ML20045C635
| ML20045C635 | |
| Person / Time | |
|---|---|
| Site: | 05200002 |
| Issue date: | 06/15/1993 |
| From: | ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY |
| To: | |
| Shared Package | |
| ML20045C622 | List: |
| References | |
| NUDOCS 9306240098 | |
| Download: ML20045C635 (600) | |
Text
~
ATTACHMENT 1 CESSAR-DC-Amendment P Overview Chapter 2 - Site Envelope Characteristics
- 1. Chapter 2 was revised to include COL applicant commitments per DSER Chapter 2 COL Action Items and DSER COL Action Items 3.3.1-1 and 3.3.2-1.
Chapter 3 - Design of Structures, Components Ecruipment ,
and Systenus ,
- 1. The Section 3.1 response to 10CFR 50, Appendix A, GDC 31 was revised to update integrated fast neutron flux exposure of I the reactor vessel welds, increase in transition temperature i and initial RTem.
- 2. Table 3.2-1 was revised to identify safety class, seismic category and quality class for the spent fuel pool and unit vents in the Nuclear Annex. l
- 3. Section 3.4 was revised to further describe the plant design regarding flood protection and to include COL applicant i commitments per DSER COL Action Items 3.4.1-1, 3.4.2-1 and l 3.4.2-2. ;
l
- 4. Section 3.5 was revised to include a COL applicant l commitment per DSER COL Action Item 3.5.1.3-1. I
- 5. Section 3.6 was revised and Appendix 3.6A was added per piping audit camments to discuss design of pipe whip restraints and loads on pipe penetrations. This section was also revised per piping audit comments to update the discussion of Leak-Before-Break (LBB) methodology and to add .
a COL applicant commitment for LBB assurance. l l
- 6. Section 3.7 was revised to clarify seismic analysis l methodology pursuant to a piping audit item. This section i was also revised to incorporate editorial comments from internal consistency review.
- 7. Section 3.8 was revised to correct Table 3.8-5, Load Combinations for Category I Structures and to add Figure 3.8-5 pursuant to a piping audit comment.
- 8. Tables 3.9-2, 3.9-10 and 3.9-11 were revised pursuant to piping audit comments. Appendix 3.9A was added pursuant to a request during the piping audit to incorporate information on piping design, pipe break and LBB from Distribution System Design Guide (DSDG) into CESSAR-DC. Revised and additional information was also included in Appendix 3.9A pursuant to DSDG audit items. l
- 9. Section 3.10 was rewritten pursuant to DSER Open Item 3.10-1.
gRO6240098 930615 m a ADOcn 05poooog y PDR n u
i
. . 1 1
Attachment 1 Page 2.
Chapter 7, Appendix 7A - CMF Evaluation for Limiting Fault Events
- 1. This appendix was added to incorporate analysis results for nine (9) events which were performed in order to close out I&C diversity issues. The results were previously.
transmitted to the NRC in a separate report.
Chapter 19 - Probabilistic Risk Assessment
- 1. Text changes were incorporated in Sections 19.4.13 and 19.5.6 in response to a verbal request from the NRC reviewer to use 3200 psia as the Level C stress limit in ATWS evaluations.
- 2. Section 19.13 was completely revised to correct an error in the sector multiplication factor for calculation of dose at distance.
- 3. Section 19.14 was added to present the results of the PRA Level 2 and Level 3 sensitivity analyses. The section was incorporated in response to DSER Open Items 19.1.2.1.2.8-1 and 19.1.2.1.3.5-1.
- 4. Section 19.15 was added. This section provides an overall summary of the PRA and the associated insights.
- 5. Editorial changes where incorporated throughout Cnapter 19 in response to the internal consistency review.
b--_-m
-. Docket No. 52-00~2 UNITED STATES OF A' MERICA NUCLEAR REGULATORY COMMISSION In the Matter of: )
)
Combustion Engineering, Inc. )
)
Standard Plant Design )
APPLICATION FOR REVIEW OF
" COMBUSTION ENGINEERING STANDARD SAFETY ANALYSIS REPORT-DESIGN CERTIFICATION" Regis A. Matzie, being duly sworn, states that he is the Vice President, ABB Combustion Engineering Nuclear Systems Development, of Combustion Engineering, Inc.; that he is authorized on the part of said corporation to sign and ".le with the Nuclear Regulatory Commission this document; and that all statements made and matters set forth therein are true and correct to the best of his knowledge,information, and belief.
COMBUSTION ENGINEERING, INC.
By: s Regis A/Matzie Vice President ABB Combustion Engineering Nuclear Systems Development Subscribed and sworn to before me this //4 S ayd of ,1993.
fal V Notary Public My Commission Expires: 3-3/-N
/
LWIT VENT
\ CDNTAINHENT ==-
1 l
1 7
=.
f i
( - =_
[ CDNTAINMENT INTERNAL STRUCTURES l
HVAC pe n it ' 1 ,
= _
kl 6 b YdIILD
} ,
VALL u__ nl ., x -
=
cvCS AND MAINTENANCE AREA I ,I
) g tL . n n pW v i __
u__ l r
UUU l l UUUUL l p
- gt j
- NJI.ING T O g $ i
~
CDNT, st N ,
st
" ^*REACTE R BUILDING ,~ -
h $ ! a SUB L\ . .
NUCLEAR ANNEX REACTOR BUILDING 5
THE RADIDACTIVE VASTE STRUCTURE IS LOCATED ADJACENT TO THE NUCLEAR ANNEX THE TURBINE BUILDING IS LDCATED ADJACENT TO THE NUCLEAR ANNEK
- - _ =
F
- - = - -
.~
v 1
LEGEND
. . navAr oeEuzuG
{ . 2"En"'
DPENING O - cotuws aELN f Qg rLuuD BARRIER l:j: j:ij 3-HR FIRE BARRIER
- um ==
sb1?vl$a i "YRA a rDR NOTES SEE FIGURE 3.0-5 SR 12 $l APERTI)!W DEELN$Lt bANO 2;T 7 j Also Available On i/ /:
~
}
Aperture Card l
llJij
- --;- mRot I 2 ,
l -
4 CONTROL N
CDMPLEX .
EttCTRICAL [0UTP f VITAL INSTRUMENT h ERE :: !
EQUIPH T RDDM E\\%%\%%%%N NUCLEAR ANNEX p Amendment P June 15,1993 TM Figure jM / u NUCLEAR ISLAND STRUCTURES SECTION A-A
- 3.8-5a)pi
- ;_i ll
[q12 ~ s
326'-0* (i 3'-D')
(SEE NOTE 4) 200'-0* (12'-O')
(SEE NOTE 6)
UNIT VENT SHIELD BUILDING CONTAll .
~
CONTAINMENT INTERNAL STRUCTURES l
A I
/
PRIMARY SHI LD
/ 1ECDNDARY ANE VALLp l
- . T /
j J
]
MAIN STEAM VALVE HOUSE f ' '
h, H I H
~
FINISHED PLANT ~
- C#ADE LEVEL gry L _. .
h G m u
\
N
\v [
~ '
f -' Scs 4 g \ ccv ccv % Erv %
ffEACTOR % . .
9 q Erv
\ S %
I'UILDING JBSPHERI: g NUCLEAR ANNEX REACTOR BUILDING t
v
" .as
/
T k
LEGEND
.,[ .
g c
^
(19 / l *
- DOORVAY IPENING 2 '
gl'f ;
Hj i>
VERTICAL
= ACCESS OPENING O = COLUMN Q\] FLOCD BARRIER
-' 3-HR FIRE BARRIER l:{: - {l ggg 3-HR f!RE AND TLOOD BARRIER REET O BUILDING
- )
ANNULUS ',!)ic
- i f }$
AREA
' ' ~ 9' 51 FOR NOTES SEE TIGURE 3.0-5, SH. 32 l ik '(? h v o 51,;I d s I ,IH f Ape : ;ure C ard H
7 MAIN S',C AM WALVE HOUSEb{ _
-kN FINISHED Pt. ANT GRADE LEVEL
,. Z 7y 3 r m
\
- s ?
N b d W 4
- p h ccv
\ 7 d e
i dccV ( kkkkkM s NUCLEAR ANNEX , 1 Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure 3% / u SECTION B-B 3.8-5 l Sheej'2 of 121 m]
4 34'-0* (14'-D') Jk (SEE NOTE 4) M" i- w-
- L set watt s m
M art trirwtartru
- ammmmmmmmmmmmu ms
~
F 4
& j-
% 8 ccv :::=
/ 4
% /
% 0 0 O p DIESEL GENERATOR AREA /
\ 2 ccv h 'i ,
/
% .I le r
,{f .Z Z Z Z Z K f f f f f f f f.Z L fG.
- LE\h siAIRs l
. . d' 13 c.ri s.-
g g i O O trv k crv N- FUEL _HANDL.ING O O h AREA - REACTOR h ' REAC'
% BUILDING Fi BUILf!
BSPHERE SUBSPF O ,, ,,,
-g
-+ s y y 5 -
e - cont si gxxxE '
/ \si ^ 5"*Y q i
[
~
5; h ,w O Y b 7 *r L h a b
\
% yh xxxxxxxxxxxxxxxxxxxxxxivCAxxxxxxxxxxxxxxxxsnxxxxxx:s
.L l
I l} omsmN N h MV]sIDN; y 22 a , .U., i U( l vu s = O _ c '\
) 9 -
st % s1
$ 0 _.
b r t] . 5 4 5 F ,; CVCS
?({,c c3 7 q 3c, ,
AREA h d
/
-J.,
I O O REACTOR REAC' N A O hl,
*~ #c 8 BUILDING SUBSPHERE
[-- k' BUILE eUBSPI
~
\ "
g ::
- 7. .
N s a trv q crv
% j :nl 1 G
i
\ i o J D D 0 vszp: 8 l *' *"* l MfstAms h mxxmmllxxxxxmsmxxm.
<x m xxsm. N
>r-h 4 e
% b' % ccv :p
\ %
g O O O N DIESEL GENERATOR AREA y ., N b % ccv ?
- I
_, vs N u m m m u2 m m x m m x m m% mmsv SEE NOTE 5 N , s s
.~,.m.
LEGEND
* = DOORVAY DPENING SEE NOTE 5
\ A W X X h u T.X X h X X X X M
\ _
VERTICAL ACCESS
/ 4( ,
=
DPENING
/
O \ O O f E . = =
$ 0 = COLUMN
/
Zs i i i* i ci M > % (\\] FLCDD BARRIER EIE -C I-:/ ' '
C 1-: . . ..
j W , 2 1 f :, ' ll 3-HR FIRE BARRIER
- 3iATTERY J. BATTE R'. -1.iii 4Q _ ROOM _
B e 1 RD94 ._ e g ggg 3-HR FIRE AND F'""" 8'""3E" g __ r1 O O s : F FR 2 l VITAL INSTRUME NT : \ ,'! NG CRE _
, EQUIPMEM::
gooM g
\
W, P,,
\ FDR NOTES SEE FIGURE 3 0-5, SH 12 ' ' bA
,gTAL L EQUIPMENT
\ - -
O " U" O o .i.- . 0 , m n.e t)tt N 9 ,
\
ST AIRS l q
' ih I $lIN fd ScS ,;=='*d O %
CONTROL COMPLEX fx m xxxxs 'xpxxxxxxxxx.
* *3** "
VALL j' CONTROL N COMPLEX s A ScS \ M ' O O \ vlTAL I
,. INSTRUMENT % i 7p & EQUIPMENT q !
T O""O s
\ r G , O O O 5 NG %
ERE N L s D_tT O O g ditWrg . difith . I j
^
I E5 5:- ..:e .1.: NY. k 3 4:c . 1310. , a ., ,
- ,., Gj so62y0098- ;
\ E s
\ 5 %
0 0 0 E *M seg ggt 3 N/
\ 4 Lim u m u m u m u Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure f$ / u PLAN AT LEVEL 1 3.8-5 Il Sheet 3 of 12 -
4 3 4 '- O' (* 4 '-O') Jk (SEE NOTE 4) i ~ M manna anmeanwm PL Aw? tKrvtairW
' Ok 111T \ \ \'
LX\\\\l'(D'\\\XXXXXXXXXXXXXXXXXXX3 E" DIESEL GENERATOR AREA O O
% y ,1.':.,,.. 'A.,'A. Lt: ,
t w:-=,\ x o -
% 0 0 .
-v.e.-
x .
.geq --
9 C REACTOR g i UEL HANDLIN 3 DEA
.... ctcci My]r ,
*Cif .Eh BUILDTUB 1f g
%
- l ELECTk- e g $ : cou:P ,i-t r A' .e.'. -
;st CDDLING
% DM n sm s ,-
a v W l .. b . J B 3x\rn:. . . ger.. 3:. .-:.r. =. 2 : e n 8 ':
" 4' CVCS AREA .:.~ , l A %_ /
O O O Q p- D "5g^' Y N O
~
O O @
. ?
& ruct \- l c$ NG a
s q o Jt w<<<c,
=
- i"R8,.n 4
sg REACTOR w g r _7 _ O. BUILDING 'C!: q -- /] SUBSPHERE - L._._
~
O O] Q t.7 h.Of t.n\~~ 1F9.y((-',c.
. rws-s IX g crv trei s O DIESEL GENERATOR AREA
]
]
\ ,,
sumsm\mmmmmX mmmmm3 1 A N
. * ~
LEGEND e
- DDDRVAY DPENING LAATXXXXXXXXXXXXXXXXXXX VERTICAL
= ACCESS CH:' LED DPENING VATER h O O O E
- O - CDtuwN i i
.( .i i.E -s
>% (\\] FLDOD BARRIER r:{O
. . . . . . { 7 10 :-F I ,
q m b;, %
.?":
- ' g 3-HR FIRE AND D n O T@ a s
F' " 8^*RIE" SI
- PHER ELECTRICAL \ Ap"' gJ l l'i II,{ {_(
g
.,. EQUIPMENT 0 '\III i.
O O O N N w r DIVik' AL t#.L
.r... .
CONTROL COMPLEX O O
\
\
FOR NOTES SEE r!GURE 3.8-5. SK 12
, n' 'gn l ,, ( ) n s, r i U T C 't, ird
\
STAIR,S f % l l
* '.h.)
70 I
~
/_ ..
T ' REMDTE SHUT DOVN RODM i
':OIO] ,N 5,' %
s g DIV!sIONAL VALL j g {
\
. N A
-e ,
g
.- F' 0 0 ./ /
j/
/
{::: : ELECTRICAL EQUIF MENT
/ .: Ef: .,, O O s r CONTROL \
COMPLEX \ / ' O O O N tLECTR] CAL EoutexENT \ m;
./../{
.... g
- e. , 8
{.w . .
,gm .
.:{g:. . , s
. m%
_ oi i .tr.i ..c k N 0 0 U+h" 0 E *dh NN f36(o2 Y0$ N N ( Asxs m x m sx m m m Amendment P June 15,1993 TM NUCLE AR ISLAND STRUCTURES Figure j% / u PLAN AT LEVEL 2 3.8-5 I Sheet 4 of if
1 rw
' M',
.%)
w
' j name munmem gt antwtarp
, -1
% -)
K 1 V%&W I - .j f e F:, 1 3 A'X'E'E5.: Q
..:Oi-X l:: t
-l j
d ' M VAR - ; 6 A g F M L J
,r h 4:!
4 y ~ g- .J g i 01 b. O -- a s-
& i 0
D i- i O E:; f
-1 ~
4 y- 0 C :- l ELECT i
] {:}-: EQUIP
* *<ELECT
- : EQUIP s-_ ,, _ _ ,,,,.
I NN *
.:01 :. ;
s s I s c P J' m
\
s l swes Lx m x m x m m s m u
-e==-
_____.__-_i_______._____,________._________.,__,__. _ _ _ , _ _ _ _ _ _ _ _ .. ., _
m-LCGtND e = D00RVAY DPCNING VcRTICAL
= ACCESS OPENING O = COLUMN
(\\] rLEDD BARRIER [:!. ' ,' ':!l a-wR riec aARRIER k%XN RED UR N 81 AyERTURE roR Natts Src r:GuRc 3e-s ss. te CSNO Atw Avauable On Aperture Card no6240078-Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure jff /u PLAN AT LEVEL 3 3.8-5 Il Sheet 5 of 15, d
+
L 4 34 '-0* (14'-0') (SEE NOTE 4)
~
m b tmtmame r' gg trv trv
*i i' n
' lE STAIRI h $41 ELD .
~,
. y . a a.- ....
a.o g , O
>1vyr FUEL H/NDL!b G
~~ 1 J * - CONTAINMENT ARI:A i
jv..
-{E t
]LgT .
o .4 switYv l \h y II 'vi$> ! I P _ .:6n . . xp. ---- 0 0 0 0 !. II
- J ,
Y ealwaev l CVCS AREA EhEjp vYL v 0 0 0 0 - 4 e
? ,le O O O O O
- m -
m.c zym , A IS n.m
- _ O v4
-y m s%
XS - - o O c a . g.).O ! - . 5,
!.* m F@ tams u--- b I i
crv crw O rb , l m b
w%, LEGEND
. = DDDRVAY DPENING 0 VERTICAL
= ACCESS DPENING O O O E -
Q cDum E N U O -
- i. i.t -:-
,> : gg rtDan sARRIER m u r
- LT--
- tr~ J
[:!: :ij 3-HR FIRE BARRIER k%%% N E-3 . O 2 O E T" ND$0"!RR$ 5!. A P Ei? 1li O O E FOR NDTES SEE FIGURE 3.8-5, SH 12
.c
;s.
',1 1
CONTROL COMPLEX O E Also Av11,,ai.,e on 3 .ELEC , QUIP -
. ,, 4-m
.; 374]pg Apertur<. Card
" ,.!Ei: ==== E DIV] . NA
,"- d. 1==
l V'
! uvt$CNAL
) ;: - ^ i VALL j( [J :i <
}'
. A m- P _F
. b 6 Lect.
/ ,
"*>' - O E CONTROL COMPLEX
.- 0 0 [
twat [L E-~~3 O O E
.3-.-
T "~ =c - 1, rt_ t . n i. _a Q - *' 930(p2Y0098') s ::
< .a m, O O O O .
-=
[
- Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure fff / u PLAN AT LEVEL 4 3.8-5 I
Sheet 6 o_f 1,2
~%
~-
434'-0* (*4'-0') I k -' (SEE NOTE 4) O e . l .- Y -
+-
m ,PLawr artr:Totitm I N
, O O O se"h% O O EXHAUST MAIN STEAM VALVE HOUSE-
='
r"' u;- v/N .N>E< . BUILDING ,. 0- CONTAINMENT g :=== f~ l FUEL Fl4NDLIIJG arf;A
== / SECDNDARY SHIELD vALL l
(CRAM VALU DIVI $ l V' ELECT -
,j EQUIP a:'
SPENT
- FUEL f") 2A' STORAGE AREA O " .
~~
[_ g FUEL TRANITER TUBE
@ l l II....:S I] l s
civrs:DNAL
^ ^
l j g UALL A CVCS AREA O O O i
.i.d
,i
' b a, , -
.s l ELECT O ( O E : Ecu1P 5 ::
- PER10NNEL
'" r. gg ;'- AIR LOCK
- 11DNAL .
U~. *
}
. m_. .
unemes: m w w 3 ~ O O r_n -- t l $h ' I
' MAIN STEAM VALVE HOUSE -
O O F n:EsEtGENERATOR
/ ExsAusi
__ 4 i I m W L_ ___ 7 .. - - _ _
m a*** LEGEND e = DODRVAY DPENING i i VERTICAL e ACCESS OPENING
- r--:- #
C = COLUMN ! l 4 -:- l Q\] FLD0D BARRIER 1 W ) _.: l::; { {j 34fR FIRE BARRIER ODD BARR i
\ =====r . -
FOR NOTES SEE r!GURE 3.0-1 SH.12 ) - {j p g.{ g a DIVISIONAL N wm
- =====:=4; . ' ;' ;
- f
}
i
;. ;.{ l ,
skh') ;D 05Il! AO $ U
- P Aptripro Cais! !
CONTROL COMPLEX 3 b:: f f
;ac.a l CONTML RDOM h==
!{ A 3 5 DIVIS1DNAL N ,
E .:g.;.}.:.; . .W? % 4
}.
A* VALL q , 4 PRIMARY s* b SHIELD 4 t s lVALL y i
}
- - D D 0 JLJ" s
... 5
.:::7- $
- p 3.-_.rt. 1_s
== W O ;
h:N"u J J L ' l l
't a d i f!.
NO- 1 L _ !:; J'-:: 9306246098 - , ie Amendment P June 15,1993 , m NUCLEAR ISLAND STRUCTURES Figure jff / u PLAN AT LEVEL 5 3.8-5 Il Sheet 7 of 1 a
4 34'-0* (*4'-0') . Ib (SEE NOTE 4) - O l=.\J e p
~
- pun mennam l- _
O O. MAIN STEAM : VALVE HOUSE-- , i . -
' U gl_ STAIRS .
U ((g 6 ......+
, 0 .
.~
-*~"
HVAC l FUEL FIANDLit!G L- - ARI.A HVAC . CDNT AINMENT < DIVIS10'ML VALL 80"t
- r] ' I 5'af ,
e - P u-f
@ l l l l l 52vis2= : N u
y j, vatt W)..- A
~
O E O O O O O O Z O -
-. -. .- j-. :I O
O O 'J "N l l "b . c- HVAC CDNTAINMENT N .I ca L . y m m , b. - O O lO O-
! $Yl sTAlas lM n n MAIN STEAM q VALVE HOUSE O O e
l CQ i N i m == *w. a
-mumEnh.ma-_Jdammmm..--
.,,.ms LEGEND
.
- DODRVAY OPEN;NG VERTICAL
'~ = ACCESS OPENING v.
$ O
^
= CILUMN 2
g (\\] FLOOD BARRIER
;d; .: l:i: :ij 3-HR rieE sARRitR
' 'ar%; L 8%%N l O O J O .
. .]
HVAC Y _ O ] E O .; FOR NOTES SEE r!GURE 3.8-5, SH.12 ; t
- ECONDARY ,sa -
* ! ' l 's '
,-e I iy' IA?3j"p GELD t1ALL DIVISID*ML!
(CDANE . , , , , , :.p y. 3 ( /\ I(l# VQLL)
- VALL l si AIRSi .
,\i.- o ', , .i t ::bi ' (I n A periu re f.'at'd
- COMPLEX i
.d::.
a
.-_:. Cg .
A ) l "IX'*:'f'- :. Ai: ' l vALL / N [ O V . HVAC taL h O O 3- r* i j ' q lql j.== y h
.E W
9309240098 - Amendment P 5 June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure jff / u PLAN AT LEVEL 6 3.8-5 Il She'et 8 of 12
o- - 4 34'-O' (* 4'-0') A " (SEE NOTE 4) g ^ /'N e %) y
- b. , A CL ANT fyrfDf' ATith 1
O O Of MAIN STEAM VALVE HOUSE
.- .. m m l
kj ST AIRS @ FUEL HANDLING ~ AREA 8 *d
;l 3 O N 0 0 g
m
=_
h 7 a g -
/ %
D b' Ir .
;c:n
~ o I i
^
3 D X , X O O O O r3 X . \N // O O O L
- " '1
/
7 u u u a O O O a _ #
$,, Q~sTA:as l%
n n MAIN STEAM VALVE HOUSE-O O mesufu N
}~
LEGEND e = DDORWAY DPENING VERTICAL CDNTROL RODH = ACCESS - AIR INTAKE DPENING
~
NJ M . E :. O = CDLUMN G : or -.- Q\] FLUDD BARRIER l::: :!l 3-HR FIRE BARRIER SHIELE p gfg
- BUILDING
,\
FDR NDTES SEE FIME 3.0-5, SH 12 CONTAINMENT 5$
.yne SECONDARY SHIELD VALL
,/iI*3'd
,=i (CRANE VALL)
I CONTROL u Mtu COMPLEX q, ,F;d Jk A
/
p sw ELEV 73062 Y0098-e b N CONTROL RUDM A!R INT AKE Amendment P June 15,1993 TM NUCl. EAR ISLAND STRUCTURES Figure jff / u PLAN AT LEVEL 7 3.8-5 Il Sh'eet 9 of 12
6- -
\
4 3 4'-0* (14 '-0') A " cstt wait 4) e !g _ _ n, t' %) y _ L- A RAarttRNWTaTEN DIESEL GENERATOR MAIN STEAM VALVE AREA 1.!
- CCv 2., '
L~l 7 ;; wN FUEL HANDLING AREA 4*0 d O If NN HVAC CONTAINME X D V '\N h 0 m u li 0 B l ff
" VI5! N
? b m m.x.3 JL VAd n HVAC A
E,. J' JO O D. O R svAC N n_.,., c- . - -- // s O O O O O a y g -- ELEV STAIRS CCV DIESEL GENERATOR MAIN STEAM VALVE AREA N
~
y ~.
~ f.- e I
I h LEGEND ~ [ t i i
. 4 % .e aeENING :
Y 6 VERTICAL $-
= ACCESS DPENING f
.a TSC i 0 - am i
.I Qg rLDDD BARRIER g
[i;
- j:] 34R r!RE BARRIER .;
SHIELD DB R BUILDING f SI i FOR NOTES SEE FIGURE 3.8-5 SH 12 ,- EECONDARY - ' *";;JEe CARD vAtu - . Also Available On CONTROL A] 1 Ure M .' COMPLEX n . A /
.l
/ f3C(p2 WOO 90 ~ i-Amendment P ( June 15,1993 m NUCLEAR ISLAND STRUCTURES Figure.- j$ / u PLAN AT LEVEL 8 3.8-5 Il . Sheet 10 of 9
4 34'-O' (2 4'-0')
~
Jk (SEE NOTE 4)
'g ._ A ,
9~ () M
.a "-m en etw wwwurm
(
\ mtsEt MAIN STEAM GENERATOR VALVE HOUSE EXHAUST
.' n
' G Y
O W
." E UNIT VE
$ $ O g m J L A
\ SHIELD BUILDING
_- /' MAIN STEAM F EI??Aroe Gt
#H *T EXHAU5T l
f4 h
)
~ . ,
LEEEND l l e
- DDDRVAY DPENING
[ VERTICAL b CDNTirDL RDDM g = ACEETS AjR INT AKE DPENING i o . C_ 1
)[
(\\] FLDDD BARRIER
-i lf
.::l 3-HR FIRE BARRIER l::
b D D BARR 1 rDR NDTES SEE FIGURE 3.0-5, SH.12 -
**5 1
- 5. 3'I . Id k.I }I b h 20 %
1 i D:- ,s .:ll
- ie (in f
.g ap : :rr i' d ! 2 6 l A ! MINIMUM DIST ANCES FROM i CONTROL RDOM AIR INTAKES ! (SEE NOTC 7) ! LDCATION TO LDCATIDN [IN"U" STANCE
@ @ 103'-o'
@ @ eso'-o'
@ @ @ 63'- o *
@ @ ett'-o'
@ @ 150'-o'
@ @ 150'-o' eso*-o' l CO.NTROL INuxE RDDH @ O 63'-o'
\ l @ @ 2 11'- o*
' 150'-o-ri @ @
@ @ 150'-o' Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure jfd(( / u PLAN AT ROOF 3.B-5
. . , _ ~
II Sheet 11 of 1
o- %, i NOTES FOR FIGLIRESi
- 1. FLODD DOORS ARE PROVIDED IN FLODD BARRIERS. AND PENETRATIONS 6. 200'-0' (*
ARE SEALED UP TO THE EXTERNAL AND INTERNAL FLOOD LEVELS. CONTAlf SENSORS ARE PROVIDED ON FLD0D DOORS VITH OPEN AND CLOSE 100'-O' 4 STATUS INDICATIONS AT A MONITORED LOCATION. ELEVAT i PLANT l ONE AD:
) 2. 3-HOUR FIRE RATED DDORS AND ELECTRICAL AND MECHANICAL SPHERE PENETRATION SEALS ARE PROVIDED FOR OPENINGS IN THE 3-HOUR t FIRE RATED BARRIERS.
- 7. THE MINIF ELEVA1
- 3. THE FOLLOVING STRUCTURES, SYSTEMS, AND COMPONENTS DEPICTED ON BETVE1 THESE FIGURES ARE NOT SEISHIC CATEGORY li DESCRll I DOORVAY DPENINGS l VERTICAL ACCESS OPENINGS STAIRS f
l ELEVATORS ( l 4. THIS DIMENSION IS MEASURED AT THE TOP ELEVAT10N OF THE LEVEL 4 l REINFORCED CONCRETE FLDOR (10'-6') IN A DIRECTION PARALLEL TO THE RESPECTIVE PL ANT ORIENT ATION AZIMUTH, O' - 180* (12*) DR 90* - 270* (12'), l BETVEEN THE EXTERIOR SURFACES OF THE REINFORCED CONCRETE AT THE CORNERS SHOVN.
- 5. THIS DIMENSION IS THE DIFFERENCE BETVEEN THE PLANT GRADE ELEVATION AND THE TOP ELEVATION OF THE LEVEL 1 REINFORCED CONCRETE FLDDR AT THE LOCATIONS INDICATED ON FIGURE 3.8-5, SH. 3.
THE PLANT GRADE ELEVATION IS DETERMINED AT THE EXTERIOR CORNER OF THE REINFORCED CONCRETE VALL ADJACENT TO THE LOCATIONS INDICATED ON FIGURE 3.8-5, SH. 3.
; LEGEND l
ABEREVI ATIONjk
. nooRvAv orEwc BLDG BUILDING CDNT CONTAINMENT VERTICAL
*A g5 3 ELECT. ELECTRICAL ELEV ELEVATOR O = column EQUIP . EQUIPMENT a
j HR . HOUR f (\\] FLDDD BARRIER MAINT . MAINTENANCE fl 1:: ::l 3-HR FIRE BARRIER SYS SYSTEM f b k$DBARRN l l
~- s l
P-Oo) IS THE INSIDE DIAMETER OF THE STEEL MENT SPHERE. THE INSIDE RADIUS OF THE SPHERE IS
- 21'- 0'). THE INSIDE RADIUS IS MEASURED AT THE (DN OF THE CENTER OF THE SPHERE (20'-6') IN FOUR DIRECTIONS, JRIENTATION AZlMUTHS 0* (15*), 90* (15*), 180* (15'), 270* (15*).
ilTIONAL INSIDE RADIUS IS MEASURED FROM THE CENTER OF THE VERTICALLY (15*), TO THE TOP OF THE CONTAINMENT, JM DISTANCE IS MEASURED IN A HORIZONT AL DIRECTION AT THE l0N OF THE CENTERLINE OF THE CONTROL ROOM AIR INTAKE (10'-6') 1 THE IDENTIFIED LOCATIONS. THE LOCATIONS ARE FURTHER ZD AS FOLLOVSi AND h - THE INTERSECTION OF THE CENTERLINE OF THE CONTROL ROOM AIR INTAKE VITH THE PLANE OF THE EXTERIOR REINFORCED CONCRETE NUCLEAR ANNEX VALL. AND @ THE POINT ALONG THE LINE FORMED BY THE INTERSECTION .. NI OF THE REINFORCED CONCRETE SHIELD BUILDING EXTERIOR VALL AND THE EXTERIOR SURFACE OF THE REINFORCED 'q pp' g (~g y" CONCRETE NUCLEAR ANNEX ROOF THAT IS CLOSEST TO THE CONTROL ROOM AIR INTAKE. C'CD AND h - THE INTERSECTION OF THE REINFORCED CONCRETE MAIN STEAM VALVE HOUSE EXTERIOR VALL, THE REINFORCED CONCRETE M M Me f)n SHIELD BUILDING EXTERIOR WALL, AND THE EXTERIOR SURFACE Aprwre C 'M I OF THE RE]NFORCED CONCRETE NUCLEAR ANNEX ROOF. I
@ - THE INTERSECTION OF THE CENTERLINE OF THE UNIT VENT VITH THE PLANE PASSING THROUGH THE TOP SURFACE OF THE UNIT VENT.
AND h THE INTERSECTION OF THE CENTERLINE OF THE DIESEL GENERATOR EXHAUST VITH THE PLANE PASSING THROUGH THE TOP SURFACE OF THE DIESEL GENERATOR EXHAUST. AND h - THE POINT ALONG THE LINE FORMED BY THE INTERSECTION OF THE REINFORCED CONCRETE MAIN STEAM VALVE HOUSE EXTERIOR VALL AND THE EXTERIOR SURFACE OF THE REINFORCED CONCRETE NUCLEAR ANNEX RODF THAT IS CLOSEST TO THE CONTROL ROOM AIR INTAKE. 730 u400 W Amendment P June 15,1993 TM NUCLEAR ISLAND STRUCTURES Figure jf[g / u NOTES, LEGEND, AND ABBREVIATIONS 335 ll Sheet 12 of 1;
CESSAR HSincari:n (s** 1 or 3) i i
,r% \ /
v l 1 EFFECTIVE PAGE LISTING i CHAPTER 2 Table of Contents Page Amendment i P ii N iii N iv I v I vi N vii N viii N ix N Text ( f) Page Amendment
) %J 2.0-1 P 2.1-1 P 2.2-1 P 2.3-1 P 2.3-2 P 2.3-3 N 2.3-4 N 2.4-1 P 2.5-1 N 2.5-2 P 2.5-3 P 2.5-4 N 2.5-5 N 2.5-6 N 2.5-7 N 2.5-8 N 2.5-9 P 2.5-10 P 2.5-11 P 2.5--12 P 2.5-13 I /' h i \
N..Y Amendment P June 15, 1993
CESSAR E!!n"lCATIEN (Sheet 2 of 3) O! 1 EFFECTIVE PAGE LISTING (Ce o'd) CHAPTER 2 Tables Amendment 2.0-1 (Sheet 1) N 2.0-1 (Sheet 2) N ! 2.0-1 (Sheet 3) N 2.3-1 N 2.3-2 N 2.3-3 N Ficures Amendment 2.5-1 I 2.5-2 J 2.5-3 I 2.5-4 I 2.5-5 N ' 2.5-6 N 2.5-7 N 2.5-8 N 2.5-9 N 2.5-10 N 2.5-11 N 2.5-12 N i 2.5-13 N 2.5-14 N 2.5-15 N 2.5-16 N 2.5-17 N 2.5-18 N 2.5-19 N 2.5-20 N 2.5-21 N 2.5-22 N 2.5-23 N i 2.5-24 N i 2.5-25 N 2.5-26 N ) 2.5-27 N l 2.5-28 N { 2.5-29 N l 2.5-30 N ' 2.5-31 N i 2.5-32 N 2.5-33 N j l Amendment N April 1, 1993
CESSAR EnH"icar 2n
,\
t ).
'%j' TABLE OF CONTENTS CHAPTER 2 Section Subiect Page No.
2.0 SITE ENVELOPE CHARACTERISTICS 2.0-1 2.1 GEOGRAPHY AND DEMOGRAPHY 2.1-1 2.1.1 SI,TE LOCATION AND DESCRIPTION 2.1-1 2.1.1.1 Site Location 2.1 2.1.1.2 Site Area Man 2.1-1 2.1.1.3 Boundaries for Establishina 2.1-1 Effluent Release Limits 2.1.2 EXCLUSION AREA AUTHORITY AND CONTROL 2.1-1 fm 2.1.3 POPULATION DISTRIBUTION 2.1-1 (
\_- l 2.2 NEARBY INDUSTRIAL, TRANSPORTATION, 2.2-1 AND MILITARY FACILITIES 2.2.1 AIRCRAFT HAZARDS 2.2-1 2.2.2 TRANSPORTATION 2.2-1 2.2.3 OTHER INDUSTRIAL HAZARDS ON AND OFF 2.2-1 SITE I
2.3 METEOROLOGY 2.3-1 2.3.1 REGIONAL CLIMATOLOGY 2.3-1 2.3.1.1 Low Temperature Effects 2.3-1 2.3.2 LOCAL METEOROLOGY 2.3-1 1 2.3.2.1 Tornados 2.3-1 l 2.3.3 ONSITE METEOROLOGICAL MEASUREMENTS 2.3-2 PROGRAMS l /N 2.3.4 SHORT-TERM (ACCIDENT) DIFFUSION 2.3-3 l i,, ) ESTIMATES (x/Q) s./ Amendment P i June 15, 1993
L CESSAR E!L"icm2. O TABLE OF CONTENTS (Cont'd) CHAPTER 2 Section Subject Page No. 2.3.5 LONG-TERM (ROUTINE) DIFFUSION 2.3-3 ESTIMATES (x/Q) 2.3.6 ONSITE (ACCIDENT) DIFFUSION 2.3-4 ESTIMATES (X/Q) f 2.4 HYDROLOGIC ENGINEERING 2.4-1 2.4.1 EXTERNAL FLOODS 2.4-1 2.4.2 INTERNAL FLOODS 2.4-1 I 2.5 GEOLOGY, SEISMOLOGY, AND 2.5-1 GEOTECHNICAL ENGINEERING 2.5.1 BASIC GEOLOGIC AND SEISMIC 2.5-3 ) INFORMATION '
)
2.5.2 VIBRATORY GROUND MOTION 2.5-3 l 2.5.2.1 , Seismicity 2.5-3 1 2.5.2.2 Geolocic and Tectonic 2.5-3 Characteristics of Site and Recion 2.5.2.3 Correlation of Earthauake 2.5-3 Activity with Geologic Structure or Tectonic Provinces 2.5.2.4 Maximum Earthauake Potential 2.5-3 2.5.2.5 Seismic Wave Transmission 2.5-4 Characteristics of the Site 2.5.2.5.1 Control Motion 2.5-4 2.5.2.5.2 Generic Soil Sites 2.5-6 O Amendment N 11 April 1, 1993
CESSAR E!54inem2. (e s't
\x.-}
TABLE OF CONTENTS (Cont'd) CHAPTER 2 Section Subiect Pace No. 2.5.2.6 Fafe Shutdown Earthauake 2.5-7 2.5.2.7 Site Response 2.5-7 2.5.2.7.1 Method of Analysis 2.5-7 2.5.2.7.2 Results 2.5-8 2.5.3 SURFACE FAULTING 2.5-9 2.5.4 STABILITY OF SUBSURFACE MATERIALS 2.5-9 AND FOUNDATIONS 2.5.4.1 Geoloaic Features 2.5-9
/s 2.5.4.2 Properties of Underlyina 2.5-9 1
Materials 2.5.4.3 Relationshin of Foundation to 2.5-10 Under1vina Materials 2.5.4.4 Soil and Rock Characteristics 2.5-10 2.5.4.5 Excavation and Backfill 2.5-10 2.5.4.6 Groundwater Conditions 2.5-10 2.5.4.7 Response of Soil and Rock to 2.5-10 Dynamic Loadina 2.5.4.8 Liauefaction Potential 2.5-10 2.5.4.9 Earthauake Desian Basis 2.5-10 2.5.4.10 Bearina Capacity 2.5-11 2.5.4.11 Criteria and Desian Methods 2.5-11 2.5.4.12 Techniaues to Imorove 2.5-11 Subsurface Conditions
/^}N
(
\s-Amendment N iii April 1, 1993
CESSAR 8nHr"ic.1,su O TABLE OF CONTENTS (Cont'd) ! CHAPTER 2 l Section subiect Page No. ) 2.5.5 STABILITY OF SLOPES 2.5-11 2.5.5.1 Slope Characteristics 2.5-11 2.5.5.2 Desian Criteria and Analyses 2.5-11 2.5.5.3 Investications of Borinas, 2.5-11 Shafts. Pits. Trenches 2.5.5.4 Properties of Borrow Material 2 2.5-12 Compaction and Excavation Specifications O l O Amendment I iv December 21, 1990
s (;IE iSiALFt Ein'iflCAT13N r l
~
1 V 2.0 SITE ENVELOPE CHARACTERISTICS The System 80+ Standard Design is designed on the basis of a set of assumed site-related parameters. These parameters were selected to envelope most potential nuclear power plant sites in the United States. A summary of the assumed parameters is provided in Table 2.0-1. Detailed site characteristics will be provided by the COL applicant referencing the System 80+ Standard Design for any specific application. These characteristics will be reviewed and compared to the enveloping assumptions of Table 2.0-1. Should specific site parameters or characteristics be outside the envelope of assumptions established by Table 2.0-1, the applicant will demonstrate that the specific site parameters do not exceed the capacity of the design. The remainder of this chapter identifies specific assumptions related to site characteristics that are employed in the evaluation of the System 80+ Standard Design. ,m , \ p iw Amendment P 2.0-1 June 15, 1993
CESSAR nainCAT13N v 2.1 GEOGRAPHY AND DEMOGRAPHY 2.1.1 BITE LOCATION AND DESCRIPTION No spec fic assumptions were employed in the evaluation of the i System 80+ Standard Design. Site-specific information on the site and location will be provided by the COL applicant referencing the System 80+ Standard Design. 2.1.1.1 Site Location Considerations of site location for the System 80+ plants are made for the purpose of minimizing the risk significance of site-dependent characteristics on plant design. Sections 2.2 through 2.5 discuss System 80+ plant siting considerations for site-dependent design parameters. Chapters 3, 9, and 13 also discuss System 80+ design features incorporated to mitigate the consequences of site-dependent and site-independent parameters. 2.1.1.2 Site Area Map
- c. The site area map is site-specific and will be provided with
( other site-dependent information. 2.1.1.3 Boundaries for Establishing Effluent Release Limits Boundary distances have been selected for an exclusion area and a low population zone as defined in 10 CFR 100.11. These distances are employed in Sections 2.3.4 and 2.3.5 to calculate estimates for diffusion of radiological releases. A site specific application will address the combined influences of site characteristics and local meteorology on diffusion of releases. 2.1.2 EXCLUSION AREA AUTHORITY AND CONTROL No specific assumptions were employed in the evaluation of the System 80+ Standard Design. Site-specific information on the exclusion area authority and control will be provided by the COL applicant referencing the System 80+ Standard Design. 2.1.3 POPULATION DISTRIBUTION No specific assumptions were employed in the evaluation of the System 80+ Standard Design. Site-specific information on population distribution will be provided by the COL applicant referencing the System 80+ Standard Design. C ( Amendment P 2.1-1 June 15,1993
CESSAR2necma Y 2.2 NEARBY INDUSTRIAL, TRANSPORTATION AND HILITARY FACILITIES _ Industrial, transportation and military hazards are discussed below. 2.2.1 AIRCRAFT HAZARDS A site is acceptable for the System 80+* without further review if the distances from the plant meet the following requirements: A. The plant-to-airport distance D is between 5 and 10 statute miles, and the projected annual number of operations is less than 500 D,2 or the plant-to-airport distance D is greater than 10 statute miles, and the projected annual number of operations is less than 1000 D 2, B. The plant is at least 5 statute miles from the edge of military training routes, including low-level training routes, except for those associated with a usage greater than 1000 flights per year, or where activities (such as practice bombing) may create an unusual stress situation. iA) v C. The plant is at least 2 statute miles beyond the nearest edge of a federal airway, holding pattern, or airport. If the above site proximity acceptance criteria are not met, or if sufficiently hazardous military activities are identified, a detailed review of the aircraft hazards must be performed to qualify a specific site for the System 80+" plant. 2.2.2 TRANSPORTATION Site-specific information on transportation will be provided by the COL applicant referencing the System 80+ Standard Design. A closed-cycle cooling system (the ultimate heat sink, Section 9.2.5) which provides the source of cooling water for all safety-related plant systems and components during all modes of operation is incorporated in the System 80+ Standard Design to eliminate the potential impacts on plant operations from boat or barge accident events. I 2.2.3 OTHER INDUSTRIAL HAZARDS ON AND OFF BITE Site-specific information on hazards will be provided by the COL applicant referencing the system 80+ Standard Design. Amendment P 2.2-1 June 15,1993
CESSAR nainema f~)l
\ \_/
2.3 METEOROLOGY Meteorology parameters are as specified in Table 2.0-1. Site-specific meteorology information will be provided by the COL applicant referencing the System 80+ design. 2.3.1 REGIONAL CLIMATOLOGY Site-specific information will include regional climatology. l 2.3.1.1 Low Temperature Effects The effects on the plant from low temperatures events, such as frost, snow fall, and ice cover, are considered in the design process. Structures are designed to withstand loadings in excess of the loads generated from combinations of snow, ice, and rain. Ventilation paths are designed and reviewed to verify that they are free from snow blockage. 2.3.2 LOCAL METEOROLOGY [\
\m /
No specific assumptions were employed in the evaluation of the System 80+ Standard Derign other than the assumptions in Sections 2.3.4 and 2.3.5 that establish the values of relative concentrations for the accident analyses in Chapter 15. As indicated in Table 2. 0-1, pressure ef fects and missile spectra associated with the design tornado are considered to be controlling. Site-specific will include an evaluation to assure l that this assumption is not violated for the specific site selected or will perform additional analysis for any potential hazards that are more limiting than the parameters given in Table 2.0-1. 2.3.2.1 Tornados Tornado characteristics are as specified in Table 2.0-1. 1 Tornado-generated missiles are considered in the System 80+ Standard Design (See Section 3.5). l Structures housing safety-related equipment are designed to I withstand the loadings generated by 330 mph winds. j Safety-related equipment is not located in the turbine building, which is not designed to withstand as high a wind loading. Tornados that occur at the plant site, causing extensive damage (]g g to the switchyard and a prolonged loss of offsite power, are l quantitatively evaluated. l Amendment P 2.3-1 June 15,1993
CESSAR8!nb mu O Section 3.3 provides additional information regarding design for tornado loading. I 2.3.3 ONSITE METEOROLOGICAL MEASUREMENTS PROGRAMS No specific assumptions were employed in the evaluation of the System 80+ Standard Design. O i O' Amendment P 2.3-2 June 15,1993
CESSAR niWicariou n V i 2.4 HYDROLOGIC ENGINEERING Hydrologic engineering parameters are as specified in Table ' 2.0-1. Site-specific hydrologic information will be provided by i the COL applicant referencing the System 80+ Standard Design. This information will include the following considerations as appropriate for the specific site: external floods; probable maximum flood on streams and rivers; potential dam failures; , probable maximum surge and seiche flooding; probable maximum tsunami loading; ice effects; cooling water canals and , reservoirs; channel diversions; flood protection requirements; l cooling water supply; groundwater; potential accidental release i of liquid effluents in ground and surface water, and technical i specifications and operation requirements. I 2.4.1 EXTERNAL FLOODS The site-specific flooding projections will consider severe precipitation, snow melt, flooding due to ice cover, river flooding, ocean flooding, tsunami flooding, seiche effects, wave and storm surge effects, hurricane effects, high lake levels and any other effects appropriate for the specific site. >O Intake structures will be designed to preclude the potential for debris blockage caused by wind, wave, and other effects. 2.4.2 INTERNAL FLOODS See Section 3.4. (3 LJ Amendment P 2.4-1 June 15, 1993
CESSAR En!inc- _ 2.5 GEOLOGY, SEISMOLOGY, AND GEOTECHNICAL ENGINEERING To cover a range of possible site conditions where System 80+ may be constructed, a range of generic site conditions was selected for geologic and seismologic evaluation (Figure 2.5-1). The System 80+ is a standard plant design to be built on a suitable site. The basis for selecting any particular site is documented in the site-specific Safety Analysis Report (SAR). Site geologic features, seismological features, liquefaction potential, site instability, ground rupture and man-made conditions are included in the site-specific SAR. Site-specific investigations, including borings, are conducted in accordance with 10 CFR 50 and 100 (Reference 2) and Standard Review Plan 2.5 (Reference 3). Any deviations from Reference 3 are identified and justified in the site-specific SAR. The total depth to bedrock for each site condition and the dynamic soil properties (in terms of maximum shear wave velocities and their variation with depth, and in terms of the variations of modulus and damping with strain) were established to cover a wide range of sites and to provide reasonably s conservative results. Using these site conditions and the [d
\ variations of maximum shear wave velocities, developed; 12 soil cases and one rock outcrop case.
selected are summarized in Section 2.5.2, and 13 more cases were The cases details for each case are included in Appendix 2A. For the System 80+ seismic design, three control motions were developed which, when combined cover the majority of potential sites in the continental U.S. Sites near active faults such as those in California are excluded. The twelve generic soil sites and one rock site were evaluated for each of the control motions. To cover sites with deep soil deposits, a control motion with a Regulatory Guide 1.60 spectral shape is used as the input motion to the ground surface of each site. To cover shallow soil sites, two rock motions applied at a hypothetical rock outcrop are used. The selection of the two rock outcrop motions was performed using low frequency content consistent with industry-wide accepted response spectra, and high frequency content that exceeds the current industry practice. The enrichment of the rock outcrop motions with high frequency content is consistent with recent studies on Eastern North America seismicity and is a proactive I measure of the System 80+ design in anticipation of future trends in the industry regarding seismic motions. The control motions described in this section are intended to provide future owners of System 80+ design with high confidence that the design is suitable for most sites in the United States, k l I Amendment N 2.5-1 April 1, 1993 1
CESSAREnnnc. O' To assess whether a site is suitable for construction of the System 80+ Standard Design, both the following Acceptance Criteria (Site Conditions and SSE Ground Motions) must be satisfied. l A. Site Conditions
- 1. The soil profile should have a (low-strain) shear wave velocity profile within the range shown in Figure 2.5-2. Although the soil response of a specific new soil profile could differ from the results obtained for each of the cases included in Reference 1, it would be covered by the envelope of the soil cases considered in the soil response analyses of Reference 1.
- 2. A soil site having a total depth to bedrock greater than that shown in Figure 2.5-1 is acceptable, because it would be covered by the soil cases analyzed.
- 3. All rock sites (with no soil deposits below the foundation level) are acceptable.
B. (SSE) Ground Motion The acceptance criteria for the Ground Motion are given in Figure 2.5.38. Site-specific free-field response spectra at the ground surface and the foundation elevation will be provided by the COL applicant referencing the System 80+ Standard Design. These spectra will be compared to the System 80+ free-field spectra as outlined by the procedure in Figure 2.5-38. If a limited site-specific confirmatory analysis must be performed, the in-structure spectra will be compared at the following locations:
- a. Foundation Basemat Elevation +50 ft.
- b. Interior Structure Elevation +91.75 ft.
- c. Control Room Elevation +115.5 ft.
- d. Top of Steel Containment Vessel Elevation +251 ft.
O-Amendment P 2.5-2 June 15, 1993
CESSAR na%mou ! V 2.5.1 DASIC GEOLOGIC AND SEISMIC INFORMATION The objective of this section is to describe geologic and seismic features that affect the site under review. Site-specific regional and site physiography, geomorphology, stratigraphy, lithography, and tectonics information will be provided by the COL applicant referencing the System 80+ Standard Design. 2.5.2 VIBRATORY GROUND MOTION Site-specific geological, seismological, and geotechnical data will be provided by the COL applicant referencing the System 80+ Standard Design. 2.5.2.1 Seismicity The complete historical record of earthquakes in the region will be included in the site-specific data. At that time, all available information pertaining to and concerning epicenter l coordinates, depth of focus, origin time, highest intensity, magnitude, seismic moment, source mechanism, source dimensions, distance from site strong motion recordings, and earthquake-induced geologic failures will be provided for each event. O 2.5.2.2 Geologic and Tectonic Characteristics of Site and Region In the site-specific information, tectonic provinces will be established based on the development and characteristics of thel current tectonic regime of the region and the pattern and level of historic seismicity. This will lead to a determination of the earthquake-potential of all identified geologic structures within the regions. 2.5.2.3 Correlation of Earthquake Activity with Geoloqic Structure or Tectonic Provinces The relationship between earthquake activity history and the geologic structure or tectonic provinces of a region will be included in the site-specific information. Detailed accounts l coniparing and contrasting the geologic structure (s) involved in the earthquake activity with other areas within the tectonic provinces will be supplied. 2.5.2.4 Maximum Earthquake Potential The free field control motion described in Section 2.5.2.5 will be shown to envelop the maximum possible vibratory ground motion at the site, by the site-specific analysis. This determination will be based on the maximum credible earthquake associated with each site-specific geologic structure, or on the maximum historic earthguake associated with each tectonic province, and will be supplied in the site-specific SAR. Amendment P i 2.5-3 June 15, 1993 l
CESSAR n Wicarian O 2.5.2.5 Beismic Wave Transmission Characteristics of the Site 2.5.2.5.1 Control Motion The Control Motion design response spectra are anchored to a 0.3g peak ground acceleration. They were developed with the objective of being in full compliance with the SRP requirements as well as the EPRI ALWR recommendations report. Again, to cover a maximum range of possible sites where the System 80+ standard design may be constructed, three separate control motion spectra were developed. These are: A. Control Motion Spectrum 1 (CMS 1): This spectrum is a soil spectrum, it is identical to Regulatory Guide 1.60 (R.G. 1.60) spectrum and it is considered in order to cover sites with deep soil deposits. B. Control Motion Spectrum 2 (CMS 2): This is a rock outcrop spectrum and is developed to cover sites typical of Eastern North America which could be subjected to earthquakes with high frequency content. C. Control Motion Spectrum 3 (CMS 3): This is a rock outcrop spectrum and is developed based on recommendations of the NUREG/CR-0098 (Reference 3) primarily to cover lower frequency motions which may not be covered by CMS 2. It is also greatly enhanced in the high frequency range to cover earthquakes with high frequency content. The maximum spectral acceleration range is extended to 15 Hz, as opposed to 8 Hz which is used in NUREG/CR-0098 motions. All of the above Control Motion Spectra are shown in Figure 2.5-5. CMS 2 and CMS 3 are intended for application at the rock outcrop, and CMS 1 is intended for application at the free-field ground surface. All three motions are applied to each of the 13 sites to conservatively cover all combinations. The logic for selection process of each of these control motion spectra is described in more detail below: Selection Process for CMS 1 The spectrum shape corresponding to this control motion is as per the requirements of R.G. 1.60. This spectrum shape is chosen in order to be in full compliance with the SRP Section 2.5 requirements as well as the EPRI ALWR recommendations, and is intended to cover deep soil sites. The control motion is anchored to a peak ground acceleration of 0.3g for the two horizontal directions and the vertical direction. Amendment N 2.5-4 April 1, 1993
CESSAR MAOic4Ii::n . ,a ( ) l V l l instability or ground rupture due to steep topography, soft soils, liquefaction or fault rupture are treated as site-specific-issues. The enveloping analyses performed were based on the distribution of maximum shear wave velocities with depth and thus did not require specification of a depth to water table at the site. Therefore, the water table can be at any depth as long as the variations of maximum shear wave velocities with depth are within the range discussed above and provided that any local site instability issues are resolved. 2.5.3 SURFACE FAULTING System 80+ plants will not be designed to withstand surface faulting related to earthquakes. Site-specific surface and subsurface geological and geophysical information to demonstrate that evidence of a potential for surface faulting has not been found will be provided by the col applicant referencing the System 80+ Standard Design. 2.5.4 STABILITY OF SUBSURFACE MATERIALS AND FOUNDATIONS +p\ Subsurface material parameters are as specified in Table 2.0-1. Site-specific information relating to stability of subsurface materials and foundations resulting from site geotechnical and geophysical investigations will be provided by the COL applicant referencing the System 80+ Standard Design. Information for the specific site will include: geologic features underlying the site; properties of materials underlying the site and a description of the state of the art methods used to determine the static and dynamic engineering properties of foundation soils and rock in the site area; engineering classification and description of materials supporting the structural foundations; data concerning the extent of Seismic Category I excavations and backfills; groundwater conditions relative to foundation stability of safety-related Etructures; and liquefaction potential including testing methods used in the evaluation. 2.5.4.1 Geologic Features Sita-specific information will include geologic features underlying the site. 2.5.4.2 Properties of Underlying Materials State-of-the-art methods used to determine the static and dynamic engineering properties of foundation soils and rocks in the site (y area will be included in the site-specific information. Amendment P 2.5-9 June 15, 1993
CESSAR Eininc-0 2.5.4.3 Relationship of Foundation to Underlyina Materials Plot plans and profiles of site explorations will be included in the site-specific information. 2.5.4.4 Soil and Rock Characteristics Results for geophysical investigations performed at the site, including compression and shear wave velocity data from borings, are included in the site-specific information. 2.5.4.5 Excavation and Backfill Site-specific information provided will include sources, quantities and engineering properties of borrow materials; compaction requirements; results of field compaction tests; and fill material properties such as moisture content, density, permeability, compressibility, and gradation. 2.5.4.6 Groundwater Conditions Site-specific information will include critical cases of groundwater conditions during plant construction and plant life. Also, soil properties assumed in design will be confirmed for all groundwater conditions. 2.5.4.7 Response of Soil and Rock to Dynamic Loading Site investigations will determine the effects of prior earthquakes on the soils and rocks in the vicinity of the site (e.g., field seismic surveys, dynamic tests on samples of foundation soil and rock). Information provided will show that design assumptions regarding variation of shear wave velocity and material damping are applicable to the site. 2.5.4.8 Liquefaction Potential Proven testing methods (e.g., triaxial shear tests) will be used to demonstrate the soils under and adjacent to structural foundations are stable against classical liquefaction. 2.5.4.9 Earthquake Desian Basis Refer to Sections 2.5.2.6, 2.5.2.7 and Appendix 2B for a summary of the derivation of the Safe Shutdown Earthquakes. Seismic in l combination with other hazards is to be evaluated to assess site materials under dynamic conditions. O Amendment P l 2.5-10 June 15, 1993 '
CESSAR1BWicuiou
/%
U 2.5.4.10 Bearing Capacity Static analyses of the underlying material supporting the loads of fills, embankments and foundations will be performed to l determine stability, deformation and settlement of site materials. The method ' used to establish the site-specific soil bearing capacity will be described in the site-specific information. 2.5.4.11 Criteria and Design Methods The criteria, analysis techniques, and factors of safety employed in evaluating the stability of the foundations of the plant. structures will be included in the site-specific information. l 2.5.4.12 Techniques to Improve Subsurface conditions If it is necessary to improve subsurface conditions, plans, summaries of specifications, and methods of quality control will be described in the site-specific information for all techniques employed. O 2.5.5 STADILITY OF SLOPES No specific assumptions were employed in the evaluation of the System 80+ Standard Design. The site-specific information on the stability of all natural and man-made slopes, including embankments and dams, that are vital to the safety of the nuclear plant will be provided by the col applicant referencing the System 80+ Standard Design. 2.5.5.1 Slope Characteristics The site-specific information will describe the characteristics l 1 I of the slope by including slope profiles, a discussion of properties of all natural and constructed slopes and embankments, and a description of groundwater and seepage conditions. 2.5.5.2 . Design Criteria and Analyses i The site-specific information will present the design criteria and the analytical methods and results which demonstrate design l margin for all Seismic Category I slopes. 2.5.5.3 Investigations of Dorings, Shafts, Pits, Trenches O The site-specific information will present borings and soil tests l ) performed for slope stability studies and dam and dike analyses. Amendment P 2.5-11 June 15, 1993
7 CESSAR Enn"icarian I i > 0 2.5.5.4 Properties of Borrow Material, Compaction and Excavation Specifications The site-specific information will describe the excavation, l backfill and borrow material for any dams, dikes and embankment slopes. It also provides construction procedures and control of such earthworks. O O Amendment P 2.5-12 June 15, 1993
m - CESSAR 8lninem:r )
,f')
'%j Y REFERENCES FOR SECTION 2.5
- 1. Idriss, I.M., " Earthquake Ground Motions - Selection of Control Motion and Development of Generic Soil Sites".
- 2. 10 CFR Parts 50 and 100, " Reactor Site Criteria".
- 3. Standard Review Plan 2.5, " Geology and Seismology", Revision June 1987.
- 4. NUREG/CR-0098, " Development of Criteria for Seismic Review of Selected Nuclear Power Plants", N.M. Newmark, W.J. Hall, May, 1978.
