
Dresser model 31739A valves have been qualified for steam, transition and water relief as part of TMI Action Plan item NUREG-0737 IL.D.1A [6]. A total of 31 full scale tests were performed at nominal set pressure of 2515 psia. The valves were tested under four general conditions: steam, steam-to-water
transition, water, and water seal conditions at pressures up to 2750 psia. Test conditions were based on consideration of PWR FSAR and extended high pressure liquid injection events.
Under steam, steam-to-water transition and water conditions, valve performance tested stable and satisfactory operation was observed. In all cases, the valve closed in response to system depressurization.
The model for PZR SRV failure is considered conservative. NUREG/CR-6928 gives a mean value SW FTC of 7.OE-05 per demand; NUREG/CR-7037 [7] gives a mean value SW FTC of 3.39E-4 per demand.
6.5 Significance Determination Color Criteria NRC Inspection Manual, Manual Chapter 0609, "Significance Determination Process" indicates the breakpoints for ACDF and ALERF. Informed by these, the following presents the breakpoints considered in this analysis:
Table 6.5-1: Risk Guidelines Risk Result Color ACCDP > 104 10-5 < ACCDP < 10-4 YELOW 5
106 < ACCDP < 10- WHITE ACCDP < 106
7.0 ANALYSIS The base analysis is given in Section 7.1; sensitivity studies are given in Section 7.2.
7.1 Evaluation of Increased Plant Risk Validation of Current Model of Record (PSAR2C)
The baseline results with nominal system alignment (at 1E-09 truncation) for the current model of record (Ref. [3]) are:
MCUB Type CDF # Cutsets Sequence MCUB 2.611 E-05 (non-subsumed) 2362 End State MCUB 2.489E-05 (subsumed) 1708 Validation of the model was completed by quantification with nominal maintenance unavailabilities to confirm that the stated results were duplicated. The results were correctly replicated.
DC Panel ED-1 1-2 Fault Event Results Results are given below.
Table 7.1-1: Results Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered. Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used, with equipment out of service just prior to event taken OOS (252-302). Failure to trip charging pump HEP set to 0.
Risk Following ED-1 1-2 Fault Event 6.5E-06 See Section 6.3 for ED-1 1-2 fault related recoveries credited.
Risk Increase 4.3E-06 ACCDP Cutset Review The top 100 cutsets are given in Attachment 08.
Cutsets 1 and 2 comprise 25% of the risk and represent scenarios from the baseline solution involving random failures only, i.e., not related to the dc fault event. Cutsets 1 and 2 are ATWS sequences that involve failure to initiate charging, unfavorable moderator temperature coefficient window, and/or failures of pressurizer safeties to open or close. These cutsets represent failures of primary coolant system overpressure protection, heat removal, and/or long term reactivity control. These cutsets are not expected to result from a loss of dc.
Cutset 3 comprises 2% of the risk and is dc fault related. Cutset 3 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.
CQutset 4 comprises 1% of the risk and is not related to the dc fault event. Cutsets 4 is an ATWS sequence that involves mechanical failure of control rods to insert and failure of the operator to initiate charging flow for boration. Turbine trip is successful, pressurizer safeties open and close and moderator temperature coefficient is negative with respect to the criterion.
Cutset 5 comprises 1% of the risk and is similar to cutset 3. Cutset 5 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and instrument mis-calibration.
Cutset 6 (and remaining cutsets) comprises less than 1% of the risk and is not related to the dc fault event. Cutsets 6 is an ATWS sequence that involves failure of primary coolant system overpressure protection (pressurizer safeties opened but failed to close).
Cutset 7 is dc fault related and is similar to cutsets 3 and 5. Cutset 7 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to manually isolate ADVs.
Cutsets 8 and 9 are dc fault related and represent excess steam demand events. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a combination of loss of ADVs, resulting in lifting and sticking open a MSSV and causing an excess steam demand event. Loss of dc power and operator failure to start and air compressor prevents AFW to the unaffected generator. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails due failure to open one PORV due to random failure and the other due the loss of dc control power.
Cutset 10 is dc fault related and is similar to cutsets 3, 5 and 7. Cutset 10 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails from a common cause failure of both PORVs to open.
Cutset 11 is dc fault related and represents a challenge to the pressurizer safety relief valves.
This cutsets represent a challenge to the PZR SRVs with successful long term secondary side cooling but does not result in a stuck open relief valve LOCAs. Operators fail to trip charging pumps in time to prevent lifting PZR SRVs, but the valves perform as designed and do not stick open. The cutset involves failure of containment heat removal due to loss of service water. Loss of service water results in failure of CCW cooling to containment spray pumps and loss of cooling for containment air coolers. In this sequence, loss of service water is caused by common cause failure (plugging) of all three service water pump discharge basket strainers.
Cutset 12 is dc fault related and is similar to cutset 3. Cutset 12 involves failure of secondary side
cooling and failure of once-through cooling. High pressure feed fails from a common cause failure all three AFW pump discharge check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.
Cutset 13 is dc fault related. Cutset 13 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from loss of all three AFW pumps: P-8A fails to start due to a consequential low suction pressure trip, P-8B fails to run (random), P-8C fails on common cause failure to start with high pressure injection pumps P-66A&B. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails due to failure of both HPSI pumps due to common cause.
Cutsets 14 and 15 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and/or instrument mis-calibration.
Cutset 16 is dc fault related and is similar to cutset 3. Cutset 16 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure of all four AFW pump injection check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.
Cutset 17 is dc fault related and is similar to cutset 5. Cutset 17 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow, instrument mis-calibration, and failure to initiate low pressure feed.
Cutsets 18 and 19 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on HPSI injection due to HPSI recirculation valve failing to remain open.
Cutset 20 represents failure of all four AFW flow control valves due to common cause failure and the human error for failure to initiate once through cooling. This is a base case cutset.
Cutset 21 represents failure of the turbine-driven AFW pump to run, failure of P-8A and P-8C to run due to mis-calibration of low suction pressure trip switches and the human error for failure to align once through cooling. This is a base case cutset.
Cutsets 22 and 23 represent an excessive steam demand event on one steam generator combined with failure of a once through cooling due to a PORV block valve failure to operate on one train and failure of the other PORV train due to loss of dc power and failure to manually start an instrument air (IA) compressor on low IA header pressure. In addition, loss of dc power prevents the operator from terminating AFW flow to the generator with excessive steam demand event.
Cutset 24 represents a long term failure to makeup to the condensate storage tank, initiate once-
through-cooling. The cutset is a base case cutset (not part of the delta CCDP) that is dominated by a human error dependency contribution related to alignment of a long replenishment of the condensate storage tank and failure to align once through cooling.
Cutsets 25 & 26 represent an excessive cooldown on one steam generator with failure of the operator to adjust flow to the steam generators to preferentially use the steam generator without the excessive cooldown combined with an inability to operate the atmospheric steam dump valves on the other generator due to dc power failures. In addition, the cutsets include a human error dependency contribution for failure to adjust AFW flow as discussed above and manually isolate ADVs and initiate once through cooling.
Cutsets directly related to the dc fault event comprise about 48% of CCDP. That is, about 52% of CCDP is part of the baseline risk and is independent of the dc fault event.
Sequence Review Sequence results are given in Attachment 09.
Non-LOCA, non-ATWS sequences represent about 64% of the CCDP. ATWS sequences represent about 28% of CCDP and consequential pressurizer safety relief valve LOCAs represent about 8% of CCDP.
The dominant two sequences are failure of secondary side cooling due loss of high and low pressure feed, and subsequent failure of once-through cooling.
The next dominant sequences are ATWS sequences not related to the dc fault event. These sequences are not part of the ACCDP result.
Files used in the analysis are:
Table 7.1-2: 10 File Configuration Control Filename Date Time Size Description (KB)
Rev 1 - 2012-01 SAPHIRE v7.27 PSAR2c (D1 1-2).zip 1/5/2012 9:54 AM 15,267 SAPHIRE Project
7.2 Sensitivity Studies 7.2.1 Impact of HEP screening values for select recovery HEPs Realistic and justifiable values were used for the fault-related recovery HEPs. The use of more conservative values can provide insight into the dependency of the results on the recovery HEPs.
The following recovery related HEPs are evaluated:
Table 7.2-1: Sensitivity Study Human Error Probabilities for Recovery Impacted Components Recovery Realistic or Sensitivity Screening HEP HEP TD AFW pump P-8B restore isolated steam supply 1.0E-02 1.0E-01
- 1 battery charger ED-15 restore normal charger not recovered not recovered
- 3 battery charger ED-17 restore alternate charger 1.3E-03 1.0E-01 dc panel ED-1 1-2 breaker 72-119 not recovered not recovered shunt trip breaker 72-01 restore battery ED-01 1.0E-01 1.OE-01 charging pumps trip charging pumps 6.8E-03 6.8E-03
- prevent challenge to SRVs 2400 v ac bus 1E restore bus 1E 2.6E-03 2.6E-03 preferred ac bus EY- 10 restore EY-10 via 3.3E02 iQE-0l
- bypass regulator restore EY-30 via preferred ac bus EY-30 - bypass regulator I.0E-01 1.OE-01
- #3 inverter ED-08
- 1 inverter ED-06ý1) restore EY-10 normal supply not recovered not recovered (1)Note: EY-10 restored via alignment to bypass regulator. ED-06 not required with EY-10 on bypass regulator.
The HEPs for restoration of bus 1E and failure to trip charging pumps were not increased in the sensitivity study. The basis for the HEPs are well founded in procedures and training, and are an expected response for any event resulting in a safety injection signal.
The HEP for restoration of the shunt trip breaker 72-01 and restoration of preferred ac bus EY-30 were not increased in the sensitivity study. The screening values used in the baseline analysis are considered to bound realistic HEP values.
Results are given below.
Table 7.2-2: Sensitivity Results Applying "Sensitivity HEP" Data from Table 7.2-1 Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered. Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used, with equipment out of service just prior to event taken OOS (252-302). Failure to trip charging pump HEP set toO.
Risk Following ED-1 1-2 Fault Event 8.2E-06 See above for ED-1 1-2 fault related recoveries credited.
Risk Increase 6.OE-06 ACCDP This result confirms the recovery HEPs are risk drivers for this assessment. However, with conservative recovery HEPs, the risk characterization remains WHITE.
8.0 REFERENCES
[1] EA-DDC-93-001, Revision 0, Pressurizer Liquid Level as a Function of Indicated Level to Support Loss of Load Initial Conditions, September 2005.
[2] EA-PSA-SAPHIRE-09-08, Revision 0, SAPHIRE v7.27 Testing and Software Quality Assurance Plan, December 2009.
[3] EA-PSA-PSAR2c-06-1 0, Revision 0, Update of Palisades CDF Model - PSAR2b to PSAR2c, June 2006.
[4] NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S.
Commercial Nuclear Power Plants, INL/EXT-06-11119, February 2007.
[5] WSRC-TR-93-262, Savannah River Site Generic Data Base Development (U), Westinghouse Savannah River Company, C.H. Blanton and S.A. Eide, June 1993.
[6] NP-2770-LD, EPRI/C-E PWR Safety Valve Test Report, Volume 1: Summary, Research Project V102-2, January 1983.
[7] NUREG/CR-7037, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, INL/EXT-1 0-17932, March 2011.
