ML17332A848

Qualitative Functional Diversity Assessment of UFSAR of Common Mode Failure of Digital Equipment Software.

ML17332A848
Person / Time
Site:	Cook
Issue date:	12/04/1992
From:	AMERICAN ELECTRIC POWER SERVICE CORP.
To:
Shared Package
ML17332A849	List: IR 05000315/1993012 ML17332A848 ML17332A850 ML17332A851 ML17334B552
References
QA-92-18, NUDOCS 9507180137
Download: ML17332A848 (87)

Text

egherfcan ".'tectrfc Power Service Corporation lear Safety And Ucenslng Section Catcttlation Covev Sheet NUC 15 91 99(R1 040glP2S Calculation No. cM c pr Subject ComPany Ty1 A Hd 1 CAVAyA0 tl Calculated By R. 5 S w Sp ryte S Verified/Checked By Safety-Related System Yes + no Method Of Venficabon

~

J/8w9'mbiem Supersedes Gale. No. Approved By tan e. ~WAn4n acrcsca4a +c oko c4 cnt Ifcccrmnt. CH-I-t nu

~~~~~. +

Description:

metr rnocct:) w Ioolnp cA cgcoclc44 Potttoofo $)eo. 2oo/s)ec 28o Pnrorco RhaC4nn'iC.g ~<a. HP,C. ~qW red, PSaPSt- 4a, CaaV~ ~

m eke. ~~ur-(cortt:) ro( ~e. 2+dmsorrrr g-tt Yt~ ctriRtbk ot 'uor~ ezra.coco~~ ori o ~

o 6-MF sign Basis Or

References:

0 phut'~

~ ~ .~ ~~Mc 2..

mrcr ocrcyon~ rcpfrccc

~ 7Ylrnocgcocrc ta, c. coorto 'P~~

u~&

5 R&~t ~ccccrc>~i~en ~~ +~+ -o$ ta,C. dcrofoy] 4,(trof No. Date Change Gale. By Checked By Date Approved By Date Superseded By Calculation No. Dated Reason:

'yt507180137 gf50707 PDR ADOCK 05000315 9 PDR Page Of

7223(9.83)

ENGINEERING DEPT.

OAT SHEET 2 C

OF~

K~52 AMERICAN ELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COMPANY G.O.

COLUMSUS, OHIO C

gU B J pCg Qualitative Functional Diversi Assessment Table of Contents Page .Ho.

A, Statement. of Purpose, and Executive Summary 3.....,...

B. Assumptions, . 3 C .. Analysis... f ...3 .

.D. Verification . 3 E. Results, ... 3..

F. Discussion of Results

. G.. References..., . I 3 H. Table. 1. 5.. ~4 p \

Appendix A ....1-48.

Appendix B. ... 1-5..

~ v ~

'I ~

F

7223(9 S9)

FQR< oE4(cI ENQINQQRING DEPT.

SHEET + OF OAT B GK AMERICAN ELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COMPANY G.G.

COLUMBUS, OHIO UA VE FUNCT ONA D S SSM SU8JECT.

A. State e t o Pu ose a d Execut ve Summa See page 4/5 B.

See Appendix A C. ~Aaa sis

~litative Evaluation given in Appendices A and B D.

The evaluation was done based on U2 FSAR. The reviewer checked Unit 1 FSAR for consistency. @CAP 11902 and its supplement, RTP License Report, @CAP 12135, RTP Engineering Report, QCAP's '12078 and 12901.

Input and Output Data, and Unit 2 cycle 8 RTSR were also used as a basis for reviewing the evaluations. Plant annunciator response procedures were used to review possible and px'obable alarms.

Discussions with HED personnel especially Z&C personnel resolved various issues such as which alarms were independent of the new it digital equipment. %here the reviewer felt was appx'opriate or necessary, changes to the evaluation were proposed and resolved with the evaluator.

esu ts See Appendix A F. D scuss on o e u ts See Appendix A G. e erences See Appendix A 3/5

722%9.d3l ENGINEERING DEP T. SHEET OF AMERICAN ELECTRIC POWER SERVICE CORP. S cx 1 RIVERSIDE PLAZA COMPANY G.O.

COLUMBUS, OHIO .'LAN

$ ug Jp(,y Qualitative Functional Diversity Assessment ST T OF PURPO E AND EXECUTIVE SUMMAR On April 21, 1992, AEPSC representatives had a meeting with the NRC on the replacement of existing analog reactor protection process instrumentation with digital Foxboro Spec 200/Spec 200 Micro Eleceronics instrumentation. During this meeting, AEPSC was asked to assume a common mode failure (CMF) of the software of the new digital equipment during an accidene and then provide details as to whether operaeors could mitigate the consequences of the accident.

In response to this request, a functional diversity assessment of each updated FSAR (UFSAR) event assuming a common mode failure of the software has been performed. In this assessment, all the events for both Units 1 and 2 of the Cook Nuclear Plane given in ehe UFSAR were considered. A review was performed to divide events into potentially affected and not affected. Table-1 lists these events and indicates whether they would be poeeneially affected or noe affected, if a CMF were to occur. The potentially affected transients were then individually evaluated qualitatively in light of the FSAR analysis as shown in the ateached Appendix A. The transienes which are noe affected by the software failure are discussed in Appendix B. ~

The first column of the evaluations in the Appendix A contain th'e UFSAR transient number listed in Table-1. The second column includes the name of the transient.

The third column depices the trip/safeguard &mction for reactor trip. This information was obtained from the UFSAR. The fourth column includes the information on the impact of common mode failure on the reactor trip function.

If ehe trip function is processed outside of the new digital reaceor protection

~ys~em, then the trip is available, e.g., trip on nuclear instrumentation system high flux. If ehe trip is processed by a function that is a part of the new digital equipmene, then the trip/ESF function is assumed to be lose. However, for some functions, alternate indicaeions and/or diverse alarms are available.

The alarm/alternate indications ehae are available to ehe operator to mieigate the transient are given in the next column. The sixth column lists the pertinene diagram numbers. The seventh column summarizes the consequences of the unavailability of diverse alazm. The last column provides the evaluation of the event. In this column, we have discussed ehe consequences of the operator's response on reactor safety.

Based on this evaluation, we have concluded that the CMF of the new digit 1 equipment has no sxgnxfxcant adverse impact on the public safeey. Some reactor trips are noe affected by the installation of the new digital equipment-these trips aze neutron high flux and high race trips, undervoltage and underfrequency trips and reaceor trip on turbine tzip. However, for events protected by trips and aceuaeions affeceed by CMF, should a CMF occur, the operator will be alerted to the evene by an alarm from a diverse system. He vill then provide the appropriaee aceuaeions manually and enter the emergency operating procedures. For some accidents, such as locked rotor, the consequences could be more severe than curzenely analyzed due eo the longer response eime for the required actuation. However, our evaluation indicates that the affected unit can be brought to a safe condition and ehe current LOCA offsiee dose evaluation will remain bounding. From these results, ie is believed that a CMF of the new digieal system would have no adverse effect on the health and safety of the public.

-4/5

1's

?22~(9.6>I ENGINEERING OEPT- SHEET AMERICAN ELECTRIC POWER SERVICE CORP. DAT 1 RIVERSIDE PLAZA COMPANY G.G.

COLUMBUS, OHIO SUBJECT ualitative Functional Diversit Assessment UFSAR ~ab 1 e- POTENTIALLY TRANSIENT 4 TRANSIENT AFFECTED (A)/

NOT AFFECTED (NA) 14 ~ l. 1 nconcxolled RCCA Withdraval from a Subcxitical Condition A 14.1. 2 ncontrolled RCCA Withdrawal at Power A 14.1.3 od Cluster Contxol Assembly Misalignment A 14.1.4 CCA Drop A 14e1.5 Chemical Volume and Control System Malfhnction A 14.1.6 ss of Reactor Coolant Flov A 14.1.7 Staxtup of an Inactive Reactor Coolant Loop A 14.1.8 Loss of Extexnal Electrical Load A 14.1.9 ss of Normal Feedvater Flov A 14.1. 10 Excessive Heat Removal due to Feedwater:Sys'tern Malfunction A 14.1.11 . Excessive Load Increase Incident A 14.1.12 ss of All A.C. Power to the Plant Auxiliaries A 14.1.13 uzbine-Generator Safety Analysis A 14.2.1 Fuel Handling Accident A 14.2.2 ccidental Release of Radioactive Liquids A 14.2.3 ccidental Waste Gases Release A 14.2.4 Steam Generator Tube Rupture A 14.2.5 upcuxe of a Steam Pipe A 14.2.6 uptux'e of a Contxol Rod Drive MeBMI~ Housing (RCCA A Ej ection) 14.2.7 Secondary System Accidencs Dose Consequences A 14.2.8 ]ox Rupture of a Main Feedvacer Pipe A 14.3. 1 Large Break LOCA Analysis A 14 '.2 ss of Reactor Coolant from Small Ruptured Pipes or from A Cracks in Large Pipes which Actuates the Emergency Core Cooling System 14.3.3 Core and Internals Integrity Analysis NA 14.3.4 Containmenc Integxicy Analysis A 14.3.5 Environmental Consequences of a Loss of Coolant Accident A 14.3.6 ydrogen in the Containment After a Loss of Coolant A ccidenc 14.3.7 Long Term Cooling NA 14.3.8 itxogen Blanketing NA 14.4.2 Postulated Pipe Failure Analysis Outside Containment NA 14.4.3 nalysis of Emergency Conditions NA 14.4.4 S tress Calculations NA 14.4.5 D escription of Pipe Whip Analysis NA 14.4.6 C ompartment Pressures and Temperatures NA 14.4.7 D escxiption of Jet Impingement Load Analysis NA 14.4.8 C ontainment Integrity NA 14.4e9 P lant Modifications NA 14.4.10 E nvironment NA 14.4.11 E lee tr ical Equipment Environmental Qualification A

APPENDlX A

~ UNII I and fsAR IRANS I I EN IRIP/SAfECUARD fUNCTION fOR IHPACT OF CO&0K NODE ALARN/ALIERNAIE INDICATION DIACRAN S coxsfouENcEs 0F EVALUATION Of EVENT TRANSIENT N RX TRIP (FEAR LN ~ L.i) fAILURE LCNf) CN 'TRIP STSTEN AVAILASLF UNAVALLASLLLTTOF FUNCTION DIVERSE ALARN Lt. L.l Uncontrolled RCCA Sank 1. Source range neutron flux Iten Nos. I.S not affcctcd Not Affected This transient Is not sffcotcd by the Ml thdroual tron ~ trip-ectwtcd shen either of LNcno dated Sept 2, 1992 rcploccncnt of N. line analog process protect lcn Subcrltlcal Condition 2 Independent source range tress V. G. Sotos to V. D. systcn by Foxboro SPEC 200 Ind SPEC 200 NICRO, chNNtts IAdlcatcs ~ flUx Vandcrgurg, 1/S Tabl ~ 3.3- ~ Icroproccss based sgdutcs. Trips I through S,

~ bove 4 prcsclcctcd, 44NJILLy I) Listed ln Colum 3, are not affected, since adjustable value. rwetcar Instnnentatlon for flux scasurcocnt ls

2. Intcrncdlete range no! replaced. for Rx trip frcot prcssurltcr high neutron flux trfp actwtcd prcssure, tuo diverse ~ Lares are available. In Uhcn ~ lthcr of tuo acklltfcn, pressurizer high prcssure trip Is a I dependent Lntcrocdlate backup trip.

r4Agc channels indicates I flux above a prcselcctcd, auxuLLy ad)ustable value.

3. Poucr range high neutron tlux trip llou setting)"

~ ctuatcd eben tuo oUt 0'f C poker ch4NNLI IAdlcatc ~

flUx 4bove Ipproxioatcty 25X of fulL poucr tlux.

S. Pouer range nCutron tlux level trip thigh setting)-

actuated uhcn 2 out ot S pacer range chancls Indicate

~ tlux LcvcL 4bova ~ preset sctpolnt.

5. In addition, Rx trip froa LOST Ad ~ cn AY bl FD.2101 None. Tuo Diverse PER high prcssure serves Is I LNcco dated Rcpt. 2, 1992 Panel Indication Sheet I/6 ALares are available.

hookup to tcnelnato the tron V..G. Sotos to V. 0. Panel Recorder Incident before an Vandcrsurg) Plant Process Cooputcr ovcrprcssUro ccndltloA could IAdlcatloA occur Y b Prcssur tcr Nigh Prcssure Dcvlatlon vl ~ Control Systca. four high prcssUre ~ Laros YI4~

ccntrol systca.

0 A ~ Ad cn Aud ble ndicat on of rod

~ et ion.

1

UNII I F SAR TRANSIENT TRIP/SAFECUARD FUNCTION fOR IHPACI Of COHHON HCOE ALARH/ALTERNATE INDICATION DIACRAH S co<<sEQUENcfs of EVALUATION Of EVENt TCA<<SIENI 4 RX 1RIP (TSAR ) l( ~ I, g,) FAILINIE (CNf) ON TRIP FUNCTICH STSTEN AVAILABLE UNAVAILABILIITOf DIVERSE ALARH 1(.1.2 Uncontrolled SCCA Sank 1. Kualcar Pa<<cr range Not Affected NIS paver range ovcrpo<<er Nuclear The Rx trip an MIS overpwcr setpolnt lc nat Vlthdra<<al et Pa<<cr Instrlsacntstlon aatwtcs ~ rod step at 103X ~ tar>>. II>>truacntat lan cystca ~ f fcatcd by the rcptaacsent of M.line analog reactor trip on high neutron not changed. process protection systea, since flux if tlux 2/C channels exceed ecasureacnt Instruacntatlon ls not replaced.

on overt<<war sctpolnt. 2. 1he 0141 Rx trlP ls lost by N-line

2. Rx trip cn any t<<o out of Ota'f Rx Trip Lost Vt* range teapcrature fD 2102 rcptaaeaant. Thc Otal trip cnsurcs that DNS four it ahalv>>ts exceed OIC'1 (Ncaa dated 9/2/92 tres V. recorders. Sheet 3/C does not occur. Ihe FSAR analysts of this event that Rx trip on high prcssurlzcr <<ster sctpolnt. This catpolnt ls 0 Sotos to V D. ~ ssuaas autaeattaatty varied <<lth Vandcrgurg) level ls assusad available. This trip actuates

~ xl ~ L txwcr distribution earlier than ~ Ither the OTC'I or high neutron coolant average tccpcrature flux trip fu>>tlans to deaanstratc this

~ rd pr ~ scute to protect protection during the sto<<cr prcssurlzcr filling against DNS. scenarios (FSAR, page TC.T.2A.C). 1hc high

3. Rx trip on t<<o out of CPUT Rx trip Lost FD pressurizer <<ster Level trip hss t<<o diverse (Ncaa dated 9/2/92 fres V. high level atars>>, therefore operator <<ould get 2102'heet four at channels cxaccd OPal 3/C satpotnt. This sctpolnt Is 0. Sotos to V. D. Vide range tccperature indlaattons prior to Otit Rx trip for auteaat laal ly varied <<1 th Vacdcrgurg) recorders. prcssurlzer fllL events. Those scenario'c that coolant average teapcrature do nat tcrsdnate on high NIS Ifux or high so that the allo<<abt ~ fueL prcssurlzcr <<ster are tcratnatcd by Otal. Ihcy parer rating Is not cxcccdcd. terd to be Lo<<er reactivity lnsertfon sacnarlos C. A high prcssure reactor Lost nd 4 Av ab FD.2102 five diverse alarc>> or Lcwer pa<<cr scenarios. Although narc tine fs trip, actuated fres any t<<a (Ncaa dated 9/2/92 fres V. Panel Irdlcat on Sheet I/d available available for response to these events, It out of four prcssure 0. Rotc>> to V. D. Panel recorder cannot be stated <<lth certainty that fuel clad channels ls sct at 4 fixed Vandcrgurg) Plant Process aaaputcr daoage <<tll nat occur. Vcsttnghouse has point. lndtaat ton reported fn VCAP.B330 that Ntntaus ONBR can bc v A ~ Ava jb achieved for ~ rod <<tthdra<<al at pa<<sr ATVAS Prcssurltcr Nigh Prcssure atthough the parttaular case evaluated <<as a Dcv!ation via con'tI'oL rapid rcaattvlty Inscrtlon case <<htah <<outd have systea tripped on MIS high flux. Clad daaage Is an Four Nigh prcssure ~ Lars>> acceptable autaaee baause thc CHF lc a sad ttpte via control systea failure condition. Na<<ever, as discussed betou, rod <<lthdra<<at of @acr events are significantly S.

• high pressurizer wter Lost ~ Ava ab FD 2101 1<<o diverse ~ lars>> nltlgatcd by the fulL pwcr base load operation level, aatwtcd frets any 2/C (Nceo dated 9/2/92 fra4 V. Panel lnd c4t on Sheet 2/d ~ vallabl ~ . Rx trip on of the Cook Units.

ahalv>>ts ~ Is sct at 4 fixed O. Sotos to V. D. Panel rccordcr high'prcssurtzcr <<ster point. Vandcrgurg) aacputcr IIdlaatlon lcvcl actuates ~al cr 3. The rcptaaeacnt of N.Line analog protection v 4 Avs ab ~h either the O~i systea causes ~ loss of OPiT Rx trip. thlc Prcssur zcr N gh Level or high neutron flux could result In fuel rod cladding failure.

Deviation via control trtp Auctions to Ha<<ever, the posslblLlttcs of thts to occur ls systea deaanstrate this stl4. First of aLL, this cvcnt wuld be Nigh level via control protect ton during tcralnated as soan as po<<er Is ~ 109X Rated systea prcssurtzcr filling Thereat Pa<<cr (Trtp Sctpolnt) by the NIS. This 0th a 4 ndtaa ans scenarios (fSAR, page Is at<<ays the llntttng trip for atntsus Audlbte ndi cat Ion of rod 1C.'I:2A C) fccdbaak, rapid rcaatlvlty lnsertton evcntc.

nation for a>>xtcus fcccbaak, rapid reactivity tnscrtlan events, the prcssure celtrot systea ts not expected to keep up thcrcby also producing ~

high pressure deviation clare. Ihe stat reactivity Insertion events are expected to thc prcssurtzcr end pl'odua4 4 Lcvcl elena Ihc fill escalation of pwcr Inarcascs Tavg, and Vide Range RCS Teaperature Recorder Indications are 2

UNI'I I 2 f SAR IRANSIEHI 'IRIP/SAFECUARO fUNCIION FOR IHPACT OF CtseQN HCOE ALARH/ALTERNATE ILOICATION OIAGRAH 4 CONSEOUENCES OF TRANSIENT 0 RX TRIP (/SAR I I.lr'f) fAILURE ICHf) ON TRIP STSTEH AVAILARLE UMAVAILASILI IT OF EVALUATION OF EVENI FQICTICH DIVERSE'LARH IA.I.2 I cont'd) avallabl ~ to the pocrator IHeso dated p/2/p2 froa U.O. Sotos to V.O. Vandcrsurg),