O U Amendment I l 2.5-13 December 21, 1990
CESSAR nai"icarian (sneet 1 or 13) l i
'%.I EFFECTIVE PAGE LISTING CHAPTER 3 Table of Contents Page Amendment i D ii iii K iv D v D vi K vii K viii E ix P x P xi o Xii I xiii N , xiv P
[ xv N ( xvi xvil I K xviii N xix K xx E xxi E xxii P xxiii P xxiv I xxv P xxvi P xxvii P xxviii P xxix P Text Page Amendment 3.1-1 D 3.1-2 D 3.1-3 K 3.1-4 D 3.1-5 D A 3.1-6 D f ( 3.1-7 D Amendment P June 15, 1993
CESSAR nutricarisu (sneet a or 13)- O EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Text (Cont'd) Pace Amendment 3.1-8 D 3.1-9 D 3.1-10 D 3.1-11 D 3.1-12 K 3.1-13 D 3.1-14 D 3.1-15 D 3.1-16 D 3.1-17 D 3.1-18 D 3.1-19 3.1-20 D 3.1-21 D 3.1-22 P 3.1-23 K 3.1-24 K 3.1-25 D 3.1-26 D 3.1-27 K 3.1-28 D 3.1-29 K 3.1-30 D 3.1-31 K 3.1-32 K 3.1-33 I 3.1-34 D 3.1-35 K 3.1-36 D 3.1-37 D 3.1-38 K 3.1-39 I 3.1-40 K 3.1-41 1 3.1-42 I 3.2-1 K 3.2-2 N 3.2-3 N 3.2-4 K 3.2-5 D 3.3-1 N 3.3-2 I 3.3-3 N Amendment P June 15, 1993
.CESSAR E!a"lCATION (Sheet 3 of 13) '
7S ( 4 i
\,__/
EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Text (Cont'd) Pacre Amendment 3.4-1 P 3.4-2 P 3.4-3 P 3.4-4 P 3.5-1 I 3.5-2 I 3.5-3 K 3.5-4 N 3.5-5 P 3.5-6 N 3.5-7 K 3.5-8 D 3.6-1 P 3.6-2 P 3.6-3 P f 3.6-4 P ( 3.6-5 3.6-6 K J 3.6-7 K 3.6-8 K 3.6-9 K 3.6-10 J 3.6-11 J 3.6-12 P 3.6-13 J 3.6-14 N 3.6-15 P 3.6-16 P 3.6-17 P 3.6-18 N 3.6-19 N 3.6-20 P 3.6-21 N 3.6-22 J 3.6-23 N 3.6-24 P 3.6-25 P 3.6-26 P 3.6-27 P 3.6-28 P 7 3.6-29 P / ) 3.6-30 P (_,/ 3.6-31 P 3.6-32 P Amendment P June 15, 1993
CESSAR 8aelCAT13N (Sheet 4 of 13) O EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Text (Cont'd) Page Amendment 3.6-33 N 3.6-34 N 3.6-35 P 3.6-36 P 3.6-37 P 3.6-38 P 3.6-39 P 3.7-1 O 3.7-2 0 3.7-3 0 3.7-4 I 3.7-5 O 3.7-6 0 3.7-7 O 3.7-8 O 3.7-9 N 3.7-10 N 3.7-11 I 3.7-12 O 3.7-13 0 3.7-14 0 3.7-15 I 3.7-16 N 3.7-17 N 3.7-18 0 3.7-19 P 3.7-20 N 3.7-21 I 3.7-22 I 3.7-23 N 3.7-24 N 3.7-25 N 3.7-26 N 3.7-27 N 3.7-28 N 3.7-29 P 3.7-30 0 3.7-31 0 3.7-32 I 4 3.7-33 I l 3.7-34 I l 3.7-35 N 3.7-36 N l l Amendment P ' June 15, 1993
CESSAR E5Mr"icaying (Sheet 5 of 13)
,e y
( ) N_) EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 f l Text (Cont'd) Pace Amendment 3.7-37 N 3.7-38 N 3.7-39 N 3.7-40 N 3.'-41 N 3.8-1 P 3.8-2 P 3.8-3 K 3.8-4 P 3.8-5 K 3.8-6 P 3.8-7 I 3.8-8 N 3.8-9 P 3.8-10 P [ 3.8-11 K 3.8-12 P 3.8-13 P 3.8-14 N 3.8-15 P 3.8-16 P 3.8-17 P 3.8-18 N 1 3.8-19 P 3.8-20 P 3.8-21 P 3.8-22 N 3.8-23 N 3.8-24 P 3.8-25 I 3.8-26 N 3.9-1 N 3.9-2 N 3.9-3 N 3.9-4 P 3.9-5 P 3.9-6 K 3.9-7 E 3.9-8 P 3.9-9 K 3.9-10 K 3.9-11 N [')s
\v 3.9-12 E Amendment P June 15, 1993
l l CESSAR 2lMinem2n (sn==t 6 or 13) l f L 9 EFFECTIVE PAGE LISTING (Cont'd) l CHAPTER 3 l Text (Cont'd) Page Amendment 3.9-13 P 3.9-14 3.9-15 3.9-16 3.9-17 3.9-18 P 3.9-19 N 3.9-20 K 3.9-?1 N 3.9-22 K 3.9-23 K 3.9-24 N 3.9-25 K 3.9-26 3.9-27 3.9-28 3.9-29 N 3.9-30 N 3.9-31 P 3.9-32 N 3.9-33 P 3.9-34 N 3.9-35 K 3.9-36 N 3.9-37 I 3.9-38 P 3.9-39 P 3.9-40 K 3.9-41 N 3.9-42 K 3.9-43 N 3.9-44 N 3.9-45 N 3.9-46 K 3.9-47 K 3.9-48 K 3.9-49 N 3.9-50 N 3.9-51 N 3.9-52 P 3.9-53 P 3.9-54 N Amendment P June 15, 1993 i I
. . . J
CESSAR E!Mi"ic41i:n (sneet 7 or 13)
? t Lj EFFECTIVE PAGE LISTING (Cont'd)
CHAPTER 3 Text (Cont'd) Amendment 3.9-55 K 3.9-56 K 3.9-57 K 3.9-58 N 3.9-59 N 3.9-60 E 3.9-61 E 3.9-62 K 3.9-63 E 3.9-64 K 3.9-65 K 3.9-66 N 3.9-67 N 3.9-68 N 3.9-69 K 3.9-70 P j i 3.9-71 N '\j 3.9-72 N 3.9-73 E 3.9-74 E 3.9-75 E 3.9-76 N 3.10-1 P 3.10-2 P 3.10-3 P 3.10-4 P 3.10-5 P 3.10-6 P 3.10-7 P 3.10-8 P 3.10-9 P 3.10-10 P 3.10-11 P 3.10-12 P 3.10-13 P 3.11-1 I 3.11-2 N 3.11-3 N 3.11-4 I 3.11-5 I 3.11-6 I 3.11-7 N / 3.11-8 I () 3.11-9 3.11-10 I I 3.11-11 N Amendment P June 15, 1993
CESSAR Einhis. (Sheet 8 e 13) O EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Tables Amendment 3.2-1 (Sheet 1) N 3.2-1 (Sheet 2) N 3.2-1 (Sheet 3) N 3.2-1 (Sheet 4) N 3.2-1 (Sheet 5) N 3.2-1 (Sheet () N 3.2-1 (Sheet 7) N 3.2-1 (Sheet 8) N 3.2-1 (Sheet 9) N 3.2-1 (Sheet 10) N 3.2-1 (Sheet 11) N 3.2-1 (Sheet 12) N 3.2-1 (Sheet 13) N 3.2-1 (Sheet 14) N 3.2-1 (Sheet 15) N 3.2-1 (Sheet 16) N 3.2-1 (Sheet 17) N 3.2-1 (Sheet 18) N 3.2-1 (Sheet 19) N 3.2-1 (Sheet 20) N 3.2-1 (Sheet 21) N 3.2-1 (Sheet 22) N 3.2-1 (Sheet 23) P 3.2-1 (Sheet 24) N 3.2-1 (Sheet 25) N 3.2-1 (Sheet 26) N 3.2-1 (Sheet 27) N
- 3. 2- 1 (Sheet 27a) P 3.2-2 (Sheet 1) I 3.2-2 (Sheet 2) I 3.2-2 (Sheet 3) K 3.2-2 (Sheet 4) K 3.2-2 (Sheet 5) K 3.2-2 (Sheet 6) K 3.2-2 (Sheet 7) K 3.2-2 (Sheet 8) K !
3.2-2 (Sheet 9) K 3.2-2 (Sheet 10) N l 3.2-2 (Sheet 11) N ! 3.2-2 (Sheet 12) K 3.2-2 (Sheet 33) I 3.2-2 (Sheet 14) I 3.2-2 (Sheet 15) I 3.2-3 I l l Amendment P June 15, 1993~
CESSAR E%ncarias (Sheet 9 or 13)
%/
l EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Tables (Cont'd) Amendment 3.5-1 (Sheet 1) N 3.5-1 (Sheet 2) N 3.5-2 K 3.5-3 N 3.6-1 (Sheet 1) K 3.6-1 (Sheet 2) J 3.6-2 K 3.6-3 (Sheet 1) K. 3.6-3 (Sheet 2) K 3.6-3 (Sheet 3) J 3.6-3 (Sheet 4) J 3.6-3 (Sheet 5) J 3.6-3 (Sheet 6) J 3.6-3 (Sheet 7) J 3.6-3 (Sheet 8) K
- f. 3.6-3 (Sheet 9) J
/ ' 3.6-3 (Sheet 10) K '\,, 3.6-3 (Sheet 11) K 3.6-4 (Sheet 1) J 3.6-4 (Sheet 2) I 3.6-4 (Sheet 3) J 3.6-4 (Sheet 4) J 3.6-4 (Sheet 5) J 3.6-4 (Sheet 6) J 3.7-1 N 3.8-1 (Sheet 1) N 3.8-1 (Sheet 2) I 3.8-2 (Sheet 1) N 3.8-2 (Sheet 2) N 3.8-3 (Sheet 1) I 3.8-3 (Sheet 2) I 3.8-3 (Sheet 3) N 3.8-4 P ;
3.8-5 (Sheet 1) I l 3.8-5 (Sheet 2) P 3.8-5 (Sheet 3) N 3.8-5 (Sheet 4) N l 3.8-5 (Sheet 5) P 3.8-5 (Sheet 6) P 3.8-5 (Sheet 7) P 3.8-5 (Sheet 8) P 3.8-5 (Sheet 9) N [) 3.8-5 (Sheet 10) N 'v' Amendment P June 15, 1993
l CESSAR EnL"icxIi:n (Sheet 10 of 13) O EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Tables (Cont'd) Amendment 3.9-1 (Sheet 1) N 3.9-1 (Sheet 2) N 3.9-1 (Sheet 3) N 3.9-1 (Sheet 4) N 3.9-1 (Sheet 5) N-3.9-1 (Sheet 6) N 3.9-1 (Sheet 7) N 3.9-1 (Sheet 8) N 3.9-2 P 3.9-3 E 3.9-4 (Sheet 1) I 3.9-4 (Sheet 2) I 3.9-4 (Sheet 3) I 3.9-4 (Sheet 4) I 3.9-4 (Sheet 5) K 3.9-4 (Sheet 6) K 3.9-4 (Sheet 7) K 3.9-4 (Sheet 8) I 3.9-5 K 3.9-6 E 3.9-7 E 3.9-8 (Sheet 1) I 3.9-8 (Sheet 2) I 3.9-9 K 3.9-10 P 3.9-11 P 3.9-12 N 3.9-13 N 3.9-14 N 3.9-15 (Sheet 1 of 57) N 3.9-15 (Sheet 2 of 57) N 3.9-15 (Sheet 3 of 57) N 3.9-15 (Sheet 4 of 57) N 3.9-15 (Sheet 5 of 57) N 3.9-15 (Sheet 6 of 57) N 3.9-15 (Sheet 7 of 57) N 3.9-15 (Sheet 8 of 57) N 3.9-15 (Sheet 9 of 57) N 3.9-15 (Sheet 10 of 57) N 3.9-15 (Sheet 11 of 57) N 3.9-15 (Sheet 12 of 57) N 3.9-15 (Sheet 13 of 57) N 3.9-15 (Sheet 14 of 57) N O Amendment P June 15, 1993 '
CESSAREHecm (Sheet u of 13) \ Q'; EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Tables (Cont'd) Amendment 3.9-15 (Sheet 15 of 57) N 3.9-15 (Sheet 16 of 57) N 3.9-15 (Sheet 17 of 57) N 3.9-15 (Sheet 18 of 57) N 3.9-15 (Sheet 19 of 57) N 3.9-15 (Sheet 20 of 57) N 3.9-15 (Sheet 21 of 57) N 3.9-15 (Sheet 22 of 57) N 3.9-15 (Sheet 23 of 57) N 3.9-15 (Sheet 24 of 57) N 3.9-15 (Sheet 25 of 57) N 3.9-15 (Sheet 26 of 57) N 3.9-15 (Sheet 27 of 57) N 3.9-15 (Sheet 28 of 57) N 3.9-15 (Sheet 29 of 57) N 3.9-15 (Sheet 30 of 57) N [ 3.9-15 (Sheet 31 of 57) N ( ,,; 3.9-15 (Sheet 32 of 57) N 3.9-15 (Sheet 33 of 57) N 3.9-15 (Sheet 34 of 57) N 3.9-15 (Sheet 35 of 57) N 3.9-15 (Sheet 36 of 57) N 3.9-15 (Sheet 37 of 57) N 3.9-15 (Sheet 38 of 57) N 3.9-15 (Sheet 39 of 57) N 3.9-15 (Sheet 40 of 57) N 3.9-15 (Sheet 41 of 57) N 3.9-15 (Sheet 42 of 57) N 3.9-15 (Sheet 43 of 57) N 3.9-15 (Sheet 44 of 57) N 3.9-15 (Sheet 45 of 57) N 3.9-15 (Sheet 46 of 57) N 3.9-15 (Sheet 47 of 57) N 3.9-15 (Sheet 48 of 57) N 3.9-15 (Sheet 49 of 57) N i 3.9-15 (Sheet 50 of 57) N 3.9-15 (Sheet 51 of 57) N ' 3.9-15 (Sheet 52 of 57) N 3.9-15 (Sheet 53 of 57) N 3.9-15 (Sheet 54 of 57) N 3.9-15 (Sheet 55 of 57) N 3.9-15 (Sheet 56 of 57) N ' 3.9-15 (Sheet 57 of 57) N s_- , I l Amendment P l June 15, 1993
CESSAR San"lCATION (Sheet 12 of 13) 1 O EFFECTIVE PAGE LISTING (Cont'd) CHAPTER 3 Tables (Cont'd) Amendment 3.11-1 I Ficures Amendment 3.3-1 K l 3.6-1 P 3.7-1 O 3.7-2 0 3.7-3 0 3.7-4 P 3.7-5 P 3.7-6 P ! 3.7-7 P l 3.7-8 P 3.7-9 P 3.7-10 P 3.7-11 P 3.7-12 P 3.7-13 O-3.7-14 0 3.7-15 O 3.7-16 O 3.7-17 O 3.7-18 O 3.7-19 O 3.7-20 0 3.7-21 O 3.7-22 0 3.7-23 I 3.7-24 I 3.7-25 I 3.7-26 I 3.7-27 I 3.7-28 P 3.7-29 I 3.7-30 I 3.7-31 I 3.7-32 I 3.8-1 (Sheet 1) I 3.8-1 (Sheet 2) N 3.8-1 (Sheet 3) N O Amendment P June 15, 1993
CESSAR naincuen (Sheet u or 13) O
\ l
%J EFFECTIVE PAGE LISTING (Cont'd)
CHAPTER 3 Fiqures (Cont'd) Amendment 3.8-2 (Sheet 1) I ) 3.8-2 (Sheet 2) I J 3.8-2 (Sheet 3) I 3.8-2 (Sheet 4) I , 3.8-2 (Sheet 5) I ! 3.8-2 (Sheet 6) I 3.8-2 (Sheet 7) N 3.8-3 I i 3.8-4 I 3.8-5 (Sheet 1) P 3.8-5 (Sheet 2) P 3.8-5 (Sheet 3) P 3.8-5 (Sheet 4) P 3.8-5 (Sheet 5) P 3.8-5 (Sheet 6) P l 3.8-5 (Sheet 7) P l [\m/ 3.8-5 (Sheet 8) 3.8-5 (Sheet 9) P P 3.8-5 (Sheet 10) P 3.8-5 (Sheet 11) P l 3.8-5 (Sheet 12) P i 3.9-1 1 3.9-2 3.9-3 3.9-4 3.9-5 3.9-6 3.9-7 i 3.9-8 3.9-9 I 3.9-10 3.9-11 3.9-12 l 3.9-13 3.9-14 E 3.9-15 K 3.9-16 (Sheet 1) N 3.9-16 (Sheet 2) N 3.9-16 (Sheet 3) N 3.9-16 (Sheet 4) N 3.9-16 (Sheet 5) N 3.9-16 (Sheet 6) N O V j l Amendment P l June 15, 1993 f 1
CESSARE!%nce i 1
% /
TABLE OF COMTE _NTS_ (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.1.52 CRITERION 61 - FUEL STORAGE AND 3.1-40 HANDLING AND RADIO-ACTIVITY CONTROL 3.1.53 CRITERION 62 - PREVENTION OF 3.1-40 CRITICALITY IN FUEL STORAGE AND HANDLING 3.1.54 CRITERION 63 - MONITORING FUEL AND 3.1-41 WASTE STORAGE 3.1.55 CRITERION 64 - MONITORING RADIO- 3.1-41 ACTIVITY RELEASES 3.2 CLASSIFICATION OF STRUCTURES, 3.2-1 COMPONENTS. AND SYSTEMS l ) (_,/ 3.2.1 SEISMIC CLASSIFICATION 3.2-1 3.2.2 SYSTEM QUALITY GROUP CLASSIFICATIONS 3.2-3 (SAFETY CLASS) 3.3 WIND AND TORNADO LOADINGS 3.3-1 3.3.1 WIND LOADINGS 3.3-1 3.3.1.1 Desian Wind Velocity 3.3-1 3.3.1.2 Determination of Anolied Forces 3.3-1 3.3.2 TORNADO LOADINGS 3.3-1 3.3.2.1 Applicable Desian Parameters 3.3-1 3.3.2.2 D_etermination of Forces on Structures 3.3-2 , 3.3.2.3 Effect of Failure of Structures or 3.3-2 i Components not Desianed for Tornado Loads 1 3.4 WATER LEVEL (FLOOD) DESIGN 3.4-1 l l N 3.4.1 FLOOD ELEVATIONS 3.4-1 I (Y N. l i Amendment D v September 30, 1988
CESSAR imincun O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.4.2 PHENOMENA CONSIDERED IN DESIGN 3.4-1 LOAD CALCULATION 3.4.3 FLOOD FORCE APPLICATION 3.4-1 3.4.4 FLOOD PROTECTION 3.4-1 3.4.4.1 Flood Protection Measures for Seismic 3.4-1 Catecorv I Structures 3.4.5 ANALYTICAL AND TEST PROCEDURES 3.4-4 3.5 MISSILE PROTECTION 3.5-1 3.5.1 MISSILE SELECTION AND DESCRIPTION 3.5-1 3.5.1.1 Internally Generated Missiles 3.5-2 (Outside Containment) 3.5.1.1.1 Auxiliary Pumps and Motors 3.5-2 3.5.1.1.2 Emergency Feedwater Pump Turbines 3.5-3 3.5.1.1.3 Valves 3.5-3 3.5.1.1.4 Pressure Vessels 3.5-3 3.5.1.2 Internally Generated Missiles 3.5-4 (Inside Containment) 3.5.1.3 Turbine Missiles 3.5-4 3.5.1.4 Missiles Generated by Natural 3.5-5 Phenomena 3.5.1.5 Missiles Generated by Events 3.5-5 Near thq_ Cite 3.5.1.6 Aircraft Hazards 3.5-5 3.5.2 STRUCTURES, SYSTEMS, AND COMPONENTS TO 3.5-5 BE PROTECTED FROM EXTERNALLY GENERATED 1 MISSILES 1 0! Amendment K -l i vi October 30, 1992
CESSAR nMincm. V) ( TABLE OF CONTENTB (Cont'd) CKAPTER 3 Section Bubiect Pace No. 3.5.3 BARRIER DESIGN PROCEDURES 3.5-5 3.5.3.1 Local Damage Prediction 3.5-6 3.5.3.1.1 Concrete Structures and Barriers 3.5-6 3.5.3.1.2 Steel Structures and Barriers 3.5-6 3.5.3.2 Overall Damace Prediction 3.5-6 3.5.4 GENERAL DESIGN BASES 3.5-7 3.6 PROTECTION AGAINST DYNAMIC EFFECTS 3.6-1 ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING 3.6.1 POSTULATED PIPING FAILURES IN 3.6-1 [) FLUID SYSTEMS U 3.6.1.1 Deslan Basis 3.6-1 3.6.1.1.1 High-Energy Piping Systems 3.6-3 3.6.1.1.2 Moderate-Energy Piping Systems 3.6-3 3.6.1.2 Descriotion 3.6-4 3.6.1.3 Safety Evaluation 3.6-8 3.6.2 DETERMINATION OF BREAK LOCATIONS AND 3.6-12 DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING 3.6.2.1 Criteria Used to Define Break and 3.6-12 Crack Locations and Confiourations 3.6.2.1.1 General Requirements 3.6-12 3.6.2.1.2 Postulated Rupture Descriptions 3.6-13 3.6.2.1.3 Piping Evaluated for Leak- 3.6-14 Before-Break 3.6.2.1.4 Piping Other Than Piping Evaluated 3.6-14 for Leak-Before-Break 3.6.2.1.4.1 Postulated Rupture Locations 3.6-14 3.6.2.1.4.2 Postulated Rupture Configurations 3.6-22 ( ['~')h Amendment K vii October 30, 1992
5'~ a CESSAR "CE.TirlCATCN O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Bubiect Pace No. 3.6.2.1.5 Details of Containment Penetrations 3.6-22 3.6.2.2 Analytical Methods to Define Forcina 3.6-22 Functions and Response Models 3.6.2.2.1 Piping Evaluated for Leak-Before-Break 3.6-22 3.6.2.2.2 Analytical Methods to Define Forcing 3.6-23 Functions and Response Models for Piping Excluding That Evaluated for Leak-Before-Break 3.6.2.2.2.1 Determination of Pipe Thrust 3.6-23 and Jet Loads 3.6.2.2.2.2 Methods for the Dynamic Analysis 3.6-24 of Pipe Whip 3.6.2.2.2.3 Method of Dynamic Analysis of 3.6-25 Unrestricted Pipes 3.6.2.3 Dynamic Analysis Methods to Verify 3.6-26 Intecrity and Operability 3.6.2.3.1 Pipe Whip Restraints and Jet 3.6-26 Deflectors for Piping Evaluated for Leak-Before-Break 3.6.2.3.2 Pipe Whip Restraints and Jet 3.6-26 Deflectors for Piping Other than that Evaluated for Leak-Before-Break 3.6.2.3.2.1 General Description of Pipe 3.6-26 Whip Restraints 3.6.2.3.2.2 Pipe Whip Restraint Components 3.6-27 3.6.2.3.2.3 Design Loads 3.6-27 3.6.2.3.2.4 Allowable Stresses 3.6-28 3.6.2.3.2.5 Design Criteria 3.6-28 3.6.2.3.2.6 Materials 3.6-28 3.6.2.3.2.7 Jet Impingement Shields 3.6-29 3.6.2.4 Guard Pine Assembly Desian Criteria 3.6-29 3.6.3 LEAK-BEFORE-BREAK EVALUATION PROCEDURE 3.6-29 3.6.3.1 Applicability of LBB 3.6-29 Amendment E viii December 30, 1988
.CESSARunhn. i
'l
-l t TABLE OF CONTENTS (Cont'd)
CHAPTER 3- i Section -Subiect Pace No. {
~3.6.3.1.1 Design Basis Loads 13.6-30 3.6.3.1.2 Susceptibility of Failure from 3.6-30 Erosion, Erosion / Corrosion, Erosion / Cavitation .
3.6.3.1.2.1 Erosion / Corrosion Minimization 3.6-30 3.6.3.1.2.2 Applicability to Piping for LBB 3.6-31 1 3.6.3.1.3 Susceptibility of Failure from 3.6-31 ' Water Hammer 3 3.6.3.1.3.1 Main-Coolant Loop (MCL) and 3.6-31 Surge Line (SL) .e 3.6.3.1.3.2 Direct Vessel Injection (DVI) 3.6-31 ! Line ; 3.6.3.1.3.3 Shutdown. Cooling (SC) Line ' 3 . 6-3 2_ i 3.6.3.1.3.4 Main Steam Line (MSL) 3.6-32 ] 3.6.3.1.4 Susceptibility of. Failure from 3.6-33 i Creep Fatigue .
. i 3.6.3.1.5 Susceptibility of Failure from 3.6-33 Corrosion 1 3.6.3.1.6 Susceptibility of Failure from 3.6-34 j
-Indirect Causes 3.6.3.1.7 Cleavage _ Type. Failure 3.6-34 i 3.6.3.1.8 . Susceptibility of Failure from 3.6-34 :
Fatigue Cracking: ! 3.6.3.1.8.1 Class l' Piping 3.6-34 3.6.3.1.8.2 Main Steam Line 3.6-34 .
-t 3.6.3.2 Leakaae Crack Location 3.6-34 1 3.6.3.3 Leak Detection 3.6-35 3.6.3.3.1 Leak Detection System 3.6-35 l
'3.6.3.3.2 Flow Rate Correlation 3.6-35 3.6.3.4 Material Properties 3.6 3.6.3.5 Leakace Crack Lenath Determination 3.6-36
.. [~'\ 3.6.3.6 Computation of J-Intecral' Values 3.6-36' NL) 3.6.3.6.1 Range'of Crack Sizes '3.6-36 3.6.3.6.2 J-Integral 3.6-36 Amendment P ix June'15',11993
CESSAR n.inflCATION O T.ABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.6.3.7 Stability Evaluation 3.6-37 3.6.3.8 Results 3.6-38 APPENDIX DISCUSSION OF METHODS FOR ANALYSIS OF 3.6A-1 3.6A PIPE WHIP 3.7 SEISMIC DESIGN 3.7-1 3.7.1 SEISMIC INPUT 3.7-1 3.7.1.1 Desian Response Spectra 3.7-1 3.7.1.2 Desian Time History 3.7-1 3.7.1.3 Critical Dampina Values 3.7-2 3.7.1.4 Supportina Media for Seismic 3.7-2 Cateaory I Structures 3.7.1.4.1 Soil Structure Interaction (SSI) 3.7-2 3.7.2 SEISMIC SYSTEM ANALYSIS 3.7-2 3.7.2.1 Seismic Analysis Method 3.7-2 3.7.2.1.1 Seismic Category I Structures, 3.7-2 Systems, and Components Other Than NSSS 3.7.2.1.1.1 Response Spectrum Method 3.7-3 of Analysis 3.7.2.1.1.2 Time History Method 3.7-5 3.7.2.1.1.3 Soil-Structure Interaction 3.7-5 Analysis 3.7.2.1.2 Seismic Analysis Method for the NSSS 3.7-6 3.7.2.1.2.1 Introduction 3.7-6 3.7.2.1.2.2 Mathematical Models 3.7-7 3.7.2.1.2.3 Analysis 3.7-9 3.7.2.2 Natural Frecuencies and Response Loads 3.7-10 Amendment P x June 15, 1993
CESSAREnnnceu
.[t TABLE OF CONTENTS (Cont'd)
CHAPTER 3 Section Subiect Pace No. 3.7.2.3 Procedures Used For Analytical 3.7-10 Modelina 3.7.2.3.1 Modeling of the NSSS and BOP 3.7-10 3.7.2.3.2 Designation of Systems Versus 3.7-10 Subsystems 3.7.2.3.3 Decoupling Criteria for Subsystems 3.7-11 3.7.2.3.4 Lumped Mass Considerations 3.7-11 3.7.2.3.4.1 Model for Horizontal Excitation 3.7-12 3.7.2.3.4.1.1 Development of FEM and Stick 3.7-12 Models of the Interior Structure 3.7.2.3.4.1.2 Development of FEM and Stick 3.7-13 Models of the Shield Building ! 3.7.2.3.4.1.3 FEM of Steel Containment Vessel 3.7-13 [}
\ '/
3.7.2.3.4.1.4 Development of FEM and Stick Models for Fuel Building, CVCS/ 3.7-13 Maintenance Area, EFW Areas, Diesel Generator Areas and Control Room Areas 3.7.2.3.4.1.5 Combined Model of Nuclear 3.7-13 Island and Nuclear Annex Structures 3.7.2.3.4.2 Model for Vertical Excitation 3.7-14 3.7.2.3.5 Modeling for Three Component Input 3.7-14 Motions 3.7.2.4 Soil / Structure Interaction (SSI) 3.7-14 3.7.2.5 Development of Floor Response Soectra 3.7-14 3.7.2.6 Three Components of Earthquake Moti_oD 3.7-15 3.7.2.6.1 Seismic Category I Structures, 3.7-15 Systems, and Components Other Than NSSS 3.7.2.6.2 Nuclear Steam Supply System 3.7-15 I O N ,lt Amendment O xi May 1, 1993
CESSAR En9cari:n O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Eace No. 3.7.2.7 Combination of Modal Responses 3.7-15 3.7.2.7.1 Seismic Category I Structures, Systems 3.7-15 and Components other Than NSSS 3.7.2.7.2 Nuclear Steam Supply System 3.7-16 3.7.2.8 Interaction of Non-Safety-Related 3.7-16 Structures with Safetv-Related Structures 3.7.2.9 Effects of Parameter Variations on 3.7-17 Floor Response Spectra 3.7.2.10 Use of Constant Vertical Static Factors 3.7-17 3.7.2.11 Methods Used to Account for Torsional 3.7-17 Effects 3.7.2.12 Comparison of Responses 3.7-18 3.7.2.13 Methods for Seismic Analysis of Dams 3.7-18 3.7.2.14 Determination of Safetv-Related 3.7-18 Structure Overturnina Moments 3.7.2.15 Analysis Procedure for Damoina 3.7-18 3.7.3 SEISMIC SUBSYSTEM ANALYSIS 3.7-19 3.7.3.1 Seismic Analysis Methods 3.7-19 3.7.3.2 Determination of Number of Earthauake 3.7-20 Cycles 3.7.3.3 Procedure Used for Modelina 3.7-20 3.7.3.4 Basis for Selection of Freauencies 3.7-21 3.7.3.5 Use of Eauivalent Static Load Method 3.7-21 of Analysis 3.7.3.6 Three Components of Earthauake Motion 3.7-22 3.7.3.7 Combination of Modal Response 3.7-22 l l Amendment I xii December-21, 1990
. . ~. -. .ICIE!E!i/ Lit 1EMsncant.- :(
() ' TABLE OF CONTENTS (Cont'd) ; i CHAPTER 3- , Section subiect Egae No. 3.7.3.8 Analytical ~ Procedures for Pinina' 3.7-22 3.7.3.8.1 Dynamic Analysis 3.7-22 3.7.3.8.2 Allowable' Stresses 3.7-23 , 3.7.3.9 Multiple Supported Eculoment Components 3.7-23 With Distinct Inputs 3.7.3.10 Use of Constant Vertical Load Factors 3.7-23 l 3.7.3.11 Torsional Effects of Eccentric Masses 3.7-23 3.7.3.12 Pipina-Outside Containment Structure 3.7-24 3.7.3.12.1 Buried Piping. '3.7-24 3.7.3.12.1.1 General Requirements . 3.7-24 x 3.7.3.12.1.2 Weight Effects (Sustained' Loads)' 3.7-25 3.7.3.12.1.3 Seismic Effects 3.7-25 , 3.7.3.12.1.4 Thermal Expansion and 3.7-26 Contraction Effects ; 3.7.3.12.1.5 Non-Repeating Building 3.7-27 Settlement Effects 3.7.3.12.2 Above Ground Piping 3.7-27 3.7.3.13 Interaction of Other Pipina With 3.7-27 Cateaory I Pioina 3.7.3.14 Seismic Analysis of-Reactor Internals. 3.7-28 Core and CEDMs 3.7.3.14.1 Reactor Internals and Core 3.7-28 1 3.7.3.14.1.1 Mathematical Models 3.7-29 3.7.3.14.1.2 Analytical-Techniques 3.7-32 3.7.3.14.1.3 Analysis Procedures for Damping. 3.7-34 3.7.3.14.1.4 Results 3.7-34 3.7.3.14.2 Control Element Drive Mechanisms 3.7-35 (CEDM) ('% 3.7.3.14.2.1 Input Excitation Data '3.7-35 \, 3.7.3.14.2.2 Analysis 3.7-35 Amendment N-xiii April 1, 1993 i
- I
CESSAREnana _ . _ . O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.7.3.14.2.3 Functional Test 3.7-35 3.7.3.15 Analysis Procedures for Damoina 3.7-35 3.7.3.15.1 Subsystems Other Than NSSS 3.7-35 3.7.3.15.2 Nuclear Steam Supply System 3.7-35 3.7.4 SEISMIC INSTRUMENTATION 3.7-36 3.7.4.1 Comparison with Reculatory Guide 1.12 3.7-36 3.7.4.2 Location and Description of 3.7-36 Instrumentation 3.7.4.2.1 Active Instruments 3.7-36 3.7.4.2.2 Passive Instruments 3.7-37 3.7.4.3 Control Room Operator Notification 3.7-37 3.7.4.4 Comparison of Measured and Predicted 3.7-38 Responses APPENDIX COUPLED REACTOR COOLANT SYSTEM SEISMIC 3.7A-1 3.7A RESULTS APPENDIX SOIL STRUCTURE INTERACTION (SSI) ANALYSIS 3.7B-1 3.7B METHODOLOGY AND RESULTS 3.8 DESIGN OF CATEGORY I STRUCTURES 3.8-1 3.8.1 CONCRETE CONTAINMENT 3.8-1 3.8.2 STEEL CONTAINMENT 3.8-1 ; 3.8.2.1 Description of the Containment 3.8-1 3.8.2.1.1 General 3.8-1 ] 3.8.2.1.2 Anchorage Region 3.8-2 l 3.8.2.1.3 Containment Penetrations 3.8-2 j 3.8.2.1.3.1 Equipment Hatch 3.8-2 ! 3.8.2.1.3.2 Personnel Locks 3.S-2 3.8.2.1.3.3 Fuel Transfer Penetration 3.8-3 i 3.8.2.1.3.4 Mechanical Penetrations 3.8-3 I 3.8.2.1.3.5 Electrical Penetrations 3.8-3 Amendment P xiv June 15, 1993
CESSAREnMem
-~,.
I \ LJ TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.8.2.2 Apolicable codes. Standards, and 3.8-4 Snecifications 3.8.2.3 Loads and Loadina Combinations 3.8-6 3.8.2.4 pesian and Analysis Procedures 3.8-7 3.8.2.5 Structural Acceptance Criteria 3.8-9 3.8.2.6 Materials. Ouality Control, and 3.8-10 Special Construction Techniaues 3.8.2.6.1 Materials 3.8-10 3.8.2.6.2 Quality Control 3.8-11 3.8.2.6.3 Special Construction Techniques 3.8-11 [' N 3.8.2.7 Testina and In-service Surveillance 3.8-11 ( ,) Reauirements 3.8.3 CONCRETE AND STRUCTURAL STEEL INTERNAL 3.8-12 STRUCTURES 3.8.3.1 Description of the Internal Structures 3.8-12 3.8.3.2 Applicable Codes. Standards. And 3.8-13 Specifications 3.8.3.3 Loads and Loadina Combinations 3.8-14 3.8.3.4 Desian and Analvsjs Procedures 3.8-14 3.8.3.5 Structural Acceptance Criteria 3.8-14 3.8.3.6 Katerials. Ouality Control, and 3.8-15 Soecial Construction Techniaues 3.8.3.7 Testina and In-service Surveillance 3.8-15 Reauirements 3.8.4 OTHER CATEGORY I STRUCTURES 3.8-15 3.8.4.1 Description of the Structures 3.8-15 3.8.4.1.1 Reactor Building 3.8-15 3.8.4.1.2 Nuclear System Annex 3.8-16 3.8.4.1.3 Station Service Water System Structure 3.8-16 Amendment N l l xv April 1, 1993 1
CESSAR Eininem O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Bection Subiect Pace No. 3.8.4.2 Applicable Codes. Standards. and 3.8-16 Soecifications 3.8.4.3 Loads and Loadina Combinations 3.8-17 3.8.4.4 Desian and Analysis Procedures 3.8-18 3.8.4.5 Structural Acceptance Criteria 3.8-19 3.8.4.6 Material. Ouality Control, and 3.8-20 Special Construction Techniaues 3.8.4.6.1 Material 3.8-21 3.8.4.6.1.1 Concrete 3.8-21 3.8.4.6.1.2 Reinforcing Steel 3.8-22 3.8.4.6.1.3 Structural Steel 3.8-22 3.8.4.6.2 Quality Control 3.8-23 3.8.4.6.3 Special Construction Techniques 3.8-23 3.8.4.7 Testina and In-service Surveillance 3.8-23 Recuirements 3.8.5 FOUNDATIONS 3.8-24 3.8.5.1 Description of the Foundation 3.8-24 3.8.5.2 Apolicable Codes. Standards, and 3.8-24 Specifications 3.8.5.3 Loads and Loadina Combinations 3.8-24 3.8.5.4 Desian and Analysis Procedures 3.8-24 3.8.5.5 Structural Acceptable Criteria 3.8-24 3.8.5.6 Material. Ouality Control. and 3.8-25 Special Construction Techaiaues 3.8.5.7 Testina and In-service Surveillance 3.8-25 Reauirements O Amendment I xvi December 21, 1990
CESSAR innncuen
.t /
N ,/ TABLE OF CONTENTE'(Cont'd) CHAPTER 3 Section Subiect .PaGe No. 3.9 MECHANICAL SYSTEMS AND' COMPONENTS 3.9-1 j 3.9.1 SPECIAL TOPICS FOR MECHANICAL COMPONENTS 3. 9-1" 3.9.1.1 Desian Transients 3.9-1 3.9.1.2 Computer Procrams Used in Stress' 3.9-3 Analysis 3.9.1.2.1 Code Class Systems, Components, 3.9-3 and Supports 3.9.1.2.1.1 MDC'STRUDL 3.9-3 3.9.1.2.1.2 C-E. MARC. 3.9-4 3.9.1.2.1.3 JEST 3.9 3.9.1.2.1.4 SUPERPIPE 3.9-5 3.9.1.2.1.5 DFORCE. 3.9-5 3.9.1.2.1.6 SG LINK 3.9-6' 3.9.1.2.1.7 CEDAGS _. 3.9-6 ; 3.9.1.2.1.8 CE177,. Head Penetration '3.9-6 Reinforcement Program , 3.9.1.2.1.9 CE102, Flange Fatigue Program 3.9-7 3.9.1.2.1.10 CE105, Nozzle Patigue Program 3.9-7 3.9.1.2.1.11 CEC 26, Edge. Coefficients Program 3.9 3.9.1.2.1.12 CE124, Generalized 4 x 4; Program' 3.9 3.9.1.2.1.13 SEC 11 3.9-8
~3.9.1.2.1.14 ANSYS . ~3.9-8 -
3.9.1.2.1.15 CE301, The Structural' Analysis. 3.9-8; ,, for Partial ~ Penetration Nozzles, Heater Tube Plug Welds, and , the Water Level-Boundary.of
.the Pressurizer.Shell Program ,
3.9.1.2.1.16 LCE223, Primary Structure 3.9-8 Interaction. Program . . j 3.9.1.2.1.17 CE362, Tube-To-Tubesheet' Weld 3.9-9 Program 3.9.1.2.1.18 CE286, Support' Skirt Loading 3.9 Program 3.9.1.2.1.19 lCE210, Principal Stress Program 3.9-9 : 3.9.1.2 1.20 CE211,: Nozzle Load Resolution 3.9-9 Program 3.9.1.2.1.21 KINI2100LProgram .3.9-9 4 3.9.1.2.1.22 CEFLASH-4A 3.9-10 .' 3 '. 9 3.9.1.2.1.23 CRIBE J 3.9.1.2.1.24 SASSI 3.9-10 l Amendment-K-xvii October-30, 1992- _. _ .i
"'a" CESSAR CERTIFICATION O
TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Bubiect Pace No. 3.9.1.2.1.25 SHAKE 3.9-11 3.9.1.2.2 Code Class CS Internals, Fuel and CEDMs 3.9-12 3.9.1.2.2.1 MRI/STARDYNE 3.9-12 3.9.1.2.2.2 ANSYS 3.9-13 3.9.1.2.2.3 ASHSD 3.9-14 3.9.1.2.2.4 CESHOCK 3.9-14 3.9.1.2.2.5 SAMMSOR/DYNASOR 3.9-15 3.9.1.2.2.6 MODSK 3.9-16 3.9.1.2.2.7 SAPIV 3.9-17 3.9.1.2.2.8 CEFLASH-4B 3.9-18 3.9.1.2.2.9 LOAD 3.9-18 3.9.1.2.2.10 COSMOS 3.9-18 3.9.1.3 Experimental Stress Analyses 3.9-19 3.9.1.4 Considerations for the Evaluation of 3.9-19 the Faulted Condition 3.9.1.4.1 Seismic Category I RCS Items 3.9-19 3.9.1.4.1.1 Reactor Internals and CEDMs 3.9-20 3.9.1.4.1.2 Non-Code Items 3.9-20 3.9.1.4.2 Seismic Category I Non-NSSS Items 3.9-21 3.9.2 DYNAMIC SYSTEM ANALYSIS AND TESTING 3.9-21 3.9.2.1 Pinina Vibrations. Thermal Expansion 3.9-21 and Dynamic Effects 3.9.2.1.1 Steady-State Vibration 3.9-22 3.9.2.1.2 Transient Vibration 3.9-22 3.9.2.1.3 Thermal Expansion 3.9-23 3.9.2.2 Seismic Oualification of Mechanical 3.9-23 Eauipment 3.9.2.2.1 Nuclear Steam Supply System 3.9-23 3.9.2.2.2 Non-NSSS Items 3.9-24 O Amendment N xviii April 1, 1993
l CESSAR E!%ncun,
~s N
TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.9.2.2.2.1 Seismic Testing and Analysis 3.9-24 3.9.2.2.2.2 Seismic Analysis 3.9-24 3.9.2.2.2.3 Basis for Test Input Motion 3.9-25 3.9.2.2.2.4 Random Vibration Input 3.9-25 3.9.2.2.2.5 Input Motion 3.9-25 3.9.2.2.2.6 Fixture Design 3.9-25 3.9.2.2.2.7 Equipment Testing 3.9-25 3.9.2.3 Dynamic System Analysis Methods for 3.9-26 Reactor Vessel Core Support and Internal Structures 3.9.2.3.1 Introduction 3.9-26 3.9.2.3.2 Periodic Forcing Function 3.9-26 3.9.2.3.2.1 Core Support Barrel Assembly 3.9-26 [~'} ( j 3.9.2.3.2.2 3.9.2.3.2.3 Upper Guide Structure Lower Support Structure 3.9-27 3.9-27 Assembly 3.9.2.3.3 Random Forcing Function 3.9-28 3.9.2.3.3.1 Core Support Barrel Assembly 3.9-28 3.9.2.3.3.2 Upper Guide Structure 3.9-28 3.9.2.3.3.3 Lower Support Structure 3.9-28 Assembly 3.9.2.3.4 Mathematical Models 3.9-29 3.9.2.3.5 Response Analysis 3.9-30 3.9.2.3.5.1 Deterministic Response 3.9-30 3.9.2.3.5.2 Random Response 3.9-30 3.9.2.4 Comprehensive Vibration Assessment 3.9-31 Procram (CVAP) 3.9.2.5 Dynamic System Analysis of the Reactor 3.9-32 and CEDMs Under Faulted Conditions / O t 'V Amendment K xix October 30, 1992
CESSAR naincue,. O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Bubiect Pace No. 3.9.3 ASME CODE CLASS 1, 2 and 3 COMPONENTS, 3.9-33 COMPONENT SUPPORTS AND CLASS CS CORE SUPPORT STRUCTURES 3.9.3.1 Loadina Combinations. Desian 3.9-33 Transients and Stress Limits 3.9.3.1.1 ASME Code Class 1 Components and 3.9-34 Supports 3.9.3.1.2 Core Support Structures (Class CS) 3.9-34 and Internal Structures (Class IS) 3.9.3.1.3 ASME Code Class 2 and 3 Components 3.9-35 and Supports 3.9.3.1.3.1 Tanks, Heat Exchangers, and 3.9-35 Filters 3.9.3.1.3.2 Valves 3.9-36 3.9.3.1.3.3 Pumps 3.9-37 3.9.3.1.4 Piping and Piping Supports 3.9-38 3.9.3.1.4.1 ASME Code Class 1 3.9-38 3.9.3.1.4.2 ASME Code Class 2 and 3 3.9-38 3.9.3.2 Pumn and Valve Operability Assurance 3.9-39 3.9.3.2.1 Active ASME Code Class 2 and 3 3.9-39 Pumps and Class 1, 2 and 3 Valves Furnished with the NSSS 3.9.3.2.1.1 Operability Assurance Program 3.9-39 3.9.3.2.1.2 Operability Assurance Program Results 3.9-40 for Active Pumps 3.9.3.2.1.3 Operability Assurance Program for 3.9-41 Active Valves 3.9.3.2.1.3.1 Pneumatically Operated Valves 3.9-43 3.9.3.2.1.3.2 Motor-Operated Valves 3.9-44 3.9.3.2.1.3.3 Pressurizer Safety Valves 3.9-45 3.9.3.2.1.3.4 Check Valves 3.9-46 O; Amendment E xx December 30, 1988
CESSARMnincm. (% TABLE OF CONTENTS (Cont'd)
' CHAPTER 3 Re.ption subiect Enge No, l
3.9.3.2.2 Non-NSSS Active ASME Code Class 3.9-47 2 and'3 Pumps and Class 1, 2 and '; 3 Valves 3.9.3.2.2.1 Pumps 3.9-47 3.9.3.2.2.2 Valves 3.9-48 , f 3.9.3.3 Desian and Installation Details fgr 3.9 Mountina of Pressure Relief Devices 3.9.3.4 Component Suncorts- 3.9-52 6 3.9.4 CONTROL ELEMENT DRIVE MECHANISMS 3.9-53 3.9.4.1 Descriotive Information of CEDM 3.9-53 0 3.9.4.1.1 3.9.4.1.1.1 Control Element Drive Mechanism' Design Description CEDM Pressure Housing 3.9-54 3.9-55 l 3.9.4.1.1.2 Motor Assembly -3.9-55 3.9.4.1.1.3 Coil Stack Assembly 3.9-56 3.9.4.1.1.4 Reed Switch Assembly 3.9-56 3.9.4.1.1.5 Extension Shaft Assembly 3.9-56
~
3.9.4.1.2~ Description of the CEDM Motor )3.9-57 Operation , t 3.9.4.1.2.1 Operating Sequence for the 3.9-57 ; Double-Stepping Mechanism 3.9.4.2 Acolicable CEDM Desian Specifications 3.9-58 3.9.4.3 Desian Loads. Stress' Limits and 3.9-59 .! Allowable Deformations. :j 3.9.4.4 CEDM Performance Assurance Proaram- 3.9 ! 3.9.4.4.1 CEDM Testing 3.9-60 3.9.4.4.1.1 Prototype Accelerated Life Tests .3.9-60 ! 3.9.4.4.1.2 First Production Test 3.9-62 3.9.4.4.1.3 Operating Experience at the Palo -3.9-62
'N Verde Nuclear Generating Station ,
- q j
Amendment E .) xxi -December 30, 1988 l
)
l
CESSAR nah"lCATION O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.9.5 REACTOR VESSEL CORE SUPPORT AND INTERNALS 3.9-63 STRUCTURES 3.9.5.1 Desian Arranaements 3.9-63 3.9.5.1.1 Core Support Structure 3.9-63 3.9.5.1.1.1 . Core Support Barrel 3.9-63 3.9.5.1.1.2 Lower Support Structure and 3.9-64 Instrument Nozzle Assembly 3.9.5.1.1.3 Core Shroud 3.9-65 3.9.5.1.2 Upper Guide Structure Assembly 3.9-65 3.9.5.1.3 Flow Skirt 3.9-66 3.9.5.1.4 In-Core Instrumentation Support 3.9-66 System 3.9.5.2 Desian Loadina Conditions 3.9-67 3.9.5.3 Desian Loadina Catecories 3.9-67 3.9.5.3.1 Level A and Level B Service Loadings 3.9-68 3.9.5.3.2 Level C Service Loadings 3.9-68 3.9.5.3.3 Level D Service Loadings 3.9-68 3.9.5.4 Desian Bases for Reactor Internals 3.9-68 3.9.6 IN-SERVICE TESTING OF PUMPS AND VALVES 3.9-70 3.9.6.1 In-Service Testina of Pumns 3.9-70 3.9.6.2 ID _ Service Testing of Valves 3.9-71 APPENDIX SUPPLEMENTAL INFORMATION ON CRITERIA AND 3.9A-1 3.9A ANALYSIS OF SYSTEM 80+ DISTRIBUTION SYSTEMS 3.10 SEISMIC AND DYNAMIC OUALIFICATION OF 3.10-1 MECHANICAL AND ELECTRICAL EOUIPMENT 3.10.1 SEISMIC QUALIFICATION CRITERIA 3.10-1 3.10.1.1 Reauirements 3.10-1 3.10.1.2 Selection of Oualification Method 3.10-1 -3.10.1.3 Inout Motion 3.10-2 Amendment P xxii June 15, 1993
CESSAR !!ninema
,_s f ) %J TABLE OF CONTENTS (Cont'd)
CHAPTER 3 Section Subiect Pace No. 3.10.2 SEISMIC AND DYNAMIC QUALIFICATION OF 3.10-3 ELECTRICAL EQUIPMENT 3.10.2.1 Methods and Procedures for Oualifyina 3.10-3 Seismic Cateaory I Electrical Eauionent and Instrumentation 3.10.2.2 Methods and Procedures of Analysis 3.10-5 or Testina of Supports of Electrical Eauipment-and Instrumentation 3.10.2.3 Methods and Procedures for Ovualifyina 3.10-6 Seismic Catecory II Electrical Eauipment and Instrumentation ,O 3.10.3 SEISMIC AND DYNAMIC QUALIFICATION OF 3.10-7 ( ,,l MECHANICAL EQUIPMENT INCLUDING MOTORS 3.10.3.1 Methods and Procedures for Oualifyina 3.10-7 Seismic Catecorv I Mechanical Eauipment Includina Motors 3.10.3.2 Desian Adecuacy of Supports 3.10-10 3.10.3.3 Leakaae Oualification for Reactor 3.10-11 Coolant Pressure Boundarv Valves 3.10.3.4 Oualification of Seismic Catecory 3.10-11 II Mechan.ical Eauipment 3.10.4 MECHANICAL AND ELECTRICAL EQUIPMENT 3.10-12 QUALIFICATION RECORDS 3.10.5 ADMINISTRATIVE CONTROL OF COMPONENT 3.10-13 QUALIFICATION 3.11 ENVIRONMENTAL DESIGN OF MECHANICAL ANQ 3.11-1 ELECTRICAL EOUIPMENT 3.11.1 EQUIPMENT IDENTIFICATION AND ENVIRONMENTAL 3.11-2 CONDITIONS ( ,) 3.11.2 QUALIFICATION TESTS AND ANALYSES 3.11-2 Amendment P ! xxiii June 15, 1993
CESSAR Mancua. O TABLE OF CONTENTS (Cont'd) CHAPTER 3 Section Subiect Pace No. 3.11.2.1 Mechanical and Electrical Component 3.11-3 Environmental Desian and Oualification for Normal Operation 3.11.2.2 Mechanical and Electrical Component 3.11-3 Environmental Desian and Oualification for Operation Durina and After a Desian Basis Accident 3.11.3 QUALIFICATION TEST RESULTS 3.11-7 3.11.3.1 Instrumentation and Electrical 3.11-7 Ecuioment 3.11.3.2 Mechanical Eculoment 3.11-7 3.11.4 CLASS 1E INSTRUMENTATION LOSS OF 3.11-7 VENTILATION EFFECTS 3.11.5 CHEMICAL SPRAY, RADIATION, HUMIDITY, 3.11-9 SUBMERGENCE AND POWER SUPPLY VOLTAGE AND FREQUENCY VARIATION 3.11.5.1 Chemical Environment 3.11-9 3.11.5.2 Radiation Environment 3.11-9 3.11.5.3 Humidity 3.11-10 3.11.5.5 Submercence 3.11-10 3.11.5.6 Power Suoolv Voltaae and Freauency -3.11-10 Variation APPENDIX TYPICAL ENVIRONMENTAL CONDITIONS AND TEST 3.11A-1 3.11A PROFILES FOR STRUCTURES AND COMPONENTS APPENDIX IDENTIFICATION, LOCATION AND TYPICAL 3.11B-1 3.11B ENVIRONMENTAL CONDITIONS OF EQUIPMENT O 1 l Amendment I l xxiv December 21, 1990
C E S S A R E!!L % m . LleT OF TABLES CHAPTER 3 Iable Bubiect 3.2-1 Classification of Structures, Systems, and Components 3.2-2 Safety Class 1, 2 and 3 Valves 3.2-3 Relationship of Safety Class to Code Class 3.5-1 Kinetic Energy of Potential Missiles - 3.5-2 Design Basis Tornado Missiles and Their Impact Velocities 3.6-1 High- and Moderate-Energy Fluid Systems 3.6-2 Systems Required for Safe Shutdown and/or to 7_ Mitigate the Consequences of a Design-Basis ( ) Accident V 3.6-3 High-Energy Lines Within Containment 3.6-4 High-Energy Lines Outside Containment 3.7-1 Damping Values 3.8-1 Design Loadings for Steel Containment 3.8-2 Loading Combinations for Steel Containment 3.8-3 Stress Intensity Limits for Steel Containments 3.8-4 Codes and Specifications for Design of Category I Structures 3.8-5 Load Combinations for Category I Structures 3.9-1 Transients Used in Stress Analysis of Code Class 1 and CS Components 3.9-2 Loading Combinations ASME Code Class 1, 2, and 3 Components r~s Amendment P xxv June 15, 1993
5't " CESSAR "E.TIFICATION C O LIST OF TABLES (Cont'd) CHAPTER 3 Table Bubiect 3.9-3 Stress Limits for ASME Code Class 1 Components, Piping, and Component Supports 3.9-4 Seismic I Active Valves 3.9-5 Stress Criteria for Safety-Related ASME Cla3s 2 and Class 3 Vessels 3.9-6 Stress Criteria for ASME Code Class 2 and Class 3 Inactive Pumps and Pump Supports 3.9-7 Design Criteria for Active Pumps and Pump Supports 3.9-8 Stress Criteria for Safety-Related ASME Code Class 2 and Class 3 Inactive Valves 3.9-9 Stress Criteria for Class 2 and Class 3 Active Valves 3.9-10 Loading Combinations for ASME Section III Class 1 Piping 3.9-11 Loading Combinations for ASME Section III Classes 2 and 3 Piping 3.9-12 Loading Conditions and Load Combination Requirements for Standard Hanger Components and Plate & Shell Type Members of ASME Code Class 1, 2, and 3 Piping Supports 3.9-13 Stress Limits for CEDM Pressure Housings 3.9-14 Stress Limits for Design and Service Loads 3.9-15 Inservice Testing Safety-Related Pumps and Valves 3.11-1 Ventilation Areas O Amendment P xxvi June 15, 1993
CESSAREEnce A l 'l
'Y LIST OF FIGURES j i
CHAPTER 3 Fiqures Subiect 3.3-1 Wind Pressure Distribution Coefficients (Cp) 3.6-1 Typical Crush Pipe Whip Restraint Configuration l 3.7-1 Synthetic Time History H1 Spectra vs Target Spectra for CMS 1 (2, 5 and 7% Damping) 3.7-2 Synthetic Time History H2 Spectra vs Target Spectra for CMS 1 (2, 5 and 7% Damping) 3.7-3 Synthetic Time History V Spectra vs Target Spectra for CMS 1 (2, 5 and 7% Damping) 3.7-4 Synthetic Time History H1 Spectrum vs Target Spectrum, CMS 2 (1 and 2% Damping)
,_ 3.7-5 Synthetic Time History H1 Spectrum vs Target / T Spectrum, for CMS 2 (5 and 7% Damping) \}
3.7-6 Synthetic Time History H2 Spectrum vs Target Spectrum, for CMS 2 (1 and 2% Damping) 3.7-7 Synthetic Time History H2 Spectrum vs Target Spectrum, for CMS 2 (5 and 7% Damping) 3.7-8 Synthetic Time History V Spectrum vs Target Spectrum, for CMS 2 (1 and 2% Damping) 3.7-9 Synthetic Time History H1 Spectrum vs Target Spectrum, for CMS 2 (5 and 7% Damping) 3.7-10 Synthetic Time History H1 Spectra vs Target Spectra for CMS 3 (1, 2, 5 and 7% Damping) 3.7-11 Synthetic Time History H2 Spectra vs Target Spectra for CMS 3 (1, 2, 5 and 7% Damping) 3.7-12 Synthetic Time History V Spectra vs Target Spectra for CMS 3 (1, 2, 5 and 7% Damping) 3.7-13 Schematic Diagram of Interior Structure (IS), Shield Building (SB), FB, CVCS 1/s Amendment P xxvii June 15, 1993
CESSARE!asem O LIST OF FIGURES (Cont'd) CHAPTER 3 Fiqures Subiect 3.7-14 Schematic Diagram of Interior Structure (IS), Shield Building (SB), DG-1, DG-2 3.7-15 Schematic Diagram of Interior Structure (IS), Shield Building (SB), EFW1(Hor), EFW2(Hor) 3.7-16 Schematic Diagram of Interior Structure (IS), Shield Building (SB), EFW1(Vert), EFW2(Vert) 3.7-17 Schematic Diagram of Interior Structure (IS), Shield Building (SB), CAA, CAB 3.7-18 Finite Element Model of Steel Containment Vessel (For SSI Analysis) 3.7-19 Schematic of Combined NI and NA Structures (Elevation looking South) 3.7-20 Schematic of Combined NI and NA Structures (Elevation looking West) 3.7-21 Schematie Diagram of the SASSI Analysis Process Using CMS 2 and CMS 3 Motions 3.7-22 Schematic Diagram of the SASSI Analysis Process Using CMS 1 Motions 3.7-23 Reactor Coolant System Seismic Analysis Model 3.7-24 Pressurizer Seismic Analysis Model 3.7-25 Surge Line Seismic Analysis Model 3.7-26 Reactor Internals Horizontal Seismic Analysis Model 3.7-27 Reactor Internals Nonlinear Horizontal Seismic Model 3.7-28 Core Seismic Model One Row of 17 Fuel Assemblies l 3.7-29 Reactor Internals Linear Vertical Seismic Model 3.7-30 Reactor Internals Nonlinear Vertical Seismic Model 3.7-31 Core-Support Barrel Upper Flange Finite-Element Model Amendment P xxviii June 15, 1993
CESSAR Einincui:w t'T
+
t Q ,/ LIST OF FIGURES (Cont'd) CHAPTER 3 Fiqures Subiect 3.7-32 Damping Value for Seismic Analysis of Piping 3.8-1 Containment Details 3.8-2 Category I Structures - Typical Fuel Transfer Penetration 3.8-3 Three-Dimensional ANSYS Containment Model 3.8-4 Axisymmetric ANSYS Containment Model 3.8-5 Nuclear Island Structures l 3.9-1 Reactor Coolant System Supports Diagram 3.9-2 Summary of Analytical Methodology 3.9-3 ASHSD Finite Element Model of the CSB System ./] 3.9-4 Control Element Shroud Tube Finite Element Model 3.9-5 Lower Support Structure Instrument Nozzle Assembly Finite Element Model 3.9-6 ICI Support Tube; Outer Position Finite Element Model 3.9-7 Skewed Beam Support Columns Finite Element Model 3.9-8 Control Element Drive Mechanism (Magnetic Jack) 3.9-9 Reactor Vertical Arrangement 3.9-10 Core Support Barrel Assembly 3.9-11 Reactor Vessel Core Support Barrel Snubber Assembly 3.9-12 In-core Instrument Support Structure 3.9-13 Core Shroud Assembly 3.9-14 Upper Guide Structure Assembly 3.9-15 In-core Instrument System 3.9-16 Typical Inservice Testing Connections [ \ ( /
%.)
Amendment P xxix June 15, 1993
CESSAR Mai"lCATION p adherence to detailed quality assurance requirements, assure an extremely high probability that safety functions are accomplished in the event of Design Basis Events (DBEs). Detailed discussions of the protection systems are provided in Chapter 7. Design quality assurance is discussed in Chapter 17. The analysis of DBEs is contained in Chapter 15. 3.1.26 CRITERION 30 - QUALITY OF REACTOR COOLANT PRESBURE BOUNDARY Components which are part of the reactor coolant pressure boundary shall be designed, fabricated, erected, and tested to the highest quality standards practical. Means shall be provided for detecting and, to the extent practicable, identifying the location of the source of reactor coolant leakage.
RESPONSE
The reactor coolant pressure boundary components are designed, fabricated, erected and tested in accordance with the ASME Code g Section III. All components are classified Safety Class 1 or 2, in accordance with the ANSI /ANS 51.1, " Nuclear Safety Criteria (* for the Design of Stationary PWR Plants," definitions for safety classes and the reactor coolant pressure boundary. Accordingly, they receive all of the quality measures appropriate to that classification. Means are provided for the identification of the source of reactor coolant leakage. These include the detection of leakage to systems connected to the reactor coolant pressure boundary as well as leakage from the boundary into the containment. Instrumentation is provided to indicate and record makeup flow rate and integrated makeup flow to the primary water system. This instrumentation permits detection of suddenly occurring leaks and those which are gradually increasing. 3.1.27 CRITERION 31 - FRACTURE PREVENTION OF REACTOR COOLANT PRESSURE BOUNDARY The reactor coolant pressure boundary shall be designed with sufficient margin to assure that when stressed under operating, maintenance, testing, and postulated accident conditions: (1) the boundary behaves in a nonbrittle manner; and, (2) The. probability of rapidly propagating fracture is minimized. The j design shall reflect consideration of service temperatures and ! other conditions of the boundary material under operating, maintenance, testing, and postulated accident conditions and the Amendment D 3.1-21 September 30, 1988
CESSARnn% - I O 1 I uncertainties in determining: (1) material properties; (2) the effects of irradiation on material properties: (3) residual, steady state, and transient stresses; and, (4) size of flaws.