9.0 ATTACHMENTS 1: Event Timeline 2: Shunt Trip Breaker Coordination 3: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves 4: Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump 5: Thermal-Hydraulic Analyses 6: Event Trees 7 Change Sets 8: Cutsets 9: Sequences 0: Auxiliary Feedwater Flow Rate to Steam Generators E-50A and E-50B Following the Failure of Bus ED-1 1-2 on September 25, 2011 1: Review of NRC Timeline and Impacted Equipment List 2: HRA Calculator Output for Developed HEPs 3: Procedure Use Evaluation for DC Panel ED-1 1-2 Fault Event 4: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves - No Credit for RV-2006 PCS Inventory Loss 1: Event Timeline Chart and Narrative This attachment contains the following:
" Event timeline in chart format (Table A01-1)
" Event timeline in narrative format
" Annotated plots of PCS and SG post trip behavior (Appendix I)
Table A01-1: Event Timeline Chart Friday 9123 1607 Saturday 9/24 Sunday 9/25 Sunday 9125 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 2218 1109 1500 Electrical maintenance Battery chargers Temp mod Electrical While removing bus bar, MSIS (2/4 logic low SG Right channel SIAS (2/4 AFAS (2/4 logic low S/G Right channel CIS/CHR restoring breaker 72- #1 ED-15 and 31973 Installed. maintenance short occurred in dc panel pressure) due to loss of logic low PZR pressure) level) due to loss of (2/4 logic, RIAX-123 (Emergency #2 ED-16 (Temp power for removed 4 dc ED-11-2 preferred ac buses EY-10 due to loss of preferred ac preferred ac buses EY-10 1805/RIAX-1807) due to Airlock ED-123) initially in- breaker 72-121 panel ED-1 1-2 and EY-30 buses EY-10 and EY-30 and EY-30 loss of preferred ac buses service (generator breakers (72- EY-10 and EY-30. Left exciter field 119,72-120,72- channel containment breaker control) 121,72-123) isolation valves closed from 72-127 due to loss of power (test cabinets))
Control room alarm: FWP air Shunt trip breaker 72-01 MSIVs CV-0510 and CV- IE bus EA-13 de- Turbine driven AFW pump PCP controlled bleedoff EK-0316 GEN FIELD compressor C- opened de-energizing dc 0501 and E-50B MFRV energized, no power to C- P-8B starts (CV-0522B valves CV-2083 and CV-FORCING/OVER 9038 cross-tied buses ED-10R and ED- CV-0703 closed on MSIS, 903B FWP air failed open due to loss of 2099 close due to EXCITATION cycling supplying plant 10L and E-50A MFRV CV- compressor (was cross- ED-11-1i). AFW flow CHR/loss of power, on/off air system 0701 closed due to loss of tied supplying plant air). control valves CV-0727 directing flow to primary power to EY-10 and EY- Closed MV-CA320 to and CV-0749 fail full- system drain tank T-74 in 30 isolate FWP from open. Flow imbalance containment (5 gpm) instrument air. C-2A develops between SGs instrument air compressor due to differential in dome was in "sleep" mode and pressures (no flow started indication available)
Multiple containment Dc panels ED-1 1-1 and All ADVs CV-0779, CV- In service PZR level AFW pump P-8C starts PCS unidentified leakage isolation valves position ED- 11-2, and preferred ac 0780, CV-0781, and CV- control channel A fails, (AFAS) supplying 165 > 1 gpm for PCP indication lost buses EY-10 and EY-30 0782 fail charging pumps P-55A gpm to each SG. controlled bleedoff de-energized closed/inoperable (quick and P-55B in service (93 Loss of EY-10 and EY-30 isolation (LCO 3.4.13.A.1, open and normal gpm), and letdown orifices causes loss of Left B. 1, B.2) operation) due to loss of CV-2003, CV-2004,CV- channel AFAS actuation preferred ac panel EY-10 2005 close (0 (P-8A does not start)
(LCO 3.7.4) letdown),PZR heaters de-energize Entered ONP-7.1 (72- Preferred ac panel EY-1 0 MSSVs lift on both SGs In service PZR pressure Inverter #1 ED-06 input Right channel CHP alarm 119 failure caused loss inoperable LCO 3.8.9.3 control channel A fails, breaker to EY-10, 72-37 (2/4 logic,PSX-1801/PSX-of service air and CV- (LCO 3.0.3) spray valves CV-1057 tripped (LCO 3.8.7.A) 1803) due to loss of EY-1221 FWP building Preferred ac panel EY-30 and CV-1059 fail closed, 10 and EY-30 panels, no cross-tie to fail open) inoperable LCO 3.8.9.B no spray available actuation (actuation logic (LCO 3.0.3) requirements not met)
Reactor trip (2/4 logic Turbine trip (from reactor Operators enter EOP-1.0 Battery charger #1 ED-i15, Dc bus ED-10R RPS) due to loss of trip), generator breakers Standard Post-Trip output breaker closed but inoperable (LCO 3.8.9.6) preferred ac buses EY-10 do not open due to loss of Actions charger not operating Dc bus ED-10L and EY-30 dc panel D-11-1 inoperable (LCO 3.8.9.6)
Table A01-1: Event Tinmeline Chart Sunday 9/25 1515 Sunday 9/25 1517 Sunday 9/25 1527 Sunday 9/25 1531 Sunday 9/25 1537 Sunday 9125 1542 Sunday 9125 1544 Sunday 9/25 1549 Sunday 9/25 1555 MSSVs open and then Operator jumpered Enter EOP-9.0 Operator observed Per EOP-9.0, enter Isolated RV-2006 NCO closed P-8C Restored 1E bus EA- Observed PZR level operate relay 487u (Y-phase) Functional Recovery high E-50A level ONP-24.1 and ONP- letdown relief by AFW flow control valve 13 (lost on SIAS at >62.8% (LCO 3.4.9.A).
(throttle/close/open) to to open generator Procedure (due to <3 (90%). Order given to 24.3 due to loss of placing letdown orifice CV-0737A to isolate 1506) and reenergized Actual PZR level 78%
maintain SG pressure output breakers 25F7 out of 4 preferred ac isolate CV-0522B preferred ac buses stop valves CV-2003, flow to E-50A, associated PZR PCS Tave 544"F and 25H9 buses available) (steam to AFW pump EY-10 and EY-30 CV-2004, and CV- continue supplying heaters P-8B) per EOP 2005 to close 165 gpm to E-50B via Supplement 19 CV-0736A (LCO 3.7.5) 1A bus EA-21 de- PZR level 62% -1530 Entered ONP- PZR pressure peaks Charging 73 gpm, 0 energized. 2.3 Loss of DC Power high 2200 psig. gpm letdown, 5 gpm Primary coolant (time not verified) PZR level 71% PCP controlled pumps P-50A and P- bleedoff to primary 50C stop, P-50B and system drain tank T-74 P-50D remain in service Realigned PZR pressure control to B channel to enable spray, pressure begins lowering Realigned PZR level control and heater control select switch to B channel. Letdown orifices open and RV-2006 (letdown heat exchanger inlet safety relief) lifts due to CV-2009 (letdown containment isolation) being closed on CHR/loss of power. 1D bus EA-12 PZR backup heaters reenergize Charging pumps P-55A and P-55B in service (73 gpm charging,108 gpm letdown relieving to quench tank) 5 gpm PCP controlled bleedoff to PSDT
Table A0l-I: Event Timeline Chart Sunday 9125 1557 Sunday 9/25 1602 Sunday 9125 1603 Sunday 9125 1609 Sunday 9/25 1615 Sunday 9/25 1621 Sunday 9/25 1630 Sunday 9/25 1639 Sunday 9/25 1646 Electricians report no Charging pump P-55B Steam to P-8B turbine CV-0736A closed to SG E-50A MSSVs lift, Entered ONP-7.1 Charging pump P-55B Restored AFW to E- Preferred ac bus EY-faults on dc buses ED- suction relief RV-2096 isolated by closing CV- isolate flow from AFW E-50B MSSVs throttle "Loss of Instrument Air suction and discharge 50B from P-8C 150 30 realigned from 10L and ED-10R. lifting to the equipment 0522B. 0 AFW flow to pump P-8C to E-50B, open. MSSVs then (due to loss of all valves closed to gpm bypass regulator to #3 Reenergized ED-1OL drain tank T-80. The E-50A. Still supplying no AFW flow to either operate instrument air isolate suction relief inverter ED-08 supply and ED-10R by tank overfilled causing 165 gpm to E-50B via SG at this time (throttle/close/open) to compressors at 1557) RV-2096 leak closing breaker 72-01 floor drains to backup P-8C and flow control maintain SG pressure (ED-1OL and ED-10R on the 590' Auxiliary valve CV-0736A Tave 544'F now operable) Bldg (order sent to iisolate P-55B)
Generator field Restored power to 1E PCS Tave 529'F. PZR PZR level peaks high Preferred ac bus EY-breaker 341 opened bus EA-13 and level 85% 101.5% 10 placed on bypass when ED-1 1-2 reenergized regulator. EY-10 reenergized associated pressurizer operable heaters Preferred ac bus EY- ADVs CV-0779, CV-30 powered via 0780, CV-0781, and bypass regulator (EY- CV-0782 operable due 30 now operable) to EY-10 restored Left channel safety (HIC-0780A now injection actuated powered), started when EY-30 controlling heat reenergized, resulting removal using ADVs.
in loss of 1E bus EA- MSSVs close 13 Tave 540'F Throttled safety injection. Stopped charging pumps P-55A and P-55B. Charging flow 0, letdown flow 0, 5 gpm PCP controlled bleedoff to PSDT.
PZR level 80%
When dc restored, instrument air compressor C-2A tripped due to trip circuit being reenergized Control room manually started instrument air compressors C-2B and C-2C
Table A01-1: Event Timeline Chart Sunday 9/25 1720 Sunday 9/25 1746 Sunday 9/25 1818 Sunday 9125 1852 Sunday 9125 1909 Sunday 9/25 1911 Sunday 9/25 1923 Sunday 9/25 1933 Sunday 9/25 2100 Entered ONP-4.1, Exited EOP-9 and Reset SIAS Restored P-8B steam Exited ONP-24.1, Loss Exited ONP-24.3, Loss ED-01, main station #3 battery charger ED- P-910 (main Containment Spurious entered GOP-8, Power supply CV-0522B to of Y-10 of Y-30 battery left channel, 17 in service supplying condenser vacuum Isolation, reset CHR Reduction and Plant AUTO (LCO 3.7.5) inoperable per 3.8.4.B ED-01 (battery pump) in-service Shutdown to Mode 2 (no connected battery chargers #2 and #3 0
or Mode 3 > 525 F(AII charger and now in service) 4 preferred ac buses surveillance in service) requirement 3.8.4.1 not met)
- 1 battery charger ED-15 inoperable per LCO 3.8.4.A.2 Table A01-1: Event Timeline Chart Sunday 9/25 2330 Sunday 9/25 2348 Monday 9/26 0156 Monday 9/26 0311 Monday 9/26 0441 Tuesday 9/27 1733 Test started PZR level <62.8% Restored P-55B Placed #4 battery Main station battery #1 inverter ED-06 instrument air (LCO 3.4.9) charging pump to charger ED-18 in- ED-01 left channel operable, supplying compressor C-2A service (available) service and removed operable preferred ac bus EY-satisfactorily, and then #2 battery charger 10 (LCO 3.8.7) placed in AUTO (C-2B ED-16 from service, still in-service, C-2C in #3 battery charger ED-SLEEP mode) 17 and #4 battery charger ED-18 now in service
Event Timeline Narrative
- 1. Initial Conditions (prior to event) 0 100% reactor power
- normal single charging and letdown lineup o Charging pump P-55A in service o Letdown orifice stop valve CV-2003 open o Primary coolant pump CBO returning to volume control tank T-54
- pressurizer T-72 pressure and level control channel A in service
- auxiliary feedwater system in normal standby lineup
- #1 battery charger ED-15 and #2 battery charger ED-16 in service 0 feedwater purity air system cross-tied with and supplying the plant compressed air system II. Electrical Equipment Conditions Concurrent with the Reactor Trip at 1506 0 dc buses ED-10L and ED-10R de-energized o shunt trip breaker 72-01 opened o #1 battery charger de-energized a dc distribution panels ED-I 1-1 and ED-1 1-2 de-energized
- #1 battery charger ED-15 failed, not supplying associated buses ED-10L and ED-1OR 0 #1 inverter ED-06 and #3 inverter ED-08 de-energized (ED-06 internal breaker also tripped)
- preferred ac buses EY-10 and EY-30 de-energized 0 2400v 1 E bus EA-1 3 de-energized Ill. Conditions Resulting from Loss of Power to Preferred AC Buses EY-10 and EY-30 Reactor Trip / Turbine Trip: main generator breakers 25F7 and 25H9 did not open due to loss of ED-1 1-2.
Main Steam Isolation SicQnal: both main steam isolation valves CV-0501 and CV-0510 closed and both main feedwater regulating valves CV-0701 and CV-0703 closed. CV-0701 closed as result of loss of EY-10 and EY-30; CV-0703 closed due to MSIS.
Auxiliary Feedwater Actuation Signal: P-8A did not receive a start signal due to loss of EY-10 and EY-30 and ED-11-1. P-8A was available to be operated from the control room or locally. P-8C started and supplied 165 gpm to each steam generator (E-50A and E-50B). Steam driven AFW pump P-8B started due to loss of panel ED-1 1-2 and AFW flow control valves CV-0749 (E-50A) and CV-0727 (E-50B) failed full open. P-8B flow indication was not available. Flow distribution was dependent on SG pressures. E-50A is the steam source for P-8B, resulting in initially lower pressure, while E-50B had no steam removal path other than MSSVs.
Safety Iniection Actuation Signal: Right channel SIAS only - resulted in de-energizing (load shedding) 2400V 1E bus EA-1 3, isolating non-critical service water header isolation valve CV-1 359 and starting associated equipment including charging pump P-55B.
