ML20023D606
| ML20023D606 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs, 05000000 |
| Issue date: | 03/05/1982 |
| From: | Tiernan J BALTIMORE GAS & ELECTRIC CO. |
| To: | Burdick G NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| Shared Package | |
| ML20023A436 | List: |
| References | |
| FOIA-83-123 NUDOCS 8305240269 | |
| Download: ML20023D606 (35) | |
Text
L ' r:f f J ^ T CLiH:
BALTIMO RE GAS AND
. ELECTRIC CHAR LES CEN1 ER. P. O. BOX 1475. BALTIMOR E, M ARYLAN D 21203 JOSEPH A TICRNAN MAhaw n Peut *6 tan POwt h Dcpante4C NT March 5, 1982 Mr. Gary R. Burdick, Chief Reactor Risk Branch Division of Risk Analysis Office of Nuclear Regulatory Research Washington, DC 20555 Gentlemen:
A recent phone conversation between Mr. James Curry, of your staff, and Mr. P. A. Pieringer, of our Liccasing and Safety Unit, indicate that our perceptions of the Reactor Safety Study Methodology Appli-cations Program (RSSMAP) are quite different.
It was our under-standing that RSSMAP provided a general outline which the Interim Reliability Evaluation Program (IREP) would be able to expand and refine. As a result of improved methodologies, better funding, utility involvement, and the use of a more current data base we e
believed the results of IREP would supersede those of RSSMAP. This impression was reinforced by your staff during our combined effort in the IREP development. Baltimore Gas & Electric Company representatives on the IREP project understood that RSSMAP was a first generation study. Because of its limited data base and simplified methodology, our staff believed it; only purpose was to establish a cicar area which second generation studies would precisely define. When RSSMAP results did not materialize until well after 1 REP was underway, it was perceived that RSSMAP was no longer relevant as IREP had already achieved what RSSMAP was designed to accomplish.
In your letter of January 22, 1982, to Mr. R. C. L. Olson, the RSSMAP report was provided to us for comment. A review was completed on February 12, 1982, which verified the accuracy of operational parameters and system descriptions. Those review comments are attached for your consideration.
Lengthy corrections and justifications are supplied on Attachment (1). Minor and grammatical corrections are shown in the highlighted sections of Attachment (2). Any questions concerning these comments may be directed to Mr. P. A. Pieringer nt (301) 269-4971.
8305240269 830331 PDR FOIA SHOLLYB3-123 PDR A (1
Mr. Gary R. Burdick March 5, 1982 We would like' to emphasize that our review did not include a study of the methodology. To accomplish such a study would require a significant dedication of resources similar to that of the IREP study. Even a cursory review at this point would be difficult, as portions of the RSSMAP report for Calvert Cliffs lack adequate data presentation and logic characterization to adequately evaluate the validity'of assumptions and results. With the IREP program near completion, we would find it difficult to allocate resources for a review of the RSSMAP methodology. Additionally, I would like to point out that our decision to support IREP was based in part on our understanding that it provided a significant step forward in risk assessment methodology. As a consequence, we have concentrated efforts on developing and reviewing what we considered the better methodology. _
If this report is to be published, a clear statement of the study's assumptions and limitations should be included. The report should also address the modifications which have been made and those sched-uled to be made at Calvert Cliffs which would affect the study's results. Finally, references should be made to the IP2P study, as appropriate, to aid the reader and provide better perspective on the results..
Based on the most re' cent communication between our ' organizations, our staf f understands the Calvert Cliffs IREP study results are
. undergoing further review because of their divergence from other probability studies. We rec'ognize your concern for this divergence, but think it can be attributed to the methodology improvements ad-dressed in this letter, and, specifically, to the improved system-modeling. The IREP study points out that, ".Recent evidence tends to suggest that plant-to-plant differences in design and operation may give rise to significant differences in the likelihood or course of accidents."
We appreciate the opportunity to comment on the RSSMAP study, and request that you clarify the exact purpose of the report. If this purpose is different from our understanding, we would appreciate further communications on the subject prior to the RSSMAP publication.
The exact status,of the IREP study has also become uncicar, and any information pertaining to the further development of its results would be helpful.
[
1 Should you have further questions regarding this matter, please contact
~
us.
Very truly yours, WA-~
l JAT/ PAP /gla L
?
Mr. Cary R. Burdick March '5, 1982 i
cc: Messrs. A. E. Lundvall, Jr. (w/o Attachments)
L. E. Russell (w/ Attachments)
R. E. Denton (w/o Attachments)
D. W. Latham (w/ Attachments)
R. C. L. Olson (w/ Attachments)
S. M. Davis (w/ Attachments)
R. N. M. Ilunt (w/ Attachments)
Ms. M. C. Key (w/o Attach: tents)
Dr. M. Rousch (w/ Attachments)
D. H. Jaffe (NRC)
(w/ Attachments)
J.
Curry (NRC)
(w/ Attachments)
File M
O
^%
I Y :._
ATTACHMENT 1 C0tV1 Erit AflD CORRECTIONS TO "RSStiAP MlALYSIS OF CALVERT CLIFFS UtilT 2" 1.
Figure 3-1 shows a common supply line for the auxiliary feed and normal feedwater systems.
Each system should have its own feed
-header going to the steam generator.
2.
In the cut set term descriptions (pgs. 6-6, 6-10, 6-15, 6-19, and 6-26) the term SW12DGT1 designates failure of Service Water System (SRW) train #12 which results in failure of #12 diesel generator.
Only failure of the jacket water coding control valve in that train, in conjunction with the failure of the counterpart valve in the #21 SRW train, would cause a loss of #12 diesel generator due to inadequate jacket cooling.
Any other failure in the #12 train would result in a low train pressure.
This low pressure would cause the control valve supplying #12 diesel generator to shut and the interlocked control valve in train
.i21 to open thereby maintaining jacket cooling.
It is unclear whether the probability number assigned to the term accounted for this type of system action.
3.
In the cut set term G2T1 (pgs. 6-20, 6-27, and B14-16) the text refers to a diesel generator #22.
Calvert Cliffs has only three emergency diesels which are accurately described in the electrical descriptions of the RSSMAP.
If the diesel numbering was an error for this cut set term, then only a correct replacement number is needed.
If the term was introduced to account for a #22 diesel generator, it should be deleted. Also, on page B14-16 the cut set term SW22DGT1 is introduced for the failure of #22 diesel generator.
This tem should also be deleted to accurately reflect Calvert Cliffs electrical system.
4.
In the cut set term RASA1 and TASBl (pgs. 6-23, 6-24, and 6-29) the containment spray pump is referenced as having a water cooled seal.
These pumps actually have air cooled seals. The term CSRS should be deleted from the term descriptions.
5.