RESPONSE
All the reactor coolant pressure boundary components are designed and constructed in accordance with ASME Section III and comply with the test and inspection requirements of these codes. The test and inspection requirements assure that flaw sizes are limited so that the probability of failure by rapid propagation is extremely remote. Particular emphasis is placed on the quality control applied to the reactor vessel on which tests and inspections exceeding ASME code requirements are performed. The tests and inspections performed on the reactor vessel are summarized in Section 5.2.4.1. Carbon and low alloy steel materials which form part of the pressure boundary are tested in accordance with the requirements of the fracture toughness requirements for materials, ASME Code Section III. Nonductile failure prevention will be ensured by utilizing the appropriate sections of the ASME Code. Excessive embrittlement of the reactor vessel material due to neutron radiation is prevented by providing an annulus of coolant water between the reactor core and the vessel. In addition, to minimize the effects of irradiation on material toughness properties of core beltline materials, restrictions on upper limits for residual elements that directly influence the RTx37 shift are required by the design specification. Specifically, upper limits are placed on copper, nickel, phosphorous, sulfur, and vanadium. Further, the reactor vessel is forged such that no welds occur in the active core region. The maximum integrated fast neutron flux exposure of the reactor vessel wall opposite the midplane of the core is less than 6.2 x l 10" nyt. This value assumes a sixty-year vessel design life and an eighty percent plant capacity factor. The maximum expected increase in transition temperature is about 79'F. The actual l change in material toughness properties due to irradiation will be verified periodically during plant lifetime by a material surveillance program. Based on an initial RT,pr of 10'F, operating l restrictions will be applied as necessary to limit vessel stresses. The thermal stresses induced by the injection of cold water into the vessel, following a LOCA, have been examined. Analyses have shown that there is no gross yielding across the vessel wall when using the minimum specified yield strength in the ASME Boiler and Pressure Vessel Code, Section III. Amendment P 3.1-22 June 15, 1993
CESSAR MMi?tCATION
! s V
TABtE 3.2-1 (Cont'd) (Sheet 23 of 27) Ct.ASSIFICATION OF STRUCTtRES. SYSTEMS. AND CXMPONENTS Safety Seismic Congxwent Idmtification Class Categon Location Quality Class Structures Reactor Building Shield Building 2 1 RB 1 Steel Containment Vessel 2 I RB 1 Internal Structure 3 1 RC 1 Equipment Hatch 2 I RC 1 Personnel Airlocks 2 I RC 1 Subsphere 3 I RB 1 Nuclear Annex Control Area 3 I NA 1 EFW Tank / Main Steam 3 I NA 1 Valve House Area 3 i NA 1 Emergency Diesel 3 1 NA 1 Generator Areas 3 I WA 1 CYCS/ Maintenance Area 3 1 NA 1 Spent Fuel Pool Area 3 I NA 1 Unit vent (30) 3 I NA 1 Turbine Building NNS 11 TB 2 Radwaste Facility (28) 3 !! RW 2 Station Service Water 3 1 SP 1 Pump Structure Station Service Water intake Structure 3 I Si 1 Component Cooling Water 3 I CX 1 Heater Exchanger Structure Diesel Fuel Storage Building 3 I DF 1 O v) I Amend. ment P June 15, 1993
CESSAR ME"icarit. O TABLE 3.2-1 (Cont'd) (Sheet 24 of 27) CLASSIFICATION OF STRUCTURfS. SYSTEMS. AND COMPONFNTS Safety Seismic Cormonmt Identification Class Category location Qtsality Class Service Building NNS NS SB 3 Administration Building NNS NS ADB 3 Warehouse NNS NS WH 3 Fire Pump House NNS NS FP 3 Dike (CVCS Outdoor Tanks) 3 I YA 1 Cranes Polar Crane 3 11 RC 1 Cask Handling Hoist 3 !! NA 1 New fuel Handling Holst 3 11 NA 1 Component Supports (23) 1/2/3/NNS I/NS ALL 1/2/3 NOTES: (1) Two safety classes are used for heat exchangers to distinguish primary and secondary sides where they are different. (2) Loss of cooling water and/or seal water service to the reactor coolant pumps (RCPs) may require stopping the pumps. However, the continuous operation of the pumps is not required during or following an SSE. The auxiliaries are therefore not necessarily Safety Class 3 or Seismic Category I. Provision for cooling water to the pump bearing oil cooler and pump motor air cooler will not comply with the requirements of Regulatory Guide 1.29 (see Section 5.4.1.3). (3) Only those structural portions of the RCP.s which are necessary to assure the integrity of the reactor coolant pressure boundary are Safety Class 1. ) 1 (4) Safety class of piping within the reactor coolant pressure boundary (as defined in 10 CFR 50) is selected in accordance with the ANSI /ANS 51.1 criteria identified in Section 3.2.2. For purposes of CESSAR, Safety Clacs 1, 2, 3, and NNS of ANSI /ANS 51.1 are equivalent to Quality Groups A, B, C, and D of Regulatory Guide 1.26. O Amendment N April 1, 1993
CESSAR SnWicarien ; N) TABLE 3.2-1 (Cont'd) (Sheet 27 of 27) CLASSIFICATION OF STRUCTURES. SYSTEMS. AND COMPONENTS NOTES: (25) locations: (Cont'd) CX = Component Cooling Water Heat Exchanger Structure DG = Diesel Generator Building FP = Fire Pump House MS - Main Steam Valve House RW = Radwaste facility RB - Reactor Building RC - Steel Containment SP = Station Service Water Pump Structure SB = Service Building TB = Turbine Building NA = Nuclear Annex YA = Yard Above Ground (mI i SI = Station Service Water Intake Structure d DF - Diesel Fuel 0il Storage ALL = Througout Plant (26) Hydrogen lines in safety-related areas are either designed to Seismic Category I requirements, or sleeved with the outer pipe vented to the outside, or equipped with excess flow check valves so that in case of a line break, the hydrogen concentration in the affected area will not exceed 2%. (27) Containment isolation valves and containment penetration piping are Safety Class 2, Seismic Category I, and Quality Class 1. (28) The Radwaste Building foundation and curb are designed to the seismic criteria of regulatory position 5 of RG 1.143. V Amendment N April 1, 1993
CESSAR linec-O TABLE 3.2-1 (Cont'd) (Sheet 27a of 27) CLASSIFICATION OF STRUCTURES. SYSTEMS. AND COMPONENTS NOTES: (29) The QA program provides a graded approach to the assurance of (Cont'd) quality of work performed by and for ABB-CE by the use of quality class designations to describe the various levels of controls as follows:
- 1) QC-1 is the highest level quality class and embodies all necessary controls for items and/or services which are required to meet 10 CFR 50 Appendix B requirements. ,
i
- 2) QC-2 is an intermediate level . quality class which is used for items or services which require a moderate level of I control of activities affecting quality, but which are neither Nuclear Safety-Related nor required to meet the ;
requirements of 10 CFR 50 Appendix B. Circumstances 1 appropriate for QC-2 designation include non-standard, I complex items, or those which must perform reliably, in a harsh environment or with less than normal operator attention or maintenance.
- 3) QC-3 is the quality class which applies to all items or services which are not assigned to another quality class. ,
Quality requirements may be specified in quality plans, ' procurement documents and/or special procedures if deemed ; necessary. ' (30) The Unit Vent is Seismic Category I and-is not designed for tornado wind and wind pressures or tornado generated missiles. l I l i I 1 O Amendment P June 15, 1993
s CESSARMninema () ^l, 3.4 WATER LEVEL (FLOOD) DESIGN i All Seismic Category I structures, components.and equipment are , designed fer applicable loadings caused by postulated floods. ! Section 2.4 of the site-specific SAR describes, in detail, the t relationship of the site-specific flood levels to safety-related buildings and facilities. 3.4.1 FLOOD ELEVATIONS The elevation level for floods at the reactor site is determined . in accordance with Regulatory Guide 1.59, " Design Basis Floods for Nuclear Power Plants," and ANSI /ANS 2.8, " Determining Design Basis Flooding at Power Reactor Sites." The design basis level for the System 80+ Standard Design is 1 foot below plant finished yard grade. Flood level values in excess of this 1 foot level are site-specific and protection measures for that flood level are described in Section 2.4 of the site-specific SAR. 3.4.2 PHENOMENA CONSIDERED IN DESIGN LOAD CALCULATION All safety-related structures of the reactor building complex are-designed to withstand the static and dynamic forces of the plant' flood level. Other safety-related. structures or' systems essential for plant operation are designed for the site-related flood level as described in Section 2.4 of the site-specific SAR. The COL applicant will provide a specific description of the site and elevation for all safety-related structures, exterior ' accesses, equipment and systems. t 3.4.3 FLOOD FORCE APPLICATION
^
The design flood is used in determining the applicable -water - level for design of all Seismic Category I structures in accordance with the load combinations discussed in Section 3.8.4. The forces acting on those structures are determined on the basis ; of full external hydrostatic pressure corresponding.to that flood level. All Seismic Category I structures will be in a stable. condition due to both moment and uplif t forces resulting from the proper load combinations, including design basis flood levels. j 3.4.4 FLOOD PROTECTION 3.4.4.1 Flood Protection Measures for Beismic Catecory I Structures The flood protection measures for Seismic Category I structures,- systems and components are designed in accordance with Regulatory Guide 1.102, " Flood Protection for Nuclear Power Plants." J Amendment P 3.4 June 15, 1993
CESSARina m O Seismic Category I structures identified in Table 3.2-1 are designed for flood protection. These Seismic Category I structures are designed to protect safety-related equipment from floods by incorporating the following safeguards into their construction: A. No exterior access openings will be lower than 1 foot above plant grade (yard grade) elevation. l B. The finished yard grade adjacent to the safety-related structures will be maintained at least 1 foot below the ground floor elevation, except where ramps or steps are provided for access. C. Waterstops are used in all horizontal and vertical construction joints in all exterior walls up to flood level elevation. D. Water seals are provided for all penetrations in exterior walls up to flood level elevation. For other Seismic Category I structures where flood protection measures are required (e.g. pumping systems, stoplogs, watertight doors, dikes, retaining walls and drainage systems) the design of means for providing such protection will be described in Section 2.4 of the site-specific SAR. Penetrations located below the external flood level in the external walls of the Nuclear Annex are currently projected to include Component Cooling Water, Radwaste, and Diesel Fuel Oil System piping and cable penetrations. Additional penetrations may be identified once layouts are finalized for systems such as sewage, demineralized water, station air, and security. 1 External flooding as a result of secondary flooding sources , located in the Turbine Building are addressed in Section I 10.4.1.3. Entrances to the Nuclear Annex from the Turbine Building are elevated above plant grade to prevent flood l propagation. ! 1 Internal flood protection in the System 80+" design minimizes possible flood sources. The station service water system is located outside the Nuclear Annex to eliminate a significant i source of water. The component cooling water and emergency I feedwater systems are fully separated by division, thus l eliminating the possibility of a single flood source within these systems impacting both divisions. ; Lengths of high energy and moderate energy piping have been I minimized by equipment location. Equipment in the Reactor I Building (RB) Subsphere is located in quadrants to minimize the Amendment P 3.4-2 June 15, 1993
l CESSAR naiLos l l C lengths of piping runs. The RB Subsphere also provides for close proximity of equipment to reduce piping runs from containment. Flood barriers have been integrated into the design to provide further flood protection while minimizing the impact on maintenance accessibility. The primary means of flood control in the Nuclear Annex and RB Subsphere is provided by the divisional wall which serves as a barrier between redundant trains of safe shutdown systems and components. Each half of the Subsphere is further divided into two quadrants to separate redundant safe shutdown components to the extent practical. Flood barriers provide separation between Subsphere quadrants, while maintaining equipment removal capability. Emergency Feedwater pumps are located in separate compartments within the quadrants with each compartment protected by flood barriers. Penetrations are sealed and no doors are provided up to EL. 70+0, the maximum internal flood in the divisional wall that separates the Nuclear Annex and the Reactor Building Subsphere. Where flood doors are provided, open and close sensors are also provided with status indication. Flood barriers also provide e separation between electrical equipment and fluid mechanical ( systems at the lowest elevation within the Nuclear Annex. At higher elevations, safety-related electrical components are elevated above the floor so that flooding events will not affect components. ~ Additional barriers (e.g., curbs, sealed penetrations) are provided or safety-related electrical components are elevated, as necessary, to mitigate the effects of postulated pipe rupture addressed in Section 3.6. Flood protection is also integrated into the floor drainage system. The floor drainage systems are separated by division and Safety Class 3 valves are provided to prevent backflow of water to areas containing safety-related equipment. Each subsphere quadrant is provided with redundant saf ety Class 3 sump pumps and associated instrumentation, which are powered from the diesel generators in the event of loss of offsite power. The Nuclear Annex floor drainage system is divisionally separated, with no common drain lines between divisions. Floors are gently sloped to allow good drainage to the divisional sumps. Flood protection is incorporated into the Component Cooling Water Heat Exchanger Structure. This structure is divisionally separated by a wall such that a flood in one division can not flood the other division. ' [ The Diesel Generator Building floor drain sump pumps associated instrumentation are Safety Class 3 to prevent flooding and of the diesel generators. These pumps are also powered from the diesel generator in the event of loss of offsite power. Amendment P 3.4-3 June 15, 1993
CESSAR EE"lCAT13N O The COL applicant will ens' ire that all Seismic Category I structures are protected against flood damage. 3.4.5 ANALYTICAL AND TEST PROCEDURES A description of the methods and test procedures by which static and dynamic effects of the design basis flood conditions or design basis groundwater conditions are applied is detailed in Section 2.4 of the site-specific SAR. O O Amendment P 3.4-4 June 15, 1993
CESSAR Heine,1i:n i $V) ! l The System 80+ design follows the guidelines of Regulatory Guide 1.115 by placing and orienting the turbine such that all safety-related structures, systems, and components are excluded from the low trajectory turbine missile strike zones or if site characteristics make this impossible, safety-related targets will be placed and shielded such that the combined strike and damage probability for the safety-related targets in these zones is less than 10E-3 per turbine failure. The COL applicant will verify that its turbine maintenance and inspection program will ensure that the failure and missile generation probability will be less than 10E-4 events per turbine-year. The COL applicant wi.ll submit a summary of the , turbine maintenance and inspection program and the results of the probabilistic evaluation. 3.5.1.4 ILissiles Generated by Natural Phenomena Tornado-generated missiles are the limiting natural hazard and, as such, are a part of the design basis for Seismic Category I structures and components. Tornado-generated missiles considered in the design are given in Table 3.5-2. O) k V 3.5.1.5 Missiles Generated by Events Near the Site Justification will be provided in the site-specific SAR. 3.5.1.6 Aircraft Hazards Justification will be provided in the site-specific SAR. Also refer to Section 2.2.1. 3.5.2 STRUCTURES, SYSTEMS, AND COMPONENTS TO BE PROTECTED FROM EXTERNALLY GENERATED MISSILES Tornado missiles are the design basis missiles from external sources. All safety related systems, equipment and components required to safely shut the reactor down and maintain it in a safe condition are housed in Category I structures designed as tornado resistant (see Section 3.5.1.4) and as such are considered to be adequately protected. 3.5.3 BARRIER DESIGN PROCEDURES Missile barriers, whether steel or concrete, are designed with sufficient strength and thickness to stop postulated missiles and to prevent overall damage to Seismic Category I structures. The h ( procedures by which structures and barriers are designed to perform this function are presented in this section. Amendment P 3.5-5 June 15, 1993
CESSAR E!Encmon O 3.5.3.1 Local Damaco Prediction The prediction of local damage in the immediate vicinity of an impacted area depends on the basic material of construction of the barrier itself (i.e. either concrete or steel). Corresponding procedures are discussed separately below. 3.5.3.1.1 Concrete Structures and Barriers Local damage prediction for concrete structures includes the estimation of the depth of missile penetration and an assessment of whether secondary missiles might be generated by spalling. Generally, the Modified Petry Formula or the Modified NDRC Formula (References 2 and 3) is used to estimate missile penetration with appropriate constants taken from available test data. To insure that no secondary missiles (due to spalling) are generated, a minimum barrier thickness of 3 times the penetration depth is provided. In addition, the minimum barrier thickness requirements for local damage due to tornado generated missiles shall be as indicated in Table 3.5-3. Depending on certain missile characteristics, additional penetration formulas may be employed as justified by full scale impact tests (References 3 and 4). ! 3.5.3.1.2 Steel Structures and Barriers The Stanford equation (Reference 5) is used as the basis for the l design and analysis of steel structures and barriers. ! 3.5.3.2 Overall Damage Prediction I The overall response of a structure or barrier to missile impact depends largely on the location of impact (e.g. near mid-span or } near a support), the dynamic and deformation properties of the l barrier and the missile, and the kinetic energy of the missile itself. Depending on the deformation characteristics of both the barrier and the missile, an impact force time history can be developed using either work-kinetic energy principles or conservation of momentum. The structural response to this impulse loading, in conjunction with other appropriate design loads, is evaluated by the procedures given in References 3 and 6. O Amendment N 3.5-6 April 1, 1993
CESSARaman CELTIFICATl3N i
,~
- }
%/
3.6 PROTECTION AGAINST DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING Protection of vital equipment is achieved primarily by separation of redundant safe shutdown systems and by separation of high-energy pipe lines from safe shutdown systems, which are required to be functional following specific pipe rupture events. This redundancy and separation results in a design which requires very few special protective features (such as whip restraints and jet deflectors) to ensure safe shutdown capability following a postulated high-energy line break. Separation is maintained by barriers such as the containment secondary shield wall, refueling cavity wall and certain Nuclear Annex walls and tunnels or by physical distance. Loadings and jet zones of influence are calculated using methodology described in Section 3.6.2. Supplemental information on design for protection against dynamic effects of postulated pipe breaks is given in Appendix 3.9A. /q 3.6.1 POSTULATED PIPING FAILURES IN FLUID SYSTEMS
% 3.6.1.1 Design Basis Most systems and components outside Containment required for safe plant shutdown are located in the. Reactor Building Subsphere.
The Reactor Building Subsphere and Nuclear Annex are divided by a structural wall which serves as a barrier between redundant trains of safe shutdown systems and components. Each half of the Reactor Building Subsphere is compartmentalized to separate redundant safe shutdown components to the extent practical. High-energy piping systems located in the Nuclear Annex, which are not required to be functional for safe shutdown, are routed primarily in designated pipe tunnels or in the Main Steam Valve Houses to provide separation from safe shutdown systems and coraponents . The Reactor Building Subsphere and Nuclear Annex are separated by structural walls that provide physical barriers. Systems and components inside containment, which are required to be functional for safe plant shutdown, are protected from postulated pipe failure dynamic effects primarily by separation and barriers. The secondary shield wall serves as a barrier between the reactor coolant loops and the containment liner. The refueling cavity walls, the operating floor, and the secondary shield wall provide separation between the reactor coolant loops. The steam generators and pressurizer are enclosed in cavities which also provide separation. {}/ (" Main steam, steam generator blowdown, and main feedwater l (downcomer and economizer) lines outside containment are Amendncnt P 3.6-1 June 15, 1993
1 C E S S A R 88 Wicariou ! l I Oll separated from essential systems and components by virtue of the plant arrangement that places these lines along the roof of the Nuclear Annex. The floors and walls adjacent to the main stcam, steam generator blowdown, and main feedwater lines are Seismic l Category I concrete walls. The essential portions of these systems (main steam and main feedwater isolation valves) are located in the Main Steam Valve Houses. These rooms are separated from all other essential systems and components by Seismic Category I concrete slabs and walls. (Refer to Figures 1.2-2, 7, 8 and 9.) The Chemical and Volume Control System high-energy lines are located inside the primary containment and extend through the annulus into the Nuclear Annex. The high-energy lines in the Nuclear Annex are 2-inch lines. The postulated dynamic effects of the Chemical and Volume Control System high-energy lines are separated from safe shutdown systems and components by distance and configuration as much as practical. Otherwise, protection is provided for by shields and barriers. The safe shutdown components are divisionally separated and divided by a Seismic Category I concrete divisional wall in the Nuclear Annex. In the unlikely event that a postulated dynamic event were to effect a safe shutdown component, the redundant equipment associated with the other division would still be available for safe shutdown. Any high-energy line routed through the annulus between the primary containment and its shield building is provided with a guard pipe so that rupture of high-energy lines in the annulus need not be analyzed. The NSSS design includes two steam generators per unit, which f acilitates separation of redundant systems and components inside containment. Other than for the safety injection system components, which must circulate cooling water to the vessel, the engineered safety features are generally located outside the secondary shield wall. The safety injection system pipes and cables, which terminate inside the secondary shield wall, are routed outside the secondary shield wall to the extent practical to avoid postulated hazards. Most of the main steam, steam generator blowdown, and feedwater piping inside containment is located at higher elevations, and the postulated dynamic effects are separated from safe shutdown systems and components by distance and configuration. Table 3.6-1 provides a list of plant fluid systems that contain high- and moderate-energy piping in the Nuclear Annex, Reactor Building Subsphere, and containment building. Table 3.6-2 provides a list of the systems that are required for safe shutdown or to support safe shutdown. Amendment P 3.6-2 June 15, 1993
CESSAREnaceu l o I i V High- and moderate-energy pipe failure locations are postulated as described in Section 3.6.2. Each postulated rupture location is evaluated for its effect on safe shutdown systems and components required following the specific pipe failure event. 3.6.1.1.1 High-Energy Piping Systems A high-energy pipe failure is postulated in branches or piping runs larger than one inch nominal diameter and which operate during normal plant conditions with high energy fluid. Included in this category are fluid systems or portions of fluid systems which are pressurized above atmospheric pressure during normal plant operation and which, in addition, operate during normal plant conditions and where either or both of the following are met: A. Maximum operating temperature exceeds 200*F, or B. Maximum operating pressure exceeds 275 psig. Fluid piping systems that qualify as high-energy for only short portions of their operational period are considered moderate-(O) energy systems if the portion of their operational period within the pressure and/or temperature specified above for high energy fluid systems is less than two percent of the time period l required to accomplish its system design function. In analyzing the effects of a high-energy pipe failure, the consequences of pipe whip, water spray, jet impingement, flooding, compartment pressurization, and environmental conditions are considered. See Appendix 3.9A, Section 1.1.8.1.1 for a further discussion. l 3.6.1.1.2 Moderate-Energy Piping Systems A moderate-energy pipe failure is postulated in branches or piping runs larger than one inch nominal diameter and which operate during normal plant conditions with moderate-energy fluid. Included in this category are fluid systems or portions of fluid systems which are pressurized above atmospheric pressure during normal plant operation and which, in addition, operate during normal plant conditions and where both of the following are met: m A. Maximum operating temperature is 200*F or less, and B. Maximum operating pressure is 275 psig or less. Amendment P 3.6-3 June 15, 1993
CESSAR88% - O In analyzing the effects of a moderate-energy pipe failure, the consequences of water spray, jet impingement, flooding, i compartment pressurization, and environmental conditions are ! considered. See Appendix 3.9A, Section 1.1.8.1.2 for a further discussion. l 3.6.1.2 Description A listing of the high-energy lines inside the containment is given in Table 3.6-3. A listing of high-energy lines outside the containment is given in Table 3.6-4. Since the Turbine and Radwaste Buildings contain no safety-related equipment, high-energy line breaks in those buildings are generally excluded from this table. ! Essential systems are those systems that are needed to safely shut down the reactor or mitigate the consequences of a pipe break for a given postulated piping failure. However, depending upon the type and location of a postulated pipe break, certain safety equipment may not be classified as essential for that' particular event. The essential systems which are to be protected from the effects i of postulated piping failures are identified below. These l essential systems were selected for each postulated break to satisfy the protection criteria given in the introduction to Section 3.6. A. The following systems, or portions of these systems, are required to mitigate the consequences of postulated breaks of high-energy reactor coolant pressure boundary piping that result in a loss-of-coolant-accident (LOCA) assuming a loss of offsite power.
- 1. Reactor Protective System.
- 2. Engineered Safety Features Actuation System.
- 3. Safety Injection System.
- 4. Containment Spray System.
- 5. Class 1E Electrical Systems, AC and DC (including switchgear, batteries, and distribution systems), 1E cabling and sensing lines.
- 6. Diesel Generator Systems, including Diesel Generator Starting, Lubrication, and Combustion Air Intake and Exhaust Systems.
- 7. Diesel Fuel Oil Storage and Transfer System.
- 8. Hydrogen Recombiner System.
- 9. Control Building HVAC System.
Amendment P 3.6-4 June 15, 1993
CESSAR n!& men p
'G) '
of a postulated piping failure. In judging the availability of such systems and components, account is taken of the postulated failure and its direct consequences, such as unit trip and loss of offsite power, and of the assumed single active component failure and its direct consequences. The feasibility of carrying out operator actions is based on a minimum of 30 minutes delay responding to alarm indication and adequate access to equipment being available for the proposed actions. (Access to the containment post-LOCA is not assumed.) I
- 6. Piping systems containing high-energy fluids are i designed so that the affects of a single postulated ;
pipe break cannot, in turn, cause failures of other pipes or components with unacceptable consequences. !
- 7. For a postulated pipe failure, the escape of steam, water, and heat from structures enclosing the high-energy fluid containing piping does not preclude:
- a. Accessibility to surrounding areas important to the safe control of reactor operations, O]
t
- b. Habitability of the control room.
- c. Ability of instrumentation, electric power ]
supplies, and components and controls to initiate, ' actuate, and complete a safety action. (A loss of redundancy is permissible, but not the loss of function.) The design criteria define acceptable types of isolation for safety-related elements and for high-energy lines from similar elements of the redundant train. Separation is accomplished by: A. Routing the two groups through separate compartments, or B. Physically separating the two groups by a specified minimum distance, or C. Separating the two groups by structural barriers. The design criteria assure that a postulated failure of a high-energy line or a safety-related element cannot take more than one safety-related train out of service. The failure of a component or subsystem of one train may cause failure of another m portion of the same train; for example, a Division 2 high-energy I pipe may cause failure of a Division 2 electrical tray, but not failure of any Division 1 component. The capability to shut the Amendment J 3.6-11 April 30, 1992
CESSARESL - O' plant down safely under such a failure will therefore remain intact. Given the separation criteria above, and the pipe break criteria in Section 3.6.2.1.2, the effects of high-energy pipe breaks are not analyzed where it is determined that all essential systems, components, and structures are sufficirntly physically remote from a postulated break in that piping lun. 3.6.2 DETERMINATION OF BREAK LOCATIONS AND DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING Described herein are the design bases for locating breaks and cracks in piping inside and outside containment, the procedure used to define the thrust at the break location, the jet impingement loading criteria, and the dynamic response models. The COL applicant will provide final designs of high and moderate-energy fluid systems. 3.6.2.1 Criteria Used to Define Break and Crack Locations and Conficurations 3.6.2.1.1 General Requirements Postulated pipe ruptures are considered in all plant piping systems and the associated potential for damage to required systems and components is evaluated on the basis of the energy in the system. System piping is classified as high-energy or moderate-energy, and postulated ruptures are classified as circumferential breaks, longitudinal breaks, leakage cracks, or through-wall cracks. Each postulated rupture is considered separately as a single postulated initiating event. For each postulated circumferential and longitudinal break, an evaluation is made of the effects of pipe whip, jet impingement, compartment pressurization, environmental conditions, and flooding. For piping systems where leak-before-break is demonstrated (Sections 3.6.2.1.3 and 3.6.3), dynamic effects of pipe breaks are not considered. If required to demonstrate safe plant shutdown, an internal fluid system load evaluation is performed on the effects of fluid forces on components within or bounding the fluid system. For each postulated leakage crack, an evaluation is made of the effects of compartment pressurization, environmental conditions and flooding. For each postulated through-wall crack, an evaluation is made of the effects of environmental conditions and flooding. The effects of pipe ruptures and/or leakage cracks are included in the environmental qualification of safety-related electrical and mechanical equipment. Environmental qualification of safety related equipment is discussed in Section 3.11. The evaluation of the required systems and components demonstrate that the protection requirements of Section 3.6.1 are met. Amendment P 3.6-12 June 15, 1993
CESSAR EKncarcu m
; \ ]
calculated by Eq. (10) in Paragraph NB-3653, ASME Code, Section III, exceeds 2.4 S, and the stress range calculated by either Eq. (12) or Eq. (13) in Paragraph NB-3653 exceeds 2.4 S,. Where the cumulative usage factor (U) exceeds 0.1. Where, as defined in Subarticle NB-3650, leakage crack locations for Class 1 piping are specified in Item E below. S. = allowable stress-intensity value. U = the cumulative usage factor. B. Class 2, Class 3, or Seismically Analyzed ANSI B31.1 Piping Ruptures, as specified in Item D below, are postulated to occur at the following locations in each piping network designed in accordance with the rules of the ASME Boiler and Pressure Vessel Code, Section III, (Reference 2) for Class 2 and Class 3 piping, or with the rules of the ASME Code for Pressure Piping, B31, Power Piping, ANSI /ASME B31.1 ,O (Reference 3) for seismically analyzed ANSI B31.1 piping: d 1. the terminal ends of the pressurized portion of the network, and
- 2. either
- a. intermediate locations of potential high stress or fatigue such as pipe fittings, valves, flanges and welded-on attachments, or
- b. where the piping contains no fittings, weld attachments, or valves, at one location at each extreme of the piping run adjacent to the protective structure, or
- c. intermediate locations where the stress, S, exceeds 0.8(X + Y).
where, as defined in Subarticle NC-3650, S = stresses under the combination of loadings for which either Level A or Level B service limits have been specified, as calculated
- from the sum of equations (9) and (10).
For those loads and conditions in which Level A and Level B (mj stress limits have been specified in the design (j spacification (excluding earthquake loads). Amendment P 3.6-15 June 15, 1993
CESSARH5L mu ' O X = equation (9) Service Level B allowable stress. Y = equation (10) allowable stress. As a result of piping reanalysis due to differences between the design configuration and the as-built configuration, the highest stress locations may be shif ted; however, the initially determined intermediate break locations may be used unless a redesign of the piping resulting in a change in pipe parameters (diameter, wall thickness, routing) is required, or the dynamic effects from the new (as-built) intermediate break locations are not mitigated by the original pipe whip restraints and jet shields. Leakage crack locations for Class 2 and Class 3 piping are specified in Item E below. C. Non-Safety Related ANSI B31.1 Piping System 80+ piping is designe,d so as to isolate seismically analyzed piping from non-seismically analyzed p,iping. In cases where it is not possible or practical to isolate the seismic piping, adjacent non-seismic pi is analyzed according to Seismic C, ate, gory 2 criteria. ping For non-seismic piping attached to seismic piping, the dynamic effects of the non-seismic piping are simulated in the modeling of the seismic piping. The attached non-seismic piping up to the analyzed /unanalyzed boundary is designed not to cause a failure of the seismic piping during a seismic event. For non-safety class piping which is not seismically analyzed, leakage cracks are postulated at axial locations such that they produce the most severe environmental effects. D. Break Locations in Piping Runs with Multiple ASME ' Code Piping Classes Breaks, in accordance with Section 3.6.2.1.4.1.E, are postulated to occur at the following locations:
- 1. The terminal ends of the pressurized portions of the run.
- 2. At intermediate locations selected by either one of the following methods:
- a. At each location of potential high stress or fatigue, such as pipe fittings, valves, flanges, and welded attachments; or
- b. At all intermediate locations between terminal ends where the stress and fatigue limits of Sections 3.6.2.1.4.1.A.2.b or 3.6.2.1.4.1.B.2.b are exceeded.
. Amendment P 3.6-16 June 15, 1993
CESSAR8Ebmu g V E. Break Locations Both circumferential and longitudinal breaks are postulated to occur, but not concurrently, systems at the locations specified inin allItems high-energy A, B, C,piping or D, l except as follows:
- 1. Circumferential breaks are not postulated in piping runs of a nominal diameter equal to or less than 1 inch.
- 2. Longitudinal breaks are not postulated in piping runs of a nominal diameter less than 4 inches.
- 3. Longitudinal breaks are not postulated at terminal ends.
- 4. Only one type of break is postulated at locations where, from a detailed stress analysis, such as finite-element analysis, the state of stress can be used to identify the most probable type. If the primary plus secondary stress in the axial direction is found to be at least 1.5 times that in the circumferential direction for the most severe loading combination association with Level A and Level B service limits, then only a circumferential break is postulated.
{ Conversely, if the primary plus secondary stress in the
\
circumferential direction is found to be at least 1.5 times that in the axial direction for the most severe loading combination associated with Level A and Level B service limits, then only a longitudinal break is postulated.
- 5. Circumferential and longitudinal breaks are not postulated at locations where the requirements of Item F are satisfied.
- 6. Circumferential and longitudinal breaks are not postulated at locations where the criterion in Item F.2 l 1s used.
F. Crack Locations
- 1. Through-Wall Cracks Through-wall cracks are postulated in all high-energy and moderate-energy piping systems having a nominal diameter greater than 1 inch at the locations specified in A, B or C, except that through-wall cracks are not postulated at locations where:
- a. For Class 1 piping, the calculated
- value of S, as defined in Item A, is less than one-half the limits of Item A.2.b.
p
- For those loads and conditions in which Level A and Level B
( stress limits have been specified in the Design A Specification (excluding earthquake loads). Amendment P 3.6-17 June 15, 1993
CESSARRENm O
- b. For Class 2, Class 3 or seismically analyzed ANSI B31.1 piping, the calculated
- values of S as defined in Item B.2.c is less than one-half the limits of Item B.2.c.
- c. The requirements of Item F are satisfied.
- d. The criterion in 2. below is used.
- 2. Leakage Cracks A leakage crack is postulated in place of a circumferential break, or loncJ i tudinal break, or through-wall crack, if justified by an analysis performed on the p,ipeline in accordance with the requirements of Section 3.6.3.
For moderate-energy fluid systems in areas other than containment penetration, leakage cracks are postulated at axial and circumferential locations that result in the most severe environmental consequences. Where a break in a high-energy fluid system is postulated which results in more limiting environmental conditions, the leakage crack in the moderate-energy fluid system is not postulated. Leaka e cracks, instead of breaks, are postulated in the p ping of fluid systems that qualify as high-energy - fluid systems for short operational periods of time but that qualify as moderate-energy fluid systems for the major operational period. G. Piping Near Containment Isolation Valves Ruptures are not postulated between the containment wall and ' the inboard or outboard isolation valves in piping, which is designed in accordance with the rules of the ASME Boiler and Pressure Vessel Code, Section III (Reference 2), and which meets the following additional requirements:
- 1. The following design stress and fatigue limits are not exceeded:
For ASME Code. Section III. Class 1 Pinina (a) The maximum stress range between any two loads sets (including the zero load set) does not exceed 2.4 S , and is calculated
- by Eq. (10) in NB-3653, ASME Code, Section III.
- For those loads and conditions in which Level A and Level B stress limits have been specified in the Design Specification (excluding earthquake loads).
Amendment N 3.6-18 April 1, 1993
CESSARUSL - f j Q.) If the calculated maximum stress range of Eq. (10) exceeds 2.4 S , the stress ranges calculated by both Eq. (12 ) "and Eq. (13) in Paragraph NB-3653 meet the l!.mit of 2.4 S,. (b) The cumulative usage factor is less than 0.1. (c) The maximum stress, as calculated by Eq. (9) in NB-3652 under the loadings resulting from a postulated piping failure beyond these portions of piping does not exceed the lesser of 2.25 S, and 1.8 S y except that following a failure outside containment, the pipe between the outboard isolation valve and the first restraint may be permitted higher stresses provided a plastic hinge is not formed and operability of the valves with such stresses is assured in accordance with the-requirements specified in SRP Section 3.9.3. Primary loads include those which are deflection limited by whip restraints. For ASME Code, Section III, Class 2 Pipino [ (d) The maximum stress as calculated by the sum of 'x _./ ~ Eqs. (9) and (10) in Paragraph NC-3652, ASME Code, Section III, considering those loads and conditions thereof for which level A and level B stress limits have been specified in the system's Design Specification (i.e., sustained loads, occasional loads, and thermal expansion) excluding earthquake loads does not exceed 0.8 (1.8 S3+ S). 3 The Sn and S i are allowable stresses at maximum (hot) temperature and allowable stress range for thermal expansion, respectively, as defined in Article NC-3600 of the ASME Code, Section III. (e) The maximum stress, as calculated by Eq. (9) in NC-3653 under the loadings resulting from a postulated piping failure of fluid system piping beyond these portions of piping does not exceed the lesser of 2.25 S3 and 1.8 S. y Primary loads include those which are deflection limited by whip restraints. The exceptions permitted in (c) above may also be applied provided that when the piping between the outboard isolation valve and the restraint is constructed. in accordance with the Power Piping Code ANSI ,m B31.1 (see ASB 3-1 B.2.c.(4)), the piping shall either be of seamless construction with full ('v) Amendment N 3.6-19 April 1, 1993
CESSAR EL"lCATION O radiography of all circumferential welds, or all longitudinal and circumferential welds shall be fully radiographed. Reaction loads on terminal anchor points (e.g. penetrations) account for piping displacements allowed by gaps and/or plastic deformation of pipe rupture mitigating hardware, conservatively ignoring the effect of any intermediate piping supports. As appropriate to the geometry of the failed system piping, reaction. loads are limited by plastic behavior of the pipe. Typical physical properties for the piping material are utiliz9d in determination of the location and behavior t. plastic hinges to preclude undar-prediction of reaction loads through use of specified minimum properties.
- 2. Welded attachments, for pipe supports or other purposes, to these portions of piping is avoided except where detailed stress analyses, or tests, are performed to demonstrate compliance with the limits of 3.6.2.1.4.1.G.1. l
- 3. The number of circumferential and longitudinal piping .
welds and branch connections are minimized. Where guard pipes are used, the enclosed portion of fluid system piping is seamless construction and without circumferential welds unless specific access provisions are made to permit inservice volumetric examination of the longitudinal and circumferential welds.
- 4. The length of these portions of piping is reduced to the minimum length practical.
- 5. The design of pipe anchors or restraints (e.g.,
connections to containment penetrations and pipe whip restraints) does not require welding directly to the outer surface of the piping (e.g., flued integrally forged pipe fittings may be used) except where such welds are 100 percent volumetrically examinable in service and a detailed stress analysis is performed to demonstrate compliance with the limits of 3.6.2.1.4.1.G.1. l
- 6. Guard pipes provided for those portions of piping in i the containment penetration areas are constructed in j accordance with the rules of Class MC, Subsection NE of the ASME Code, Section III, where the guard pipe is part of the containment boundary. In addition, the Amendment P 3.6-20 June 15, 1993
1 CESSAR Eni"icarinn v
)
entire guard pipe assembly is designed to meet the following requirements and tests: (a) The design pressure and temperature is not less than the maximum operating pressure and temperature of the enclosed pipe under normal plant conditions. (b) The Level C stress limits in NE-3220, ASME Code, Section III, is not exceeded under the loadings associated with containment design pressure and temperature in combination with the safe shutdown earthquake. (c) Guard pipe assemblies are subjected to a single pressure test at a pressure not less than its design pressure. (d) Guard pipe assemblies do not prevent the access required to conduct the inservice examination specified in 3.6.2.1.4.1 F.7. Inspection ports, if used, are not located in that portion of the (~N guard pipe through the annulus of dual barrier iL containment structures.
- 7. A 100% volumetric inservice examination of all pipe welds are conducted during each inspection interval as defined in IWA-2400, ASME Code, Section XI.
- 8. Following a postulated pipe break of high-energy piping beyond either isolation valve, the stresses in the piping from the containment wall, to and including the length of the isolation valve, are maintained within Level C Service Limits as specified in the ASME Boiler and Pressure Vessel Code, Section III, (Reference 2).
- 9. The design and in-service inspection requirements, as specified in MEB 3-1 (Reference 4), are satisfied.
Inservice inspection program requirements are given in Sections 5.2.4 and 6.6. ,
- 10. The containment isolation valves are appropriately l qualified to assure that operability and leak tightness i are maintained when subjected to any combination of loadings, which may be transmitted to the valves from postulated pipe breaks beyond the valves. )
4
, 11. For moderate-energy piping, the stresses calculated by the sum of equations (9) and (10) in ASME Code, Section D)
/ III, NC-3653, do not exceed 0.4 times the sum of the l stress limits given in NC-3653. Amendment N 3.6-21 April 1, 1993' l
CESSAREnnnem O 3.6.2.1.4.2 Postulated Rupture Configurations A. Break Configurations Where break locations are postulated at fittings without the benefit of a detailed stress calculation, breaks are assumed to occur at each pipe-to-fittings weld. If detailed stress analyses or tests are performed, the maximum stressed location in the fittings is selected as the break location. Circumferential breaks are postulated in fluid system piping and branch runs as specified in CESSAR-DC Section 3.6.2.1.4.1.D. Instrument lines, one inch and less nominal pipe of tubing size are designed to meet the provisions of Regulatory Guide 1.11. Longitudinal breaks in fluid system piping and branch runs are postulated as specified in Section 3.6.2.1.4.1.D. B. Crack Configurations Leakage cracks are postulated at those axial locations specified in Section 3.6.2.1.4.1.E. For high-energy piping, leakage cracks are postulated to be in those circumferential locations that result in the most severe environmental consequences. The flow from the crack is assumed to wet all unprotected components within the compartment with consequent flooding in the compartment and communicating compartments. Flooding effects are determined on the basis of a conservatively estimated time period required to effect corrective actions. 3.6.2.1.5 Details of Containment Penetrations Details of containment penetrations are discussed in Sections 3.8.1 and 3.8.2. 3.6.2.2 Analvtical Methods to Define Forcing Functions and Response Models 3.6.2.2.1 Piping Evaluated for Leak-Before-Break There are no forcing functions or response models for the reactor coolant loop, surge line, shutdown cooling line, safety injection line and main steam line based upon elimination of dynamic effects by leak-before-break evaluation. O 1 Amendment J l 3.6-22 April 30, 1992 l l
DESlfN hfh/klg CELTIFICATISN O V 3.6.2.2.2 Analytical Methods to Define Forcing Functions and Response Models for Piping Excluding that Evaluated for Leak-Before-Break This section applies to all high-energy piping other than that whose dynamic effects due to pipe breaks are eliminated from the design basis by leak-before-break evaluation. 3.6.2.2.2.1 Determination of Pipe Thrust and Jet Loads A. Circumferential Breaks Circumferential breaks are assumed to result in pipe severance and separation amounting to at least a one-diameter lateral displacement of the ruptured piping sections, unless physically limited by piping restraints, structural members, or piping stiffness. B. Dynamic Force of the Fluid Jet Discharge The dynamic force of the fluid jet discharge is based on a circular break area equal to the cross-sectional flow area of the pipe at the break location and on a calculated fluid ()N t s pressure modified by an analytically determined thrust coefficient, as determined for a circumferential break at the same location. Line restrictions, flow limiters, positive pump-controlled flow, and the absence of energy reservoirs are taken into account, as applicable, in the reduction of jet discharge. Piping movement is assumed to occur in the direction of the jet reaction, unless limited by structural members, piping restraints, or piping stiffness. C. Pipe Blowdown Force and Wave Force The fluid thrust forces that result from either postulated circumferential or longitudinal breaks, are calculated using a simplified one step forcing function methodology. This methodology is based on the simplified methods described in ; References 5 and 6. ; When the simplified method discussed above leads to impractical protective measures, then a more detailed j computer solution which more accurately reflects the j postulated pipe rupture event is used. The computer l solution is based on the NRC's computer program developed l for calculating two-phase blowdown forces (Reference 7).
%/
l Amendment N l 3.6-23 April 1, 1993
C E S S A R H5Ein m ia O D. Evaluation of Jet Impingement Effects Jet impingement force calculations are performed only if structures or components are located near postulated high energy line b:ceaks and it cannot be demonstrated that failure of the structure or component will not adversely affect safe shutdown capability. E. Longitudinal Breaks A longitudinal break results in an axial split without severance. The split is assumed to be orientated at any point about the circumference of the pipe, or alternatively. at the point of highest stress as justified by detailed stress analyses. For the purpose of design, the-longitudinal break is assumed to be circular or elliptical (2D x 1/2D) in shape, with an area equal to the largest piping cross-sectional flow area at the point of the break and have a discharge coefficient of 1.0. Any other values used for the area, diameter and discharge coefficient associated with a longitudinal break is verified by test data which defines the limiting break geometry. 3.6.2.2.2.2 Methods for the Dynamic Analysis of Pipe Whip Pipe whip restraints usually provide clearance for thermal expansion during normal operation. If a break occurs, the restraints or anchors nearest the break are designed to prevent unlimited movement at the point of break (pipe whip). The dynamic nature of the piping thrust load is considered. In the absence of analytical justification, a dynamic load factor of 2.0 is applied in determining restraint loading. (Elastic-plastic) pipe and whip restraint material properties may be considered as applicable. The effect of rapid strain rate of material properties is considered. A 10 percent increase in yield strength is used to account for strain rate effects. In general, the loading that may result from a break in piping is determined using either a dynamic blowdown or a conservative static blowdown analysis. The method for analyzing the interaction effects of a whipping pipe with a restraint is one of the following: (1) the Energy Balance Method (2) Lumped Parameter Method, or (3) Equivalent Static Method. The energy balance method is based on the principle of conservation of energy. The kinetic energy of the pipe generated during the first quarter cycle of movement is assumed to be converted into equivalent strain energy, which is distributed to the pipe or the whip restraint. See Appendix 3.6A for a i discussion of the application of the energy balance method. l I Amendment P j 3.6-24 June 15, 1993 ) i
CESSAR En#lCATION ( The lumped parameter method is carried out by utilizing a lumped mass model. Lumped mass points are interconnected by springs to take into account inertia and stiffness properties of the system. A dynamic forcing function or equivalent static loads may be applied at each postulated break location with pipe whip interactions. A nonlinear elastic-plastic analysis of the piping-restraint system is used. The computer method for this analysis is described in Appendix 3.6A. A conservative static analysis model is used for rigid rupture restraints. In order to obtain the design load for a rigid restraint, the following equation is used: F=2x1.1xF 3
= 2.2F 3 where F = the design load F3 = maximum blowdown force and the dynamic load factor (DLF) is taken as 2.0 and rebound effects are accounted for by a factor of 1.1.
t
\s 3.6.2.2.2.3 Method of Dynamic Analysis of Unrestricted Pipes The impact velocity and kinetic energy of unrestricted pipes is calculated on the basis of the assumption that the segments at each side of the break act as rigid plastic cantilever beams subject to piecewise constant blowdown forces. The hinge location is fixed either at the nearest restraint or at a point determined by the requirement that the shear at an interior plastic hinge is zero. The kinetic energy of an accelerating cantilever segment is equal to the difference between the work done by the blowdown force and that done on the plastic hinge.
The impact velocity V I is found from the expression for the kinetic energy: 2 KE = (1/2) M,,V 1 where M,, is the mass of the single degree of freedom dynamic model of the cantilever. The impacting mass is assumed equal to M., . For a straight run of pipe rotating about a plastic hinge, the zone of influence of the whipping pipe accounts for an increasing length due to a traveling hinge point caused by strain hardening effects. The impact energy of unrestrained pipe into a barrier v (e.g. the divisional wall) is governed by the vector component of Amendment P 3.6-25 June 15, 1993
CESSARMEN-O its velocity at impact which is perpendicular to the barrier. Impact of small piping into building structures conservatively assumes that all of the impact energy is imparted to the barrier with no dissipation due to local crushing deformation of the pipe. Bearing area of impact on building structure is generally elliptical, but is treated as a circle of equivalent area, with dimensions based on experimental data for pipe crush behavior. As the impact load is greatest on the periphery of the ellipse, this yielde a conservative force distribution into the barrier. Long term loading on the barrier subsequent to impact due to system blowdown and continued deceleration of remaining pipe (beyond the impact zone) is accounted for in addition to the initial impulsive loading. 3.6.2.3 Dynamic Analysis Methods to Verify Intecrity and operability 3.6.2.3.1 Pipe Whip Restraints and Jet Deflectors for Piping Evaluated for Leak-Before-Break There are no pipe whip restraints and jet deflector for the reactor coolant loop, surge line, shutdown cooling line, safety injection line and main steam line based upon elimination of dynamic effects due to pipe breaks by leak-before-break evaluation. 3.6.2.3.2 Pipe Whip Restraints and Jet Deflectors for Piping Other than that Evaluated for Leak-Before-Break This section applies to pipe whip restraints for all piping other than that whose dynamic effects due to pipe breaks are eliminated from the design basis by leak-before-break evaluation. 3.6.2.3.2.1 General Description of Pipe Whip Restraints When required, pipe whip restraints are provided to protect the plant ac inst the effects of whipping during postulated pipe break. The design of pipe whip restraints is governed not only by the pipe break blowdown thrust, but also by functional requirements, deformation limitations, properties of whipping pipe and the capacity of the support structure. Typically, a pipe whip restraint consists of a ring around the pipe and components supporting the ring from the supporting structure. The diameter of the ring is established considering the pipe diameter, maximum thermal movement of pipe, thickness of insulation and an additional tolerance for installation. The restraint is designed for the impact force induced by the maximum possible initial gap between the whip restraint and the process pipe. Amendment P 3.6-26 June 15, 1993
CESSAR En!iricuiu n
'uY Another alternative for a pipe whip restraint consists of a crush pipe or crush pad mounted perpendicular with respect to the orientation of the process pipe (See Figure 3.6-1 for illustration of a crush pipe configuration). The diameter, wall thickness, and length of the crush pipe is established considering the energy imparted to the crush pipe by a postulated process pipe break.
The impact energy is usually too high for an elastic restraint l system or support structure to absorb. Therefore, energy absorbing measures designed utilizing the energy balance approach l (impact energy + external work = internal energy of pipe restraint system), are provided. 3.6.2.3.2.2 Pipe Whip Restraint Components Pipe whip restraints typically consist of the following components: A. Energy. Absorbing Members Members that are under the influence of impacting pipes (pipe whip) absorb energy by significant plastic f' \ deformations (e.g., honeycomb material). rods, crush pipes and crushable l B. Non-Energy Absorbing Members Those components which form a direct link between the pipe and the structure (e.g., ring, crush pipe shim plates and l components other than energy absorbing members). C. Structural Attachments Those fasteners which provide the method of attaching connecting members to the structure or the ring (e.g., weld bolts). l D. Building Structure l Steel and concrete support structures which ultimately carry l the restraint load. Design criteria are specified in l Sections 3.8.3 and 3.8.4. l 3.6.2.3.2.3 Design Loads Restraint design loads, the reactions, and the corresponding deflections are established using the criteria delineated in Section 3.6.2.2.2. r\ Amendment P 3.6-27 June 15, 1993
CESSAR EnMcmou O 3.6.2.3.2.4 Allowable Stresses The allowable stresses are as follows: Allowable stresses used in the design of the pipe break restraint components are consistent with the component function. The upper design limit for pipe break restraint energy absorbing members is 50 percent of the restraint material ultimate strain. The allowable stresses associated with the non-energy absorbing members and structural attachments are given in Section 3.9.3.1.4. For the steel and concrete building structures, allowable stresses are specified in Sections 3.8.3 and 3.8.4. 3.6.2.3.2.5 Design Criteria The unique features in the design of pipe whip restraint components relative to the structural steel design are geared to the loads used and the allowable stresses. These are as follows: A. Energy-absorbing members are designed for the restraint reaction and the corresponding deflection established according to the pipe size and material and the blowdown force using the criteria delineated in Section 3.6.2.2. B. !!on-energy-absorbing members, structural components, and their attachments to the building structure are designed to ensure that the connecting members remain elastic. All essential components are evaluated for jet impingement and pipe whip effects using a dynamic or an equivalent static analysis of testing to demonstrate either the functional capability and/or operability in addition to the structural integrity of the component. 3.6.2.3.2.6 Materials The materials used are as follows: A. For energy-absorbing members: ASTM A-193 Grade B7 or equivalent for tension rods, A-106 Grade B or equivalent for crush pipe and crushable honeycomb made of stainless steel for compression. B. For other components: ASTM A-588, ASTM A-572 Grade 50, and ASTM A-36. l O Amendment P 3.6-28 June 15, 1993
CESSAREnnne-i
) /
(G ) 3.6.2.3.2.7 Jet Impingement Shields Protection from jets is provided by using separation and redundancy, as described in Section 3.6.1, in lieu of jet shields. 3.6.2.4 Guard Pipe Assembly Desian Criteria Guard pipes to limit pressurization effects in the containment penetration area will not be used except in " Hot Penetration" assemblies as described in Section 3.8.2.1.3.4. 3.6.3 LEAK-BEFORE-BREAK EVALUATION PROCEDURE This section describes Leak-Before-Break (LBB) analysis to all applicable piping. LBB analysis is used to eliminate, from the structural design bases the dynamic effects of double-ended guillotine breaks and equivalent longitudinal breaks for an applicable piping system. LBB is applied to the following System 80+ piping systems. p) i,
'v 1.
2. 3. Main Coolant Loop (MCL) piping, hot and cold' legs Surge Line (SL) Direct Vessel Injection (DVI) Line (main run inside containment)
- 4. Shutdown Cooling Line (SC) (main run inside containment)
- 5. Main Steam Line (MSL) (main run inside containment)
Supplemental information on LBB methodology and on design of piping systems to LBB criteria is given in Appendix 3.9A. 3.6.3.1 Applicability of LBD Piping evaluation for LBB is first shown to meet the applicability requirements for NUREG-1061, Volume 3. Specifically, the points considered for applicability for LBB are: (1) Regulatory requirements - level of susceptibility of failure from erosion, erosion / corrosion, erosion / cavitation, waterhammer, creep fatigue, corrosion resistance, indirect ; causes, cleavage type failure, and fatigue cracking. (2) Technical requirements - pipe properties, normal operation, l seismic load levels, and stratified flow, where applicable. l l s \ U) Amendment P 3.6-29 June 15, 1993 I l
l
- ! h h k !b. S ICATitN l
l l Ol 3.6.3.1.1 Design Basis Loads The LBB evaluations are based on design basis loads using the design configuration. Piping analyses of final detailed designs will confirm that LBB criteria is met for each piping system listed above. 3.6.3.1.2 Susceptibility of Failure from Erosion, Erosion / Corrosion, Erosion / Cavitation Systems susceptible to erosion / corrosion pipe wall thinning are those with wet steam, flashing liquids, or liquid flow with high localized velocities. These factors are considered along with water chemistry and usage time to determine susceptibility and appropriate preventative methods. 3.6.3.1.2.1 Erosion / Corrosion Minimization For systems susceptible to erosion / corrosion, the following methods are used to minimize degradation: A. Proper material selection is essential for the prevention of excessive pipe wall thinning. Low alloy steel is significantly more resistant to wall thinning than carbon steel. Stainless steel is essentially immune to erosion / corrosion and is used in the most susceptible areas. B. Additional wall thickness is sometimes specified to accommodate a limited amount of wall thinning without violating code requirements. C. The bulk fluid velocity is limited to prevent excessive erosion of the pipe wall. The following velocity limits are used for carbon steel piping: Recommended Bulk Velocity Limits Service Velocity Steam Piping 150 ft/sec Water (Temperature < 300"F) 10 ft/sec Water (Temperature > 300*F) 10 - 20 ft/sec Recirculation Lines (Infrequent Use) 20 - 25 ft/sec D. Pipe routing is utilized to lower susceptibility to pipe wall thinning. Amendment P 3.6-30 June 15, 1993
CESSAR8!nikm2 l 1 r\ k ) G 3.6.3.1.2.2 Applicability to Piping for LBB l Use of high quality steels, stainless steel or stainless steel liners in the MCL, SL, DVI, and SC piping prevents erosion, erosion / corrosion, and erosion / cavitation. Additionally, water chemistry for the reactor coolant system is closely controlled and monitored. There is no evidence of unusual wall thinning in these pipes due to erosion, erosion / corrosion, or erosion / cavitation in pressurized water reactor plants. Therefore, these pipes have a very low level of susceptibility of failure from these failure mechanisms. Carbon steel is used in MSL piping. There is no evidence of wall thinning due to erosion or erosion / corrosion for MSL piping inside containment, because dry steam and the operating temperature prevents erosion and erosion / corrosion degradation. Therefore, MSL piping inside containment has a very low level of susceptibility of failure from these failure mechanisms. 3.6.3.1.3 Susceptibility of Failure from Water Hammer 3.6.3.1.3.1 Main Coolant Loop (MCL) and Surge Line (SL) (O V
) There is a very low potential for water hammer in the sub-cooled water solid portions of the reactor coolant system since these portions of the reactor coolant system are designed to preclude void formation. Safety valve discharge loads associated with the pressurizer have been specifically identified and included in the component design basis. Therefore, the MCL and SL piping have a very low level of susceptibility of failure from water hammer.
3.6.3.1.3.2 Direct Vessel Injection (DVI) Line NUREG/CR-2781 (Reference 10) identified four water hammer events l involving the safety injection system. Three of the four events were caused by voids due to improper venting while the lines were being refilled. The fourth event was caused by steam bubble collapse in the safety injection accumulator line. The steam bubble formation occurred during leak testing as a result of inadequate testing procedures. Procedures for initial fill and venting ensure that voids will not occur in the System 80+ DVI piping. High point vents provide for proper venting of lines and pumps. The pressure in and the low temperature of the DVI system further ensures that the lines will remain full and steam bubbles will not develop. Valve operations and pump startup and trip will cause negligible water hammer loads, t i b Amendment P 3.6-31 June 15, 1993
CESSAR nai"lCATION l l I O Based on system operating procedures which require venting of DVI lines, and the low number and low severity of events reported for safety injection type systems in PWR's, the susceptibility of water hammer induced failures in the System 80+ DVI system is very low. Thus, the DVI system meets the screening criterion for water hammer. 3.6.3.1.3.3 Shutdown Cooling (SC) Line The SC system piping inside containment is not susceptible to water hammer induced failures based on a system specific review against the water hammer events identified in NUREG/CR-2781 (Reference 10). These lines are only susceptible to a small l number of the generic causes of water hammer - rapid valve opening or closing and steam bubble collapse. There is little potential for water hammer loading due to the first cause because there are no f ast-acting valves in the System 80+ SC system, and it is very unlikely for a steam bubble to form in the line. Under normal power operation, the valves in the line are closed and the fluid in the line is at ambient temperature. Thus, the vapor pressure is low and steam bubble formation will not occur. During shutdown cooling operation, the system is open to the RCS and will have the same vapor pressure as the RCS, which will be subcooled due to the hydrostatic head formed by the water and steam in the pressurizer. Therefore, steam bubble formation is precluded by the characteristics inherent to the system. In addition, there have been no water hammer transients reported for this type of system (Reference 10). l Based on the absence of reported water hammer events and the low severity for the types of events to which the SC system is subject, the SC system meets the screening criterion for water hammer. 3.6.3.1.3.4 Main Steam Line (MSL) NUREG/CR-2781 identifies six water hammer events occurring in the main steam supply system. Of the six events, only one was considered an unanticipated water hammer. This event involved the inadvertent opening of the main steam isolation valves, allowing steam to be admitted into a partially warmed main steam line during heatup. This unanticipated water hammer was attributed to poor operating procedure. Four of the six events were anticipated steam hammers resulting l from valve closure. The valve closures were attributed to i I spurious signals. an excess flow check valve flutter, and one unidentified cause. Amendment P ) 3.6-32 June 15, 1993 l
CESSAR HKi*icari:n V-A sixth event appeared to have been caused by high reaction forces normally resulting from relief valve actuation rather than by water hammer. Steam hammers resulting from valve closures such as the four described in NUREG/CR-2781 are similar to those resulting from anticipated valve closures in the main steam system. None of the events caused damage to MSL piping. The System 80+ main steam supply system (including MSL pipe support system components) is designed to accommodate steam hammer dynamic loads and relief valve discharge loads resulting from rapid closure of system valves and safety / relief valve operation without compromising safety functions. The number of 90-degree elbows and miters is minimized in the MSL piping layout to reduce the effects of steam and water hammer. Valves in the main steam supply system are designed to withstand loads developed from the various operating and design basis events described in Section 3.9.3. Based on the low severity of the water hammer events described in NUREG/CR-2781 and the design considerations of the System 80+ f' main steam supply system, the MSL piping has a very low level of (x_- susceptibility of failure from water hammer. 3.6.3.1.4 Susceptibility of Failure from Creep Fatigue Creep fatigue is a concern for ferritic steel piping at operating temperatures above 700*F and for austenitic stainless steel piping at operating temperatures above 800*F. Operating temperatures of the System 80+ piping systems are below these limits, and therefore not susceptible to creep fatigue failure. 3.6.3.1.5 Susceptibility of Failure from Corrosion Materials used in the MCL, SL, DVI, SC and MSL piping are highly resistant to corrosion. Material selection, fabrication controls, and water chemistry ensure resistance to corrosion. To prevent intergranular stress corrosion attack of the austenitic stainless steel surge line, fabrication and operation controls are implemented. Primary water chemistry is controlled to minimize contaminants, and the dissolved oxygen is at a level that would normally preclude intergranular stress corrosion cracking (IGSCC). I Therefore, through material selection, chemistry control and fabrication control, these pipes have a very low level of f susceptibility of failure from corrosion. l %J l Amendment N l 3.6-33 April 1, 1993
CESSAREna m. O 3.6.3.1.6 Susceptibility of Failure from Indirect Causes Pipe degradation or failure from indirect causes such as fires, missiles and component support failure is prevented by designing, fabricating and inspecting to criteria that ensures low probability of the event or its impact on safety related structures. Therefore, the MCL, SL, DVI, SC and MSL piping have a very low level of susceptibility to failure from indirect causes. 3.6.3.1.7 Cleavage Type Failure Cleavage type failures are generally not a concern for the system operating temperatures and materials used for the MCL, SL, DVI, SC and MSL piping. In add _ tion, material tests (ASME Section III Code required toughness tests and J-R tests) show the materials for these pipelines to be highly ductile and highly resistant to cleavage type failures at operating temperature. 3.6.3.1.8 Susceptibility of Failure from Fatigue Cracking 3.6.3.1.8.1 Class 1 Piping The MCL, SL, DVI, and SC piping are designed to meet the ASME Section III subsection NB fatigue criteria. All design basis transients identified in Section 3.9.1 are included in the detail stress analyses. Therefore, these pipes have a very low susceptibility of failure from fatigue cracking. 3.6.3.1.8.2 Main Steam Line The Safety Class 2 MSL piping is designed to meet ASME Section III Subsection NC fatigue criteria. The design basis transients identified in Section 3.9.1 are reviewed and applicable criteria are included in the detailed stress analysis. Therefore, the MSL piping inside containment has a very low susceptibility of failure from fatigue cracking. 3.6.3.2 Leakace Crack Location A survey of the piping is performed to determine the locations of highest stress loading and coincident poorest material properties. All base metal, weld materials, heat affected zones in the vicinity of the terminal ends, and all intermediate elbow locations are considered. I i O Amendment N I 3.6-34 April 1, 1993 l l
CESSAR En&"l CATION O 3.6.3.3 Leak Detection There are two major aspects to leak rate based on crack detection in addition to the crack opening size; leak detection capability, and flow rate correlation for leakage through a crack. 3.6.3.3.1 Leak Detection System A leak detection system is recommended by Regulatory Guide 1.45, Reference 8, capable of' detecting a leakage rate of 1.0 gpm or less to the primary reactor containment. NUREG-1061, Volume 3, recommends a safety margin of ten on the leak detection system capability. Diverse measurement means are provided for System 80+ for leakage detection, including RCS inventory monitoring, sump level and flow monitoring, and measurement of airborne radioactive particulates and gases (see Section 5.2.5). The RCS primary water inventory balance method is used to detect leakage rates of 1 gpm or less. Leak detection system requirements to support the LBB analysis for main steam line piping are met by a l combination of humidity detectors, air cooler condensate flow monitors, radioactive airborne activity sensors, sump flow and level meters, and the RCS inventory balance instrumentation. [ 3.6.3.3.2 Flow Rate Correlation D The other major aspect of crack detection based on the leak rate, namely the flow rate correlation for leakage through a given crack size, cannot be predicted precisely. Variables such as surface roughness of the side walls of the crack, the nonparallel relationship of the side walls due to the elongated crack shape, and possibly zigzag tearing of the material during crack formation all introduce uncertainties in defining an exact flow rate correlation. The leakage rate required to be detectable is 1.0 gpm or less. The licensing guidelines (NUREG-1061, Volume 3) recommend a factor of 10 on that leakage rate for conservatism unless otherwise justified. The LBB evaluations of System 80+ primary side piping systems listed in Section 3.6.3 are based on a leak detection capability of 1.0 gpm, with a safety margin of 10. The l LBB evaluation of the System 80+ main steam line inside containment is based on a leak detection capability of 1.0 gpm and a safety margin of 10. See Appendix 3.9A for further discussion of flow rate correlation. , i l i Amendment P 3.6-35 June 15, 1993 1
CESSAR nui6ou 9 3.6.3.4 Material Properties For the main coolcnt loop, the hot and cold leg piping material is SA516 Gr70 or SA508 CL1A. All hot- and cold-leg pipe-to-pipe welds and the pipe-to-reactor vessel, steam generator and reactor coolant pump safe end welds are carbon steel. All main loop component nozzles are SA508 CL 1A, 2 or 3 carbon steel or SAS41 CL 1, 2 or 3. The surge line is SA312 Type 347 or Type 316 stainless steel, resulting in bimetallic safe end welds. The shutdown cooling line and the direct vessel safety injection line are Type 304 or 316 stainless steel. The main steam line is l SA516 Gr70 or A516 Gr70. The detailed analysis of cracks in pipe welds requires consideration of the properties of the pipe and the weld materials. Previous work by C-E has shown that a conservative bounding analysis results when the material stress-strain l properties of the base metal (lower yield) and the fracture , properties of the weld (lower toughness) are used for the entire l structure, (Reference 11). This material representation is used l for all analyses. The tensile (stress-strain) curves and the J 3 vs. Aa curves are required for each material type. 3.6.3.5 Leakage Crack Length Determination l It is necessary that hypothesized through-wall cracks open significantly to allow detection by normal leakage monitoring under normal full power loadings. The method for determining the appropriate leakage crack length is described in Section 1.9.6.2 of Appendix 3.9A. 3.6.3.6 Computation of J-Integral Values 3.6.3.6.1 Range of Crack Sizes The range of crack lengths are calculated using a detailed stability analysis of the through-wall cracks in the piping evaluated. The finite-element analysis is performed for the leakage crack size and twice that length. This procedure, therefore, considers the stability of a range of crack lengths for all locations selected for the analysis. 3.6.3.6.2 J-Integral , i l The stability of through-wall cracks is evaluated using the J-integral technique. The J-integral is determined in the finite-element analysis for pressure, normal operation, and maximum design load, which is the largest of the dynamic loads (due to safe shutdown earthquake, thermal stratified flow, rapid Amendment P 3.6-36 June 15, 1993
CESSARnah m r% valve closure, or other) included in the crack stability analysis. The J-integral is determined for two different crack lengths for each geometric model. For the margin on loads evaluation, the J-integral for the leakage crack size is evaluated for 4 x (Pressure +NOP+ Maximum Design) loads. For the margin on crack length evaluation, the J-integral for 2 times the leakage crack size is evaluated for Pressure +NOP+ Maximum Design loads. l 3.6.3.7 Stability Evaluation The stability of the cracked pipes is assessed by comparing the J-integral value due to the applied loads on the pipe to the material crack resistance. The stability criterion for ductile crack extension employed is: if J-applied < J m terial, and l IC applied < material then crack stability is assured. The change in J-integral with crack length "a" is determined by x_) analyzing several crack lengths in the region of interest. For a leakage crack of length "a", crack lengths "a", a-6, and a+6 are analyzed. Similarly, the change in J-integral with crack length in the region of length "2a" is determined by analyzing cracks with lengths 2a, 2a-6, and 2a+6. This method provides the derivative information in the two regions of interest. The variation of J with crack length in the region of "a" and "2a" is plotted along with the material curve. Evaluation of the plots allows for direct verification of the stability criteria. The evaluations are performed for the locations chosen to envelop all limiting cases. The pipes with the leakage crack length subject to loads of 4 x (P+NOP+ Maximum Design Load) and the pipes with crack length twice the leakage crack length with loads of (P+NOP+ Maximum Design Load) are demonstrated to have significant margin between the material curve and the loading curve, indicating that all pipe locations satisfy the LBB crack stability criteria. See Appendix 3.9A, Sections 1.1.9.5.4 and 1.1.9.6 for a discussion of LBB design criteria development and a further discussion of analytical methods. , b ( Amendment P 3.6-37 June 15, 1993
CESSAR En@icarieu 9 3.6.3.8 Results The piping listed in Section 3.6.3 and evaluated by the mathods j described above are shown to meet all the criteria for application of the leak-before-break according to NUREG 1061, Volume 3. Specifically, these criteria require that: A. Cracks which are assumed to grow through the pipe wall leak significantly while remaining stable. The amount of leakage is detectable with a safety margin of at least a factor of 10 unless otherwise justified. l B. Cracks of the length that leak at the rate in A. can withstand normal operation plus maximum design load loads with a safety factor of at least fi. C. Cracks twice as long as those addressed in B. will remain stable when subjected to normal operation plus maximum design load. The COL applicant will confirm that the bases for the LBB acceptance criteria are satisfied by the final as-built design and materials of the piping systems listed in Section 3.6.3. Amendment P 3.6-38 June 15, 1993
CESSAR E!aincuin O PEFERENCES FOR SECTION 3.6
- 1. " Evaluation of Potential for Pipe Breaks," NUREG-1061, Vol. 3.