Containment High Radiation: Right channel CHR only - resulted in containment isolation valves closing, including letdown isolation valve CV-2009 and PCP controlled bleedoff valve C-2099. Left channel containment isolation valves also closed due to the loss of dc to their control circuits.
Containment High Pressure: Logic inputs were not sufficient for system actuation, i.e. no initiation signal was generated, alarm only.
Pressurizer Pressure Control: In service pressurizer pressure controller PIC-0101(channel A) de-energized - resulted in pressurizer spray valves CV-1057 and CV-1059 failing closed, and all available heaters energizing.
Pressurizer Level Control: In service pressurizer level controller LIC-0101 (channel A) de-energized -
resulted in letdown orifices closing, charging pump P-55A running at maximum speed (53 gpm) and all pressurizer heaters de-energizing. P-55C did not start due to loss of breaker control power (ED-11 -1).
2400V 1E Bus EA-1 3: de-energized - resulted in unavailability of associated PZR heaters and FWP air compressors. Plant air compressor C-2A automatically started to restore pressure.
Atmospheric Steam Dump Valves: all ASDVs CV-0779, CV-0780, CV-0781 and CV-0782 failed closed (both normal and 'quick open') due to loss of power to controller HIC-0780A (EY-1 0).
Generator Output Breakers: breakers 25F7 and 25H9 failed closed and all switchyard breaker indication lost due to loss of ED-11-1. 1A bus EA-21 and 1F bus EA-23 did not transfer to startup power on turbine trip due to loss of ED-1 1-2. IA bus EA-21 remained powered from #1-1 station power transformer EX-01 until operators opened the generator breakers using a jumper on relay 487u (Y phase) in control room panel EC-04. IF bus EA-23 remained powered from #1-3 station power transformer until the generator breakers opened.
IV. Plant / Equipment Conditions and Operator Actions Following Event Initiation Notes:
- Due to the high activity level and unavailability of some plant computer data during this event, times recorded in the Operator Log are generally correct, but may not exactly match information from other sources.
- Effects of conditions/actions described below are depicted in Appendix 1 - PCS and SG Post-Trip Behavior.
1506: Conditions noted in III above.
Main steam safety valves (MSSVs) on both steam generator headers opened and operated (throttled/closed/opened) to maintain SG pressures and lower PCS temperature and pressure. (MSSVs opened due to ASDVs failing closed and MSIVs closing on MSIS.)
Operators entered EOP-1.0 Standard Post-Trip Actions.
1515: Due to there being no steaming path available, PCS temperature rose to 544°F resulting in MSSVs opening further and PCS temperature, pressure and level lowering. PCS temperature continued lowering primarily due to relatively cold (87°F) AFW being supplied to the steam generators (690 gpm total).
AFW pump P-8B flow control valves CV-0727 and CV-0749 failed full open. The flow delivered to each SG was dependent on piping losses and SG pressure differences. SG pressures were initially both -930 psig. However, E-50A's pressure lowered more than E-50B's (possibly due to E-50A supplying P-8B steam and varying MSSV characteristics), resulting in significantly more cool AFW flow to E-50A, which further lowered its pressure. By 1530 total AFW flows (P-8B +P-8C) to the SGs were 502 gpm to E-50A and 195 gpm to E-50B. This flow imbalance contributed to over-filling E-50A.
1517: Power Control verified main generator breakers 25F7 and 25H9 were closed (failed to open on turbine trip). Operators installed a jumper on relay 487u (Y phase) in control room panel EC-04 to open the breakers per EOP-1.0. Opening the generator breakers de-energized 4160v 1A bus EA-21, stopping primary coolant pumps P-50A and P-50C. PCPs P-50B and P-50D remained in service, maintaining forced circulation with one operating pump in each PCS/SG loop.
1527: Operators entered EOP-9.0 Functional Recovery Procedure due to less than 3 preferred AC buses being available. (Pressurizer level 62%)
1531: Operator observed high SG E-50A water level (90%) and an NPO was directed to isolate steam to P-8B per EOP Supplement 19 Alternate Auxiliary Feedwater Methods, i.e. manually closing steam supply valve CV-0522B. Both SG levels had been observed approximately equal (35% - 40%) during EOP-1.0 verbal verifications (1515). Operators entered ONP-2.3 Loss of DC Power.
1537: Operators first addressed safety function MVAE-DC-1 due to it being jeopardized (acceptance criteria not being met). Per MVAE-DC-1 operators entered ONP 24.1 Loss of Preferred AC Bus Y-10 and ONP-24.3 Loss of Preferred AC Bus Y-30 to recover the buses.
Operator observed high PCS pressure (2200 psia) due to loss of power to pressurizer pressure controller channel A which failed spray valves CV-1 057 and CV-1 059 closed. Operator placed pressurizer pressure control channel B in service, lowered pressure in manual mode and then placed the controller in auto mode. PZR spray valves then remained available for pressure control.
Operator also noted loss of power to pressurizer level controller channel A and placed channel B and pressurizer heater select channel B in service. This resulted in letdown orifice stop valves CV-2003, CV-2004 and CV-2005 opening and charging pump P-55A speed lowering from 53 gpm to 33 gpm, and restored bus 1D pressurizer heater availability. Opening the letdown orifice valves resulted in letdown relief valve RV-2006 opening, due to CV-2009 having closed on CHR. RV-2006 directed letdown flow (108 gpm, 560 gal total) to quench tank T-73 in containment, and resulted in relief valve 2006 discharge high temperature annunciator EK-0702 alarming. (Pressurizer level 71%)
1542: Operator closed letdown orifice stop valves CV-2003, CV-2004 and CV-2005 to isolate letdown flow per ARP-4 Annunciator Response Procedure Primary System Volume Level Pressure Scheme EK-07 (C-12).
At this time charging flow was 73 gpm with 0 letdown and 5 gpm PCP bleedoff flow, resulting in 68 gpm PCS net inventory addition. When the density change from charging temperature to PCS temperature is considered this gives a 90 gpm effective charging rate or 1.36%/minute pressurizer level rise rate (90 gpm / 66.16 g/% = 1.36%/m). (Pressurizer volume gal / % indicated level = 66.16 g/% per surveillance procedure DWO-1 Operator's Daily/Weekly Items Modes 1, 2, 3, and 4 Rev 80.)
1544: Operator closed CV-0737A, isolating P-8C AFW flow to steam generator E-50A. P-8C flow to E-50B continued at 165 gpm, and P-8B flow continued at 380 gpm to E-50A and 0 gpm to E-50B.
1549: Operators restored power to 2400v 1E bus EA-1 3 per SOP-30 Station Power and reenergized associated pressurizer heaters.
1555: Operator logged pressurizer level high (>62.8%) (actual level 78%). Due to PCS temperature continuing to lower, the observed level rate of rise was less than would be observed if temperature was stable. Changing PCS temperature one degree has the effect of changing PCS water volume 74.43 gallons (per DWO-1). (Note: Per PZR pressure/level recorder LPIR-01 01 B, pressurizer level exceeded 62.8% at 1528.)
1557: Operator aligned preferred ac bus EY-30 to be supplied from instrument ac bus EY-01 via the bypass regulator. Energizing EY-30 resulted in Left channel safety injection actuation which de-energized (load shed) 2400V 1 E bus EA-1 3 and started associated equipment. P-55C did not start due to panel ED-11-1 being de-energized.
Operators verified Sl throttling criteria met and stopped both operating charging pumps P-55A and P-55B to stop PCS inventory addition. Charging and letdown flows = 0, 5 gpm PCP bleedoff to primary system drain tank T-74 continues. (Pressurizer level 80%)
Electricians reported buses ED-1OL and ED-10R fault free. Operator closed shunt trip breaker 72-01 reenergizing Left channel dc buses ED-10L, ED-10R, ED-11-1, ED-11-2 from battery ED-01. Generator field breaker 341 automatically opened when ED-1 1-2 was reenergized. Instrument air compressor C-2A tripped due to its trip circuit being reenergized when dc power was restored. Operator manually started compressors C-2B and C-2C. The brief loss of air compressor had no noticeable effect.
1602: NPO reported charging pump P-55B suction relief valve RV-2096 lifting and not reseating, equipment drain tank T-80 full and floor drains backing up on the auxiliary building 590 elevation. Control room directed closing pump suction and discharge valves to isolate P-55B and its suction relief. Water discharged from the relief was from concentrated boric acid tanks T-53A and T-53B.
Operators restored power to 1E bus EA-13 and reenergized associated pressurizer heaters.
1603: Auxiliary operator reported steam supply valve to P-8B turbine CV-0522B manually closed per EOP Supplement 19. AFW flow to and steam flow from E-50A = 0. AFW flow to E-50B continued at 165 gpm and steam flow from E-50B was controlled by associated MSSVs. PCS heat removal rate was reduced and PCS temperature stopped lowering and started rising. The PCS heatup rate was 1°F/m, resulting in PZR level rising 1.125%/m. (Tave 529°F, PZR level 85%)
1609: Operator closed CV-0736A, isolating AFW flow to E-50B, slightly raising the PCS heatup rate.
There was no AFW to either SG at this time and steam was only being removed from E-50B via MSSVs throttling.
1615: MSSVs on both steam generator headers opened due to PCS temperature rising to 544°F. PZR level peaked at 101.5% and then lowered as PCS temperature lowered. (Note: There was no PCS inventory addition since 1557. The PZR level rise was entirely due to PCS heatup from 529 0 F to 5440 F.)
After opening, the MSSVs remained partially open, effectively controlling PCS Tave 540°F until the ASDVs were placed in service.
1621: Operators logged entering ONP-7.1 Loss of Instrument Air due to compressor C-2A tripping at 1557 as previously noted.
1630: Charging pump P-55B suction and discharge valves reported closed, isolating suction relief valve leakage.
1639: Operator restored 150 gpm AFW flow to E-50B using P-8C.
1646: After confirming no faults on preferred ac bus EY-10, #3 inverter ED-08 was aligned to supply EY-30 and EY-10 was powered from instrument ac bus EY-01 via the bypass regulator. All preferred ac buses were now available.
All 4 ADVs were available when EY-10 was restored, and operators began using them for PCS temperature control. MSSVs fully closed. (Tave 539°F) 1720: Operators entered ONP-4.1 Containment Spurious Isolation and operator reset CHR.
1746: Operators exited EOP-9.0 and entered GOP-8 Power Reduction and Plant Shutdown to Mode 2 or Mode 3 > 525°F.
1818: Operators reset SIAS and restored non-critical service water per SOP-15 Service Water System.
1852: Operators restored AFW pump P-8B steam supply CV-0522B to AUTO per EOP Supplement 19.
1933: Placed #3 battery charger ED-17 in service supplying station battery ED-01. #2 and #3 battery chargers ED-16 and ED-17 in service.
2348: Pressurizer level lowered to 62% and continued lowering due to PCP bleedoff.
09/26/11, 0311: Placed #4 battery charger ED-1 8 in service supplying station battery ED-02. Battery chargers #3 ED-17 and #4 ED-18 in service.
09/27/11, 1733: Placed #1 inverter ED-06 in service supplying #1 preferred ac bus EY-10.
Acronyms AFAS Auxiliary Feedwater Actuation Signal AFW Auxiliary Feedwater ASDV Atmospheric Steam Dump Valve CAS Compressed Air System CBO Controlled Bleedoff CHP Containment High Pressure CHR Containment High Radiation CiS Containment Isolation Signal CVCS Chemical and Volume Control System FWP Feedwater Purity MFRV Main Feedwater Regulating Valve MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSSV Main Steam Safety Valve NCO Nuclear Control Operator NPO Nuclear Plant Operator PCP Primary Coolant Pump PCS Primary Coolant System PSDT Primary System Drain Tank PZR Pressurizer RPS Reactor Protective System SG Steam Generator Sl Safety Injection SIS Safety Injection Actuation Signal VCT Volume Control Tank
Appendix I- PCS and SG Post-Trip Behavior PCS Post Trip Plot SG Post Trip Plot Figure A01-1: PCS Post-Trip Plot Figure A0I-2: SG Post-Trip Plot Table A01-2: PCS Post-Trip Plot Key Elap. T (ave) PZR PZR PT Time Time Level Press.