The auxiliary feedwater system discussion on page 6-33 indicates that any new infonnation will be incorporated into the final publication. At this time the following information is available:
.The auxiliary feedwater system upgrade currently in progress will result in a three train automatically initiated system with two steam driven pumps and one electrical pump.
Completion for Unit 2 is scheduled for the end of 1982 Unit 2 refueling outage.
6.
Diesel. generators #11 and #21 have the capacity of serving ESF buses
- 11/#21 and #14/#24, respectively, but normally' diesel generator
- 12 is lined up to carry buses #14 and #21.
tiumber 11 diesel generator normally carries #11 bus and #21 diesel generator nonnally carries #24. bus. Manual breaker and disconnect alignment must be accomplished to do otherwise.
(PageB1-6,Section2.2,First Paragraph)
7.
The three minute operating time for a diesel assumes the Jacket cooling trip is the mechanism that shuts down the diesel.
During LOCA conditions, however, this is not true. With a SIAS signal present, the jacket cooling temperature trip will be bypassed.
The diesel generator will continue to run until the damage incurred causes a trip by some other mechanism.
(PagesB1-10,B1-18) 8.
In addition to the items listed on pg B1-20, the following components would also be powered, if required.
- 12 DG
- 21 DG a.
Switchgear Room AC a.
Switchgear Room AC Compressor #21 Compressor #22 b.
Boric Acid Pump #21 b.
Control Room AC Compressor c.
Charging. Pump #21 c.
Boric Acid Pump #22 d.
Containment Filter d.
Charging Pump #22 Unit #21 e.
Containment Filter Unit e.
Containment Coolers.
- 22
- 21, #22
- f. - Containment Coolers #23, #24 9.
All part length rods have been removed.
(Pages B3-1, B3-2)
- 10. Table 3-1 gives power level trip setpoints' for < 4 pump operation.
Presently Calvert Cliffs u~ses only a four pump operation and will
~
continue to do so until the Safety Analysis is completed for-the other combinations.
- 11. The highlighted sentence on attached page B4-2 (see Attachment 2) does not make sense.
If the intent was that all isolation valves have automatic control switches in the Control Room, this is not so. Type IV do not because they are always shut unless manually opened.
- 12. There are audible and visual alarms for both pressure and level. on the safety injection tanksi The instrumentati'on which thetext :is addressing consists of limit switches and level transmitters 'for measuring level and pressure switches and. pressure transmitters for measuring pressure.
(Page BS-2)
- 13. The recirculation mode of operation for the low pressure safety injection system can be manually initiated, but only after the refueling water tank low level is cleared.
(This low level-
' is what automatically initiates RAS).
(PagesB7-2,B7-6)
~
w
4 3-
- 15. The following information should be added to the list of protective action signals.
(PageB10-2)
G.
Chemical and Volume Control System Isolation Signal (CVCSIS) i
- 16. The following actions will complete the list on page B10-4.
SIA4/ SIB 4 A) Open BA Gravity Feed Isolation (SIA4 Only)
B) Close 1 BA Recirc Valve C) Close VCT Make-up Valve (SIB 4 Only)
D) Open BA Feed Pump MOV-514 (SIB 4 Only)
E) Open Hot Leg Sample Valve F) Close Cont. Header Waste Gas Hdr Vent (SIB 4 Only)
G) Close RC Sample Line Valve (SIB 4 Only)
H) Closes 2 SI Loop Leak Test Valves j
SIA5/ SIB 5 B) Closes 1 RCP Seal Bleed-off C)' Closes 1 Letdown Stop Valve
_. D) Close VCT Discharge Valve (SIA5 Only)
SIA6/ SIB 6 A) Open'BA Gravity Feed Isolation (SIA6 Only)
B) Start 1 BA Pump C) Start 1 Charging Pump SIA7/ SIB 7 Omit Item F s
Delete Footnotes at bottom of page SIA9/ SIB 9 D) - Closes ~ Various Sample Valves E) Opens 1 Service Water Heat Exchanger Saltwater Outlet Valve F) Closes RC Drain Tank' Pump Discharge CV-4260 (SIA9 Only)
G) Secures Purge Air Supply and Exhaust Fans (SIA9 Only)
H) Closes Cont. Normal Sump to Drain Tank MOV-5462 (SIA9. Only)
I) Closes Cont.-. Purge Air Supply-and Discharge.
' ~
+ =
Isolations:(SIB 9 Only)'
- h-
~
J) Closes 1 Cont. Norm Sump to Misc. Waste NOV-5463 (SIB 9Only)
SIA10/ SIB 10:
A) 0' pens 2 SI' Tank Isolation _ Valves 1
+
~
4 mg
.m st:.
gr
'ra a
.-mg
.L r
- sg i
i..
I'
- 17. The following information will complete table B10-1 on page B10-14.
SIA4 MOV-509 CV-661 CV-510 CV-628 MOV-6579 CV-618 CV-2180 CV-5467 SIB 4 CV-511 CV-638 MOV-514 CV-648 CV-5464 CV-512 SIA5 CV-506 MOV-501 CV-515 SIB 5 CV-505 CV-516 SIA6 MOV-508 Boric Acid Pump #21 Charging Pumps #21, #23 SIB 6
~ Boric Acid Pump #22 Charging Pumps #22, #23 SIA7 Omit CV-5210 SIA9 MOV-5462 Purge Air Supply Fan #21 CV-1410 CV-5465 CV-5210 CV-1412 CV-5466 CV-5291 CV-4260 Purge Air Exhaust Fan #21 SIB 9 SV-6529 CV-1411 MOV-5463 SV-6531 CV-1413 CV-2181 CV-5292 CSA1 Containment Coolers., #21, #22.
CSB1 Containment Coolers-
- 23, #24 CSA3 Change 1598 to 1596 CSB3 Change 1599 to 1597 RASB1 CV-5212
l 18.
flumber #12 diesel generator receives cooling water from service water system (SWS) train #12 or from Unit 2 train 21. The control k
k
~
valves regulating water to the diesel generator are interlocked such that a low pressure on train #12 will cause the train #12 control valve to shut and the train #21 control valve to open.
Because of this the cooling water systems are independent with the exception of the tie point at the #12 diesel generator jacket cooling water supply line.
(PageB14-16)
- 19. Steam is dumped to atmosphere by the atmospheric dumps, not the safety valves. The safety valves are designed to provide back-up reflief capability.
(pageA2-9) 20.
Currently, Calvert Cliffs does not have a procedure for reducing steam generator pressure as the paragraph on page A2-9 indicates.
- 21. Section 3.2.7 on page 3-7 refers to a low pressure recirculation system.
Calvert Cliffs does not make use of a low pressure recirculation system, although the safety injection system has the potential in doing so. Presently, a recirculation actuation signal (RAS) sends a lock-out signal to the LPSI pumps.
The lock-out signal is removed'when the RWT low level has been cleared.