prcssurlzcr Rx trip and hfoh prcssurlzcr wtcr Level Rx trip have Olvcrse Atares avallablc.

A. the Cook Units are base loaded so that they operate prlaarlly at IOOX RTP <<Ith rods csscntlatly cosptetcty ulthdram. The Lover pouer cases csscntl ~ Ily address condltlona uhlch are transitory. Ourin9 transltlon opcratlon, operators ulll give close attention to IndlcatlonP as they nanlpulate the narhlne.

Nate that poucrs VOX are used occaslonatty to stretch a cycle. for these reasons this ls a Iou probablllty event.

.3.

UNIT 1 a 2 t(.l. ~

I SAR 'IRANS I EN I TRIP/SAFECUARD FUNCTION fOR IHPACI Of CCHNOM HCOE ALARH/ALIERMATE INDICATIOM DIACRAN g CONSEOUENCES OF EVALUATION OF EVENT fRANSIENT 4 RX TRIP (fSAR It(.I.3 FAILURE (CNF) ON TRIP STSIBI AVAILARLE UNAVAI LAD I LITT Of I tf FUNCTION DIVERSE'LARM IC. 1.3 Rod Cluster Control Mo reactor trip on RCCA for RCCA elsallgfvaent event (fSAR IC.I 3), there Asscebly (RCCA) a(sal(gtvcent (FSAR 1C.1.3) ls no reactor trip. The analysis for RCCA drop NlcaL lgnacnt (IC.1.3) rod(s) cvcnt docs not take credit for any direct reactor trip due to dropped rods (Uchp-)139(,

1C.I.C RCCA Assccbly Drop for RCCA drop rod(s) event, page t-2). Thus, the rcplaceeent of cxlstlng M-(TC.I.C) the analysis docs not take Llne analog process protection systen ullL not credit for any direct reactor ~ ffcct the fSAR results of these tuo events.

trip due to dropped rods (UCAP-TI39C, page I 2) lhe fat tcuing dctectlon signals/slams are

~ vallsble For the operator to respond to these transients (FSAR, Unit 2 pages 1C.1.3-1 and 1C.1.'3.2) t (I) Sudden drop ln core paver level as seen by the NIS (II) Asyrnctric pouer distribution as scen on out-of-core neutron detectors or core exit thernocouple, (III) Rod deviation ~ terat (Scf'point-Individual ral position dcvlatlon + 12 steps fraa deaand canter, Procedure 2-ONP CORC.210 Drop 29),

(Iv) Rod position Indication.

In addition, for rod dropped event or dropped bank, thc fully Inscrtcd assccblles are Indicated by a rod at bottaa signai, uhich

~ ctwtcs a control roaa anntnciator (sctpolnt 20 steps froa the bet taa, Procedure R.ONP CORC.210, Drop 22).

VNI'f I 1 2 fSAR TRANS IENI IRIP/SAF EGUARD fVNCIION fOR IHPACI Of C(secGN HOOE ALARH/ALTERNATE INDICATION DIAGRAN 4 CONSEQUENCES Of EVALUATION OF EVENT TRANSIEN'I g Rx TRIP(fsAR ici,l 5)

~ fAILURE (CHF) ON TRIP STSIEH AVAILASLE UNAVAILASILIITOf fVNCT ION DIVERSE'LARH IC<'I.S Uncontroclcd Saran 1) llfth reactor ln aats<at OT<<1 reactor trip tost fg.2102 Ihe fSAR scctlcn IC.I.S has cxsafncd three Ollu cion control snd no operator (acco dated 9/2/92 fras M Sheet 3/C phases of boron dilution accident, I. ~ . boron

~ ctlon taken to tcralnate the g. Sotos to V. D. dilution during (I) refueling, (II) startlp, snd transient, the FNwer ard Vandergwg) (ill) pouer operation. for dllutlon during

'cccpcra'cure >>ill cause the refueling, thcrc arc aors than 33 afr<<tcs reactor to reach the available for operator action troa the tlae of overccsperature <<I (oc<<T) Initiation of the event to loss of shucdwn trip sctpolnt resulting In ~ asrgln (SX <<k/k) (fSAR, page 1(.1.5.$ ). For reactor trip (fSAR, Page refueling cade< the cost Likely source of 1(.1.$ 5) h ~ <as I<dtca dilution, CVCS, ls tagged out. for other aodcs NIS pwcr range ovcrpo>>cr thlc source ls not tagged out. for dilution rod stop at 103X during startlp there are acre than 3S alnutcs Pr(sary>>ster f to>> available for the operator action frc<a the tlae deviation ~ lara ot Initiation of thc event to loss ot shucdoun Roric and flew deviation aargln (1.3X ik/k) (fSAR, page IC.I.S.S) for clara>>lth rods in Unit 2 <<d ES ala>>tea tor Unit 1. Startup ls a cute>>ac lac transient operation. Opcratofs >>lll give close Rod bank D Lcw ~ lara attention to Irdlcatlons as they aanlpulate the Rod bank D Iou-Lou alara aach\ne.

Amllbl~ indication of rod aoclon Dilution accident at peer Includes the reactor In autoaatic control ol; aac<<a( control. tilth the reactor in cute>>etio control, thc po>>er and tccperature Increase froa che boron dilution results ln Insertion of the controL rods <<d a decrease In the available shutdo<n aargln.

1hcre are acre than CS air+tea froa thc tlae of

~ Lara (Lou Iou red Insertion (lait) to Loss of shutdo<<n aargln (1.3X <<k/k) (fSAR, page 1(.1.5

5) for Unit 2 and Cg af<v<tcs for Vnlt 1. the Cook Units are operated >>lth rods in autasatlc untess there ls ~ cocpettlng reason to operate In aanual.

illth reactor In a<<smL control and no operator

~ ctlcn taken to tcralnatc the transient, the pwer and tcapcraturc >>ould cause che reactor co reach DT<<T trip sctpolnc. This trip >>ill be lost as ~ result of co<<>>n aoda failure ot the neu Foxboro digital systca. The boron dilution tr<<>>lent In this case ic essentially equivalent to an cs>>ontroL(cd RCCA>>ithdrauaL at poucr (fSAR, page 1(.l.S-I). There Is no control rosa clara frca the a'1 aystca for th'is event.

No>>ever, the increasing pwer and>>lde range tcoperature Indications>>auld indicate conSIclons to the operator. This event ls s sto>> rcactlvicy addition event ~ ~ Ipca/sec<

.5.

UNII I a 2 I SAR IRANSIENI )RIP/SAFECUARD FUNCI ION fOR IHPACI Of COHHON HCOE ALARH/AL'IERNAIE ILDICAIION OIACRAH g CONSEOUENCES Of EVALUAII ON OF EVENF IRANSIINI 4 RX IRIP (fSAR It(.t. r) fAILURE (CHf) ON IRIP SVSIEH AVAILASLE UNAVAILASILIIYOF IUNCI I ON 0 I VERSE ALARH lt 1.5 Fol loving the discuss lon on tneontrot lcd RCCA (con'I) bank ulthdraval at power, the high prcssurlzcr uatcr level ~ Lara ls assumed ave(labia, tblch has tuo diverse ~ Lanes (meso dated 9/2/92 from M. o. sotos to V. O. Vandergurg). )his ls a stou trans(cnt, and ulth the prcssurhcr level, Nlde range tcoperaturc Indlsat lens, and other Indlcatlons, the operator should be able to trip thc reactor.

0 ll

UNIT 'I a 2 I SAR TRANS IEN'I TRIP/SASECUARO (UNCTION fOR IHPACI Of COHHON HOOf ALARH/ALTERNATE INDICATION DIACRAN g CDNSECUEMCES Of EVALUATION Of EVENT TRANSIENt N RX TRIP (fSAR (II I g I) IAILURE (CHf) ON IRII' STSTEH AVAILASLE UXAVAILASILIITOf DIVERSE ALARH UNCTION I(.).6. I Loss of forced Reactor 1. Rx trip on reactor Not Affected Reactor Coolant Pulp Ihc Rx trip an reactor coolant pulp pa<<cr slpply Coolant fla<< coolant pap pwer slppiy underfrecpcnay and undcrvoltage and under frequency rcaa inc tedcrvoltage or IJndcrvaltagt alafsl lalallcatcd by a aaaoon Node failure (cxf) of the under Irccpcnay (Procedure I, 2-oxp, (02(, ne<<digital Instrloentat ion.

107, 207) The reactor trip on Loss of f(a<< ln ~ coolant loop ls lost on CHf for tach loop. These are no Diverse Alarms avallablcl ha<<ever, panel

2. Rx trip on La<<reactor Lo<< flo<<Rx trip Lost (for I 4 Ion Avs Iab ID 2101 If the Rx is at po<<cr Indite'tlon and cocputcr Indlca'tlon art 4vallablc coolant loop f1o<<. ~ LL four loops) Panel Ind(cat Ion Sheet 3 4t thc tine of tht for the La<< coolant loop flow.

cooputcr ind I cat Ion and ( ~ aaldcnt, the vcr Alara Aval cbt imacdiatc effect of ~ T<<o cases of loss of flo<<are discussed ln fSAR loss of coolant fia<< (I( 1.6). Ihe slcultsncous loss of peer to all la ~ rapid Increase tn C RCPs can occur due to either undcrfrcqucnoy or the coolant undervoltage, <<hlch Is not lcpaatcd by CHF. 'Ibis a~h tcopcr4'turc <<blah Is situation Is highly mllkely, sino>> each Ixap Is Press<<riser prcssure panel ~ ugnl fled by ~ carncctcd to a separate bus, <<blah ls stpp(lcd Indication positive HTC. Ibis by anc of t<<o transfonacrs.

Prcssurlzcr prcssure Increase could rcsutt rcaordcr ln DNS <<lth subsequent the consequences of the loss of f lou Inaiufe an Prcssurltcr pressure advcrsc cffccts to the Increase In Tavg, pressurlter pressure, and cocpulcr Indication fueL, if the Rx ls not prcssurlter <<ster lcvcl. Vide range RCS Prcssurlter level panel tripped procptly. tcapcrature recorders (neco dated 9/2/92 froa U.

Indication ((SAR, page I(.).6-1) C. Sotos to V. D. Vandergurg) are available to Press<<riser levcL recorder the operator to indicate an Increase In Tavg.

Prcssurlter Level coeputcr Thcrc Is no Rx trip on high Iavg. Thc Indication prcssurlter prcssure <<ill contltwe to rise untlL tilde range tccpcrature thc operator gets 4 high pressure deviation records slane et 2325 pais (2.ONP (02(.200 Drop 7) for Unit 2 and 2175 psla for Unit 1. the Rx trip on Qhhr ~c high presswe (cctpolnt <<2(00 pale) ls Lost due Prcsswi ter high prcssure to CHf. However, dlverst ~ Lares (octo dated deviation vl ~ control 9/2/92 fran M. C. Sotoa to V. D. Vandergwg) are ayctcQ available. It ls cvldent that the high prcssure four high pressure ~ Larsi deviation alarm <<ILL drau tha operator'a via controL systoa attention, and he <<ILL trip the Rx <<atua(Ly.

Prcssurltcr high level Thc operator <<IIL also be Likely to see the high deviation via cantrol level deviation ~ Lare at SX above prograa. Thc cyst<<a cansapcnocs of thlc Nanual Rx trip are Nigh level via control dl s cussed bc lou.

systua Acoustic Nanltor f lou Crude cxtrapolat iona of DNSR for theat tvcnta dctcatcd suggest that IONSR could be reached <<lthln .16 to wig seconds for loss of f Lo<< ln one loop.

Siai(ar extrapolations suggest that the high pressure deviation elena <<auld first be received W seconds into the transient ~ Lthough the operation of pressurltcr sprays <<ILL Increase this cstlaate. Allo<<tng operation response It

~ scaands for is clear that DNS could

.7.

0 UNIT I 2 I SAR TRANSIENT TRIP/SAFEGUARD FUNCTION FOR IHPACT Of COHHON HCOE ALARH/ALTERNATE INOICAllOI DIAGRAN g CONSEQUENCES OF EVALUATIOIOf EVENT IRANSIENT 8 RX TRIP(FEAR fAILURE (CHf) ON TRIP STSIEN AVAILARLE UNAVAILASILITTOF fUNCTION DIVERSE ALARH It.t.6.1 occur resulting In clat danagc. Since ~ nasstve (cont'd) ~ ultlple failure la accused for this event, thfs lc belicvcd to be acceptable. lllth ~ loss of flow tn one loop total core flow should rcnaln rooovlng the bulk of thc heat fran th<<

core, Ltatttng the deterioration of the core prior to cenual reactor trip. The portion of the core that cxpcrtcnccs ONS ls expected to heat up tntlt the Doppler coctflcfcnt shuts It down. Fuel Is not expected to sett but ctad burst and oxtdatlon are anticipated. Lt should also be noted that this event was analyzed with a positive aedcratlon coefftctcnt (NIC) of eS paa/'F. Ihls value ls nore Llatttng than the Tcchnlcat Spcctflcatton Licit at 100X RTP. It fs conservative and provides sMtantlat chargtn throughout nest of the Life. cthts causes power to Increase as the coolant tccperature Increases. A nore rcallstlc asstnpttcn for beginning of cycle Ic -(pcn/of. A negative NIC wlLL tend to shutdown the core es tccpcraturc increases ntttgattng the cvcnt. the HTC bcconcs sdstantt ~ Lty nore negative as hurray progresses. The Cook Units are base loaded and operate with control rods in the all out posltlcn at futt power. There(orc, the posslblltty that cutcnatlc rod control night ulthdrau rods wILL have no lcpact because rods arc essentially fully wlthdram. After reactor trip, the cecrgcncy operating procedures provide for nlttgatton activities to bring the cjachlne

'to e safe cordlttcn.

In the evaluation of the previous paragraph, an operator response tine of M seconds uas assuacd. Mtthout e reactor trip, prcssurltcr assure anf levcL are expected to conttrwc to ncrcase after the first atoms are resolved.

Shen prcssure reaches 2250 Dalai 'the PORVic will open rcsultlng ln an acousttc eonttor ftou detected stars. Extrapolating the analysis curves, which do not cxdct prcssurltcr spray, this could occur before IINSR ls reached.

Therefore, it ls Likely that an ecctnutatlon of eterne wilt occur before 60 seconds have elapsed. Therefore, the opcratorc response tice nay be less than 40 seconds for this event.

UNIT I 2 f SAR TRANSIENT TRIP/SAfEQJAAO fUNCfION fOR INPAct 0F CQONNI NCOE ALARH/ALTERNATE INOICATION D IACRAN N CONSEQUENCES OF EVALUATION OF EVENT,,

IRANSIENI I RX TRIP (ISAR )tt.f.g.t) FAILURE ICNF) ON TRIP fUNCTION STSTEN AVAILABLE UNAYAILABILITTOF DIVERSE ALARM IS.T.S. I The east Ilkcly cause of en event of this t)pc, Icont'd) ls a failure of the reactor coolant Ianp IRCp) or Its actor. Thc operator ls provided ulth ~

slsnlf leant rasher of eterne to give hfn inforoatlon resardlnS thc RCP's and enters.

These ~ Taros Include RCP actor dlffcrcntlal trip, RCP actor overload trip, snd RCP aeter overheated. Therefore, It Is likely that the operator Nlll have Inforaatlon available shish Nlll at lou hie to antlclpatc <<d, therefore, substantially nltlgate the event.

UNII I 2 fSAR IRANS I EN I TRIP/SAFECUAZO fUNCIIQI fOR IHPACI Of CttetOH HCOE ALARH/ALTERNATE INOICAT ICtt 0IACRAH N CONSEOUENCES Of EVALUATION Of EVENT TRANSIENT 4 RX IRIP (/SAR LLI, Lo f e 2) FAILURE (CHF) CH TRIP STSIEH AVAILABLE UNAVAILABILIIIOF I UNCTION DIVERSE ALARH IL. I.6. 2 Locked Rotor/She ft Reactor trip on Lo<< flo<< Lo<< fto<<reactor trip Lost tdl eels Avcl ch f0.2101 Lf the Rx ls at pater Thc fSAR analysis foc 'this cvcnt assuscs an Brcak Accident signal (acao 9/2/92 acao frets V. Panel ndicat ion Sheet at thc tlae of !nstentcncous seizure of ~ reactor coolant putp C. Sotos to V. 0. Cocputcr Indication 3 and 6 ~ ccldcnt, the rotor. For this event, the reactor trips on lo<<

Vctdcrgwg) v A ra Avc CMc Ictscdiatc effect of ~ fle<<signal. 'the cotcson aode failure (CHF) of loss. of fto<< (seizure the ne<<digital Instcttscntat Ion <<outd result In of ~ RCP rotor) ls an ~ loss of lo<< flo<<gx trip signal.

~h~l~aens increase In the Pressurizer prcssure panel coolant tccperature. Ihc loss of fle<<<<ill Increase the coolant indi cat Ion This Increase could tccpcraturc atd an Increase In prcsswlzer Pressurizer prcssure result In ONB <<lth prcssure due to ~ reduction ln beat rcaovat.

recorder stftscqucnt adverse The <<lde range RCS tccpcraturc recorders (acco Pressurizer prcssure effects to fust, if dated 9/2/92 free V. O. Sotos to V. 0.

cocputcr Itdicatlon the Rx Ic not tripped paid arc available to thc operator. The Vatdergurg)

Pressurizer level panel procptly (FSAR, Page prcssurlzcr prcssure <<ill continue to rise, end (Cd(cation IL.I.6.1) tba operator <<ill gct ~ high prcssurlzcr Prcssur izcr Level recorder deviation ~ Iara at 2325 paid (Procedure 2-ONP Pressurizer level cocputcr (02(.200 Orop 7) for Unit 2 attd 2175 ps(a for ltdlcat I on Unit 1. The reactor trip on high prcssure Vide range tccperature (<<2(00 ) ls lost due to CHf. No<<ever, high records prcssure diverse ~ Iarsts arc available (accto gourd ol prcssurlzcr dated 9/2/92 froa V. O. Sotos to V. 0.

safety valves Vandergurg). Therefore, the high prcssure deviation clara <<ill dra<< thc operator's 9~he t~cc attention to trip the reactor ttatstaiiy.

Pressurl ter high prcssure dcvlatlon via control Ibis event ls very sztdt Like thc loss of forced systccl reactor coolant fle<< in cne tocp. No<<ever, lt four high prcssure alarsa ls core severe In that totaL core flat la vie controL systcta cc4Kcd store rapidly 'to ~ Lo<<cc value, the Pressurizer h(gh Level total core flou ls reduced to 7OX <<Ith(n ~ '2 deviation vie contcoi accords. As the coolant heats tp, a significant 4ystua Irncase In prcssure occurs. 'Ihe peak analyzed Nigh lcvcL vs control prcssure for both mits la M90 psla. Ibis 4ys tea peak occurred at 2 accords after the reactor Acoustic aonitor f Lou trip at 1 accord. Ibis prcssure Ic less than detected 110X of the design prcssure, I. ~ . 2750 psl ~ .

No<<ever, lf reactor trip ls delayed 40 sccotds, it carrtot be stated <<lth certainty that this prcssure <<outd not be exceeded. No<<ever, the

~ nalysls takes no credit for pressurizer spray or thc pressurizer PORVts. Lt ls also the case as <<lth the Loss of forced reactor coolant fle<<

that tha analysis <<44 pcrfoctacd <<lth 4 po4ltlva

~ todcrator tccperature coefficient (KIC) of c5 pca/'f. This value Is cora Ilaltlng than the

'Tcchnical Speclf Ication I\alt at IOOX RIP. Lt ls conservative and provides stftstsntfal aargln throughout tha core Life.

.10-