ID NOTES (min) (*F) (%) (psia) 1 1506 0 559.5 57 2069 Reactor trip, MSSVs open and then throttle/close 2 1515 11 544 52 2033 MSSVs open and then throttle/close 3 1536 31 536 71 2184 E-50B MSSVs open and throttle maintaining SG pressure 4 1537 32 536 71 2206 Operator places PZR pressure and level channel B controls in service 5 1542 36 530 66 1980 Operator closes letdown orifice valves to isolate letdown 6 1544 38 530 68 2016 Operator closes CV-0737A to isolate P-8C flow to E-50A 7 1557 51 528 80 2068 Operator throttles SI by stopping P-55A and P-55B Steam supply CV-0522B closed to isolate P-8B flow to SGs, also isolates steam flow from E-50A 9 1615 69 544 101.5 2069 MSSVs open and then throttle maintaining PCS temp -540 °F 10 1639 90 540 97 1865 Operator restores 150 gpm AFW to E-50B and throttles to maintain level Power restored to ADV controls, Operator begins using ADVs for PCS heat removal, MSSVs close 12 1730 144 539 90 2087 Tave stable, PZR level slowly lowering due to PCP bleedoff, PZR I I_ I_ I Ipressure is controlled
- Time does not match time recorded in Operator Log (1603).
WR PRESS (PSIA) oo 0° ° 0° 0° 0 R 'I Hot D)eg F PZR LEVEL (%)
o 15:02:20- ~-1--__ ____ ___
15:06:20 -u 15:10:20 15:14:20 15:18:20 15:22:20 15:26:20 15:30:20 15:34:20 I 15:38:20 '
15:42:20 01 i-15:46:20 Ct) 15:50:20 Ln 15:54:20 15:58:20 -I Ii Gou 16:02:20 N
16:06:20 m i'-
m 16:10:20<
16:14:20 I -
16:18:20 16:22:20 I 16:26:20 -
16:30:20 16:34:20 -
16:38:20 16:42:20 16:46:20 16:50:20 16:54:20 16:58:20 17:02:20 17:06:20 17:10:20 17:14:20 17:18:20 17:22:20 17:26:20 17:30:20 1 iL 17:34:20
Steam Generator Level (%)
N)Cý.~ (A1 a) -4 w (D CD C0 0 CD 0D CD 0 0 0 0 0 CD I
'0 Steam Generator Pressure (PSIA)
-4 J -J 00 00 co 00 00 (D to CC) (0 (D 0 .
0)
CO 0C 0 N) .1. 0) OD 0 N) .0N d 0) 0 o o 0) 0 0 0 0 0 0 0 0 0 0 0 -
15:03:00 15:06:00 15:09:00 15:12:00 15:15:00 15:18:00 15:21:00 15:24:00 15:27:00 15:30:00 15:33:00 15:36:00 15:39:00 15:42:00 15:45:00 15:48:00 15:51:00 15:54:00 15:57:00 16:00:00 16:03:00 16:06:00 16:09:00 16:12:00 16:15:00 16:18:00 16:21:00 16:24:00 16:27:00 16:30:00 16:33:00 16:36:00 16:39:00 16:42:00 16:45:00 16:48:00 16:51:00 16:54:00 16:57:00 17:00:00 17:03:00 17:06:00 17:09:00 17:12:00 17:15:00 17:18:00 17:21:00 17:24:00 17:27:00 17:30:00 17:33:00
Table A01-3: PCS Post-Trip Plot Regions REGION NOTES ID A PZR pressure rising in this region is due mainly to PZR level rising and spray valves failing closed due to loss of power to the Channel A pressure controller.
With exception of the 2 step changes in this region, PCS temperature lowering is mainly due to AFW addition to the SGs.
B Temperature lowering in this area is masking inventory addition to the PCS, i.e. the PCS inventory rate of rise is > than indicated.
Temperature rising in this region is mainly due to having isolated all AFW flow to E-50A without establishing another heat C removal path. E-50A MSSVs are closed PZR level rising in this region is due solely to PCS heatup. Charging flow = 0 gpm.
D PCS temperature is being maintained in this region by the MSSVs.
E PZR level lowering in this region is due mainly to PCP controlled bleedoff.
2: Shunt Trip Breaker Coordination Issue Shunt trip breakers 72-01 and 72-02 are designed to operate by remote signal only, and not to operate/isolate on experiencing fault current.
Breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. Therefore, the shunt trip breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.
Conclusions
- No identified mechanism would cause a fault in one dc division to propagate to the other division.
- Initial investigation suggests proper coordination of breakers 72-01 and 72-02 with associated downstream devices exist for fault currents up to 3,000 amps.
- The condition will be addressed in a separate analysis, as needed.
Evaluation Shunt trip breaker 72-01 isolates #1 battery ED-01 from the balance of the left channel dc circuit, leaving only dc panel ED-1 1A connected to ED-01. Shunt trip breaker 72-02 isolates #2 battery ED-02 from the balance of the right channel dc circuit, leaving only dc panel ED-21A connected to ED-02. The shunt trip breakers are used for a fire in the cable spreading room.
Circuit breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. This does not comply with statements in the FSAR and from a design basis perspective constitutes a non-conforming condition per EN-OP-104, Revision 5, Attachment 9.1, Table 1.
The shunt breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.
See Figure A02-1 for fault currents expected to result in shut trip breaker 72-01 actuation.
72-01, 72-18 &
Dl1-2 Fuse Coordinal Figure A02-1: 72-01, 72-18, FUZ/D11-2 Coordination Curve There is currently no identified mechanism that would cause a fault in one dc division to propagate to the other division. The coordination of breakers 72-01 and 72-02 with other breakers in the dc system has not been evaluated for this analysis.
=
,_=
72-01 72-18 DIO-R FUZ/DI 1-2 10 I oi 1000( I0000 Current in Artperes X 10 125 Volt Phase and Ground Thn~e-Current Characteristic Cus-es 09/30/201 I 72-01, 72-18 & FUZ/DI 1-2 Coordination Curve 01:08:06 Prepared By: Eric C Jones Reviewed By: David M Kennedy J:\SHARE\EJONES\72-01, 72-18 & DI 1-2 COORDINATION CURVE.MDB
References
[1] Operability Evaluation attached to CR-PLP-2011-4835.
[2] J:\Engineering\ACTION PLANS\9-23-11 DC 11-2 Problem\operability evaluation - coordination 3: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves Issue The 09/25/2011 dc panel ED-1 1-2 fault isolated letdown flow and increased charging flow. This resulted in rising pressurizer level and represented a potential challenge to pressurizer safety relief valves. Steam and/or water release from pressurizer safety relief valves could result in a stuck open relief valve and pressurizer vapor space loss of coolant accident.
This evaluation summarizes post trip inventory behavior and estimates the additional time to pressurizer safety relief operation had no mitigating actions been taken.
Conclusions
- With letdown isolated, the pressurizer would have gone solid had charging not been secured within -11 minutes of the actual time of 15:57 (i.e., by -16:08).
- Pressurizer safety relief valves expected to lift prior to 16:15 had charging not been tripped by 16:08.
Evaluation See event timeline and narrative discussion [1].
With respect to pressurizer level, key aspects of the event are:
- Loss of ADVs and start of P-8B with loss of flow control valves (full open) results in overcooling PCS due to excessive AFW addition.
- SIS starts additional charging pump and loss of level control results in letdown isolation and maximum charging.
- Cooldown partially masks inventory addition. Subsequent heatup results in PCS inventory expansion and potential challenge to PZR safety relief valves.
Hemispherical space exists above the upper level tap, such that volume in excess of 100% is needed to completely fill the pressurizer (see SOP-1 B Attachment 8 [2]).
As documented in the event timeline, indicated pressurizer level peaks at 101.5% at 16:15. Note:
- Data from LPIR-0101B (available hot calibrated pressurizer level indicator) indicates pressurizer level peaked at 101.5% at -16:15.
- This value implies pressurize level is at or near (but not above) 100% level, i.e., at or near the upper level tap.
- If actual pressurizer level exceeded elevation of upper level tap, the trendline for both hot and cold calibrated levels would flatline at the point of tap submergence. Level trendlines from the event do not appear to flatline.
- Indicated level greater than 100% is due to pressurizer pressure and/or temperature deviations from nominal, reference wet leg temperature deviation from nominal, and/or instrument loop inaccuracies.
Based on 1,000 gallons of additional volume between 100% pressurizer level and the solid condition [2], it is estimated an additional 11 minutes of charging flow @ 73 gpm would have resulted in a solid PCS condition upon heatup to 544°F:
1,000 gallons / 1.3 density correction from 82°F to 544°F / (73 gpm charging - 5 gpm PCP bleedoff) =
-11 minutes With respect to the timeline, charging pumps were secured at 15:57. Therefore, charging needed to be secured prior to 16:08 to avoid a PCS solid condition. The solid condition would have occurred just before MSSV lift at 16:15 if charging was secured at 16:08.
References
[1] EA-PSA-SDP-D11-2-11-07, Revision 0, Attachment 1.
[2] SOP-1 B, Revision 11, Primary Coolant System - Cooldown.
4: Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump Issue Various data sources [1],[2] indicate post-trip steam generator inventory asymmetry following the 09/25/2011 plant trip. The significance is three-fold: (1) E-50A high level resulted in manual isolation of steam to AFW pump P-8B requiring manual recovery ifthe remaining AFW supply failed, (2) failure to isolate P-8B in time to prevent steam generator overfill may have damaged P-8B, and (3) additional post-trip SG inventory extends time available to restore AFW or initiate once-through-cooling ifrequired.
This evaluation summarizes expected post trip inventory behavior, estimates the additional time to E-50A overfill had no mitigating actions been taken and provides a reasonableness check on actual post-trip inventory.
Conclusions
- Asymmetry in post-trip SG level is expected based on plant design given loss of left channel dc.
- Steam generator E-50A overfill (full to top of steam dome) may have occurred within 33 minutes from the time all E-50A level indication was restored 15:57, i.e., at 16:30.
Evaluation Without operation of turbine driven auxiliary feedwater pump P-8B, post-trip steam generator water levels on both steam generators are expected to behave similarly: shrink to approximately 23% while increasing due to inventory addition by motor-driven auxiliary feedwater pump(s) and potential main feedwater pump coastdown. Operation of P-8B with flow control valves full open and not controlled, with atmospheric steam dump valves inoperable and closed, results in a steam generator pressure asymmetry. Since steam generator E-50A supplies the P-8B turbine, pressures tend to be lower in E-50A, resulting in increased flow to and higher levels in E-50A. However, variations in MSSV lift setpoints and operating characteristics can result in variations in steam generator pressure that can also impact flows.
Following an uncomplicated plant trip, the main feedwater pumps normally ramp down to minimum speed and the main feedwater regulating valves are closed over a period of 3-4 minutes. Feed reg valves lock in position at the time of the trip and are closed by operator manual action per EOP-1.0.
A coastdown flow rate function was developed based on data collected from the PI data archive for three Palisades plant trips and is credited in the MAAP analysis [3] for events that don't result in containment high pressure or MSIV closure (these events result in automatic fast closure of the feed reg valves). The additional coastdown flow provides significant inventory in short period of time, resulting in higher steam generator levels shortly after trip than would otherwise occur for feed reg valve fast closure events.
For the plant trip on 09/25/2011, PI data indicates that feedwater control valve CV-0703 to steam generator E-50B closed very quickly in 1-2 seconds and the steam generator level trend reflects this fact.
This is expected based on a loss of EY-10 and EY-30, which generates a 2/4 low steam generator pressure and a close signal to CV-0703.
PI data for CV-0701 valve position indication was lost on loss of EY-10. CV-0701 is also expected to close very quickly based on a loss of EY-10 and EY-30, which results in a loss of current to E/P-0701 and
the equivalent of a close signal to CV-0701. Observed levels during EOP-1.0 (-1515) were 40% and 35%
for E-50A and E-50B respectively, indicating they started out about the same and the E-50A high level was not due to MFW pump coastdown addition.
When power was restored to the E-50A level indication at 15:57 (PI time), the water level had increased to 94.5%. E-50B level indication was not lost, and the PI archive data shows its level initially lowered to 23% and was gradually restored to 60.8% via the auxiliary feedwater system.
Given uncertainty in P-8B steam supply isolation timing, AFW flow split to E-50A/B [6] and integrated steam releases, an exact accounting of steam generator inventory is not possible. However, arbitrarily assuming about 1/2 of the nominal decay and pump heat over the time period was removed by steaming (note P-8B steam load is neglected), with an arbitrary split between E-50A and E-50B, suggest steam generator levels can be explained.
See Appendices 1-3 for additional details.
Given: 7,812 ft3 total steam volume [5]
5,845 ft3 of water at 100% level (0% power) [5]
4,861 ft3 of water at 77.3% level (0% power) [5]
- 16,487 gallons of inventory above 94.5% (see Appendix 3).