- 2. ASME Boiler and Pressure Vessel Code, Section III, Nuulear Power Plant Components, Class 1, 2 or 3.
- 3. ASME Code for Pressure Piping, B31, Power Piping, ANSI /ASME B31.1.
- 4. USNRC Branch Technical Position MEB 3-1 Rev. 2 - Postulated Rupture Locations in Fluid System Piping Inside and Outside Containment, attached to Standard Review Plan 3.6.2, June, 1987.
- 5. American National Standard Design Basis for Protection of Light Water Nuclear Power Plants Against the Effects of Postulated Pipe Rupture, ANSI /ANS 58.2-1988.
- 6. R. T. Lahey, Jr. and F. J. Moody, " Pipe Thrust and Jet Loads," The Thermal Hydraulics of a Boilina Water Nuclear Reactor, Section 9.2.3, pp. 375-409, Published by American
'(~~} Nuclear Society, Prepared by the Division of Technical Information United States Energy Research and Development Administration, 1977.
- 7. RELAP 4/ MOD 5, Computer Program User's Manual 098. 026-5.5.
- 8. USNRC Regulatory Guide 1.45 " Reactor Coolant Pressure Boundary Leakage Detection Systems."
- 9. NUREG/CR-1319, " Cold Leg Integrity Evaluation," Battelle Columbus Laboratories.
- 10. NUREG/CR-2781, " Evaluation of Water Hammer Events in Light Water Reactor Plants," July 1982.
- 11. " Analysis of Cracked Pipe Weldments," EPRI NP-5057, February 1987.
- 12. USNRC Regulatory Guide 1.11 (Safety Guide 11), Instrument Lines Penetrating Primary Reactor Containment; including supplement, Backfitting Considerations.
Amendment P 3.6-39 June 15, 1993
POSTULATED BREAK
^ G ,
,-=a=aw s
t RO " CRUSH PIPE .. f;pE PROCESS PIPE " OFFSET __. S , s r' BUILDING O 7 RESTRAINT STRUCTURE
~
'. ; STRUCTURE
- j INITIAL PLASTIC HINGE LOCATION (
. 3 -
3 f i
.i ^
Amendment P J June 15,1993 9 * [ TYPICAL CRUSH PIPE WHIP RESTRAINT CONFIGURATION
CESSAR SEL"icating (Sheet 1 of 1)
,s / \ \m EFFECTIVE PAGE LISTING APPENDIX 3.6A Table of Contents Pace Awendment i P ii P Text Page Amendment 3.6A-1 P 3.6A-2 P Fiqures Amendment
( l'} 3.6A-1 P (N \ \ N ,/ Amendment P June 15, 1993
CESSAR Elaincuia n V APPENDIX 3.6A DISCUSSION OF METHODS FOR ANALYSIS OF PIPE WHIP b) L 1 l 1 l /3 i V i I Amendment P 1 June 15, 1993 l l l l
3 CESSAR EE5nnem:w ~ u TABLE OF CONTENTS APPENDIX 3.6A Section Subiect Pace No. 1.0 ENERGY BALANCE METHOD 3.6A-1 2.0 LUMPED PARAMETER METHQQ 3.6A-2 i i i
'3 /
i
%-)
Amendment P i June 15, 1993
l CESSAR naincur., ) l O' LIST OF FIGURES APPENDIX 3.6A Ficure Bubiect 3.6A-1 Typical Pipe Model for Determining Pipe Whip Restrained Loads O O Amendraent P 11 June 15, 1993
CESSAR naibou l l ('% V )- 1.0 ENERGY BALANCE METHOD The energy balance method is used generally on smaller piping systems. In this method, a computer code is used as an aid to pipe whip analysis, utilizing a simplified approach. The program is specifically designed for the purpose of sizing whip restraint devices and obtaining conservative estimates of dynamic loads applied to restraint support structures (Figure 3.6A-1). The analytical models employed are simple restraint systems with assumed pipe behavior in the event of pipe ruptures, as depicted in Figure 3.6A-1. The basis of the program is a simplified time history dynamic analysis formulation, for the duration of the initial impact phase of a pipe rupture event - i.e. up to the point where the piping system initially stops after impact with the restraints for the configurations shown in Figure 3.6A-1. The assumptions made in developing the analytical models are as follows:
- 1. The piping systems are assumed to consist of rigid pipe C) segments connected by plastic hinges - i.e., elastic pipe deformations are not considered.
- 2. Motion is characterized by the generalized co-ordinates 6 1, 6 2 (Figure 3.6A-1).
- 3. Small displacements.
- 4. In plane motion only (2-D).
~
- 5. Primary plastic hinge location, designated A in Figure 3.6A-1 is assumed or calculated. The capacity of this hinge is neglected for conservatism.
- 6. Secondary hinge formation is restricted to point X as shown in Figure 3.6A-1. The possibility of the formation is to be checked in each time interval of the analysis.
The input parameters consist of:
- 1. process pipe properties
- 2. restraint device type, properties, and locations l
- 3. gaps
- 4. blowdown load Amendment P 3.6A-1 June 15, 1993 l
CESSARMaine- l l
)
O,1 S. primary hinge location (may be assumed or determined considering the dynamic equilibrium of the piping' system subjected to an " instantaneous" blowdown load).
- 6. secondary plastic hinge capacity
- 7. concentrated masses (e.g., valves) and their locations Typical output consists of:
- 1. maximum dynamic loads applied to restraints
- 2. maximum restraint deformations
- 3. static capacities of restraints - data useful for the steady state phase of pipe whip analysis 2.0 LUMPED PARAMETER METHOD The lumped parameter analysis method is used mainly for larger piping systems where large blowdown forces are involved. In this method, a computer code is used to perform a non-linear dynamic time history analysis of the whipping process pipe. The method of solution is based on the use'of the three dimensional finite element stif fness method. The piping is mathematically idealized as a series of flexible structural members connecting discrete nodal points. Piping elements and restraint stiffness characteristics are set up to permit representation of elastic, linear strain hardening and plastic material properties, and gaps between piping and restraints. Input consists basically of the piping configuration description and the specification of rupture blowdown loads. The configuration description includes piping material, section properties, piping geometry, and identification of location and characteristics of restraints. The analysis is performed in increments, and the stiffness characteristics are updated based on calculated response at the end of each increment, until equilibrium is established or failure criteria are exceeded. Results are output at a user specified print interval. Results include internal forces, moments and deflections, identification of plastic hinges in the pipe, restraint status including gap closure, and reacting load. The backup structure or the supporting plant structure is not modelled in this analysis.
O Amendment P 3.6A-2 June 15, 1993
p
\
l 1 l i F M2 A eT R, u M
^,
i n ,
/ nX e2 R1 Amendment P June 15,1993 TYPICAL PIPE MODEL FOR DETERMINING PIPE WHIP. Figure -;
j$ RESTRAINED LOADS - 3.6A 1
CESSAREannc-p 3.7 SEIBMIC DESIGN 3.7.1 SEISMIC INPUT This section discusses the seismic design parameters and methodologies being used for the design of those systems and subsystems important to safety and classified as Seismic Category 1 in Section 3.2. 3.7.1.1 Desicn Response Spectra The System 80+ Standard Design as defined by CESSAR-DC is not based on a specific site. The design response spectra which define the free field design ground motion or control motion specified either at the site soil surface or on a hypothetical rock outcrop are shown in Figure 2.5-5. Generic site conditions were selected to cover a range of possible conditions for the System 80+ sites. More specifically, sets of representative cases from each of four generic site categories were evaluated. Ground surface and foundation level spectra which correspond to the design response spectra of control motions CMS-1,. CMS-2 and CMS-3 for rock and soil cases are shown in CESSAR Section 2.5. p Out of 12 soil cases analyzed in Section 2.5.2, ten are used in (' the soil structure interaction (SSI) analyses. The two cases eliminated in the SSI analysis (B3 and D1) were non-governing cases whose soil response levels were enveloped by other cases. See Section 2.5.2 for details of this analysis phase. Two rock cases were analyzed, one with no backfill (fixed base at bottom of basemat) and one with concrete backfill (fixed base at all subsurface elevations). The effect of differential seismic displacement on the equipment and supports is included in the analysis as described in Section 3.7.3.1. 3.7.1.2 Desion Time History Since the System 80+ Standard Design is designed for generic site conditions, for the time history method of analysis, the generic free-field ground surface time histories are used as control motions in the analyses. In the soil-structure interaction analyses, for each generic site, the corresponding two horizontal and one vertical time histories at the free-field ground surface are used with the SSI model of that site. For the fixed-base analyses, the rock outcrop time histories are directly used as the control time histories.
]
l The response spectra at 2, 5 and 7% damping of control motion l /'_\ CMS 1, and 1, 2, 5 and 7% damping of control motions CMS 2 and CMS 3 ( and the corresponding spectral ordinates of the matching time histories are shown in Figures 3.7-1 to 3.7-12. The Power l Amendment O ' 3.7-1 May 1, 1993
C E S S A R n'nnc = ,. O Spectral Densitie; of all time histories are included in Section 2.5. Each time history that is used in the SSI and rock analyses contains 20.48 seconds. For the SSI analyses, a time step of 0.005 sec is used. For the rock analyses, a time step of 0.0025 sec is used. 3.7.1.3 Critical Dampina Values Damping values used for various nuclear safety-related structures systems and components are based upon Regulatory Guide 1.61 or ASME Code Case N-411-1 (See Figure 3.7-32). These values are l expressed in percent of critical damping and are given in Table 3.7-1. When the response spectra method of analysis is used for piping, damping values are based on Code case N-411-1. 3.7.1.4 Supportina Media for Seismic Catecory.I Structures Category I structures are founded directly on rock or competent soil. The foundation embedment depth for System 80+ standard plant is 52 feet (Reference 7). The rock properties and the layering characteristics, including shear wave velocity, shear modulus, and density, are given in Section 2.5. The System 80+ Standard Plant is designed for the range of soil conditions discussed in Section 2.5 and shown in Appendix 3.7B. 3.7.1.4.1 Soil Structure Interaction (BSI) Two different types of analysis methodologies are used for the seismic analyses. For the fixed-base cases, modal superposition time history analyses are performed using the rock outcrop motions as control motions. When a structure is supported on soil, the SSI is taken into account by coupling the structural model with the soil medium. To accomplish this, the methodology of the computer program SASSI (System for Analysis of Soil Structure Interaction, Reference 6) is used. Detailed methodology and results of the SSI analysis are presented in Appendix 3.7B. 3.7.2 SEISMIC SYSTEM ANALYSIS 3.7.2.1 Seismic Analysis Method 3.7.2.1.1 Seismic Category I Structures, Systems, and Components Other Than NSSS Seismic Category I structures, systems and components are identified in Table 3.2-1. The Nuclear Island (NI) and Nuclear Annex (NA) structures are modeled as stick models for the seismic i analysis. Figures 3.7-13 through 3.7-17 show typical sketches of l Amendment O 3.7-2 May 1, 1993 l I
l CESSAR nuiricarieu l /n\ b ) The translational mass and mass moments of inertia are lumped at the center of mass of each floor. This is done for ease of comparison between the full 3-D FEM and the equivalent 3-D stick model. The mass of each floor includes the mass of concrete walls, concrete slabs, concrete columns, heavy steel platforms, and heavy equipment. For light equipment, secondary structural steel, piping, tanks and miscellaneous mechanical and electrical components, a cumulative uniformly distributed mass is estimated and added to each floor. Figure 3.7-13 shows a schematic of the stick model of the IS for the horizontal analysis. 3.7.2.3.4.1.2 Development of FEM and Stick Models of the Shield Building Since the SB is symmetric about the vertical axis of the RB, the FEM of the SB is developed using an assembly of axisymmetric ! shell elements. Fixed-base modal analyses are performed for the horizontal and vertical directions and, based on these analyses, mass and stiffness properties are selected for the SB stick model. The mass of the SB is lumped at eleven nodal points along the height of the stick. \v) 3.7.2.3.4.1.3 FEM of Steel Containment Vessel I The SCV is modeled with shell elements as shown in Figure 3.7-18. l The bottom nodes, corresponding to elevation +91 ft., are ; connected with rigid links to the stick model of the IS. l l 3.7.2.3.4.1.4 Development of FEM and Stick Models for Fuel Building, CVCS/ Maintenance Area, EFW Areas, Diesel Generator Areas and Control Room Areas The FB, CVCS, DG, EFW and CA stick models are developed following the procedure used in the development of the IS stick model. Each floor of each area is modeled with finite elements representing the main structural load-resisting elements of that floor. Subsequently, based on these models, equivalent stiffness propertiec are computed for each floor which are assigned to an equivalent beam element representing that floor in the stick model of that area. 3.7.2.3.4.1.5 Combined Model of Nuclear Island and Nuclear Annex Structures The combined model of the NI and NA structures is generated by linking the individual stick models of all the areas in the NI p and NA complex. In addition, the dynamic model of the NSSS is coupled to the IS stick model at the appropriate elevations. Because of the in-plane rigidity of the slabs, all sticks are Amendment O 3.7-13 May 1, 1993
CESSAR n'.Hnc-l O connected with rigid links at each major elevation, as shown in Figures 3.7-13 to 3.7-17. The rigid links provide in-plane rigidity only. All NI and NA structures are founded on a common basemat, the dimensions of which are given in Appendix 3.7B. 3.7.2.3.4.2 Model for Vertical Excitation The previous discussion of the models developed for horizontal excitation applies to vertical excitation model development, with minor changes in the case of the IS, FB, EFW, DG,'CVCS and CA models. The only difference between the horizontal and vertical analysis stick models is the eccentricity of the center of mass to the center of rigidity at each major elevation. 3.7.2.3.5 Modeling for Three Component Input Motions As discussed in Section 3.7.2.3.4, two independent models, one in the horizontal and the other in the vertical direction, are used. The horizontal and vertical models are decoupled, since the response in the vertical direction due to horizontal excitation will be negligible and vice versa. In the horizontal analysis of all structures, the seismic model is analyzed along both the plant E-W and N-S directions. 3.7.2.4 Soil Structure Interaction (SSI) The soil model and SSI analysis methodologies are described in Appendix 3.7B. 3.7.2.5 Development of Floor Res_p_onse Spectra The time history method of analysis is used to generate the floor response spectra. The spectra are generated according to the procedure given in Regulatory Guide 1.122. As discussed in Section 3.7.2.3.4, the horizontal and vertical models are decoupled and the floor response in horizontal and vertical directions are obtained by three separate analyses. For horizontal analysis, the response spectra are generated for each floor along the two axes of the structure. In vertical analysis, the response spectra are generated for the walls. l The spectra are generated for appropriate critical damping for SSE. The peaks of the response spectra are broadened as l described in Section 3.7.2.9. O Amendment o 3.7-14 May 1, 1993
CESSAREna mw g ( ) G' where: n = total number of components,
$.3 = composite modal damping for mode j, Sy = critical modal damping associated with component 1,
$. = mode shape vector, 3
{Mf } = subregion of mass matrix associated with component i, and [M] = the mass matrix of the system. For direct integration method, viscous damping proportional to the mass and stiffness matrix is used; thus [C] = a[K] + $[M] where [C] is the damping matrix, [K] is the stiffness matrix and p [M] is the mass matrix. The values of a and # are selected such that the damping in the range of frequency of interest is (V) approximately equal to the damping of the structure. 3.7.3 SEISMIC SUBSYSTEM ANALYSIS 3.7.3.1 Seismic Analysis Methods The seismic analysis of the Seismic Category I structures, subsystems, and components other than piping is performed by either the response spectrum or time history method as described in Section 3.7.2.1.1 or an equivalent static method described in Section 3.7.3.5. For Seismic Category I piping, each piping system is idealized as a mathematical model consisting of lumped masses connected by elastic members. The stiffness matrix for the piping subsystem is determined using the elastic properties of the pipe. This includes the effects of torsional, bending, shear, and axial deformations as well as changes in stiffness due to curved members. Generally, a response spectrum analysis is performed using the envelope of all applicable spectra to account for inertia effects. The effects of rocking and torsion are implicitly included- because the spectra at the support points include motions due to rocking and torsion. The total seismic response of the piping is then calculated by absolute summing the fO results of the response spectrum analysis and a static analysis () which accounts for the relative displacement effects between Amendment P 3.7-19 June 15, 1993
CESSAREnnncu. O support locations. Since the displacement effects are self-limiting, it is justified to place them in the secondary stress category. As an alternative to the modal response method, a time history method of analysis may be used. This method is also used for other types of dynamic analyses such as LOCA and hydraulic transients. Either a direct integration method or a modal superposition method is used to solve the equations of motion. 3.7.3.2 Determination of Number of Earthquake Cycles The procedure used to account for the fatigue effect of cyclic motion associated with seismic excitation recognizes that the actual motion experienced during a seismic event consists of a single maximum or peak motion, and some number of cycles of lesser magnitude. The total or cumulative usage factor can also be specified in terms of a finite number of cycles of the maximum or peak motion. Based on this consideration, Seismic Category I subsystems, components, and equipment are designed for a total of two SSE events with 10 maximum stress cycles per event (20 full cycles of the maximum SSE stress range). Alternatively, an equivalent number of fractional vibratory cycles to that of 20 full SSE vibratory cycles may be used (but with an amplitude not less than one-third (1/3) of the maximum SSE amplitude) when derived in accordance with Appendix D of IEEE Standard 344-1987. 3.7.3.3 Procedure Used for Modeling The modeling techniques incorporate either a single or multidegree of freedom subsystem consisting of discrete masses connected by spring elements. The associated damping coefficients are consistent with Table 3.7-1. The degree of complexity of each model is sufficient to accurately evaluate the dynamic behavior of the component. For additional details on pipe modeling, see the section below. Valves (i.e. , with natural frequencies greater than the frequency corresponding to the zero period acceleration (ZPA)) are included in the piping system model as lumped masses on rigid extended structures. If it is shown by test or analysis that a valve has a frequency less than a frequency corresponding to the ZPA, then a multimass, dyri nic model of the valve, including the appropriate stiffnesses, is developed for use in the piping - system model. O Amendment N 3.7-20 April 1, 1993
CESSAR sannema 7~ (V i spectra used are based upon the acceleration of the reactor vessel flange. If the preliminary linear vertical analysis indicates that the response of the core may be sufficiently large to cause it to lift off the core plate, a vertical nonlinear analysis of the internals is also performed. In these analyses, two horizontal components and the vertical component of the seismic excitation are considered and the maximum responses for the three components are combined by the method of square root of the sum of the squares. Closely spaced modes are considered in accordance with Regulatory Guide 1.92. 3.7.3.14.1.1 Mathematical Models Equivalent multimass mathematical models are developed to represent the reactor internals and core. The mathematical models of the internals are constructed in terms of lumped masses and elastic-beam elements. At appropriate locations within the internals and core, points (nodes) are chosen to lump the weights of the structure. A sketch of the internals and core showing the relative node locations for the horizontal model is presented in p* Figure 3.7-26. The criterion for choosing the number and (d location of mass concentration is to provide for accurate representation of the dynamically significant modes of vibration of each of the internals components. Between the nodes properties are calculated for moments of inertia, cross-section areas, effective shear areas, and lengths. Separate horizontal and vertical models of the internals and core are formulated to more efficiently account for structural differences in these directions. In the horizontal nonlinear lumped mass representation of the internals and core, shown in Figure 3.7-27, gap and spring elements are used to represent contact between the fuel and core shroud. Lumped-mas's nodes in the core are positioned to coincide with fuel-spacer grid locations. To simulate the nonlinear motion of the fuel, nonlinear spring couplings are used to connect corresponding nodes to the fuel assemblies and core shroud. Incorporated into these nonlinear springs is the spacer grid impact stiffness derived from test results. The core is modeled by subdividing it into fuel assembly groupings and choosing stiffness values to adequately I characterize its beam response and contacting under dynamic l loading. i l The horizontal nonlinear reactor core model consisting of one row of 17 individual fuel assemblies is depicted in Figure 3.7-28. l In this model each fuel assembly is represented with mass points l I located at spacer grid locations. To simulate the gaps in the [-) core, nonlinear spring couplings are used to connect V corresponding nodes on adjacent fuel assemblies and core shroud. Amendment P 3.7-29 June 15, 1993 1 1
CESSAR nn% mon O : The impact stiffness and impact damping (coefficient of restitution) parameters for the gap elements are derived from the impact tests which are described in Section 4.2. The spacer grid impact representation used for the analysis is capable of representing two types of fuel assembly impact situations. In the first type, only one side of the spacer grid is loaded. This type of impact occurs when the peripheral fuel assembly hits the core shroud, or when two fuel assemblies strike one another. The second type of impact loading occurs typically when the fuel assemblies pile up on one side of the core. In this case, the spacer grids are subjected to a through-grid compressive loading. The fuel assemblies in the coupled core / internals mudel and the detailed core model are modeled with beam elements to represent the horizontal stiffness between mass points and rotational springs at each end to simulate the end fixity existing at the top and bottom of the core. The valve used for fuel horizontal stiffness and end fixity is based upon a parametric study in which analytic predictions are correlated with fuel assembly static and dynamic test data. Fuel assembly structural damping as a function of vibrational amplitude was derived from fuel assembly forced vibration and pluck tests defined in Section 4.2. The damping values used in the seismic analysis of the reactor internals are in accordance with the values in Table 3.7-1. Figure 3.7-29 shows the idealized linear vertical model. The vertical nonlinear model is shown in Figure 3.7-30. Additional calient details of the internals and core models are discussed in the following paragraphs. A. Hydrodynamic Effects It has been shown both analytically and experimentally (Reference 2) that immersion of a body in a dense-fluid medium lowers its natural frequency and significantly alters its vibratory response as compared to that in air. The effect is more pronounced where the confining boundaries of the fluid are in close proximity to the vibrating body as in the case for the reactor internals. The method of accounting for the effects of a surrounding fluid on a vibrating system has been to ascribe the system additional or " hydrodynamic mass". The hydrodynamic mass of an immersed system is a function of the dimensions of the real mass and the space between the real mass and confining boundary. O Amendment O 3.7-30 May 1, 1993
1 l l 1
, . i 9 .
? -
~
9 . m _ o _ m I - , O m . . . o ~ ~ (s_./h.. s
. s
~.
0 -s
- ~
0 ' d ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 0
~
I 10 ~2 10 ~3 .1D 10 PERIOD, SECONDS SPECTRAL MATCH TO REG 1.60 COMPONENT V l Amendment O May 1,1993 . SYNTHETIC TIME HISTORY V SPECTRA VS Figure _ j$ TARGET. SPECTRA FOR CMS 1 (2,5 AND 7% DAMPlNG) 3.7-3 1
= - .. - .. - ..<
2.0 1.8 1.6 + - en } t y 1.4 _ i a : , e 1.2 _ i j S : 81.0 N h
; 0.8 _
2: b 80 .6 N
~
e ~ I od ; ,r,,-
- J k
O.2
- 0. 0 -
O.1 1 10 100 Frequency - H 1% Damping a .. 1.4 _
.g :
e 1.2 2 --
~ l 81.0 o -
~g ajl L- - -
y 0.8
~
8 0 .6 +-- e , _ t 0.4 - -- 0.2 [ 7-4
~
- 0. 0 --
1ll ' 1 i 0.1 1 TO 100 j Frequency - Hz 2% Damping Amendment P June 15,1993 -
/ SYNTHETHIC TIME HISTORY Hi SPECTRUM VS Figure l
ggg / TARGET SPECTRUM FOR CMS 2 (1 AND 2% DAMPING) 3.7-4
1.0 cn - 80.8 _
.g
- h
.s
- 0. 6 2 -
$' f \k O.2 0.0 O.1 1 10 100 Frequency - Hz 1.0 tn -
80.8 3o : 0.6 ~ ! - -
?
D 1
%^ ; &
0.2 0.0 0.1 1 10 100 Frequency - Hz 7% Damping ^ Amendment P June 15,1993 SYNTHETIC TIME HISTORY H1 SPECTRUM VS Figure
-jyj TARGET SPECTRUM FOR CMS 2 (5 AND 7% DAMPING) 3.7-5
l 2.0 1.8 - -
?1.6 _
1.4 -
--q - -
j 7.2 .. 1.0 - 0.8 -
-+ @ 0.6 _
0.4 -- - l 0.2 l
^
0.0 ' O.1 1 10 100 Frequency - Hz 1% Damping 1.8
?1.6 ---+
c .. 81.4 g _
$I* -
8,e a, w ;
$ 0.8 -
b 8 _ l
+--- L-g 0.6 0.4 - -- +- -
0.2
~
' I 0.0 '
0.1 1 10 100 Frequency Hz 2% Damping Amendment P ^ June 15,1993 SYNTHETIC TIME HISTORY H2 SPECTRUM VS Figure AFE TARGET SPECTUM FOR CMS 2 (1 AND 2% DAMPING) 3.7 6
- , -. =- -. . . . _ . . . _ . -
1 I O _ 1.0 cm - 1 g 0.8 c - ( b l E J , E 2 ' 80.6 a b 4 e Q4 O g 0.2 0.0 0.1 1 10 100 Frequency - Hz 5% Damping cn - g 0.8
'i@ .
0.6 - E _ . - t 1 n
\g ,
0.2 O.0 - 0.1 1 10 100 Frequency - Hz 7% Damping Amendment P June 15,1993 SYNTHETIC TIME HISTORY H2 SPECTRUM VS Figure jyj TARGET SPECTRUM FOR CMS 2 ( 5 AND 7% DAMPING) 3.7-7 .m ye ~- 4, -rq -,,g - - ,e e- m,- ,,f =, e -' '-- ' --a " "
l l I l 1.4 1.2 - en - i 1.0 ; t 8 : ' i;- 0.8 - :
. ;hl o -
[ J -l"[
$ 0.6 5
--) - - .
t l R0.4 - e ;_ L 0.2 0.0 0.1 1 10 100 Frequency - Hz 1% Damping 1.0
.E 5
/
y 0.8 _ 0 ! o - j o ll} J 0.6 i .
\c: - -g<
?" -
~
l[ l L O.4 - - e -
)
k oo 0.1 1 10 100 Frequency - Hz 2% Damping Amendment P June 15,1993 - SYNTHETHIC TIME HISTORY V SPECTRUM VS Figure gg TARGET SPECTRUM FOR CMS 2 (1 AND 2 % DAMPING) 3.7 8
%J - l 0.7 en 0.6 C
. ?
b 0.4 r
- y. -
~
g 0.3 g . S 0.2 0.1 0.0 O.1 1 10 100 Frequency - Hz 5% Damping ' cn 0.6 e
~
80.5 5 -
?0.4 . ,, -' -
N - E O3 02 0.1
- 0. 0 O.1 1 10 100 Frequency - Hz 7% Damping -
p June 15,1993
/ SYNTHETIC TIME HISTORY H1 SPECTRUM VS Figure gj7g / TARGET SPECTRUM FOR CMS 2 (5 AND 7% DAMPING) 3.7 9
i I
' ' ' v. , , , , , , ,
a - m _ 1 cn _ v4
? -
~
f j 1
' (
i h. - N I l!E ~ i3 -
~
I U) " _ h]4 LMW ~ - \ j .
? -
i,
\
\ jvw '
~
.) \ r.._ _ p / Ww_ -
u , - O 2 g , i1 , ,ii., , , , ,,ii, , , , 10 ~2 10 -1 10 0 10 3 PER]OD, SECONDS SPECTRAL MATCH TO CMS 3 C0i1PONENT H1 Amendment P June 15,1993 SYTHETIC TIME HISTORY H1 SPECTRA VS Figure gg TARGET SPECTRA FOR CMS 3 (1,2,5 AND 7 % DAMPlNG) 3,7 10
- ( 'N N._)
N H - h -
' . I -
. , 1 -
~
U C - fi A 43 -
; sun wwnwx :
r 10 -2 10 -3 30 0 30 1 PER]OD, SECONDS SPECTRAL MATCH TO CMS 3 COMPONENT H2 i i i
~
Amendment P June 15,1993 TM I
/ SYNTHETIC TIME HISTORY H2 SPECTRA VS Figure j jfffg / TARGET SPECTRA FOR CMS 3 (1,2,5 AND 7% DAMPING) 3.7-11 i
l l l
)
S _
- o. -
~
N , _ q O . I _ u, a m . _ b t A
~ ~
g h. . l\ . vy 9 v r. , _ v
- _ b '
~
- 'N -
. s g
g: d ' ' ' ' 10 -2 10 'l 10 0 10 1 PER30D, SECONDS SPECTRAL MATCH TO CMS 3 COMP 0 MENT V Amendment P June 15,1993 "i
/ SYNTHETIC TIME HISTORY V SPECTRA VS. Figure ,
g g 7g / TARGET SPECTRA FOR CMS 3 (1,2,5 AND 7% DAMPING) 3.7-12' ) l
-i
- r- o
- - 1
( go -
///////,av / ///; /;-
-( CEA UGS SHROUDS - SUPPORT % BARREL / 6 34 40 5e 6 4 hPRESSURE ~
/, V ES SEL
'I. .
70 .8 8- 90 10 P - 11 ,- - CORE '/ SUPPORT / TUBE BARREL /- ' SHEET " / REGION 12 # 13 % ' FAP la [
- w H H ,','/ " tv/ /' ' H Pw' o 15 f 16
/
45 g ; 17 4WH> 35 o 40 4H%> l7 # 18 y 19
-FUEL -FUEL-20 4WHD 36 # 41 4HWD20 # 21 $ 22 ',
CORE X : SHROUD ' - 47
'/
23 4WHD 37 o 42 4Hhw-0 23 o 24 4 25 : 48-26 4WHD 38 o 43 4H FW-0 26 # 27 e 28- ; 49 Y, 29 4WHD 39 0 44 4HWp29 0 30 y/ 31 IMPACT j/ 33 ELEMENT I i v/////////Av//////////1 e p.s-g 34 i ICSP (SURF ACE) 32 SNUBBERS LLOWER SUPPORT STRUCTURE l l l Amendment i December 21,1990
""^
Ju /$ o""e^a "oaYz"'7^"'T"iSToo"' "
CORE SHROUD (MOTION-PRESCRIBED) k 12 11 1o 9 8 7 6 s 4 3 O O O O O O O O O O 1 1 1 1 1 1 1 1 1 1 183 182 181 1Bof 179[ 178 177[ 176[ 17sf 274[ _ 1 1 l 1 1 1 1 1 1 1 @ naT mI "E noT iaI ic8T ic7T issI issI ic4I 8 l 1 1 1 1 1 1 1 1 1 i isE ic2T ieT icoT is9T is8T is7T iser issT is4T ; 1 I l 1 1 I I 1 1 1 8 1s31 1s2T isiT isoI 449I 248I i4'I i4sI 24sT $44T 7 2 1 1 1 1 1 1 1 1 1 1 E uaT mT i4iT i4oI ia9T ia8T u7T 238T issT ixT 2 l I 1 1 1 1 1 1 1 1 : IMPACT s 1331 122[ 13i[ 130[ 129[ $2B[ 127[ 126[ 12s[ 124[
'NI 1 l 1 1 1 1 1 1 1 !
uaT mT uT uoI "9T u8T ii>I iici iisT ii4T O . a 1 I I 1 1 I 1 1 1 1 naT iuT uir noT >=T ioeT io7T ioeT iosT io4I
/
O 2 o ioaT io2T ioiT iw I 99T 98 97 es esh94T , , E I 1 1 1 1 1 1 1 1 1 93[ 92[ 91[ 90 [ 89 [ 88[ 87[ 86[ 8s[ 84[ E .1 1 1 1 1 1 1 1 1 1 W
; sat 82T BiI 80T nr 78T nT vsT 7sT 74I 3 1 1 1 1 1 1 1 1 1 1
; uT nT 2iT 7oT eT c8T e7T ccI esT c4T i .1 _ 1 1 1 1 1 1 1 1 5 cat cc cit cot s9T set s7T ser ssr s4I
! 1 1 1 1 1 1 1 1 1 I s sat s2T sit sot 49T 48I 47T 4eT <sT 44 .
( l 1 1 1 1 1 1 1 1 43T 42T iT 40T a9T asT 27T aeT asT 24T N IEs? Mea I 1 1 L L 1 1 I L 1 22T 22T aiT aor 29T 28T ur 2eI 2sT 24T 1 1 1 1 1 1 1 1 1 1 23T 22T 2iT 20T i9r iaT 47T icI isT 44T I 1 I 1 1 1 1 I 1 1 uT O uTO sotO 9T O 8T O 7T O sT O sT O 4T O aT O CORE SHROUD (MOTION-PRESCRIBED) I Amendment P 1 June 15,1993 l CORE SEISMIC MODEL Figure jg / ONE ROW OF 17 FUEL ASSEMBLIES 3.7-28
CESSARnaL a nv 3.8 DESIGN OF CATEGORY I STRUCTURES 3.8.1 CONCRETE CONTAINMENT This section is not applicable to the System 80+ Standard Design. For a description of the containment, see Section 3.8.2. For a description of the containment shield building, see Section 3.8.4. 3.8.2 STEEL CONTAINMENT 3.8.2.1 Description of the Containment 3.8.2.1.1 General The containment is a spherical free-standing welded steel structure. The sphere is supported by sandwiching . its lower portion between the building foundation concrete and the interior structure base. There is no structural connection either between the containment and the interior structure, or between the containment and the shield building. The diameter of containment is 200 ft. The plate nominal thickness is 1.75 inches. The anchorage region plate thickness is 2 inches. The containment is shown on the plans and elevations of Figures 1.2-2, 1.2-3, 1.2-5, /t 1.2-6, 1.2-7 and 1.2-9. L The arrangement of the Nuclear Island structures, which includes. containment and defines critical dimensions, flood barriers, and fire barriers, is shown in Figure 3.8-5. The spherical shell plate segments will be shop fabricated and field welded. These plates will be approximately 25 feet long and 13 feet wide and can weigh as much as ten tons each; however, these dimensions will vary depending upon the plate location. Two or more plates may be assembled and field welded on the ground and then erected. A vast majority of penetration assemblies will be shop welded to the vessel plates, while others will be attached to the vessel in the field. Vessel plate will be thickened around the penetration to compensate for the openings. Where there is a cluster of penetrations in the same plate segment, the entire segment may be fabricated out of the thicker plate, tapered to 1.75 inches at the edges. The additional thickness will depend upon the nominal size, thickness and location of the penetration sleeve and shall be in accordance with ASME Boiler and Pressure Vessel Code (ASME Code) requirements (Reference 1). The 2 inch thick portion of the steel containment vessel in the anchorage region will be shop fabricated and welded. The longitude plate welds will be 2 inch welds and will be postweld /O heat treated. The top and bottom edges of these 2 inch plates will be tapered to 1.75 inches. Amendment P 3.8-1 June 15, 1993
CESSAR n!Wicari:n 3.8.2.1.2 Anchorage Region O The containment is assumed to behave as an independent, free-standing structure above elevation 91+9. Below elevation 91+9, the vessel is encased between the base slab of the internal structures and the shield building foundation. In the transition region, a compressible material is provided as shown in Figure 3.8-1 to eliminate excessive bearing loads on the concrete as well as to reduce the secondary stresses in the vessel at this location. No shear connectors are provided between the containment plate and the shield building foundation or base slab of internal structures. The lateral loads due to seismic forces, etc., are transferred to the foundation concrete by friction and bearing. The containment shell is thickened to 2 inches in the anchorage region for corrosion allowance. The vessel plate thickness in the embedded zone is the same as in the free zone. 3.8.2.1.3 Containment Penetraticns 3.8.2.1.3.1 Equi.pment Hatch The equipment hatch is composed of a cylindrical sleeve in the containment shell and a dished head 22 feet in diameter with mating bolted flanges. The flanged joint has double seals with ' an annular space for pressurized leak testing in accordance with 10CFR50, Appendix J. The equipment hatch is designed, and fabricated in accordance with Section III, Subsection NE of the ASME Boiler and Pressure Vessel Code. The equipment hatch is tested and stamped with the containment vessel. Seals are designed to maintain containment integrity for Design Basis Accident conditions, including pressure, temperature, and radiation. Details of a typical equipment hatch are shown in Figure 3.8-1. 3.8.2.1.3.2 Personnel Locks Two personnel locks 10 feet in diameter are provided for each unit. Each lock has double doors with an interlocking system to prevent both doors being opened simultaneously. Remote indication is provided to indicate the position of each door. Double seals are provided on each door with an annular space for pressurized leak testing in accordance with 10CFR50, Appendix J. The personnel locks are welded steel subassemblies designed, fabricated, tested, and stamped in accordance with Section III, Subsection NE of the ASME Code. Seals are designed to maintain containment integrity for Design Basis Accident conditions, including pressure, temperature, and radiation. Details of a typical personnel lock are shown in Figure 3.8-1. Amendment P 3.8-2 June 15, 1993
CESSAR nnincarian I
. 3 .8 .2 .'1.3 .3 Fuel Transfer Penetration 1 i
A ' fuel transfer penetration is provi~ded for transfer.of fuel. between the fuel pool and_the Containment fuel transfer canal. The fuel transfer penetration is provided with a double sealed. ; blind flange in the transfer canal and a gate valve in the-fuel- a pool. An annular space is provided_between the double' seals'on 'l the blind flange for pressurized leak testing in accordance with 10CFR50, Appendix J.. The fuel transfer tube penetration sleeve and flanges are designed, fabricated, tested a n d .' s t a m p e d i n : accordance with Section III, Subsection NE of the ASME Code. . The , fuel transfer penetration is shown in Figure.3.8-2. 3.8.2.1.3.4 Mechanical Penetrations j Mechanical penetrations are treated as fabricated. piping. ] assemblies meeting the requirements of the ASME Code, Section III, Subsection NE, and Subsection NC. The process line and - penetration flued head- making up the pressure- boundary are consistent -with the system piping materials;~ fabrication, inspection, and analysis requirements are as required by the ASME Code, Section III, Subsection NC. All welds on the process pipe are accessible Lfor inspection in accordance with the.ASME. Code, Section XI. High energy- lines and selected engineered ' safety system and-auxiliary lines' require the typical " Hot-Penetration", assembly _ shown on Figure 3.8-2 which~ features an exterior guard. pipe for protection of.other penetrations in the_ building annular' space. - Other lines use the .. typical " Cold Penetration" assembly also shown in Figure 3.8-2_ since a leak into the annular space would not-cause a personnel hazard or damage other penetrations in'the- l immediate area. whanical penetrations are -leak tested in accordance' with
?FR50 Appendix J.
3.8.2.1.3.5 Electrical Penetrations l Medium voltage electrical penetrations for reactor coolant pump power (shown in. Figure 3.8-2) use sealed bushings for conductor-seals. The assemblies incorporate dual seals along the axis of each conductor. Low voltage power, control, and instrumentation cables enter the containment vessel through penetration' assemblies which are designed to provide two leak-tight barriers in series with each conductor. Amendment K 3.8-3 October 30, 1992
CESSAR E!!Wncma All electrical penetrations, including seals, are designed to l maintain containment integrity for Design Basis Accident conditions, including pressure, temperature, and radiation. Double barriers permit testing of each assembly in accordance with 10CFR50 Appendix J to verify that containment integrity is maintained. The electrical penetration assemblies are designed, fabricated, tested, and stamped in accordance with IEEE-317. The pressure boundary portion of the assembly is designed, fabricated, tested and stamped in accordance with Section III, Subsection NE of the ASME Code. 3.8.2.2 Applicable Codes, standards, and specifications The design, materials, fabrication, erection, inspection, testing, and inservice surveillance of the steel containment and penetrations is covered by the following codes, standards, , specifications, and regulations: . Codes Title ASME Boiler and Pressure Vessel Code, Section II, " Material Specifications" ASME Boiler and Pressure Vessel Code, Section III, Division 1, Subsection NE, " Class MC Components" ASME Boiler and Pressure Vessel Code, Section V, " Nondestructive Examination" ASME Boiler and Pressure Vessel Code, Section IX, " Welding and Brazing Qualifications" ASME Boiler and Pressure Vessel Code, Section XI, Rules for Inservice Inspection of Nuclear Power Plant Components, Subsection IWE
" Requirements for Class MC and Metallic Liners of Class CC Components of Light-Water Cooled Power Plants" O
Amendment P 3.8-4 June 15, 1993
CESSAR UL"icari:n -i \
/
Regulatory Guides Title 1.11 Instrument Lines Penetrating Primary Reactor Containment (Safety Guide 11) 1.50 Control of Preheat Temperature for Welding of Low-Alloy Steel 1.54 Quality Assurance Requirements for Protective Coatings Applied to Water Cooled Nuclear Power Plants 1.57 Design Limits and Loading Combinations for Metal Primary Reactor Containment System Components 1.63 Electric Penetration Assemblies in Containment Structures for Nuclear Power Plants 1.84 Design and Fabrication Code Case 7s Acceptability - ASME Section III, Division 1 (s' ) 1.85 Materials Code Case Acceptability
- ASME Section III, Division 1 1.141 Containment Isolation Provisions for Fluid Systems 1.147 Inservice Inspection Code Case Acceptability - ASME Section XI, Division 1 Regulations 10CFR50 Appendix A - General Design Criteria for Nuclear Power Plants 10CFR50 Appendix J - Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors Standards IEEE IEEE-317- Electric Penetration Assemblies in Containment fs Structures for Nuclear Power Generating Stations (N.))
Amendment K 3.8-5 October 30, 1992 ,
CESSARnn hou 3.8.2.3 Loads and Loadino Combinations O The loads and loading combinations for the analysis and design of the containment vessel are in accordance with Subsection NE, Section III, of the ASME Code and Regulatory Guide 1.57 (Reference 13). In addition, the specified loads and loading combinations are in accordance with the NRC Standard Review Plan, Section 3.8.2, II.3 (Reference 12). The loads and loading combinations are summarized in Tables 3.8-1 and 3.8-2. A. Dead Load and Construction Loads The dead load includes the weight of the containment vessel l and all permanent attachments. Construction loads are those loads imposed on the containment vessel only during l construction. A typical construction load is the shoring load induced by the formwork for the containment shield building concrete dome. B. Thermal Loads The containment vessel is subject to thermal loads during normal operation of the unit. The maximum operating temperature can reach 110*F. C. Seismic Loads The containment vessel is loaded by simultaneous seismic events in two orthogonal horizontal directions and the vertical direction. Seismic loads are described in Section 3.7. D. External Pressure A vacuum load can be imposed on the Containment Vessel by an inadvertent actuation of the Containment Spray System during normal unit operation. The design vacuum pressure is 2.0 psig. E. Design Basis Accident The Design Basis Accident Loads are based on the peak pressure and temperature developed inside containment as a result of a rupture in the primary coolant system up to and including a double-ended rupture of the largest pipe (a Loss-of-Coolant-Accident or LOCA) or a main steam line break. The containment vessel design pressure is 53 psig and the design temperature is 290*F. See Chapter 6 for details of the Containment Design Basis Accident. O Amendment P 3.8-6 June 15, 1993
CESSAR HKi?ICATl3N p. (v) F. Combustible Gas Loads The containment vessel is subject to the consequences of I uncontrolled hydrogen-oxygen recombination as specified in i the Code of Federal Regulations, 10 CFR 50.44. G. Localized Loads Penetration loads, piping loads and jet impingement loads are all localized loads applied to the containment vessel. Penetration and piping loads are due to the reactions at penetrations, pipe supports / restraints and other attachments welded to the shell. Jet impingement loads are due to fluid jets caused by the rupture of small diameter piping adjacent to the containment vessel. 3.8.2.4 Desien and Analysis Procedura d A. Design Per ASME Code The containment vessel is designed to satisfy the requirements of Articles NE-3130 and NE-3320 of the ASME Code with regard to pressure loadings. The local areas []) ( v around openings are reinforced as necessary per Article NE-3330. B. Static and Seismic Load Analysis The containment vessel is analyzed to determine all membrane, bending and shear stresses resulting from the specified static and seismic loads. The vessel is idealized as a three dimensional thin shell using the finite element method of analysis. The stresses and deflections produced in the shell under the applied loads are calculated with the ANSYS computer program (Reference 2). The ANSYS mathematical model used to represent the containment vessel is shown in Figure 3.8-3. Seismic stresses and deflections are calculated using the response spectrum method. The frequencies of vibration and corresponding mode shapes are determined using the normal mode method. Modal responses are combined as described in Regulatory Guide 1.92 (Reference 15). The appropriate damping level for the applied response spectra is defined in Regulatory Guide 1.61 (F.eference 14). n (V \ Amendment I 3.8-7 December 21, 1990
CESSAR En=cmon C. Buckling O The containment vessel is evaluated for buckling using a rigorous analysis as described in Article NE-3222 of the ASME Code. This analysis is performed on a three dimensional model with the ANSYS finite element code using a large deflection option. The deflection under load is continuously used to redefine the geometry of the structure, thus producing a revised structure stiffness during iterative load steps. By observing the rate of change in deflection per iteration, an estimate of the stability of the structure is made. An imperfection is modelled in the structure to account for the effect of actual geometric imperfections. The loads are factored and the rigorous analysis is performed to demonstrate the safety factors in Section 3.8.2.5.B. D. Ultimate Capacity The maximum pressure capacity of the containment vessel is evaluated by a linearly elastic analysis. The vessel is modelled with an axisymmetric model which includes local mass effects due to penetrations. The analysis is performed using the ANSYS computer program. E. Combustible Gas Loads The stresses in the containment vessel due to combustible gas loadings are calculated using a static linear elastic analysis. The vessel is represented by an axisymmetric shell finite element model with the ANSYS computer program. This model is the same as the model used for the ultimate capacity evaluation. F. Nonaxisymmetric and Localized Loads There are no nonaxisymmetric loads applied to the steel containment vessel during a Design Basis Accident. Localized loads applied to the containment vessel may be piping support / restraint reactions, reactions from other attachments, jet impingement loads, etc. The ANSYS computer program is used to calculate the local stresses caused by these loads, which are then included in the appropriate loading combination. O' Amendment N ! 3.8-8 April 1, 1993 I
CESSAR ETnc-G. Computer Programs l ANSYS (Reference 2) is a general purpose finite element program capable of both linear and nonlinear analysis. ! Loads may be either static or dynamic -in nature. The program has a large element library useful in modeling a variety of problems. 3.8.2.5 Structural Acceptance Criteria A. Allowable Stress Limits Allowable stresses have been established for each of the loading combinTtions listed in Table 3.8-2. These limits are in compliance with Subsection NE, Section III of the ASME Code and Section 3.8.2, II.5 of the NRC Standard Review Plan. They are summarized in Table 3.8-3. B. Buckling Safety Factors The factors of safety for buckling loads are 3.0 for Level A and B loads, 2.5 for Level C loads and 2.0 for Level D loads. These values are in agreement with the limits set forth in Article NE-3222 of the ASME Code, iO) V C. Ultimate Capacity The failure criteria for.the ultimate capacity analysis is defined as the pressure which when combined with dead weight result in the allowable limits for Level C loadings shown in Table 3.8-3. The containment vessel must satisfy the allowable limits for Level C loadings shown in Table 3.8-3 when subjected to combustible gas loads. D. Structural Analysis Report A structural analysis report will be prepared for the containment. This report will document that the structures meet the requirements specified in Section 3.8 and design changes and identified construction deviations, which could potentially affect the structural capability of the structure, have been incorporated into the structural analysis. The following records will be reviewed, as applicable:
- 1. Construction records stating material properties for (d
f-) concrete, reinforcing steel, and structural steel Amendment P 3.8-9 June 15, 1993
CESSAR HMICATION l i
- 2. As-built structure dimensions and arrangements O
- 3. Design documents for the structure l Deviations from the design are acceptable provided the following acceptance criteria are met:
- 1. An evaluation is performed (depending on the extent of the deviations, the evaluation may range from the documenting of an engineering judgement to performance of a revised analysis and design), and
- 2. The structural design meets the requirements specified in Section 3.8, and
- 3. The seismic floor response spectra of the as-built structure does not exceed the design basis floor response spectra by more than 10%.
The structural analysis report will summarize the results of the reviews, evaluations, and corrective actions, as applicable, and conclude that the as-built structure is in accordance with the desig.a. 3.8.2.6 Materials, Ouality Control, and Special Construction Techniques 3.8.2.6.1 Materials The containment vessel materials are in accordance with Article NE-2000 of Subsection NE, " Class MC Components," of the ASME Boiler and Pressure Vessel Code, Section III, " Nuclear Power Plant Components." The containment plate material is ASME SA537 Class 2. This material is exempt from post-weld heat treatment requirements through thicknesses of 1.75 inches in accordance with Table NE-4622.7(b)-1 of the ASME Boiler and Pressure Vessel Code, Section III. Welds on plate thicknesses which exceed 1.75 inches will be post weld heat treated. Fabrication and erection of the containment vessel are in accordance with Article NE-4000 of Section III of the ASME Code. This includes welding procedures, procedure and operator performance qualifications, post weld heat treatment and tolerances. Nondestructive examination of welds and materials is in accordance with Article NE-5000 of Section III of the ASME Code. O. Amendment P 3.8-10 June 15, 1993
i CESSAR MMicma j I 3.8.2.6.2 Quality Control 1 The general provisions of the overall Quality Assurance program are outlined in Chapter 17. These are supplemented by the special provisions of the ASME Code for quality control as applicable to Class MC Components. The containment vessel is ASME Code stamped. Therefore, the ASME Code requirements for quality control have priority over those outlined in Chapter 17 in case of any conflict. 3.8.2.6.3 Special Construction Techniques The steel containment vessel may be assembled in sections in an area of the construction yard and then lifted and moved into place with a walker crane. This procedure allows the assembly of the containment to begin when the plates forming the lower hemisphere are delivered to the site. In this manner the containment assembly can proceed on a parallel path with the construction of the concrete subsphere region. The following options are two of several techniques that can be employed for placing the concrete for the dish pedestal supporting the containment: ,CN A. The concrete dish except for the top four inches can be (~ ) placed. The containment vessel then would be placed on the support heads and pressure grouted. B. The containment vessel can be placed on the support heads and used as formwork for placing the concrete. With either option care must be taken to prevent the floating of the containment. This is accomplished by filling the containment with water as the grout / concrete is placed. After the lower containment section has been placed, the construction of the interior structure can begin. The assembly of the containment sections will continue in the yard. As the work on the interior structure continues additional sections of the containment can be lifted into place. After the major equipment is placed in the interior structure the top section of the containment vessel can be set. The completed containment will then be used to support the scaffolding for the concrete dome of the shield building. 3.8.2.7 Testing and In-service Surveillance Requirements The containment vessel, personnel airlocks and equipment hatch are inspected and tested in accordance with the ASME Boiler and Pressure Vessel Code, Section III, Subsection NE. Penetrations are pressure tested as required for Subsection NC of the ASME Code. b l Amendment K 3.8-11 October 30, 1992 l l l
CESSAR neiflCATION Periodic leakage rate tests of the containment are conducted in O accordance with 10CFR50, Appendix J to verify leak tightness and integrity. These tests and other in-service inspection requirements are described in Section 6.2. Periodic in-service inspections are conducted in accordance with the ASME Boiler and Pressure Vessel Code, Section XI, Subsection IWE. 3.8.3 CONCRETE AND STRUCTURAL STEEL INTERNAL STRUC'1URES 3.8.3.1 Description of the Internal Structures The internal structure is a group of reinforced concrete structures that enclose the reactor vessel and primary system. The internal structure provides biological shielding for the containment interior. The internal structure concrete base rests inside the lower portion of the containment vessel sphere. A description of various structures that constitute the internal structure is given in the following paragraphs. The details of the internal structure are shown in Figures 1.2-2, 1.2-3, 1.2-6, 1.2-7 and 1.2-9. The arrangement of the Nuclear Island structures, which includes the internal structure and defines critical dimensions, flood barriers, and fire barriers, is shown in Figure 3.8-5. The primary shield wall encloses the reactor vessel and provides protection for the vessel from internal missiles. The primary shield wall provides biological shielding and is designed to withstand the temperatures and pressures following LOCA. In addition, the primary shield wall provides structural support for the reactor vessel. The primary shield wall is a minimum of six feet thick. The secondary shield wall (crane wall) provides supports for the polar crane and protects .the steel containment vessel from internal missiles. In addition to providing biological shielding for the coolant loop and equipment, the crane wall also provides structural support for pipe supports / restraints and platforms at various IcVels. The crane wall is a right cylinder with an inside diameter of 130 feet and a height of 118 feet from its base. The crane wall is a minimum of four feet thick. The refueling cavity, when fil]ca with borated water, f acilitates the fuel handling operation without exceeding the acceptable level of radiation inside the containment. The refueling cavity has the following sub-corpartments: A. Storage area for upper guide structure. B. Storage area for core support barrel. l Amendment P l 3.8-12 June 15, 1993 i
CESSAR naincuia o O C. Refueling canal. The refueling canal, when filled with borated water, forms a pool above the reactor vessel. The reactor vessel flange is permanently sealed to the bottom of the refueling canal to prevent leakage of refueling water into the reactor cavity. The fuel transfer tube connects the refueling canal to the Spent Fuel Pool. The refueling canal is filled with borated water to a depth that limits the radiation at the surface of the water to acceptable levels during the period when a fuel assembly is being transferred to the Spent Fuel Pool. The shield walls that form the refueling cavity are a minimum of six feet thick. The In-containment Refueling Water Storage Tank (IRWST) provides storage of refueling water, a single source of water for the safety injection and containment spray pumps and a heat sink for the Safety Depressurization System. The IRWST is dishlike in shape and utilizes the lower section of the Internal Structure as its outer boundary. The IRWST is provided with a stainless steel liner to prevent leakage. Design of the IRWST considers pressurization as a result of the containment systems Design Basis Accident. A full description of the IRWST is provided in Section 6.3.2. \ The operating floor provides access for operating personnel functions and provides biological shielding. Inside the crane wall, the operating floor is a reinforced concrete slab with a covered hatch that is aligned with hatches in the two lower floors. Outside the crane wall, the operating floor consists of steel grating. There are also reinforced concrete floor slabs at elevation 115+6 and elevation 91+9 that connect the crane wall and the primary shield wall. The support systems for the reactor vessel, steam generators, reactor coolant pumps and primary loop piping are completely described in Section 5.4.14. The locations of the missile shield, hatch covers, and other removable structures are shown in Figu.es 1.2-2, 1.2-3, 1.2-6, 1.2-7 and 1.2-9. The removable slcos and hatch covers are provided with suitable tiedown devices to eliminate any possibility of these items becoming missiles in case of a seismic event or other loading conditions. 3.8.3.2 Applicable Codes, Standards, and Specifications Category I structures are designed in accordance with the codes and criteria listed in Table 3.8-4. Amendment P 3.8-13 June 15, 1993
CESSAR ESMICATION 3.8.3.3 Loads and Loadina Combinations O The loads and loading combinations used for the internal structures are shown in Table 3.8-5. The internal structures are designed for the following loads: A. Dead load B. Equipment operating loads and other live loads C. Pipe reactions D. Seismic (See Section 3.7 for seismic criteria) E. Internal missiles (The internal structure is designed to withstand internal missiles as defined in Section 3.5.) F. Pipe rupture jet impingement G. Differential pressures between the reactor vessel cavity, pressurizer enclosure or In-containment Refueling Water Storage Tank and the remainder of the containment free velume. H. The reactor vessel support corbels are designed for the upward forces resulting from an excessive steam explosion in the reactor cavity. 3.8.3.4 Desian and Analysis Procedures The internal structure is designed for the loads and ' load combinations specified in Section 3.8.3.3. The complete internal structure (and supporting substructure) is modeled with three-dimensional solid, plate or shell and beam finite elements'using ANSYS or another suitable computer code. The forces and moments resulting from the applied static and dynamic loads are used to design the walls, slabs, beams and columns which make up the Internal Structure. The design is performed using either ACI 349 (Reference 3) or ANSI /AISC N690 (Reference 4) as appropriate. 3.8.3.5 Structural Acceptance Criteria l The structural acceptance criteria for the Internal Structures is outlined in Section 3.8.4.5. I I O' Amendment N 3.8-14 April 1, 1993
CESSAR nnificariou o) b 3.8.3.6 Materials, Ouality Control, and Special Construction Techniaues The design addresses the vertical alignment of the Secondary Shield Wall (Crane Wall) with the corresponding structure below the containment and provides special construction tolerances, as necessary, to ensure potential misalignment is appropriately considered. Additional materials, quality control, and special construction techniques for the concrete internal structures are outlined in Section 3.8.4.6. 3.8.3.7 Testina and In-service Surveillance Re_quirements Testing and in-service surveillance requirements are outlined in Section 3.8.4.7. 3.8.4 OTHER CATEGORY I STRUCTURES 3.8.4.1 Description of the Structures 3.8.4.1.1 Reactor Building The reactor building is composed of the containment shield building, steel containment vessel including the internal ( structures, and subsphere. The steel containment vessel is described in Section 3.8.2. The internal structures are described in Section 3.8.3. Details of the reactor building are shown in Figures 1.2-2 through 1.2-10. The arrangement of the Nuclear Island structures, which includes the reactor building and defines critical dimensions, flood barriers, and fire barriers, is shown in Figure 3.8-5. The containment shield building is a reinforced concrete structure composed of a right cylinder witn a hemispherical dome. The containment shield building shares a common foundation base mat with the nuclear system annex. The containment shield building houses the steel containment vessel and safety-related equipment located in the subsphere, and is designed to provide biological shielding as well as external missile protection for the steel containment shell and safety-related equipment. The containment shield building has an inner radius of 105 feet, a cylinder thickness of 4 feet up to elevation 146+0. Above elevation 146+0 the shield building thickness is 3 feet including l the dome area. The height of the containment shield building is approximately 215 feet. The structural outline of the containment shield building is shown in Figures 1.2-2 and 1.2-3. g An annular space is provided between the containment vessel and ( containment shield building above elevation 91+9 for structural \ Amendment P 3.8-15 June 15, 1993
CESSAR naincmon separation and access to penetrations for testing and inspection. 9 The shield building and the nuclear annex are connected to form a monolithic structure. The subsphere is that portion of the reactor building which is below elevation 91+9 and external to the containment vessel. The subsphere houses auxiliary safety-related equipment. This area below the spherical containment allows efficient use of space for locating safety equipment adjacent to the containment vessel and eliminating excessive piping while allowing maximum access to the containment for locating penetrations. 3.8.4.1.2 Nuclear System Annex The Nuclear System Annex is composed of the control complex, diesel generator areas, main steam valve house areas, CVCS and maintenance areas and spent fuel storage area. The nuclear system annex is a reinforced concrete structure composed of rectangular walls, columns, beams, and floor slabs. The nuclear system annex shares common walls and foundation basemat with and is monolithically connected to the containment shield building. In addition to the structural components, there are components designed to provide biological shielding and protection against tornado and turbine missiles. Structural components, as well as members serving as shielding components, vary in thickness from approximately one foot to five feet. Details of the nuclear system annex are shown in Figures 1.2-2 through 1.2-10. The arrangement of the Nuclear Island structures, which includes the nuclear systems annex and defines critical dimensions, flood barriers, and fire barriers, is shown in Figure 3.8-5. 3.8.4.1.3 Station Service Water System Structure The station service water structure is a concrete structure which is separately located from the Nuclear Island. The location is site specific. The structure contains safety-related equipment. 3.8.4.2 Applicable Codes, Standards, and Specifications Category I structures are designed in accordance with the codes and criteria shown in Table 3.8-4. O Amendment P 3.8-16 June 15, 1993 i
CESSARERMema n l ) (s s/ 3.8.4.3 Loads and Loadina combi. nations The Category I structures are designed to maintain their function for the following loadings: A. Dead Loads The dead loads include all sustained loads during and after construction. B. Operating Loads Operating loads are those live loads or other variable loads l associated with the operation of the plant. C. Design Basis Accident Loads The Design Basis Accident Loads are those associated with the pressure increase in the annulus due to a temperature rise as a result of the energy release inside the containment vessel during a loss-of-coolant accident. D. Wind Loads O) ( '" The wind load is based upon ANSI /ASME 7-88 (Reference 5) and ASCE Papers 3269 and 4933 (References 6 and 7) as defined in Section 3.3.1.- The normal and tornado wind loads considered in the design of the containment shield building are nonaxisymmetric loads. The wind loads are analyzed by approximating the wind distribution on the containment shield building as defined in ASCE Paper 4933 by a Fourier Series. The wind distribution curves used in the design are given in Section 3.3.1. Individual harmonics are analyzed and combined to produce the force and moment resultants for the total series. The wind loads on the Category I structures other than the shield building are analyzed using the methods defined in ASCE Paper 3269. E. Tornado Loadings I The tornado loadings are described in Section 3.3.2. V) ( Amendment P 3.8-17 June 15, 1993
CESSARE5ac-F. Snow and Ice Loads O The containment shield building and the nuclear system annex are designed for a snow and ice load of 50 pounds per square foot. C. Soil and Water Pressure The containment shield building and the nuclear system annex are designed for the earth pressure and groundwater pressure defined in Section 2.4. H. Seismic Loads See Section 3.7, " Seismic Design," for the seismic loadings. Loading combinations used for the design of category I structures are shown in Table 3.8-5. I. Pressure and Temperature Loads The reactor building and nuclear annex are designed for global effects of pressure and temperature as a result of postulated pipe ruptures. 3.8.4.4 Desian and Analysis Procedures The containment shield building is designed for the static and dynamic loads listed in Section 3.8.4.3. The shield building is modeled as a three dimensional finite element structure with ANSYS or another suitable computer program. The forces and moments determined by the analysis of the applied loads and loading combinations are used for the design of the structure in' accordance with ACI 349. The reactor building (including the steel containment vessel, internal structure and containment shield building) is designed to prevent possible overturning, sliding and flotation. The forces and moments acting on the building which could cause these events are determined for the different loads and load combinations and are then compared to the corresponding forces and moments which resist overturning, sliding or flotation. Safety factors for the possible events are determined for comparison with the allowable safety factors listed in Table 3.8-5. The nuclear system annex is modeled with beam and plate finite elements. It is analyzed for the loads and load combinations O Amendment N 3.8-18 April 1, 1993 I
CESSARni h on O QJ found in Section 3.8.4.3. The forces and moments calculated in the analysis are used to design the walls, slabs, beams and columns using either ACI 349 or ANSI /AISC N690 as required. 3.8.4.5 Structural Acceptance Criteria Analysis and design of the concrete internal structures, the shield building, sub-structures, the nuclear system annex and foundations use the ultimate strength design method in accordance with ACI 349. Category I structural steel analysis and design are in accordance with ANSI /AISC N690. The concrete support for the spherical containment vessel is also analyzed and designed per ACI 349. (Since the support has no pressure retaining function, it is not designed in accordance with the ASME Code.) No increase in allowable stresses under service load conditions due to normal or severe load combinations is permitted due to seismic or wind loadings (per the NRC Standard Review Plan, Section 3.8.4, Part II.5). Three orthogonal components of earthquake loads (2 horizontal and 1 vertical) are considered simultaneously. A minimum additional eccentricity of 5% of the maximum building dimension at the level under consideration is assumed to account for accidental torsion (per the NRC Standard Review Plan Section 3.7.2, Part II.11). In addition to satisfying the load combinations for structural adequacy against the design loadings, the load combinations to ensure safety factors against overturning, sliding, and flotation are checked to ensure overall stability. The following events are checked as a minimum: A. The reactor building / nuclear system annex overturning about the too of the foundation supported on soil. B. The reactor building / nuclear system annex foundation sliding on soil. C. Floating of the entire reactor building / nuclear system annex foundation base mat. D. The containment vessel slipping in the lower concrete support dish. Amendment P 3.8-19 June 15, 1993
CESSAR Ennncmow E. The containment vessel overturning about the edge of the O lower concrete support dish. F. The interior structure concrete slipping inside the containment vessel. The safety factors which must be satisfied during any of these events are shown in Table 3.8-5. A structural analysis report will be prepared for Seismic Category I structures. This report will document that the structures meet the requirements specified in Section 3.8 and design changes and identified construction deviations, which could potentially affect the structural capability of the structure, have been incorporated into the structural analysis. The following records will be reviewed, as applicable:
- 1. Construction records stating material properties for concrete, reinforcing steel, and structural steel
- 2. As-built structure dimensions and arrangements
- 3. Design documents for the structure Deviations from the design are acceptable provided the following acceptance criteria are met:
- 1. An evaluation is performed (depending on the extent of the deviations, the evaluation may range from the documenting of an engineering judgement to performance of a revised analysis and design), and
- 2. The structural design meets the requirements specified in Section 3.8, and
- 3. The seismic floor response spectra of the as-built structure does not exceed the design basis floor response spectra by more than 10%.