- 22. The assumption that the core will melt if _ the ' auxiliary feedwater system (AFW) is lost is not correct. The core will melt if both the AFW and power conversion systems are lost.
h E
Airac H m E A/T 2-Table 1-1.
Major Characteristics of RSS and RSSMAP Studied Plants RSSMAP PLANT RSS PLANT USED FOR COPE RISON Sequoyah #1 PWR Surry PWR
- Reactor Vendor - Westinghouse Reactor Vendor - Westinghouse Architectural Enginaer -
Architectural Engineer - Stone Tennessee Valley Authority and Webster Engineering Corp.
Four Reactor Coolant Loops Three Reactor Coolant Loops 1148 MWe 775 MWE Dry Subatmospheric Containment Ice Condenser Containment lommercial Operation on 12/72 Now in low power testing Oconee #3 PWR Reactor Vendor - Babcock and Wilcox Architectural Engineer - Duke Power Co. with Assistance from Bechtel Power Corp.
Two Hot Leg Reactor Coolant SURRY PWR Loops Four Cold Leg Reactor Coolant Loops 886 MWe Dry containment Commercial Operation 12/74 Calvert Cliffs #2 PWR Reactor Vendor - Combustion Engineering Architectural Engineer -
Bechtel Power Corp Two Hot Leg Reactor Coolant SURRY PWR
. Loops Four Cold Leg Reactor Coolant Loops 850 MWe
!77 Dr Containment h3 [dM5b10Mk4
- Grand Gulf fl BWR Peach Bottom BWR Reactor Vendor - General Electric Reactor Vendor - General Electric Co.
Co.
Architectural Engineer -
Architectural Engineer -
Bechtel Power Corp.
Bechtel Power Corp.
BWR/4 Design BWR/6 Design 1065 MWe 1250 MWe Mark I Containment Mark III Containment Commercial Operation 7/74 Commercial Operation scheduled for 1981 1-3,1-4
3.0 GENERAL PLANT DESCRIPTION AND DIFFERENCES FROM RSS PLANT The likelihood of certain accident sequences and the factors which cause an accident sequence to dominate the risk associated with a plant are clearly dependent on the plant design.
In this section, significant design differences between the Calvert Cliffs and Surry units are summarized.
Detailed system descriptions and reliability estimates are presented in Appendix B.
The Calvert Cliffs reactor units each have two steam gener-ators and two steam generator loops designed by Combustion Engineering; the S'urry units have three steam generators and three loops designed by Westinghouse.
Each Calvert Cliffs reactor unit power is 850 MWe; the Surry units each develop 788 MWe.
Both containments are the dry type.
The Csivert Cliffs containment PREnHEs5EP construction is a pzetressedireinforced concrete cylinder and dome with a steel liner.
The design pressure is 50 psig.
The Surry containment is of reinforced concrete design with a steel liner and has a design pressure of 45 psig.
The Calvert Cliffs contain-ment free volume is 2 x 106 ft3 while Surry's is 1.8 x 106 ft3, There are several important differences in the safety systems between the plants which perform the LOCA.and transient engineered safety functions (ESF).
These differences' are the result of dif-ferent systems present at the Calvert Cliffs plant as well as many differences in piping and circuitry configurations, system success criteria, and test and maintenance intervals for systems which ap-pear at both plants.
Some of the more obvious dissimilarities can be seen in Figures 3-1 and 3-2 which depict Calvert Cliffs and Surry
.ESFs with related system components in a simplified manner.
3-1
tlTil;C HME rJT
.?.
to the miscalibration of the battery charger charging rate which causes the batteries to degrade and fail upon demand following a loss of off-site power.
This common mode was judged to be appli-cable to the Calvert Cliffs emergency on-site power control 125-volt DC subsystem.
The unavailability estimate for this subsys-tem is greater than two orders of magnitude higher than would have been estimated using the RSS method.
3.2.3 Reactor Protection System (RPS)
The RPS for both Surry and Calvert Cliffs are actuated by in-terrupting power to the control rod assemblies (CRA) but the method fc r doing co is significant1y dif ferent.
The Surry RPS accomplishes the reactor trip by de-energizing combinations of one-out-of-two pri-
~
mary circuit breakers via the logic channels.
In the Calvert Cliffs RPS each measurement channel which can initiate protective action operates a channel trip unit containing three sealed electromagnet-ically actuated reed relays.
The Surry RPS logic employs three sensor logic channels feed-ing into two output trains which, in turn, input to the circuit breakers.
The Calvert Cliffs sensor logic is a two-out-of-four sys-tem whereas the Surry sensor logic is a two-out-of-three system; P
i.e., any two of the logic channels will trip the reactor when an abnormal condition occurs.
Calvert Cliffs RPS unavailability is lower than Surry's by I
a factor.of two.
This is due to the fact that a recent-NUREG re-
?
b port Qefeken~cE38 has indicated that the Surry RPS failure due to three or more rods f ailing to drop into the core is over conserva-
^
tive and was assessed as insignificant-for Calvert Cliffs.
i 3-5
~ '
3.2.4 Containment Leakage (CL5_
As discussed in the main report, insights from WASH-1400 were used wherever possible to evaluate the reliability of each part of the Calvert Cliffs design.
Thus, on the basis of the WASH-1400 analysis, and in consideration of the leak tests required by tech-nical specifications, structural failure of the containment shell, failure of the blind flange on the refueling tube and major leakage through the equipment hatch were not judged to be dominant contri-butors to the CL probability.
Further, the probability of a sig-nificant -leakage path through the containment spray injection line was not judged significant because, unlike Surry, Calvert Cliffs uses the same line for containment spray recirculation as for in-jection.
Back leakage through the LPIS lines was also judged not significant because of the numerous check valves in each line.
Conversely, dominant contributors to the Calvert Cliffs CL probability, which were not present at Surry, developed from the difference between Surry's subatmospheric design and Calvert Cliffs
~
atmospheric containment.
Specifically, the probability of signif-icant open' penetrations of the containment which go unnoticed for some time was precluded at Surry because normal operation requires internal containment pressure to be significantly below atmospheric
- pressure, i.e.,
the' containment is constantly leak tested.
- However, at Calvert Cliffs, where there is no constant leakage monitoring NEAR system and the containment is keptlyT7btmospheric pressure, a sig-nificant. unnoticed leakage path was judged to be more likely, re-sulting in a CL probability of at least three times that of Surry.
.3-6
_i._ -
l 5-3 and discontinuities to resist local moments and shears. The basic design k
criterion is that the integrity of the liner b[ maintained under all antici-
. pated load conditions and the structure shall have an elastic, low-strain response under all design loadings. The post-tensioned tendons are stressed
'to 80 percent of ultimate strength during installation and perfom at 50 to 60 percent during-the lifetime of the contafroent.