Given 380 gpm auxiliary feedwater addition [6] and neglecting inventory lost due to decay heat removal, steam generator overfill could have occurred within 33 minutes of the time SG level indication was restored at 15:57 (16,487 gallons / 1.325 density ratio 87°F to 535°F / 380 gpm = 33 minutes).
Given 380 gpm auxiliary feedwater addition [6] and assuming 1/2 of decay heat is removed via E-50A, steam generator overfill could have occurred within 47 minutes of the time SG level indication was restored at 15:57.
References
[1] PI data, file "09252011 Loss of DC Event - Post Trip SG Inventory.xls"
[2] Plant Personnel Statements per ADMIN 4.08, Attachment 2 (pdf), page 13 of 18 "At 1602, reported that B CCP suction relief valve lifting. Isolated. racked out breaker. S/G levels still T (A @ 90%) so manually isolated CV-0522B."; page 15 of 18 "S/G levels were high due to P-8B feeding both S/G and TBV/ADV closed.".
[3] PLP0247-07-0004.01 Rev. 2, "Palisades Nuclear Plant Thermal Hydraulic MAAP Calculations"
[4] EOP-1, Standard Post-Trip Actions, pdf of procedure used during 09/25/2011 trip.
[5] 82688-ST-602 Rev. 1, "Steam Generator Secondary Inventory"
[6] EA-PSA-SDP-D11-2-11-07, Revision 0, Attachment 10.
Appendices Appendix 1: Design Summary Appendix 2: Steam Generator Water Volumes Appendix 3: Potential Steam Generator Inventory Accounting
Appendix 1: Design Summary MSIV CV-0510 (E-50A)
CV-0501 (E-50B)
Isolate on CHP, MSIS (2/4 low SG pressure), loss of dc power (each SG has one de-energize to open (vent) solenoid isolation valve off each dc train)
Expected event response: Both MSIVs close on loss of ED-10L & ED-10R MSlV bypass MO-0510 (E-50A)
MO-0501 (E-50A)
No automatic actuation Expected event response: both MSIV bypass valves remain closed SG blowdowns CV-0767, CV-0771 (E-50A)
CV-0768, CV-0770 (E-50B)
Isolate on CHP or CHR Isolate on loss of dc power to associated energize to open solenoid valve Each SG has one isolation valve off each dc train Expected event response: both SG blowdowns isolate ADVs CV-0781, CV-0782 (E-50A)
CV-0779, CV-0780 (E-50B)
Quick open function (Tave and TT inputs) to prevent MSSV relief Expected event response: quick open not functional, manual remote control not available, ADVs remain closed on loss of ED-10L & ED-10R, remain unavailable until EY-10 restored MSSV RV-0703 thru RV-0706, RV-0713 thru RV-0718, RV-0723, RV-0724 (E-50A)
RV-0701, RV-0702, RV-0707 thru RV-0712, RV-0719 thru RV-0722 (E-50B) 1 st set pressure 985 psig; 2 nd set pressure 1005 psig; 3 rd set pressure 1025 psig 3% blowdown Expected event response: given ADV quick open not available, 1 st set of MSSVs expected to lift on both SGs MFRV CV-0701 (E-50A)
CV-0703 (E-50B)
Close on CHIP, MSIS (2/4 low SG pressure), loss of dc power (loss of signal to E/P)
Expected event response: Both MFRV close on loss of ED-1OL & ED-1OR: CV-0701 closes on loss of signal to E/P-0701, CV-0703 closes on 2/4 low SG pressure signal to E/P-0703
MFRV bypass CV-0735 (E-50A)
CV-0734 (E-50B)
Close on CHP, MSIS (2/4 low SG pressure), open on loss of dc if in auto Expected event response: Both values are in manual during normal operation and should remain closed AFW P-8A starts on left channel AFAS and DBA P-8B starts on loss of left channel dc power and AFAS CV-0749 (E-50A) fails open on loss of EY-10 and EY-30 or air CV-0727 (E-50B) fails open on loss of EY-10 and EY-30 or air P-8C starts on right channel AFAS and DBA (if insufficient flow)
CV-0737A (E-50A) fails open on loss of EY-20 and EY-40 or air CV-0736A (E-50B) fails open on loss of EY-20 and EY-40 or air Expected event response:
P-8A does not start due to loss of EY-10, EY-30 and ED-i 1-1 P-8B starts on loss of dc bus ED-10L/ED-1OR P-8C starts on low flow from P-8A Flow control valves on P-8A/B go full open on loss of EY-10 and EY-30 Flow control valves on P-8C throttle to provide - 165 gpm to each SG
Appendix 2: Steam Generator Water Volumes Table A4-1: Water Volume vs. Level at 0% Power [5]
Water State Volume L (gallons) (%)
SG water volume at 100% 43723 100.0 SG water volume at 77.3% 36359 77.3 SG water volume at nominal (assume 65%) 32365 63.9 SG water volume at 23.7% (nominal post-trip) 19607 23.7 Water Volume (gallons) vs. Level (%)
50,000 45,000 40,000 35,000 30,000 25,000 20,000 20 100 15,000 10,000 5,000 0
20 40 60 80 100 Figure A4-1: Water Volume vs. Level at 0% Power
Appendix 3: Potential Steam Generator Inventory Accounting Table A03-1: Potential Post-Trip Steam Generator Accounting PPC trip time 15:03 (based on invalid data entries indicating loss of Y1 0/Y30)
PPC EY-1 0/EY-30 restoration time (based on data indicated return of A SG level indication) 15:57 Initial E-50A Level 64.7 %
Initial E-50B Level 62.3 %
-10 min post trip E-50A Level (from EOP-1 in-use 40 procedure) 40_%
-10 min post trip E-50B Level (from EOP-1 in-use PI data indicates 35% level in E-50B at procedure) 35_% 15:14 E-50A Level at 15:57 94.5 %
E-50B Level at 15:57 60.8 %
P-8C flow to E-50A 5847 gallons P-8C flow to E-50B 8750 gallons P-8B max flow rate 372 gpm P-8B operation to 15:57 57 min after 1531 and on or before 1603 Total P-8B flow 21204 gallons P-8B flow split -fraction to E-50A 0.81 P-8B flow to E-50A 17175 gallons P-8B flow to E-50B 4029 gallons Density correction from 87F to 535F 1.325 Volume of E-50A at 94.5% at 15:57 41939 gallons Volume of E-50B at 60.8% at 15:57 31068 gallons At 0% power:
SG water volume - total 58438 gallons SG water volume at 100% 43723 gallons 100.0 %
SG water volume at 77.3% 36359 gallons 77.3 %
SG water volume at normal level (63.9%) 32365 gallons 63.9 %
SG water volume (E-50A post-trip)? 21194 gallons 28.7 %
SG water volume at 23.7% (nominal post-trip) 19607 gallons 23.7 %
Table A03-1: Potential Post-Trip Steam Generator Accounting Nominal water volume "lost" at trip 12758 gallons Decay, Pump and Sensible Heat Steaming from E-50A 9770 gallons Decay, Pump and Sensible Heat Steaming from E-50B 5167 gallons Net post-trip volume added to E-50A 20729 gallons Net post-trip volume added to E-50B 11762 gallons Post-trip 15:57 volume of E-50A 41923 gallons 94.5 %
Post-trip 15:57 volume of E-50B 31369 gallons 60.8 %
Unaccounted for volume to E-50A 16 gallons 5: Thermal-Hydraulic Analyses 1.0 PURPOSE .......................................................................................................................................... 2
2.0 CONCLUSION
................................................................................................................................... 2 3.0 INPUT ................................................................................................................................................. 2 3.1 MAAP 4.0.6 Model .......................................................................................................................... 2 3.2 Event-Specific Plant Data ......................................................................................................... 2 3.3 Condensate Storage Tank .......................................................................................................... 4 3.4 Atmospheric Dum p Valves (ADVs) ........................................................................................... 4 3.5 Auxiliary Feedwater ........................................................................................................................ 4 3.6 Charging ......................................................................................................................................... 5 4.0 ASSUMPTIONS ................................................................................................................................. 6 4.1 Major Assumptions ......................................................................................................................... 6 4.2 Minor Assumptions ......................................................................................................................... 7 5.0 ANALYSIS ......................................................................................................................................... 7 5.1 D11-2 SDP Case7 .......................................................................................................................... 7 5.2 Dl1-2 SDP Casel1 ......................................................................................... ....... 10 5.3 D11-2 SDP Case17 ...................................................................................................................... 16 6.0 WATER
SUMMARY
......................................................................................................................... 19
7.0 REFERENCES
................................................................................................................................. 20 8.0 APPENDICES .................................................................................................................................. 20
1.0 PURPOSE The 09/25/2011 dc panel ED-1 1-2 fault isolated letdown flow and increased charging flow. This resulted in rising pressurizer level and represented a potential challenge to pressurizer safety relief valves. Steam and/or water release from pressurizer safety relief valves could result in a stuck open relief valve and subsequent above-core, vapor-space loss of coolant accident.
This evaluation investigates the integrated plant response to a stuck open safety relief valve within the context of the loss of dc event. This attachment is a margin evaluation of employing the charging pumps as a makeup source. The results are provided as information, only.
The current event tree success criteria require HPSI as the makeup source. No changes to this criterion have been made.
This evaluation uses the Modular Accident Analysis Program (MAAP) model for Palisades.
2.0 CONCLUSION
Thermal-hydraulic analysis in this evaluation demonstrates the success criteria for above-core, vapor-space LOCAs can be satisfied with two charging pumps providing makeup.
As long as secondary side cooling is available for decay heat removal, the transient does not require high pressure safety injection to preclude core damage, apart from additional failures that once-through-cooling would be required to mitigate the event.
Long term heat removal via the steam generators or transition to shutdown cooling could then become a success path, even when a SRV sticks open - provided inventory makeup is available. For example, charging with safety injection refueling water tank (SIRWT) inventory, conserved by terminating sprays, or via HPSI in recirculation mode would maintain adequate core cooling.
3.0 INPUT 3.1 MAAP 4.0.6 Model The baseline model is developed and documented in the MAAP 4.0.6 model parameter file [1] and thermal hydraulic analyses [2]. The baseline model is used as the starting point for this evaluation.
MAAP is a computer code that simulates the response of light water reactor power plants during severe accidents. Given a set of initiating events and operator actions, MAAP predicts plant response as a function of time. Plant response under severe accident scenarios is complex and is best evaluated in an integrated manner. The primary system and containment responses are sensitive to the calculated pressures, temperatures, flows, and event timings. These parameters also affect operator action timings, the radionuclide release timings, and the mitigating system performance assessments. Proper plant-specific characterization of the severe accident progression is important to the realistic representation of the plant and highly desirable for a PRA assessment.
3.2 Event-Specific Plant Data The timeline in Attachment 01 considered the best available information, including PI data, PPC data, control room recorder data, operator logs, procedures filled-out during the event, and interviews and discussions with operations.
Inputs to this evaluation are based on and consistent with the results of the timeline construction, to the greatest extent possible. Specific data sources are given below.
3.2.1 Process Information (PI) Data Event-specific plant data for various plant parameters are obtained from the PI data archive. PI is software quality assurance (SQA) category "C" (important to business) per Entergy SQA procedure EN-IT-104. The plant process computer (PPC) provides data to the PI system. PPC is SQA category "B" (regulatory commitments). Most PPC points are calibrated via technical specification surveillance procedure or by preventive maintenance and controlled calibration sheets.
Part of the PI server system runs on the PPC. This portion monitors selected points every second to test against the exception threshold change value. If the change value is exceeded, the data is passed to the PI server and recorded. The PI server also compares the new value against previous values to see if it still fits on a line within the compression limit. If yes, the data is discarded, otherwise it is added to the archive. For pump starts, the compression limit is simply a change in state (on-off or start-stopped), if 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> have passed without an archive update, one is made regardless. PI provides generally accurate long term values and greater amounts of data when events are changing rapidly.
Since the event resulted in the loss of two preferred ac buses, various PPC/PI data points were unavailable and not recorded in the PPC/PI systems.
This evaluation uses PI data both directly and in support of other data sources for:
" steam generator level
" steam generator pressure
" auxiliary feedwater flow
- pressurizer level
" pressurizer pressure
" charging flow
- primary coolant system average temperature 3.2.2 Control Room Recorder Data Event-specific plant data for various plant parameters are obtained from control room recorder data.
Certain Yokagawa-type control room indicators have the ability to record and store data. Plant instrumentation and control engineers collected post-event data from these recorders and provided both display screen shots and data to the PRA group.