~~~ "~~Q0t mh ct ~ 'tr> .<~ < 4 ...:" >~-..... I~,.""~ m .,imp C~ .) ..."3 ~~ F. 't r ..a C

ONIT I 2 fSAR TRANSIENI TRIP/SAFEQJARO fuKCTICN fOR INPACT Of CISOQN INIOE ALARM/ALIERNATE IKOICATION 0 I AGRAN g CONSEQUENCES OF EVALUATION Of EVENI TRANSIENT N TRIP (CESAR FAILURE ICNF) OI TRIP RX

( tf ~ t ~ g a 2) STSIEN AVAILASLE LNAVAILASILI TT Of fOKCT ION 0IVERSE ALARN IS.I A.2 Thcrctore, as Tavg Is fncreascd, powr Increases (ccn't) In the analysis. As Indicated In the loss ot forced reactor coolant ftou, ~ sore rcatistlc beginning of cycle NTC, uould be

~ -Spec/~F. throughout core life the NTC uoutd decrease to thc 20pcn/'F. The fccchack freak the NTC uoutd therefore tend to shut the reactor doun rather than Increase paver tn an actwl event. Ihe Cook >nits arc base loaded and operate hand Kith control roCk In the atl out position at fulL poucr. the possibility that autocotic rod control night utthdrau rods uttt have no tcpact because roCk sre essentially fully utthdraw. These considerations toad us to conclude that It ls tntlkety that prcssurltcr pressure uoutd exceed 2730 psla and virtually tcposslble to exceed 3200 pstIF, the ARNE Roller Prcssure Vessel Code Level C crlterlcn, uhlch uas used for ANSAC design.

In the analysts, ONS ts expected to occur. In the event of a delay,.ot reactor trip by ~

seconds, this situation can only be exacerbated.

The operation of pressurltcr sprays and PORV's uhlch vere not sedated In the analysts uttt also result In an Increase In fucL rods ln DNS.

Nouever, It Is believed that the available ftou util prevent the core tron degrading to condition uhere It canrot be cooled after trip.

The portion of the core that cxpericnccs ONS ls expected to heat up tnttt the Oopplcr coefficient shuts tt doun. Fwl ls not expected to nett but clad burst and oxidation are anticipated. Qbstantta\ core daoage Is

~ cccptabte for thts cvcnt Khtch ls an ANS condltton IV cvcnt Kith suasive aulttpte failures.

In the evaluation ot the prcvlous tuo paragraphs, an operator response tine of ceconds uas aksuaed.

~

Nowvcr, this cvcnt ls expected to be very dracetlc Several prcksurltcr atarkxt can be expected Nlthln seconds of the start of the event Including the acoustic cxnltor f lou detected slane. 'the prcskurttcr cafcty valves can be <<xpectcd to Lift uhtch creates an tcprcsslve sound in the control rook. Therefore, the operators response nay bs less than 40 seconds for this cvcnt.

J'

~

~ ~ P 4 lt 4,

"tg q 'I A

~ ~ ~ ~ I \ I 0~ ~ ~

~ ~

I I ~

~ I

~ ~

UNIT 'I 2 ISAR TRANSIENT IR IP/SAF E GUARD FUNCTION FOR INPACT Of COHHON HCOE ALARM/ALTERNATE INOICATICN DIAGRAM N CONSEOUENCES Of EVALUATION Of EVENT TRANSIENT ~ RX TRIP (<SAR I t(. I. 2 ) fAILURE (CNF) ON TRIP STSTEII AVAILASLE UNAVAILABILITTOf FUNCTION DIVERSE ALARN It.).7 Start>@ of an Inactive Unit 1 and Unit 2 operation In accordance ulth T/S 3/SA.T, operation during Reactor Coolant Loop during startup and pover start~ and poucr operation ulth less than four operation ulth less than four loops ls not pernlt ted. As such, this accident toops ls not pcrnlttcd (I/S uas not analyzed for the VANTACE-5 fuel 3/(.(.I) except for speal ~ I transition (Unit 2 FRAR, page I(.1.2-1) or for testing as provided for In the Unit 1 reduced tccpcrature and pressure I/S 3/(.10.5 for Unit 1 and prograa (Unit I UFSAR, Page 1(.1.7-3).

I/S 3.C.IO.S for Unit 2. Tbcrcfore, the cocnon node failure (CNF) of the License ccndl tiara for both ncu foxboro dlgltaL systns uould have no lcpact Units prohibit operation on this transient.

above P-7 ulth Less than four reactor coolant Fcnps ln operation. Noucvcr, thc Ufs*R contains analytic of this event for both Units.

This inforoat ion la provided for Inforoatlon and because It bounds the test condltlcns Inslcatcd above. !hase analyses result In reactor trips on nuclear Instruscntatfon hfgh f(ux.

'- 13

0 V

UNI) I 2 I SAR IRANSIENI TRIP/SAFECUARD FUNCTION fOR Inphcf of cotcoN ncoE ALARH/ALTERNATE I AOICATION OIAGRAH g CONSEOUENCES Of EVALUATION gf EVENT TRANSIENT N RX TRIP (FSAR fAILURE (CNF) Ol TRIP

)CI ) STSTEN AVAILABLE UNAVAILABILITYOF fUNCTION DIVERSE ALARN I( ~ 1.0 Loss of External Reactor trips on fotlouing ocs o oad Twb no T I Elcctrlc Load or signals x Thc cost I kcty source of a cocpt ~ ca Loss of Turbine Trip (full Vantage.S Core) load In NSSS Is a trip of the twblne-generator or ~ differential relay uhlch results In ~

1. Nigh prcssurlzcr prcsswe Nigh prcsswe Rx trip lost Ic Ava ab FD 2101 turbine trip. In Chic case, there ls ~ direct signal ~ Panel ndlcat Ion Sheet I/d reactor trip signal (crclcss power ls betou

~ Panel recorder ~ pproxleatcly 1'lX povcr, I.e., betou P.T) cocputac'Indlcacicn dcrlvcd frees the turbine eacrgency trip fluid v r A ares Ava'I ablt prcssure and turbine stop valws (FEAR, page

~ N gh Prcssure dcviaticn T(.T.SS- I). Ihercfore, the coccacn node falture vl ~ . control systcca (CNF) of the ncu digital systce has no Icpact on

~ Nigh prcssure via control the reactor trip.

systce (four ~ lares>

~ Pressurizer PCRV s of Load ulthou wbi I discharge tccp high Tuo Initiating scenarios sere considered for

~ Prcssurlzcr safety valve this events Cocptete loss of ~ lcctrlcal Load, discharge Cccp hl (3 ~ nd loss of condcnscr vaccxec.e

~ Lares)

- Pressurizer Cccp hi relic( tank I t o ec r ca oad

~ Pressurizer relief tank for this cvcnt the reactor trips on four trip pressure high or Lou fca>>tfcns. For high pressurizer prcssure trip

. Prcssurlzcr relief tank fcz>>cfcn, three alternate Irdlcatlons acd level high or lou several dlvtrst ~ Iares are available. for high

~ Acoustic eonltor (lou prcssurlzcr tater level trip, three alternate detected Irdfcatlons and tuo diverse clare available

2. Nigh prcssurlzcr uatcr for Iou-Lou stean generator uater lcwl trip, Nigh prcssur1 ter uatcr cd ~ Ave abl F0-2101 three alternate Indications acd onc diverse lcvcl lcvcL Rx trip lost ~ Panel ted(cation Sheet 2/0 ~ lana are available. These Irdlcttlons, stares,

~ Panel rccordcr ~ nd other tndlcatfons, especially thc scxsd of

-Cocputcr Indication safety valves should provfde Icdlcatfons to the a va ebt operator of abnonaal cltwtion and ht uouid trip the reactor eacxcaliy.

setpolnt vie controL sysCeo The (space of thc coccacn node failure (cNF) of

- Pressurizer level high the digital syscce uould result In ~ loss of froa controL systcca Ofat reactor trip fcc>>Clan. Tht Otit reactor

3. Ovcrtceperature at(OTit) trip ls tht only fcz>>tton for which the 04T Rx trip lost FD 2IOI ~ I ternate stares/lcdicatlcns are noC avallabl ~

signal Vide range Rcs cccpcracure Sheet S the loss of reactor trip uould cause the RCS recorders prcssure and tccperature to rise. This uould result in an tncrcase of pressurizer uacer Lcwl. Prcssurlxtr pressure, prcssurlzcr Level

~ nd ulde range tccperature Indications ara

~ vallabl ~ co the operator to trip the reactor (eseo dated 9/2/92 frees U. 0 Sotos to V, 0, Vandergurg). The high pressure deviation stare activafts at 232$ psia (proctdwe 2 DNP (02(.208

UHI'f I and I 2 fSAR IRANS I EN I TRIP/SAFEGUARD fUKCTION fOR IKPACT Of COtOKNI HCOE ALARK/ALTERNATE IKOICAIIOH OIACRAK g COKSECUEKCES Of EVALUATION OF EVENT~",

TRANSIENT g RX TRIP (fSAR I f I 8) fAILURE (CHf) OK TRIP fUxct IDN STSTEH AVAILASLE UHAVAILASILITTOf DIVERSE ALARH IL.I.O 4. Lou.fou stean gawrator Lo-Lo Hater lcveL reactor ~ Ava Drop y) for Unit 2 and 2175 for Unit 1. This (ccn't) uatcr level trtp lost ~ Puwt ndlcat on alcfn uouid drau operators attcn'Lion

~ Panel recorder Prcssurltcr sprays uoutd begin to open at 2260

~ cocputer indication pslg and uould be fulL open at 2310 pslg (FSAR,

~ va abl Table 4.1.2) for Unit 2 and fran 2110 pslg to

'LcvcL deviation v ~ 2160 for Unit 1. 1he PORV NIL I be full open at controL systoa 2355 palg, snd safety valves open at 2405 pslg (fSAR, Table 4.1-2).

th cct ons A area

~ Paver Range ovcrpoucr Assuslng thc availability of this control Rod Stop cquipacnt, thc pr feery prcssure should not

~ Sourd of stean generator cxce<<d 2750 pal a fn the ntnlsxaa reactivity and prcssurltcr safeties. fcehsck case. 1hc HTC for this case ic accused

~ Audible trd lection of to be c5pca/'F and the Doppler cocfftclent ls control rod action. ~ sauced to be ~.6pcn/X. Kore realistic

~ ss options for beginning of cycle and Nip are HTCa -(pcn/X and Doppler .Open/X . these values util Increase thc tccperature fecchsck relative to the analyslc tending to reduce poucr and consequent ly pr fnary prcssure.

In the aexlaxsa reactivity fcogwck, the reactor paver ard consequently prfaary prcssure ere reduced by thernal feedback. OHSR ta not threatened In the aaxtcxaa reactivity fatback case, Additional controL equi pncnt nay also operate to alt tgatc thlc cvcnt. The poucr atsawtch channel for rod control can be cxpectcd to operate on a loss of Load driving rods into the core. The tfcw ccnstant of first stage prcssure tc 40 scc.

Therefore, rods can be expected to insert tntit the operator Initiates protective actlcn. If Tavg fatlc constant on a cHF or falls high, rods Kill ccntfnue to insert after the paver nlsaatch signet has decayed. 'the stean &ay to cardcnser ucutd also Sperate Kith tavg constant or high provtdcd that condcnscr vacwa or offslte paver are not lost.

0 rV the loss of condcnscr vaaasa affects only the turbine and not the reactor protection systoa.

Therefore the turbine trip on ccndcnser vacua Kill result In ~ reactor trip since both rccwtn tawffccted by the cocoon axde fatlure of the ncu digital systce 15

'A P

UNLI I 2 F SAR TRANSIENT FUNCTION fOR IHPACf OF CCNNCN NCOE ALARN/ALTERNATE INDICATION DIAGRAN g CONSEQUENCES Of EVALUATIDN OF EVENT 1RANSIENI g RX TRIP FCCdv4ICI'RIP/SAFECUARD (F SAR L ti, I Q) FAllURE (CNF) ON TRIP fUNC'l ION STSTOI AVAILASlE UNAVAILASILLTTOF DIVERSE ALARN 1C.1.9 Loss of Normal 1. Reactor trip on Lou.tou (car lou level trip lost vcf 4 ~ Ava ab FD.2101 The ccxonon mode failure (CNF) of the ncu digital uatcr lcvcl In any stcam ~ stcam generator level Shcct 5 cqulpmcnt results In 4 Loss of reactor trips on generator deviation via ccntrol lou.tou uatcr level, and on Lou fccckatcr flou system signal (stcam flou/fccdtlou mismatch In AY4 ab 4 coincidence ulth lou uatcr Level). goth the

~ Panel nd cat on motor driven Ocaf turbine driven auxiliary

~ Panel recorder fc<<heater Systccaa are also lost except In

~ cocputcr Indication situation described betou.