Some of the principal design parameters for the containment building are as follows:
Inside Diameter (131.5~ ft? 13 o Inside Height 180.0 ft7 1s166 E
Vertical Wall Thickness 3.75 ft Dome Thickness 3.25 ft Foundation Slab Thickness 10 ft Liner Thickness 0.25 in Free Volume 2,000,000 ft 3 Design Pressure 50 psig Design Leak Rate 0.33 v/o per day In the absence of detailed information on the sizing and placement of reinforcing in the struc'ee and given the limited scope of the study, it was not possible to perfom a detailed analysis of the structure to define an expected failure level.
On the basis of available infomation on the de-
-tails of the structure and limited analyses, it was initially estimated that the yield strength of the prestressing tendons, as defined by one percent defomation, would be reached at an internal pressure of about two times the design level. Relative little additional load bearing capacity would be gained in going to the ultimate strength of the tendons. A failure pressure of twice the design level, or 115 psia, was assumed in the initial analyses of this study.
If consideration is given to the strength of the conventional reinforcing steel, that of the containment liner, effect of dead loads, etc.,
a somewhat higher nominal failure level can be derived. A failure pressure of 135 psia was used, where applicable, for the derivation of the probabilities of the several containment failure modes.
As utili:ed here, the failure pressure is not a single discrete value, but a continuous variable with a cumulative probability distribution.
Cut Set Term Descriptions W -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.
P(W) = 1.3 x 10-2, V -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.
P(V) = 1.3 x 10-2, E2T1 -- Failure of Salt Water System pump 822 to restart and continue running after a loss of offsite power.
This pump helps to provide pump seal cooling for the LPRS and HPRS.
P(E2Tl)
=
3.5 x 10-3, G2T1 -- Failure of Service Water System pump #22 to restart and continue Junning after a loss of offsite power.
This pump is needed to provide jacket cooling for diesePL 322iand See **Y83 O N A 8'* b b secondary cooling for the CARCS fan coolers.
P(G2Tl)
=
3.5 x 10-3, Most of the cut sets liste[ above are characterized by double recirculation pump cooling faults either caused by_ diesel generator failures or cooling water hardware faults.
Several of the cut sets involve sump suction failures along with diesel generator failures.
The dominant containment failure mode probabilities and release category placements for Sequence T MQ-H are assessed to be:
I P(a) = 0.0001; Category 1 P(7 + 6 ) = 0.7; Category 3
~
P(0) = 0.007; Category 5 P(E) = 0.3; Category 7.
. Multiplying the sequence frequency by the containment failure mode probabilities gives the values presented in Figure 6-1.
6-20 v.
s
~
S m
.e
Cut Set Term Descriptions D21ST -- Diesel #21 unavailability due to maintenance or start failures.
Diesel is needed to provide power to various components after a loss of offsite power.
P(D21ST)
=
3.6 x 10-2, D12ST -- Diesel 112 unavailability due to maintenance or start failures.
Diesel is needed to provide power to various components after a loss of offsite power.
P(D12ST)
=
3.6 x 10-2, NR -- Failure of the operator to close the PORV block valve or repower failed components given that one or both diesel 1.0 x 10'l.
generators are operating.
P(NR)
=
F2 -- Failure of several control valves in Service Water System train #22 which are needed to provide jacket cooling for diesel generator #21.
The diesel will f ail without jacket cooling.
Diesel #21 is needed to power various components after a loss of offsite power.
P(F2) = 2.4 x 10-2, R21 -- Failure of room cooler #21 which causes failure of one train 1.9 x 10-2, of CSRS, LPRS, and'HPRS.
P(R21)
=
R22 -- Failure of room cooler #22 which causes failure of one train 2.5 x 10-2, of CSRS, LPRS, and HPRS.
P(R22)
=
SW12DGT1 -- Failure of Service Water System train #12 to provide jacket cooling for diesel generator fl2.
The diesel will fail without jacket cooling.
Diesel #12 is needed to power various components after a loss of offsite power.
P(SW12DGTl)
=
3.2 x 10-2, W -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.
P(W) = 1.3 x 10-2, V -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.'
P(V) = 1.3 x 10-2, RASCM -- Common mode failure of the CSRS, LPRS, and HPRS due to miscalibration of both recirculation actuation system RUST level sensors.
P( RASCM) = 1.0 x 10-3, RASAl -- Failure of recirculation actuation subchannel Al which signals open the salt water inlet and outlet valves of com-ponent cooling water heat exchanger.921.
The heat exchanger provides pump seal cooling for the LPRS, %3UdI, and HPRS during recirculation.
P( RASA1) = 5.0 x 10-3, See Halef w wramar one
Cut Set Term Descriptions RASBl -- Failure of recirculation actuation subchannel B1 which signals open the salt water inlet and outlet valves of com-ponent cooling water heat exchanger #22.
The heat exchanger provides pump seal cooling for the LPRS, CJGdG and HPRS SEE NOTE M during recirculation.
P(RASSI) = 5.0 x 10-3 og 3rac# f.
B -- Failure of several HPRS train #21 components.
P(B)
=
7.0 x 10-3, C -- Failure of several HPRS train #23 components.
P(C)
=
7.0 x 10-3, -
The dominant cut sets listed above are characterized by failure of the CSRS and all emergency coolant recirculation systems due to combinations of room cooling, actuation, suction line, and diesel
, generator faults.
The dominant containment failure mode probabilities and' release category placements for Sequence T MQ-FH are assessed to be:
I P(a) = 0.0001; Category 1 P( 7 + 6 ) = 0.7; Category 2 P(S) = 0.007; Category 4 P(E) = 0.3; Category 6
~
Multiplying the sequence frequency by the containment failure
~
mode probabilities gives the~ values presented-in Figure 6-1.
Secuence T1MQ-CYD a, 6, S :
This sequence'is initiated by a loss of offsite power.(T )
I followed by a failure of the Power Conversion System (M), a relief valve opening-and then failing to reclose (Q), and failures of the Containment Spray Injection System (C), the Containment Air 6-24
Cut Set Term Descriptions G2T1 -- Failure of Service Water System pump 922 to restart and continue running after a loss of'offsite power.
This pump is needed to provide jacket cooling for diesel $22* and secondary See Abnc 3 cooling for the CARCS fan coolers.
P(G2Tl) = 3.5 x 10-3, oaAnAcNi.
The dominant cut sets listed above are characterized by f ailures of both diesel generators due to hardware or jacket cooling faults.
The dominant containment failure mode probabilities and release category placements for Sequence T MQ-CYD are assessed to be:
I P(a) = 0.0001; Category 1 P(6) = 0.8; Category 2
?( 6') = 0.2; Category 3 P(S) = 0.007; Category 4 For this sequence, the overpressure containment failure due to gas generation was split into 6 and 6'.
The 6' represents delayed overpressure failure relative to core melt.
Multiplying the sequence frequency by the containment failure mode probabilities gives the values presented in Figure 6-1.