This evaluation uses Yokagawa recorder data both directly and in support of other data sources for:
" pressurizer level
- pressurizer pressure
" charging flow
- primary coolant system average and loop temperatures
" main feewater turbine steam flow
" main feedwater turbine steam pressure
3.2.3 Operator Logs Event-specific plant data for various parameters and events are obtained from electronic operator round (eSOMS) logs.
This evaluation uses eSOMS logs mainly in support of other data sources.
3.3 Condensate Storage Tank The condensate storage tank (T-2) was 87'F as recorded in the electronic operator rounds (eSOMS) at 0752 on 9-25-2011.
3.4 Atmospheric Dump Valves (ADVs)
Operation of the atmospheric dump valves (CV-0779, CV-0780, CV-0781, and CV-0782) via quick open and manual control is unavailable until power is restored to preferred ac bus EY-10.
The loss of dc event resulted in loss of power to the inverter that supplies preferred ac bus EY-1 0. Power can be restored by restoring power to the dc bus and re-energizing the inverter or aligning the bypass regulator to re-energize the preferred ac bus. EY-1 0 was placed on bypass regulator at 16:46, one hour forty minutes into the event.
For cases where ADVs are restored, valve operation to achieve decay heat removal and plant cooldown in accordance with technical specification limits on cooldown rate is used.
In nearly all the MAAP cases reported herein, the ADV's are modeled as "failed closed".
3.5 Auxiliary Feedwater Auxiliary feedwater pump P-8A does not start on auxiliary feedwater actuation signal due to loss of preferred ac buses EY-10 and EY-30. However, P-8A remains available to be started from the control room or locally. After restoration of power to ED-1 1-1 and EY-10 or EY-30, P-8A is capable of automatic start should steam generator levels fall to the auxiliary feedwater actuation signal setpoint.
The loss of dc event de-energized left channel dc power. This results in automatic start of P-8B (mechanical governor maintains normal turbine/pump speed) with flow control valves wide open. Steam supply to P-8B was manually isolated at 16:03. P-8B flows to each steam generator are given in 0. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.
Right channel dc power remained available. Auxiliary feedwater pump P-8C starts on auxiliary feedwater actuation signal given P-8A failure to deliver required flow (due to loss of EY-10, EY-30 and loss of left channel dc). Flow control valves set to 165 gpm to each steam generator. P-8C flow to E-50A was isolated due to overfill concerns at 15:44. P-8C flow to E-50B was isolated at 16:09 due to adequate E-50B level.
For cases demonstrating event thermal-hydraulics, the following AFW data is used:
Table 3.5-1: Total AFW Flow Time Time Time Flow to E-50A Flow to E-50B Flow to E-50A Flow to E-50B (event time) (hours) (minutes) (gpm) (gpm) (Ibm/hr) (Ibm/hr) time 0 (1506) 0 0 342 350 1.697E+05 1.737E+05 1520.0 0.2333 14.0 342 350 1.697E+05 1.737E+05 1520.1 0.2350 14.1 419 273 2.080E+05 1.355E+05 1530.0 0.4000 24.0 419 273 2.080E+05 1.355E+05 1530.1 0.4017 24.1 495 185 2.457E+05 9.182E+04 1540.0 0.5667 34.0 495 185 2.457E+05 9.182E+04 1540.1 0.5683 34.1 379 163 1.881E+05 8.090E+04 1603.0 1.6167 97.0 379 163 1.881E+05 8.090E+04 1603.1 1.6183 97.1 0 156 0 7.743E+04 1609.0 1.7167 103.0 0 0 0 0 1636.0 2.1667 130.0 0 0 0 0 1636.1 2.1683 130.1 0 129 0 6.403E+04 1730.0 3.7333 224.0 0 129 0 6.403E+04 1730.1 3.7350 224.1 56 96 2.779E+04 4.765E+04 end of problem 24.0000 1440.0 56 96 2.779E+04 4.765E+04 problem 3.6 Charging Initial charging flow was 93 gpm. At approximately 36 minutes into the event, charging flow was reduced to 73 gpm.
The loss of dc event resulted in failure of the in-service channel A pressurizer level and heater control circuit. With no power to channel A the control program defaulted to maximum flow from the operating pumps (93 gpm: P-55A - 53 gpm; P-55B - 40 gpm).
At approximately 31 minutes into the event operators switched pressurizer level control to channel B to enable pressurizer spray. With channel 'B' in service charging flow reduced to the minimum flow from operating pumps (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm).
Had channel 'B' been in service at the time of the event, charging flow rate would have been at minimum flow from the operating pumps from time zero.
For cases demonstrating event thermal-hydraulics, the following charging data is used:
Table 3.6-1: Total Charging Flow Time Time Time Flow to PCS Flow to PCS (event time) (hours) (minutes) (gpm) (Ibm/hr) time 0 (1506) 0 0 93 1542.0 0.6000 36 73 1557.0 0.8500 51 0 0 end of problem 24.0000 1440.0 000 0 problem I1 4.0 ASSUMPTIONS 4.1 Major Assumptions 4.1.1 AFW flow delivery is under predicted.
Basis: AFW flow is limited based on S/G level control. Therefore, the Table 3.5-1 data is automatically throttled to match decay heat.
Bias: Conservative, as the calculated primary system pressure is greater.
4.1.2 MAAP S/G Modeling Limited Basis: The Palisades MAAP model runs hotter than the RELAP Version 3 Mod 2 model. Comparisons
[3] between MAAP and RELAP have shown that for station blackout sequences with subsequent once-through-cooling (OTC), that the comparative behavior between the codes for the most part, is very similar.
The single biggest difference is the more rapid steam generator dryout calculated by MAAP. This is considered due to the MAAP S/G modeling limitations. Below, the MAAP hot core node temperature peaks at about 1200°K. No peak is exhibited from the RELAP results.
1400 z 1200
!1000 a-
=. 400 200 S 0 0 10000 200301 30000 40000 rinl. 40 Bias: Conservative, as the MAAP results produce higher pressures and temperatures for above core breaks.
4.2 Minor Assumptions 4.2.1 The onset of core damage has been defined as the time when peak core temperature reaches 1800 F.
Basis: The onset of core damage should be developed consistent with the desire to be as realistic as possible and consistent with current best practice. If the MAAP code is used to predict core response, it is recommended that core damage be defined as the time when peak core temperature reaches 1800°F.
This is based on the characteristics of the MAAP code and the guidance provided in the MAAP4 applications guide. A peak core temperature of 1800°F is also consistent with the general guidelines for the definition of core damage provided in the EPRI Probabilistic Safety Assessment (PSA) Applications Guide [4].
Bias: This is considered conservative per Assumption 4.1.2 and given that the fuel design limit is 2200°F.
4.2.2 Quench Tank Model Disabled Basis: The PORV discharge model to the quench tank was disabled, to improve code execution time.
Bias: This is considered neutral as it results in a slightly higher early containment heat load and somewhat slows the PCS blowdown transient.
5.0 ANALYSIS Illustrative and/or important MAAP cases are described below. Not all MAAP cases are explicitly discussed. The case name (prefix of the input file name) indentifies the specific MAAP run. The purpose, description and conclusion of each run are provided; selected plots follow.
Two basic types of cases are analyzed:
" Cases utilizing event-specific timing and/or plant response
" Cases utilizing bounding timing and/or plant response.
The first set of cases is meant to envelope the actual event to ensure the actual plant response is bounded by the second set of cases. No cases have been performed to precisely match actual event plant response in all respects. Various model conservatisms add margin to the bounding case results.
Following each case the selected plot results are presented following by the specific MAAP input file is listed.
5.1 DI1-2 SDP Case7 5.1.1 D11-2 SDP Case7 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. in order to determine the time to refill T-2. In this case, with charging secured in 51 minutes core heat is removed by AFW with steaming through the safeties. Table 5.1.1 provides an overview of the case inputs and boundary conditions. Appendix A includes the specific input file.
Table 5.1.1 MAAP CASE
SUMMARY
Purpose:
Determine the time to Refill T-2.
- AFW initially operable for -97 minutes. Tripped for -27 minutes restored
Description:
in -2.17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br />. See Table 3.5-1.
- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- P-55A and P-55B available for 51 minutes and secured. See Table 3.5-2
- T-2 refill not credited.
Other:
- No PCS Break(s)
D11-2 SDP Case7 - HPSI Tripped (t=0)
- LPSI Tripped (t=0)
- PCPs tripped in 11 minutes
- Fans/Coolers Tripped (t=0)
- Containment Sprays Tripped (t=0)
- PZR Sprays Tripped (t=0)
- PZR Heaters Tripped (t=0)
- Main Feedwater Isolated (t=0)
- MSIVs Forced Closed (t=0)
Conclusion:
If T-2 can be refilled within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, core damage will be averted.
Figure 5.1.1-1 Peak Core Temperature (mass averaged over node matenal) [d 11-2_sdpcase-7 d95]
3OOaE-03 2 50E+03 2 OOE+03 0 I 50E+03 I100E+03 5 00E02 000500 I 0005.+00 5 005.00 I 005.01 I 50i+01 2 005.+01 2 50E.01 TME(HR)
Figure 5.1.1-2 CST Level Idl 1-2_sdp_case-7 d951 8ODE-01 7 OOE.011 6 OOE-01 5 OOE.01 4 OOE.O1 3 OOE.O1 2 OOE+0l 1 OOE.O1 0 OOE.00 ON( 5 0OE.00 I 00Fg01 1 50E.01 2 00E+01 2 50E+01 3 00E+01 Figure 5.1.1-3 Charging Pumps Volumetric Flow Rate [dll-2_sdpcase-7.d95]
I 20E+02 I OOE÷02 8 OOE01 4 ooEo01 2 OOEM01 o oo0foo 0 OOE+00 5 008O1 1 00.E81 1 50E801 2008.01 2 50E801 3000E+1 W3ME(MR)
5.1.2 D11-2 SDP Case7 Results Figure 5.1.1-1 indicates the rise in the peak core node temperature begins in about 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. Figure 5.1.1-2 show the condensate storage tank (T-2) emptying in approximately 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, and Figure 5.1.1-3 presents charging flow termination.
5.2 D11-2 SDP Casel1 5.2.1 D11-2 SDP Casel 1 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. This case reports on the water inventory given a stuck open PZR valve, and unsecured charging flow for a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. Table 5.2.1 provides an overview of the case inputs and boundary conditions. Appendix A includes the specific input file.
Table 5.2.1 MAAP CASE
SUMMARY
To evaluate the 9/25/11 baseline event incorporating time line data,
Purpose:
operating plant equipment, etc. Charging, 80 gpm flow, unsecured (t=0) with a Stuck Open PZR Safety (t=1.15 hrs). 1 CAC operable.
Description:
- AFW initially operable for -97 minutes. Tripped for -27 minutes restored in -2.17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br />. See Table 3.5-1.
- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- T-2 refill not credited.
- 1 Containment Air Cooler credited.
- Problem run time 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
Other:
- Forced PCS Break Simulating Stuck Open PZR Safety (1.15 hrs)
Dll-2 SDP Casel1 - HPSI Tripped (t=0)
- LPSI Tripped (t=0)
- PCPs tripped in 11 minutes
- Containment Sprays Tripped (t=0)
- PZR Sprays Tripped (t=0)
- PZR Heaters Tripped (t=0)
- Main Feedwater Isolated (t=0)
- MSIVs Forced Closed (t=0)
In case 11, the PZR safeties begin to pass water in -1.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> at which time a stuck open PZR safety is modeled. Assuming containment sprays
Conclusion:
are promptly secured, safety injection refueling water tank inventory (T-
- 58) and condensate storage tank (T-2) water will last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Moreover, 1 CAC alone can remove containment heat.
Figure 5.2.1-1 Peak Core Temperature (mass averaged over node matenal) [dl I-2_sdpcase-il d951 185M.03 - - -
I 60E+03 1 40E503 I 20E÷03 8 00.E02 6 00E+02 4 00E+02 2 OOE.02 0 00E+05--
0 00E+00 5 00+00 1 00E+01 I150E+01 5--
2 00i+01 0.