The motor driven auxiliary fccduatcr temps are not affected by CNF If the Scope started on C kv

2. Reactor trip cn Lou Lou fc<<AIatcr f lou trip sane as above (for stcam bus loss of voltage or Loss of all main tccduatcr tlou signal In any lost generator lou.lou wtcr fceduatcr pcmps (1/S table 3.3.3, pago 3/C 3.

stcam generator (Ihlc signal level) 19). The turbine driven auxiliary fccduater ls 4ctually ~ stc<<4 f lou Fcmp ls also not sftccted by CNF If the pcmp ls fc<<heater mismatch In started on reactor coolant Fxafp bus cedcrvoltage coincidence ulth lou w ter (1/S Table 3.3-3, page 3/C 3-2g).

lcvcL) ln caae Of the CNF of ncu digital equipment,

3. Tuo secor driven auxiliary IOAFP star'ts (Outocotfc 4'tc4al gcncfatol'evel deviation ~ Lacaa and ANsAC fccduater Fcmps Ifclch are Initiation) on Lou-Lou ~ lena are avallabl ~ to the operator. In

~ tartcd cnt stean generator levcL Ond same as 4bova ~ ddltlon, three alternate Indlcatlcns aro ~ Lso

~ . Lou-Lou lcvcl In eny stcam safety in]ection from nnn- avail abl ~ .

gcncratol'. manual Initiation are Lost Trip of ~ Ll mafn fccchcatcr for the Loss of normal tc<<heater/ATUS transient, ATVS Nltlgatlng System Actuation Circuitry

c. Any safety In)ection (ANSAC) ls available (memo dated 10/13/92 frcca signal V. 0. Sotos to V. 0. Vandergurg). the ANSAC

b. C kv bus loss of voltage ~ utccaatfcaLLy lnftlatcs ~ turbine trip and

~ . Nanual actuation Initfatcs AFV f lou to maintain the RCS prcssure bclou 3200 pslg (ASNE Roller and Prcssure Vessel C tufb'lno dflvcn 4uxILIary TDAfP start (autcmatlc Code Level C criterion). At 100X RIP these fccduatcr pufp ls started ont Initiation) on Lou-Lou" fceotfona are initiated at 30 scc. of transtcnt

a. Lou-Iou Level In any tuo stcam generator level Is sama ca above signaL delay tlm4 ANSAC la OVallable 'to stcam generators lost perform this fcectlon In thc event the CNF ot

b. Reactor coolant fxmp bw the ncu digital equipment occurs. An JNSAC Ixvtcrvoitsge ~ Ivxecfator ls initiated after ANSAC ls actuated (Proccdwo 2.ONP C02C.212 Drcp TC). The tufbfne trip Is not affected by the CNF of the ncu digital cquipmcnt (memo dated 9/2/92 free V. 0.

Sotos to V. D. Vandcrgwg). Therefore, the h r A fata nd ~ reactor uould bo tripped Igxnn turbine trip.

~ Prcssurltcr high levcL deviation At aLL poucrs the stcam gcncratOr level

~ Prcssurlter level high deviation alarm, prcssurfzcr level high Level deviation and prcssurlxcr level high are

~ vallable to alert thc operator to 4 Loss of normaL fccduatcr event. In addltlcn, Ixaacrous

~ terms describing thc status ot the condensate and tccduatcr systems and pcmps, such es ccedcnscr hotuct I level, booster mater trip, IS ~

U<<lf I 2 fSAR TRANSIENT TRIP/SAfEQlARD FUNCTION fOR IHPACT OF CCHHCH HODE ALARH/AL'IERNATE INDICATIOH DIACRAH 0 Of TRANSIE<<1 ! RX 'TRIP (tSAR Lg.t.q) fAILURE ICHF) ON TRIP STSTEH AVAILABLE CONSEOUENCES UNAVAILABILIT'fOf EVAlUATIDH OF EVENt FUNCTION DIVERSE ALARH LL.I.9 aaln feed<<ster Fcnp, ctc. <<ILL actfvate. Relo<<

(con't) LOC rated theraal po<<cr, It Is expected that these alaras <<auld lead thc operator to trip the reactor a<<catty due to Lcu etcae Rcncretor lcvct In acfordance <<lth 2-ONP CD23.E-O.

Ue atso note that this event progresses rclatlvely stcuty so that the prcssurlzcr fills fn thc order of alrutcs not seconds. The cvcnt

~s dcscrlbed In the UFSAR ls analyzed ustng AFU flea based on f1 o<<rctentlon. The operator

<<ILL be able to open the flo<<rctcntlon valves to substantfalty Increase fccdvatcr fto<<. It is also not constdercd necessary to assuee an AFU putp fall<<re In eddtt Ion to CHF. Assuslno the

~ vallabllfty of ~ LL three Aflf fsaps also substsntf atty Increases thc flou of Afll. for all these reasons, <<e belfcve 'fhe outcoae of this cvcnt <<ilt not be stzatanttatty dlffercnt frca the analyzed result.

UNIT I 2 I SAR TRANSIENI TRIP/SAfECUARD IUNCTICN fOR IHPACI Of COHHON HCOE ALARH/AL'TERNAIE INDICATION DIACRAH S CCNSEOUENCES Of EVALUATION Of EVENI TRANSIENT g RX TRIP (fSAR Lc( ~ I Io) fAILURE (CHf) ON TRIP STSIDl AVAILASLE UNAVAILAS'ILI'I'IOf fUNCT ION DIVERSE ALARH L(.1.10.1 Excessive Scat Rcaoval I. Nigh ncutrcn flux trip Not sf fasted NIS pwcr range over povcr the reactor trip on NIS ovcrpcwer sctpolnt ls duc to fccduatcr rod stop ac 103X clara not affected by the coocaon aode failure (CHf) of Systca Halfcccotlons 2. Ovcrcccperature il (OI I)

~ ofil reactor trip Lost Mlde range tccpcraturc the ncu dig( eel cqulpacnt.

trip recorders Ihe OliT and opif reactor trips erc lost due to IC. I ~ 10.2 fccduater Systca Ovcrpoucr OT (OPil) Crlp opal reactor tr'lp lost Mlde range tccperacurc CNI of the ncu digital equi pacnt. No altcrnatc Hal f lect lens causing recorders afarca are available for these trip fcNotfons.

and Increase ln d. Sccaa generator uaccr Noucvcr, Hide range hot and cold leg ccepcreture fccdustcr flow Level high.high Lost ca cnc Avs labia Indications are available. Ihc cases of Iou

~ Pane( ndlostfon prcssure or high prcssure fccduatcr heater

~ Panel recorder bypass valve fully open'lng rcsu'lt ln transients

~Cocletcr Irldlcatlon ' very slallsr to those for cxccsslve Increase In secondary sccaa f lou. This transfcnt ls

~ Avel tab discussed In section 1(.1.11. The Unit 2

~ Level deviation via fccchcatcr events arc bounded by the cxccsslve controL cyst ca load increase. Ihe Unit I cvcnts are also expected Co be bounded. ~

for an Increase ln fceduaccr f lou In che absence ot CHf, che turbine uould trip on high-hfgh stcaa generator uatcr Lcvcl, uhlch weld tn turn trip thc reactor. In case of CHf, this trip Is lost (T/5 Table 3.3-3).

At cero pwcr, steaa generator lcvcl ls under aanusl control. Therefore, the operator uou(d be cxpcctcd to identify the event procptly and take corrcc)fve action. Sciou P 10, the NIS high flux sctpolnt ac 2SX RTP and the NIS fntcracdiate range trips are also available. Ac IOOX RTP, the sceaa gcncrator deviation clara (Procedure 2 ONP (02L.213 Drop 2) uould activate

~ t SX above progrscacd level of (CX. Three stcaa generator 1cwl indications erc available (acao dated 10/13/92 froa M. 0. Sotos to V. D.

Vandcrgurg). In addition, pwcr range cwcrpoucr rod atop clara (Procedure 2-ONP (02(.210 Drop

19) uoucd actuate at 10)X paver, uhfch uould occur ac about 20 scc. Into the crsnslcnt (lCAp-12901 ~ fig 10.dlA) Mlth the 5, 0, dcvlatlon clara and level Indications available, the operacor should be able to trip the turbine,

~ Reich tn turn uoufd trip the reactor.

figurc 10.1dA of ICAP-12901 shous Chat, the pwer stablt lees at spproxlaatcly IOSX noainal (trip sctpolntel09X). froa figure 10.29A of LCAP-12901, the steaa generator devlaclcn a(ala uould aotuace at about 0 scc. Into the transient.

Id

%. ~

Uxll I 11 t ISLA ItaxSIExt IRIP/SASICUARD IUNCIION ICR IHPACI Of CCHHCW HCOE ALARNlALIESNAIE IHOICAIION DIACRAN 4 coxSEOUExcf s of EVALUAIION Of EVENI IRAH$ IEHI I RX IRIP(SCAR )LI.) LO)

~

fAllURE CCHI} ON IRIP SfSIEN AVAILARLE UMAVAILASIL111 fUXCIIDI ALARN Of'IVERSE It.l.Io.t .Accusing the operator's respcnse tine to be 60 leant'd}L scc., the turb}no would trip at cpproxlactely 60 scc.'r the reactor trip tfoc ls approaloatcty 70 scc. flSurcs IC.1.10A-t and 14.1.10A 6 of t

the Unit UfSAR shou that the DkSR st this tice is approxfaatcty $ .6. flsures 1C.1.10-t crvf IC.1.10-C shou Dxtt at this tice to be .l.O.

lhasa values are well above the DNSR safety Llalts for both Units. Ihcrcfore, there would not be any fueL daoasc.

19

UNlf 'I a fSAR IRANSIENT IRIP/SAfEGUARD FUNCIIOH fOR IHPACT OF CO<<NOH HCOE ALARH/AL'TERNATE INDICATION DIAGRAN g CONSEQUENCES Of EVALUAIIOH OF EVENT IRANSIENI g Itt I RX TRIP (fSAR tt) FAILURE (CHF) ON TRIP IUNCTION SYSTEN AVAILASLE UNAVAILARILITTOf DIVERSE ALARH IL.I.I I Excessive load Increase Incident

l. Ovcrpo<<er it (OPit) trip OPit Rx Trip Lost Mide range RCS tccperature Iha cocoon code failure (CHF) of the nc<<digital

(<<ceo dated 10/13/92 fros cqulpscnt results ln ~ loss of OPiT trip, Otit M. 0. Sotos to V. recorder'ide trip and lo<<prcssurltcr prcssure trip. The Vandergurg) reactor trip on po<<cr range htgh neutron flux Is

2. Overtccperature it (Olit) range RCS tcepcreture not affected by thc CHF of the reactor process trip Otal Rx 1rlp Lost (<<ceo recorder equi psent.

dated 10/13/92 fran M. 6.

Sotos to V. Vandergurg) Ihe FSAR section IG.I.II has ccnsldcrcd four

3. Paar range high neutron NIS paver range ovcrpo<<er cases to anatyzc this cvcnt (I) Reactor control f tux Not Affcctcd rod stop In cjsnwt <<lth nlnissss soderator reactivity feedback; (II) Reactor control In nanuat <<lth L. Lo<<prcssur I acr prcssure ndl a cna Aval abl f0.2101 naxlssss aodcrator reactivity feedback, ttll) trip Los! (nano dated 10/13/92 ~ Panel Indication Sheet I Reactor ccntrot in wtocattc <<lth <<In!cess fr<<s M. 0. Sotos to V. ~

Panel recorder aoderator reactivity fcccback; and (Iv) Reactor Vandergurg) ~ Cocputcr Irdlcat ion control In autoeatic <<tth saxlssss aNderator e Ala Ava lab reactivity fccchsck.

~ Prcssurtscr Io<< prcssure deviation (turn on backup Tha reactor trip and/or engineered cafcguard hcatcrs) via control ~ ctuatlcn sfgnal <<as not generated for thts systcs event (fSAR, page IL.I.IIA.3). The FSAR h rve ndlca I ~ nalysis ass<<ass that nonaat operating Aud bl ~ ndicatlon of rod procedures <<outd be folio<<cd to to<<cr po<<er. In sation belo<<103X. thc event that this event occurs concurrently Prcssurtzer to<< level <<Ith ~ CNf of the ne<<digital reactor process deviation ~ tarn equipaent, the operator <<outd be expected to Press<<riser Io<< level bring the reactor to hot shutdo<<n consistent

~ tcrn <<lth T.S. 3.0.3 20-

1 w

~ ~ ' ~~ ' ~~ ~ ~ \ '

l ~ '

LNII I 2 f SAR TRANS IENf TRIP/SAfECUARO FLNCTIOI fOR INPACT OF COHHOI HCOE ALARH/ALTERNATE IIOICATION AVAILABLE'IACRAHg CONSfOUENCFS OF EVALUATION Of EvfNI TRANSIENI g RX 1RIP tfSAR ltl,te lg) FAILURE (CKF) ON 'fRIP STSIEH LNAVAILASILIIT OF fUNCTION 0 I VERSE ALARH TL.T.I2 earlier Lhsn nodcted due to loss of voltage and (ccn'tl RCP bus uodcrvoltsgc.

there are ~ Iso several alternate eterne available to the operator. Thc stean generator level deviation atarst ls available tor Iou-Iou stean generator uater level. Nigh pressurizer prcssure devi ation and high pressure ~ Taros arc also ave(labia.

Thercforc, there Is no adverse icyact of the CHF of the RPS on this event.

. 22 ~

UNII I 2 I SAR I RAN SIEHI IRIPISAFECUARO FUNCIIOH FOR IKPACE OF CCHHQH HOOE ALARIMALIERHAIEINOICAIICH OIACRAH S CCHSECUEMCES Of EVALUAIIOH Of EVEHI IRAHSIEHI S RX IRIP (F SAR ILI. I )3)

~ fAILURE CAlf) OH 1RIP STSIEH AVAILASLE LNAVAILABILIIVOf fUHCTIOH 0IVERSE ALARH IC.I. IS I whine. generator Ibis cvcnt ls related to ncchanleal failure of safety Analysis the cain turbine-Scnerators. 1here ls no reactor trip assoclatcd ulth this analysis. If there ucrc to be a fallur, one or nore turbine trips, uould be expected. A reactor trip, toaf fccted by CHF, uould result tree the turbine trip. Ihcre(ore, the cocoon code failure of the softuarc of the ncu digital systcct has no Ispact on this event.

UNIT I F SAR TRANSIENT IRIP/SAfECUARO fUNCIION fOR IHPACT OF CCNHOI NCOE ALARM/ALTERNATE INOICATION DIABRArl s CONSEQUENCES OF EVALUATION OF EVENT IRANSIENI N RX TRIP (fSAR )q.g.i) FAILURE ICNF) ON TRIP FUNCTION STSIEN AVAILABLE UNAVAILABILITT OF OIVERSE ALARH It.2. I RadloIOQIcal Boundlns fuel conditions are selected for the consciences of fuel ~ nalys la of ~ hypothetlcaL dropped fuel assesbly Rand l lny Acc I dent for both Unjt 1 and Unit 2. They are described In fSAR Sections Unit I, Tt.2.1 and Unit 2, IS.3.$ -3. These analyses also assuae that the

~ ccldent occurs IOO hours alter shutdoun. Since the accident occurs shen the reactor ls ~ lready tripped, the coseon node tallwe of the neu digital equipoent has no effect on this event.

UKII I 2 f SAR IRAKSIEKT IR I P/SAFEGUARD fUKC I ION FOR IHPACT Of CCHHON HOOE ALARH/AL'IERNAIE IKDICAT ION DIAGRAH d COKSEOUEKCES Of EVALUATION OF EVENI IRANSIENI 4 RX TRIP (fSAR ltl,+ D.) FAILURE (CHF) OK TRIP STSTEH AVAILASI.E UNAVAILABILITYOf IUNCT ION DIVERSE ALARH It.2.2 Postulated Rcdloaotlvc This event ls not affected by ~ reactor trip or Releases dkkc to safcswrds actwtlon. Thcrclore, ihe coamon Ll~ld.Containing Tanh skodc failure of the softuare ot the ncu dlDltal failures cqullsacnt KILL not la@act the results of this even't

- 2S k

~~

k

UNIT 'I and 2 f SAR TRANSIENT IRIP/SAfECUARO fUNCTION fOR IHPACT Of COHHQN HCOE ALARH/ALTERNATE INOICATICH OIAGRAH S CONSEOUENCES Of EVALUATION Of EVENI IRANSIENT ~ RX TRIP (fSAR tg. X 3) fAILURE (CHf) ON TRIP STSIEH AVAILASLE UNAVAILASILIITOf fUNCTION DIVERSE ALARH I(.2.3 Accidental M4$ te cas This event Is not affected by ~ reactor trip or Release safcguards actuation. Therefore, the cocaan ~

node failure of the softuare of the neu digital reactor protection systcn Hill not (epact thc results of this event.

In the event of a votuae control tank (VCT) rtpture, VCT Iou lcvct ard VCT lou-lou Level

~ Iarns uoutd be anticipated. Various radiation 4(arne uoutd ~ lso be anticipated Inc(udiny the tilt vent aiar44 A VCT Iou loll Level klLL result ln a refuel lnS Hater sequence uhlch Hill start the shutdoun of the reactor. This cccblnatlon of slams and aut004tlc actions uou(d lead the operator to Isolate Ictdoun and proceed ulth an orderly shutdoun. This scenario Is tnaffectcd by CHf of the ncuccqulpncnt.

,I l

'I i W'

UNlt I 2 I SAR IRANS IENT TRIP/SAFEGUARD FUNCTION FOR IHPACt OF COHHON HCOE ALARH/ALTERNATE INDICATICN D IACRAH 0 CONSEOUENCES OF EVALUA'IION Of EVENt TRANSIENT 4 RX TRIP (CESAR Il(,q.t() fAILURE (CHF) OI TRIP FUNCfION STSTEH AVAILABLE UNAVAILASILLTTOf DIVERSE ALARH I(.2.( Stcaa generator tlbc I. Reactor trip on lou Reactor trip lost (ecao fKII ~ cn Aval labt fD.2101 lhe reactor trip accused for calculating the Rupture prcssurlter prcssure signal dated 10/13/92 free M.O. Panel nd lection aass transfer fraa the reactor coolant systca Sotos to V.D. Vsndcrgurg) Panel recorder through the broken tube In this event occurs cn cocputcr Indication Lou pressurltcr prcssure signal. Thlc trip ls I c A eral Avc tcb lost because of coceon Node failure (cHF) of the Lou prcssure dev ation neu digital cqulpacnt. Thc safety injection ls (turn on backup heaters) also lost If CHF of the ncu digital cqulpacnt via control systca occurred.