Sequence T MO-H a, Y, 6, p, c :
2 This sequence is initiated by a loss of feedwater with offsite power available (T M) followed by a relief valve opening and then 2
failing to reclose (Q), and a f ailure of all emergency coolant recirculation (H).
Containment failure is predicted to occur from an in-vessel steam explosion (a), overpressure due to hydrogen 6-27
Cut Set Term Descriptions M -- Total interruption of the Power Conversion System.
P(M) 1.0
=
due to the initiating event.
y -- Probability that the PORVs are demanded.
P(P1) = 7.0 x 10-2, P
O -- Failure of a PORV to reclose given it opens.
P(Q) = 8.0 x 10-2, NRB -- Failure of the operator to close the PORV block valve.
1.0 x 10-1 P(N RB)
=
N1 -- Failure of the salt water inlet or outlet valves of component cooling water heat exchanger #22.
This heat exchanger helps supply pump seal cooling during recirculation for the LPRS and HPRS.
P(N1) = 2.4 x 10-2, S1 -- Failure of the salt water inlet or outlet control valves of component cooling water heat exchanger #21.
This heat exchanger helps supply pump seal cooling during recirculation for the HPRS and LPRS.
P(S1) = 2.4 x 10-2, R1 -- Failure of several control valves in the Component Cooling Water System which affect pump seal cooling for the LPRS and 1.0 x 10-1 HPRS.
P(Rl)
=
R22 -- Failure of room cooler (22 which causes f ailure of one train of CSRS, LPRS, and HPRS.
P(R22) = 2.5 x 10-2, R21 -- Failure of room cooler 121 which causes failure of one train of CSRS, LPRS and HPRS.
P(R21) = 1.9 x 10-2, RASAl -- Failure of recirculation actuation subchannel Al which signals open the salt water inlet and outlet valves of com-ponent cooling water heat exchanger 121.
The heat exchanger provides punp seal cooling for the LPRS, CSE55 and HPRS during recirculation.
P(RASA1) = 5.0 x 10-3 See udYe Y oc nyten L ~
RASBl -- Failure of recirculation actuation subchannel B1 which signals open the salt water inlet and outlet valves of com-ponent cooling water heat exchanger #22.
The hpat exchanger provides pump seal cooling for the LPRS, $$1GR, and HPRS during recirculation.
P(RASB1) = 5.0 x 10-3 See ^ ora #
oM nrAcy L W -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.
P(W)
=
1.3 x 10-2, V -- Failure of valves in one of the containment sump recirculation lines which fails one train of CSRS, LPRS, and HPRS.
P{V)
=
1.3 x 10-2, 6-29
Their research has shown that one spray subsystem or one fan cooling unit will provide adequate pressure control during both the injection and recirculation phases.
(Dering the recire-ulation phase, heat must also be extracted from the spray water via the CCW heat exchanger.) This more realistic criteria will therefore be used.
2.1.3 Post Accident Radioactivity Removal Su _.ss Criteria In addition to its depressurizatien functico, the containment spray system scrubs the containment a ;mosphere of radioactive materials.
The operation of one spray subsystem is adequate to perform this function during both the injection and recirculation phases.
2.1.4 Emergency Core Cooling Success Criteria The Calvert Cliffs FSAR states:
" Analysis of the loss-of-
~
coolant incidents are performed assuming minimum engineered safety features which includes only one high pressure pump, one low pressure pump, and four safety injection tanks (one spilling through the break). "
This FSAR criterion was used for the large
~
(A) LOCA analysis.
Because of the slow pressure decay following Si and S2 LOCA's, it is assumed that only the high pres'sure system is applicable.
For the small (SI) LOCA, the flooding ficw must also be supplemented by heat removal through the auxiliary feed-water system (AFWS).
MtMf-Assumg=f A.nthef.RSS&that=coremi see wied ou am ar p l
teelt_ vill; occur withotithoperation'Ifor*this71tT3ACA';7 Table
.Al-1 illustrates the combinations of system success needed for successful emergency core cooling for each LOCA break size.
Al-5 E
condensate pumps (another on standby), two electrically-driven condensate booster pumps (another on standby), and two stean driven main feedwater punps.
The system is designed to operate in several different modes dependent on conditions resulting from the initiating transient event.
Each node also entails a different means of transferring heat to the environnent.
Following a_ transient [WRisvWA3t!;1M.7 KIP!
U PCS., feedwater flow is throttled to 5a cN cack s/9 (6C(i. e., decay heat level) and steam bypasses the main turbine via the turbine bypass valve and dumps directly into the condenser.
At least one complete train of condensate and main feedwater piping must,be intact to deliver water from the condenser hotwell to the steam _ generator.
If the condenser should become unavailable, steam may be dumped to the atmosphere via the secondary sareTy7[** ^',7" cy, ire 11Ef va1ves.'i (IPthiiiFWiirE fecai7&EeT~p5iii~p~s~fsil-'?Ehe7operatbFntist re1reVe, sea Norr 21 ou AYrACH A pressure--in--the~stesiCge6sFator tBralToCtWe-loWeCptess0Pc pondensate pumpir tE~ftThcT165%
In this mode heat is release 3 to see wie 19 '
the ' environment thr.ough tife;secondRyZsafeEyfr'eIIef"Tahe'd11 o, n n.,e g i, Successful POS operation following a T3 transient initially requires the automatic throttling of the feedwater flow to approximately 6 percent.
Once this has been accomplished, all that is required is the continued operation of the feedwater system.
Continued operation is estimated to fail with a prob-ability of 10-2 based on RSS insight.
1 Discussions with plant personnel indicate that this cooling option may not be possible.
A2-9 L
1.0 INTRODUCTION
The systems interf acing with the Reactor Coolant System (RCS) in the Calvert Cliffs Unit 2 plant which, if certain isolation f ailures occur, provide a flow path leading to an extra-containment LOCA, were reviewed and compared with the interfacing systems in the similar PWR design (Surry) evaluated in the Reactor Safety
~
Study (RSS).
The important interfacing systems for both Calvert Clif f s and Surry are described and compared in Sections 2 through 4.
A point estimate probability of a Calvert Cliffs interfacing systems LOCA is given in Section 5.
2.0 CALVERT CLIFFS INTERFACING SYSTEMS 2.1 Description The systems interf acing with the reactor coolant system provide for emergency shutdown and core cooling in the event of an accident.
They also provide temperature control for the coolant under normal operating conditions, and collect deaerated tritiated water inside the containment.
The Safety Injection System and the Shutdown Cool-ing System provides emergency cooling at'both low and high pressures and shutdown cooling at low pressures.
The Chemical Volume and Control System (CVCS) delivers borated water from the boron injection tanks to the core for emergency shutdown cooling.
The Reactor Coolant Drain Tank collects deaerated tritiated water from the reactor coolant system.