The structural analysis report will summarize the results of the reviews, evaluations, and corrective actions, as applicable, and conclude that the as-built structure is in accordance with the design. 3.8.4.6 Material, Ouality control, and Special Construction T_ochniques The Category I structures are poured-in-place reinforced concrete structures. The major materials that will be used in the Amendment P 3.8-20 June 15, 1993
CESSAR nn??lCATl3N
\
m G) l construction are concrete, reinforcing bars and structural steel. j A brief description of these materials is given below. )
-4 3.8.4.6.1 Material 1 3.8.4.6.1.1 Concrete The basic ingredients of concrete are cement, fine aggregates, coarse aggregates, and mixing water. Admixtures will be used if needed.
Cement will be Type I or Type II conforming to " Standard l Specification for Portland Cement," ASTM C150. For special circumstances, other approved cements will be used. Aggregates will conform to " Standard Specification for Concrete Aggregate," ASTM C33. Water used in mixing concrete will be clean and free from injurious amounts of oils, acids, alkalis, salts, organic materials or other substances that may be deleterious to concrete or steel. A comparison of the proposed mixing water properties will be made with distilled water by performing the following CN tests:
~
A. Soundness, in accordance with " Standard Test Method for Autoclave Expansion of Porbland Cement," ASTM C151. The results obtained for the proposed mixing water will not exceed those obtained for distilled water by more than ten percent. B. Time of setting, in accordance with " Standard Test Method for Time of Setting of Hydraulic Cement by Vicat Needle," ASTM C191. The results obtained for the proposed mixing water will be within ten minutes for initial setting time and one hour for final setting time of those obtained.for distilled water. C. Compressive strength, in accordance with " Standard Test Method for Compressive Strength of Hydr aulic Coment Mortars (using 2 in, cube specimens)," ASTM C109. The results obtained for the proposed mixing water will not be lower by more than five percent of those obtained for distilled water. The water used to make ice for concrete pours in hot weather will i conform to the requirements for mixing water described above. p Admixtures, if used and as determined by detailed mix design, t 1 will conform with the applicable ASTM standard: O . Amendment P 3.8-21 June 15, 1993
CESSAR EL%"icarian A. Air-entraining admixtures. " Standard Specification for O Air-Entraining Admixtures for Concrete," ASTM C260. B. Water reducing, retarding, and accelerating admixtures.
" Standard Specification for Chemical Admixtures for Concrete," ASTM C494.
C. Pozzolanic admixtures. " Standard Specification for Fly Ash and~ Raw or Calcinea Natural Pozzolan for use as a Mineral Admixture in Portland Cement Concrete," ASTM C618. D. Slag cement. " Standard Specification for Blended Hydraulic Cements," ASTM C595. E. Plasticizing admixtures. " Standard Specification for Chemical Admixtures for Use in Producing Flowing Concrete," ASTM C1017. The combined chloride content of the admixtures and mixing water will not exceed 250 ppm. The ingredient materials will be stored in accordance with the detailed recommendations presented in ACI 304 (Reference 10). Concrete mixes will be designed in accordance with ACI 301 (Reference 9). The batching, mixing and transporting of concrete will conform to ACI 301. The placement of concrete, consisting of preparation before placing, conveying, depositing, protection and bonding will be in accordance with ACI 301. 3.8.4.6.1.2 Reinforcing Steel Reinforcing steel will consist of deformed reinforcing bars conforming to " Standard Specification for Deformed and Plain Billet - Steel Bars for Concrete Reinforcement," ASTM A615, Grade 60 or " Specifications for Low-alloy Steel Deformed Bars for Concrete Reinforcing," ASTM A706, Grade 60. The fabrication of reinforcing bars, including fabrication tolerances, will be in accordance with CRST " Manual of Standard Practice" MSP-1. The placing of reinforcing bars, including spacing of bars, concrete protection of reinforcement, splicing of bars and field tolerances will be in accordance with ACI 349. 3.8.4.6.?. 3 Structural Steel The structural steel will essentially consist of low carbon steel shapes, plates and bars conforming to " Standard Specification for Structural Steel," ASTM A36. Other structural steels listed in ANSI /AISC N690 may also be used. O Amendment N l 3.8-22 April 1, 1993 I
CESSAR EnG"lCATION l 7s l \ :
] l Fabrication and erection of structural steel will be in accordance with the requirements of ANSI /AISC N690. The j structural connections will be either welded or bolted. Welding ;
will normally be by electric-arc welding process using electrodes I conforming to the requirements of ANSI /AISC N690. All welding will be performed by qualified welders using welding procedures that have been qualified in accordance with the American Welding Society (AWS) Structural Welding Code with latest revisions. Non-destructive examination, if required, will be indicated on-the drawings by the Engineer by specifying the type and the Code requirements of the examination to be conducted. All bolted connections will be made with high strength bolts conforming to one of the following specifications: A. " Specification for High-Strength Bolts for Structural Steel Joints," ASTM A325. B. " Specification for Heat-Treated Steel Structural Bolts, 150 KSI Tensile Strength," ASTM A490. , Other bolts listed in ANSI /AISC N690 may also be used. 3.8.4.6.2 Quality Control (f ]\ The quality of materials will be controlled by requiring the suppliers to furnish appropriate mill test reports as required under relevant ASTM Specifications as described in Subsection 3.8.4.6.1. These mill test reports will be reviewed and approved in accordance with the general provisions of the overall Quality Assurance Program outlined in Chapter 17 and supplemented by the special provisions of the appropriate codes and specifications for design listed in Table 3.8-4. Erection tolerances, in general, will be in accordance with the referenced design code. Where special tolerances that influence the erection of equipment, etc., are required, they will be indicated on the drawings by the Engineer. 3.8.4.6.3 Special Construction Techniques No unique or untried construction techniques are contemplated. i Both the cylindrical and the dome portions of the shield building ! will be constructed using standard construction techniques. l l 3.8.4.7 Testine and In-service surveillance Reguirements There will be no testing or in-service surveillance beyond those ) quality control tests performed during construction, which will j be in accordance with ACI 349, ACI 301, ANSI /AISC N690 or ANSI i
- ) N45.2.5 (Reference 8) as applicable.
'%.l Amendment N 3.8-23 April 1, 1993
CESSAR 8laincmou 3.8.5 FOUNDATIONS O 3.8.5.1 Description of the Foundations The foundations of the Category I structures are thick reinforced concrete mats. The foundation of the reactor building / nuclear system annex complex is approximately 10 feet thick, has a flat bottom and rests on soil or rock. The foundations of other Category I structures are also reinforced concrete mats on soil or rock. The COL applicant will submit the site-specific foundation mat construction procedures in accordance with SRP 3.8.5. 3.8.5.2 Applicable Codes, Standards, and Specifications Reinforced concrete foundations and supports of Category I structures are designed in accordance with ACI 349. 3.8.5.3 Loads and Loadino Combinations The design loads and loading combinations are described in Section 3.8.4.3. 3.8.5.4 Design and Analysis Procedures The reinforced concrete foundations of Category I structures are analyzed and designed for the reactions due to static, seismic and all other significant loads at the base of the superstructures supported by the foundation. The foundation mat is modeled as a three dimensional finite element structure with A!15YS or another suitable computer code on an elastic foundation. The forces and moments determined in the analysis are input to the structural design using ACI 349. The analysis and design of the foundations considers the effects of varying soil properties beneath a specific foundation and the effects of construction sequence, with particular emphasis on differential settlements of the basemat. A settlement monitoring program is required for all Seismic Category I structures. Settlement monuments are provided at appropriate locations to track total and differential settlements. Monitoring is begun as each monument is installed. Actual vs. predicted settlements is tracked and evaluated for each Seismic Category I structure. 3.8.5.5 _S_tructural Acce.ptance Criteria These are outlined in Section 3.8.4.5. Amendment P 3.8-24 June 15, 1993
CESSAR Einineni:n 73 LJ 3.8.5.6 Material, Ouality Control, and Special Construction Techniaues These are outlined in Section 3.8.4.6. 3.8.5.7 Testina and In-service Surveillance Requirements These are outlined in Section 3.8.4.7. O h ( 5 ss / Amendment I 3.8-25 December 21, 1990
CESSAR EL"lCATl!N B_EFERENCES FOR SECTION 3.8 O
- 1. ASME Boiler and Pressure Vessel Code.
- 2. Gabriel J. DeSalvo and John A. Swanson, ANSYS Engineering bnalysis System User's Manual, Swanson Analysis Systems, Inc.
- 3. ACI 349, " Code Requirements for Nuclear Safety Related Concrete Structures".
- 4. ANSI /AISC N690, " Nuclear Facilities -- Steel Safety-Related Structures for Design Fabrication and Erection".
- 5. " Minimum Design Loads for Buildings and Other Structures,"
ANSI /ASCE 7.
- 6. " Wind Forces on Structures," ASCE Paper No. 3269, Transact _ ions, ASCE, Vol. 126, Part II, 1961, p. 1124.
- 7. " Wind Loads on Dome-Cylinder and Dome-Cone Shapes", ASCE Paper No. 4933, Journal of the Structural Division, ASCE, Vol. 92, No. ST5, October 1966, p.79.
- 8. " Supplementary Quality Assurance Requirements fer Installation, Inspection, and Testing of Structural Concrete, Structural Steel, Soils and Foundations During the Construction Phase of Nuclear Power Plants," ANSI N45.2.5.
- 9. ACI 301, " Specifications for Structural Concrete for Buildings".
- 10. ACI 304, " Recommended Practice for Measuring, Mixing, Transporting and Placing Concrete".
- 11. NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants".
- 12. Regulatory Guide 1.57, " Design Limits and Loading Combinations for Metal Primary Reactor Containment System Components".
- 13. Regulatory Guide 1. 61, " Damping Valves for Seismic Design of Nuclear Power Plants".
- 14. Regulatory Guide 1.92, " Combining Modal Responses and Spatial Components in Seismic Response Analysis".
- 15. Code of Federal Regulations, Title 10, Part 50.
- 16. Regulatory Guide 1.84, Design and Fabrication Code Case Acceptability ASME Section III Division 1.
Amendment N 3.8-26 April 1, 1993
CESSAR EL"lCATIIN
,\
\
' _/ 's TABLE 3.8-4 CODES AND SPECIFICATIONS FOR DESIGN OF CATEGORY I STRUCTURES Structural component Desian Codes and SAecifications Concrete ACI 349 Concrete Reinforcement ASTM A615 or A706 Structural Steel and ANSI /AISC N690
. Plates j Containment vessel Shell Subsection NE, Section III of the ASME Code fm l
%J l l Amendment P June 15, 1993 1
CESSAR Eini"lCATI N ; N TABLE 3.8-5 (Sheet 1 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES INDEX I. Load Definitions
- 1. Normal Loads
- 2. Severe Environmental Loads
- 3. Extreme Environmental Loads
- 4. Abnormal Loads
- 5. Other Definitions II. Load Combinations and Acceptance Criteria for Category I Concrete Structures
- 1. Service Load Conditions
- 2. Factored Load Conditions ps III. Load Combinations and Acceptance Criteria for Category I Steel Structures
\' l. Service Load Conditions
- a. Elastic Design
- b. Plastic Design '
- 2. Factored Load Conditions
- a. Elastic Design
- b. Plastic Design IV. Load Combinations and Acceptance Criteria for Category I Foundations l
l l l f% Amendment I December 21, 1990 l
CESSAR EnL"icari:n TABLE 3.8-5 (Cont'd) O (Sheet 2 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES
- 1. Load Definitions All the major loads to be encountered and/or to be postulated in a Category I structure are grouped into four categories described below.
All the loads listed, however, are not necessarily applicable to all the structures and their elements in the plant. Loads and the applicable load combinations for which each structure is designed will depend on the conditions to which that particular structure could be subjected.
- 1. Normal Loads Normal loads are those loads to be encountered during normal plant operation and shutdown. They include the following:
0 --- Dead loads or their related internal moments and forces, including any permanent equipment loads and hydrostatic loads L --- Live loads or their related internal moments and forces, including any movable equipment loads and other loads which vary with intensity and occurrence, such as soil pressure F --- Lateral and Vertical forces associated with hydrostatic loadings, either internal or external F' --- Buoyant force of probable maximum flood H --- Lateral loads produced by static or dynamic earth pressures T, --- Thermal effects and loads during normal operating or shutdown conditions, based on the most critical transient or steady state condition R, --- Pipe reactions during normal operating or shutdown conditions, based on the most critical transient or steady state condition
- 2. Severe Environmental loads Severe environmental loads are those loads that could infrequently be encour.tered during the plant life. Included in this category are:
W --- Loads generated by the design wind specified for the plant Amendment P l June 15, 193
CESSAR E!Mi"icui:n j TABLE 3.8-5 (Cont'd) (Sheet 3 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES
- 3. Extreme Environmental Loads Extreme environmental loads are those which are credible but are highly improbable. They include:
E' --- Loads generated by the Safe Shutdown Earthquake. The loads consist of three directional loads, E' (N-S direction), E'y (E-W direction), E', (ve,rtical direction). The earthquake loads are combined to obtain the maximum stress results by one of the following combinations as appropriate: (i) E ' = ( E ' ,2 + E ' y2+ E ' ,2) 1/2 (ii) E ' = E ', + 0. 4 ( E ' y + E',) (iii) E' - E'y + 0.4 (E', + E'y) (iv) E ' - E ', + 0. 4 (E ', + E ' y) W t L ads generated by the Design Basis Tornado specified for the plant. They include loads due to the tornado wind pressure (W,), loads due to the tornado-created differential pressures (W p), and loads due to the tornado-generated missiles (W,) p is determined in a conservative The combined manner for eacheffect of W,, W particular , struc and W, ture or portion thereof, as applicable, by using one or more of the following combinations as appropriate: (i) W, = W, (ii) W, = Wp (iii) W, = W, (iv) W, = W, + 0. 5 Wp i (v) W, = W, + W, /) (vi) W, = W, + 0. 5 Wp + W, NJ Amendment N April 1, 1993 { j
CESSAR MMICATl!N TABLE 3.8-5 (Cont'd) O (Sheet 4 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES
- 4. Abnormal loads Abnormal loads are those loads generated by a postulated high energy pipe break accident within a building and/or compartment thereof.
Included in this category are the following: P, --- Pressure equivalent static load withir. or across a compartment and/or building, generated by the postulated break, and including an appropriate dynamic load factor to account for the dynamic nature of the load T, --- Thermal loads under thermal conditions generated by the postulated break and including T, R, --- Pipe reactions under thermal conditions generated by the postulated break and including R, Y, --- Equivalent static load on the structure generated by the reaction of the broken high-energy pipe during the postulated break, and including an appropriate dynamic load factor to account for the dynamic nature of the load Y; -- Jet impingement equivalent static load on a structure generated by the postulated break, and including an appropriate dynamic load factor to account for the dynamic nature of the load Y, --- Missile impact equivalent static load on a structure generated by or during the postulated break, such as pipe whipping, and including an appropriate dynamic load factor to account for the dynamic nature of the load In determining.an appropriate equivalent static load for Yr, Yj, and Ym, elastic-plastic behavior may be assumed with appropriate ductility ratios as long as excessive deflections will not result in loss of function of any safety related system.
- 5. Other Definitions S --- For structural steel, S is the required section strength based on the elastic design methods and the allowable stresses defined in ANSI /AISC N690 0
. Amendment N April 1, 1993
CESSAR EHL"lCATION ! )
%J TABLE 3.8-5 (Cont'd)
(Sheet 5 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES U --- For concrete structures, U is the section strength required to resist design loads based on the ultimate strength design method described in ACI 349-85 Y --- For structural steel, Y is the section strength required to resist design loads based on plastic design methods described in ANSI /AISC N690-1984 II. Load Combinations and Acceptance Criteria for Cateaory I Concrete Structures , The following set of load combinations and allowable design limits is used for all Category I concrete structures:
- 1. Service load Conditions
^ Service Load Conditions, represent Normal, Severe Environmental and Normal / Severe Environmental loads.
The Ultimate Strength Design method is used with the following load combinations:
- 1) U - 1.4D + 1.4F + 1.7L + 1.7H + 1.7R,
- 2) U - 1. 4 D + 1. 4 F + 1. 7 L + 1. 7H + 1. 7 R, + 1. 7W If thermal stresses due to T are present, the coefficients for each load category may be multip, lied by 0.75 to satisfy the following combination:
- 3) U - (0.75) (1.4D + 1.4F + 1.7L + 1.7H + 1.7T + 1.7R + 1.7W) or V = 1.050 + 1.05F + 1.3L + 1.3H + 1.3T, + 1.3R, + 1.3W In addition, the following combination is considered:
- 4) U = 1.2D+1.7W Individual contributory loads under each category must be evaluated for the cases of it being at its full value or of it being absent (i.e., wind loads in equation 1 & 2). Any load that acts to reduce the critical load combination will be taken as zero unless it can be v
Amendment P June 15, 1993
i CESSAR n!Mcuia l TABLE 3.8-5 (Cont'd) O (Sheet 6 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES shown that the counteracting load must be present. The coefficient for these counteracting loads will be taken as 0.9. The following illustrates the potential impact to equation 1 for counteracting loads;
- 5) U = 0.90 + 0.0F + 1.7L + 0.0H + .9R,
- 2. Factored load Conditions Factor Load Conditions represent Extreme Environmental, Abnormal, Abnormal / Severe Environmental and Abnormal / Extreme Environmental loads. The Ultimate Strength Design method is used with the following load combinations:
- 1) U = D + L + F + H + T, + R, + E '
- 2) U - D + L + F + H + T, + R, + W,
- 3) U = D + L + F + H + T, + R, + 1. 5 P,
- 4) U = D + L + F + H + T, + R, + 1. 0 P, + 1. 0 ( Y, + Y; + Y,) + 1. 0 E '
In factored load combinations (3) and (4), the maximum values of P,, T , R,, Y;, Y , and Y,, including an appropriate dynamic load factor, are used unless a time-history analysis is performed to justify otherwise. Factored load combinations (2) and (4) are satisfied first without the tornado missile load in (2), and without Y,, Y;, and Y, in (4). When considering these loads, however, local section strength capacities may be exceeded under the effect of these concentrated loads, provided there will be no loss of function of any safety related system. Except for dead loads, all load categories shall be evaluated for load components at both full value and completely absent. Where any load reduces the effects of other loads, the corresponding coefficient for that load should be taken as 0.9 if it can be demonstrated that the load is always present or occurs simultaneously with other loads. Otherwise the coefficient for the load should be taken as zero. Where the structural effects of differential settlement, creep, or shrinkage may be significant, they should be included with the dead load, D, as applicable. Amendment P June 15, 1993
CESSAR n%"lCATION 1
"\
(O TABLE 3.8-5 (Cont'd) ) l (Sheet 7 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES III. Load Combinations and Acceptance Criteria for Cateaory 1 Steel Structures The following set of load combinations and allowable design limits is used for all Category I steel structures:
- 1. Service load Conditions Either the elastic working stress design methods or the plastic design methods of ANSI /AISC N690 may be used.
- a. If the elastic working stress design methods are used:
- 1) S=D+L+F+H+R,
- 2) S = D + L + F + H + R, + W
(~} If thermal stresses due to T, and R, are present, the following (y combinations are also satisfied:
- 3) 1. 5 S = 0 + L + F + H + T, + R,
- 4) 1. 5 S - D + L + F + H + T, + R, + W Both cases of L having its full value or being completely absent are checked.
- b. If plastic design methods are used:
- 1) Y = 1.7 0 + 1.7 L + 1.7 F + 1.7 H + 1.7 R,
- 2) Y = 1. 7 D + 1. 7 L + 1. 7 F + 1. 7 H + 1. 7 R, + 1. 7 W l
I Ch Amendment P June 15, 1993
CESSAR EnL"icari:s TABLE 3.8-5 (Cont'd) O (Sheet 8 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES If thermal stresses due to To and Ro are present, the following combinations are also satisfied:
- 3) Y = 1. 3 (D + L + F + H + T, + R,)
- 4) Y = 1. 3 (D + L + F + H + T, + R, + W)
Both cases of L having its full value or being completely absent are checked.
- 2. Factored Load Conditions The following load combinations are satisfied:
- a. If elastic working stress design methods are used:
- 1) 1. 6 S = D + r + L + H + T, + R, + E '
- 2) 1. 6 S = 0 + F + L + H + T, + R, + W,
- 3) 1. 6 S = D + F + L + H + T, + R, + P,
- 4) 1. 7 S* = D + F + L + H + T, + R, + P, + 1. 0 ( Y; + Y, + Y,) + E '
For combination (4), in computing the required- section strength, S, the plastic section modulus of steel shapes may be used.
- b. If plastic design methods are used:
- 1) Y* = D + F + L + H + To + R, + E '
- 2) Y* = D + F + L + H + T, + R, + W,
- 3) Y* = D + F + L + H + T, + R, + 1. 5 P,
- 4) Y* = 0 + F + L + H + T, + R, + P, + 1. 0 (Y;+ Y,+Y,) + E '
O Amendment P June 15, 1993
CESSAR EE"icari:n TABLE 3.8-l1 (Cont'd) (Sheet 9 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES In the above factored load combinations, thermal loads can be neglected when it can be shown that they are secondary and self-limiting in nature and where the material is ductile.
- Y(for the factored lead combinations) should be multiplied by 0.90 for the Internal Structures and 1.0 for other Category I structures.
In factored load combinations (3) and (4), the minimum values of P,, T , T,, Y;, Y,., and Y,, including an appropriate dynamic load factor, are used unless a time-history analysis is performed to justify otherwise. Factored load combinations (2) and (4) are first satisfied without the tornado missile load in (2), and without Y , Yi , and Y, in (4). When considering these loads, however, focaT section strengths may be exceeded under the effect of these concentrated loads, provided there will be no loss of function of any safety-related system. O) \ Where any load reduces the effects of other loads, the corresponding coefficient for that load should be taken as 0.9, if it can be demonstrated that the load is always present or occurs simultaneously with other loads. Otherwise, the coefficient for that load should be taken as zero. Where the structural effect of differential settlement may be significant it should be included with the dead load, D. IV. Load Combinations and Acceptance Criteria for Cateaory I Foundations-In addition to the load combinations and acceptance criteria referenced above, all Category I foundations are also checked against sliding and overturning due to earthquakes, winds, and tornadoes and against flotation due to floods in accordance with the following: Minimum Factors of Safety Load Combination Overturnina Slidina flotation D+H+W 1.5 1.5 -- D + H + E' 1.1 1.1 - D+H+W, 1.1 1.1 - D + F' - - 1.1 s i Amendment N April 1, 1993 i i
CESSAR EHH"icivi u O TABLE 3.8-5 (Cont'd) (Sheet 10 of 10) LOAD COMBINATIONS FOR CATEGORY I STRUCTURES Definitions: 0 - Dead Load F' - Buoyant Forces of Design Basis Flood H - Lateral Earth Pressure E' - SSE Seismic Load W - Wind Load W, - Tornado Load O O Amendment N April 1, 1993
CESSAREn& - ' o) \v RCS. For the number of cycles pertaining to fatigue effects of cyclic motion associated with the SSE, refer to Section 3.7.3.2. Design load combinations for ASME Class 1, 2 and 3 components are given in Section 3.9.3. 3.9.1.2 Computer Procrams Used in Stress Analyses 3.9.1.2.1 Code Class Systems, Components, and Supports l The following paragraphs provide a summary of the applicable l computer programs used in the stress and structural analyses for ASME Code Class systems, components, and supports in the CESSAR-DC scope. The summaries include individual descriptions and applicability data. The computer codes employed in these analyses have been verified in conformance with design control methods, consistent with the quality assurance program described in Chapter 17. 3.9.1.2.1.1 MDC STRUDL The MDC STRUDL computer program provides the ability to specify characteristics of framed structure and three-dimensional solid structure problems, perform static and dynamic analyses, and reduce and combine results. \ Analytic procedures in the pertinent portions of MDC STRUDL apply to framed structures. Framed structures are two- or three-dimensional structures composed of slender, linear members that can be represented by properties along a centroidal axis. Such a structure is modeled with joints, including support joints, and members connecting the joints. A variety of force conditions on members or joints can be specified. The member stiffness matrix is computed from beam theory. The total stiffness matrix of the modeled structures is obtained by appropriately combining the individual member stiffness. The stiffness analysis method of solution treats the joint displacements as unknowns. The solution procedure provides results for joints and members. Joint results include displacements and reactions and joint loads as calculated from member end forces. Member results are member end forces and 1 distortions. The assumptions governing the beam element ! representation of the structure are as follows: linear, elastic, homogeneous, and isotopic behavior, small deformation, plane sections remain plane, and no coupling of axial, torque, and ! bending, j 1 The program is used to define the dynamic characteristics of the i structural models used in the dynamic seismic analyses of the l [^ reactor coolant system components. The natural frequencies and mode structural models and the influence l ( shapes of the Amendment N 3.9-3 April 1, 1993
CESSAR naincmou coefficients which relate member end forces and moments and O support reactions to unit displacements are calculated. The influence coefficients are calculated for each dynamic degree-of-freedom of each mass point and for each degree-of-freedom of each support point. The ANSYS computer code (Section 3.9.1.2.1.14) is also used as an alternate to MDC-STRUDL for defining the dynamic characteristics of the reactor coolant system and seismically analyzing it. The program can perform either time-history analysis or spectrum analysis using the modal super position technique. Support reactions, member loads and joint acceleration are computed by back substituting from the modal coordinates to physical coordinates through the applicable transformation matrice and then combining modal contributions from each individual mode included in the response analysis. MDC STRUDL is a program which is commercially available and has l had sufficient use to justify its applicability and validity. Extensive verification of the C-E version has been performed to supplement the public documentation. The version of the program in use at C-E was developed by the McDonnell Automation Company / Engineering Computer International and is run on the IBM computer system. MDC STRUDL is described in more detail in Reference 1. 3.9.1.2.1.2 C-E MARC The C-E MARC program is a general purpose nonlinear finite element program with structural and heat transfer capabilities. It is described in detail in Reference 2. C-E MARC is used for stress analysis of regions of vessels, piping or supports which may deform plastically under prescribed loadings. It is also used for elastic analyses of complex geometries where the graphics capability enables a well defined solution. The thermal capabilities of C-E MARC are used for complex geometries where simplification of input and graphical output are preferred. C-E MARC is the C-Z modified version of the MARC program, which is in the public domain and has had sufficient use to justify its applicability and validity. Extensive verification of the C-E version has been performed to supplement the public documentation. 3.9.1.2.1.3 JEST JEST is a proprietary computer code developed for evaluation of nuclear piping systems with hypothesized flaws. The code Amendment P 3.9-4 June 15, 1993
CESSARnancmo l performs fracture mechanics related calculations such as J-Integral parameter and crack mouth opening displacements used 1 in leak-before-break and stability evaluations. Input to the i code consists of the geometry, material properties, the flaw size l and the loading conditions. The code uses elastic-plastic estimation scheme type solutions developed by Electric Power Research Institute (EPRI) and General Electric (GE) . Several EPRI/GE analytical solutions are available in the code. The program is used to automate calculations that would have been performed manually. The verification of JEST was performed by making direct comparison with hand calculations and with other direct solutions. 3.9.1.2.1.4 SUPERPIPE SUPERPIPE is a linear finite element program for the static and dynamic analysis of piping systems. These systems may include such components as bonds, elbows, tees, reducers, socket or butt , welds, flexible couplings, and flanges, with the appropriate flexibility factors and stress indices accounted for. Support types may include rigid, spring, constant-force, snubber, anchor, or user-specified, and may have any desired orientation. 1 Analyses performed include thermal, weight, applied load, frequency and mode shape, response spectrum, and time-history. Following the static and dynamic analysis phase, the program performs a complete ASME B&PV Code, Section III Class 1 stress check, combining analysis results in any manner specified by the user to create the appropriate loading cases applicable for each of the ASME code stress equations. The user also supplies the number of occurrences of each steady-state and transient load state, with which the program performs a complete fatigue damage calculation. SUPERPIPE, which is commercially available software, was l developed by ABB-Impell and is described in detail in Reference
- 20. SUPERPIPE was verified in accordance with ABB-Impell's Quality Assurance Manual.
3.9.1.2.1.5 DFORCE The computer code program DFORCE calculates the internal forces and moments at designated locations in a piecewise linear structural system, at each time step, due to the time history of relative displacements of the system mass points and boundary points. The program also selects the maximum value of each component of force or moment at each designated location, and the times at which they occur, over the entire duration of the specified dynamic event. I Amendment P 3.9-5 June 15, 1993
CESSAR n%ncircu The program forms appropriate linear combinations of the relative 9 displacements at each time step and performs a complete loads analysis of the deformed shape of the structure at each time step over the entire duration of the specified dynamic event. The program is used to calculate the time dependent reactions in structural models subjected to dynamic excitation which are analyzed by the CEDAGS program. To demonstrate the validity of the DFORCE program, results for test cases were obtained and shown to be substantially identical to those obtained for an equivalent analysis using the public domain program MDC STRUDL. 3.9.1.2.1.6 BG LINK SG LINK determines steam generator and snubber stroke and building interface boundaries for the steam generator snubber lever system. The program verifies the kinematics of the snubber lever linkage systems based on input motions of the steam generator lug and detailed snubber lever system geometry. 3.9.1.2.1.7 CEDAGB The computer program CEDAGS (C-E Dynamic Analysis of Gapped Structure) performs a piecewise linear direct integration solution of the coupled equations of motion of a three dimensional structure which may have clearances or gaps between the structure and any of its supports or restraints (boundary gaps) or between points within the structure (internal gaps). The contacted boundary points may be oriented in any selected direction and may respond rigidly, elastically, or plastically. The structure may be subjected to applied dynamic loads or boundary motions. The CEDAGS program is used to calculate the dynamic response of piecewise linear structural systems subjected to time varying load forcing functions resulting from postulated pipe break conditions. To demonstrate the applicability and validity of the CEDAGS program, the solutions to an extensive series of test problems were obtained and shown to be substantially identical to results obtained by hand calculations or alternate computer solutions. 3.9.1.2.1.8 CE177, Head Penetration Reinforcement Program This program calculates reinforcement available and reinforcement regaired for penetrations in hemispherical heads. The technique described in paragraph NB-3332 of the ASME Code, Section III is used. Amendment K 3.9-6 October 30, 1992
CESSAR Minnemu This program is used to perform preliminary sizing and reinforcement calculations for hemispherical heads in the reactor vessel. Program was verified by comparisons of program results and hand calculated solutions of classical problems. 3.9.1.2.1.9 CE102, Flange Fatigue Program This program computes the redundant reactions, forces, moments, stresses, and fatigue usage factors in a reactor vessel head, head flange, closure studs, vessel flange, and upper vessel wall for pressure and thermal loadings. Classical shell equations are used in the interaction analysis. This program is used to perform the fatigue analysis of the reactor vessel closure head and vessel flange assembly. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. 3.9.1.2.1.10 CE105, Nozzle Fatigue Program This program computes the redundant reactions forces, moments, and fatigue usage factors for nozzles in cylindrical shells. j r~' This program is used to perform the fatigue analysis of reactor ( vessel nozzles and steam generator feedwater nozzle. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. 3.9.1.2.1.11 CEC 26, Edge Coefficients Program This code calculates the coefficients for edge deformations of conical cylinders and tapered cylinders when subjected to axisymmetric unit shears and moments applied at the edges. I This program is used to perform the fatigue analysis of reactor vessel wall transition. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. 3.9.1.2.1.12 CE124, Generalized 4 x 4 Program This program computes the redundant reactions, forces, moments, stresses, and fatigue usage factors for the reactor vessel wall at the transition from a thick to thinner section and at the bottom head juncture. This program is used to perform fatigue analysis of reactor vessel bottom head juncture. Program was verified by comparisons of program results and hand-calculated solutions of classical (h problems. V Amendment E 3.9-7 December 30, 1988
CESSAR narlCATI@N 3.9.1.2.1.13 SEC 11 O The SEC 11 program automates the flaw evaluation method of ASME B&PV, Section XI, Appendix A. This program performs the crack growth analyses and assesses the margin against critical crack size according to the criteria in Appendix A. The program has been verified by direct comparison of program results and hand calculations. The program is used for leak-before-break type analyses. 3.9.1.2.1.14 ANSYS ANSYS is a large-scale, general-purpose, finite element program for linear and nonlinear structural and thermal analysis. This program is commercially available. Additional descriptive l information on this code is provided in Section 3.9.1.2.2.2. This program is used for numerous applications for all components in the areas of structural, fatigue, thermal and eigenvalue analysis. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. 3.9.1.2.1.15 CE301, The Structural Analysis for Partial Penetration Nozzles, Heater Tube Plug Welds, and the Water Level Boundary of the Pressurizer Shell Program This program computes various analytical parameters, primary plus secondary stresses and stress intensities, peak stresses and stress intensities, and the cyclic fatigue analysis with usage factors at cuts of interest. This program is utilized to satisfy the requirements of Section III, of the ASME B&PV Code. This program is used in the fatigue analysis of partial penetration nozzles in the pressurizer and piping. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. 3.9.1.2.1.16 CE223, Primary Structure Interaction Program This code calculates redundant loads, stresses, and fatigue usage factors in the primary head, tubesheet, secondary shell, and stay cylinder for pressure and thermal loadings. This program is used in the fatigue analysis of the steam generator primary structure. Program was verified by comparisons of program results and hand-calculated solutions of classical problems. O Amendment P 3.9-8 June 15, 1993
CESSAR H5MICATION g I 1 V The finite elements used to date in C-E analyses are the elastic beam, plate and ground support spring members. The assumptions governing their use are as follows: small deformation, linear-elastic behavior, plane sections remain plane, no coupling of axial, torque and bending, geometric and elastic properties constant along length of element. Further description is provided in Reference 4. The MRI/STARDYNE code is used in the analysis of reactor internals. The ANSYS code (3.9.1.2.2.2) and the COSMOS code (3.9.1.2.2.10) are also used as alternatives to STARDYNE. The program is used to obtain the mode shapes, frequencies and response of the internals to predescribed static and dynamic loading. The structural components are modeled with beam and plate elements. Ground support spring elements are used, at times, to represent the effects of surrounding structures. The geometric and elastic properties of these elements are calculated such that they are dynamically equivalent to the original structures. The response analysis is then conducted using both modal response spectra and modal time history techniques. Both methods are compatible with the program. p The program is also used to perform a static finite element t, analysis of the lower support structure to determine its structural stiffness. MRI/STARDYNE is commercially available software and has had l sufficient use to justify its applicability and validity. Extensive verification of the C-E version has been performed to supplement the public documentation. 3.9.1.2.2.2 ANSYS ANSYS is a general purpose nonlinear finite element program with structural and heat transfer capabilities. It is described in Reference 5. ANSYS is used to perform detailed stress analyses of the fuel assembly due to combined lateral and vertical dynamic-loads resulting from postulated seismic and loss-of-coolant-accident conditions. Static finite element analyses of reactor internal structures, such as flanges, expansion compensating ring and core shroud, are performed with ANSYS to determine vertical and lateral stiffnesses and thermal stresses. ANSYS is a proprietary code and commercially available. The l developers, Swanson Analysis Systems, Incorporated have published an ANSYS verification manual with numerous examples of its usage. (A) 'O l Amendment P l 3.9-13 June 15, 1993 1 I l
CESSARs h u 3.9.1.2.2.3 ASHSD 9 The ASHSD program uses a finite element technique for the dynamic analysis of complex axisymmetric structures subjected to any arbitrary static or dynamic loading or base acceleration. The three-dimensional axisymmetric continuum is represented as an axisymmetric thin shell. The axisymmetric shell is discretized as a series of frustums of cones. Hamilton's variational principle is used to derive the equations of motion for these discrete structures. This leads to a mass matrix, stiffness matrix, and load vectors which are all consistent with the assumed displacement field. To minimize computer storage and execution time, the nondiagonal " consistent" mass matrix is diagonalized by adding off-diagonal terms to the appropriate diagonal terms. These equations of motion are solved numerically in the time by a direct step-by-step integration procedure. The assumptions governing the axisymmetric thin shell finite element representation of the structure are those consistent with linear orthotropic thin elastic shell theory. Further description is provided in Reference 6. ASHSD is used to obtain the dynamic response of the core support barrel under normal operating conditions and due to a LOCA. An axisymmetric thin shell model of the structure is developed. The spatial Fourier series components of the time varying normal operating hydraulic pressure or LOCA loads are applied to the modeled structure. The program yields the dynamic shell and beam mode response of the structural system. ASHSD has been verified by demonstration that its solutions are substantially identical to those obtained by hand calculations or from accepted experimental tests or analytical results. The details of these comparisons may be found in References 6 and 7. 3.9.1.2.2.4 CESHOCK The computer program CESHOCK solves for the response of structures which can be represented by lumped-mass and spring systems and are subjected to a variety of arbitrary type loadings. This is done by gumerically solving the differential equations of motion of an n degree of freedom system using the Runge-Kutta-Gill technique. The equations of motion can represent an axially responding system or a laterally responding system (i.e., an axial motion, or a coupled lateral and rotational motion). The program is designed to handle a large O 3.9-14
CESSARE!an - ! 1 /O O M = model mass matrix th Wn = natural circular frequency for the n mode th
$n = normal mode shape matrix for the n mode The solution to the general eigenvalue problem is obtained using the dual Jacobi rotation method.
The MODSK code is used in the analyses of reactor internals to obtain frequencies and mode shapes, and damping parameters. The results of these analyses are incorporated into overall reactor vessel internals models, which calculates dynamic response due to seismic and LOCA conditions. The MODSK program was developed by C-E. To demonstrate the validity of the MODSK program, results from lateral and vertical test problems were obtained and shown to be substantially identical to those obtained from an equivalent analysis using the public domain program ANSYS (Refer to Section 329.1.2.2.2). 3.9.1.2.2.7 BAPIV The SAPIV computer code is a structural analysis program capable y of analyzing two and three-dimensional linear complex structures subjected to any arbitrary static and dynamic loading or base acceleration. The analysis technique is based on the finite element displacement method. The structure to be analyzed can be represented using bars, beams, plates, membranes and three-dimensional finite elements. Structural stiffness and load vectors are assembled from the element matrices which are derived assuming various displacement functions within each element whereas lumped mass matrices are used to represent inertia characteristics of the structure. In the static analysis, the assembled equations of equilibrium are solved by using a linear equation solver. Dynamic analysis capabilities include modal analysis, modal superposition and direct integration methods of computing dynamic response and response spectrum techniques. l SAPIV has been applied to the eigenvalue and response spectra ! analyses of spent fuel storage racks and lifting rig structures. The SAPIV coda is used in the computation of dynamic response of l control element drive mechanisms under mechanical and seismic loads. Both modal analysis and response spectrum capabilities of the code are used to find the natural frequencies and mode shapes O 3.9-17
CESSAR88% - and the dynamic loads in CEDM components. ANSYS (3.9.1.2.2.2) is O also used as an alternative to SApIV. SAPIV is commercially available software and has had sufficient l use to justify its applicability and validity. Extensive verification of the C-E version has been perfcrmed to supplement the public documentation. 3.9.1.2.2.8 CEFLASH-4B The CEFLASH-4B computer code (Reference 14) predicts the reactor pressure vessel pressure and flow distribution during the subcooled and saturated - portion of the blowdown period of a Loss-of-Coolant-Accident (LOCA). The equations for conservation of mass, energy and momentum along with a representation of the equation of state are solved simultaneously in a node and flow path network representation of the primary reactor coolant system. CEFLASH-4B provides transient pressures, flow rates and densities throughout the primary system foll.owing a postulated pipe break in the reactor coolant system. The CEFLASH-4B computer code is a modified version of the CEFLASH-4A code (References 15 through 17). The CEFLASH-4A computer code has been approved by the NRC (References 18 and 19). The capability of CEFLASH-4B to predict experimental blowdown data is presented in Reference 14. 3.9.1.2.2.9 LOAD LOAD calculates the applied forces of the axial internals model which is contained within water control volumes using results from the CEFLASH-4B blowdown loads analysis as input. The fluid momentum equation is applied to each volume and a resultant force is calculated. Each force is then apportioned to the various structural nodes contained within the volume. Use of the fluid momentum equation takes into account pressure forces, fluid friction, water weight, and momentum changes within each volume. The resultant forces are combined with the reactor vessel motions obtained from the reactor coolant system analysis before the structural responses are determined. The LOAD code has been verified by demonstrating that its solutions are substantially identical to those obtained from hand calculations. 3.9.1.2.2.10 COSMOS COSMOS is a general purpose program, commercially available, l which can be used to perform finite element, dynamic, eigenvalue, response spectra, random vibration, and other structural Amendment P 3.9-18 June 15, 1993
CESSAREnGem I
\v ) l 3.9.3 ABME CODE CLASS 1, 2 AND 3 . COMPONENTS, COMPONENT SUPPORTS AND CLASS CS CORE SUPPORT STRUCTURES ASME B&PV Code Section III Class 1, 2 and 3 Piping and Components are designed and constructed in accordance with Section III of the ASME Boiler and Pressure Vessel Code and Code Case (s).
In accordance with ASME Code, a specification is provided for piping supports which defines the jurisdictional boundary for the NF portion of the piping support. For equipment component supports, such as those for pumps and vessels, the supports are generally furnished by the manufacturer along with the equipment. The supports are designed and classified and meet ASME Code Section III, Subsection NF. Reactor coolant loop piping and associated components and component supports are designed and analyzed by Combustion Engineering. Loading conditions, stress limits, design transients, and methods of analysis for ASME Code Class 1 reactor coolant loop piping and associated components and component supports are discussed in Section 3.9.3.1. (n)
\d The COL applicant will provide information on the specific edition of the ASME Code used in the site-specific design.
3.9.3.1 Loadino Combinations, Desian Transients and Stress Limits The loading combinations specified for the design ASME B&PV section III Code Class 1 components, supports, and piping are categorized as normal, upset, emergency and faulted. The following r.pecific loading combinations are specified for design: A. The concurrent loadings associated with the Level-A (normal) plant conditions of dead weight, pressure and the thermal and expansion effects during startup, hot standby, power operation and normal shutdown to cold shutdown conditions. B. The concurrent loadings associated with either the normal plant condition or the Level-B (upset) plant condition. The vibratory motion of the Safe Shutdown Earthquake (SSE) is included in the fatigue evaluation in accordance with Section 3.7.3.2. C. The concurrent loadings associated with the Level-C (emergency) condition. n D. The concurrent loadings associated with the Level-A (normal) I ( plant condition, the vibratory motion of the SSE, and the C dynamic system loadings associated with the Level-D Amendment P 3.9-33 June 15, 1993
CESSAR nai"lCATION O (faulted) system condition (postulated pipe rupture for branch line breaks not eliminated by leak before break analysis). The SSE and pipe rupture loadings are combined by the SRSS method in accordance with the guidelines of NUREG-0484, Rev. 1, 1980 or by a more conservative method. The specific design transients specified for design are discussed in Section 3.9.1.1. The loading combinations of the section and the stress limits associated with them, as defined in the Code, also apply to the internals parts which are essential to the component in performing its safety function. ASME B&PV Code Class 1, 2 and 3 piping and components of fluid systems are designed and constructed in accordance with Section III of the ASME Boiler and Pressure Vessel Code. Hydrostatic testing is performed per Section III. Design pressure, temperature, and other loading conditions that provide the bases for design of fluid systems are presented in the sections which describe the systems. Stress analysis is performed to determine structural adequacy of pressure components under the operating conditions of normal, upset, emergency or faulted, as applicable. Significant discontinuities are considered, such as nozzles, flanges, etc. In addition to the design calculation required by the ASME B&pV Section III code, stress analysis is performed by methods outlined in the code appendices or by other methods by reference to analogous codes or other published literature. 3.9.3.1.1 ASME Code Class 1 Components and Supports Design transients for core support structures and ASME Code Class 1 components, supports and piping are discussed in Section 3.9.1.1. Loading combinations for ASME Code Class 1 components are described in Table 3.9-2. Stress limits for ASME Code Class 1 components, supports and piping are described in Table 3.9-3. The operating pressures of Code Class 1 active valves are limited to the pressures taken from the applicable primary pressure class pressure-temperature rating of the ASME Code, Section III, for the maximum temperature for the applicable condition. 3.9.3.1.2 Core Support Structures (Class CS) and Internal Structures (Class IS) Design transients for core support structures and reactor internals structures are discussed in Section 3.9.1.1. Loading combinations and stress limits are presented in Section 3.9.5. Amendment N 3.9-34 April 1, 1993
CESSAR E!Encmu rN l ) I L/ ' 3.9.3.1.3.3 Pumps j Pumps supplied for the Auxiliary Systems are: Safety Injection (active) (Safeguard) Code Class 2 Shutdown Cooling (active) (Safeguard) Code Class 2 Containment Spray (active) (Safeguard) Code Class 2 Component Cooling Water System Pumps (active) Code Class 3 Station Service Water System Pumps (active) Code Class 3 Essential Chilled Water Circulation Pumps (active) Code Class 3 Diesel Generator Fuel Oil Recirculation Pump (active) Code Class 3 Diesel Generator Fuel Oil Booster Pump (active) Code Class 3 Diesel Generator Cooling Water Circulation Pump (active) Code Class 3 Diesel Generator Cooling Water Keep Warm Pump (active) Code Class 3 Diesel Generator Starting Air System Air Compressors (active) Code Class 3 Diesel Generator Lube Oil Transfer Pumps (active) Code Class 3 f'~'N Diesel Generator Prelube Oil Pump (active) Code Class 3 1' ) Reactor Building Subsphere Surp Pumps (active) Code Class 3 Diesel Generator Building Sump Pumps (active) Code Class 3 Spent Fuel Pool Cooling System Pumps (active) Code Class 3 Emergency Feedwater Pumps (active) Code Class 3 The design rules and associated design stress limits applied in the design of ASME Code Class 2 and 3 pumps are in accordance with the ASME Code, Section III, Subsections NC and ND, respectively. The results are as described herein. Stress limits for active pumps are ' shown in Table 3.9-7 and stress limits for non-active pumps are shown in Table 3.9-6. Loading combinations are in accordance with Table 3.9-2. Pump assemblies, including supports, support attachment welds, and bolts, are capable of withstanding specified horizontal and vertical seismic accelerations. The seismic accelerations are applied separately at the center of gravity acting in each of two orthogonal horizontal directions and either vertical direction. p im-) Amendment I 3.9-37 December 21, 1990
CESSAR Ein% mon O The stresses or reaction loads at a given point, due to the three separate analyses, are combined by the SRSS method to define a total seismic design condition. The design allowable nozzle forces and moments act in directions that yield the highest stress when combined with the seismic loads, as determined above, and other concurrent loads. The stress criteria of the ASME Code, Section III are applied in the design of component supports to the same Code Class as the pressure boundary involved within the jurisdictional boundaries defined in the code for the loading conditions defined above. Those steel support structures which are considered to be an extension of the building structure, but supplied with the pump assembly (i.e., bedplates), are designed to the stress criteria of the AISC Manual of Steel Construction. In addition, the Safcguard Pump assemblies are required to be capable of withstanding the design thermal transients of Section 3.9.1. 3.9.3.1.4 Piping and Piping Supports 3.9.3.1.4.1 ASME Code Class 1 A. Piping For ASME Code Class 1 piping, the combinations of design loadings are categorized with respect to service levels, identified as Level A, Level B, Level C, or Level D, as shown in Table 3.9-10. The design stress limits for each of the loading combinations are found in ASME B&PV Code, Section III, NB-3600. B. Piping Supports For pipe supports, the design loading combinations are presented in Tables 3.8-5 and 3.9-12. Pipe support members are designed to meet the requirements defined by ASME Code, Section III, Subsection NF. See Appendix 3.9A, Section 1.7.4, for a further discussion. 3.9.3.1.4.2 ASME Code Class 2 and 3 A. Piping For ASME Code Class 2 and 3 piping the combinations of design and service loadings are categorized with respect to system service levels identified as Design, Level A, B, C and D as shown in Tables 3.9-11. The design stress limits for each of the loading combinations are found in ASME B&PV Code, Section III, NC/ND-3600. Amendment P 3.9-38 June 15, 1993
CESSAR EEiHnc 13. N.) B. Piping Supports For pipe supports, the design and service loading combinations are presented in Tables 3.9-12. Pipe support members are designed to meet the requirements defined by ASME Code, Section III, Subsection NF. See Appendix 3.9A, Section 1.7.4, for a further discussion. C. Functional Capability To address functional capability, the piping shall be designed to meet ASME B&PV, Section III, Level D limits. 3.9.3.2 Pump and Valve Operability Assurance 3.9.3.2.1 Active ASME Code Class 2 and 3 Pumps and Class 1, 2 and 3 Valves Furnished with the NSSS 3.9.3.2.1.1 Operability Assurance Program Active pumps and valves are defined as pumps and valves and those components that must perform a mechanical motion in order to shut /9 down the plant, maintain the plant in a safe shutdown condition, kj or mitigate the consequences of a postulated event. operability (i.e., performance of this mechanical motion) of The active components during and after exposure to design bases events is confirmed by: A. Designing each component to be capable of performing all safety functions during and following design bases events. The design specification includes applicable loading combinations, and conservative design limits for active components. The specification requires that the manufacturer demonstrate operability by analysis, by test, or by a combination of analysis and test. The results are independently reviewed by the NSSS Supplier considering the effects of postulated failure modes on operability. Internals parts which are essential' to the component in performing its safety function are analyzed and/or tested as an assembled component to validate operability. B. Analysis and/or test demonstrating the operability of each design under the most severe postulated loadings. Methods /results of operability demonstration programs are detailed in Sections 3.9.3.2.1.2 and 3.9.3.2.1.3. 0% V Amendment P 3.9-39 June 15, 1993
1 CESSAR n%"lCAT12N l e l C. Inspection of each component to assure compliance of critical parameters with specifications and drawings. This inspection confirms that specified materials and processes were used, that wall thicknesses met code requirements, and that fits and finishes met the manufacturer's requirements based on design clearance requirements. D. Shop testing of each component to verify "as-built" conditions, as defined in Sections 3.9.3.2.1.2 and 3.9.3.2.1.3. E. Startup and periodic in-service testing in accordance with ASME Boiler and Pressure Vessel Code, Section XI to demonstrate that the active pumps and valves are in operating condition throughout the life of the plant. NSSS active pumps are listed below with a brief description of active safety function of each. NSSS active valves are listed in Table 3.9-4. Active Components Active Safety Function Safety injection pumps Operate at flow rates to runout Shutdown cooling pumps Operate at design flow Containment spray pumps Operate at design flow 3.9.3.2.1.2 Operability Assurance Program Results for Active Pumps Operability of the Safety Injection, Shutdown Cooling and Containment Spray pumps under required conditions demonstrated by analyses of the assemblies and by analyses and tests of the motors. For the safety injection, shutdown cooling and containment spray pumps, allowable stresses are not exceeded, clearances are acceptable and shaft and pedestal bolt deflections do not cause stresses to exceed the normal values. Where necessary, lumped mass models are used with the computer programs to determine the natural frequencies and displacements. The models are conservative (i.e., simplifications tend to make them more flexible). Amendment K 3.9-40 October 30, 1992
TC E S S A R in Wic = ,,
-i O 1 B. In-shop hydrostatic test..
C. In-shop. seat leakage test. _ D. Periodic valve exercise and inspection to assure the functional ability of the valve. , Using the methods described, safety-related active valves in the i system are qualified'for operability:during a seismic event. J 3.9.3.3 Desian and Installation Details-for Mountinco'f' Pressure Relief Devices Safety valves and relief valves are analyzed in accordance with the ASME Section III Code. The method of analysis for safety valves and relief valves suitably accounts for the. time-history. of loads acting
- immediately following a valve opening (i.e., 'first .few milliseconds). The fluid-induced forcing. ' functions are calculated for. each safety valve .and. relief valve using '
one-dimensional equations for the conservation of mass, momentum,; e and energy'. The calculated forcing functions arelapplied at . locations along the ' associated piping where a change.in fluid : ( flow direction occurs. Application of these forcing functions to . the associated piping model-constitutes'the' dynamic' time-history analysis. The dynamic response of- the piping. system' is determined from the input forcing functions. 'Therefore, a dynamic amplification factor is inherently accounted for'in the. y analysis. Alternately, an' equivalent static analysis may be used following the criteria of Appendix 0 of..the ASME' Code Section'III' , as supplemented'by the additional criteria of SRP3.9.3, Section . II.2. i Snubbers or strut-type restraints are used as required.- 'The-stresses resulting from the loads produced by the sudden opening of a relief or safety valve are~ combined with stresses due'to 3 other pertinent loads and are shown to be within'. allowable. limits of the ASME Section III Code. Also, the analyses show that the . loads applied to the nozzles of the safety and relief valves do1 not exceed the maximum loads specified by the manufacturer. Jurisdictional boundaries' between ASME Section III Class ~1, 2 and l 3 component supports and the building structure are established H in accordance with ASME Section III, Subsection NF. Jurisdictional. boundaries between ASME Section III Class 1, 2 and 3 component supports and the building structure are established in accordance with ASME Section.III, Subsection NF. Amendment N 3.9-51 April 1,7 1993 o l
CESSARE!aiNmm ! O 3.9.3.4 Component Supports ASME B&PV Code Section III Class 1, 2 and 3 component supports are designed and constructed in accordance with Section III of the ASME B&PV Code and Code Case (s). The edition of the ASME Code will be specified in the site-specific SAR. Supports for ASME Section III Code Class 1, 2 and 3 components are specified for design in accordance with the loads and loading combinations discussed in Section 3.9.3.1 and presented in Table 3.9-2. Component supports which are loaded during normal operation, seismic and following a pipe break (branch line breaks not eliminated by leak-before-break) are specified for design for loading combinations (A) through (D) of Section 3.9.3.1. Design stress limits applied in evaluating loading combinations (A), (B), and (C) of Section 3.9.3.1 are consistent with the ASME Code, Section III. The design stress limits applied in evaluating loading combination (D) of Section 3.9.3.1 are in accordance with the ASME B&PV Code, Section III. Loads in compression members are limited to 2/3 of the critical buckling load., See Appendix 3.9A, Section 1.7.4, for a discussion of concrete expansion anchors. Where required, snubber supports are used as shock arrestors for safety-related systems and components. Snubbers are used as structural supports during a dynamic event such as an earthquake or a pipe break, but during normal operation act as passive devices which accommodate normal expansions and contractions of the systems without resistance. For System 80+, snubbers are minimized, to the extent practical, through the use of design optimization procedures. Assurance of snubber operability is provided by incorporating analytical, design, installation, in-service, and verification criteria. The elements of snubber operability assurance for System 80+ include: A. Consideration of load cycles and travel that each snubber will experience during normal plant operating conditions. B. Verification that the thermal growth rates of the system do not exceed the required lock-up velocity of the snubber. C. Accurate characterization of snubber mechanical properties in the structural analysis of the snubber-supported system. Amendment P 3.9-52 June 15, 1993
CESSAR 8!Since I i
'O '
l D. For engineered, large bore snubbers, issuance of a design ' specification to the snubber supplier, describing the required structural and mechanical performance of the snubber; verification that the specified design and fabrication requirements are met. E. Verification that snubbers are properly installed and operable prior to plant operation, through visual inspection and through measurement of thermal movements of snubber-supported systems during start-up tests. F. A snubber in-service inspection and testing program, which includes periodic maintenance and visual inspection, inspection following a faulted event, a functional testing program, and repair or replacement of snubbers failing inspection or test acceptance criteria. The COL applicant will provide a listing of all safety-related components which utilize snubbers, in accordance with SRP 3.9.3. 3.9.4 CONTROL ELEMENT DRIVE MECHANISMS 3.9.4.1 Descriptive Information of CEDE
\.N-) The control element drive mechanism (CEDMs) are magnetic jack type drives used to vertically position and indicate the position of the control element assemblies (CEAs). Each CEDM is capable of withdrawing, inserting, holding, or tripping the CEA from any point within its 153-inch stroke in response to operation signals.