2. Safety Injection on Safety Injection lost (t/S prcssurltcr prcssure-lou Iable 3.3.3) 1he stcaa generator tube rupture event uould result In ~ decrease tn the prcssurltcr prcssure

~ nd level. Thc prcssurlzcr pressure lou Nigh radiation alara lnt dcvlatlon ~ Lcra at 25 psig bclou Stcaa generator bioudoun (noresL controller sctpolnt ls 2085 controller'ctpolnt Liquid pslg for Unit 1 and 2235 pslg tor Unit Stcaa jet air ~ Jcctor vent 2)(Procedures 1,2 - ONP (02(.100, .200 Drop 0)

~ tflucnt radiation eonltor ~ nd the pfcssurlzcr level deviation alara at SS Steaa generator hfgh level bclou level prograas. (Procedures 1,2 - ONP deviation (In affected 402(.108, .208 Drop () uoutd actwte. 1hls S.C.) ~ ccidcnt can be Identified by thc operator by either a condenser air ~ Jcctor radiation alara Pressurltcr Lou level or a stcaa generator bloudovn radiation alara devi ~ sion via control (FSAR, page T(.2.(-S and SD.DCC-NE 101). Ihe systea stcaa generator high level deviation ~ lara for Prcssurlzcr Lou level the faulted stcaa generator ls ~ lso availabl ~ .

(block pressurttcr FOLLoulng these alsres, the operator actions are heaters) via control specified by plant procedure 01-ONP (023.E-3.

systca 'this caergency procedure ulll guide the operator through eltlgatfon ot the event.

It Is anticipated that the lncrcecntaL ties for the operator to respond to the ~ lares produced by thfs event, cvalwte the appropriate Indications, and actuate protection and safcgwrds factions viLL result ln a rcletlvcly saslL tncrcase in the transfer ot fluid troa the prfaary to the secondary systca. The ERO gackground Docuacnt for E.3, SOIR Indicates on p 2d that although the level In the affected stcaa generator aay reach the top of the narrou range span, slgnlf leant voluae still exists before thc steaa generator fills ulth wter.

Procedure 12 TNP d020 LAS.122 provides the guidelines for actions taken based on stcaa generator prlaary to secondary leak.

2t-

~ ~ ~ t

~ ~

~ .

' I

V UNIT I 2 f SAR TRANSIENT TRIP/SAFEGUARD fUNCT ION fOR IHPACT OF CO%ON HCOE ALARH/ALTERNATE IHDICA'IIOH OIACRAH N CONSEQUENCES Of EVALUATION Of EVENI TRANSIENT N RX TRIP (fSAR )g. 2.g) fAILURE (CHF) ON TRIP STSTEH AVAILASLE'd UNAVAILASILITYOF FUNCTION DIVERSE ALARH IL.2.5 (II) Nigh stean f lou Lost a ons Ava abl or take nanuat action to trip thus. Ihe (cont'd) coincident <<Ith Lo-Lo Tavg Eaergcncy Operating procedures based cn recorders Eoergency Response guideline f.-O (HP-Rcv.1$ )

provide recovery guidelines to the operator.

(III) Lou stean prcssure In Lost nd c va ~ b e tao loops (Unit 2) Panel nd lee't lan Slrple extrapolations suggest that, ulth added Nigh stean f lou coincident Cocputer Indication delays for operator response, the rctwn to ulth Iou stean prcssure (Unit Stean fiou Indication pouer could be slgnlf fcantly higher than

1) frotcn on CHF (Unit 1) calculated for the fSAR. This could result In 0 her A ares rdlca I fuel clad daaage. Kouevcr, It ls not believed Lou prcssurl ter level that this Hill prevent the operator fron deviation bringing the alt to a safe condition using thc Lou prcssurlter level Ecergency Operating Proccdurcs. 1he Stean generator high level cnvlronaental (epact of fuel clad dosage ls deviation cents lnaent discussed ln Section T(.2.7.

devpo Tnt nonI tor (ches'ked at least once per ~ lght hours)

Ica condenser Inlet doors open

.29-

\I V

~

' F g

r

UNIT I and UN 2 f SAR '!RANSIENt TRIP/SAFECUARD fUNCTION FOR IMPACT OF CONAN NODE ALARH/ALTERNATE INDICATION DIACRAN 4 CONSEQUENCES OF EVALUATION Of EVENT -e IRANSIENI g RX TRIP (fSAR Itl 1.C)

~ fAILURE (CNf) ON TRIP STSTEN AVAILASLE UNAVAILASILI TT Of fUNCT ION DIVERSE ALARN I(.2.6 Rupture of Control Rod 1. Reactor trip on high Not affected for this event, the tuo reactor trips occur on Drive Itcchenisn (CRDN) neutron flux (high and lou NIS overpouer setpoint and the high rata of Mousing (RCCA $ <<sting) neutron flux Increase sctpolnt. 1hese tuo trip EJcctlon) 2. Reactor trip on high rate Not sffcctcd fact(one are not processed by the ncu dlgltaL of neutron flux Increase cqulpacnt. 'therefore, the fSAR results of this event are not affected by thc cosnon sxde failure of the ncu dlgltal reactor protection systcn Ko radlologlcal dose asscssncnt Mas pcrforncdg but thc dose received ~ I sl tc bolzx4ry and a Lou population zone uould be nlnlnaL (Unit 2 fSAR, page I(.3.5-5). The asscssocnt prcvlously perforncd by Advanced Nuclear fuels, uhlch ls Included ln Tables IC.3.5-6 through 1$ .3.5-9, shoo that the doses for this ace(dent are uelL belou IDCfR IDO guldel Ines.

.30-

UNIT I and f SAR 'IRANSIfNI TRIP/SAFECUARO fUNCTION fOR IHPACT OF CCHHON HCOE ALARH/ALTERNATE INOICAT I ON OIAGRAH N CCWSEOUENCES Of EVALUAtION OF EVENT TRANSIENT N RX IRIP (fSAR Itf. 2. t) FAILURE (CHF) ON IRIP SYSTEH AVAILASLE UNAVAILABILITTOF FUNCtION 0IVERSE ALARH N.2.7 Secondary Systccu Table I Lists all cvcnts with Scc tASLE I See TASLE I Ibis section Includes the discussion of the Accident Envlranacntat dose consequences and cnvifanacntat consequences of ~ canaan axdc Consequences Irdicatcs where thc failure (CHF) of the digital Foxboro cqulpeent (this Section ol Unit protection/salcguards an several cvcnts. Table Il Lists all events 2 fSAR refers to flActlone 4re found ~ for which dose consequences will be found.

Section IC.3.5 of Unit 2 fSAR) TASlf I tASLE II 0l S(USSICH RAO IOLOQ ICAL

~OF VE~N 0 IS(SISS ICH EVENT ~OF V~EN Loss of External IC.I.O Electric Load Loss of fxtcrnaL Flcctrlc load IC.2.'7 Loss of Narccl 1C.1.9 (this section) feed ster Loss of Naruai Fccdwatcr IC.2.7 Loss of alL AC IC.1.12 (this sectlcn)

Power to Plant Loss of All AC Power to 'IC.2.7 Auxiliaries Plant Auxiliaries, (this section) fuel Handling IC.2.1 fueL Nardttng Accident IC.2.1 Accident Lacked Rotor N.1.6.2 Locked Rotor 'IC.1.6.2 Stean Ccncra'tor Tube Rapture 1(.2.7 Etc>a Generator IC.E.C (this acct ten) tube Rupture Ruptwe of 4 stean Pipe IC.2.7 Rupture of ~ N.2.5 (this section)

Stcua Pipe Rupture of a Control Rod IC.2.6 RLpture of a 1C.2.6 Orlvs Hcchanisu Housing Contral Rad Single RCCA Assccbly Ulthdrawal IC.3.5 Drive Hcchanlsu Incident Assccbly LOCh N.3.5 Single RCCA Assccbty Mlthdrawai The cvatuatlans of thc Loss of External Incident ELcctrlcal load (IC.I.S), loss of Norual LOCA IC.3.1 Fccdwater flow (IC.1.9), and Loss of all AC Power to the Plant Auxiliaries (1C.1.12) did not 1(.3.2 Indicate that the autcoaes of these events would caeproatse any of this fission product barriers.

These evaluations sssuacd aiarsct frost control systces or other indications to alert the operator to the need far action. It was then accused thatdescribed he would take procpt action in accordance with his eacrgcncy operating procedures to nasally actuate protection and safcguards factions as appropriate. Since no caapruaise of the fission product barriers resulted frau the evaluations, the incident off site doses !n Scctlcn IC.2.7.2 reaatn valtd.

for the steau brcak event, the evaluation of scctlon IC.2.5 suggests a potcntlaL higher return to power when additlonaL tice ls

~ lloc4ted for operator fcspaAse to swwxutty

- 31.

~ '

h

UN11 I <<XI 2 fSAR IRANSIENT TRIP/SAFECUACD fUNCTION fOR INPACT Of COeCON IKNE ALARH/ALTERNATE IIQICATIOH OIAGRAH g CONSEOVENCES OF EVALUATIOI Of EVENt

'IRANSIENT g RX TRIP (fSAR tq. 2.q) fAILURE ICHF) OH TRIP SYSTEII AVAILABLE UNAVAILASILIIYOf FUNCTION 0IVERSE ALARH IC.2.7 Initiate safecy Infection. It this tcuh to (cent'd) cled fatlure, thc inventory ot radlolsotopcs In the reactor coolant afccr tha event ulLI be larger than accused fn the IC.2.2 anatyslc.

Noucvcr, the anatysls for 1X failed fuel and \0 gpa prlaary to scc<<vhry leak rate shous ~ 0.0 hr site txxndary thyroid dost ot C r<<a and a 0.3 rca site boundary ahois body dose. These values arc tuo orders of aagnttude bclou thc 10 CfR 100 acceptance criteria of 300 rca and 2S rca for thyroid and uholc body doses respectively.

Since these values are a very saatt fraction of thc 10 CfR 100 crtterla, It appears that ctad fallwc ulll not causa these crltcrla to be

~ xcccdcd An analysts to sapport atccrnati stean generator tube plugging crtterta for Unit 1 has been sdxattccd to the Ncc. The analysts ta dcscrtbcd In UCAP-131ST. It Inchdcs ~ aethodology to ensure that thc of fat ta dose Is Ital ted to 30 rca thyroid at the site boundary. this analysfs

~ sauces a 'IX fueL defects and ~ 120 gpa leak during ~ stean brcak. At each outage uhcn the stean generators are cxcalncd for degraded tubes, ~ ccnservatlve evaluation Nil I bc pcrtoracd to ensure that, In the cvcnt of a secant tne brcaL, the 120 gpa leak rate Is not cxcccdcd. If ~ potcntlat return co poucr shoutd result In addltlcnal clad daaage above that accused In thts cvaluatlce, the 30 rca cricerlcn could be cxcccdcd. Koucvcr, 30 rca Is snail cocparcd to 10 CFR 100 llalts.

Ne further observe that, In accusing culclpla failures ln safcguarch actuation, It is not also necessary to assuae other fallwcs as uett. It ic ls accused that att rah insert, the very Large Fo associated utth the analyzed return co poucr util not be present. These fn's can be

10. It Isiche porclon of the core associated ulth this poucr peak that ls expected to suffer cl<<t daaagc Fwthcraoreg Ihcn rods arc inserted, the SOH util be dxktcd or nore accusing ~ stuck rod uorth greater than or pea and excess SOH >COO pea. Ic should also be

~

noted, as discussed In Section TC.2.S, that at taro poucr or lou poucrs, rxctcar Instruacntat ion trips frca tha source range and tntcracdlate range detectors and the poucr range high range lou sctpolnt are expected to protect agatnst paver excursion c ~

~ ~

5 0

E J

N,' ~'

CESAR UNIT 'I and 1 TRANS I TNT TRIP/SAFECUARO FLXICTION fOR I<<PACT Of CC<<NON HCOE ALARN/ALTERNATE INOICATION OIACRAN g CONSEOUENCES OF EVALUATION OF EVENT

'2 TRANSIENT g RX TRIP (fSAR Iq '7) fAILURE (CNF) ON IRIP STSTEH AVAILABLE UNAVAILASILLTTOf FUNCTION OIVERSE ALARN IC.2.7 F lnaLLy, <<e believe that ln the case of ~ large (cont'd) sudden stean brcak, there <<ILL be a safer

~ udlbia Indication <<hlch <<auld proept the operator to carly action. If thc brcak <<cre to develop gradually, the various clams available

<<ill allo<< the operator to take action In a tine fraae that <<ill prevent any clad danage.

Therefore, <<e conclude that a CHF in cocbinatlon

<<lth other failures could result ln releases larger than currently calculated but not in cxccss of 10 CFR 100 If<<its. In ~ nore Likely scenario In <<hfch large core peaking factors are avoided, thc current calculations arc cxpcctcd to be maf fcctcd because Little or no clad dc<<age <<ould result.

Should CNF of the neu digital cquipxcnt occur for the stean generator tobe rtpture event, the operator has to trip thc reactor annually and Isolate the broken stean generator folio<<lng the guidelines given fn cncrgcncy operating procedures. It has been assuacd in our evaluation that the operator's response tfae ls M seconds. This one ninute tine Is on

~ ddlticn to the 30 nlnutcs allotcd for operator

~ stion after thc accident, ulthln <<hlch tine the pressure bct<<ccn the defective etc<<a generator and the prlaary systcn Is cquallzcd, and the defective stean generator lc Isolated. Assuaing

~ I gpa prlsary-to-secondary leak rate Isaxlsxxa leak rate aLLo<<ed by T.S) prior to the tube rupture, the 0-2 hour doses at site ixxxvfary are: thyroid 1.7 re<<I <<hole bodya0.02 rcn.

These doses are euch lo<<cr than 10 CfR 100 guidelines of 300 rca thyroid and 25 rcn <<hole body, respectively IUnlt 1 fSAR page TC.2.7.6).

Thc doses at the cnd of 31 alnute of tine <<auld be nfnloaLIy lcf>>ctcd by the delay ln safeguards actuation h)potheslzcd for a CNF. The release (or SCTR are expected to rcnafn ouch Less than 10 CFR 100 gufdcllnes even shen ~ CNF ls

~ sauced

.33-

UN!I 2 CESAR IRANSI(NI TRIP/SAFECUARD FUNCTION fOR IHPACT OF CANON HODE ALARH/ALIERXATE INDICATION DIACRAH g CONSEOUENCES OF EVALUATION Of EVENT IRACSI(ct S RX IRIP (fSAR LQ. 2..$ fAILURE (CHF) ON TRIP

) fUNCTION STSIEH AYAILASLE UNAVAILASILITT OF DIVERSE ALARH 1(.2.8 Hajor R~tufc of Hain ~) A reactor trip on any of Fccdvatcr Pipe the folioulng condltla>>t This cvcnt uas onl'y cvaluatcd for Unit 2. It ls (fcedllne greek) not In thc Unit I License basis. A Unit I

1. High presswl ter prcssure analysis Is provided ln the Unit I UfsAR for Trip lost Ad c4 on Ava ab FD -2101 lnfofc>>t ion cnly.

~ PancL lnslcatlon Sheet I

~ Panel recorder the FSAR anglysls for this event has been

~ Cocputcr indication per forced at full pouer ulth OAS ulthout loss of offal te pouer. This analysis assuacs that ~

Iver e A ares Available reactor trip ls initiated Chen the Lou-Lou stean generator level trip sctpolnt In the ruptured control systcN stean generator ls reached. Thc Lou-Lou steea

~ Nl prcssure (2325 psla) generator uater level trip Is lost, If ~ coc>>on vi ~ control systcct code failure (cHF) of the ncu digital cquipacnt

~ Three high prcssure occuf 4

~ Lares at 2350 psla (occ>> dated 10/13/92 fres All the reactor trlpc and safety Injection M.A, Sotos to V.D. signals ullL be tost (Colum C)cahcn CHF of neu Vandcrgurg) equlpacnt occurs. goth the aeter driven and twblne driven auxiliary fecduater systcc>> are

2. Overtccperaturc 4T Trip lost Mlde range RCS tccp f0.2102 also lost except In situation descrlbcd betou.

recorders Shcct 3 Ihc a>>tor driven auxllfafy fccdvatcr Txnps are

3. Lou-lou stcaa generator Trip Lost Ad Ice t I Ava ab FD 2101 not affected by CHF If the pwps started on CCV vatcr lcvcl fn any stean ~ Panel Ind cation Sheet 5 tx>> Loss of voltage or loss of ~ Ll Nein generator ~ Panel recorder fccduatcr pwt>> (1/S Table 3.3-3, page 3/A 3-

~ Cccputcr indication 19). Thc turbine driven auxiliary fecduatcr Fxap ls also not affcctcd by CHF lf the Ixup IV A afll!$ AV4 ab started on reactor coolant pwp bus tavfcrvoitage

'LCVCL devi ~ t ion via (I/S table 3.3-3, page 3/L 3-20).

controL systea (ceno dated 10/13/92 fraa tn case of CHF of the digital equipacnt, stean C. Safety injection slgnalc M.C. Sotos to V.D. generator leveL devlatlcn clara, prcssurlzcr froo any of the folloulngt Vandcrgwg) prcssure lou deviation clans, prcssurltcr lou level deviation ~ lena, and prcssurltcr lou lcv<<L (I) Tuo out of three Signal lost Ad 4 Ave abl e clara are available to the operator. In dlffcfcAtl~ L pfcsswc sfgnats addition, three alternate Indications of the bctvecn 4 stean LIAC 4Ad tho Cofputcr Indication stcaa generator uater level, prcssurlter reaalnlng stcaot ines prcssure, and prcssurfter level are available to the operator.