Of these systems only the Residual Heat j
Removal System (low pressure safety injection system / shutdown cooling system) aligned in the low pressure injection (normal S
operating) mode', tprQy_13b] the possibility for 'a pipe rupture outside.
c A3-2 L
an inverter with its own DC feeder and each pair of inverters per channel is supplied by a separate battery.
Each inverter can be manually bypassed and its distribution panelboard supplied from the 120-volt AC inverter backup bus which is fed from an engineered safety features motor control center through a regulating transformer.
Each of the four 125 VDC emergency power sources is equipped with the following instrumentation in the control room to enable continual operator assessment of emergency power source condition.
1.
DC bus undervoltage alarm 2.
Battery current indication
~
3.
Charger current indication 4.
Charger malfunction alarm (including input AC undervoltage, output DC undervoltage and output DC overvoltage) 5.
DC bus voltage indication 6.
DC ground indication systems are ungrounded and are equipped with so... s _. uw_ o..... w_..,.
ground detectors.
The 125V DC and 120V AC system,shown in Figure B1-2 supplies j
power to various plant backup lube and seal oil emergency pumps in the event of loca of auxiliary AC power or failure of the normal AC pumps.
No other engineered safety feature loads are supplied by this system.
The system consists of one motor control center, two. battery chargers and one battery.
The battery chargers are sized such that in combination they are capable of supplying the continuous load of the largest motor.
Each battery charger 5
Bl-(
L
~
~
-. :)
The 125-volt DC control power for diesel generator 11 is suppliedbybatteryj{ll.
Diesel generator [{ll is a part of and supplies power to load group A.
Batteryjhllisalsoacomponent of load group A.
Diesel generator 21 is supplied by battery 21 both of which are components of load group B.
Diesel generator 12 obtains control. power from either battery 12 or 22 by manual transfer.
Equipment is provided in the control room for each gener-ator, for remote manual starting, remote stopping, remote synch-ronization, governor and voltage regulation, governor and voltage Dhof odropiselection and automatic or manual regulator selection.
Equ'ipment is provided locally at each diesel generator for re-stricted manual starting in case of control room emergency, man-ual starting during routine diesel generator testing or mainte-nance, manual stopping, governor and voltage regulatien, automatic or manual regulator selection, exciter field removal and reset, and remote and automatic or local manual control selection.
2.3 System Operation During normal plant operation both plant service trans-formers are energized from the 500 KV substation and share the total auxiliary load with the bus tie between service buses 11 and 21 open.
The 4160-volt buses receive off-site power from the 13.8 KV system through the unit service transformers.
The diesel generators are' started by either loss of-4160-volt bus voltage or by' the Safety Injection Actuation System (SIAS).
In the event of an SIAS signal, actual transfer to the bus is not made until the preferred source of-power (off-site) is actually
~
B1-8
1.0 INTRODUCTION
The Calvert Cliffs Unit 2 Reactor Protection System (RPS) was reviewed and compared with the similar PWR design (Surry) evaluated in the WASH-1400 study.
The RPS designs for Calvert Cliffs and Surry are described in Sections 2 and 3 of this report, ' respectively.
A comparison of the two reactor protection systems is given in Section 4.
RPS event tree interrelationships are detailed in Section 5.
Also included in Section 5 is a description of the reduced RPS fault tree model and a point estimate of the system unavailability.,
2,0 CALVERT CLIFFS RPS DESCRIPTION
2.1 System Description
The RPS consists of sensors, amplifiers, logic and other equipment necessary to monitor selected nuclear steam supply system conditions and to effect reactor shutdown by de-energizing the control element drive mechanism (CEDM) coils allowing the control element assemblies (CEA) to drop into the core by gravity if any'one or a combination of conditions deviates from
' a preselected operating range.
An auxiliary signal is provided to trip the turbine coincident with reactor-trip.
2.1.1 Control Element Assembly The Calvert Cliffs reactor core.is composed of 217 fuel 77 assemblies and j]; control element assemblies (CEA).
The CEAs B3-1 a &n
consist of five inconel tubes 0.948 inch in outside diameter.
Four tubes are assembled in a square array around the central fifth tube.
The tubes are jointed by a spider at the upper end.
The hub of the spider couples the CEA to the drive assembly.
The CEAs are activated by magnetic jack control element drive mechanisms (CEDM) mounted on the reactor vessel head.
The CEAs are divided into the following groups:
a.
Shutdown:
three groups b.
Regulating:
five groups RJ 2EWJJE.;iS: ~
- TW
, m.
_...,______r,.____.
A. E mv,,w
_sC~~, 4.fCM g.vuw g.
w-A wiry w..
w e... w g
w,.
_ -...., _....w'M T6%TM r - hjM,r, y -- h m._._.
gg i v,'gh
[T se,,h, =. g.E d b,w b.g O4w
~~
a c. a L Lal d ci :.t ym. i k r. 3 t!. C:.'.; p.c d;d v
f : r ; : - : _. " : i ;_
"'t : 71r' '-- 'i ""'- - *..
- '
- :: f ri ; - r: :t r trir '
37 Th e re a re 45 s ingle CEAs, T 4
- .14,..
- c. c t, l n ;i'c i
44iD4, and 20 dual CEAs (the dual CEA is made up' of 2 single
~
CEAs connected to separate grippers and carried by an extension I
shaft).
The 20 dual CEAs are for shutdown, 37 single CEAs are for r egu la ting..- ' ". : ~ ?.T: ! t.2. :'. :_r t I_: n - t.i. ". _7. :.. _:_:
.f._:__
.:- c ALL t.E x I ca -
--- t _ b.c., CEAs are..scrammable.
^
a The Control Element Drive Mechanism (CEDM) is of the magnetic jack type drive.. Each CEDM is capable of withdrawing, t
inserting, holding or tripping the CEA from any point within l
its 137-inc,h stroke.. The CEDM drives the CEA within the B3-2
reactor core and indicates the position of the CEA with respect to the core.
For conditions requiring rapid shutdown of the reactor, the CEDM coils are de-energized, allowing the CEA and the supporting CEDM components to drop into the core by gravity.
S7 There are $!f CEDMs (4 E~E 2"M M5hb G h,-i.9-Uw m a ets-L... ? f Et.
The CEDM coils are de-e ergized by opening a minimum of oNE SAIA OF TA) CKT BRERKeRSiv CAC M7DR GcacurogsvPPLY ht"H ff--M&thf-R-;J&ff;it _-i 77 There are some basic differences be' tween Calvert Cliffs and the RSS PWR.
For ex-ample, the RSS PWR plant (Westinghouse) used a two-of-three trip logic whereas the Calvert Cliffs plant (Combustion En-gineering) uses a two-of-four trip logic system.
Also, the 9
RSS used only one power circuit to the control rods.
That circuit had two CBs in series-either of which could trip the reactor.
The Calvert Cliffs plant has_four paralleled power paths to the control rods each path contains two CBs in series, either of which will open that power path.