The CEDM is designed to function during and after all normal plant transients. The CEA drop time for 90% insertion is 4.0 seconds maximum. The drop time is defined as the interval between the time power is removed from the CEDM coils to the time the CEA has reached 90% of its fully inserted position. The CEDM pressure boundary components have a design life of 60 years. The CEDM is designed to operate without maintenance for a minimum of 1-1/2 years and without replacing components for a minimum of 3 years. The CEDM is designed to function normally during and after being subjected to seismic loads. The vibratory motion of the Safe Shutdown Earthquake is included in the fatigue evaluation in accordance with Section 3.7.3.2. The CEDM will allow for tripping of the CEA during and after a Safe Shutdown Earthquake. I \ ( Amendment P 3.9-53 June 15, 1993
CESSAREnh . O The design and construction of the CEDM pressure housing fulfill the requirements of the ASME boiler and Pressure Vessel Code, Section III, for Class 1 vessels. The CEDM_ pressure housings are part of the reactor coolant pressure boundary, and they are designed to meet stress requirements consistent with those of the vessel. The pressure housings are capable of withstanding, throughout the design life, all normal operating loads, which include the steady-state and transient operating conditions specified for the vessel. Mechanical excitations are also defined and included as a normal operating load. The CEDM pressure housings are service rated at 2500 psi at 650*F. The loading combinations and stress limit categories are presented in Table 3.9-14 and are consistent with those defined in the ASME code. The design duty requirements for the CEDM is a total cumulative CEA travel of 100,000 feet operation without loss of function. The test programs performed in support of the CEDM design are described in Section 3.9.4.4. 3.9.4.1.1 Control Element Drive Mechanism Design Description The CEDMs are mounted on nozzles on top of the reactor vessel closure head. The CEDMs consist of the upper and lower CEDM pressure housings, motor assembly, coil stack assembly, reed switch assemblies, and extension shaft assembly. The CEDM is shown in Figure 3.9-8. The drive power is supplied by the coil stack assembly, which is positioned around the CEDM housing. Two position indicating reed switch assemblies are supported by the upper pressure housing shroud, which encloses the upper pressure housing assembly. The lifting operation consists of a serits of magnetically operated step movements. Two setc. of mechanical latches are utilized engaging a notched extension shaft. To prevent excessive latch wear, a means has been provided to unload the latches during the engaging operations. The magnetic force is obtained from large dc magnet coils mounted on the outside of the lower pressure housing. Power for the electromagnets is obtained from two separate supplies. A control programmer actuates the stepping cycle and moves the CEA by a forward or reverse stepping sequence. Control element drive mechanism hold is obtained by energizing one coil at a reduced current, while all other coils are deenergized. The CEAs are tripped upon interruption of electrical power to all coils. Each CEDM is connected to the CEAs by an extension shaft. Amendment N 3.9-54 April 1, 1993
CESSAR En&"lCATION r C To properly perform their functions, the reactor 1:2ernal structures are designed to meet the deformation J im.i
- s listed below:
A. Under Level A, Level B and Level C service lop.ings, the ! core will be held in place and deflections will be limited so that the CEAs can be inserted under their own weight as the only driving force. B. Under service loading combinations other than Level A, B, and C service loadings that require CEA insertability, deflections are limited so that the core will be held in ; place, adequate core cooling is preserved, and all CEAs can ! be inserted. Those deflections that would influence CEA movement are limited to less than 80% of the deflections required to prevent CEA insertion. The allowable deformation limits are established as 80% of the loss-of-function deflection limits. l The significant component deflection limits are designed as follows:
- 1. Fuel lower end fitting interface with the lower support structure is deflection limited to avoid disengagement.
- 2. Fuel upper end fitting interface with the upper guide structure relative displacement precludes disengagement.
- 3. The CEA shroud lateral deflection allows CEA insertion.
In the design of critical reactor vessel internals components which are subject to fatigue, the stress analysis is performed utilizing the design fatigue curve of Figure I-9-2 of Section III of the ASME Boiler and Pressure Vessel Code. A cumulative usage factor of less than one is used as the limiting criterion. 1 As indicated in the preceding sections, the stress and fatigue limits for reactor internals components are obtained from the j ASME Code. Allowable deformation limits are established as 80% ; of the loss-of-function deflection limits. These limits provide j adequate safety factors assuring that so long as calculated l stresses, usage factors, or deformations do not exceed these ! limits, the design is conservative. / Amendment K , 3.9-69 October 30, 1992
/~
CESSARnuib m O 3.9.6 IN-SERVICE TESTING OF PUMPS AND VALVES The In-service Testing (IST) program for safety-related pumps and valves is developed in accordance with the requirements of Section XI of the ASME B&PV Code. This program is implemented to assess operational readiness during preservice and In-service Inspection (ISI). The inservice testing program in coordination with the System 80+ design utilizes provisions and features to ensure all compliance with ASME B&PV Code, Section XI, Subsections IWP and IWV requirements result. The COL applicant will identify the applicable ISI and IST code editions in accordance with 10 CFR 50.55a(g). The COL applicant will develop an in-service testing program for ASME Code Class 1, 2 and 3 pumps and valves. 3.9.6.1 In-service TestinCT of Pumps The In-service Testing program will include all safety-related pumps. Safety-related pumps are those pumps which are required to perform a specific function in shutting down a reactor or in mitigating the consequences of an accident, and that are provided with an emergency power source. All pumps requiring in-service testing in accordance with Section XI of the ASME B&PV Code are listed .i n Table 3.9-15 which includes testing requirements for each pump and the frequency at which testing will be performed. I Typical testing configurations to support in-service testing of the pumps are shown in Figure 3.9-16 and referenced in Table 3.9-15 where applicable. In addition to Section XI of the ASME B & PV Code, the following provisions will be included as a part of the pump test plan for the pumps specified above: A. Full flow testing of safety-related pumps on a quarterly basis. B. Pump suction pressure and its derivative Net Positive Suction Head (NPSH) while the pump is operating will be standard test parameters in addition to static suction pressure (pump shut down NPSH). C. Operational guidance for ensuring minimal pump miniflow operation since pumps are not specifically designed to operate for extended periods at miniflow conditions for normal operations. Miniflow lines are sized and instrumentation appropriately provided for verifying presence of miniflow. Amendment P 3.9-70 June 15, 1993 k
CESSAR nn"ication n O' f D. A Pump Maintenance Plan which will ensure the trending of all safety related pump test parameters. This program will , also provide a link between trended results and plant engineers responsible for pump operability and reliability ; so that problems may be identified and further analysis 1 maybe instituted. The Plan will also establish a safety-related pump disassembly / inspection program. The frequency and extent of disassembly of safety-related pumps will be based upon:
- 1. Historical performance of the pump to identify pumps which are prone to degradation / wear.
- 2. Analysis of trends of pump test parameters and service condition.
- 3. Analysis of pump components, such as "O-Rings," which are subject to aging.
3.9.6.2 In-service Testinc of Valves The In-service Testing program will include all active safety-related valves. Active valves are those valves which are ( required to perform a specific function in shutting down a N reactor or in mitigating the consequences of an accident. All valves requiring in-service testing in accordance with Section XI of the ASME B&PV Code are listed in Table 3.9-15 which includes testing requirements for each valve and the frequency at which testing will be performed. Typical testing configurations to support in-service testing of the valves are shown in Figure 3.9-16 and referenced in Table 3.9-15 where applicable. In addition to Section XI of the ASME B & PV Code, the following , provisions will be included as a part of the valve test plan for the valves specified above: A. Determination of the optimal test frequency of valves from a regulatory, design, vendor and engineering practicality standpoint. B. Programmatic use of appropriate non-intrusive diagnostic check valve testing technologies. C. For those valves which must operate under differential pressure to perform their safety function, tests are to be performed on an appropriate schedule in a manner which best replicates the postulated differential pressure. ( D. Categorization and appropriate testing of the following ( classes of Category A valves: Amendment N 3.9-71 April 1, 1993
CESSAR En'Jncuiw O
- 1. Pressure isolation valves -
valves that provide isolation of a pressure differential from one part of a system to another or between systems.
- 2. Temperature isolation valves - valves whose leakage may cause unacceptable thermal stress, fatigue, or stratification in the piping and thermal loading on supports or whose leakage may cause steam binding on pumps.
- 3. Containment isolation valves - valves that provide isolation capability for the piping systems penetrating containment.
E. A Valve Maintenance Plan which will ensure the trending of all safety related valve test parameters. This program will also provide a link between trended results and plant engineers responsible for valve operability and reliability so that problems may be identified and further analysis may be instituted. The Plan will also establish a safety-related valve disassembly / inspection program. The frequency of disassembly of safety-related valves will be based upon:
- 1. Historical performance of the valve to identify valves which are prone to degradation / wear.
- 2. Analysis of trends of valve test parameters and service condition.
- 3. Analysis of valve components, such as "O-Rings," which are subject to aging.
- 4. Analysis of non-intrusive testing results.
Oll Amendment N 3.9-72 April 1, 1993 I
LCESSARLinnficy,w a m kb
%f .l
.I TABLE 3.9-2 1 LOADING COMBINATIONS ASME CODE CLASS 1. 2. AND 3 COMPONENTS Design Loading (*) j Condition ' Combination ,
1 Design PD (b) PO+DW Level Level AB (Normal)b) (Upset) PO+DW 4 LevelC.(Emergency), 'P0+DW+DE Level D~ (Faulted) .P0+DW+SSE+DF -j' A O : 1 a) Legend: PD = Design pressure. , P0 = Operating pressure Dead weight DW = SSE = Safe Shutdown Earthquake DE = Dynamic system loadings associated with the emergency condition , DF = Dynamic system loadings associated with pipe breaks. (not eliminated by leak before break analysis) ; b) As - required by. ASME Code Section'. III, other loads, such as thermal-transient, and thermal gradient require consideration infaddition to -the primary ' stress. producing loads listed. SSE is considered . in equipment fatigue evaluations.in accordance with Section 3.7.3.2. h
-(/
.c) Loading Combination for Class l' Piping, Eq. 12a.
Loading Combination for Class 2/3 Piping, Eq. 10b. Amendment P June'15, 1993 l l r . 'i
CESSARn!L mu I i i
\
TABLE 3.9-10 LOADING COMBINATIONS FOR ASME SECTION III CLASS 1 PIPING Service Level Loadinc Combination Design Design Pressure, Weight, Other Sustained Mechanical Loads Level A Level A Transients, Weight, Operating Pressure, Thermal Expansion, Anchor Movements, Safe Shutdown Earthquake,1 Other Mechanical Loads, Dynamic Fluid Loads Level B Level B Transients, /"'N Weight, Coincident Pressure, ( d) Thermal Expansion, Anchor Movements, Safe Shutdown Earthquake,1,3 Other Mechanical Loads, Dynamic Fluid Loads Level C Maximum Pressure, other Mechanical Loads, Weight, Dynamic Fluid Loads Level D Maximum Pressure, Other Mechanical Loads, Weight, Safe Shutdown Earthquake, Pipe Break Loads, Dynamic Fluid Loads SSE SAMS (Full Range) Thermal TAMS,2 Thermal Expansion 2 NOTES: The dynamic loads are combined by the square root of the sum of the squares. 3 Alternatively, a lower level of SSE motion may be used in accordance with Section 3.7.3.2. f.3 2 Loading corr.bination for Eq.12a 3 Prirnary plus secondary stress producing load f%j) Amendment P June 15, 1993
~'
CESSARinancamr o
)
i
.i 5 (~~ %)
TABLE 3.9-11~ LOADING COMBINATIONS FOR ASME SECTION III CLASSES 2 AND 3 PIPING j l Service Level Loadina Combination
.'i Design Design Pressure, Weight Level A & B Design Pressure, t Weight, Other_ Occasional Loads (DFL, t
Wind) Thermal Expansion,
. Anchor Movements Level C Pressure, Weight, Other Occasional Loads ~(DFL, Tornado)- ,
t
\%
Level D _ Pressure, i Weight, DFL, Safe Shutdown Earthquake, 4pe Break,. l Ar" hor Movements 1, Theraal Expansion 1 l NOTES: ' Dynamic ~ fluid loads (DFL) are occasional
~
l [] loads such as safety / relief valve thrust, j steam hammer,-water hammer, or loads ' associated with plant upset or faulted condition as applicable. j l 1 Loading Combination for Eq. 10b .] l 5
.]
Amendment P j June 15, 1993
CESSAR EE%ncycu (saent 1 or 3)
,rh
(.,,
]
EFFECTIVE PAGE LISTING i
-l Table of Contents Pace Amendment i P il P iii P iv P v P vi p vi P vii P viii p ix P x P Text Page Amendment
[N . i, 3.9A-1 3.9A-2 P P 3.9A-3 P 3.9A-4 P 3.9A-5 P 3.9A-6 P 3.9A-7 P 3.9A-8 P 3.9A-9 P 3.9A-10 P 3.9A-11 P 3.9A-12 P 3.9A-13 P 3.9A-14 P 3.9A-15 P 3.9A-16 P 3.9A-17 P 3.9A-18 P 3.9A-19 P 3.9A-20 P 3.9A-21 P 3.9A-22 P 3.9A-23 P 3.9A-24 P 3.9A-25 P
,x 3.9A-26 P ,f, 3.9A-27 P 'u 3.9A-28 P 3.9A-29 P Ar,endment P l June 15, 1993 l
CESSAR H54inc 1cn (sneut 2 or 3) EFFECTIVE PAGE LISTING (Cont'd) O Text (Cont'd) Page Amendment 3.9A-30 P 3.9A-31 P 3.9A-32 P 3.9A-33 P 3.9A-34 P 3.9A-35 P 3.9A-36 P 3.9A-37 P 3.9A-38 P 3.9A-39 P 3.9A-40 P 3.9A-41 P Tables Amendment 3.9A-1 P Figures Amendment 3.9A-1 P 3.9A-2 P 3.9A-3 P 3.9A-4 P 3.9A-5 P 3.9A-6 P 3.9A-7 P 3.9A-8 P 3.9A-9 P 3.9A-10 P 3.9A-11 P 3.9A-12 P 3.9A-13 P 3.9A-14 P 3.9A-15 P 3.9A-16 P 3.9A-17 F 3.9A-18 P 3.9A-19 P 3.9A-20 P 3.9A-21 P 3.9A-22 P 3.9A-23 P 3.9A-24 P Amendment P June 15, 1993
CESSAR innnenen <sneet 3 or > (J EFFECJ'IVE PAGE LISTT_N_G (Cont'd) Fiqures Amendment 3.9A-25 P 3.9A-26 P 3.9A-27 P 3.9A-28 P 3.9A-29 P rx U l i i l O V Amendment P ! June 15, 1993 l
I CESSAR Eini"ic 13. l I
/'N. l i,
) !
l APPENDIX 3.9A SUPPLEMENTAL INFORMATION ON CRITERIA AND ANALYSIS OF SYSTEM 80+ DISTRIBUTION SYSTEMS
/%
i )
'x._./
(h I l l Amendment P i June 15, 1993 1
CESSAR M%"icm:u 73
\
TABLE OF CONTENTS APPENDIX 3.9A Section Subiect Pace No. 1.0 PIPING DESIGN 3.9A-1 1.1 GENERAL 3.9A-1 1.2 DESIGN CONSIDERATIONS 3.9A-1 1.2.1 PRESSURE 3.9A-1 1.2.2 GRAVITY 3.9A-1 1.2.3 THERMAL 3.9A-1 1.2.4 SEISMIC 3.9A-1 1.2.4.1 Seismic Anchor Movements 3.9A-2 /N 1.2.5 WIND / TORNADO 3.9A-2 L'') 1.2.6 FLUID TRANSIENT LOADINGS 3.9A-2 1.2.6.1 Relief / Safety Valve Thrust 3.9A-2 1.2.6.2 Water and Steam Hammer. 3.9A-2 1.2.6.3 Other Loadinas 3.9A-2 1.2.7 PIPE BREAK LOADS 3.9A-3 1.2.8 THERMAL STRATIFICATION 3.9A-3 1.2.9 MISSILE LOADS 3.9A-3 1.2.10 THERMAL TRANSIENTS 3.9A-3 1.3 DESIGN LOAD COMBINATIONS 3.9A-3 1.4 ANALYSIS 3.9A-3 1.4.1 GRAVITY ANALYSIS 3.9A-3 1.4.2 THERMAL ANALYSIS 3.9A-3
/~s i I 1.4.3 SEISMIC ANALYSIS 3.9A-4 LJ Amendment P i June 15, 1993
CESSAR Eannem:n i TABLE-OF CONTENTS (Cont'd) e! l i APPENDIX 3.9A Section Subject Eage No. 1.4.3.1 Static Analysis 3.9A-4
.i 1.4.3.2 Dynamic Analysis 3.9A-5
)
I 1.4.3.2.1 Response Spectrum Analysis 3.9A-5 1 1.4.3.2.1.1 General 3.9A-5 1.4.3.2.1.2 Response Spectrum 3.9A-5 1.4.3.2.1.3 Damping 3.9A-6 1.4.3.2.1.4 Modal Cutoff and Rigid Range 3.9A-7 Acceleration Effects 1.4.3.2.1.5 Modal and Direction Result 3.9A-7 Combination 1.4.3.2.1.6 Seismic Anchor Movements 3.9A-8 1.4.3.2.1.7 Fatigue 3.9A-8 1.4.3.2.2 Time History Analysis 3.9A-8 1.4.3.2.2.1 General 3.9A-8 1.4.3.2.2.2 Piping Dynamically Decoupled 3.9A-8 from the NSSS 1.4.3.2.2.3 Piping Dynamically Coupled 3.9A-9 to the NSSS 1.4.4 WIND / TORNADO ANALYSIS 3.9A-9 1.4.5 FLUID TRANSIENT ANALYSIS 3.9A-9 1.4.5.1 Safetv/ Relief Valve Thrust 3.9A-10 l l 1.4.5.2 Water and Steam Hammer Analysis 3.9A-10 j 1.4.5.3 Water and Steam Hammer Minimization 3.9A-10 1.4.6 PIPE BREAK ANALYSIS 3.9A-11 , 1 1.4.7 THERMAL STRATIFICATION 3.9A-11 1.4.7.1 Pioina Analysis 3.9A-11 1.4.7.2 Thermal Stripina Analysis 3.9A-12 e Amendment P ii June 15, 1993
(! h h k h ICATION i I ./ fN \ x/
) 1
\
TABLE OF CONTENTS (Cont'd) APPENDIX 3.9A Section Subiect Page No. , 1.4.8 SPECIFIC THERMAL REQUIREMENTS FOR 3.9A-12 CLASS 1 PIPING 1.4.9 EQUIPMENT NOZZLES 3.9A-12 1.4.10 HIGH ENERGY AND MODERATE ENERGY 3.9A-13 REQUIREMENTS 1.4.11 NON-RIGID VALVES 3.9A-13 1.4.12 EXPANSION JOINTS 3.9A-13 1.5 ANALYSIS TECHNIOUES 3.9A-14 1.5.1 MODEL BOUNDARIES 3.9A-14, [~'h 1.5.2 DECOUPLING 3.9A-14 1.5.2.1 General 3.9A-14 1.5.2.2 Branch Decouplina Criteria 3.9A-14 1.5.2.3 Seismic to Non-seismic Decouplina 3.9A-15 Criteria 1.5.3 OVERLAPPING 3.9A-16 1.5.3.1 General 3.9A-16 1.5.3.2 Overlap Criteria 3.9A-16 1.5.3.2.1 Restrained Elbow (or Tee) 3.9A-17 1.5.4 IN-LINE ANCHORS 3.9A-17 1.5.5 SUPPORT CONSIDERATIONS 3.9A-17 1.6 ACCEPTANCE CRITERIA 3.9A-18 1.6.1 ASME CLASS 1 PIPING 3.9A-18 gg 1.6.2 ASME CLASS 2 AND 3 PIPING 3.9A-18
\ \- /) 1.6.3 ALLOWABLE NOZZLE LOADS 3.9A-18 1
i Amendment P' iii June 15, 1993
CESSAR E!Ecm TABLE OF CONTENTS (Cont'd) O APPENDIX 3.9A Section Bubiect Pace No. 1.6.4 ALLOWABLE PENETRATION LOADS 3.9A-18 1.6.5 WELDED ATTACHMENTS 3.9A 1.6.6 FUNCTIONAL CAPABILITY REQUIREMENTS 3.9A-19 1.6.7 VALVE REQUIREMENTS 3.9A-19 1.6.8 EXPANSION JOINT REQUIREMENTS 3.9A-19 1.7 PIPE SUPPORT DESIGN REQUIREMENTS 3.9A-19 1.7.1 GENERAL 3.9A-19 1.7.2 DESIGN CONSIDERATIONS 3.9A-20 1.7.2.1 Deadweiaht Loads 3.9A-20 1.7.2.2 Thermal Loads 3.9A-20 1.7.2.3 Seismic Loads 3.9A-20 1.7.2.4 Dynamic Fluid Loads 3.9A-21 1.7.2.5 Wind / Tornado Loads 3.9A-21 1.7.2.6 Missile Loads 3.9A-21 1.7.2.7 ,Di.ne Break Loads 3.9A-21 1.7.2.8 dupport Stiffness 3.9A-21 1.7.2.9 Friction 3.9A-22 1.7.2.10 Support Gaps 3.9A-22 1.7.2.11 Support Mass 3.9A-23 1.7.2.12 Welded Pipe Attachments 3.9A-23 1.7.2.13 Minimum Desian Loads 3.9A-23 1.7.3 LOAD COMBINATIONS 3.9A-23 l Amendment P iv June 15, 1993 l l
~
l lhhhk!ah!R ICATICN ' i l
$/"' -l '
9s-T/L '
' TABLE OF CONTENTS.(Cont'd)
.t APPENDIX 3.9A l
Section Subiect Page No, j ~ 1.7.4 ACCEPTANCE CRITERIA 3'9A-23' 1.7.5 JURISDICTIONAL BOUNDARIES' 3.'9A-25': 1.8 POSTULATED PIPE BREAKS- 3.9A-25 1.8.1 CLASSIFICATION 3.9A-25 1.8.1.1 Uich Enercy 3.9A-25 1.8.1.2 Moderate Enerav 3.9A-26 1.8.2 POSTULATED RUPTURE LOCATIONS 3.9A 1.8.2.1 Break Locations in ASME Class 1 '.9A-26 3 , Pinina Runs
- d'. i I Break Locations in ASME C1 ass i
~
1.8.2.2 '3.9A-26 I and-3~-PiDina Runs 1.8.2.3 Break' Locations in-Non-safety 3.9A-26 Related Pioina-Runs : 1.8.2.4 Break Locations In Pinina Runs 3.9A-26 With-Multiple ASME-1.8.2.5 Break Locations 3.9A 1.8.2.6 Crack ~ Locations 3.9A-26 1.8.2.7 Pipina Near Containment Isolation 3.9A-26 Valves
)
1.8.3 POSTULATED RUPTURE CONFIGURATIONS 3.9A-26 : 1.8.3.1 Break Confiaurations .3.9A-26 1.8.3.2 Crack Confiaurations -3.9A-27 1.8.4 PIPE RUPTURE LOADS .3.9A-27 ] 1.8.5 PIPE RUPTURE ANALYSIS 3.9A-27' t 1.8.5.1 Dynamic Analysis of Pine Whio 13.9A-27 Amendment-P v . June 15,L1993 l l
CESSAR n.L"ICATl3N TABLE OF CONTENTS (Cont'd) O APPENDIX 3.9A Section Subiect Pace No. 1.8.5.2 Dynamic Analysis of Unrestricted 3.9A-27 Pines 1.9 LEAK-BEFORE-BREAK (LBB) 3.9A-27 1.9.1 DESIGN OF PIPING EVALUATED FOR 3.9A-27 LEAK-BEFORE-BREAK 1.9.2 PIPING DESIGN REQUIREMENTS 3.9A-27 1.9.3 PIPING DESIGN PROCEDURE 3.9A-28 1.9.4 PLANT AND PIPING DESIGN CONDITIONS 3.9A-28 1.9.4.1 Pinina Desian Parameters 3.9A-28 1.9.4.2 Leakaae Detection Systems (LDS) 3.9A-29 1.9.4.3 Consideration of Potential for 3.9A-29 Dearadation Sources 1.9.4.4 Consideration of Loadina Conditions 3.9A-30 1.9.5 CRITERIA 3.9A-30 1.9.5.1 Apolicability of LBB 3.9A-30 1.9.5.2 Detectable Leakaae Rate Reauirement 3.9A-30 1.9.5.3 Stability Analysis Acceptance 3.9A-30 Criteria 1.9.5.4 LBB Desian Criteria Development 3.9A-31 1.9.6 ANALYSIS 3.9A-31 1.9.6.1 Determination of Leakace Crack 3.9A-31 Locations 1.9.6.2 Flow Rate Correlation to Leakaae 3.9A-31 Crack Lenoth O Amendment P vi June 15, 1993
CESSAR H%ncari:n
,-~.
i-l TABLE OF CONTENTS (Cont'd) APPENDIX 3.9A section Subiect Face No. 1.9.6.3 Material Properties 3,9A-32 1.9.6.3.1 Stress-Strain Curves 3.9A-32 1.9.6.3.2 Material Resistance Curves 3.9A-32 1.9.6.4 Finite Element Model Description 3.9A-33 1.9.6.4.1 Geometry and Boundary Conditions 3.9A-33 1.9.6.4.2 Loadings 3.9A-33 1.9.6.4.3 J-Integral Calculation 3.9A-33' 1.9.6.4.4 Stability Evaluation 3.9A-33 1.9.6.5 LBB Pipina Evaluation Plots 3.9A-35 1.9.6.5.1 Constructing an LBB Piping 3.9A-35 Evaluation Diagram ['N 1.9.6.5.2 Using an LBB Piping Evaluation 3.9A-36 sa ) Diagram 1.10 TUBING 3.9A-36 1.10.1 GENERAL 3.9A-36 1.10.2 SUPPORT AND MOUNTING REQUIREMENTS 3.9A-36 2.0 HVAC DUCTWORK 3.9A-38 3.0 ELECTRICAL CONDUIT / CABLE TRAX 3.9A-39 4.O REFERENCES 3.9A-40
,/ 3
( 's.-) Amendment P vii June 15, 1993
CESSAR E!!Wncuio. LIST OF TABLES O APPENDIX 3.9A Table Bubiect 3.9A-1 Material Constants O O \ Amendment P viii June 15, 1993 j
mI LCESSARinnncoix l 1 1
.y^
q' LIST-OF FIGURES. ; APPENDIX 3.9A Ficure .Subiect l 3.9A-1 Response Spectra, . Direct' Vessel Injection Nozzle at -l the Reactor Vessel for CMS 3,' Soil Case B4, -X-Direction' ; 3.9A-2 Response Spectra, Direct: Vessel Injection Nozzle at" j the Reactor Vessel for CMS 3, Soil: Case B4, Y Direction- M 3.9A-3 Response Spectra, Direct Vessel Injection Nozzle at , the Reactor Vessel for. CMS 3, Soil.. Case B4, Z Direction -i 3.9A-4 Response Spectra, Shutdown Cooling Nozzle at the Hot . Leg for CMS 3, Soil Case B4, X Direction j 3.9A-5 Response; Spectra, Shutdown Cooling Nozzle at.-the Hot l ' Leg for CMS 3, Soil Case B4, Y-Direction . 3.9A-6 Response Spectra, Shutdown-Cooling Nozzle at the. Hot- , Leg for CMS 3, Soil Case B4,.Z Direction
'd 3.9A-7 Response Spectra, Main. Steam Line Nozzle at'the Steam {
Generator.for CMS 3, Soil Case B4, X-Direction '
.)
.3.9A-8 . Response Spectra, Main Steam Line Nozzle at the Steam "
Generator for CMS 3, Soil' Case B4, Y Direction' ;
.3.9A-9 Response Spectra, Main'SteamLLine Nozzle at the Steam: 'l Generator for CMS 3, Soil Case B4, Z Direction' '
I 3.9A-10 Restrained Elbow 3.9A-11 Restrained Tee j
'I 3.9A-12 LBB Design Criteria Development Diagram a 3.9A-13 Moment vs. Crack Length - Surge-and DVI, 12" Sch 160; 3.9A-14 Moment vs. Crack Length - Shutdown Cooling, 16" Sch 140 i 3.9A-15 Moment vs. Crack Length - Main Stream,-31" O.D.
3.9A-16 Moment vs. Crack Length.- Cold Leg, 35" 0.D. 3.9A-17 Moment vs. Crack Length Hot Leg, 49" O.D. Amendment-P j ix June 15', 1993- .j u z- :-
CESSAR ESL"icui:n LIST OF FIGURES (Cont'd) O APPENDIX 3.9A Fiqure _Subiect 3.9A-18 516 Stress-Strain PIFRAC 3.3A-19 516 Stress-Strain, Fit to Intermediate Strains 3.9A-20 316 Stress-Strain PIFRAC 3.9A-21 316 Stress-Strain, Fit to All Data 3.9A-22 Data Fit to PIFRAC Data No. 62, 516 Pipe Weld 3.9A-23 Data Fit to PIFRAC Data No. 20 and other Industry Data, GTAW Welds 3.9A-24 Overall Finite Element Model 3.9A-25 Crack Area Closeup of Finite Element Model 3.9A-26 Different Crack Lengths Used to Calculate Derivative 3.9A-27 Development of a Stability Evaluation Diagram 3.9A-28 LBB Piping Evaluation Diagram 3.9A-29 Use of the LBB Piping Evaluation Diagram O Amendment P x June 15, 1993
CESSAR 88&icmu ' o\ i V I 1.0 PIPING DESIGN 1.1 GENERAL Seismic Category I small and large bore piping, as defined in Section 3.2.1, is designed to meet the analysis requirements of the ASME Boiler and Pressure Vessel (B&PV) Code, Section III, Subarticles NB-3650, NC-3650, or ND-3650. Seismic Category II small and large bore piping, as defined in Section 3.2.1, is analyzed to ensure that the SSE does not adversely impact safety-related equipment or components. Category II requirements are normally satisfied by analyzing the piping to the same criteria as Seismic Category I, or ASME B 31.1. The analysis requirements described in this appendix apply only to Seismic Category I and II piping. 1.2 DESIGN CONSIDERATIONS 1.2.1 PRESSURE O The pipe wall thickness is sized to accommodate the specified k' internal pressures and meet the requirements of the ASME B&PV Code, Section III, Subarticle 3640. Stresses due to the system design pressures and maximum peak pressures are included in the acceptance criteria (see Section 1.6 of this appendix). 1.2.2 GRAVITY The weight of the pipe, in-line components, contents of the pipe and insulation are included. The weight of water during hydrostatic testing is considered for steam or air-filled lines. 1.2.3 THERMAL The effect of thermal expansion of the system due to the design temperature is included. Possible operating modes of the system that result in more severe thermal expansion stresses than the ; entire system at design temperature are considered. 1 The effects of anchor movement due to thermal expansion of l equipment or other piping are considered. i l 1.2.4 SEISMIC The effects of earthquake loading are considered. The inertia . loads and movements, including earthquake anchor movements, and I g N,_/
) the effects of fatigue are included in the analysis.
Amendment P 3.9A-1 June 15, 1993 l
CESSARnEN-1.2.4.1 Seismic Anchor Movements 0 Seismic anchor motion is included for piping supported by more than one structure by applying; 1) the building seismic movements, and/or 2) equipment seismic movements, as support movements on the pipe. The support movements are included in the most conservative combination for adjacent structures to give the maximum stress in the pipe, unless the relative time phasing of the motions of the supporting structures or equipment is determined by simultaneous time history analyses. The effects of seismic anchor motion on the piping are included for the safe shutdown earthquake (SSE). Seismic anchor movements of headers are also considered in the analysis of decoupled branch lines. 1.2.5 WIND / TORNADO Exposed piping is designed to withstand wind and tornado loads. Simultaneous wind and tornado loads are not considered. 1.2.6 FLUID TRANSIENT LOADINGS 1.2.6.1 B_elief/ Safety Valve Thrust Relief valve thrust loads are considered for both open and closed valve discharge cases. The relief valve thrust load is a function of the valve opening time, flow rate, fluid properties, and flow area. Loads are input as static loads in the piping analysis with appropriate dynamic load factors applied. Alternatively, a dynamic analysis is performed where the static analysis results in an overly conservative design. The analysis methods are discussed in Section 1.4.5 of this appendix. Where conditions exist which result in water or steam hammer effects, they are evaluated and identified for inclusion in the piping analysis. 1.2.6.2 Water and Steam Hammer . Water and steam hammer are dynamic loadings on piping that are caused by a sudden change in momentum of the flow medium due to a rapid system transient and are considered in the analysis. Typically, transients are caused by pump start or pump trip, filling a voided line, check valve actuation, relief valve operation, steam turbine trip, and rapid control valve operation. 1.2.6.3 Other Loadinas Other fluid transient loadings such as pump start, check valve , slam, pressure forces on unbalanced expansion joints, and filling empty lines are considered. Amendment P l I 3.9A-2 June 15, 1993
CESSAR Enneum /D v) t, 1.2.7 PIPE BREAK LOADS Pipe break loadings consist of pipe whip, jet impingement, differential pressure, support movements, or temperature increases resulting from the rupture of nearby pipes other than the line under consideration. Pipe break loads are considered. 1.2.8 THERMAL STRATIFICATION Piping subjected to stratified flow conditions are evaluated for the effects of thermal stratification. 1.2.9 MISSILE LOADS Piping subjected to the loads described in Section 3.5.1 are evaluated for the effects of missiles. 1.2.10 THERMAL TRANSIENTS Thermal transient loadings are considered in the analysis of ASME Class 1 lines. 1.3 DESIGN LOAD COMBINATIONS O Loading combinations, in accordance with Section 3.9.3.1, Q applicable to ASME Class 1 piping, are detailed in Table 3.9-10. Load combinations applicable to ASME Class 2 and 3 piping, are detailed in Table 3.9-11. 1.4 ANALYSIS Static and dynamic analyses, as defined in this section, are based on linear elastic analysis methods. 1.4.1 GRAVITY ANALYSIS The gravity analysis includes the weight of the pipe or piping component, the weight of the enclosed fluid, the weight of all other sustained mechanical loads, and the weight of any attached insulation. Also, if the system contents vary during operation, the analysis considers all modes of operation. Weight due to attached support / restraints is considered (see Section 1.7.2.12 of this appendix). 1.4.2 THERMAL ANALYSIS A thermal analysis of piping systems takes into account forces and moments resulting from expansion and contraction. For all analyses, the ambient temperature is 70"F. Flexibility analyses j are based on the material property values at the temperature v under consideration. Therefore, the analyses are be based on the Amendment P 3.9A-3 June 15, 1993
CESSARnaineww value of Young's modulus at temperature, E3ot. The ASME Code O requires that stresses be based on E,,1a. This is accomplished by multiplying the analysis results by Ecota / Enot . All possible operating modes are evaluated to determine the highest range of thermal expansion stress. The effects of anchor-movement due to thermal expansion of equipment or other piping are also considered. Lines with maximum temperatures less than 150*F which connect to equipment with thermal movements < 1/16 inch are not analyzed for thermal expansion. 1.4.3 SEISMIC ANALYSIS seismic analysis of a piping system generally are performed using both dynamic and static techtiiques. A dynamic analysis is performed to evaluate the inertia loads developed as the mass of the piping is accelerated due to seismic motion. The static analysis is performed to determine loading resulting from differential seismic movements of structures or large lines to which piping is attached. 1.4.3.1 Static Analysis The equivalent static load method involves the multiplication of the total weight of the equipment or component member by the specific seismic acceleration value. The magnitude of the seismic acceleration coefficient is established on the basis of the expected dynamic response characteristics of the component. Components that can be adequately characterized as a single degree of freedom system are considered to have a modal participation factor of one. Therefore, the acceleration value from the spectrum which corresponds to the- single degree of freedom frequency is used. Seismic acceleration values for multi-degree of freedom systems are determined by increasing the peak acceleration from the applicable amplified response spectra curves by a factor of 1.5 to account conservatively for the increased modal participation. If the equipment natural frequency is above the frequency corresponding to the zero period acceleration (ZPA), the seismic acceleration value is equal to 1.0 times the ZPA. The ZPA is the response spectrum acceleration in the rigid range of the spectrum. It corresponds to the peak acceleration of the input on which the response spectrum is based. The ZPA frequency is the lowest frequency at which the response returns to approximately the zero-period acceleration. The following points are considered in performing the analysis: A. Inertia loads are applied separately in the x, y, and z directions, and the results of the 3 separate analyses are combined by SRSS. The accelerations are obtained from the Amendment P 3.9A-4 June 15, 1993 I
CESSARn h a o) (w respective floor response spectra with values corresponding to the zero period. I B. The active supports are seismic supports, rather than gravity supports (i.e., seismic supports are active and low stiffness spring hangers inactive). 1.4.3.2 Dynamic Analysis 1.4.3.2.1 Response Spectrum Analysis 1.4.3.2.1.1 General P The response of a flexible system to seismic forces depends upon its natural frequencies and the frequencies of excitation. For these systems, it is necessary to know the natural frequencies, and the seismic excitation which is usually defined as acceleration response spectrum. To determine the system natural frequencies, each pipe is idealized as a mathematical model consisting of lumped masses connected by elastic members. In order to adequately represent the dynamic characteristics of the piping system, maximum lumped O mass spacing is determined based on simply supported beam natural (^ frequencies equal to the cutoff frequency. Using the elastic properties of the pipe, the flexibility for the pipe is determined. The flexibility includes the effects of torsional, bending, shear, and axial deformations. As a minimum, the number of degrees of freedom is equal to twice the number of modes with frequencies less th.n the frequency corresponding to the ZPA. Once the flexibility and mass of the mathematical model are calculated, the frequencies and mode shapes for all significant modes of vibration are determined. Piping stresses and displacements are then determined utilizing standard modal response spectra analysis techniques. 1.4.3.2.1.2 Response Spectrum A response spectrum is a curve which represents the peak acceleration response verses frequency of a single degree of freedom spring mass system which is excited by an earthquake motion time history. It is a measure of how a structural system with certain natural frequencies will respond to an earthquake applied at its supports. The response spectra curves for System 80+ have been developed using three control motion time history analyses. These analyses (p \] are used to cover a wide range of possible soil and foundation conditions. The resulting floor response spectra is used in one of the three options presented below. Amendment P 3.9A-5 June 15, 1993
CESSARnih mn Option 1: O This is the first option that is used in the design process. According to this option, broadening of the raw response spectra by 15% is initially performed for all soil cases. The envelope of the broadened spectra of all soil cases is then directly used in the design. This option is used wherever possible. Where excessive conservatism is introduced by using Option 1 in the design of some piping or components, Option 2, 3, or 4 is applied. Option 2: When this option is used, broadening of the raw response spectra by 115% is performed for all soil cases. Grouping of the sites is then performed according to site categories (a maximum of 2 or 3 categories is selected, e.g., soft sites, medium sites, and hard sites). Following the site grouping, an envelope of the broadened spectra for each category of sites is developed. The envelope of spectra of each category is then used in the design process. Option 3: Since the soil cases cover a wide range of sites and the peaks of the response spectra are broadened by il5%, it is expected that site specific spectrum with multiple peaks would be enveloped by the individual soil cases. Thirteen soil cases for three control motions were analyzed, resulting in 39 spectra covering the entire frequency range of possible amplification. If any secondary peaks of the site specific spectrum occurred at locations not completely enveloped by the soil cases analyzed, it would be in a region where there is no structural frequency. Since the peaks would not be amplified by the building, they would have no sig ificant effect on the piping design and can be neglected. Option 4: According to this option, the site specific response spectra for a 0.3 g Safe Shutdown Earthquake will be used for the design of all piping and components. The method for peak broadening and frequency shifting is detailed in ASME Code, Section III, Division I, Appendix N, Section N-1226.3. Alternate techniques for frequency shifting as defined by ASME B&PV Code Case N-397 is also used. 1.4.3.2.1.3 Damping Damping values are provided in Section 3.7.1.3 and Table 3.7-1. As an alternative to Table 3.7-1 damping values, variable damping Amendment P 3.9A-6 June 15, 1993
CESSARnninmm (~"N k
) l values in accordance with the requirements and limitations of the ASME Code Case N-411-1 are used in piping analysis. No combination of the two damping criteria is used. The variable damping curve is provided in Figure 3.7-41. Composite modal damping is used in the analysis in accordance with the procedure described in Section 3.7.2.15.
1.4.3.2.1.4 Modal Cutoff and Rigid Range Acceleration Effects The number of modes included in the analysis is chosen to correspond with the range of seismic excitation frequencies up to the frequency corresponding to the ZPA. At modal frequencies above the frequency corresponding to the ZPA, pipe members are considered rigid. The acceleration associated with these rigid modes is usually small. In certain situations the response to high frequency modes can significantly affect support loads, particularly axial restraints on long runs. To account for these effects, a missing mass correction is applied. To calculate the missing mass correction, the system is considered to be subjected to a unit steady-state acceleration. For this condition, the total inertial force at each mass, as well as the sum of the modal inertial forces for all modes used in the analysis, are C calculated. The difference of these inertial forces is then (~ multiplied by the ZPA and applied statically to the system. The resulting response is then added to the solution as an additional mode, conservatively accounting for the close-mode effect. This correction is made separately in each of the three directions. A similar technique is alternatively used to account for the missing mass effects of higher frequency modes. This method computes the missing mass based on summation of the fraction of mass at each degree of freedom (DOF) for all modes below the cutoff frequency. If the missing mass at any DOF exceeds 10 percent of the total for the DOF, the response of this missing mass at higher frequencies is considered. The method assumes the missing masses at the higher modes to respond in phase with each other and the ZPA, with the result that the additional force at each DOF is the product of the missing mass and the ZPA. 1.4.3.2.1.5 Modal and Direction Result Combination As stated in Section 3.7.3.7, the seismic response of each mode is calculated and combined with the other modal responses using the methods described in Regulatory Guide 1.92, " Combining Modal Responses and Spatial Components in Seismic Response Analysis". If the modes are not closely spaced (two consecutive modes are A defined as closely spaced if their frequencies differ from each (' ') other by 10 percent or less of the lower frequency), the results are combined by the square root of the sum of the squares (SRSS). Closely spaced modes are combined by one of the following Amendment P 3.9A-7 June 15, 1993 ; I
CESSAR 8!a%mou methods: (1) Grouping Method, (2) Ten Percent Method, or, (3) O Double Sum Method. The responses due to each of the three separate directions of seismic excitation are combined by SRSS. 1.4.3.2.1.6 Seismic Anchor Movements The effects of seismic anchor motion are considered in the
,ismic analysis by combining with SSE inertia by absolute mmation (ASUM). For models with piping in more than one suilding, it is assumed that the buildings move 180a out ' of phase. Movements within all buildings except the Reactor Building are assumed to be in phase. Within the Reactor Building there are differential movements between the Reactor Building, the Containment Vessel, Reactor Interior Structures, and the NSSS. These movements are assumed to act 180' out of phase. The resulting relative movement is applied as static support displacements with all dynamic supports active.
For branch line models at decoupled header locations, the header seismic anchor movements are run as separate load cases and the results are combined using the SRSS method. 1.4.3.2.1.7 Fatigue The cyclic load basis for fatigue analysis of the safe shutdown earthquake (SSE) for Class 1 piping systems is given in Section 3.7.3.2. 1.4.3.2.2 Time History Analysis 1.4.3.2.2.1 General Time history analysis is used as an alternative method to response spectrum analysis for any piping system. For those piping systems analyzed by time history methods, development of mathematical models, which define flexibility and mass, and calculation of natural frequencies and mode shapes, as described in Section 1.4 3.2.1.1 of this appendix, is first performed. i 1.4.3.2.2.2 Piping Dynamically Decoupled from the NSSS ; l Most piping systems are dynamically decoupled from the nuclear steam supply system (NSSS), following the guidelines of Section 1.5.2.2 of this appendix. The solutian of the differential equations of motion, which describe the dynamic response of a system to a seismic excitation, is obtained by the method of modal superposition or Amendment P 3.9A-8 June 15, 1993
CESSAR an'iincari:n 1 l l i (N , ( V) by the method of direct integrations, using time history I analysis. These methods are described in Section 3.7.2.1.1.2. The mathematical model is subjected to seismic excitations at the anchor points (terminal ends) and at building supports. For statistically independent earthquake motions, input excitations in all three translation directions and, as applicable, in all three rotational directions are applied simultaneously to the anchor points and building supports. Input of multiple time history excitations, which allow calculation of the effects of both differential motion and inertia, are used in a multiply supported system such as a piping system. An alternate time history method used, as described in ASME Code, Section III, Division I, Appendix N, Section N-1228.4, is to input an " envelope" time history excitation to calculate the inertia response, and separately to determine the effects of differential support motion using a static analysis. The ASME B&PV Code defines the envelope excitation as a time history whose response spectrum envelopes the response spectra for the individual support motions. 1.4.3.2.2.3 Piping Dynamically Coupled to the NSSS f~ k The only piping system that is dynamically coupled to the NSSS for the purpose of structural analysis is the main coolant loop piping. The main coolant loop piping is seismically analyzed as an integral part of the reactor coolant system structure, using methods described in Sections 3.7.2.1.2 and 3.7.2.6.2. 1.4.4 WIND / TORNADO ANALYSIS Exposed piping is designed to withstand forces generated by wind and tornados. Maximum wind speeds are given in Section 3.3. Tornado loads are based upon the NRC Staff interim position based on NRC Regulatory Guide 1.76, " Design Basis Tornado for Nuclear Power Plants". 1.4,5 FLUID TRANSIENT ANALYSIS Transient fluid dynamic loadings on piping are evaluated and the resulting loads included in the piping analysis. The loads considered are those significant loads due to transients caused by pump start or pump trip, filling a voided line, check valve actuation, relief valve operation, steam turbine trip, and rapid control valve operation. Potential loadings are evaluated and defined for each problem on a case-by-case basis. Multiple safety valve discharges are analyzed so as to maximize piping ; e stresses and support / restraint design loads except where another ' ( discharge sequence is justified. Amendment P 3.9A-9 June 15, 1993 l
CESSAR nnincua l l 1.4.5.1 Safety / Relief Valve Thrust O Safety / relief valves produce transient and steady-state loads on the valve inlet piping and discharge piping (if used). The thrust load, F, is a function of fluid type (water or steam) , operating pressure, and valve throat area. Relief valves cause both dynamic and static loading conditions. To simplify analysis, however, essentially all relief valve thrust loads are evaluated statically. Closed discharge and piped relief valves have an additional complicating factor since transient forces C.evelop at each intermediate turn in the piping during the initial phase when the flow along the pipe is being established. These transient loads are treated as dynamic water / steam hammer loads. As the transient phase ends, all of the intermediate forces cancel each other out, leaving only the steady state thrust force at the exit point of the fluid from the discharge system. For closed discharge systems, the steady state thrust force is zero at the valve outlet. Relief valve thrust loads are applied to the piping model as static loads with seismic supports active and a dynamic load factor applied to the loads. 1.4.5.2 Water and Steam Hammer Analysis Water and steam hammer are both dynamic loading conditions on the piping. Forcing functions, using actual time history analyses, are used in the dynamic analysis except where simplified conservative approximations of the forces are used in a static evaluation. Water and steam hammer are similar dynamic loading conditions on the piping produced by changes of momentum in fluid systems with fast actuating valves, rapid pump starts and stops, or water column rejoining. Water and steam hammer force time histories are usually developed using method-of-characteristics or other computer codes. These forces are reacted by the piping system. Piping systems are generally evaluated for water and steam hammer loading using time history dynamic solutions using the force time histories developed as input loading. When equivalent static fluid forces are developed and/or applied statically to the piping segments, the forces are applied in such a way as to not counteract the effect of each other, except in cases where simultaneous application of forces is justified. 1.4.5.3 Water and Steam Hammer Minimization Son Section 3.6.3. Amendment P I 3.9A-10 June 15, 1993 1 1
i CESSAR 8%"lCATCN l (g) LJ 1.4.6 PIPE DREAK ANALYSIS Pipe break loads are any loads that are applied to components or to unbroken pipe resulting from ruptures of nearby piping. Pipe break loadings include, but are not limited to, the effects of the following: pipe whip, jet impingement, differential pressure, temperature increase (localized or overall) , and support / anchor movement (including reactor coolant loop and containment vessel) . Effects of a ruptured pipe on other portions of itself are not considered except to demonstrate that a whipping pipe is restrained. In general, pipe break loads are defined for each piping problem on a case-by-case basis. These loads are applied as applicable to the appropriate piping problem. See Section 1.8 of this appendix for further details of postulated pipe breaks. Pipe break loadings due to two or more assumed pipe breaks are considered to act individually as separate events. 1.4.7 THERMAL BTRATIFICATION Piping systems subjected to stratified flow are evaluated for additional thermal stresses due so thermal stratification. Stratified flow exists when a hotter fluid flows over a colder (Q) V region of fluid. This condition induces a vertical thermal gradient, resulting in increased overall bending stresses and localized thermal gradient stresses. Stratified flow effects consist of (1) local stresses due to temperature gradients in the pipe wall and (2) additional thermal pipe bending moments generated by the restraining effect of supports on the stratified-flow-induced curvature of the piping. Structural evaluations are performed using elastic and/or simplified elastic-plastic analyses in accordance with the ASME Code considering the applicable loadings of Section 1.3 of this appendix in addition to the stratified flow loadings. 1.4.7.1 Pipinc Analysis The stratified-flow-induced curvature of the piping and local stresses due to a temperature gradient are obtained in two-dimensional finite element analyses. These analyses provide the local ef fects and pipe rotations for an unsupported pipe segment. A stratified flow thermal hydraulic model with the top half of the fluid at the hot temperature and the lower half of the fluid at the colder temperature is employed to determine the pipe wall temperature, based on the thermal hydraulic conditions. ivo-dimensional heat transfer and structural thermal stress analyses are performed in order to determine the rotations and local (q 4 stresses. Rotations are considered to act over all horizontal (/ portions of the pipe. The resulting bending stresses are calculated in the piping analysis by allowing the pipe to I Amendment P j 3.9A-11 June 15, 1993 l
CESSAR Mairicarian thermally expand unconstrained and by then applying a set of O equal and opposite displacements at the rigid support points. Local stress effects due to top-to-bottom thermal gradients are also considered to act over all horizontal sections of pipe. For Class 1 piping, gross bending stresses due to stratification are considered as secondary stresses, while local stresses due to thermal gradients are considered as peak stresses. 1.4.7.2 Thermal stripino Analysis Striping refers to the thermal oscillations that potentially occur at a hot-cold water interface. The striping phenomena at the interface of thermal stratification is postulated to have significantly contributed to feedwater fatigue cracking problems. A number of tests, experiments and analytical work (References 4.1 to 4.11) show that striping does not significantly contribute to fatigue usage. It is the stratification (top to bottom temperature differences) which is the major contributor to fatigue. The thermal striping effect on fatigue life is considered by determining the pipe wall metal temperatures in a 1-D finite element model caused by the oscillations in fluid temperature across the stratification interface region. It should be noted that the amplitude of the temperature fluctuation in the vicinity of the pipe wall is considerably smaller than the maximum top-to-bottom fluid temperature difference. The stresses due to the temperature gradient as a function of time are then determined. The striping stress range is then combined with the corresponding number of cycles for the stratified flow stress ranges, resulting in an alternating stress range, and an allowed number of cycles is calculated. 1.4.8 SPECIFIC THERMAL REQUIREMENTS FOR CLASS 1 PIPING The thermal analysis includes a check of the stress intensity range and an evaluation of fatigue (as expressed by cumulative usage) for all normal and upset operating temperature distributions, the transient events experienced in going from one operating mode to another, thermal anchor movements associated with the operating conditions and transients, and all test conditions. 1.4.9 EQUIPMENT NOZZLES The following effects of equipment nozzles are considered in the analyses and included where appropriate: e Equipment nozzle displacements and rotations
- Equipment nozzle flexibility I
i l Amendment P l 3.9A-12 June 15, 1993 l
CESSAREnMemeu i i ( k
- Nuclear Steam Supply System (NSSS) response spectra (where NSSS components are defined as the reactor vessel the steam generators, the reactor coolant pumps, the pressurizer, main coolant loop and surge line piping).
Typical response spectra curves at NSSS nozzle locations for Control Motion 3, Soil Case B4, (as defined in Section 2.5) are shown in Figures 3.9A-1 through 3.9A-9. Figures 3. 9A-1 to 3. 9A-3 are for the direct vessel injection nozzle at the reactor vessel; Figures 3.9A-4 to 3.9A-6 are for the shutdown cooling nozzle at the hot leg; Figures 3.9A-7 to 3.9A-9 are for the main steam lint nozzle at the steam generator. Equipment response spectra is not included for non-NSSS equipment. However, in some cases where equipment natural frequencies are below the ZPA cutoff, the mass and stiffness properties are incorporated in the seismic analysis. Normally for rigid equipment, an anchor is modeled at the nozzle interface as a termination point for the piping analysis model. In some instances, the stiffness model of the equipment is included in the piping model to more accurately calculate the nozzle loads in order to show compliance with allowables. 1.4.10 HIGH ENERGY AND MODERATE ENERGY REQUIREMENTS High and moderate energy piping systems are evaluated for postulated pipe breaks. Intermediate break locations are based on potential high stresses and fatigue limits determined by the piping stress analysis results. For the postulated pipe break evaluation requirements, see Section 1.8 of this appendix and Section 3.6.2. 1.4.11 NON-RIGID VALVES Normally, valves are specified to be rigid. Non-rigid valves (indicating that the valve has modes of vibration less than the corresponding frequency at ZPA) are identified by the applicable . valve seismic report. Both mass and stiffness effects of non- I rigid valves are conridered in the piping analysis. See the ; discussion in Section 1.4.3.1 of this appendix. I 1.4.12 EXPANSION JOINTS Expansion joints allow limited relative lateral and axial displacements and bending rotations between the ends of the joint, depending on the type of joint in use. Expansion joints are considered in the analysis. N Amendment P 3.9A-13 June 15, 1993
CESSAR nainCATIBM 1.5 ANALYSIB TECHNIOUES O 1.5.1 MODEL BOUNDARIES Piping models ideally run from anchor to anchor (equipment nozzle, or penetration). Where this is not feasible, the piping is separated by decoupling, overlapping, isolation, or in-line anchors ar described in the following subsections to form more manageable models for analysis. Where the piping cannot be separated to form smaller analysis models by these methods, the use of an intermediate anchor is considered in order to separate models, subject to the considerations of Section 1.5.5 of this appendix. 1.5.2 DECOUPLING 1.5.2.1 General Small branch lines are allowed to be decoupled from larger run piping regardless of seismic classification. In some instances, decoupling is also applied for in-line pipe size changes (such as at a reducer or reducing insert). In the description in Section 1.5.2.2, the smaller line is defined as the " branch" and the larger line is defined as the "run". To meet decoupling criteria, piping meets the size or moment of inertia ratios as detailed in the following paragraphs. For decoupling criteria to be meaningful, the branch line must be designed flexible enough to absorb the anchor motions of the run pipe. Therefore, the branch line flexibility is maintained by avoiding placement of branch line supports close to the run pipe. 1.5.2.2 Branch Decouplino Criteria Branch lines meeting the following criteria may be decoupled from the main run: (a) D3 / D, < 0. 3 3, or (b) Ib /I, < 0. 04, where D3 = Branch nominal pipe size D, = Run nominal pipe size Ib = Branch moment of inertia Ir = Run moment of inertia An appropriate stress intensity factor (SIF) is included on the branch and main run lines at the point where the piping is decoupled. Mass effects of the branch line are considered in the Amendment P 3.9A-14 June 15, 1993
l C E S S A R 8E nnenriou l 1 1 V analysis of the run line. The branch point is considered as an anchor in the analysis of the branch pipe. Thermal and seismic anchor movement analyses of the decoupled branch lines are performed with the thermal, seismic inertial, seismic anchor movement (SAM) , or pipe break movements of the larger pipe header , applied as anchor displacements and/or rotations to the smaller l branch line wherever these movements are significant. Piping is also decoupled at flexible hose wherever each interfacing analysis considers the flexible hose weight and significant stiffness, and wherever the flexible hose qualifies for the net end displacements of the interfacing analysis problems. Analysis results of the interfacing problems are not combined. The flexible hose is not allowed to experience loads beyond those recommended by the manufacturer. Also refer to Section 3.7.2.3.3 for general decoupling criteria. 1.5.2.3 Seismic to Non-seismic Decoupling Criteria Two methods for designing the region of a seismic /non-seismic piping interface are as follows: ( \ A. Use of structural anchors for isolation Structural isolation anchors provide an effective means of protecting seismic piping from the seismic response of non-seismically designed piping. Anchors are designed assuming that a plastic hinge forms at the interface with non-seismic piping. This usually results in extremely conservative anchor reactions. To make isolation anchors more practical, the anchors are designed to loads that can be reasonably expected result from a seismic event. One method which is used to design the anchors for reasonable seismic loads allows reactions based on a static uniform acceleration analysis of the non-seismic piping. This is possible where the non-seismic piping is routed and supported on seismic structures and where seismic response spectra are available. The static acceleration analysis apply the peak acceleration from the applicable response spectra with amplification factor of 1.5. For cases in which the non-seismic piping is not attached to seismic structures, it is difficult to ascertain the appropriate acceleration for the static analysis and this method is not applicable. In this case an analysis is performed to determine the peak accelerations or the anchor is designed for the worst case plastic hinge reactions. O Amendment P 3.9A-15 June 15, 1993
CESSAREnHnceu B. Use of isolation restraints O Piping restraints are utilized ia isolate the seismic response of non-seismically designed piping from seismically designed piping. Isolation restraints are designed as follows:
- One restraint located in each of the three orthogonal directions provides isolation by placing it in the direction of the significant contributing mass and by positioning the restraints to avoid pivoting. Where the restraints cannot be positioned to avoid pivoting, two restraints are used to form a couple to isolate the seismically caused pipe moments.
- An isolation restraint is designed for anticipated seismic loads. Alternatively, simplified guidelines such as loadings based on simple beam span tables are used to develop reasonable restraint loadings.
- The use of smaller safety factors are made in the restraint design. For example, the stress allowables given in ASME Section III NF for Level D loadings are used for qualification of seismic loads.