(ll) Lou stcua prcssure ln Signal lost These clara>> end Indlcatlcns arc capes\cd to tvo of four Lfnes saoe as for dlffcrcntlal cause the operator to Inttfaie protective and prcssure signal ssfeguards action relatively early In the event.

Using thc coergcncy operating procedures, the (lll) Tuo out of three high Signal lost Ild at Va aht operator uoutd very Likely apply auxiliary cental tvacnt pfcsslJf 4 Signets fCCduater tO the!ntaet Steaa DCneratOra Carller Cocputcr Indication than the 10 alnutcs after the Initiation assuacd in the analysis. In addition, ue do not believe A afcc Ava It Is necessary to assuae an AFM pwp failure ln Upper cental rfacnt prcssure aklltton to CHF. In vleu of this and the fact high or lou (tuo stare>>) that ~ conservatively soall fecduater flou of

.3C.

1

ISAR TRANS I EN I TRIP/SxfECUARD FUNCTION fOR IHPACT Of COONH HCOE ALARH/ALTERNATE INOICATION OIACRAH g CONSEOUENCES OF EVALUATIOH Of EVENt TRANSIENT g 1'I >

RX TRIP (FEAR

9) fAILURE ICHf)

FUNCTION OH 'fRIP STSTEH AVAILABLE UNAVAILABILITTOF 0 I VERSE ALARH It.t.6 b) Aux l I lary teeduater 600 gpa ws accused to be SIBTILlcd to tha Ieontrd) ll) 1uo actor driven IOAfP starts Iwtoeetlc Intact steoa generatOra, a SIbetantlatty targcr auxiliary fcedvatcr purps initiation) or Lou-Iou ~ uxlllary fceduatcr tlou can be expected to be uhlch are started ont stean generator Level ard supplied to the Intact Stean BCneratora. Cn Lou Iou LcvcL IA eny stean safety Infection tron non-

~

gcAcrator ACISICI Initiation are lost this basis, lt ls likely that the event not only uoutd not be uorse than the analytcd case, but

b. Trip ot aIL aaln fccduatcr could Likely be less severe.

c. Any safety Injection At ~ II poucrs, the stean gcncrator lcvcl signal devlatlon clara Is available. In edfltion,

d. L kv bus loss of voltage Auserous slams describing the status of the

e. Hcrxlsl actuation condensate and fceduater systce ixnps and pressures, such as condensate hotwll Level, III) turbine driven IDAFP start Iwtoaatle Ad I booster ootor trip, nein fecdvater fxnp, etc.

4uxll fary fccdvatcr Fxnp ls fnitiaticn) on lou lou ~ Pressurltcr pressure Lou ulll activate. Uhcn at least tuo channels of started cnt stean gcAcr4'tor lovEl Is deviation fccdvater are lost above AOX, thc AHSAC ttoer 4 Lou lou LcvcL In any Clio

~

stean generators Lost ~ Presswlzcr level lou ulll also initiate. If the tlcgr Is attoued to devi at ton tine out, ~ turbine trip and wxlllary fceductcr

b. Reactor coolant prp bus ~ Prcssurlzcr Iou level Ixnp start ulll be inltlatcd. The turbine trip Ixdcrvoitage ~ Prcssuritcr high level ulll result In ~ reactor trip uhlch Is dcvlatlon Ixlaffccted by CHF.

~ Prcssurltcr high Lcvct

~ *

• P UHII I an@

I SAR TRAMS IEHT TRIP/SAfECUARD fuMCTIOM IOR IMPACT Of (XZCQN HOOE ALARH/ALTERMATE IMOICATIBM OIACRAH g COMSEOUEMCE'S Of EVALUATIOH Of EVEMT TRAMSIEMT 4 RX TRIP (fSAR L4. 3 ~ I) IAILURE (CHf) OH TRIP STSTEH AVAILABLE UMAVAILABILI IY Of IUMCTIOM DIVERSE ALARM IC.3.1 Large Brcak Loss of 1. Reactor trip on lou Reactor trip lost nd at Ava tabt I0.2101 Diverse ~ lara for Lo Thc fSAR analysis of this event shous that a Coolant Accident prcssurlzcr pressure ~ Panel Indlcat on Sheet prcssure (turn cn 1 large brcak LOCA Uith discharge coefficient (cd)

~ Panel recorder backlp heaters) vie of 0.6 is the aust llaltlng casa for Unit 2 Ulth

~ Cccput sr Indication control syst<<a ls the RHR cross-ties open. for Unit 1 ~ aax Sl v e 4 fas Avaitab 4v4ILabtc case ls Llaltlng. The fSAR analysis assuaes ~

Prcsswlzcr prcssure Lou Consequences of reactor trip on lou pressurizer prcssure <<d deviation (turn on backup teaval tabll I ty of Sl subsequent lnltlatfon of safety Injection, and heaters) vie control systca is decreasing acclxulator Injection at 600 pale. The Lou systea (aeee dated RCS Inventory prcssurlzcr prcssure reactor trip and lou 10/13/92 free U.C. Sotos resulting In an pressure safety Injection signals are lost, lf a

2. Safety Injection (Sl) on safety Injection signal to V.D. Vanderburg) Increase of peak clad cemxe aode failure (CHf) of thc ncu digital Icw prcssurlzcr prcssure lost tccpcratUfc, !nstruaentatlon systca occurs.

3. Containacnt spray on hi ~ Hl hl pressure spray Ihe only protective 1he Large brcak LOCA results In a rapid hl prcssure ~ ctuatlon and ESF trip Panel Ifdlcat ion flection prior to dcpressurl tat ion of the reactor coolant systca lost. Coefwtcr lndlc4tloA operator action Mill (RCS). The Lou pressurizer prcssure deviation vc A efec Avail abl ba ccclaulator clara MILL actuate at 25 pslg below controller Upper contalffacnt hl/Lo injection. Thc setpolnt of 2235 pslg (Proccduri 2.OHP C02C.200 pfcssufc ~ Lares 4v41 lable operator UIIL be Drop 0). figure 1C.3.1-3a of Unit 2 fsAR shous via. ccntrol systca (oece lnutdatcd by ~ Iafas that this alara Mould actuate ln less than cne date 10/13/92 froa U.G. for this event as scc<<d of transient. Three alternate Sotos to V.O. Vanderburg). indicated lsder the indications are available for the IOM other pressurizer pfcssure. The taper ccntelnacnt 0th ~ Ad I ca tI Alafas/Ifdlcatfons high prcssure aiafa Mill actuate at C0.2 pslg Lowr containacnt heading. (Procedure 2.0HP C02C.105 Drop 31). These <<d radiation Monitors Nevertheless, w other alaras as frdicatcd under Other (isolated on phaseg). ~ ssuae M seconds for Alaras/indication effectively Harn the operator Upper ccntalffaent arcs the operator response that ~ aajor accident ls occurring.

radiation aonltors. t lac. Since tha Post accident high range outcoae of this event Accusing that the operator'a response tlac to con\clffacnt afc4 aceltol'4 ~ depends on proept altlgate the event ls 60 scc., the reactor Mould Pressurizer Level lou safcguards actuation, be trlppqd at about 61 seconds of transient <<d deviation clara. 44 aodc lcd subsequently Initiate the safety Injection <<d Prcssurl acr Lou Level X rules, UAdef'pp<<dlx accwulator Injection. In our evaluation, w

~ lara. ~ lcvatcd PCT and assuaed that the results given ln fSAR are Lowr contalnaent slap extensive fuel daaage delayed by about 60 secceds. frca figure lcvcl high. Mould be expected to 1C.3.1-15a, the peak clad tccpcrature (PCT) of Conte I <<sent ~ I r ba calcUla'tcd by <<l 21CO'f occurs at about 260 accord of transient.

tccper4twe high Appcfdlx K aodeI.

Accusulator Level high or LBLOCA ls a very coepllcatcd cvcnt to aodcL ~

lou (ona al ~ fa Therefore, extrapolations of PCT are very

~ ter) ~ leCcftaln, AttccptlAB to CXtfapolat4 flgUrCS pcf'ccuaJI Acclaulator prcssure high N.3.1-154 for Unit 2 and IC.3.1-13I for Unit I or Lou (onc alara per by Inserting ~ delay of 60 accords for operator

~ ccloutator). response tlae suggests PCT'4 as high as the RCS hot leg pressure LOU 3000'f range. HoueVCr, the rcaL situation ls In RCP Seal 1 diff prcssure all likelihood such Less severe. Best cstlaatc Lou (CAC clara pcf'CP) ~ aodcls 4l' knoun to rccult ln slgotantf ~ Ily Lover PCT's. Houevcr, even If the App<<dlx X

~ 36-1

'I + u

~'

~

0 I

UNIT I and

<SAR TRANSIENT TRIP/SAFECUARD FUNCTION fOR IMPACT Of COHHOM HCOE ALARM/ALTERNATE IMOICATIOM DIACRAH S CONSEOUEMCES Of EVALUATION Of EVEMI

[RANSIENT N RX TRIP (ESAR fAILURE (CHF) OM TRIP STSIEH AVAILABlE UNAVAILASILITS OF FUNCTION DIVERSE ALARH (cont'd)

IL.3. I Seal I leak off Iou nodal ls conservative by as such as RCP EOO~F g the (one clara per RCP). acceptance crltcrla for IOCFRSO.AS cauld ctlll Loop RCP trip or Lou f Lou possibly be exceeded.

(one clara per RCP).

ice condenser Inlet doors Although these estlnates of the ispact of a CHF open on LSLOCA Is of concern, lt ls unlikely that Contalnaent deupolnt such an event Mill occur cnd even nore unlikely conltor (checked at least that such an event Mill occur ln coincidence once per ~ lght hours) . ulth CHF. As indicated ln Section IL.3.3 of the Unit 2 UFSAR, p IL.3.3.4, pipe uhip rcstralnts and other protective cessures against the d)naaic eifqcts of ~ brcak ln the nein coolant piping arc not required because "Leak before break" can be attuned to allou for shutdoun of the Cook Units before an event as catastrophic

~ s ~ LSLOCA occurs This arguaent also gives rcasonabl ~ assurance that such an event in conJtnct ion ul th ~ CHF Is extrcnely tnt I keiy.

P 1

0

'S ~ f t

UHI'f 1 2 fSAR IRANSIENI TRIP/SAFEQMRO fUNCTIN fOR IHPACT OF CaeN HCOE ALARH/ALTERNATE INDICATION OIACRAH g COHSEQUEHCES OF EVALUATIOH OF EVENT TRANSIENT g RX TRIP (CESAR I I.3.2) FAILURE (CHF) ON 'IRIP STSTEll AVAILABLE UHAVAILABILITTOF FUHCTIN DIVERSE ALARM 14.3.2 Lost ol Rcoc'cor 1. Reactor trip on Lou RCS I. Lo pressure Rx trip fg 2101 Diverse Alara for Lo lhc saall brcak loss of coolant accident results coolonc froa saall prcssure lost 1. Panel Indication Rcv. 00 Presswc via Control ln dcprctturlcacicn of the reactor coolant ruptwcd pipes or froa 2. Safety InJcctlce (SI) on 2. SI (auco Inl c I at lcn) Z. Panel Recorder sheet 1 Syttca Is available. tyscca. The Llaitlny break (as deceralned by cracks ln Large pipes Lou RCS prcssure (auto lost (aeao 9/2/92 free u. 3. Cccputcr Indication Consequence of the highest calculated peak fuel rod cled lhlch occuotc the Inl t let ion) 0. Sotos to V D. vc Alora Avol obt cnavaitabilicy of Sl cccperacure) for thc high head safety Infection Eacrgcncy Core Coating Vtndcrgury) 1. Prcttwl ter pressure syscca la decrcaslny cross*cia valves opened ls 4 Inches In disaster Systea (Brcak tice Iou dcv let Ion vl ~ Control RCS Inventory for Unlc 2 and 3 Inches In dlaaetcr for Unit I ~

c).OILZ) Systca (acao 9/2/9Z froa resuttlny ln an A cold lcg brcak uos Initiated at RCS prcssure M. 0. SOCos Co V. D Increate of peak clod of 2100 psia and Tavg of 501.3 F for Unit 2.

yonder Bwg) tccpcraturc. Ihe The Unit I Initial Tavg uos SCT f. for the Other A(orat ndlce on period of core Unit 2 case, the Rx trip uas actuated at 1060 Louer concalreent cncovcry could be pals (fSAR, page IC.3.2.9). In the Unit 2 radlaclon cenicors extended lf Sl tystca anatysls, the tifccy Infection (Sl) signal (Isolated cn Fhttcg) It noc occuoccd ln ~ ~ ctuaced at ITIS psla ulth ~ Zy second tlac Upper Contalleenc area C lesly aorecr. (fSAR delay to acccxnt for diesel gcncrator scartup red(scion tenlcors. 14.3.2) and caergency paver bus Loading In case of Level lou

'resswlccr offslte pouer coincident ulth an accident. Ihe deviation ~ Lara aoxfcxlo fuel cladflny tccpcraturc sttalncd Pretsurlcer Lou Level during the transient uas 1C26 f (Units 2 UfsAR, alara pose 'IC.3.2 12).

Contalreent ~Inc aonltor (checked at Least the canton cede failure (cHf) rcsulcs fn Loss of once pcr ~ lght hours) both Lo prcssure Rx trip and autoaatlc Sl.

Hovcvcr, for Lo pretcurlter prcssur>>, three alternate lndlcacicns, and lou prcssure deviation via ccecrol syscca Diverse Alone are avallabl ~ for thc operator to trip thc reactor aueatly. 1he alara, PZR Prcssure Lou Deviation Backup Ilcaccrs Ce, ul(L activate at 2210 pslg (Z.OHP C024.200 Drop 0). The corrcsPonding sccpolnt ls 2060 pslg for Unit 1.

SBLOCA lt s very cccpllcsted event to cade(a Therefore, extrapolations of pCT ere very entertain. Attccpts to extrapolate flgurcs 1C.3.2-C for unit 2 and 1C.3.2-5 for Unit 1 by Inscrtlng an adflcfcna( 60 seconds of haec up tfte to accocnc for operator response cine In lieu of autceaclo actuation Led to lncrcaental Incrctte In PCI's o( ASOOF ald 200' respectively. For Unit 2 there Is a aargln to accocedatc a 500'f Pcl Increase for the cross-t1 ~ open cosa. Tha Incrcaental PCT uould Lead co only 1900of pcf. for Unit 1 such aorgln appears not to cxlct. Roucver, the unit 1 SBLOCA analytic uat pcrforacd at 3560 INT for 15xlS fuel ulth the Intent of bounding both Units. If one attuacs the rul ~ of ttxab, CSof for each IS of Dover, there ls CSO f of PCt aorgln due co chic contcrvaclsa. Unit I

~ 30

l l

UMII I 2 fSAR 'IRANSIENI IRIP/SAFECUARD fUMCIION FOR IHPACI OF CONN IMOE ALARM/ALIERMAIEIMDICATIOM DIAGRAII 0 CONSEQUENCES OF EVALUAIION OF EVEMI IRAN1IENI N RX  !RIP (fSAR I'4.g i) fAILURE (Cxf) CSI IRIP f UMCI ION SISIEN AVAILABLE UNAVAILAeltllfOF DIVERSE ALARM 8E 14.3.2 operates at 3250 Muf snd there ls no Intent to leon'tl Increase this paver. thus there efpcars to be substantial pcf nareln In the Appendix K sstocA sadcl for Unit I also.

lie further note that, as ln the case of LSLOCA, the Appendix K codel ls s bstantlatly ccnscrvatlve. furthcrcorc, thc analyted events

~ ssuacd the loss of a train of Sl Ixnps. Such an asslrptfon, ln addit'lon to thc sultlple failures ot CMF, ls also ~ slbstsnti ~ l conscrvatisn. Ihcrcforc, It ls concluded that, even ufth additional operator response tines relative to autcoatlc actuatfon, IDCFR SD.S6 acceptance crltcrfa Mould Likely be aet for SSLOCA.

Ihe hleh head safety Infection cross-ties closed cases Mere not considered because the Cook Units

~ re operated ulth these cross-tice open cxccpt for short periods of surveillance tcstfnS and nalntcnance.