2 5iE+01 T-ME(HR)
Figure 5.2.1-2 Pnmary System Pressure [dl I-2_sdpcase-1 1 d95]
3 00E+03 2 50E+03 2 00-+03 I 50E-03 I OOE-03 5 00.E02 0
THAE(W
Figure 5.2.1-3 Charging Pumps Volumetric Flow Rate [dl 1-2_sdpcase-11 d95]
1 20E+02 I 00E+02 8 OOE+01 2 OOE01 400E-01 2 0OE+01 0 OOE+00 0 oGCEo 5 OOE.00 1ooI0i01 150El 2 oo+oE1 2 50E.l1 nME(HIR)
Figure 5.2.1-4 Water Level in Refueling WaterStorage Tank [dl1-2_sdp case-11 d951 2 50E+01 2 OOE+01 1 50E+01 I OOE10*01 5OOE.00 0 oo00o5 O 00i+00 ta~I 0ý0 5DE-01i aOE.01 2 SOE.01 T "Qa)
Figure 5.2.1-5 Crane to Dome- North and South (corresponding to GOTHIC nodes 1 & 2) pressure [dli-2_sdpcase-11 d95]
4 OE.01 3050E+01 3 5OE+01 2 50E+01 2 OE.+01 150E+01 5 OOE+01 000E+00 0 00E+00 5 006+00 1 006E.01 1 50E601 2 00E+01 2 50E-01 TIME(HR)
Figure 5.2.1-6 CST Level [dl 1-2_sdp case-Il d95]
8 OOE+01 . . . .
7 00E+01 600E+01 5 00E+01 01 4 00E+01 3 00E01 2 00E+01 1 006E01 0 00E+00 5 00E+00 100E+01 I 50E.01 20+001 2 O0E+01
Figure 5.2.1-7 E-50A S/G Level [dll -2_sdpcase-Il d95]
8 OE÷01 7 O0E+01 6 00E*01 5 00E+01 S4 00501+O 300E+01 2 00E+01 100E.01 0ooE000 5 OOE+o0 I oo+o01 I 50+010 TIME TIME(HR)
Figure 5.2.1-8 E-50B S/G Level [d11-2_sdpcase-lI d95]
7 065 +01 .. .. . . . . . . .. . . . .. ... .. ............. . .. . . ... ... . .. ..
6 00E+01 5 00E +O1 4 005+01 300E501 200E+01 1005&01 00 +5 000OE+0000 05+00 00*O 1 ooý+01 I 50E-01 2 OOE+01 2 50E+01 TIME (HR)
(HR)0
Figure 5.2.1-9 AFW Volumetric Flow Rate (GPM) to E-50A [dl 1-2_sdpcase-11 d951 600E02 5 0OE+02 4 0OE.02 3 00E+02 2 00E+02 I 000E02 0 OOE+O00 0 00E+00 5 00.E00 1 00ue01 liE (HR) I250E-01 2 00E.01 2 50E*01 Figure 5.2.1-10 AFW Volumetric Flow Rate (GPM) to E-50B [dll-2_sdpcase-11 d95]
4 OOE÷02 3 50E.02 3 00E+02 2.50.02 S2 006.02 1 50E+02 1 00E+02 5006E01 0 00.E00 0 006.00 5 006.06 I 00i.01 1 +01.0 2 000E+01 2 50E+01 liME (IR)
5.2.2 D1 1-2 SDP Casel 1 Results Figure 5.2-1 shows the rise in the peak core node temperature given a stuck open pressurizer safety valve at approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The peak temperature of 1650'F remained less than the success criteria limit of 1800'F. Figure 5.2.1-2 displays the primary coolant system pressure (PCS). Figure 5.2.1-3 presents the unsecured charging flow dropping from 93 gpm to 73 gpm at 36 minutes into the event.
Figure 5.2.1-4 shows the safety injection refueling water storage tank (SIRWT) dropping about 8 feet during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. Figure 5.2.1-5 demonstrates that 1 containment air cooler (CAC) is sufficient to keep containment pressure less than the 55 psig design value. Figure 5.2.1-6 indicates that the condensate storage tank (T-2) dropped from about 72 feet to 26 feet during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> duration. Figures 5.2.1-7 and 5.2.1-8 present displays the E-50A and E-50B steam generator levels, and similarly Figures 5.2.1-9 and 5.2.1-10 report the AFW flow to each generator.
In summary, Case 11 results show that if 2 charging pumps, SIRWT water and AFW are available then HPSI injection is not required.
5.3 D1l-2 SDP Casel7 5.3.1 D11-2 SDP CaseI7 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. This case presents the minimum time to empty the SIRWT. A failed open PZR valve modeled at 1.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> with all three spray pumps running is considered. The time to emptying the pressuizer may be used as an operator recovery action.
Table 5.3.1 MAAP CASE
SUMMARY
To evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. 80 gpm charging flow with a Stuck Open
Purpose:
PZR Safety (t=1.15 hrs). All 3 containment spray pumps are operating to determine the time to SIRWT depletion.
Description:
- No AFW.
- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- T-2 refill not credited.
- Problem run time 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
Other:
- Forced PCs Break Simulating Stuck Open PZR Safety (1.15 hrs)
D11-2 SDP Case17 - HPSI Tripped (t=0)
- LPSI Tripped (t=0)
- PCPs tripped in 11 minutes
- PZR Sprays Tripped (t=0)
- PZR Heaters Tripped (t=0)
- Main Feedwater Isolated (t=0)
- MSIVs Forced Closed (t=0)
In case 17, the PZR safeties begin to pass water in -1.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> and a
Conclusion:
stuck open PZR safety is modeled. Assuming containment sprays are not secured, the SIRWT runs out of water in a little over two hours.
Figure 5.3.1-1 Water Level in Refueling Water Storage Tank [d Il-2_sdpcase-17 d951 2 50E-01 2 00E+01 1 5M+01 1 00E01 500.E00 0000.00 001 1 00E00 2 00E+00 3 00E00 4 00.E00 5 00E+00 6000E00 TIME (HR)
Figure 5.3.1-2 Spray P-54A, P-54B and P-54C Volumetric Flow Rate Idl 1-2_sdp _case-i 7 d95]
600E+03 5 00E+03 400E.03 200E003 -
020E.03
- 0 00.E00 I 0 00.00 10 0000 20E+00 3 00+00 0 oo.00 50 0.00 6000+00 riME 011R)
Figure 5.3.1-3 Water Flow Through the Pressunzer Safety Valves [dl I-2_sdp case-I7 d95]
8OOE-05 7 OOE+05 6 OOE-05 5 OOE.05 4 OE0 3 OOE.O5 2 OOE-05 I OOE.O5 OOE-00E-0 OOE+00 1 00E+00 2 00E+00 3 00.E00 4 00E000 5000E+0 TIME (HR) 5.3.2 D11-2 SDP Casel7 Results Figure 5.3.1-1 shows the time when the SIRWT would empty, given that containment spray pumps are not secured and charging is providing makeup. Figure 5.3.1-2 plots the containment spray delivery curve.
Figure 5.3.1-3 presents the water flow rate through the pressurizer safety valve starting at approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.
6.0 WATER
SUMMARY
Water summary results are listed below in Table 6.
Table 6 Case Water Makeup Requirements Case . Charging Containment
- Water Source Refill Time ADV's AFW PZR Safeties Flow Heat Comments Removal 7 Condensate 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> Closed Table closed Table 3.5-2 Assuming Table 3.5-1 delivery rates.
Storage Tank 3.5-1 Table Failed open per PCS high pressure demand at 11 SIRWT Empty > 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Closed 3.5-1 Failed Open 80 gpm 1 CAC 1.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Assumes containment sprays initially secured.
Condensate Table Failed open per PCS high pressure demand at 11 Storage Tank > 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Closed 3.5-1 Failed Open 80 gpm 1 CAC 1.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Assumes containment sprays initially secured.
3 Spray PZR Safeties failed open at 0.2 hrs, chosen to 17 SIRWT Empty - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Closed none Failed Open 80 gpm Pumps bound the results. Three containment spray pumps are modeled.
7.0 REFERENCES
[1] PLP0247-07-0004.02R1, Revision 1, Palisades Nuclear Plant MAAP 4.0.6 Parameter Files Notebook, Volumes 1-8, August 2009.
[2] PLP0247-07-0004.01 R2, Revision 2, Palisades Nuclear Plant Thermal Hydraulic MAAP Calculations, October 2009.
[3] Letter from Jeff R. Gabor to Brian Brogan, "MAAP4/RELAP5 Comparison Final Report",
PP0495050004-2613, March, 2006.
[4] Palisades PSA Notebook NB-PSA-ETSC Rev. 2, "Event Trees and Success Criteria".
8.0 APPENDICES Appendix A - MAAP Input Files Appendix A - MAAP Input Files Appendix B - MAAP Attach & Plot Files Appendix B - MAAP Attach & Plot Files. pd
Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 S Entergy Engineering Appendix A - Page I of 13 Analysis MAAP Input Files Appendix A: MAAP Input Files 1.0 D11-2_SDP_ -Case-7.inp
............................................................................................................................... 2 2.0 DI1-2_SDP_Case-11.inp ............................................................................................................................. 5 3.0 DII-2_SDP_Case-17.inp ............................................................................................................................. 9
Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Entergy Engineering Appendix A - Page 2 of 13 Analysis MAAP Input Files 1.0 D11-2_SDP_CASE-7.1NP SENSITIVITY ON TITLE Loss of D11-2 Case 7 END TITLE INCLUDE attach.dat INCLUDE attachcharginglDll_2(2).dat INCLUDE sc-plots(1).dat PARAMETER CHANGE C
PSGRV = 2000 PSI // Lock the ADV closed TDMFW = 0.0 HR // Time delay between MFW isol & actual isol C Set CST to large value but keep same level C MWCST0 = 1.E9 LB C ACST = 738220. FT**2 C Given MAAP will use the minimum of WAFWXU or the flowrate from the pump head
- curve, C set the head curve data high.
WVAFW(1)= 1000. GPM WVAFW(2)= 1000. GPM WVAFW(3)= 1000. GPM WVAFW(4)= 1000. GPM WVAFW(5)= 1000. GPM END START TIME IS 0.
END TIME IS 24.0 HR PRINT INTERVAL IS 1. HR INITIATORS C PS BREAK(S) FAILED HPI FORCED OFF LPI FORCED OFF C MCP SWITCH OFF OR HI-VIBR TRIP FANS/COOLERS FORCED OFF ESF UPPER/LOWER COMPT. SPRAYS FORCED OFF C MOTOR-DRIVEN AUX FEED WATER FORCED OFF PZR SPRAYS FORCED OFF PZR HTRS FORCED OFF MANUAL SCRAM MAIN FW SHUT OFF C CHARGING PUMPS FORCED OFF S/G MSIV: FORCED CLOSED PS MAKEUP OFF LETDOWN SWITCH OFF
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Entergy Engineering Appendix A- Page 3 of 13 Analysis MAAP Input Files END WHEN REACTOR SCRAM IS TRUE SET TIMER 1 END WHEN TIMER 1 > 0.000833 HR CHARGING PUMPS SWITCH: AUTO CHARGING PUMP SWITCH: MAN ON C PARAMETER CHANGE C 342 GPM to E-50A and 350 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 1.697E+05 LB/HR WAFWXB = 1.737E+05 LB/HR C END END WHEN TIMER 1 > 0.1833 HR MCP SWITCH OFF OR HI-VIBR TRIP END WHEN TIMER 1 > 0.2350 HR C PARAMETER CHANGE C 419 GPM to E-50A and 273 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.08E+05 LB/HR WAFWXB = 1.355E+05 LB/HR C END END WHEN TIMER 1 > 0.4017 HR C PARAMETER CHANGE C 495 GPM to E-50A and 185 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.457E+05 LB/HR WAFWXB = 9.182E+04 LB/HR C END END WHEN TIMER 1 > 0.5683 HR C PARAMETER CHANGE C 379 GPM to E-50A and 163 GPM to E-50B C TAFW = 120. F @ 900 psia
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Ente y Engineering Appendix A - Page 4 of 13 Analysis MAAP Input Files C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] 0.0020148156 [GAL/MIN]
WAFWXU = 1.881E+05 LB/HR WAFWXB = 8.09E+04 LB/HR C END END WHEN TIMER 1 > 0.6 HR C PARAMETER CHANGE C P-55A and P-55B assumed operating at time 0 C Reduce P-55A flow rate from 53 gpm to 33 gpm WVPM6(1) = 73.0 GPM WVPM6(2) = 73.0 GPM WVPM6(3) = 73.0 GPM WVPM6(4) = 73.0 GPM WVPM6(5) = 73.0 GPM C END END WHEN TIMER 1 > 0.85 HR WVPM6(l) = 0.0 GPM WVPM6(2) = 0.0 GPM WVPM6(3) = 0.0 GPM WVPM6(4) = 0.0 GPM WVPM6(5) = 0.0 GPM END WHEN TIMER 1 > 1.6183 HR C PARAMETER CHANGE C 0 GPM to E-50A and 156 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- I/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 0.0 LB/HR WAFWXB = 7.743E+04 LB/HR C END END WHEN TIMER 1 > 1.7167 HR C PARAMETER CHANGE C 0 GPM to E-50A and 165 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- l/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 0.0 LB/HR WAFWXB = 0.0 LB/HR C END END
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Engineering Appendix A- Page 5 of 13 Analysis MAAP Input Files WHEN TIMER 1 > 2.1683 HR C PARAMETER CHANGE C 0 GPM to E-50A and 129 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 0.0 LB/HR WAFWXB = 6.403E+04 LB/HR C END END WHEN TIMER 1 > 3.735 HR C PARAMETER CHANGE C 56 GPM to E-50A and 96 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- l/0.1336805556[GAL/FT3]
- 1/60[HR/MINI C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.779E+04 LB/HR WAFWXB = 4.765E+04 LB/HR C END END 2.0 D11-2_SDPCASE-11.INP SENSITIVITY ON TITLE Loss of D11-2 Case 11 END TITLE INCLUDE attach.dat INCLUDE attachchargingl Dll_2(2).dat INCLUDE scplots(1) .dat PARAMETER CHANGE C
PSGRV = 2000 PSI // Lock the ADV closed TDMFW = 0.0 HR // Time delay between MFW isol & actual isol C Set CST to large value but keep same level C MWCSTO = 1.E9 LB C ACST = 738220. FT**2 C Given MAAP will use the minimum of WAFWXU or the flowrate from the pump head
- curve, C set the head curve data high.