1.5.3 OVERLAPPING 1.5.3.1 General overlapping is used to separate seismically analyzed piping problems. Isolation of non-seismic piping from seismic piping is addressed in Section 1.5.2.3 of this appendix. Seismic piping that cannot be separated by decoupling as described in Section 1.5.2 of this appendix may be separated using an overlap region. Where an overlap region is used, an adequate number of rigid restraints and bends in three directions to prevent the transmission of motion due to seismic excitation from one end to the other is included. The following criteria is used for applying overlapping: 1.5.3.2 overlap criteria A section of piping can be considered an overlap region where the following criteria is met: A. The section contains a minimum of four (4) restraints in each of three perpendicular directions. If a branch is encountered, the balance of restraints needed beyond that point must be included on all lines joining at the branch. Amendment P 3.9A-16 June 15, 1993
CESSARn h o l l l
,r x '
l i (G B. A dynamic analysis of the overlap region must be made with pinned boundaries extended beyond the overlap region either to the next actual support or to a span length equal to the largest span length within the region. The fundamental frequency determined from this analysis must be greater than the frequency corresponding to the ZPA. The overlap region contains at least one change in direction to filter torsional effects. The overlap piping is included in all models adjacent to the overlap region. One axial restraint on a run is effective at each point of lateral restraint on that same run. Hanger design loads and movements in the overlap region are obtained by enveloping the results of all models adjacent on the overlap region. Pipe stresses and valve accelerations are checked in each separate analysis. 1.5.3.2.1 Restrained Elbow (or Tee) Where restrained elbows or restrained tees are used to terminate or separate analysis models, they meet the criteria of Figures 3.9A-10 and 3.9A-11, respectively. Results of all analyses are combined to obtain pipe stresses and hanger loads for the restrained elbow and restrained tee configurations. (O v j 1.5.4 IN-LINE ANCHORS An in-line anchor is a device restricting all six degrees of freedom, thereby isolating each run. In-line anchors are only used to separate piping models, if practical, based on the following considerations: A. Anchors could be impractical, especially on large diameter piping (>4" nominal pipe size, NPS) or on lines with high thermal and/or seismic movements. B. The addition of anchors can add terminal end break locations to high and moderate energy piping. C. The use of anchors can be limited by high piping thermal expansion loads or the practicality of the anchor design and installation. D. Anchor load results from seismically analyzed piping on both sides of an anchor are combined to obtain the design loads for the anchor. (For anchor loads at seismically analyzed to non-analyzed piping interfaces, see Section 1.5.2.3 of this appendix.) 1.5.5 SUPPORT CONSIDERATIONS
\
[Q The proper participation and orientation of restraint is included in the piping analysis. each support / Amendment P l 3.9A-17 June 15, 1993 l
CESSAR nainc-Participation is consistent with how the support type performs O during the loadings under consideration. Some loading conditions create pipe movements that affect the analyzed support orientation, such as vertical supports with large lateral thermal movements. The effects of such pipe movements on the analyzed support orientation are evaluated. 1.6 ACCEPTANCE CRITERIA 1.6.1 ASME CLASS 1 PIPING The allowable stress limits for the specified loading combinations for ASME Class 1 piping shown in Table ' 9-10 are . those of NB 3600 and Reference 4.12. 1.6.2 ABME CLASS 2 AND 3 PIPING The allowable stress limits for the specified loading combinations for ASME Class 2 and 3 piping are shown in Table 3.9-11 and Reference 4.12. 1.6.3 ALLOWABLE NOZZLE LOADS Equipment nozzle loads are minimized to be within equipment vendor specifications. The design nozzle load values are provided to equipment vendors as part of the procurement specification. 1.6.4 ALLOWABLE PENETRATION LOADS Piping systems are design such that loads and displacements on containment penetration assemblies, as shown in Figure 3.8-2, meet manufacturer's allowables. 1.6.5 WELDED ATTACHMENTS Per ASME Section III, Subarticle NC/ND 3645, external and internal attachments to piping are designed so as not to cause flattening of the pipe, excessive localized bending stresses, or harmful thermal gradients in the pipe wall. Such attachments are designed to minimize stress concentrations in applications where the number of stress cycles, due either to pressure or thermal effects, are relatively large for the expected life of the equipment. Local stresses due to all support loads acting on a welded attachment are evaluated and added directly to the nominal pipe stresses at the point of the attachment. The sum of the stresses are compared against the allowable stresses given in Tables 3.9-10 and 3.9-11. Methods for evaluating local stresses due to welded attachments are provided in ASME Code Cases N-318 and Amendment P 3.9A-18 June 15, 1993
CESSAR E!ninemw f V N-392. Methods and criteria are supplemented by NRC-approved PVRC and EPRI testing and research, l 1.6.6 FUNCTIONAL CAPABILITY REQUIREMENTS Section 3.9.3.1.4.2 C. requires that piping meet the allowable stress from the ASME Code of 3.0 S, but not greater than 2.0 Sy to satisfy functional capability requirements. 1.6.7 VALVE REQUIREMENTS Piping systems are designed such that valve accelerations meet the allowable manufacturer's requirements for seismic acceleration. In-lieu of specific values, reasonable generic seismic valve acceleration limits of at least i6g (for SSE conditions) and il2g (for water hammer type loads) are established. The design values are included in the procurement specification. The loads on supports attached to valve operators are also evaluated. The valve operator support does not support the pipe. 1.6.8 EXPANSION JOINT REQUIREMENTS Expansion joints are evaluated to ensure compliance with vendor allowables based on the stress report provided by the vendor. 1.7 PIPE SUPPORT DESIGN REQ _UIREMENTS 1.7.1 GENERAL Pipe supports are designed to meet the intended functional requirements of the stress analysis as well as the specified stress limits for the support components. Support components include typical structural steel members as well as manufactured catalog items for typical support components. Supports are idealized in the piping analysis as providing restraint in the analyzed direction while providing unrestricted movement in the unrestrained direction. Since the design . of supports cannot completely duplicate the idealized condition, supports are designed to minimize their effects on the piping analysis. Additionally, it is confirmed that the support design does not invalidate any assumptions used in the analysis of the piping system. In addition to loads defined by the stress analysis, any additional forces the support are subjected to are considered in the support qualification. b, V Amendment P 3.9A-19 June 15, 1993
CESSAR nai?ICATION 1.7.2 DESIGN CONSIDERATIONS O 1.7.2.1 Deadweicht Loads Gravity loads of the pipe are typically restrained by two types of supports. The piping analysis defines whether the support is designed as a rigid or flexible support. Flexible supports are specified when the pipe must be restrained for its gravity weight, however must remain free to move during thermal expansion. Vendor supplied spring components with specified spring constants are typically provided in this application. In addition to gravity loads from the piping analysis, the j deadweight of the support itself is considered in the support i I design. 1.7.2.2 Thermal Loads { Temperature changes within the pi ing system, including thermal ! stratification, cause the pipe to thermally expand. Thermal j loads are induced into supports which restrain the piping system l from being able to freely expand. Additional thermal loads could be a result of " anchor" displacements. Movements at the terminal end points of the piping system, such as branch lines and vessels, induce loads into supports which resist these movements. These forces are usually referred to as thermal anchor movements (TAM). All possible thermal conditions, including ambient thermal, are be evaluated when combining thermal loads with other load cases to obtain the worst loading on the supports. The pj pe also experiences radial expansion due to temperature increases. To minimize local stresses within the pipe, supports are designed to allow for this expansion. See Section 1.7.2.10 of this appendix concerning support gaps. Pipe supports are also evaluated for environmental thermal conditions. Temperature increases in the area around the support { cause the support itself to tend to thermally expand. In addition, local high temperatures can exist close to the pipe wall. Support elements which are subjected to these elevated temperatures are evaluated for thermal effects. Material property values consistent with the associated temperature are , used. l l Thermal expansion of the pipe support and/or the building I structure from which the support is attached is evaluated for its l effects on the piping analysis. 1.7.2.3 Seismic Loads The building response to earthquake motion causes seismic l acceleration of the piping system. Earthquake inertia forces are applied to supports that restrain the seismic movement of he Amendment P 3.9A-20 June 15, 1993
CESSAR EnWMCATION O V piping system. Additional seismic movements can be caused by seismic acceleration of terminal end points of the piping system such as branch lines and vessels. These forces are referred to as seismic anchor movements (SAM). The response of the support itself due to seismic acceleration is also evaluated. Typically, the inertia response of the support mass is evaluated using a response spectrum analysis similar to the piping analysis as described in Section 1.4.3.2.1 of this appendix. Damping values for welded and bolted structures are provided in Table 3.7-1, 1.7.2.4 Dynamic Fluid Loads Dynamic fluid loads are a result of fluid transients due to safety / relief valve thrust, water hammer, and steam hammer. These events are evaluated in the piping analysis. Supports are designed to meet the requirements of the piping analysis. 1.7.2.5 Wind / Tornado Loads Exposed piping and support structures are designed to withstand forces generated by wind and tornados. Wind and tornado loading
'N on the piping are evaluated in the piping analysis. The effects of wind and tornado on the support structure are also considered in the support qualification. Design wind speeds are provided in i Section 3.3.
1.7.2.6 Missile _ Loads Supports subjected to loads described in Section 3.5.1 are evaluated for the effects of missiles. 1.7.2.7 Pipe Break Loads The dynamic effects of pipe breaks on the piping system are considered in the piping analysis unless eliminated by leak-before-break (LBB) methodology (see Section 1.9 of this appendix). The effects of pipe whip, jet impingement, and temperature increases on the support structure are considered in the support qualification. 1.7.2.8 Support Stiffness Supports are modeled in the piping analysis by using the actual support stiffness values or by using rigid stiffness values. When the actual support stiffnesses are used, the flexibility of l all support components as well as the effects of the building ! s structure are included in the total stiffness value. l \ Rigid stiffness values are typically used; however, actual < stiffness values for flexible supports (e.g., spring cans) are Amendment P l 3.9A-21 June 15, 1993
CESSAR nai"lCATION included in the piping analysis. When rigid stiffnesses are O used, all supports in a given piping analysis are typically designed with a reasonably equal stiffness. This reduces the effects of load redistribution to stiffer supports due to the deflection of the more flexible supports. Since supports are usually modeled with one stiffness value for both directions of a support axis, supports are designed to have similar stiffnesses in both directions. Additionally, support stiffness in the unrestrained direction of the pipe are considered to minimize the effects of seismic inertia loading of the support mass. Rigid supports are designed to ensure that the stiffness of the supports do not affect the pipe frequency. Pipe support deflection limits are established and included in support design specifications when required. 1.7.2.9 Friction Temperature changes in the piping system causes movement in the unrestrained direction of the pipe. If the pipe is free to slide across a support, frictional forces are developed between the support surface and the pipe. The amount of frictional force developed is a function of the coefficient of friction of the sliding surfaces and the support stiffness in the direction of movement. Since friction is due to gradual movement of the pipe, such as thermal expansion, frictional forces are considered in the support design under combined deadweight and thermal loading only. Friction forces are applied in both directions of thermal expansion. To account for these forces, the friction force is calculated by using the smaller of CN or KX, where C is the coefficient of friction and N is the component of force normal to the movement and K is the stiffness of the support in the direction of X. Typical coefficients of friction are: 0.3 for steel to steel 0.1 for low friction slide / bearing plates Typically, frictional forces are neglected in the analysis of the piping system because supports are designed to minimize the effects of friction on the piping analysis. 1.7.2.10 support Gans Small gaps are provided for frame type supports built around the pipe. These gaps allow for radial thermal expansion of the pipe ) Amendment P 3.9A-22 June 15, 1993 l
l CESSAR HErlCATISN l i i l as well as allowing for pipe rotation. Total gaps of 1/8 inch or j less in the restrained direction are negligible and are ! considered to be zero in the piping analysis. 1.7.2.11 Support Mass 1 Typically, the mass of the support is not included in the piping analysis. Therefore, the weight of components supported by the pipe is limited to the extent possible. For example, spring supports include the weight of the components below the spring in the spring load setting, thus negating that part of the spring support weight that is supported by the pipe. However, due to the seismic response of the attached mass, supports which add substantial mass to the pipe are evaluated for the effects on the piping analysis. 1.7.2.12 Welded Pipe Attachments Welded attachments to the pipe wall are avoided where possible. However, certain design requirements such as anchors or axial restraints require the use of welded lugs or trunnions. All welded attachments require the evaluation of the local stresses induced into the pipe. Materials used as welded attachments are O t compatible with the piping material. 1.7.2.13 Minimum Design Loads In order to provide some uniformity in load carrying ability, all supports are designed to minimum loads. All supports are designed for the largest of the following three loads: e 100% of the Level A condition load from the piping stress analysis i e The weight of a standard ANSI B31.1 span of water filled, schedule 80 pipe
- Minimum value of 150 pounds i 1.7.3 LOAD COMBINATIONS Load combinations are in accordance with Section 3.9.3.1 and are detailed in Table 3.9-12. For common supports, the SRSS method for combination of dynamic loads is used.
1.7.4 ACCEPTANCE CRITERIA l 5 Pipe supports are either linear or plate and shell type devices. A linear type component support is defined as acting under essentially a single component of direct stress. Such devices Amendment P 1 3.9A-23 June 15, 1993
()l$!hbh[khk 0kbkFICAT10N 1 l 1 may also be subjected to shear stresses. Plate and shell type of 0' supports are fabricated from plate and shell elements and are normally subjected to a biaxial stress. Category I pipe support members are designed to meet the requirements defined in ASME Code, Section III, Subsection NF. For A500 Grade 5b tube steel, NF requirements are supplemented by the weld requirements of AWS D1.1, " Structural Welding Code." Category II pipe support members are designed to meet the requirements of the AISC Steel Construction Manual. Standard support manufactured catalog items are designed to meet the requirements 01 MSS-SP-58, " Pipe Hangers and Supports-Materials, Design and Manufacture." The application of catalog components is consistent with the manuf acturer's requirements and are designed to meet the manufacturer's load rated capacities for the items. Materials used for support devices are structural elements or standard components. Standard components include: snubbers, mechanical or hydraulic; constant or variable spring support hangers; rigid supports consisting of anchors, guides, restraints, rolling or sliding supports, and rod type hangers; sway braces and vibration dampeners; structural attachments such as ears, shoes, lugs, rings, clamps slings, straps and clevises; any other NRC approved devices. seismic limit stops Concrete expansion anchors are designed to meet the requirements of ACI-349, Code Requirements for Nuclear Safety Related Concrete Structures", with the following additional requirements and exceptions: A. A factor of safety acceptable to the NRC is applied to anchor allowables. B. Provisions are taken for anchor strength reductions when the anchor is located in the concrete tension zone. C. The failure cone angle used is consistent with recent test data for the specific application and acceptable to the NRC. D. Embedment length calculations for ductile anchors demonstrate a minimum factor of safety of 1.5 when determining the pullout strength of the concrete based on the minimum tensile strength of the anchor steel. Amendment P 3.9A-24 June 15, 1993
CESSAR nai"lCATION l (G E. The energy absorption capability (deformation capability I after yield) is considered for the anchor material and an anchor acceptable to the NRC staff for ductile applications is chosen. This assures that the design strength of concrete for a given expansion anchor or group of anchors is greater than the strength of the anchor steel, accounts for the effect of shear-tension interaction, and considers minimum edge distance and bolt spacing on expansion anchor capacity. Base plate flexibility is accounted for in the calculation of expansion anchor bolt loads. 1.7.5 JURIBDICTIONAL BOUNDARIES The jurisdictional boundaries are defined in ASME Section III, Subsection NF. 1.8 POSTULATED PIPE BREAKS 1.8.1 CLASSIFICATION 1.8.1.1 High Enerav O High energy piping systems are those systems or portions of systems that are maintained pressurized at either temperatures in excess of 200*F or at pressures exceeding 275 psig during any of the following normal plant operating modes. For systems containing process fluids other than water, the atmospheric boiling temperature is applied in place of the 200*F criterion.
- Reactor Startup
- Hot Standby
- Operation at any Power Level e Reactor Cooldown to Cold Shutdown Exceptions:
A. Non-liquid piping systems (air, gas, steam) with a maximum pressure less than or equal to 275 psig are not considered high energy regardless of the temperature. I B. Piping which operates at pressures and/or temperatures meeting high energy requirements is not considered high energy if the total time spent in operation at high energy l conditions is less than two percent of the time period
~
required to accomplish its system design function. C. Piping of one-inch nominal pipe size and less is not considered "high energy." Amendment P , 3.9A-25 June 15, 1993 l
CESSAR n!Mnce,, 1.8.1.2 Moderate Enerav O Moderate energy piping systems are those systems or portions of systems, that during any of the normal plant operating modes are maintained pressurized at a maximum temperature of 200*F or less and a maximum pressure of 275 psig or less including all piping excluded from high energy. Exceptions: A. Open-ended vents and drains are not considered moderate energy. B. Piping of one-inch nominal pipe size and less is not considered moderate energy. 1.8.2 TOSTULATED RUPTURE LOCATIONS 1.8.2.1 Break Locations in ASME Class 1 Pipine Runs See Section 3.6.2.1.4.1.A. 1.8.2.2 Break Locations in ASME Class 2 and 3 Pipina Runs See Section 3.6.2.1.4.1.B. 1.8.2.3 Break Locations in Non-safety Related Pipine Runs See Section 3.6.2.1.4.1.C. 1.8.2.4 Break Locations In Pipina Runs With Multiple ASME Code Pipinc Classes See Section 3.6.2.1.4.1.D. 1.8.2.5 Break Locations See Section 3.6.2.1.4.1.E. 1.8.2.6 Crack Locations See Section 3.6.2.1.4.1.F. 1.8.2.7 Pipine Near containment Isolation Valves See Section 3.6.2.1.4.1.G. 1.8.3 POSTULATED RUPTURE CONFIGURATIONS 1.8.3.1 . Break Conficurations See Section 3.6.2.1.4.2.A. Amendment P 3.9A-26 June 15, 1993
CESSARE!Knem
/-m
(%' ) 1.8.3.2 Crack Conficurations See Section 3.6.2.1.4.2.B. 1.8.4 PIPE RUPTURE LOADS See Section 3.6.2.2.2.1. 1.8.5 PIPE RUPTURE ANALYSIS 1.8.5.1 Dynamic Analysis of Pipe Whip See Section 3.6.2.2.2.2. 1.8.5.2 Dynamic Analysis of Unrestricted PiDes See Section 3.C.2.2.2.3. 1.9 LEAK-BEFORE-BREAK (LBB) 1.9.1 DESIGN OF PIPING EVALUATED FOR LEAK-BEFORE-BREAK The approach taken in the System 80+ design is to include LBB () ( ,) considerations in the piping design. One aspect of the LBB evaluation pursued for each selected piping system is the performance of a preliminary LBB evaluation prior to and independent of pipe routing. This evaluation is used to establish LBB acceptance criteria in terms of a range of NOP and maximum design loads for each piping system designed for LBB. An LBB piping evaluation diagram is established which is used to route, design and support the piping system within a range of design parameters. The COL applicant will confirm that the bases for the acceptance criteria are satisfied by the final as-built design and materials. System 80+ piping systems designed for LBB meet the requirements , defined oy the LBB Piping Evaluation Diagrams, which constitute l the crack stability acceptance criteria. The LBB Piping j Evaluation Diagrams are based on a defined set of piping design i parameters for each piping system. The five System 80+ piping I systems designed for LBB are listed in Section 3.6.3. I 1.9.2 PIPING DESIGN REQUIREMENTS Piping design parameters, including pipe size, base metal and weld material, and minimum detectable leakage crack length, form the basis for developing LBB acceptance criteria curves (i.e., the LBB Piping Evaluation Diagrams, PEDS). To demonstrate that f-' LBB acceptance criteria are met, the piping system is designed (N- such that the load at the highest stressed point for each material in the pipeline falls within the acceptance area on the evaluation diagram. Methodology for developing LBB Piping Amendment P 3.9A-27 June 15, 1993
CESSAR nainemon Evaluation Diagrams is discussed in Sections 1.9.6.4 and 1.9.6.5 O of this appendix. Piping design parameters used for developing the PEDS constitute piping design requirements for LBB for a specific pipeline. In addition to the criteria defined by the pipe specific PED, the five piping systems listed in Section 3.6.3 meet the LBB applicability criteria discussed in Section 3.6.3.1. NOP and maximum design loads are defined in Section 1.9.4.4 of this appendix. 1.9.3 PIPING DESIGN PROCEDURE The piping is routed, designed, and analyzed in accordance with the ASME Boiler and Pressure Vessel Code, and is evaluated for LBB using the criteria discussed in Section 1.9.2 of this appendix. As-calculated piping loads at the location of highest stress for each material type throughout the run of piping are compared to the LBB PED which is based on the set of design parameters for that piping system. 1.9.4 PLANT AND PIPING DESIGN CONDITIONS 1.9.4.1 Piping Desicn Parameters In piping design, fluid system requirements normally drive the selection of specific piping parameters. For System 80+ piping systems chosen for LBB evaluation, LBB considerations are integrated into the process of selecting those design parameters. Specifically, the design parameters for which LBB are considered include pipe size (cross-section), pipe and weld materials, loads and piping system thermal flexibility. The pipe and weld material are chosen considering LBB requirements, along with system, stress and f atigue requirements. Within the limitations of fluid system and ASME Code requirements, pipe and weld materials are selected which have good corrosion resistance, high yield and high toughness characteristics. Piping system thermal flexibility is governed by the stress requirements of the ASME Code and the duty cycle of loadings. The piping systems are routed such that they are sufficiently flexible to be able to thermally deflect without exceeding stress or fatigue limits and meet criteria for all load combinations associated with earthquakes (see Section 1.9.4.3). The approach in considering piping system thermal flexibility is to route the pipe subject to the thermal loadings, other NOP loadings, seismic loadings, and stress and fatigue limits. , Determination of bounding leakage crack lengths for a LBB ! l Amendment P 3.9A-28 June 15, 1993
CESSAR nnh,os l V evaluation is made on the basis of a range of NOP pipe loads that span the loadings for each pipeline evaluated. 1.9.4.2 Leakace Detection Systems (LDS) The various means of leak detection discussed in Section 3.6.3.3.1 support the requirements of the LBB evaluation even though they may not be designed specifically for LLB. Regulatory Guide 1.45 (Reference 4.14) requires a LDS capable of detecting a 1.0 gpm rate or less, independent of LBB requirements and NUREG-1061, Volume 3 (Reference 4.13) recommends a safety margin of ten (10) on the LDS capability. The LBB evaluation, however, depends on these " diverse measurement means", their diverse sensitivities and accuracies, which constitute the LDS, in order to correlate a crack length to a flow rate 10 times the leak detection capability. See Section 1.9.5.2 of this appendix for the detectable leak rate requirement for System 80+ LBB evaluations. 1.9.4.3 Consideration of Potential for Degradation Bources CESSAR-DC, Section 3.6.3.1, states the following: N Piping evaluated for LBB is first shown to meet the applicability requirements for NUREG-1061, Volume 3. The piping is designed to meet the requirement to be not particularly susceptible to failure from the effects of corrosion, water hammer or low and high-cycle fatigre, or degradation or failure of the piping from indirect causes. In order to meet the commitment of CESSAR-DC, Section 3.6.3.1, the LBB evaluation considers pipe and weld material selection, significant thermal modes of operation, the environment in which the piping is routed, and potential for water hammer within the particular fluid system, as each relates to potential for degradation of the pipe. Consideration of LBB is integrated into the process of selecting materials (for corrosion resistance), determining modes of operation (for reduction of loads from critical thermal transients), designing the piping system to preclude water hammer, and routing to minimize potential of failure of the pipe from indirect causes. Piping lines are evaluated for susceptibility to erosion, erosion / corrosion, erosion / cavitation, creep f atigue, cleavage type failure, and f atigue cracking. See Section 3.6.3.1 for discussions of consideration of degradation sources. /"' ( Amendment P 3.9A-29 June 15, 1993
CESSAREHL - 1.9.4.4 Consideration of Loading conditions 0 Loads due to NOP (dead weight, pressure, and normal steady state thermal conditions) are applied to the pipe section at each location selected for LBB evaluation (Section 1.9.6.2 of this appendix) to calculate a crack length that will result in 10 times the detectable leakage rate. A load consisting of pressure plus a small arbitrary moment and another, higher arbitrary NOP load, which together span the range of NOP loads of the pipeline, are considered in this crack length determination in order to generate a range of leakage crack lengths. NOP loads, critical thermal transients (including loads due to thermal stratification, SSE loads, and normal operation dynamic transient loads (such as from rapid valve closure), are considered in the stability analyses. The combination of the NOP load and the largest of the design loads (which is referred to herein as the " maximum design" load) is applied to the cracked pipe section in the stability analyses, along with the applicable load margin. 1.9.5 CRITERIA 1.9.5.1 Applicability of LB_B See Section 3.6.3.1 for discussions of LBB applicability with respect to consideration of degradation sources for the piping systems listed in Section 3.6.3. 1.9.5.2 Detectable Leakage Rate Requirement Per Regulatory Guide 1.45, the detectable leakage rate requirement of the leak detection system is 1.0 gpm or less. The leakage crack to be subjected to the crack stability analyses must leak at a rate ten times the capability of the LDS unless otherwise justified. Section 3.6.3.3 commits to these requirements of Regulatory Guide 1.45. The LBB evaluations of System 80+ primary side piping systems are based on a leak detection capability of 1.0 gpm, with a safety margin of 10. The LBB evaluation of the System 80+ main steam line inside containment is based on a leak detection capability of 1.0 gpm and a safety margin of 10. 1.9.5.3 Stability Analysis Acceptance Criteria ' Stability analysis acceptance criteria are given in Section 3.6.3.8. O l l Amendment p ! 3.9A-30 June 15, 1993 l
CESSAR n!MICATION O 1 b 1.9.5.4 LBB Design Criteria Development LBB acceptance criteria are developed for each of the selected piping systems using the procedure shown in Figure 3.9A-12. LBB evaluations are performed to establish LBB acceptance criteria in terms of NOP and maximum design loads for all locations determined in accordance with the selection criteria of Section 1.9.6.1 of this appendix. The LBB acceptance criteria are established in the form of an LBB Piping Evaluation Diagram ) (PED), which is utilized to route, design and support the piping ; system. The analyses done at the LBB design criteria development stage to create the LBB PED are performed using analytical methods of Section 1.9.6 of this appendix. The PED is further discussed in Section 1.9.6.5 of this appendix. The LBB PEDS are additional criteria to which the piping system is designed. Design of a piping system to the LBB requirements developed using the above approach assures that LBB has been demonstrated. Reconciliation with as-built piping system parameters will be made by the COL applicant by demonstrating (1) that the dimensional and material properties of the piping system is consistent with the parameters used in the development of the PEDS and (2) that the as-built piping responses meet the ASME Code allowables and the LBB PED criteria. 1.9.6 ANALYSIS 1.9.6.1 Determination of Leakage Crack Locations It is a regulatory requirement that LBB be applied to an entire piping system or analyzable portion thereof, typically segments located between anchor points. Locations of highest maximum design stresses are determined for each type of material present within the piping run in order to define the locations where the LBB evaluation is performed. 1.9.6.2 Flow Rate Correlation to Leakace Crack Length l l The leakage crack length for a required 10 gpm flow depends upon I the pipe loading, thermodynamic conditions and assumed crack surface roughness conditions. The [LATER) elastic-plastic estimation method (Reference 4.15) is used to find the crack opening displacement for a given loading, the [LATER) program is used to calculate the flow for a given crack length and loading. For the purpose of generating analysis data for PEDS, a plot of moment vs. crack length for a 10 gpm flow is made using [LATER). This is done for each of the pipelines being evaluated for LBB. [^ This provides the relationship between normal operating loads j (pressure + moment) and the crack length that gives a 10 gpm l flow. The moment vs. length curves for each of the pipelines j Amendment P 3.9A-31 June 15, 1993 i 1
CESSARM L e,. listed in Section 3.6.3 are shown in Figures 3.9A-13 to 3.9A-17. These are the crack lengths associated with 10 gpm flow for a given moment. An analysis using a longer crack at a given moment results in more than 10 gpm flow. 1.9.6.3 Material Properties Section 3.6.3.4 identifies materials used for System 80+ piping systems designed to LBB criteria. 1.9.6.3.1 Stress-Strain Curves The hot leg, cold leg and main steam line are typically fabricated from SA516 Gr. 70. The material stress--strain curve is taken from the Piping Fracture Mechanics Data Base (PIFRAC), NUREG/CR-4894 (Reference 4.16). The stress-strain data is shown in Figure 3.9A-18. The data shown in Figure 3.9A-18 is used in the finite element analysis. Figure 3.9A-19 shows the Ramberg-Osgood fit to these data. The Ramberg-Osgood material characterization is required for the [LATER] estimation method. The shutdown cooling, surge line, and DVI lines are typically fabricated with 316 stainless steel. A low strength 316 material is chosen from the PIFRAC data base, which bounds the stainless steel used in the System 80+ design. The stress-strain data is shown in Figure 3.9A-20. Figure 3.9A-21 shows the Ramberg-Osgood fits to these data. 1.9.6.3.2 Material Resistance Curves The material resistance curves (J-R) for each of the pipelines is taken from the PIFRAC data base. The J-R material curve use for the HL, CL, and MSL is for a SA516 Gr. 70, shielded metal arc weld (SMAW) and is shown in Figure 3.9A-22. A fit to the data used in the stability evaluation is also shown in the figure. This J-R curve bounds the material toughness behavior in any of these pipelines. In order to ensure that LBB is satisfied for the shutdown cooling, surge line, and DVI lines, which are relatively small diameter pipes, gas tungsten arc weld (GTAW) will be specified for all shop and field welds. The J-R material curve plotted in Figure 3.9A-23 for the shutdown cooling, surge line, and DVI lines. Industry data (References 4.16, 4.17, 4.18 and 4.19) were reviewed to establish the curve shown in Figure 3.9A-23 for GTAW welds. The lower bound data for GTAW welds were dcveloped for non-side-grooved data. A summary of material properties is given in Table 3.9A-1 for each of the materials used in these evaluations. Amendment P 3.9A-32 June 15, 1993
CESSARnub a k ...- i 1.9.6.4 Finite Element Model Description 1.9.6.4.1 Geometry and Boundary Conditions The finite element model for a typical leakage crack length in the pipe is shown in Figure 3.9A-24. Figure 3.9A-24 is a model for the surge line. A close-up of the crack tip area is shown in Figure 3.9A-25. The finite element model is simply a means for applying the pressure and moment loading to a section of pipe containing the hypothetical crack at some location in the pipeline. Since the crack is assumed to be aligned with the moment, a quarter symmetry model is used. The length of the pipe is chosen to be at least five (5) pipe diameters in order that the point of load application not be close to the crack tip region. The mesh uses 20 node isoparametric solid elements. Boundary conditions are imposed on the model based upon symmetry and crack location. The crack surface area is free from constraint. 1.9.6.4.2 Loadings The finite element model is loaded with internal pressure appropriate to the normal operating conditions of each piping p system. An axial end load traction, which when integrated over V) ( the pipe cross-sectional area, is equal to the continuity axial force, is applied to the far end of the pipe. Moments are applied as a linearly varying traction to the far end of the pipe. 1.9.6.4.3 J-Integral Calculation The J-integral is evaluated from the calculated energy release rate using the virtual crack extension method. A virtual crack extension generates a strain energy change which, when divided by the virtual extension, provides the energy release rate. The following is the basic definition of J-integral: J= x Where: du = Strain energy change (in-lbs.) da = Virtual crack advance (inches) t = Thickness (inches) 1.9.6.4.4 Stability Evaluation There are two aspects to the LBB fracture mechanics method of [ evaluating the stability of a piping system. For stable crack ( growth at each point of interest, Amendment P 3.9A-33 June 15, 1993
CESSAR 8lE*lCATION l (1) J tew < Jm7 O (2) dJt w/da < dJm7/da In order to simultaneously satisfy both equations, a cross plot of J and dJ/da for the loading and material curves is made. Each material J-R curve has a fitted analytical function and may be differentiated to find dJm7/da. In order to evaluate the derivative in the region of the leakage crack tip, three meshes are used. For a given leakage crack length "1" and model crack length at, the three meshes have crack length at-d, at, and a1+d. The value d is a length appropriate to the anticipated amount of stable crack growth. This is indicated in Figure 3.9A-26. These three meshes are used in the analysis of the leakage crack. Similarly, three more meshes are generated for the analysis of twice the leakage crack length, 2 at-d , 2 a1, and 2 a1+d . For each load step in the analysis, the loading curve as a function of crack length is fit to a quadratic: J(a) =Ca 2 3 +Ca+C 2 3 The values at a, a d provide the boundary conditions necessary to evaluate the constants C ,3 C, 2 and Ca. At each loading point, , the function is differentiated. This provides the dJ/da values for the loading curve. The material curves J(a), dJ(a)/da are evaluated at increasing crack extension. The loading functions J(a), dJ(a)/da are evaluated at either at or 2at, whichever cracklength is being evaluated. Each point on the J vs. dJ/da loading curve corresponds to a different load state. As long as the loading curve stays below the material curve, Jmt < Jm7
-AND-dJt w/da < dJm7/da and the crack growth is stable. For the case of increasing load, the loading curve will eventually intersect the material curve.
At this point the crack will experience unstable crack growth. At this point of instability, Jmt
=
Jm7
-AND-dJt m/da =
dJur/da Amendment P l 3.9A-34 June 15, 1993 l
CESSAREnib a l p) i J Development of the J vs. dJ/da diagram for determining points of instability is'shown in Figure 3.9A-27. 1.9.6.5 LBB Pipina Evaluation Plots 1.9.6.5.1 Constructing an LBD Piping Evaluation Diagram The method by which LBB Piping Evaluation Diagrams (PEDS) are constructed allows for the evaluation of the piping system in advance of the final piping analysis, incorporating LBB considerations into the piping design. The LBB PED is prepared prior to the piping design and aralysis and is used to evaluate critical points in the pipeline. The maximum design load at any time during the plant operation is the loading used in the stability analysis. Traditionally, this loading has been NOP+SSE. However, the combination of the NOP load and the largest of the design loads (i.e., the maximum design load) is used in the stability analysis (see Section 1.4 of this appendix). In the case of the surge line, for example, the line is evaluated for the larger of either NOP+SSE and for Stratified Flow (SF). For the discussion that follows, the maximum design load is considered to be the SSE load, and the loading combination is NOP+SSE.
' The LBB piping evaluation plot requires performing two complete LBB evaluations. The evaluations are for two NOP loads which span the typical loadings for the line under consideration. A completed typical diagram is shown in Figure 3.9A-28. The procedure used for generating that figure is as follows:
(1) Choose NOP = Pressure + NOP 1 (2) Determine a1 (3) Increase the analysis moment until the critical moment is found for at and 2a1 (4) Separate the critical analysis moment, M,c into the correct addition of SSE and NOP 1 proportion for the at and 2a3 evaluations. (a) Mc =
/7 (NOP1 + SSE1 ) (at Analysis)
SSE 1 =M c - NOP 1 1
-AND-(n\
Q ,)
\
l l I A.nendment P 3.9A-35 Jucte 15, 1993
CESSARE!Sinem (b) Me = (NOP3 + SSE ) 3 (2a1 Analysis) O SSE 3 = Mc - NOP 1 (5) Plot values from (4a) and (4b) at NOP . 1 This corresponds to the points labeled "1" in Figure 3.9A-13. (6) Repeat steps (1) to (5) for NOP 2. The results are shown in Figure 3.9A-28, labeled "2". Two stability evaluations are performed for each pipeline under consideration in order to complete the piping evaluation diagram. 1.9.6.E.2 Using an LDB Piping Evaluation Diagram Once the lines marking the acceptable areas of allowable piping loads are plotted as described in the previous section, normal operating piping loads and corresponding SSE values for the critical piping locations are plotted on the evaluation. diagram. The critical locations are selected as the highest stressed point for each different type of material in the line. Figure 3.9A-29 shows how the plot is used for a hypothetical' line. In this example, three points failed LBB and one point passed LBB. The reasons for each failure are given in the figure. The piping design can then be revised using the results: eg., lowering the SSE response load by rerouting or by adding a snubber; further review may result in other options for reducing the loads. 1.10 TUBING 1.10.1 GENERAL The same analysis and loading considerations that are used for piping are used for tubing. However, due to the amount of tubing, bounding analyses are performed to reduce the acceptance criteria to meeting applicable support criteria. This analysis method is also used for small-bore piping. These criteria apply to safety-related tubing. Non-safety related manifold valves, solenoid valves, and instruments located over or near safety-related equipment or components are supported using the same criteria, except where justified by analysis. This prevents damage, degradation, or interference with the performance of equipment required for safety functions. 1.10.2 SUPPORT AND MOUNTING REQUIREMENTS Two support mechanisms are used, free tube spans and tube track i supports. Criteria for each tube support mechanism are ' Amendment P 3.9A-36 June 15, 1993
CESSAR Einincarica p I G' determined as described above. The following are additional support and mounting considerations: A. Tubing that is routed in two or more Seismic Category I structures (i.e., Reactor Building, Containment, Main Steam Valve House, Nuclear Annex, Diesel Generator Building) are verified to have sufficient flexibility to allow for differential building displacements. B. Span lengths are chosen and supports and tube details are designed to accommodate heat tracing and/or insulation requirements. C. All reservoirs, valves, and other in-line components are independently supported. D. Movements of the root valve (SAM and TAM) between the pipe and the tubing are considered.
/'
(x b\ \v} Amendment P 3.9A-37 June 15, 1993
CESSAR 8!!n"lCATICN O 2.0 HVAC DUCTWORK AND SUPPORT / RESTRAINTS (LATER) O : l l l l l l l Amendment'P 3.9A-38 June 15, 1993
CESSAR HinnCAEN m 3.0 CABLE TRAY / CONDUIT AND SUPPORT / RESTRAINTS (LATER) O g\_ s Amendment P 3.9A-39 June 15, 1993
CESSAR E5Hricari:n
4.0 REFERENCES
O I 4.1 Bracshel, R., et. al., " Thermal Stratification in Steam Generator Feedwater Lines", ASME, J. Press. Vessel Tech., V 106, February, 1984, p. 78. 4.2 Hu, M. H., et. al., " Flow Model Test for the Investigation of Feedwater Line Cracking for PWR Steam Generators", ASME 81-PVP-4. 4.3 Fujimoto, T., et. al., " Experimental Study of Striping at the Interface of Thermal Stratification," ASME-AICHE 20th Heat Transfer Conference, August, 1981, p. 73. 4.4 Bejan, A., Tien, C. L., " Fully Developed Natural Convection Counterflow in a Long Horizontal Pipe with Different End Temperatures", Intl J Heat Mass Trans., V21, 1978. 4.5 Miksch, M., et. al., " Loading Conditions in Horizontal Feedwater Pipes of LWR's Influenced by Thermal Stratification Ef f ects", Nuclear Engineering & Design, V84, 1985. 4.6 Dhir, K., et. al., "A One Dimensional Model for the Prediction of Stratification in Horizontal Pipes Subjected to Fluid Temperature Transients at the Inlet", Nuclear Engineering & Design, V107, 1988. 4.7 Bamford, W. H., et. al., " Fatigue Crackgrowth in Pressurized Water Reactor Feedwater Lines", ASME, 81-PVP-2. 4.8 Thurman, A. L., et. al., "3-D Finite Element Analysis for the Investigation of Feedwater Line Cracking in PWR Steam Generators", ASME-PV-3. 4.9 Woodward, W. S., " Fatigue of LMFBR Piping Due to Flow Stratification", ASME 83-PVP-59. 4.10 Choe, H., et. al., " Turbulent Temperature Fluctuation and Heat Transfer to a Metal Surface Resulting from the Mixing of Cold and Hot Water", ASME-79-WA/HT-23. 4.11 Wolf, L., " Experimental Results of HDR-TEMR Thermal Stratification Test in Horizontal Feedwater' Lines." 4.12 NRC Letter of September 11, 1992, " Safety Evaluation on the Use of a Single Earthquake Design for Systems, structures and Components in the ABWR", Docket 52001. j 4.13 NUREG-1061, Volume 3, " Evaluation of Potential for Pipe Breaks", November 1984. ' l Amendment P 3.9A-40 June 15, 1993 l l
CESSAR nairicum 1 l \qv) 4.14 USNRC Regulatory Guide 1.45, " Reactor Coolant Pressure Boundary Leakage Detection Systems", Revision 0, May 1973. 4.15 "An Engineering Approach for Elastic-Plastic Fracture , Mechanics", Kumar, V., German, M.D., Shih, C.F., NP-1931. I 4.16 Hiser, A.L. and Callahan, G.M., "A Users' Guide to the NRC's Piping Fracture Mechanics Data Base (PIFRAC)," NUREG/CR-4894 (MEA-2210), Materials Engineering Associates, Inc., Lanham, Maryland, May 1987. 4.17 Horn, R.M., et. al., " Evaluation of the Toughness of Austenitic Stain.lcss Steel Pipe Weldments", EPRI NP-4668, Electric Power Research Institute, Palo Alto, CA, June 1986. 4.18 Wilkowski, G.M., et. al., " Analysis of Experiments on Stainless Steel Flux Welds", NUREG/CR-4878 (BMI-2151), Battelle's Columbus Division, Columbus, OH, April 1987. 4.19 Wilkowski, G.M., et. a1., "Short Cracks in Piping and Piping Welds", NUREG/CR-4599 (BMI-2173), Battelle's Columbus Division, Columbus, OH, April 1992. N) Amendment P 3.9A-41 June 15, 1993
e hhk R FICATl:N ! l ,[ g
- x. /
TABLE 3.9A-1 MATERIAL CONSTANTS
- 1. SA516 Gr. 70 (Hot Leg, Cold Leg, Main Steam Line)
Finite Element Analysis (from PIFRAC Data Base) Modulus, E = 27.7 x 106 psi Yield = 33,930 psi Work hardening slopes derived from data shown in Figure 3.9A-18. Ramberg-Osgood Constants ao = 33,390 a = 2.18188 y = 4.07898 [~N 2. Stainless 316 (Shutdown Cooling, Surge Line and Direct () Vessel Injection) Finite Element Analysis (from PIFRAC Data Base) Modulus, E = 27.7 x 10' psi Yield = 24,143 psi Work hardening slopes derived from data shown in Figure 3.9A-20 Ramberg-Osgood Constants ao = 24,143 a = 5.77854 y = 3.84756 / ) L) Amendment P June 15, 1993
j"K V - 100.
~
t i r
- 50. ].
I \
\
}' \s ,
g r
) I%
z _._ _ i 1- ; 5
.a e-m m
/ -
8 / V W / '
/
/ -
0.1 ,/ :
/
I '
/
/ , ,
t 0.01 , d a J S S FREQUENCY (CPS) ; RVDI N0ZZLES X DIRECTION SYS80+ S0ll CASE B4-S3 OAMPING N411 , Amendment P June 15,1993 ' Figure
/
/ RESPONSE SPECTRA, DIRECT VESSEL INJECTION NOZZLE AT AFJf4 / / u THE REACTOR VESSEL FOR CMS 3, SOIL CASE B4, X DIRECTION 3.9 A-1.
.,. , - . . ~
O 10. I l k ( \ t F i %_
$* 1"
/
z
/
)
\
\l~j v
S 5 / e / U
/
0.1 f
/
g
/
/
/
/f 0.01
- . a o d 3 3 FREQUENCY (CPS)
RVDI N0ZZLES Y DInECTION SYS00+ SOIL CASE B4-S3 DAMPING N411 Amendment P June 15,1993 - TM - RESPONSE SPECTRA, DIRECT VESSEL INJECTION NOZZLE AT Figure JFA / u THE REACTOR VESSEL FOR CMS 3, SOIL CASE B4, Y DIRECTION 3.9A-2
.~ , - - ., . . -.
'l i
'Q/
- 10. -!
fl 2- ' 1 m 5 i li
, i
\
e
~
f \ / I 1
/ \ / \ \
z ( \ -}
% s-, ;;;
1 7 O /
!5 s d l 8* /
/
N 0.1 i r
/
/ :
/ :
/
r i
}
J
/ i 0.01
- . 6 a J S S i
FREQUENCY (CPS) RVOI N0ZZLES Z DIRECTION SYS80+ SOIL CASE B4-S3 OAMPING N411 _ - Amendment P June 15,~1993
~
TM RESPONSE SPECTRA, DIRECT VESSEL INJECTION NOZZLE AT : Figure 3FJ / u THE REACTOR VESSEL FOR CMS 3, SOIL CASE B4, Z DIRECTION 3.9A-3
10. O R h h j L 1, f L A 5 g- , r-m f l V 5 s 1 r a
/
u w / 0.1 / l O i
/
/
/
/
0.01 a 6 J S S FREQUENCY (CPS) SHUTOOWN COOLING N0ZZLE X DIRECTION SYS00+ SDIL CASE B4-53 DAMPING N411 c Amendment P _ June 15,1993 RESPONSE SPECTRA, SHUTDOWN COOLING NOZZLE AT THE Figure jff HOT LEG FOR CMS 3, SOIL CASE B4, X DIRECTION 3.9A 4
, , - - . .~ . .. .
. . . . 1 t.) '
- 10. j r '
.1 T
l F (\ g, ._____ , r I w'% % _
$ ( .g , [
z ) \}V . O
- /
F a / tu / 8
* / 7 0.1
/ ,
j
\ ,
,/ s
/
/
/
/I .
0.01
-- d a J S S FREQUENCY (CPS) :
SHUTDOWN COOLING N0ZZLE Y DIRECTION SYS80+ SOIL CASE B4-S3 DAMPING N411 _ Amendment P June 15,1993 TM RESPONSE SPECTRA, SHUTDOWN COOLING NOZZLE AT THE Figure AFA / u HOT LEG FOR CMS 3, SOIL CASE B4,-Y DIRECTION 3.9A ,
O 10. l O i i 8 I L
'- i 1 1
I 1 1 1 e e \ l \m ~~ l
~
f L i l = f \ r' i S -e E / 5 ? d / N / i 0.1 ,
/ .
/
/
/
/ i J
I l 0.o1 J e . *b::)$ _
$ d 3 U ,_ 8 s FREQUENCY (CPS)
SHUTDOWN COOLING N0ZZLE Z DIRECTION SYS80+ 50ll CASE B4-53 DAMPING N411 Amendment P _ June 15,1993
/ RESPONSE SPECTRA, SHUTDOWN COOLING NOZZLE AT THE Figure
/ u JFATE / / HOT LEG FOR CMS 3, SOIL CASE B4, Z DIRECTION 3.9A-6
gy ( ) \.__,/ 10. I i
,1 l A
\
l
< (a
- 1. .
)
/
5
~
m , -l e-m f' V
$ [ Y 4
/
r 5 r'
/
d a
< /
j- ^ 3 (m.- ) 0.1 , 1
/
/
/
/
/
/
0.01 o o - 3 3 FREQUENCY (CPS) MAINSTEAM OUTLET N0ZZLE X DIRECTION SYS80+ SOIL CASE B4-S3 DAMPING N411
- Amendment P June 15,1993 TM RESPONSE SPECTRA, MAIN STEAM LINE NOZZLE AT THE Figure jff / u . STEAM GENERATOR FOR CMS 3, SOIL CASE B4, X DIRECTION 3.9A 7
l l l O, 100.
- 10. j i \
\
i \ el 5 Ei i N
, N a '
/
y 1. j tr -
,r \)
0 ,
' v I
N
/
/
0.1 1 l l a
/
/ _
/
.f 0.01
- c5 o J - ?,
FREQUENCY (CPS) MAINSTEAM OUTLET N0ZZLE Y DIRECTION SYS60+ S0ll CASE B4-53 DAMPING N411 Amendment P _ June 15,1993 RESPONSE SPECTRA, MAIN STEAM LINE NOZZLE AT THE Figure JF4 / u STEAM GENERATOR FOR CMS 3, SOIL CASE B4, Y DIRECTION 3.9A-8
! ) ( ,,/ 10. 1. ['t , "-i[ t I i J V \ g i ,\ / I g I' \ / T 1 \'d-l
\,
5 64 } H f
$ /
'i e u l M /
/^N 0.1 ( ) / l
- x. _.-
/
/
3
/
]
/
/
0.01
" o O e 3 3 FREQUENCY (CPS) 1 i
MAINSTEAM OUTLET N0ZZLE Z OIRECTION SYSBO+ S0ll CASE B4-S3 OAMPING N411 Amendment P June 15,1993 3FI, /Y. RESPONSE SPECTRA, MAIN STEAM LINE NOZZLE AT THE STEAM GENERATOR FOR CMS 3, SOIL CASE B4, Z DIRECTION Figure 3.9A-9
O i . a u 7 , , R2 R2 4_ O Dimensions R, and R2 are defined as follows: Nominal Minimum Maximum g, 6" Weld Clearance 6" g, U4 U8 UA Where: L = ASME B31.1 Recommended Support Span per Table 121.5. Amendment P June 15,1993 m Figure RESTRAINED ELBOW 3.9A-10
en V(
</
>Q R ,x x R '
0 xx - P Dimensions R,and 2 2are defined as follows: Nominal Minimum Maximum R, 6" Weld Clearance 6" R2 U4 U8 U4 i Where: L = ASME B31.1 Recommended Support Span per Table 121.5. , l - Amendment P June 15,1993 1
i SELECT SELECT SELECT PIPE LEAK DETECTION PlPE SIZE SYSTEM CAPABILITY MATERIAL U 10 x LDS CAPABILITY c SELECT If SELECT LOW 4 - F HIGH NOP LOADS NOP LOADS lf if DETECTABLE DETECTABLE LEAKAGE LEAKAGE CRACK CRACK (DLC) l' 'T II lf DLC 2 x DLC U V If U LOAD LOAD J-a J-a CURVES CURVES VU V U MATERIAL J - dJ/da # J-a p J - dJ/da CURVES CURVES CURVES U If Vlf LDB PIPING MAXIMUM MAX. LOAD /VE = EVALUATION 1 LOAD DIAGRAM NOP LOAD vs. MAXIMUM DESIGN LOAD Amendment P
^
June 15,1993 f LBB DESIGN CRITERIA DEVELOPMENT DIAGRAM ,
1 y (y.)- ; E 1.6 i i l i 1 I I I k I i i i i,
~
I I ( l l 1 -I 1 _ l 1 i l 1 i i 1 l 12 - ---------- -----------'-----------i-----------L-'------------
- 1 i l I
@ - I i 1 1 1
W - i 1 i i i i I' x - l l l l : 9ja _ i l i i i l i I T .8- -----------i---------- , ----------l------------f------------ 5 _ i i l 1 l l l l O 8 E O 22 -
~
1 i I l 1 i I I i I I i i.
.4-
------------l------------l------------l-----------V-----------
i .i i i I' I i
- 1 I l I i 1- 1 i 1 I .l .I l
~
1 i i- i l i 1 1 1 I t i 0 I I i l l 4 I l 1 1 I [. 4. 4 I j l l .A 3 .4 5 6- 7. 8 -< Crock. Length (h) l l 1 i l _ Amendment P June 15,1993 -
.w ..
MOMENT vs. CRACK LENGTH - SURGE AND DVl,' ' Figure
'JFJ / U 12" SCH 160 3.9A-13 a
f 9 6 i 1 i e i l l ! I L
- 1 I 4 1 1 3 I i I l 8 1 i i l 5-- --------5-------- J---------i--------- L-------- L---------.
I I I t i i l 1 1 1
- 1 I e i i i l i ! l U} I I I i i f, 4_.----- -_2---_---_a_-___-___i__________t_________t_________.
I t i ; i i I I i l x - 1 I I i Q l i i I 1 l 4 l i l 3- -------- J---- ---J---------'---------'--------L---------< i i i i i
- l N, :
I i 4 i i 2-- --------J--------J----- i i
- - '- - - - - - - - - L - - - - - - - - L _ _ _ _ _ - _ _.
i i i 2 i i % i i _ i e i N, i i l i i l 1 i i i l 1 1- ---------j----------l----------l---------,--------}---------. I I l i t i i i i i
, X, I I i i 1 0 i i i i i i i i i l i 15 2.5 3.5 4.5 5.5 6.5 7.5 Crack Length (in)
Amendment P June 15,1993 TM Figure JFJ / MOMENT vs. CRACK LENGTH - SHUTDOWN COOLING, 16" SCH 140 3.9^-14
. _. . . . - , ~ _ _
J i
'l I /3 k.)
t 4 t 4 6 E 20 i i i .; 1 I -1 = l l l f i I ; i i i " _ i i i l' I 15 - -------------'--------------'--------------i t
'--------------- i O I i i l i I
' i 9 - i 1 i 1 i x _ i i 1 i i i 1
^ ,
l i
$ ~
N i I
. 10 - - - - - - - - - - - - - -
l l l - 1 1 1
~
l 1 1 1 1 I i 2 ' i ! ) 5- ------------'- J_______________l__ , ____________F_____________ . i _ i i 1 1 1 1 I i l 1 i i l 1
~
i 1 -. I l i I 0- ' ' ' - i i i i i i i ; .i i 8 11 14 17 20 CrackLength(b) l l
.1 1
1 1
.l i
L a Amendment P . i June 15,1993 i y w MOMENT vs. CRACK LENGTH - MAIN STEAM, Figure Jg /
- 31" O.D. 3.9A-15 l
.? e -- - +. W m
O 45 4 1 , g g ,
- 1 I i i j 3 I I I 4 1 3 40- - - +N - - - ' - - - - _ - _ '- _ - - _ _ _ _ a _ _ _ _ _ _ _ _ t _ _ _ _ _ _ _ _i_ _ _ _ _ _ _ _ a _ _ _ _ _.. _ _.
i i i i i ,
- i i i i i i I I I i l ;
_L________!_______a________t________i________a________, 35 - ----__ ' i i i i
~ I I I i a g) d 30 - ------ -
\-----l'----____________h________l________j________.
, i i i , i x -
i I n m 25 - -----_- '--- \_ I l I l h - ! \'____---_a________t________t._______a____ l l l 5 20- --------h-------!h---_$,_-______[________!,________j________. t i i 5 l 5 15 - ---- -- '-------'-----__-(____-___[,________,________j________ , m , ; 1 i i I I I i i : 10 - -------L--------l-__-____q-______L________l________J________. l l g , i l i 1 8 i I a t_______J._______, 5- -------',--------'------_q________L______ i ! i i i 0 i ' ' I i i i i i i i i i i i # i i g i i i ; i i i 3 4 5 6 7 8 9 10 Crack Length (in) Amendment P June 15,1993 MOMENT vs. CRACK LEtJGTH - COLD LEG, gure
, . - - , - - ., . . . . - + . , . , .a . . . , ~ . . . - .~
' I. .
t l
,i / '
- +
\ ,
r 6
-l
'.?
-f
'I b
I 10 0 - I l I i i i
~
l'
~
l ! 1 1 1 4 1 I l I i i l -I l 1 i .I I 1 1 e i 1 1 i i i ! -i + 80- ---- I
---------J-------L--------'--------J_____.
I I I I i I i l I e i _ l i l i I O i i 1 I ~
! ; l' 'I l '
i i i i t 9 _ l .
'I i i i 1
-------'---'----l---------l--------E---------E-------4---------
3 x 60 - r !
$7 - 1 I
1 1 I I i ,
~ I I I 1 1 l i l I i 1. t
- I l- 1 1' 1 h- ,,,
I~ l l 1 1 1' l-
i f f I 40- --------*---------Ii---- ---4--------l---------i---------l--------- ,
r _ i i $ i i i-I I I I l' I
,Q -
1 4 1 1 I
*2 l t i
_ 1 1 $ '4
~
1 4 i i i i l 3 4 1- 1 i 20 - ------- '-------l~ '<------ 2--------l-------J--------- I l' I i- I
! l' l I i 1
- 1 I i I I i
~
i 1 1 i 1 t l I ! 1 1 1 I i i i i i i ,
' ' ~' ' '
- 0- i i i i i j i i i i i i i 4 i i i i 1 i l i i. i I ; i 4 5 6 7 8 9. 10 11 Crack Length (In)
..t k
1
- Amendment P June 15,1993 TM MOMENT vs. CRACK LENGTH - HOT LEG, . F_igure .
Jpf / ' 49" O.D. 3.9A-17
O 80000 i 1
=
- 1 I I i I t I
~
l i 4 i i I i I
. I i 1 I i l 60000- -------- ----J--------------i--------------t---------------.
I i 1
- I f l 1 1 I
~
l I l
^
~
l I i
*g l I a _
i i i i e i "M 40000- ------------J--------------'--------------'--------------- i 1 i I i h - 1 i i i 3 - l 1 l to 1 i i
~
l i I i i i l l 1 2s)00 t - -------------.J____-__________I____________...._L____________1 i i i l
~ i i i l 1 !
-u I 1 e i I i
~
l i 1
~
I i t l 1 i 0 i i i i 1 i i i i l i e i i l i i i. 0 .05 .1 .15 .2 Stroin ( h/h ) l l l l l Amendment P - June 15,1993 TM Figure jfj / 516 STRESS-STRAIN PlFRAC 3.9A-18
,m
/ h , I 'w)1 l l l 80000 '
= = = = "
-*- to l # i i 3 1 3 1 l I I g
- I t g 60000 - -------- ____
s,_---_-_________ L.______________' ______________.
~ l I g I I t
' i I n ' i i I I l
._??
I g Q. - 40000 - -------_____J_______________;_ _____________[______________, o - i i I M - i 6 3 v) I 1 3 I I l i i I l g J_-____-________i_________ _____t.__ [-%) 200003 ------------- 1 : s e a I I i
\M
-" l l l i , ,
I I g _a i ! l 1 i j
' ' i 0 ' ' i i i i i i i i i i i i i i i i 0 .05 .1 ,t5 7 Strcin ( h/h )
Amendment P June 15,1393 TM Figure 3% / 516 STRESS-STR AIN, FIT TO INTERMEDIATE STRAINS 3.9A 19
1 i l 9 70000 - i i
- i i , ,
- 1 i -
1
- 1 i j j 60000- -
---------- J-----------
i e
----------- L----------
i L_-------- i
- 1 I I i
- 1 i l l 1 I I t 50000 - -----------i- l I
i i l I i l I i I
^ l I i (
g
,1 ---------- ,i -----------r-----------r------------ '
y 40000- ~~--- ---- l l l m - i l i , M
---------d------------l------------l-----------'_--------_
j 30000 -- i v3 e i
/ i i i i i i i ,
4 1 I t 200002 -----------d------------i------------------------w-----------, i
-; i i i
-; I I i 1
-8 I I i i :
1 i 10000 ,---------- J-----------l----------- L--- --- L-----------.
- i i i i u> I i i
- 1 l l 1
- t 1 l l
' ' l 0 I I I l I I i l I I I .'
l l 5 I j l l l 0 .08 .16 .24 .32 .4 Strain ( h/h ) Amendment P - June 15,1993 TM - Figure g / 316 STRESS STRAIN PIFRAC
1
,m
\
6 t.;/ 4 , I
\j i I
1 70000 ~
+ Data i :
-+- R--O Fit :
60000 -
- - . --- - --- - ---i. - - - - -- - - '
..g.
Q Q. -...................h.......... . f....
.... .. ......j. ......... .. .
<s - r .! . .
is 40000-- - ----- -- e---------i.---------.;------------------- S - yi i - . (N .6 30000- -- --
- i. --
---- -- l - - - ' --- - - ' -- -- - -- ' - -- - - -- -
)
m - . r,s L/ . 20000-- ------4.------<.---
- - - --l-
-- --- ---4 - - - --
~
'...............:..................q...................................3...............:.................
3o000. .. . . 0 i i i i i i i i l i i i i 1- i i i i i i i i l i i i i 0 .05 .1 .15 .2 .25 .3 Strain (in/in) Amendment P l June 15,1993 l l
- TM I
/ Figure l 316 STRESS-STRAIN, FIT TO ALL DATA ?
jfd / 3.9 A ! 1
)
I 1
O 1 l 18000 15000 l p d
- 12000
.h ~
'k -
f
& 9000 6000 l
3000 l
- f. - 1 l
I I ( l ' ' ' ' i i i i i f ! 0 5 3 ~ 2 l- ! DeMa A (h) I t 1 Amendment P _ June 15,1993 DATA FIT TO PlFRAC DATA NO. 62, Figure dfd(( 516 PIPE WELD 3.9A 22 _=___ - - . _ _. _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _
7- ' i '\__/ 20000 15000 R -
'/
( _ S - 1 10000 ' i : /, ( N '\.- 5000 0 , , , i , , , , , , , , 0 .5 1 15 Dc!ta A (in) _ Amendment P June 15,1993 TM DATA FIT TO PIFRAC DATA NO.20 AND Figure jfjf[ / u OTHER INDUSTRY DATA, GTAW WELDS 3.9A-23
!E O
/7 i
/ h1\ /y \J
;j,,
/
/ s i
'l
$l 9 r
l t y I
'N
^
June 5 93 ,g g s g((d" OVERALL FINITE ELEMENT MODEL l _---- - -- - - -- _ -- - _ _ _ j
.j l
l
\ N.
o N l l - Amendment P .i June 15,1993 I ggg . CRACK AREA CLOSEUP OF FINITE ELEMENT MODEL - 3 A-25._ n , - , . , . - . .
1 O [-
' s
/ ,
/ / {
/ ' I
/ '
/ ,
i /
\
/
l j
\
\
\
s O SYMMETRY l I = Leakage crack area a, = Model crack length a, i d = Model crack length i a small amount 1 Amendment P ^ June 15,1993 DIFFERENT CRACK LENGTHS USED TO Figure jfj /u CALCULATE DERIVATIVE 3.9A 26 '
i
, TYPICAL LOADING l
.;- ') '
. '%J l
J l
+-
4 dJ da 'l l TYPICAL MATERIAL J C V) dJ 5 } INSTABILITY LOAD J ! i I 1 _dJ . l 1 da i i i Amendment P June .15,1993 . TM Figure
/ DEVELOPMENT OF A STABILITY EVALUATION DIAGRAM -
O i
@ ANALYSIS #1 RESULTS
@ ANALYSIS #2 RESULTS A
@ 2a " Fall
=
E 2 PASS
@[a o PASS 2 PASS g
o i 2 G NOP i NOP 2 l ! > MINIMUM MOMENT (NOP) Amendment P _ June 15,1993 _ ggg LBB PIPING EVALUATION DIAGRAM
2a 14 2 *11 : a
.1 :
m m m O : NOP Point 1 passes LBB Point 2 fails (NOP+SSE) on 2a Point 11 fails (f(NOP+SSE) on a Pcint 14 fails (NOP+SSE) on 2a and ff (NOP+SSE) on a Amendment P June 15,1993 gg USE OF THE LBB PIPING EVALUATION DIAGRA'M
CESSAR =lncui. O 3.10 SEISMIC AND DYNAMIC OUALIFICATION OF MFCHANICAL AND ELECTRICAL EOUIPMENT This section describes the tests, analyses, procedures, and acceptance criteria applied to two categories of mechanical and electrical equipment to assure operability and structural integrity under the full range of normal transient seismic and accident loadings specified in Table 3.9-1. The two categories are safety related (Seismic Category I) equipment and non-safety related equipment whose failure can prevent the satisfactory accomplishment of safety functions (Seismic Category II) . A list of the structures, systems and components included in these two categories are shown in Tables 3.2-1 and 3.2-2 and designated as Seismic Category I (safety related) or Seismic Category II (non-safety related). The safety related equipment are those necessary to ensure (1) the integrity of the reactor coolant pressure boundary, (2) the capability to shut down the reactor and maintain it in a safe condition, or (3) the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposures in excess of 10 CFR 100 guidelines. Non-safety related equipment whose failure could reduce the performance of safety related equipment is designated as Seismic Category II. O 3.10.1 SEIBMIC QUALIFICATION CRITERIA 3.10.1.1 F_eguirements The seismic and dynamic qualification program ensures that equipment classified as Seismic Category I can meet functional performance requirements, as defined in the equipment's design specification, during and after the dynamic loadings due to normal operating, transient, seismic and accident conditions. For Seismic Category II equipment it is demonstrated that structural integrity is maintained under normal operating, , transient, seismic and accident loads and therefore this equipment will not be a missile hazard or in some other manner damage nearby safety-related equipment. The seismic and dynamic qualification program conforms to the requirements of Regulatory Guide 1.100, Rev. 2 and IEEE Std. 344-1987. The seismic and dynamic testing portion of the qualification program is performed in a sequence consistent with the requirements of Section 6 of IEEE Standard 323-1974. 3.10.1.2 Belection of Oualification Method Seismic and dynamic qualification of mechanical and electrical equipment is accomplished by test, analysis, a combination of y test and analysis, or experience. Amendment P 3.10-1 June 15, 1993
CESSAR naisemon In general, Seicmic Category I equipment, for which functional O operability must be demonstrated, is qualified by tests. Analyses alone, without testing, is used for qualification only if the necessary functional operability of the equipment is assured by its structural integrity alone. An example of this type of equipment is the core support structure. Some Seismic Category I equipment is qualified by a combination of test and analysis. This is done, for example, with a large electrical cabinet when testing the complete component is not feasible. An analysis is performed to demonstrate that the structural integrity of the cabinet is maintained and also to obtain seismic response spectrum at equipment mounting points. These are used as the required response spectra (RRS) for testing various pieces of equipment mounted in the cabinet. An example of mechanical equipment qualified by a combination of test and analysis is the control element drive mechanisms. The pressure boundary is qualified by analysis, while operability is demonstrated by tests. Seismic Category II equipment, for which only structural integrity must be demonstrated, is generally qualified by analysis. Qualification by experience for equipment similar to equipment that has been in service for various periods of time and has been exposed to in-plant vibration and natural seismic disturbances is used only when the following documentation can be provided: A. Similarity of the equipment based on design, manufacturing, operability, and dynamic characteristics. B. Excitation environment must be established by techniques that are technically justified. 3.10.1.3 Input Motion The input motions for the qualification of equipment and supports are generated from the building dynamic analysis, as described in Section 3.7. The buildings dynamic analyses envelope all sites forming the design basis for the standard design. The buildings dynamic analyses provide response spectra or time histories for elevations in each building. Envelopes of these input motions are used directly for qualification or to perform dynamic analyses to generate input motions at other equipment mounting locations. The equipment input motions to be used incorporate the contributions of the dynamic loads specified in Table 3.9-1. O Amendment P 3.10-2 June 15, 1993 I
CESSAR CERTsFICATION l s 3.10.2 SEISMIC AND DYNAMIC QUALIFICATION OF ELECTRICAL EQUIPMENT Instrumentation and electrical equipment used for post-accident monitoring, the Reactor Protective System (RPS), the Engineered Safety Features Actuation System (ESFAS), the actuation devices for ESF system actuated components, and the emergency power system are designed to Seismic Category I requirements to ensure the ability to initiate required protective actions during, and following, a Safe Shutdown Earthquake (SSE) and for all static and dynamic loads from normal, transient and accident conditions; and, to supply power, following an SSE and for all static and dynamic loads from normal, transient and accident conditions, to components required to mitigate the consequences of events which require safety system operation. Instrumentation and electrical equipment designated Seismic Category II are shown to maintain their structural integrity and not adversely impact safety related equipment during an SSE and for all static and dynamic loads from normal, transient and accident conditions. Instrumentation and electrical equipment that has been previously qualified by means of test and analysis is described in Topical Report CENPD-182, " Seismic Qualification of Instrumentation and Electrical Bquipment". Methods and procedures for qualifying electrical equipment and instrumentation are as described below, and are consistent with those described in the above report with the appropriate changes to reflect the new requirements of Regulatory Guide 1.1. 00, Revision 2, and IEEE Standard 344-1987. 3.10.2.1 Methods and Procedures for Oualifying Seismic Catecorv I Electrical Equipment and Instrumentation Seismic Category I instrumentation and electrical equipment required to perform a safety action during a seismic event and for all static and dynamic leads from normal, transient and accident conditions; af ter a seismic event and for all static and dynamic loads from normal, transient and accident conditions; or both are qualified with appropriate documentation in accordance with the requirements of the equipment specifications. These requirements are consistent with those of IEEE Standard 344-1987,
" Seismic Qualification of Class 1 Electrical Equipment for Nuclear Power Generating Stations", and Regulatory Guide 1.100, Rev. 2. The methods and procedures used for qualifying Seismic Category I electrical equipment and instrumentation include the l following:
A. Testing and/or analyses are used to confirm the operability of the instrumentation and electrical equipment during and after an SSE and for all static and dynamic loads from Amendment P 3.10-3 June 15, 1993
CESSARnibbua normal, transient, and accident conditions. Depending on O the type of equipment under consideration and its intended safety function, qualification is done by test, analysis or a combination of both. B. Equipment is tested in the operational condition. Operability is verified during and after testing. Loadings simulating those of plant normal operation, if any, are concurrently superimposed upon the seismic and oti.ar pertinent dynamic loading. C. The seismic and dynamic excitation for which the equipment must qualify is determined based on location in the plant. D. The characteristics of the required seismic and dynamic input motion is specified by one of the following:
- 1. response spectrum
- 2. power spectral density function
- 3. time history These characteristics, derived from the structures or systems seismic and dynamic analyses, are representative of the input motions at the equipment mounting locations.