~ 39-4

C t

k

UNIT I 2 f SAR TCANslENT TRIP/SAfECUARO fUNCIIOH fOR IHPACT Oi COHHON HCOE ALARH/ALIERNAIE ILOICATION OIACRAH 8 CONSEOUENCES Of EVALUATION Of EVENT TRANSIENT 8 RX 1RIP (fSAR III Q.LL) fAILURE (CHf) OH TRIP STSTEH AVAILASLE UNAVAILASILITTOf IUNCT IOH DIVERSE ALARH IC.3.C Long Tera Cont ~ insent 1. Contslrrscnt SPfay on Lost <ld cs ons Av4I able f0.2103 cnly the long tera ccntalnsent prcssure analysis Integrity Analysis higrl high prcssure signal Panel Indlcat on Sheet C ls considered In this cvalwtlon. The short (Section LC.3.C of Cocfuter Indication tera prcssure analyses typically have peaks unit 2 refers to Unit prior to thc actwtlon of any protective or 1 uf SAR Section v r sr<<a Av I 4b ssfegusrds fIs<et lone and cre therefore not IC.3.C) Upper ccntairyscnt h /lo applicable to this evaluation. 'Ihe asss and prcssure alaras available energy release rates for stcasl inc breaks are vl ~ ccntroL systca (ccco considerably less than the RCS daRIIC-ended flop dated 10/13/92 froa U.O. suction PIPe breaks (Unit I, FSAR, P. IC.3.C-18)

Sotos to V.D. Vsndcr8urg) and are, therefore, bauIdcd. The ccntafnc<cnt tccpcrature effects of stcaa(fne breaks are other Alar<<s Adl ti ccnsldcrcd In Section 1C.3.C/N.3.11, Electrical Prcssurlzcr prcssure lou Equlpscnt Envirovscntal Ousllticatlon Otsss and dcvlstlcn (turn on backlp Energy Release Inside Contalnscnt and Outside hcatcrs) vs control Contalr<ocnt).

cysts<4 Lover coAt ~ Inscnt The fSAR analysis of this event shous that radiation aonl tora pressure peaks about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Idto thc event uhen (isolated OA phased). the lce bed.colts out. Thcrctorc< as long as Upper ccntal<vscnt arcs additions( energy Is not added to the radiation sonltors. contalrvacnt 4$ 4 result of coo<son node failure Post accident high range (CHf) ot the new digital Instrusentatlon, the contalr<scnt arcs aonitors. peak pressure should not change. In large break Pressurizer lcveL Iou LOCA, the reactor fs procpt(y shut doun by devi st Ion stars. voids. 1hc long tera LOCA cooling analysis Prcssurlzcr (ou level ~ tsures that It does not bccoc<s critical again.

slane. lt actuation of safegusrds Is delayed, PCT Hill Lover conte(<<sent swp be expected to rise above the analyzed value level high, ICItlL the core ls quenched at a delayed tine ccA'tal<vscnt ~ Ir and, thcrctorc, addition fuel daccge asy occur.

tccpereture high. Houevcr< thc nct energy delivered to the Accus<Later lcvcl high or ccntefr<scnt Is not lfpectcd by 4 fclatlvcly Lou (cne alara per snail change of a alnutc or tuo In the re<Cove(

~ zeus<Later). of thcraat energy froa thc core and delivery to Accus<later prcssure high the oontainscnt In the carly alnutcs ot thc or (ou (CAC Clara pcr" event. It ls concluded that ~ delay of a fcu

~ ccus<Ictor). airs<tea In the actuation ot safcguards Hill have RCS ho't lcg p<'cssufe lou no fcpsct on the analysis ot record.

RCP Scat 1 diff prcssure lou (cAC alcfa pcr'CP) ~ fwthcrsore< since It I ~ not necessary to accuse RCP Seal 1 leak oft lou that one train of safcgusrds falls ln addlticA tone alsra pcr RCP). to CHf, lt Is rcascnabie to believe that the Loop RCP trip or Lou f lou operator can aaruaLLy activate tuo full trains (one alara per RCP). of safcgusrds 44rly ln the event. cn this Ice condenser Inlet doors basis, It ls Likely that the event not only OPCA, uould Aot be Horse than thc analyzed case, but uould like'ly be less severe.

Contalnscnt dc<point acAI ter (checked 4t lc4st once pcr eight hews)

~ CO ~

1

'I

,> i

UNI'I I and 2 I SAR IRANSIENI IRIP/SAfECUARO fWCIION FOR INPACI Of CONHON NODE ALARN/ALIERNAIE INOICAIION DIACRAN g CONSEOUENCES Of EVALUAIION Of EVENI IRANSIENI g RX IRIP (fSAR fAILURE (CNf) ON IRIP SZSIEH AVAILARLE WAVAILARIL!Iy OF FWC IION 0 I VERSE ALARN It.).t Although the lapact of CNf on the containaent tccnt~d) pressure analysis does not seen to be significant, the pressure analysis ls based on LRLOCA. It ls trdlkety that such an event ulll occur and even nore tnllkety that such an event

<<Ill occur ln coincidence ulth CNF. As indicated In Section lt.3.3 of the Unit 2 UFSAR, p IS.3.3-t, of pipe uhip restraints and other protective neasurcs against the dynanic effects ot a break ln the nein coolant piping are not required because "leak-be(ore break" can be

~ ssuaed to allou for shutdown of the Cook Units before an event as catastrophic os ~ LRLOCA occurs. Ibis arguaent also gives reasonable assurance that such an event in conjunction ulth a CNF Is extrenety mlikety.

41

I' UNIT I and 2 I SAR TRANSIENT IRIP/SAFECUARD FUNCTION fOR INPACT Of CCHHON HCOE ALARHIALTERNATE INDICATION DIACRAH g Of EVALUATIOI OF EVENT "

TRANSIENT I RX TRIP (FSAR ftf $ ,5)

~ FAILURE (CHF) OI TRIP SYSTEH AVAILABLE CONSEOUENCES UNAVAILABILITTOF DIVERSE ALARH FUNCTION'cpaat

'IC.3.5 Rad I ol og I ca I Reactor trip/safcgwrd of CHF ls discussed Discussed In thc lhe Unit 2 UfSAR analysis of Radiological Consequences of ~ Loss fcnctions arc Included in the ln th<<cvalwtlon of cvcnt cvalwt ion of event IC.3.'I ccnsequenacs of ~ LOCA Includes analysea of of Coolant Accident cvatwtlcn of fSAR Event N.3.1 several events for radiological ccnsequenaes

~ nd other Events N.3.1. cfclch uere perforned by Advanced Nuclear Fuels Consideration ln Corporation. These events are rcvleued for the Safety Analysis. lcpact of ccccacn node failure ((Hf) In other sections of this evaluation. Table I Ilats alL cvcnts for uhich dose <<cnsequcnccs have been anatyted for Cook Units I and 2 anf Indicates In Rich section of this revlcu a discussion of thc Ispact of ~ CHF an the radiological consequences ulll be found. Section IC.3.5 of the Unit I UfSAR addresses only the Envlraccocntat consequences of e LOCA TABLE I D I SISISS ION

~OF '~EN Loss of Extcrnat Electric Load 'IC.2.7 Loss of Nonaal fccchcater TC.2.7 Loss of All AC Pouer to

. Plant Auxiliaries IC.2.7 Fuel Handling Accident 'IC.2.1 Locked Rotor IC ~ 1.6.2 Stean generator Tube Rcpturc TC.2.7 Rcpture of a stcacl Pipe 1(.2.7 Rupture of a Control Rad 1(.2.6 Drive Hcchanlse Nouslng Single RCCA Asseahty Ml thdrawt N.3.5 Inc Ident (this section)

LOCA IC.3.5 (this section)

'tha single RCCA ulthdraual cvcnt uas analytcd for Untt 2 for cycle 6 operattan. As ~ part of the transition to Ucstlnghause fuel In cycle d, AEP argued and the NRC concurred that this event uas not In the license basis for Donald C. Cook Nuclear Plant, Unit 2. NRC concurrence ls docxsaented ln ~ Latter frees Joseph O. Clitter of tha NRC staff to H.P. Alcxlch, dated August 3c 1989 anl In the cycl ~ d SER, dated August 27, 1990. Therefore, no neu analysis of thfc event has been per foread.

For the Cook Units, slngl ~ RCCA ulthdrauaL Is

~ ntlclpatcd to be an event <<lth niner conscquenacs. The (nits are generally operated

~ t fuLL paver and base Loaded. In this aode of operation,'he RCCA's arc nearly fully C2-

t I'

% I 8 g

UNIT I ard 2 I SAR TRANSIENT TRIP/SAFECUARO fUMCTION FOR IMPACT OF CONHON IKOE ALARH/ALTERMATE INDICATION OIACRAN g CONSEOUEMCES Of EVALUATION Of EVENT IRANSIENT M RX TRIP /SAR ]q. 3 g) FAILURE (CHF) ON TRIP FUMCTIOH SISTEN AVAILABLE UNAVAILABILIITOf 0 I VERSE ALARN I(.3.5 ufthdrakA. Therefore, ulthdraual of one RCCA a (cent'd) fcu steps has no Irpact. If a unit should be operating at ~ reduced poucr, an Increase In OMSR cksrgfn ls availablc. The Units sre operated using thc constant axial offset control ckcthod so that the controlling bank ls scldtxa deeply Inserted. In addltlcn, the rod deviation

~ Lane, uhlch ts maffcctcd by CNFk uould be expected to alert the operator to take appropriate action.

Thc evaluations of snail break LOCA (Event I(.3.2) and large brcak LOCA (Event T(.3.1) shou that the large break LOCA event ls bounding, as there uouid be significant clad failure, If coxson cede failure (CHF) of ncu digital instruacntat lan occurred, slcultancously ulth a LBLOCA.

Evaluation of the large brcak LOCA event (I(.3.1) shove that the CHF of thc ncu digital apipaent could result ln ~ peak cled tccpcrature of approxicatciy 3000'f on an Appendix K basis for both telts. Thic tccperature exceeds the acceptance criterion of 2200 F, thug resulting in significant cled failure NKI rclcasc of f issicA products ~

The UFSAR analysis of thc radiotoglcal effects of LOCA for both Units fncludcs tuo cases. In the first case, Identified as the design basis

~ ccldcnt. It Is accused that the entire Inventory of volatile fission productc Eonti~

h Ict- add s of all the fueL rods Is r<<leased during the tice the core Is being flooded by the ECCS. Of the gap Inventory, SOX of the halogcns and 100X of the noble gases ara considered to bc released to the contalnacnt atskosphcre. In the second case, ldcntlflcd as the SLaxlcua h)pothctlcal accident, it Is sssuscd that 50X of the ~or I~Oven EX of halogcns and IOOX of the ~or I yfnno oof noble gases are rclcascd to the contalrsaent auaosphcre. tabl ~

T(.3.5.10 of the Unit 2 UFSAR and Table 1(.3.$ .2 of the Unit I UfSAR display thc doses for both the design basis accident and the skSXicxxs hypothetical accident. As discussed In section 1(.3.1, the delays rclatcd to stRkstituting operator rcspoAsc ticks for clcc'troAlc response slake COuld result ln substantially Increased

- 43

~ ~

k

I

~ I I

~ " ~ <<<< ~ ~ ~

I ~

UNIT I and f SAR IRANS I EN I TRIP/SAFECUARD FUNCTION fOR INPACT OF CCNNCN NQOE ALARN/ALTERNATE INOICAIION OIACRAN N CONSEOUENCES Of EVALUATION Of EVENT

'TRANSIENT d RX TRIP (fSAR Iq.3.y) FAILURE (CNF) ON TRIP FUNCTION STSTEN AVAILABLE UNAVAILASILITT Of OIVERSE ALARN IL.3.5 fuel dosage on an Appendix K basis. No+ever, (cont'd) since the consequences of the coxlsus h)pothet Ical accident are based on core Invencory and since they acct the acceptance crltcrl~ of 'IOCFRIOO, ue conclude that the

~ nalysls of this section ls tnaffcctcd by cNF.

Ue further note that the analysts of scccion IL.3.5, p.p. IL.3.5-3, S and 13 of the Unit 1 UFSAR, assuacs only cee train of safcguards Including only onc CEO (an operating. Although noc explicitly stated, it Is clear that ccntainocnt prcssure ls NaxlsLIzcd by degradatlon of cafcguards Including ccntalnscnt spray. Sce figure IS.3.5-3 of the Unit 1 UFSAR. These failure acsuctpclons In addition to CNF are cxccsslve.

c As Indicated In the cvaluatlon of Section TL.3.1, there ls susbstantlal real aargln In the use of an Appendix K nodal to estlcote PCT. IC ls also cnllkcly that ~ large brcak LOCA ulll occur and It Is cvcn sore txdlkely that cuch event ulll occur In coincidence ulth CNF. As indicated ln Scctlon IS.3.3 of the Unit 1 UFSAR, p, IL.3.3-L, pipe ship restraints and other protccclve aeasurcs against the dynLslc effects of ~ brcak ln the Nein coolant piping are not rcqulrcd because ~ leak before brcak" can be assuscd to allou for shutdoun of the Cook Units before an event as catastrofhic as a LSLOCA occurs. This arguacnt also gives reascnabl ~

~ ssurance that such an event In ccnJcnctlcn ulth a CNF ls excrccoly cnilkely.

~ .D

~ 'l% ',J

)

,1 P

e

~ 0 F

1

UNIT 1 and 2 I SAR TRANSIENT TRIP/SAFECUARD FUNCTION fOR INPACT OF CCNNCH HCOE ALARH/ALTERNATE INDICATION DIACRAH g CONSEQUENCES OF EVALUATION Of EVENT TRANSIENT 0 RX TRIP (fSAR ILI g fAILURE ICNF) ON 1RIP SYSTEH AVAILASLE UNAVAILASILITTOf g) FLWCT I OH DIVERSE ALARN 14.3.6 N)drogcn In the Reactor tr I p/safeguard Ispact of CNF Is discussed Dlscusscd in the There arc tuo hydrogen analyses for the cook Contalnacnt After ~ fuv:tlons are Included In the In 'thc cvslU4tloA of cvcAt evaluation of event plant Iacoo dated 11/16/92 frua R.g. Rcmett to Loss. of-Coolant evaluation of event It.3.1. It.3.1. IL.3.1. R.S. Sharoa). The first analysis, Uhich ls ~

Accident part of original design basis, ls given In TSAR IL.3.6. the second analysis, Airh docs not appear In the fSAR Is 4 response to the Three Hllc Island accident Lace above referenced AUSO). In this analysis, a very Large avant of hydrogen Is 4SSuacd to be gcACf4tCd by 4 scvcrely daeagcd core, cqulvalcnt to 73X tlrconlus - Uater reaction. The hydrogen Ignitcrs vere installed to ensure the structural integrity of the containacnt building and survlvablll ty ot cqulpocnt end Instrtsacnts Accdcd to stop the progression of thc accident.

The NRC rcvicu of this analysis ls not yct cocpicte. I I thc reactor safcguards Initiation systcn Ucre to fall for large brcak LOCA, the evaluation of Secticn TS.3.1 suggests hfgh POPS. Nigh PCT's Uoutd be cxpectcd to increase the hydrogen productlcn. KCUCVCr, the h)drogcn ignltcrs are expected to be turned on eavxally for large brcak LOCA conditions through the Status 1rccs. Thc Eccrgcncy Operating Procedures fR-2.1 and IR.C.1 Uould be used by the operator In response to high high contairacnt prcssure cnd Inadequate core cooling, respectively, to ensure that the ignltors Uould be available.

IhUC $ UfflclcAt Instfuacntctlon and procedural guidance ls available to the operator to prcvcnt any adverse consequences of hydrogen coobust Ion In the event of CNF of thc ncu digital equlfxacnt. In Section IS.3.1, It Uas conclufcd that, although the lcpact of 4 CNf on LSLOCA ls of concern, It ls tntlkciy that such an event Ulll occur and even nore LALIkcty that such an event Ulll occtx In coincidence ulth CNF. As fndlcatcd ln Section IL.3.3 of the Unit 2 UfSAR, p IL.3.3.C, pipe ship restraints and other protective acasurcs against the dynantc effects of ~ brcak ln the Ualn coolant piping are not required because "lea'k be(ore brcak" can be

~ ssuncd to ~ Lieu for shutdoun of thc Cook Units before an event as catastrophic as ~ LRLOCA occUrs, This artxncnt also gives rcasonabl ~

assurance that such an event In con]~tlon ulth CNF ls cxtrceety tnt lkeiy.

-AS-

i I

'l V 1

UNIT I 2

'fSAR TRANS(EN( TR(P/SAFEQlARD fUNCIION fOR IHPACI Of COWOK HCOE ALACK/ALIERKATE INDICATION DIACIAH g CONSEOUEKCES OF EVALUAt(ON OF EVEKt IRANSIENT N RX TRIP (fSAR FA(LURE (CNF) ON STSTEH AVAILASLE UNAVQILASIL('lTOF I

tw. IRII'UNCflON DIVERSE ALARH 1(.3.( Electrical Equ(paent Safety Injection cn 'this event Is divided Into Cuo parts, Hass and Env lronsenc ~ I fo((ou(ng signa(st Energy (HCE) Release Ins(de conte(lvsenc and HLE N.(.II Ouall I leat IOn (Haaa (I) Tuo out ol three Lou Signet lost Release Outs fde Conte(le>>nc.

SAd Encfgy Rclc4$ cs prcssurlccr prcssure signets Panel lnd(cation Inside Cents(nsent and P<<>>l recorder The Contalnsent Integrity analysis for the outside conte(Asent) Ccopuccr Indication double ended (xop suction RCS break case bounds I f t A efe>> va(teb(C Che <<aln steaa(lne brcak cont ~ insent prcssure Lo prcssure deviation response. (UCAP 11902, Slpp(ec>>nt I, p S-3.(-

(turn on backup heaters) 2). Rcvlcu of the pressure curves in IJCAP 11902 vs control systea Supp. I suggests chat there Is sufficient <<argin so that this Kill re<<aln the case even if

$ 4fCgusfd$ 4ctU4CIOA$ 4fe dc(eyed tF/ I co 2

<<inutes. If this jldge<<ent shautd be opt(<<lst(c and one of the steaa((ne HIE Release events (II) Iuo out of three Signal Lost Ice lon Ava able Should cause the santa(nsent prcssure to exceed dlffcfcA'clat prcssure signals Panct lrdlcat on 12 pslg, It Is noted that the NRC In ~ letter becueen ~ stcs<< l(A4 <<d the Coepuctr IAd(cactoA fra<< Steven A. Verge of thc NRE staff to Hr.

re<<sining stcaallnes )ohn Dolan of Indiana and H(eh(San Electric (III) Nigh stet<< f(ou (n Signal lost nd ~ lon Ave l abl Coepsny accepted 36 ps(g as the cence(nsent Cuo Lines coincident ulth Sat>> 4$ for d tfcrcAcl~ I ultl<<ate strength. Thcrcfore, thtc!ssue util Iou-(ou Tavg In tuo loops or prcssure sfgnat not be considered further.

sce<<a prcssure Iou In tuo Stc<<s f lou Ifdlcat (on Loops (Cna analysis bounds frotcn on CHF the tceperature prof((ca (n IICAP 11902 Slpp I both Units) for the Hain Stcaal(ne greek (HSLS) Cents(lvsent (Iv) TNO out of three high Integrity uere rcv(cued for this evaluation.