WVAFW(1)= 1000. GPM WVAFW(2)= 1000. GPM WVAFW(3)= 1000. GPM WVAFW(4)= 1000. GPM WVAFW(5)= 1000. GPM C 3 CACs = 12 Coils
Entergy PSA EA-PSA-SDP-DII-2-11-07 Rev. 0 Engineering Appendix A - Page 6 of 13 Analysis MAAP Input Files C 2 CACs = 8 Coils C 1 CAC = 4 Coils C NFN = 12, number of containment air cooler coils for 3 CACs C Credit only 1 Fan Cooler NFN = 4 END START TIME IS 0.
END TIME IS 24.0 HR PRINT INTERVAL IS 1. HR INITIATORS C PS BREAK(S) FAILED HPI FORCED OFF LPI FORCED OFF C MCP SWITCH OFF OR HI-VIBR TRIP C FANS/COOLERS FORCED OFF ESF UPPER/LOWER COMPT. SPRAYS FORCED OFF C MOTOR-DRIVEN AUX FEED WATER FORCED OFF PZR SPRAYS FORCED OFF PZR HTRS FORCED OFF MANUAL SCRAM MAIN FW SHUT OFF CHARGING PUMPS FORCED OFF S/G MSIV: FORCED CLOSED PS MAKEUP OFF LETDOWN SWITCH OFF END WHEN REACTOR SCRAM IS TRUE SET TIMER 1 END WHEN TIMER 1 > 0.000833 HR CHARGING PUMPS SWITCH: AUTO CHARGING PUMP SWITCH: MAN ON C PARAMETER CHANGE C 342 GPM to E-50A and 350 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 1.697E+05 LB/HR WAFWXB = 1.737E+05 LB/HR C END END WHEN TIMER 1 > 0.1833 HR MCP SWITCH OFF OR HI-VIBR TRIP END
Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Entergy Engineering Appendix A - Page 7 of 13 Analysis MAAP Input Files WHEN TIMER 1 > 0.2350 HR C PARAMETER CHANGE C 419 GPM to E-50A and 273 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.08E+05 LB/HR WAFWXB = 1.355E+05 LB/HR C END END WHEN TIMER 1 > 0.4017 HR C PARAMETER CHANGE C 495 GPM to E-50A and 185 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.457E+05 LB/HR WAFWXB = 9.182E+04 LB/HR C END END WHEN TIMER 1 > 0.5683 HR C PARAMETER CHANGE C 379 GPM to E-50A and 163 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 1.881E+05 LB/HR WAFWXB = 8.09E+04 LB/HR C END END WHEN TIMER 1 > 0.6 HR C PARAMETER CHANGE C P-55A and P-55B assumed operating at time 0 C Reduce P-55A flow rate from 53 gpm to 33 gpm WVPM6(1) = 73.0 GPM WVPM6(2) = 73.0 GPM WVPM6(3) = 73.0 GPM WVPM6(4) = 73.0 GPM WVPM6(5) = 73.0 GPM C END END C WHEN TIMER 1 > 0.85 HR C WVPM6(1) = 0.0 GPM C WVPM6(2) = 0.0 GPM C WVPM6(3) = 0.0 GPM
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Engineering Appendix A- Page 8 of 13 Analysis MAAP Input Files C WVPM6(4) = 0.0 GPM C WVPM6(5) = 0.0 GPM C END WHEN TIMER 1 > 1.15 HR C PARAMETER CHANGE C Set PORV to model Stuck Open PZR Safety C At 16:15(analysis timeline)the PCS is solid and PZR Safety Lifts C and passes water. Event duration 15:06 start and 16:15 safeties lift.
C C PZR Safety ASRV(3) 0.0097 FT**2 C The POV is assumed to be always open for a LOCA C so the setpoint pressure to open is set to a low value C
PSETRV(1) = 10 PSI ASRV(l) = 0.0097 FT**2 C Since the PORV discharges to the quench tank, C the quench tank needs to be disabled. The rupture C pressure is set to a low value C Setting IQT = 0 disables the quench tank model IQT = 0 C END PORV PZR Safety Relief Model END WHEN TIMER 1 > 1.6183 HR C PARAMETER CHANGE C 0 GPM to E-50A and 156 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 0.0 LB/HR WAFWXB = 7.743E+04 LB/HR C END END WHEN TIMER 1 > 1.7167 HR C PARAMETER CHANGE C 0 GPM to E-50A and 165 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 0.0 LB/HR WAFWXB = 0.0 LB/HR C END END WHEN TIMER 1 > 2.1683 HR C PARAMETER CHANGE C 0 GPM to E-50A and 129 GPM to E-50B
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Engineering Appendix A - Page 9 of 13 Analysis MAAP Input Files C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MINI WAFWXU = 0.0 LB/HR WAFWXB = 6.403E+04 LB/HR C END END WHEN TIMER 1 > 3.735 HR C PARAMETER CHANGE C 56 GPM to E-50A and 96 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
WAFWXU = 2.779E+04 LB/HR WAFWXB = 4.765E+04 LB/HR C END END 3.0 DI1-2_SDPCASE-17.1NP SENSITIVITY ON TITLE Loss of D11-2 Case 17 END TITLE INCLUDE attach.dat INCLUDE attachcharging2.dat INCLUDE scplots(1).dat PARAMETER CHANGE C
PSGRV = 2000 PSI // Lock the ADV closed TDMFW = 0.0 HR // Time delay between MFW isol & actual isol C Set CST to large value but keep same level C MWCSTO = 1.E9 LB C ACST = 738220. FT**2 C Given MAAP will use the minimum of WAFWXU or the flowrate from the pump head
- curve, C set the head curve data high.
WVAFW(1)= 1000. GPM WVAFW(2)= 1000. GPM WVAFW(3)= 1000. GPM WVAFW(4)= 1000. GPM WVAFW(5)= 1000. GPM C 3 CACs = 12 Coils C 2 CACs = 8 Coils C 1 CAC = 4 Coils C NFN = 12, number of containment air cooler coils for 3 CACs
Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Appendix A- Page 10 of 13 Analysis MAAP Input Files C Credit only 1 Fan Cooler C NFN = 4 C Credit 3 Spray Pumps NSPAG = 3 END START TIME IS 0.
END TIME IS 5.0 HR PRINT INTERVAL IS 1. HR INITIATORS C PS BREAK(S) FAILED HPI FORCED OFF LPI FORCED OFF C MCP SWITCH OFF OR HI-VIBR TRIP FANS/COOLERS FORCED OFF C ESF UPPER/LOWER COMPT. SPRAYS FORCED OFF MOTOR-DRIVEN AUX FEED WATER FORCED OFF PZR SPRAYS FORCED OFF PZR HTRS FORCED OFF MANUAL SCRAM MAIN FW SHUT OFF CHARGING PUMPS FORCED OFF S/G MSIV: FORCED CLOSED PS MAKEUP OFF LETDOWN SWITCH OFF END WHEN REACTOR SCRAM IS TRUE SET TIMER 1 END WHEN TIMER 1 > 0.000833 HR CHARGING PUMPS SWITCH: AUTO CHARGING PUMP SWITCH: MAN ON C PARAMETER CHANGE C 342 GPM to E-50A and 350 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
C WAFWXU = 1.697E+05 LB/HR C WAFWXB = 1.737E+05 LB/HR C END END WHEN TIMER 1 > 0.1833 HR MCP SWITCH OFF OR HI-VIBR TRIP END WHEN TIMER 1 > 1.15 HR
Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 0 Engineering Appendix A- Page 11 of 13 Analysis MAAP Input Files C PARAMETER CHANGE C Set PORV to model Stuck Open PZR Safety C At 1.93 hours0.00108 days <br />0.0258 hours <br />1.537698e-4 weeks <br />3.53865e-5 months <br /> the PCS is solid and PZR Safety Lifts C and passes water. Refer to Case 8.
C C PZR Safety ASRV(3) 0.0097 FT**2 C The POV is assumed to be always open for a LOCA C so the setpoint pressure to open is set to a low value C
PSETRV(1) = 10 PSI ASRV(1) = 0.0097 FT**2 C Since the PORV discharges to the quench tank, C the quench tank needs to be disabled. The rupture C pressure is set to a low value C Setting IQT = 0 disables the quench tank model IQT = 0 C END PORV PZR Safety Relief Model END WHEN TIMER 1 > 0.2350 HR C PARAMETER CHANGE C 419 GPM to E-50A and 273 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- l/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
C WAFWXU = 2.08E+05 LB/HR C WAFWXB = 1.355E+05 LB/HR C END END WHEN TIMER 1 > 0.4017 HR C PARAMETER CHANGE C 495 GPM to E-50A and 185 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
C WAFWXU = 2.457E+05 LB/HR C WAFWXB = 9.182E+04 LB/HR C END END WHEN TIMER 1 > 0.5683 HR C PARAMETER CHANGE C 379 GPM to E-50A and 163 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
C WAFWXU = 1.881E+05 LB/HR C WAFWXB = 8.09E+04 LB/HR
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Entrg Engineering Appendix A - Page 12 of 13 Analysis MAAP Input Files C END END WHEN TIMER 1 > 0.6 HR C PARAMETER CHANGE C P-55A and P-55B assumed operating at time 0 C Reduce P-55A flow rate from 53 gpm to 33 gpm C WVPM6(1) = 73.0 GPM C WVPM6(2) = 73.0 GPM C WVPM6(3) = 73.0 GPM C WVPM6(4) = 73.0 GPM C WVPM6(5) = 73.0 GPM C END END C WHEN TIMER 1 > 0.85 HR C WVPM6(1) = 0.0 GPM C WVPM6(2) = 0.0 GPM C WVPM6(3) = 0.0 GPM C WVPM6(4) = 0.0 GPM C WVPM6(5) = 0.0 GPM C END WHEN TIMER 1 > 1.6183 HR C PARAMETER CHANGE C 0 GPM to E-50A and 156 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- I/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MINI C WAFWXU = 0.0 LB/HR C WAFWXB = 7.743E+04 LB/HR C END END WHEN TIMER 1 > 1.7167 HR C PARAMETER CHANGE C 0 GPM to E-50A and 165 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- l/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MINI C WAFWXU = 0.0 LB/HR C WAFWXB = 0.0 LB/HR C END END WHEN TIMER 1 > 2.1683 HR C PARAMETER CHANGE C 0 GPM to E-50A and 129 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
Entergy PSA EA-PSA-SDP-Dll-2-11-07 Rev. 0 Entergy Engineering Appendix A - Page 13 of 13 Analysis MAAP Input Files C 1 [LB/HR] = 0.0020148156 [GAL/MIN]
C WAFWXU = 0.0 LB/HR C WAFWXB = 6.403E+04 LB/HR C END END WHEN TIMER 1 > 3.735 HR C PARAMETER CHANGE C 56 GPM to E-50A and 96 GPM to E-50B C TAFW = 120. F @ 900 psia C specific volume = 1.61605e-2 FT**3/LB C 1 [LB/HR]
- 0.0161605 [FT3/LB]
- 1/0.1336805556[GAL/FT3]
- 1/60[HR/MIN]
C 1 [LB/HR] = 0.0020148156 [GAL/MINI C WAFWXU = 2.779E+04 LB/HR C WAFWXB = 4.765E+04 LB/HR C END END