All four power parallel power paths must be opened to completely SCRAM the reactor.
The first of these differences (two-of-four logic for trip) would be expec'ted to reduce unavail' ability while the second (four parallel power paths to the control rods) would be expected to increase unavailability.
2.1.2 Trip Logic The Calvert Cliffs RPS consists of four identical channels.
Each measurement channel which can initiate protective action B3-3
_____m
J y
b
+
l 5
i
~'
~
Table B3-1.
Calvert Cliffs RPS Tr ip Parameters (Cont.)
B;VarMDie
- Brip Numb.er of Condition for Sensors Trip Comments s
y7 S* g2 628
'V Low Steam Genera-Four s e ts o f two (one 7500TPSIA Pre trip AlarmIUDD' psia tor Pressure on each steam generator)
, i.'l downcomer level differ-l Auctioneered Low of l
ential pressure trans-Steam Generators 1& 2 A
mitters is used.
j 2
High Pressure Four narrow range pres-2400 PSIA Pro trip Alarm 2350 t
Pressure sure transducers psia.
T Thermal Margin /
4 Resistance Tempera-Variable Trip Set Point Pro trip Alarm 100 paia Low Pressure ture Detectors (in the Minimum 1750 psia above the variable trip Trip hot and cold leg of Set _ point (computed each steam generator) valve).
L(.
High Containment Four pressure trans-4 PSIG Pre trip Alarm 3 PSIG Pressure mitters Loss of Load Loss of Load above a Equipment Protection preset power level.
Trip - Not required for reactor protection.
Manual Trip 2 Sets of two push Operation Decision Testable during button switches reactor operation.
~
0
)
- 1. O ' INTRODUCTION The Calvert Cliffs Unit 2 systems and components which are designed to contain the release of radioactivity from the primary system in the event of an accident were reviewed and compared with the. analogous system and components of the Surry plant analyzed in WASH-1400.
The probabilities of failure of these system or ccm-ponents define the containment leakage (CL) probability as was used in the containment event tree.
As in WASH-1400, containment leakage was defined as that leakage which provides a flow path to the atmos-phere equivalent to' a 4" diameter hole or greater.
The designs to, minimize containment leakage for Calvert Cliffs
~
- DE SCRl6ED a.id Surry are (de.siyned iin Section 2 and 3, respectively, of this Appendix.
A comparison of the Calvert Cliffs..and Surry design is given in Section 4.
The use of the
'CL' probability in the contain-
~
ment event tree is spec'ified in Section 5.
Also included in Section 5 is a point estimate of the Calvert Cliffs ' 'CL' probability.
2.0 CALVERT CLIFFS CONTAINMENT INTEGRITY
SUMMARY
2.1 Description The containment building is a' post-tensioned reinforced con-crete cylinder and dome connected to and supported by a massive reinforced concrete foundation slab.
The entire interior surface of the structure is lined with 1/4 inch thick welded ASTM A36 steel plate to assure a high degree of leak tightness.
Numerous mechanical-and electrical systems penetrate the containment structure wall through welded steel penetrations. 7te penetrations and access openings were designed, fabricated, inspected and installed in j
I.
B4-1^
I
~
~
3
accordance with Section III, Class B of the ASME Pressure Vessel Code.
tJ u a rie n The general. design basis governing valve require-ments is that leakage through all fluid penetrations not serving engineered safety feature systems is to be minimized by a double barrier so that no single, credible failure or malfunction of an active component can result in loss-of-isolation or intolerable leakage.
The installed double barriers take the form of closed pipino systems, both inside and outside the containment structure, and various types of isolation valves.
Isolation valves associated with containment penetrating lines not required for. safety systems are closed in the event of a LOCA.
These valves are closed by the ISOLAT/o#
redundant containment fsoltioq signals generated by the Engineered Safety Feature Actuation System (see Appendix BlO).
All'. con.tainmen,t (isolat. ion _ valves ~pr~ovi~dedNith _han,dswi,tchesgqcatednin3he ma_in SEE NOTE //
og an AcHmD/r l (control"Gpm~for.normaLconEror and backup contro1TCuring arr gemergency.
All remotely operated containment isolation valves are provided with position indication (open or closed) in the control fes',
Figu' e 34-lN.s a' simp'11-fied'Mici of _the contaihraent -
t<
$;,g r
~
room.
u.-
e r s :~~
pys t e?n showing sa fe t? es tism.a ndM_th64ene_trations.
e._.--
- 4. '
l All penetrations except the following are located in groups i
and a penetration room is located at each group.
y
,1.
Equipment Hatch 2.
Personnel Access Lock 3.
Emergency Personnel Access Lock 1
4.
Refueling Tube 5.
Purge Line Inlet.and Outlet 34-2
e' a
The accumulator tanks contain borated water at a minimum boron concentration of 1720 ppm and are pressurized with nitrogen at 200 psig.
The tanks are constructed of carbon steel and internally clad
. with stainless steel.
Level and pressure instrumentation (audible;5n:Ao7e ll
^
aga meH.1 -
candlyisual.) is provided. to monitor the availability of the tanks during plant operation.
Proviciens have been made for sampling, filling, draining, venting and correcting boron concentration.
Two 12-inch check valves in series prevent high pressure cool-ant from entering each accumulator during normal plant operation (valves SI217, SI227, SI247, SI237, A1, A2, A3, and A4).
The isolation valves which are in each line between the two check valves is fully open during normal plant operation and has its position indicated in the control room ( MO\\'-614, 624, 634, and 644).
The position of these valves _is verified every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> aus required by technical specifications.
2.2 System Operation During normal operation the reactor coolant system is isolated from the tanks by two check valves in series'thereby preventing re-actor coolanc from entering the accumulators.
When the reactor
~
coolant system pressure drops below 229 psig, due to a LOCA, the stored borated water, driven by the pressurized nitrogen, opens the two series check valves and is injected into the four RCS cold legs to fiood the core.
3.0 SURRY CLAS DESCRIPTION The Surry' Cold Leg Injection Accumulator System (CLAS) pro-vides for core protection for intermediate and large reactor B5-2
l'. 0 INTRODUCTION The Calvert Cliffs Unit 2 Low Pressure Recirculation System (LPRS) was reviewed and compared with the similar PWR design (Surry) evaluated in the WASH-1400 study.
The LPRS designs for Calvert Cliffs and Surry are described in Sections 2 and 3 of this report, r espectiv ely.
'A comparison of the two low pressure recirculation systems is given in Section 4.
LPRS event tree interrelationships are detailed in Section 5.
Also included in Section 5 is a descrip-tion of the model used to incorporate LPRS failures into the Calvert Cliffs accident sequences and a point estimate of the LPRS unavail-ability assuming independence from all other Calvert Cliffs sy s tems.
2.0 CALVERT CLIFFS LPRS DESCRIPTION
2.1 System Description
The LPRS utilizes two pumps designed for a 3000 gpm capacity. at ~
15 0
..a discharge head of (?S0] ft.