Cents(nsent prCSSure Signa(4 signet lost nd( a I Ava blc Tuo Ll<<(ting transients are discussed. 'fhey are P<<ltl Indi c4c(CA 6.6 sqft daub(e cndcd rapture (DER) at 102X RTP Cotputer Ild(cat(on and ~ 0.05 ft split brcak at 102X RTP. Doth of I A Ave b these Include sfnglc fallurts, <<@In stca<<

Upper ceACS AsCAC prcssure Isolation failure for the DER and wxlllsry

2. Reactor trip high or lou (Cuo 4(af<<s) fcedvatcr EFxlp rlxvxlt protection failure for the (I) Ovcrpover reactor trips NoC sf ftcted v A ~ va b split Ic ls Ao'C Accessary co assuse 'these (neutron flux) Poucr range over paucr rad failures fn ackl(tton to the cocnon <<ode failure SCop (CHF) of the neu digital lnstrusentatlon.

(II) OP 41 reactor trfp Lost

3. Reactor trip In NOt affCCCed (KOveVCr, Sll (fide range RCS tccpcrature Thc tetperaturc ard prcssure peaks of the DER conjlx>>ttcn Kith receipt of ~ uco<<at(c Sl actwtlons are recorders oecUI' c 6,( sccoAds <<d 1(,01 SccoAds cht safety Injection (SI) Last. (here(ore, this respectively. 'Ihts ls Nell be(ore the first a(gnat sfgnal ls fix>>t(ontt on safeguafds of steaallne Isolation at 10.5

<<<<<<4( sl Initiation only) ascends hut near and after reactor trip at i6 A. Fccduatcr isolation on Nat af (ected (Kouevcr, ~ II seconds. Thcrcfare, It I ~ tstl<<ated that the any safety Injection s(gnat auto<<at(a Sl actwt(ons are Icpact of the CHF uou(d be retatlvely <<odest.

lost. thcrcforc, this signal Is fix>>C(ona( on thc tccperature afd prcssure peaks of the split

<<<<ssa( Sl (n(C(at(CA cn(y) occur later at 50.72 ascends. Ihe tccperatwe

5. Stcaa(lne lsotatlenl <<d prcssure trajectories are on the rise at the (I) N(gh.h(gh cents(lvsent Lost tice of thc peaks. the risc ls tcf<<(nated by Pf CSSUf4 cents(nsenc spl'4'y (CtS) 4ccU4cioA, Ic 4ppe4rs Panel ffdlcat(on that the tecperature could exceed che 330'F to Cosputcf tldlcatloA r 4 Ava tMe Upper canes(ra>>nt prcssure (6

UNIT I 2 ISAR 'fRANSIENI TRIP/SAf ECUARD FUNCTION FOR IMPACT OF CONNOM H(OE ALARM/ALTERNATE INDICATION DIAGRAM y CONSEOUENCES OF EVALUATION Of EVEN f TRANSIENT N RX IRIP (FSAR L'I 3 9+

lit cl 'l FAILURE (CNF) OH TRIP fUNCTION STSTEN AVAILABLE UNAVAILABILITTOF DIVERSE ALARN T(.3.( (II) Nigh stcaa flou Lost cxlic onc Avcl ab c lhlch contalraent cqulpaent ls qualified lf the cnd coincident ulth Lo'Lo Tavg llide range RCS tccperature actuation ot CTS ucrc detayed by I to 2 TL.L.II recorders alnutcs. Novever, transalttcrs are tested to (cont'd) (III) Nigh stc<<a flou <00'F and are encased fn thick cast iron cases.

coincident uith Lou stcaa Panel IAdlcatloA It ls expected that the thersaL Lay of these prcsswe (One analysis boc<<ds Cocputer Indication cases can accoccaodatc one or tuo alnutcs of both Units) Stc4a (lou IAdlcatioA delay. CIS actuation ls step 13 of Eaergcncy frolcn on CNF Operating Proccdwc E.O and ls expected soon 0 h r A erat Adica ion after entry Into the procedure. Mhcn CTS Is Lou pressurl ter leveL actuated, It Is expected that both trains uculd deviation be available and that the spray Mould rapidly Lou prcssurltcr lcveL condense the stcaa and cool the cnvlronacnt to Steaa generator high lcvcl tccperatwea uelL belou that calculated in thc dcvi4t ioA analysis of record uhfch assuaes only one train Icc condenser Inlet doors of CIS. This Is expected ulth approxlaatciy one OPCA Minute delay relative to thc analysis of record.

Ccntaincent dclpotnt 4 acnltor (checked at least Ihe ability of lhe operator to respond to once pcr ~ lght hours). available aiaras ard Irdlcatlons and enter thc caergcncy operatiny procedures ls discussed In Section I(.2.5. It fs expected that the delay ln actuaticn of safeguards and protective fc<<ot lone Mould be I alice. Based on this and the discussion above, It ls concluded that a NLE rclcase of the aaynitude of the Llaltlng cases ulth a CNF Mould result fn acceptable consequences, The NLE rclcasa outside of contalrcaent Is analyxcd to ensure survivability of InstrMaents and cquipacnt In the aain ate<<a enclosures. Ihe toLloulng cvalu4'lion Is b4scd CA ~ a<<so dated 11-20-92 froa R.B. gannett to R.S. Sharaa "Cook Nuclear Plant, Failure of Reactor Protection Syst<<a Icpact of steaallne Brcak inside and Outside of Ccntafnacntc. In thlc event, ~ large steaa f lou eventually txlcovcrs the stcaa generator tubcsi 4LLCNIAg tha cxltlng atcaa to bcccae Scpcrhcated fn passing across the tubes.

Superheat ls the priaary concern tor this cvcnt.

Prcssure affects are over ln ~ f<<c seconds, so the reactor protection and safcguerds actuation cyst<<c does not 'ccoe Into play for prcssure effects. The analysis perforsxNf shous that< for the llaltlny breaks (1.0.1.2 ftc), thc reactor trip occurred at 108 seconds or greater based on

UNIT I and 2 I SAR 'IRANS IENI TRIP/SAF ECUARO FUNCTION fOR IHPACT Of CCHHON HCOE ALARHJALTERNATE INDICAIION OIACRAH N CONS(<<UKNCES OF EVALUATION OF EVEN I

'J

'IRANSIENI g RX TRIP (fSAR fAILURE (CKF) ON TRIP STSIEH AVAILAIL.E UNAVAILASILITT OF hand IN. (UNCT ION DIVERSE ALARH L(.3.( Lo<<<<stcaa generator level. Significant Levels LL.L.II of s<<pcrhcat occurred ainutcs later. Since the (cont'd) ctc<<a generator level alar<<<<s uould be reached

<<such earlier than the conservatively calculated stc<<a gcncrato<<'evel sctpolnt, the effects of

<<Cain steaaline brcak on cqulpacnt 3<<auld be ulthln the analyzed bourvfs.

lhe only plausible fast acting break is L.C ft2,

<<hlch predicts ~ reactor trip at 8 seconds on either Lou stcaollne prcssure (Unit 2) or Lou stca<<CIIne pressure colncldcnt ulth high stc<<a f(ou (Unit I). The reactor trip at 60 sccgnds delay (operators response tioe) for I.A ftx ~(88 sec<<<<vff) should still be bo<<xvfcd by the analyzed 1.2 (t~ brcak ulth trip at 108 seconds.

for the c>>st recent aass and energy rclcasc outside ccntainocnt <<>>Lysis a calculation of the heat up of the cast Iron cases uas pcrfor<<acd. Therefore, part of the wargln represented ln the thcroeL lsg due to tha cast Iron hand cases has been used. Noucvcr, tha fact that the transolttcrs have been tested to 400'F does apply to these transolttcrs and provides assurance that thc Instruocnts are Likely to f<<x3ctlon cvcn If the tcspcrature briefly cxcccdcd the qua'Liflcatlon tccpcrature. In

~ dSItlon, in the very uorst sccnarlo, only the Instruacntction assoolstcd ulth rIJPturcd stcac<<

Line end or>> other stcax Line uouid be dac>>gcd.

This ls the case because the ates<<s enclosures for stc<<a Lines one and four exit cental<<vacnt on one atda and the stc<<a enclosures for Linea tuo three exit IEO'uay on the opposite aide of the cental<<vacnt. Therefore tuo stcaa (inca 3<<1th f<<C3ctloning Instruacntation are available to controL the cysts<<a <<x3til lt can be placed bn RNR ln this Horst case scenario. Sated on this and the discussion above, It ls ccncludcd that a HLE release of the s>>Snit<<xfe of the LI<<siting cases ulth a CHF uould result In acceptable cense<<ptnccs ~

- (8-

APPENDIX B OT A L CABLE EV S FSAR Section 14 3 3 This section addresses the me'chanical forces from LOCA, Design Basis Earthquake (DBE), and combined LOCA/DBE.

The Unit 2 FSAR documents the applicabili.ty of leak before break to Cook.

The most recene analyses of this type are described in WCAP 11902 and the Unit 2, Cycle 8 RTSR.

These evenes consider approximately the first second of ehe transient and are not impacted by protection or safeguards actuation.

FSAR Section 14 3 7 This section addresses the overpressuriration of the vessel after cooldown. The UFSAR material from 1982 appears not to address the ERG based EOP's.

The current maeerial is the ERG background material. The ERG material is symptom based. Actions required of the operator are based on the results of an analysis based on a step temperature change in the cold leg. The initial temperature was chosen to be a conservatively high 550 F. The actions are then based on the observed temperature during ehe course of the implementaeion of ehe EOP's. The eemperature and pressure are moni,tored continuously throughoue the application of the EOP's by staeus tree F-0.4, Integrity. (If one exceeds curve A of the staeus cree criterion, a soak time is required). See p.p. 4, 8 of F-0.4 background and p. 5 of FR-P.1 background. Based on the nature of the ERG analysis, this event is noe believed eo be impacted by a common mode failure of the new digital equipment.

This opinion was discussed with Satyan-Sharma on Hov. 13, 1992. He concurred.

FSAR ection 4 3 8 This section describes an analysis to show that the RCS will not depressurize below the Nz injection point from the accumulators prior to the time when S.G.

cooling is no longer needed for SBLOCA. Cases with and without operator action are considered.

This material is superseded, or at least modified, in view of the ERG based EOP's. Operator action is provided as required for any event to ensure isolation of the accumulators prior to the injection of nitrogen into the reactor coolant system. At least the following events were addressed. (The step numbers are ERG numbers not EOP numbers).

LBLOCA E-1 Loss of Rx or Secondary Step 1S Coolant SBLOCA ES-1.2 Post LOCA Cooldown and Step 23 Depressurization Loss of Sump ECA-1.1 Loss of Emergency Steps 23, 31 Recirculation Coolant Recirculation Steam Break/4 Loop ECA-2.1. Uncontrolled Steps 10, 38 Depressurization of all S.G.'s ECA-3.1 Recovery Modes Step 28 ECA-3 ' Step 23 Inadequate Core FR-C.1 Response to ICC Step 12 Cooling Degraded Core FR-C.2 Response to DCC Step 12 Cooling 1't should be noticed that the issue is more broadly addressed in the ERG's than in the UFSAR.

The UFSAR cases with no operator response are irrelevant to this evaluation because operator response must be achieved on the loss of nearly all protection and safeguards actuations to achieve a satisfactory outcome. The operator action cases are superseded by the ERG analyses.

The ERG decision to isolate the accumulators is based on observable parameters and is not impacted by an additional delay of =1 minute. The ERG analyses in suppor~ of SBLOCA's (1" break) show that the accumulators will be isolated on subcooling not on low primary pressure.

For larger breaks, those for which primary pressure stabilizes at or belo~

approximately 300 psig, the accumulators are isolated after the accumulators have injected. See response not obtained for step 15 of E-l.

In conclusion, the ERG's address the issue in Section 14.3.8 more currently than the FSAR. The ERG's are symptom based and address a wide range of contingencies.

They are not directly affected by an additional delay of ~1 minute in obtaining a protection or safeguards action. They are designed in sufficient depth to provide assurance that a unit can be brought to a safe and stable condition following any accident.

FS Sect on 14 4 This section is a general description of the analysis of high energy line breaks outside of containment. The material in this section is further elaborated in sections 14.4.3 through 14.4.11. A high energy line is a line with normal service temperature above 200 F, a normal operating pressure above 275 psig, and a nominal diameter greater than 1 inch. Five systems were determined to include high energy lines. They are:

1) Main Steam

2) Feedwater

3) CVCS

4) S.G. Blowdown

5) Steam to TDAFP Breaks in high energy lines were examined for:

1) Pipe Whip

2) Jet Impingement

3) Jet Erosion of Concrete

4) Compartment Pressure - Loading Stress

5) Structural Resistance to Loading

6) Equipment E.Q.

Item 3 was determined not to be a problem in general. Breaks were analyzed for criteria 1, 2, 4, 5, and 6. Cracks were analyzed for 1, 2, and 6.

An ESW flood incident is also included in this section.

No impact of the postulated freeze" of the Foxboro digital software on these analyses or those of Sections 14.4.3 through 14.4.11 was identifiqd except as indicated in the following comments.

FS Section 14;4 3 This section addresses, in a general way, the ability to bring the reactor to a safe condition following the events evaluated for high energy line breaks. As indicated on p 14.4.3-1 of the Unit 1 UFSAR, they are general because deemed appropriate to allow for assessment of the incident prior toiultimately "it is bringing the reactor to cold shutdown".

Main steamline breaks'(MSLB) are discussed in section 14.2.5 from the point of view of core response and in section 14.2.7 from the point of view of offsite dose effects. MSLB outside of containment from the point of view of equipment qualification (EQ) is addressed in UFSAR sections 14.4.6, 14.4.10, and 14.4.11.

The evaluation of the impact of common mode failure (CMF) of the new digital equipment on MSLB EQ has been placed in section 14.4.11.

Feed water line break was analyzed from the core response point of view in section 14.2.8. The NK release from a feedline break is believed to be similar with or without CMF. Unit 2 UFSAR Figure 14.2.8-4 suggests that the affected S.G. blowdown for a feedwater line break takes =200 sec. By this time, it is believed that the operator will be well into his immediate actions. Steamline isolation is step 12 of E-0. The operator will certainly be well into immediate actions, if there is a turbine trip. If there is no turbine trip, the turbine is a significant competitor for steam from the intact steam generators. Failure of a steam generator stop valve would also not be assumed in addition to the multiple failures of the CMF. Therefore, blowdown of the mainsteam lines would not occur after manual initiation of mainsteamline isolation.

CVCS line break assumes operator action. The alarms assumed continue to be available from the control system,. and therefore, are not affected. This description is not affected.

Both the turbine driven auxiliary feedwater pump and steam generator blowdown line rupture are considered to be small steamline ruptures according to the UFSAR. Therefore, their effects would be expected to be bounded by MSLB and feedwater line break.

No impact of the postulated "freeze" of the Foxboro digital software on events other than MSLB was identified. Since MSLB will be discussed under section 14.4.11, the section is classified as NA.

PSAR Sect on 4 4 4 This section provides the quantitative results of stress calculations for high energy line breaks. See the discussion of Section 14.4.2 above.

FSAR Section 14.4.5 This section provides some further elaboration on the pipe whip analysis. See the discussion of Section 14.4.'2. Note that this analysis uses the maximum operating pressure for conservatism.

FSAR Sect on 14.4 6 This section provides further details on the pressure analysis outside

~

containment due to a high energy line break. The pressure peaks appear in the first second or two and cannot be impacted by an increase in time until reactor trip. Therefore, the pressure peak aspect of this section is classified as not applicable.

Temperature peaks are =5 minutes into the event presumably due to heat sinks.

The impact of steam generator superheat from a MSLB outside containment on equipment qualification is addressed in this section. Without automatic safeguards functions, the environmental conditions could potentially be worse.

The equipment qualification aspect of this section is combined with Section 14.4.11 where event+ which impact environmental conditions and which are mi~iga~ed by protection and safeguards actuations are discussed. These events are mass and energy release inside and outside containment.

FSAR Section 14 4 7 This section provides some further elaboration on the jet impingement analysis.

It also uses the maximum operating pressure. See the discussion of Section 14.4.2.

FS ect on 14 4 8 This section describes the impact of high energy line breaks on the containment exterior. See the discussion of Section 14.4.2.

~ ~ - FSAR Section 14 4 9 This section describes the modifications required by the high energy line analysis. It will not be affected by the Foxboro "freeze".

F AR Section 4 4 0 This section describes the steps taken to'nsure that the'dverse environmental conditions that result from HELB do not inhibit the ability to bring the reactor to cold shutdown. Without automatic safeguard functions, the emrironmental conditions could potentially be worse. This section is combined with Section 14.4.11'here events which impact environmental conditions and which are mitigated by protection and safeguards actuations are discussed. These events are mass and energy release inside and outside containment.