Each pump has a separate supply line from the containment sump which it shares with the containment spray and high pressure injection pump (s) of the same train.
The two sump supply lines each contain a motor operated valve and a check valve which must open.
The two low-pressure pumps discharge to a common header from which each RCS cold leg is supplied.
The four RCS cold leg supply lines interface with the high pressure and accumulator discharge lined.
Comparison of Figure B6-1 and B7-1 reveals that-the LPRS
. pumps and many valves are. shared with the Low Pressure Injection
. System.. Passive.miniflow by-pass lines are employed to prevent pump overheating.and loss of suction.
B7-1
-J
2.2 System Operation The safety injection pumps initially draw borated water from the refueling storage water tank.
This tank has sufficient water 1
volume to supply safety injection flow for up to 36 minutes follow-a lar ing{ ass $e LOCA uming three high-pressure and two low-pressure safety injec-tion pumps and two containment spray pumps are running.
When the refueling water tank is 10 percent fu ll, a recirculation actuation signal (RAS), opens the isolation valves in the two lines from the containment sump and shuts down the low-pressure safety injection pumps.
'ite refueling water tank suction valves remain open initially during the switch to the recirculation mode to preclude the loss of supply to a high-pressure safety injection pump in the unlikely event the isolation valve in the _ containment sump line should experience delay in opening.
Back flow through either refueling water tank suction line is prevented by check valves.
In addition,
~,
a the operator will manually close the RWST suction valves after inve s' verifying the opening of the containment sump Linesjvalves.
The earliest automatic recirculation would occur is 36 minutes assuming all engineered safety features _ pumps are running.
The recirculation mode can also be accomplished manually by the operat'or.
The High Pressure Recirculation System (HPRS) would normally be used.to recirculate water from the sump.
If the HPRS is unavailable, tiie LPRS would be used. _ Che' LPRS Vcitflif'be manua17yl pittaited7s10cp i
the~1ow-pressure;2 umps;argupn_e_d,off,:byTtlie'Ye~circUratton actuation f (signa 1T ses Afore 13 ou AnpckmLWT L B7-2
assumed that the pump seals and bearings need cooling.
The terms HPLP21CR and HP23LP22CR represent pump seal and bearing cooling f ailures during recirculation.
Refer to Appendix B14 for more details.
The terms RASAl and RASBl represent individual subchannel actuation faults.
Subchannels RASAl and RASBl open the recircula-tion line MOVs.when the RWST water level gets low.
The term RASCM represents a common mode failure of both RAS subchannels due to miscalibration of the RWST water level sensors.
(Siri6e~the pumps are: turned 1off by__the.., recirculation 1si nalg.t SEE A67f 13 S
OW 9 TTACH L Lthe3 PRS _~.rhGs't~EeT5anua_lly-i_nitiat_ed? A common mode failure of the operator failing to start the LPRS is depicted by the tern LPRSCM.
Since the LPRS is demanded only after a failure of the HPRS, it is assumed the operator would be under a moderate to high stress level.
This failure was conservatively assessed to be 1.0 x 10-1 (reference 6).
5.2.2 LPRS Unavailability Using the Boolean equation given in the last section and the term unavailabilities given in Table B7-1, an independent LPRS point estimate unavailability can be calculated.
This is found to be:
LPRS = 1.1 x lO-1/ reactor year
'" Double" test and maintenance contributions, i.e.,
a deliberate action specifying both trains to be tested or maintenanced simultaneously, were not included in this unavailability estimate because such an action would violate technical specifications.
Further, it can.be seen that reduction of the Boolean equation B7-6
)
.--~~__-____;_-_____________L-_---_-_r:___--_;__-_____
O HPRS shares most of its com'ponents with the HPIS.
The HPRS draws water from the containment sump through two redundant lines.
One line feeds high pressure pumps HP21 and HP22 and the other line supplies pump HP23.
The pumps discharge to a common header which then branches into two lines which, in turn, connect to the four RCS cold legs.
2.2 System Operation The safety injection pumps initially draw borated water from the refueling water storage tank (RWST).
This tank has sufficient water volume to supply. safety injection flow for up to 36 minutes assuming three high pressure and two low pressure safety injection pumps and two containment spray pumps are running.
When the refueling water tank is 'lO percent fu ll, a recirculation actuation system (RAS) signal opens the isolation valves in the two lines from the containment sump and shuts down the low pressure safety injection pumps. - The RWST suction valves remain open initially during the switch to the recirculation mode to preclude the loss of supply to a high pressure safety injection pump in the unlikely
)
event the isolation valve in the containment sump line should experience a delay in opening.
The operator. will manually close the RWST suction valves after verifying the opening of VA LVES the containment sump linetvalaveul In addition, back flow to the RWST suction line is prevented by check valves.
The-earliest automatic recirculation would occur is 36 minutes assuming all engineered safety features pumps are running.
The recirculation mode can also be accomplished, manually, by the operator.
e B9-2
.y
R22 COOL (used for T1 transients) =
E 2T1 + R22 + S IAl* S IBl + D21-L T::.O.
(Eq. 314-8(a))
e--~_ ~~ m - -
.ffflO_l*2 3..OW__AE}]CymEN_T~ $_
S n
${e next equation depicts a cooling water failure of the emergency diesel generator jacket cooler (1227 It is assumed that without jacket cooling the emergency diesels will fail.
This l
equation was input into the Boolean equation used to model emergency l diesel.y22'I See Appendix Bl.
I E
SW22DGT1 = E2T1 + G2T1 + F2 (Eq. B14-9)
L r$.
Diesel generator 42'1 receives cooling waterrfrom SWSJ 2
L1j
- Grain ~22-whichT-in--turn,-is cooled by-salt-waterTtisiF22Tvmte f
- , (SWS_Xeat.'~ exchanger.
Term E2T1 and F2 represent pump and compo-nent failures of salt water train'22.
Term G2Tl represents pump
'and com failures of SWS train 22.
r-w -~ ponent
.m.._____..._m.,.
y 4
, Diesel generator $12 receives cooling water from Unit l's 9
SWS train #12.
Ej.ncCUnit'1?rcooTing yater-sy st ems ;ar.e7
' SEE NOT6/8 f ndependent__tryiCUn1D7 si.. a@lnf es.timate,of_-3 Tx 1Dr.2.3as;us'ed i
, og gg i, p nst~eaToCdevelopinCBool_e.an~.modeTsf.
This.value, referred to as i
SW12DGT1 in the model for diesel #12, is the same as that calcula-ted for Equation B14-9.
The last equation describes the Containment Heat Removal Sys-tem (CHRS) which contributes to the LOCA event G.
The CHRS is re-quired when all four containment air recirculation and cooling system-fan units are unavailable.
B14-16
. I t."-
.,