E. The actual input motion is characterized in the same manner as the required input motion. Conservatism in amplitude and multi-frequency energy content is demonstrated. That is, the test response spectrum (TRS) is demonstrated to envelope the required response spectrum (RRS) over the entire frequency range. F. Multifrequency input motion is used whenever possible. However, single frequency input, such as sine beats, are utilized provided one of the following conditions is met:
- 1. The characteristics of the required input motion indicate that the motion is dominated by one frequency (i.e., by structural filtering effects).
- 2. The anticipated response of the equipment is adequately represented by one mode.
- 3. The input has sufficient intensity and duration to excite all modes to the. required magnitude, such that ;
the testing response spectra envelope the corresponding i response spectra of the individual modes. l G. The input notion is applied to one vertical and one principal (or two orthogonal) horizontal axes simultaneously Amendment P 3.10-4 June 15, 1993 ! I
'~"
CESSAR "E.iTIFICATl*N C ! O i except where it is demonstrated that the equipment response ! along the vertical direction is not sensitive to the vibratory motion along the horizontal direction, and vice versa. The time phasing of the inputs in the vertical and horizontal directions is such that a purely rectilinear resultant input is avoided. The acceptable alternative is to have vertical and horizontal inputs in-phase, and then repeated with inputs 180 degrees out-of-phase. In addition, the test is repeated with the equipment rotated 90 degrees horizontally. Biaxial and triaxial input motion is utilized where practical. H. Dynamic coupling between the equipment and related systems, if any, such as other mechanical components, is considered. I. The fixture is designed to meet the following requirements:
- 1. Simulate the actual service mounting.
- 2. Cause no extraaeous dynamic coupling to the test item.
J. The in-situ application of vibratory devices to superimpose the seismic vibratory loadings on the complex active device A for operability testing is acceptable when application is (A justifiable and meets the requirements of IEEE Std. 344-1987. K. The test program may be based upon selectively testing a representative number of mechanical components according to type, load, level, size or other appropriate classification on a prototype basis. L. Selection of damping values for equipment to be qualified is made in accordance with Regulatory Guide 1.61 and IEEE Std. 344-1987. Higher damping values are used only if justified by documented test data with proper identification of the source and mechanism. 3.10.2.2 Methods and Procedures of Analysis or Testina of Supports of Electrical Equipment and Instrumentation Analyses or tests are performed for all supports of electrical equipment to assure their structural capability. The analytical results include the required input motions to the mounted equipment as obtained and characterized in the manner stated in Section 3.10.2.1.D above. / Combined stresses of the mechanically designed component supports I h are maintained within the limits of ASME Code Section III, Division 1, Subsection NF, up to the interface with building l I Amendment P l 3.10-5 June 15, 1993 l i
CESSAR8la% . structure, and the combined stresses of the structurally designed O component supports defined as building structure in the project design specification are maintained within the limits of the AISC Specification for the Design, Fabrication and Erection of Structural Steel for Buildings. Supports are tested with equipment installed or with a dummy simulating the equivalent equipment inertial mass effects and dynamic coupling to the support. If the equipment is installed in a nonoperational mode for the support test, the response in the test at the equipment mounting location is monitored and characterized in the manner as stated in Section 3.10.2.1.D above. In such a case, equipment is tested separately for operability and the actual input motion to the equipment in this test is more conservative in amplitude and frequency content than the monitored response from the support test. The methods and procedures of Sections 3.10.2.1.D, E, F, G, H, I and L above, are applicable when tests are conducted on the equipment supports. 3.10.2.3 Methods and Procedures for Oualifying Seismic Catecory II Electrical Ecuipment and Instrumentation Seismic Category II instrumentation and electrical equipment (non-Class 1E) perform non-safety functions, but their failure can prevent the satisf actory accomplishment of one or more safety functions. The requirement for such equipment is to demonstrate structural integrity for the equipment and its supports. The methods and procedures for qualifying such equipment include the following: A. The seismic and dynamic excitation for which the equipment must qualify is determined based on location in the plant and enveloping generic input ground motion. B. The equipment is designed to maintain its structural integrity during an earthquake of the intensity of the SSE, and for non-seismic vibrations in accordance with Regulatory Guide 1.100, Rev. 2. C. Analysis, testing or operating experience is used to determine the str" ' ural integrity of the equipment, depending on the ti,,e of equipment under consideration. D. The requirements of Sections 3.10.2.1.D, E, F, G, H, I and L are applicable when tests are conducted on the equipment. O' Amendment P 3.10-6 June 15, 1993
CESSAR EnMCATION ( 3.10.3 BEIBMIC AND DYNAMIC QUALIFICATION OF MECHANICAL EQUIPMENT INCLUDING MOTORS 3.10.3.1 Methods and Procedures for Qualifying Beismic Category I Mechanical Equipment Including Motors Dynamic loads of mechanical eq.ipment are combined as specified in Table 3.9-2. Qualification of mechanical equipment and their supports meet the requirements of Regulatory Guide 1.100 Rev. 2 and IEEE Std. 344-1987. Methods and procedures of testing and analysis for confirming the operability of equipment for the I defined loads are presented in the following paragraphs. ! A. Tests and analyses are performed to confirm the operability of all mechanical equipment during and after an earthquake of magnitude up to and including the SSE, and for all static and dynamic loads from normal, transient and accident conditions. It is demonstrated that the equipment can withstand 1/2 SSE excitation without loss of structural integrity. Analyses are utilized if the functional operability of the equipment is substantiated by its structural integrity. If complete testing is impractical, a combination of tests and analyses is utilized. When equipment that has been previously qualified by means of tests and analyses equivalent to those described here is utilized, documentation of such tests and analyses is provided. B. Equipment is tested in the operational condition. Operability is verified during and/or after the testing, as applicable to the equipment being tested. Loadings simulating those of plant normal operation, such as thermal , and flow-indaced loading, if any, are concurrently ' l superimposed upon the seismic and other pertinent dynamic loading to the extent practicable. Particular attention is l paid, in operability qualification of mechanical equipment subjected to flow-induced loading, to incorporate degraded i flow conditions such as those that might be encountered by the presence of debris, impurities, and contaminants in the I fluid system. C. The characteristics of the required seismic and dynamic input motions are specified by response spectra, time histories, or power spectral density functions. These characteristics, derived from the structures or systems seismic and dynamic analyses, are representative of the input motions at the equipment mounting locations. h V D. For seismic and dynamic loads, the actual test input motion are characterized in the same manner as the required input l 1 Amendment P l 3.10-7 June 15, 1993
CESSAR UNnCATION motion, and conservatism in amplitude and frequency content g is demonstrated. E. Since seismic and the dynamic load excitation generally have a broad frequency content, multi-frequency vibration input motion is used. However, single frequency input motion, such as sine beats, is utilized if the motion is dominated by one frequency (e.g., by structural filtering effects), or the anticipated response of the equipment is adequately represented by one mode, or in the case of structural integrity assurance, the input has sufficient intensity and duration to produce sufficiently high levels of stress for such assurance. Components that have been previcusly tested to IEEE Std. 344-1971 are reevaluated to justify the appropriateness of the input motion used, and requalified if necessary. F. For the seismic and dynamic portion of the loads the test input motion is applied to one vertical axis and one principal horizontal axis (or two orthogonal horizontal axes) simultaneously unless it is demonstrated that the equipment response in the vertical direction is not sensitive to the vibratory motion in the horizontal direction, and vice versa. The time phasing of the inputs in the vertical and horizontal directions is such that a purely rectilinear resultant input is avoided. The alternative is to test with vertical and horizontal inputs in-phase, and then repeat the test with inputs 180 degrees out-of-phase. In addition, the test is repeated with the equipment rotated 90 degrees horizontally. Components that have been previously tested using a single axis test input motion are requalified using biaxial test input motions or a justification for using a single axis test input motion is provided. G. Dynamic coupling between the equipment and related systems, if any, such as connected piping and other mechanical components, is considered. H. The fixture is designed to simulate the actual service mounting and will not cause any significant dynamic coupling to the test item. I. For pumps and valves, the loads imposed by the attached piping is taken into account. In order to assure operability under combined loadings, the stresses resulting from the applied test loads envelope the specified service stress limit for which the component's operability is intended. Amendment P 3.10-8 June 15, 1993
CESSAR 85ine-l ( V J. If the dynamic testing of a pump or valve assembly is impracticable, static testing of the assembly is performed with end loadings conservatively applied and equal to or greater than postulated event loads. All dynamic amplification effects are accounted for, the component is in the operating mode during and after the application of loads, and an adequate analysis is made to demonstrate the validity of the static application of loads. K. The in situ application of vibratory devices to simulate the scismic and dynamic vibratory motions on a complex active device may be utilized to confirm the operability of the device after it is shown that a meaningful test can be made in this way. L. The test program is based upon selectively testing a representative number of components according to type, load level, size, etc., on a prototype basis. M. Selection of damping values for equipment to be qualified is made in accordance with Regulatory Guide 1.61 and IEEE Std. 344-1987. Higher damping values are used if justified by documented test data with identification of the source and mechanism. ( \ N. When complete testing is not practicable, the features listed below are incorporated into a test and analysis operability assurance program for pumps and valves. Similar programs are developed for other types of equipment.
- 1. Simple and passive elements, such as valve and pump bodies and their related piping and supports are analyzed to confirm structural integrity under postulated event loadings. However, where practical, complex active devices such as pump motors, valve operator and gate or disk assemblies, and other electrical, mechanical, pneumatic, or hydraulic appurtenances which are vital to the pump or valve operation are tested for operability.
- 2. The following are typical analyses which are used for ;
qualification. 1
- a. An analysis to determine the vibratory input to the valve or pump.
- b. An analysis to determine the system natural frequencies and the movement of the pump or valvo l during the dynamic events.
- c. An analysis to determine the pressure differential l and the impact energy on a valve disc during a Amendment P 3.10-9 June 15, 1993
CESSAR HE"icari:n LOCA, and to verify the design adequacy of the O disc.
- d. An analysis to determine the forcing functions of the axial and radial loads imposed on a pump rotor due to a LOCA, such that combined LOCA and vibratory effects on the shaft and rotor assembly can be evaluated.
- e. An analysis to determine the speed of the pump shaft as.a result of postulated events and to compare it with the design critical speed.
- f. An analysis to verify the design adequacy of the wall thickness of valve and pump pressuro-retaining bodies.
- g. An analysis to determine the natural frequencies of a pump shaft and rotor assembly to ascertain whether they are within the frequency range of the vibratory excitations. If the. minimum natural frequency of the assembly is beyond the excitation frequencies, a static deflection analysis of the shaft is acceptable to account for dynamic effects. If the assembly natural frequencies are close to the excitation frequencies, an acceptable dynamic analysis must be performed to determine the structural response of the assembly to the excitation frequencies.
- h. When analyses are used for qualification, the combination of multimodal and multidirectional responses are made in accordance with Regulatory Guide 1.92.
3.10.3.2 Desi_gn Adectuacy of Buygorts Analyses or tests are performed for all supports of mechanical equipment to assure their structural capability. The analytical results include the required input motions to the mounted equipment as obtained and characterized in the manner stated in Section 3.10.3.1.C and the loads and loading combinations discussed in Section 3.9.3.1 and presented in Table 3.9-2. Supports are tested with equipment installed or with a dummy simulating the equivalent equipment inertial mass effects and dynamic coupling to the support. If the equipment is installed
- in a nonoperational mode for the support test, the response in the test at the equipment mounting location is monitored and characterized in the manner as stated in Section 3.10.3.1.C. In Amendment P 3.10-10 June 15, 1993 -;
CESSAR Enhrion O v such a case, equipment is tested separately for operability and the actual input motion to the equipment in this test is more conservative in amplitude and frequency content than the monitored response from the support test. The criteria of Sections 3.10.3.1.C, D, E, F, G, H, and M above are applicable when tests are conducted on the equipment supports. 3.10.3.3 Leakace Oualification for Reactor Coolant Pressure Boundary Valves In addition to the qualification program described in Section 3.9.3.2, valves that are part of the reactor coolant pressure boundary are tested, or tested and analyzed, to demonstrate that these valves do not experience any leakage or increase in leakage resulting from defined loads. 3.10.3.4 Oualification of Seismic Category TT Mechanical Et.tuipment Seismic Category II mechanical equipment perform non-safety functions but their failure can prevent the satisfactory f" accomplishment of one or more safety functions. The requirement ( for such equipment is to demonstrate structural integrity for the \ equipment and its supports. The methods and procedures for qualifying such equipment include the following: A. The seismic excitation for which the equipment must qualify is determined based on location in the plant and enveloping generic input ground motion. B. The equipment is designed to maintain its structural integrity during an earthquake of the intensity of the SSE, and for non-seismic vibrations in accordance with Regulatory Guide 1.100, Rev. 2. C. Static analysis is utilized to substantiate structural integrity of Category II mechanical equipment except where analysis is not suitable, or where economic or schedular considerations make testing more suitable. Dynamic analysis may be utilized in special cases. D. The requirements of Section 3.10.3.1.D, E, F, G, H and M are applicable when tests are conducted on the equipment. E. Loads are combined as follows: l Operating Pressure + Dead Weight + SSE + Dynamic Loads l Amendment P 3.10-11 June 15, 1993 )
CESSAREnnnema 3.10.4 MECHANICAL AND ELECTRICAL EQUIPMENT QUALIFICATION O RECORDB Complete and auditable records including reports are available and maintained by the applicant, for the life of the plant, at a central location. The reports describe the qualification method used for all equipment in sufficient detail to document the degree of compliance with the specified criteria. These records will be updated and maintained current as equipment is replaced, further tested, or otherwise further qualified. The equipment qualification file contains a list of all systems equipment and the equipment support structures. The equipment list identifies which equipment is NSSS-supplied and which equipment is BOP-supplied. The equipment qualification file includes qualification summary data sheets for each piece of equipment, i.e. , each mechanical and electrical component of each system, which summarize the component's qualification. These data sheets include the following information: A. Identification of equipment, including vendor, model number and location within each building. Valves that are part of the reactor coolant pressure boundary are so $dentified. B. Physical description, including dimensions, vieight and field mounting condition. Identification of whether the equipment is pipe, floor, or wall supported. C. A description of the equipment's function within the system. D. Identification of all design (functional) specifications and qualification reports, and their locations. Functional specifications for active valve assemblies conform to the Regulatory Position of Regulatory Guide 1.148. E. Description of the required loads and their intensities for which the equipment is qualified. F. If qualified by test, identification of the test methods and procedures, important test parameters and a summary of the test results. G. If qualified by analysis, identification of the analysis methods and assumptions and comparisons between the calculated and allowable stresses and deflections for critical elements. H. The natural frequency (or frequencies) of the equipment. I. Identification of whether the equipment is affected by vibration fatigue cycle effects and a description of the Amendment P 3.10-12 June 15, 1993
CESSAR Einincuiw o D methods and criteria used to qualify the equipment for such loading conditions. J. Indication whether the equipment has not the qualification requirements. K. Availability for inspection, i.e. , identification of whether the equipment is already installed. L. A compilation of the required response spectra (or time history) and corresponding damping for each seismic and dynamic load specified for the equipment together with all other loads considered in the qualification and the method of combining all loads. 3.10.5 ADMINISTRATIVE CONTROL OF COMPONENT QUALIFICATION The licensee at the time of COL will establish a program for administrative control of component qualification, especially a description of the equipment qualification file, the handling of documentation, internal acceptance review procedures, identification of the scope of NSSS and A/E suppliers, and the procedures of the interchange of information between NSSS, A/E, equipment vendors and testing laboratories. k n U Amendment P 3.10-13 June 15, 1993
CESSAR nsific 12n meat i or n
,e
(
\_,
EFFECTIVE PAGE LISTING APPENDIX 7A Table of Contents Eage Amendment i P ii P iii P iv P v p vi p vii p Text FARE Amendment 7A.1-1 P
,cg 7A.2-1 P
( ) 7A.2-2 P
\d 7A.2-3 P 7A.2-4 P 7A.2-5 P 7A.2-6 P 7A.2-7 P 7A.2-8 P 7A.3-1 P 7A.3-2 P 7A.3-3 P 7A.3-4 P 7A.3-5 P 7A.3-6 P 7A.3-7 P 7A.3-8 P 7A.3-9 P 7A.3-10 P 7A.3-11 P 7A.3-12 P 7A 3-13 P 7A.3-14 P 7A.3-15 P 7A.3-16 P 7A.3-17 P 7A.3-18 P 7A.3-19 P
.( 7A.3-20 7A.4-1 P P Amendment P June 15, 1993 ;
4 CESSAR EBincuen (sneet 2 or 3) EFFECTIVE PAGE LISTING (Cont'd) O' APPENDIX 7A Tables Amendment 7A.2-1 P 7A.3.1-1 P 7A.3.2-1 P 7A.3.3-1 P 7A.3.4-1 P 7A.3.5-1 P 7A.3.6-1 P 7A.3.7-1 P 7A.3.8-1 P Eiqures Amendment 7A.1-1 P 7A.2-1 P 7A.3.1-1 P 7A.3.1-2 P 7A.3.1-3 P 7A.3.1-4 P 7A.3.1-5 P 7A.3.2-1 P 7A.3.2-2 P 7A.3.2-3 P 7A.3.2-4 P 7A.3.2-5 P 7A.3.2-6 P 7A.3.2-7 P 7A.3.3-1 P 7A.3.3-2 P 7A.3.3-3 P 7A.3.3-4 P 7A.3.4-1 P 7A.3.4-2 P 7A.3.4-3 P 7A.3.5-1 P 7A.3.5-2 P 7A.3.6-1 P 7A.3.6-2 P 7A.3.6-3 P 7A 3.6-4 P 7A.3.6-5 P 7A.3.6-6 P 7A.3.7-1 P 7A.3.8-1 P 7A.3.8-2 P i Amendment P June 15, 1993
CESSAR Heincamu (sneet 3 or 3) e'N EFFECTIVE PAGE LISTING (Cont'd) 2LPPENDIX 7A Fiqures (Cont'd) Ameradment 7A.3.8-3 P 7A.3.8-4 P 7A.3.8-5 P 7A.3.8-6 P 7A.3.8-7 P 7A.3.8-8 P 7A.3.8-9 P 7A.3.8-10 P 7A.3.8-11 P 7A.3.8-12 P 7A.3.8-13 P 7A.3.8-14 P 7A.3.8-15 P 7A.3.8-16 P 7A 3.8-17 P 7A.3.8-18 P / 7A.3.8-19 P ! 7A.3.8-20 P 7A.3.8-21 P Amendment P i June 15, 1993 l l
CESSAR !!nincueu t ,/
-k s-1 i
APPENDIX 7A CMF EVALUATION FOR LIMITING FAULT EVENTS 4
\.J!
l l 1 1 1 (' ( Amendment P June 15, 1993
CESSAR E!!Gema
,r ~ N, N, h %./
TABLE OF CONTENTS APPENDIX 7A Section Subiect Pace No.
1.0 INTRODUCTION
7A.1-1 2.0
SUMMARY
7A.2-1 2.1 EVALUATION APPROACH 7A.2-1 2.2 INSTRUMENTATION AVAILABLE TO THE OPERATOR 7A.2-1 2.3 BASIS FOR OPERATOR RESPONSE TIME ESTIMATES 7A.2-3 2.4 SPECIFIC RESPONSE TIME ESTIMATES 7A.2-5 l 2.5 NON-LOCA COOLABILITY CRITERION 7A.2-7 2.6 EVENT DEFINITIONS 7A.2-7
,/'"} 3.0 INDIVIDUAL EVENT EVALUATIONS 7A.3-1 \ / \'
3.1 TOTAL LOSS OF FORCED REACTOR COOLANT FLOW 7A.3-1 3.1.1 IDENTIFICATION OF EVENTS 7A.3-1 3.1.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-1 3.
1.3 CONCLUSION
S 7A.3-2
- 3. SINGLE RCP SHAFT SEIZURE / SHAFT BREAK 7A.3-3 3.2.1 IDENTIFICATION OF EVENTS 7A.3-3 3.2.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-3
~3.
2.3 CONCLUSION
S 7A.3-3 3.3 CEA EJECTION 7A.3-5 3.3.1 IDENTIFICATION OF EVENTS 7A.3-5 3.3.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-5 3.
3.3 CONCLUSION
S 7A.3-6 r~N l I
%.)
Amendment P i- June 15, 1993 I
"': =
CESSAR "ERTIFICATION C TABLE OF CONTENTS (Cont'd) APPENDIX 7A Section Bubiect Pace No. 3.4 LETDOWN LINE BREAK OUTSIDE CONTAINMENT 7A.3-7 3.4.1 IDENTIFICATION OF EVENTS 7A.3-7 3.1.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-7 3.
4.3 CONCLUSION
S 7A.3-8 3.5 STEAM GENERATOR TUBE RUPTURE 7A.3-9 3.5.1 IDENTIFICATION OF EVENTS 7A.3-9 3.5.2 ANALYSIS OF EFFECTS AND CONSEwUENCES 7A.3-9 3.
5.3 CONCLUSION
S 7A.3-10 3.6 MAIN STEAM LINE BREAK 7A 3-11 3.6.1 IDENTIFICATION OF EVENTS 7A.3-11 3.6.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-11 3.
6.3 CONCLUSION
S 7A.3-13 3.7 F_EEDWATER PIPE BREAK 7A.3-15 3.7.1 IDENTIFICATION OF EVENTS 7A.3-15 3.7.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-15 3.
7.3 CONCLUSION
S 7A.3-16 3.8 LOSS OF COOLANT ACCIDENT 7A.3-17 3.8.1 IDENTIFICATION OF EVENTS 7A.3-17 3.8.2 ANALYSIS OF EFFECTS AND CONSEQUENCES 7A.3-17 3.
8.3 CONCLUSION
S. 7A.3-20
4.0 REFERENCES
7A.4-1 O Amendment P l ii June 15, 1993
CESSAR !!!snc-1 I ij- i LIST OF TABLES APPENDIX 7A Table Subiect 7A.2-1 Key Indicators of Critical Function Status Displayed Continuously via DIAS-P 7A.3.1-1 Loss of RCS Flowrate Input Parameters and Initial Conditions 7A.3.2-1 Single RCP Shaft Seizure / Break Input Parameters and Initial Conditions 7A.3.3-1 CEA ' Ejection Input Parameters and Initial Conditions 7A.3.4-1 Letdown Line Break Input Parameters and Initial ~ Conditions 7A.3.5-1 Steam Generator Tube Rupture Input Parameters and
/~~'T Initial Conditions
'k" ) 7A.3.6-1 Steam Line Break Input Parameters, Initial Conditions and Assumptions > 7A.3.7-1 Feedwater Line Break Input Parameters and Initial Condiitons Containment Analysis 7A.3.8-1 Loss of Coolant Accident Input Parameters, Initial Conditions and Assumptions 0 ( Amendment P iii June 15, 1993'
CESSAREnO,cma LIST OF FIGURES O Figure Subiect 7A.1-1 Diverse Manual ESF Actuation Interface to ESF Components 7A.2-1 Diversity in Display of Category 1 Parameters 7A.3.1-1 Loss of Offsite Power with no RPS Actuation; Minimum DNBR vs Time 7A.3.1-2 Loss of Offsite Power with no RPS Actuation; Normalized Core Flow vs. Time 7A.3.1-3 Loss of Offsite Power with no RPS Actuation; Power vs. Time 7A.3.1-4 Loss of Offsite Power with no RPS Actuation; RCS Pressure vs. Time 7A.3.1-5 Loss of Offsite Power with no RPS Actuation; RCS Temperature vs. Time 7A.3.2-1 Shaft Seizure / Break with no RPS Actuation; DNBR vs. Time 7A.3.2-2 Shaft Seizure / Break with no RPS Actuation; DNBR-vs. Time 7A.3.2-3 Shaft Seizure / Break with no RPS Actuation; RCS Flow vs. Time 7A.3.2-4 Shaft Seizure / Break with no RPS Actuation; RCS Flow vs. Time 7A.3.2-5 Shaft Seizure / Break with no RPS Actuation; RCS Pressure vs. Time 7A.3.2-6 Shaft Seizure / Break with no RPS Actuation; Power vs. Time 7A.3.2-7 Shaft Seizure / Break with no RPS Actuation; RCS Temperature vs. Time 7A.3.3-1 CEA Ejection with no RPS/ESFAS Actuation; Core Average Power vs. Time 7A.3.3-2 CEA. Ejection with no RPS/ESPAS Actuation; Minimum DNBR vs. Time Amendment P iv June 15, 1993
CESSAREBMem i
\._ -l LIST UP FIGURES (Cont'd)
Fiqure Bubiect 7A.3.3-3 CEA Ejection with no RPS/ESFAS Actuation; Maximum Cladding Surface Temperature vs. Time 7A.3.3-4 CEA Ejection with no RPS/ESFAS Actuation; Maximum Fuel Centerline Temperature vs. Time 7A.3.4-1 Letdown Line Break, Outside Containment, Upstream of Letdown Line Control Valve; Pressurizer Pressure vs. Time 7A.3.4-2 Letdown Line Break, Outside Containment, Upstream of Letdown Line Control Valve; Pressurizer Water Level vs. Time 7A 3.4-3 Letdown Line Break, Outside Containment, Upstream of Letdown Line Control Valve; Integrated Primary Coolant Discharge vs. Time 7A.3.5-1 Steam Generator Tube Rupture with no RPS (]) / v Actuation; RCS Pressure vs. Time 7A.3.5-2 Steam Generator Tube Rupture with no RPS Actuation; Minimum DNBR vs. Time 7A.3.6-1 Full Power Steam Line Break Outside Containment, Upstream of MSIVs with no RPS/ESFAS Actuation; Core Power vs. Time 7A.3.6-2 Full Power Steam Line Break Outside Containment, Upstream of MSIVs with no RPS/ESFAS Actuation; Steam Generator Mass Inventories vs. Time 7A.3.6-3 Full Power Steam Line Break Outside Containment, Upstream of MSIVs with no RPS/ESFAS Actuation; Reactor Coolant System Pressure vs. Time 7A.3.6-4 Full Power Steam Line Break Outside Containment, Upstream of MSIVs with no RPS/ESFAS Actuation; Reactor Coolant Temperatures (A) vs. Time 7A.3.6-5 Full Power Steam Line Break Outside Containment, Upstream of MSIVs with no RPS/ESFAS Actuation; Fuel Centerline Temperature vs. Time x Full Power Steam Line Break Outside Containment, [ j 7A.3.6-6 \m,/ Upstream of MSIVs with no RPS/ESFAS Actuation; Fuel Cladding Temperature vs. Time Amendment P v June 15, 1993
CESSAR sanricarian LIST OF FIGURES (Cont'd) O Fiqure subiect 7A.3.7-1 Feedwater Line Break at Full Power with no RPS/ESFAS Actuation; Containment Pressure vs. Time 7A.3.8-1 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Core Power vs. Time 7A.3.8-2 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; RCS Pressure vs. Time 7A.3.8-3 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Core Flow Rate vs. Time 7A.3.8-4 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Break Flow Rate vs. Time 7A.3.8-5 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Safety Injection Tanks Discharge Rate vs. Time 7A.3.8-6 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Mixture Level in Core vs. Time 7A.3.8-7 SBLOCA of 6 Inch Pressurizer Safety Valve Nozzle with no RPS/ESFAS Actuation; Collapsed Liquid Level in Core vs. Time 7A.3.8-8 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Core Power vs. Time 7A.3.8-9 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; RCS Pressure vs. Time 7A.3.8-10 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Core Flow Rate vs. Time 7A.3.8-11 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Break Flow Rate vs. Time O Amendment P vi June 15, 1993
CESSAR ERUicari3u
,/- .
.* 1
\.j LIST OF FIGURES (Cont'd)
Fiqure subiect 7A.3.8-12 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Safety Injection Tanks Discharge Rate vs. Time 7A.3.8-13 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Mixture Level in Core vs. Time 7A.3.8-14 0.041 FT 2 SBLOCA at Top of Upper Head (CEA Ejection) with no RPS/ESFAS Actuation; Collapsed Liquid Level in Core vs. Time 7A.3.8-15 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS Actuation; Core Power vs. Time 7A.3.8-16 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS Actuation; RCS Pressure vs. Time j# 7A.3.8-17 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS ( Actuation; Core Flow Rate vs. Time 7A.3.8-18 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS Actuation; Break Flow Rate vs. Time 7A.3.8-19 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS Actuation; Safety Injection Tanks Discharge Rate vs. Time 7A.3.8-20 SBLOCA of 3 Inch Cold Leg Nozzle with no RPS/ESFAS Actuation; Mixture Level in Core vs. Time 7A.3.8-21 SBLOCA of 3 Inch Cold Log Nozzle with no RPS/ESFAS Actuation; Collapsed Liquid Level in Core vs. Time l I l l l u 1 7N I ('v) Amendment P I vii June 15, 1993
CESSAR 8!nhuon g i
\
1.0 INTRODUCTION
The draft NRC policy on common mode failure (CMF) of protective system software (Reference 1) specifies the need to perform an evaluation of the capability of the plant design to cope with the l event initiators in Chapter 15 with a postulated pre-existing l common mode failure of the protection system software. As a I bounding analysis of the capability of the diverse equipment to l cope with such a condition, the evaluation in Reference 2 assumed that all automatic responses of systems using the protective software and the capability for manual actuation using these systems would be precluded. The evaluation assumed nominal plant i conditions at the initiation of each event and best estimate responses for the diverse reactor trip and emergency feedwater actuation equipment, and for the normal control systems and operator action. A review of the evaluation was performed in Reference 3. Subsequent discussion of the evaluation with the reviewer and the NRC staff (Reference 4) determined that the capability of the diverse equipment to provide adequate protection had been demonstrated for 19 of the 28 event initiators in Chapter 15. I Discussion of the evaluation with NRC management (Reference 5) l determined that a revised evaluation would be appropriate for the remaining 9 events while applying more relaxed criteria than those applied in Chapter 15, and crediting use of manual controls implemented in the design to comply with position 4 of the Reference 1 draft policy statement. The evaluation presented here presents the results of the revised evaluation of the 9 ovents which demonstrate the capability of { l the diverse equipment and reasonable operator response to provide adequate protection. The manual controls credited for actuation of Engineered Safety Feature Systems equipment are those presented in Reference 6 and shown in Figure 7A.1-1. These , comply with position 4 of the Reference 1 policy statement with j the addition of a switch to manually actuate closure of the containment air purge valves and a letdown line isolation valve. j l O d I l I Amendment P June 15, 1993 ] 7A.1-1 1
l L.) MP Divt.5[ mana/ag ($f AC TU* 1 ! DN Ci V a DI / (
- 4) 11 (4--
_. _g [s 9 __ _._ _
-O " ' G O . t ...,C.a., ..
-<C.... c..r c.ai ,
_ ('4 grg G_ _ Cl
- Cetament s Pue0 V*i v. tesisten u t.ie.a i.s.'r a
~ '
50 '1GP 43 Ci/ti M. .., , .._..m. . _ . . , , . . . _ , . . . t twptrat D*t l a putic ati;ms & ispic a f lO41 & legit a t tteet tir-Cr; eivstrcs a g , qg i I I c.wcm.sj pr.x l cos ;nor x l ss l m_..... g y Is.Q #[l'~ 7' 7' LC I j
-f ;a l~~1- - -
_ fm ,e , l ,'"*I bC '_) LC 8 I s
] ge , g C
[ <C ll C l MC C ll Mt l W l MCC l l aCC l l MCC l l MCC l l #CC l St (1 tru t *,7 101 Cl if C1 16 SCP 10f
*v='
- va* tr v I' v *sive t Pt!"* 6 vatvt trv (T *1t v.
6 vg vt run,V a sat vt ema a v at vt te vaivt vatvt vat VI tie - -a le s
,A Amendment P w) l m
June 15,1993 Figure
/ / DlVERSE MANUAL ESF ACTUATION INTERFACE TO ESF COMPONENTS 7 A.1 - 1
CESSAR nai"icuion 1 l C k 2.0
SUMMARY
The evaluation consisted of analyses of the 9 events to estimate the outcome of each event applying the initial conditions, equipment operability, operator actions and acceptance criteria described herein. The emphasis of the evaluation was to ensure a reasonable ability to cope with the events in a manner which preserves core coolability, prevents excessive RCS or containment overpressure, prevents excessive offsite doses and relies on reasonable operator response times. The criteria for core coolability, RCS pressure, containment pressure, offsite doses and operator action time are chosen to be appropriate for the beyond design basis categorization of each event when a concurrent low probability CMF of the protection system software is also assumed. 2.1 EVALUATION APPROACH The evaluations of nine events in conjunction with a hypothetical CMF in the NUPLEX 80+ software are enclosed. The nine events are:
- 1. Total Loss of Reactor Coolant Flow
- 2. Single RCP Shaft Seizure s 3. Single RCP Shaft Break
- 4. CEA Ejection
- 5. Letdown Line Break
- 6. Steam Generator Tube Rupture
- 7. Main Steam Line Break
- 8. Feedwater Pipe Break
- 9. Loss of Coolant Accident (LOCA)
The evaluations use best estimate assumptions regarding initial operating conditions and assume continued operability of the RCPs (except in the case of the loss of offsite power event) , the main steam and feedwater systems, and the NSSS control systems since they are not affected by the CMF. The Alternate Protection System (APS) provides an automatic high pressurizer pressure reactor trip and an automatic actuation of the emergency feedwater equipment on low steam generator level. 2.2 INSTRUMENTATION AVAILABLE TO THE OPERATOR Operator response is neccssary to help mitigate the short term effects and to accomplish subsequent recovery actions following each event. Diversity in the NUPLEX 80+ equipment and software assures that adequate instrumentation and controls will remain available for timely diagnosis and mitigation of the event initiators with the postulated software CMF. / ( The NUPLEX 80+ safety related display instrumentation is implemented in 3 segments: DIAS-N (Discrete Indication and Alarm Amendment P 7A.2-1 June 15, 1993
CESSAR nainemou System - Channel N), DIAS-P (Channel P) and DPS (Data Processing O System). Since the DIAS-N equipment may be affected by the postulated CMF, this evaluation conservatively assumes that the alarms and displays generated by this system will be disabled. Reference 6 presents the implementation of hardwired communication for the DIAS-P display of key indicators of critical safety functions, as shown in Figure 7A.2-1. These displays comply with Position 4 in the Reference 1 policy statement. They provide a dedicated display of the Category 1 parameters specified in Regulatory Guide 1.97 and would remain unaffected by the postulated commesn mode failure in the NUPLEX 80+ protection system software. The parameters displayed are listed in Table 7A.2-1. The DPS, which provides a redundant and diverse display of the indications and alarms presented by DIAS-N, would not be affected by the postulated failure. The DPS receives information used for display and alarm from the Process-Component Control System (P-CCS) , the Power Control System (PCS) and the Engineered Safety Feature-CCS (ESF-CCS). The P-CCS and the > PCS would not be affected by the postulated failure. Information provided to the DPS by the ESF-CCS is assumed to become unavailable due to the postulated failure. The P-CCS and PCS obtain key plant parameters either from isolated safety channel signals at the Auxiliary Process Cabinets or via control channel sensors which are separate from the safety equipment. The P-CCS and PCS obtain the sensed parameters in Table 2-1 via the former method. The DPS performs signal validation of this information and then compares the validated value for each parameter to the validated value determined by DIAS-N and generates an alarm if they are inconsistent. As a result, the operator will be alerted if a failure occurs in DIAS-N, and can compare DPS and DIAS-N indications to the DIAS-P display to determine if either system is providing an unreliable ! indication for the key parameters. I i Each UIAS-N and DPS display screen incorporates a rotating icon ! in the lower right corner to indicate that the display device is receiving data updates from its network. If the display device stops receiving data updates, the icon stops rotating. If a common mode failure were to lock up DIAS-N such that the displays remained on but the data provided to the display devices was not being updated, the icon Lould stop rotating on every affected display screen. The PCS implements independent control channel sensors for excore neutron flux data and detection of dropped control rods. Therefore, the DPS display of core power, and the core mimic representation of a successful reactor trip are not affected by the postulated failure. j 1 l Amendment P 7A.2-2 June 15, 1993
. - . . = _ _
DESIGN CESSAR CERTIFICATION The DPS provides alarms for conditions associated with reactor trip, pre-trip and ESF actuation which would not be affected by the postulated failure. The IPSO display of critical function status and key plant parameters is supported by the DPS and would not be affected by the postulated failure. Detection of high radiation levels in the secondary system, such as in the SG blowdown or the condenser, is performed by a radiation monitoring system which is diverse from the protection system and would not be affected by the postulated failure. Monitored information from this system is data linked to both the DPS and the DIAS. Therefore, the DPS displays of high radiation alarms in these areas would remain operable with the postulated failure. 2.3 JLABIS FOR OPERATOR RESPONSE TIME ESTIMATES As discussed in Reference 2, the evaluation of the capability of the System 80+ design to provide adequate protection for a common mode failure of protection system software coincident with a Chapter 15 event initiator credits reasonable operator action. The operator response times for the manual actuations presented in the following discussion are estimated by reviewing .the ( sequence of steps called for in the Emergency Procedure Guidelines (EPGs). The time required for each step is based on information provided in the draft revision to the ANS/ ANSI-58.8 Standard, " Time Response Design Criteria for Safety-Related Operator Actions," and its Appendix (Reference 7) and in the Accident Provention Group Report, " Application of the EPRI Operator Reliability Experiments Data to Update the ANS-58.8 Standard" (Reference 8). The ANS-58.8 Standard provides analysts with a methodology to evaluate the acceptability of response time intervals afforded to operators by the plant design. The assessment verifies that the design, including its automatic protective features, will provide operators with a sufficient margin for safety-related manual actions. The applicability of ANS-58.8 extends to Design Basis Events (DBEs) that result in (automatic) reactor trip. For such scenarios, the model and criteria of ANS-58.8 have been empirically tested and shown to produce estimates that bound the actual operator response data with 95% confidence. Thus, j ANS-58.8 provides conservative estimates for the operator ' response times to be credited in a safety analysis. To provide a reasonable estimate of the operator response for the beyond design basis analysis presented here, the ANS-58.8 model is adapted based on information provided in its Appendix and in Reference 8 which discuss the empirical operator response data h d used to verify the conservatism of the values presented in ANS-58.8. In the general ANS-58.8 model, the earliest time for l l operator action is preceded by a diagnostic time interval. It Amendment P 7A.2-3 June 15, 1993
CESSAR EnWICATION permits the operator to observe plant parameters,- verify O. automatic system responses, and plan subsequent actions. A longer diagnostic time interval is allocated for less frequent events for which the operator responses are less familiar. This is applicable for circumstances in which the protective system functions normally and the operator's role is to observe those responses and diagnose the plant condition to determine appropriate subsequent actions. For this evaluation, in which the protective systems are assumed to fail to act, it is appropriate to credit operator action to initiate a reactor trip consistent with response time data determined for ATWS scenarios. The data discussed in the ANS-58.8 Appendix and in Reference 8 indicate that the earliest time for operator action in this scenario is typically less than 1 minute. The DPS will provide alarms indicating conditions corresponding to reactor trip setpoints on displays which the operator normally uses, including the indication of an alarmed condition for key indicators of critical function status displayed on the IPSO. The display of rod bottom lights on the PCS core mimic, which is a normal indicator of a successful reactor trip for the operator, would indicate that a trip had not occurred. This would be confirmed by the normal DPS display of core power and by the IPSO display of core power and reactor trip status. The true core power can readily be verified by comparison to the hardwired DIAS-P display. Based on the availability of familiar indications and alarms indicating the need for a reactor trip, the availability of familiar indications that one had not occurred, and the empirical response data discussed above, operator action to initiate a manual reactor trip within two minutes of reaching an alarmed trip condition is considered a reasonable estimate for the purposes of this beyond design basis analysis. The operator actions called for in this evaluation would be performed by the control room staff as part of the Standard Post-Trip Actions which would be initiated immediately after a reactor trip and would precede event diagnosis. Since it is common for operators to memorize the standard post trip actions during their training, this procedure is considered to be highly familiar. The DPS provides a familiar display of all parameters called for in this procedure to verify critical functions. Most of these are also provided on the dedicated DIAS-P display. Four minutes are allocated during the first nine minutes of the response sequence, for the supervisor and two operators to identify that a global problem has occurred in the DIAS-N displays and to determine that the DPS displays should be used instead. This decision is supported by the DPS alarm indicating inconsistency between DPS and DIAS-N validated parameter values, as well as the DIAS-P display which uses hardwired input of Amendment P 7A.2-4 June 15, 1993
CESSAR ME"icari3u ! n) ( v sensed parameters. Subsequent to this decision, if a step in the EPG involves simple verification of parameters which are readily available on a normal DPS display and can be verified on DIAS-P, and the value can be expected to be within the acceptable range, then that step in the EPG is estimated to take 1 minute per manipulation. This is consistent with the ANS-58.8 model for performing familiar actions. The evaluation assumes that the normal full staff are available, as follows: initially 2 operators and one supervisor are available in the main control room (MCR), and all 3 are in the control work space within one minute after reaching an alarm condition calling for a reactor trip. A 3rd operator and a 2nd supervisor are assumed to arrive in the MCR within 5 minutes of the alarm calling for reactor trip and a STA is assumed to arrive within 10 minutes of that alarm. To determine an estimate for the total time involved in performing each of the manual actuations credited in the evaluation, a time line is constructed which sums the time involved for operator responses performed in series. Credit is taken for activities which the operators would perform in parallel. Specific estimates of reasonable response times are provided in the following event evaluations. 2.4 BPECIFIC RESPONSE TIME ESTIMATES For the main steam line break outside containment, the DPS would display alarms indicating high power, low steam generator pressere and low pressurizer pressure within 15 seconds. All of these are normally associated with a reactor trip condition. The DPS core mimic display would indicate that the rod bottom lights ordinarily associated with a successful reactor trip had not come on. The DPS display of core power would also indicate that a reactor trip had not occurred. The IPSO would also indicate that a reactor trip had not occurred and that the reactor remained at 100% power. It is probable that the effect of the CMF on Lhe DIAS-N displays would be a lack of indication or an indication of no change, rather than a false indication of a reactor trip. J With these familiar indications of the need for a reactor trip, a reasonable best estimate is that the operator would manually actuate the reactor trip within 2 minutes of event initiation. { l The DPS's validated display of pressurizer pressure (confirmed by _ the DIAS-P display) and associated low pressure alarm, would j indicate the need to manually actuate safety injection. The i DPS's validated display of SG pressure and RCS temperature ! (confirmed by the DIAS-P display) and associated alarms, would -'
,_s provide indication of the need to close the main feed valves and
\ the MSIVs. A reasonable estimate of the responses of the control
.( room operators in proceeding through the standard post-trip actions indicates that safety injection would be manually Amendment P 7A.2-5 June 15, 1993
CESSAR nahuou actuated in 15 minutes, the main feed valves closed in 17 O minutes, and the main steam isolation valves would be closed in 20 minutes. For the feedwater line break at the economizer nozzle, the reactor trip would be initiated automatically by the Alternate Protection System on high pressurizer pressure. The DPS's validated display of SG pressure, RCS temperature and containment pressure (confirmed by the DIAS-P display) and associated alarms, would provide indication of the need to close the main feed valves and the MSIVs and actuate containment spray. A reasonable estimate of the responses of the control room operators in confirming the automatic trip and proceeding through the emergency procedures indicates that manual closure of the main feed valves would occur at 16 minutes, manual closure of the MSIVs within 18 minutes and manual actuation of containment sprays at 17 minutes. For a loss of coolant accident, the DPS's validated display of pressurizer pressure and level (confirmed by the DIAS-P display) and associated alarms would provide indication of the need to manually initiate reactor trip and safety injection. A reasonable estimate of this response indicates that manual actuation of the reactor trip would occur within 2 minutes after the low pressurizer pressure alarm is generated at 1825 psia. Safety injection would be actuated within 14 minutes after the low pressure alarm. Also, two RCPs would be tripped at 15 and 21 minutes following this alarm. For the limiting LOCA addressed in this evaluation, these times correspond to manual actuation of a reactor trip within 3 minutes, safety injection within 15 minutes, and RCP trip within 16 and 22 minutes of event initiation. For a CEA ejection, the DPS would provide an immediate indication and alarm of the power excursion, which would be followed by indications associated with a LOCA. A reasonable estimate of the response times indicates manual actuation of a reactor trip at 2 minutes and safety injection at 15 minutes after the CEA ejection. For the letdown line break the following alarm, provided by the DPS, would alert the operator immediately of the event: Letdown line low pressure alarm (downstream of the break). A few seconds later, the nuclear annex high radiation, high temperature and high humidity alarms would be triggered. Within a few ninutes, alarms indicating pressurizer low level, high sump level in the nuclear annex, and a low level in the volume control tank would occur. Based on these alarms and indication of a continued letdown flow with a continued decrease in pressurizer level, the operator should be able to determine the need to Amendment P 7A.2-6 June 15, 1993
CESSAR naibou O isolate the leak within 10 minutes. The operator is estimated to attempt isolation via the ESF-CCS, determine that this has failed and initiate isolation via the hardwired controls within 15 minutes-of event initiation. For the steam generator tube rupture, as discussed in the Reference 2 evaluation, isolation of the affected steam generator is normally initiated by operator action, per the emergency procedures. The DPS provides high radiation alarms and indications appropriate for these actions. The delays involved in determining a lack of response to the ESF-CCS MSIS signal and initiation of manual closure of the main steam isolation valves via the hardwired controls and termination of normal feedwater flow via the P-CCS would not cause radiological releases to exceed 10 CFR 100 guidelines. 2.5 NON-LOCA COOLABILITY CRITERION The coolability criterion used for non-LOCA events is the 10 CFR 50.46 limit of cladding temperatures less than 2200*F. DNBR, although not used as a coolability criterion, was used as an indicator that the 2200*F limit was not violated in cases where the DNBR remained above the specified acceptable fuel design limit of 1.24. 2.6 EVENT DEFINITIONS For breaks in small lines (e.g., the 6" pressurizer safety valve line) the capability of the diverse equipment and operator action to provide protection are evaluated. The core coolability acceptance criteria used are the 10 CFR 50.46 criteria. Operator action is credited to mitigate the event and realistic assumptions are made regarding initial operating conditions and equipment operability. The event was also evaluated with respect to offsite doses. Steam line breaks outside containment are considered, including the double-ended break of a main pipe. The steam line break is considered for its impact on core overpower, core coolability, offsite doses and peak RCS pressure. Operator action is assumed at 30 minutes to perform steam and feedwater line isolation, and safety injection actuation using available diverse equipment. Double-ended feedwater line breaks are considered inside , containment. Check valves inside the containment prevent steam I generator blowdown for breaks outside containment. Hence, the I feedwater line break inside containment and downstream of the check valves is evaluated for its impact on containment pressure. The evaluation assumes the lack of automatic steam /feedline L/
.) isolation and the continued addition of main feedwater to the steam generators. The acceptance criterion is the ASME Service Level O stress 1imit which corresponds to approximately 145 psia.
Amendment P 7A.2-7 June 15, 1993 l l
CESSAR 8lai"lCATION ; l l l J The letdown line break outsir's containment and the steam O J generator tube rupture evente are slow depressurization events for which the control sprems have more significant benefit. ! These events allow at least 30 minutes for operator intervention without fuel damage. The loss of flow, RCP shaft seizure, RCP shaft break and CEA ejection (without primary system rupture) events were evaluated crediting the best-estimate overpower margin of about 135% in the System 80+ design. This allows these events to result in minimum DNBRs above the specified acceptable fuel design limit. In addition to DNBR, the CEA ejection event was evaluated with respect to core coolability and fuel enthalpy. For the CEA ejection event with primary system rupture, the event was evaluated with respect to 10 CFR 50.46 criteria and offsite dose consequences. O O Amendment P 7A.2-8 June 15, 1993 !
CESSAR Ennncum 7-^) ( '%. l TABLE 7A.2-1 KEX_ INDICATORS OF CRITICAL FUNCTION STATUS DISPLAYED CONTINUOUSLY VIA DIAS-P l l I SENSED PARAMETERS: 1 RCS Pressure Coolant Temperature (Hot) Coolant Temperature (Cold) Containment Pressure (Wide Range) Containment Pressure (Narrow Range) Steam Generator Pressure Steam Generator Level (Wide Range) Pressurizer Level Neutron Flux Power Level (Safety Channels) / Reactor Cavity Level N' RCS Radiation Level Containment Area Radiation Containment Hydrogen Concentration Containment Isolation Valve Status Emergency Feedwater Storage Tank Level CALCULATED BY PAMI COMPUTER: Core Exit Temperatures Reactor Vessel Coolant Level RCS Subcooling r's
's-Amendment P June 15, 1993
l' (~~ I \
- u; .
I r ue 1,c.c~, t a 'f r4* e 1 7" fr" F - - - - ---------] l l
)
Pata4 *( #1 ti$s MrJ f ( l
.________.j; _ .,_ _ _ _ _ l g g .itse+mdj ectq-cts [___.
I
. ..:. l p--- .
gj i3
~
r.cos e t.<t p-pale ! I
}
l
~ ----p r;,. ,} _ _ _
g l
] ;-- _ _ -- _- - J _____,,j
* #L"' I I r------------ g - - --+
q )
#^* *
-- l l i
c- as fi t apt .a gl[;, 7
- i l
I a r ') i [d#a, l' I
'r; k pag.e a 3 l
)
gias.w tit *g av s ge t lgiset a v s t e 0*( e fi?e
~~ F~ t vas t. g s ynt t.
l Daill Celt D 8 () d'0 9 l Daten I galas g- - 1 [' l j
\ l%Ih I l !
f Paul 5 ._____...__J
'--. ! y l l
01.ra ..g :::::::::::::: h
! ::.4____ __j ,,,,,
Vf *I
~k_,, *h- - *'
s iaa r l l II l j l ritte Of fit
# lj fj d I
( ***t 0C M 'P*-
. . .. - : : :.&k k l V if(( ![k r(53xhg=.((CE$
; d *'
l . .'"t ,',. ~---
-**~~
e 1( i l ritte CPflC lir 77 { em;-r u ].. _ . _ _ _ _ _ _ . _ _ _ ' ,_ _ _ ._ _. _ _ a ca v a u~- i i s ic.ea.. ori r-- t co etteete I $5 I i
-J q *
- s e u r a t ,I _ _ _ _ _ _ _ . __J I ! 3' - I i yri,t70 lst 'I L . _ _ _ _ . _._ g J.
et i . . it...a f t wc is aeoviet s rea (*c sv-t 940 1 ALL CattCDev i PAasser f t*1 Act (0=eveeltait 0
' G . f ( $ le f3 $3?N f M( PP$ AM$ Tef( ( $r =(($
A ' Amendment P / i June 15,1993 s x .
- n. Figure j
OlVERSITY IN DISPL AY OF CATEGORY 1 PAR AMETERS
CESSAR nainemou 9 v 3.0 INDIVIDUAL EVENT EVALUATIONS 3.1 TOTAL LOSS _OF FORCED REACTOR COOLANT FLOW 3.1.1 IDENTIFICATION OF EVENTS This event is caused by the simultaneous loss of power to the 13.8 KV electrical buses supplying the Reactor Coolant Pumps (RCPs). The only credible failure that can result in the simultaneous loss of power to these buses is a complete loss of offsite power to the unit main and auxiliary transformers that would also result in a turbine-generator (T/G) trip and loss of normal electrical power to station equipment. The postulated common mode software failure is assumed to preclude PPS initiation of a reactor trip on low RCP speed. However, upon the T/G trip, a rapid reduction in reactor power would be initiated by the Reactor Power Cutback System (RPCS). A full reactor trip would occur soon thereafter, as follows. The loss of normal electric power to station equipment would include the 4.16 KV non-safety buses that power the motor-generator sets that provide power to the Control Element N Drive Mechanisms. As discussed in the Reference 2 evaluation, on loss of power, the Control Element Drive Mechanisms (CEDM) motor-generator sets would begin to coast down and an under voltage relay would open an output breaker. This would cut power to the CEDMs, allowing the control rods to drop into the core by gravity. Even quicker action would be taken by an output contactor on each motor-generator set, that will open at four seconds after power is lost on the bus, cutuing power to the CEDMs and causing the CEAs to drop into the core at that point. 3.1.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a total loss of reactor coolant flow was simulated using the CESEC-III computer program. The minimum DNBR was calculated using the CETOP computer code which uses the CE-1 CHF correlation. These codes are described in Section 15.0 of CESSAR-DC. B. Input Parameters and Initial Conditions The input parameters and initial conditions used to analyze the NSSS response to a total loss of flow are presented in Table 7A.3.1-1. \ Amendment P 7A.3-1 June 15, 1993
CESSAR nin"icari:n C. Results O The dynamic behavior of important NSSS parameters following a total loss of reactor coolant flow is provided in Figures 7A.3.1-1 through 7A.3.1-5. The loss of offsite power (assumed to occur at 1.0 second) causes the plant to experience a simultaneous turbine trip, loss of main feedwater, condenser inoperability, and a coast down of all four reactor coolant pumps. At 5.0 secerids power is interrupted to the CEA holding coils. Shortly thereafter, the CEAs begin to drop resulting in a rapid reduction in core power. The reduction in reactor coolant flow together with the core being maintained at full power preceding CEA drop resulta in a degradation in DNBR. The minimum DNBR of 1.74 occurs at 6.9 seconds. Subsequent to this minimum, the DNBR continuously increases until 30 minutes at which time the operator is assumed to take control of the plant. Figures 7A.3.1-1 through 7A.3.1-5 demonstrate that the plant remains in a stable condition for at least 30 minutes. 3.
1.3 CONCLUSION
S The minimum DNBR was shown to remain well above the specified acceptable fuel design limit of 1.24 ensuring that no fuel failures occur. Also, the plant was shown to remain in a stable condition for at least 30 minutes ensuring that the operator has sufficient time to take control of the plant in order to execute a controlled cooldown. O Amendment P 7A.3-2 June 15, 1993
CESSAR 88Hncoia
,O f_,
TABLE 7A.3.1-1 LOBB._-_OF RC8 FLOW RATE INPUT PARAMETERS AND INITIAL CONDITIONS Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR 1.50 Os G (' \ Amendment P June 15, 1993
[~N s 3.0 \. 2.6 - 2.6 - 2.4 - 2.2 - s 8 2 2.0 -- o a z 2 1.8 - [] 1.6 - \._.) 1.4 - 1.2 - 1.0 i i i I I i i i 3 3 ' ' ' O 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 TIME, SECONOS Amendment P June 15,1993 - Figure 3y, /6 ' ** ' "*" " Jo"se*e"" "#l' ^ """' " z. 3.,.,
1 i O 1.2 , 1.1 2 1.0
>, 0.9 -
O - d : w 0.8 - x - O : o . o 0.7 - N 5
~
0 0.6 - 2 - c: - o ~ z 0.5
~
0.4 0.3 2 0.2 ; ;
; j-; J, [ ; ;-- ; i ; ;
O 3 6 9 12 15 TIME, SECONOS Amendment P June 15,1993 su Figure dh / u LOSS OF OFFS!TE POWER WITH NO RPS ACTUATION NORMAllZED CORE FLOW vs TIME 7 A.3.1 -2
sp'0 e 3 *k9,' 5 N\\(o . O Y A %# IMAGE EVALUATION j/
$q(f TEST TARGET (MT-3)
N /77p/ " g e? f f '",[,4"ftN#4 s s.7 g[/ gxks
+ <
1.0 lf m M p a gn c v: == 4 l.l b e ll2p t l.8
- 1 1.25 1.4 l 1.6 N
4 150mm > l i i I 4 6" > l i t 4'DP 4 4. ey4,/+,.%,<g + /,s po% : wcy ;;,r ,*+ $ 4<,@ pd sp , o%, c ,,p g : J [ g 48* bIssw _.##1gamssesghWN. e mamh
4 s'&
*' qf~ , ,,,
O :. ' IMAGE EVAL.UATION f6
.M
?k^ //// / f,f?
\//// TEST TARGET (MT-3) .4%
$/ g) // I l.0 ?'
^^ M22 u y it --
U 2.0 l,l llih23 I Hlw.8 i =a 1.25 ! 1.6 l llI l I[ I.4-
- 1. i mm 1
w -.- _ _ _ _ _ . 150mm >
- w. . . _ _ . _ . _ _ _ . _ . _ _ _ _ _ . _
6" > s a 9;?f ,gy
'h' //4%
+ . ~
v;c
- ? /y ct U
, *p +;;, /////q\
g 7 jgb6 y#74 g, 4ls 9:s y 1 1
"Ni n , .
A.9,
. CA .8IMAGE EVAL.UATION 1 r<ep
\),o/ff 1 [,[ % k# TEST TARGET (MT-3)
/ ./fp(g f; 'f4?
\ h/ % '
i
+
i 4 6" >
* +
4k>*%, s e#i 4, 3 y
~
/# oS /////o>
g s gr n . .,,p ,g .o 0} ( kb* fY' y% ;...
- v. ..
4$> - - c....., : k w . w. n ;s.-.:n sad &Gt A .__._. _a.eu R ll
, , .. . .. . .. . ~ . . . . . - . - . . . .. . .. . .. . - . .
1 I
.l 4
( - 4 120 , 100' b T 80 H Z uJ O c > g 60
- g. '
w 5 0 1 i 1 40 t L l a 20 7 1 1 t.
+
t
^~ ^ # ' ' ' ' '
- 0 0 200 -400 600 800 1000 1200 1400 1600 TIME, SECONDS
.I i
.. r Amendment P I t June ' 15, '1993
- 3. ' Figure ,
LOSS OF OFFSITE POWER WITH NO RPS ACTUATION
- m. ,
af POWER vs TIME - 7 A 3.1-3
,...,,-y,. ., ,w.,h_-.- ..*-,..r,---,--
2800 O 2600 2400
< t k j N
@ 2200 7
$ i E !
cc l 2000
~
1800
' ^ ' ' ' ^
1600 ' 0 200 400 600 800 1000 1200 1400 1600 TIME. SECONDS l Amendment P June 15,1993 m Figure LOSS OF OFFSITE POWER WITH NO RPS ACTUATION df / u RCS PRESSURE vs TIME 7 A.3.1-4
,/ l
\ 640 _
620 o' 600
?
s Ni s 8c: 580 560
~
.i , ,,, .t,,,, .L J ,1- f- -
0 200 400 600 800 1000 1200 1400 1600 TIME, SECOt4DS Amendment P f']1 June 15,1993 l w Figure dfd / LOSS OF OFFSITE POWER WITH NO RPS ACTUATION RCS TEMPERATURES vs TIME 7 A.3.1 -5
CESSARnahmn m 3.2 SINGLE RCP SHAFT SEIZURE / SHAFT DREAK 3.2.1 IDENTIFICATION OF EVENTS A single reactor coolant pump shaft seizure can be caused by seizure of the upper or lower thrust-journal bearinge. A single reactcr coolant pump shaft break could be caused by mechanical failure of the pump shaft. 3.2.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a reactor coolant pump shaft seizure / break was simulated using the CESEC-III computer program. The minimum DNBR was calculated using the CETOP computer code which uses the CE-1 CHF correlation. These codes are described in Section 15.0 of CESSAR-DC. B. Input Parameters and Initial Conditions The input parameters and initial conditions used to analyze the NSSS response to a reactor coolant pump shaft seizure / break are presented in Table 7A.3.2-1. C. Results \ The dynamic behavior of important NSSS parameters following a reactor coolant pump shaft seizure / break are provided in Figures 7A. 3. 2-1 through 7A. 3. 2-7. The reactor coolant pump shaft seizure / break results in a rapid decrease in reactor coolant flow. The flow reduction terminates within a few seconds and stabilizes at a flow of approximately 75% of the initial flow. The reactor is assumed not to trip due to the CMF. The flow reduction results in a degradation in DNBR. The minimum DNBR of 1.59 occurs at 4.2 seconds. Subsequent to this minimum, the DNBR slowly increases until an essentially constant value is reached. At 30 minutes the operator is assumed to trip the reactor at which time the DNBR will again increase. The operator will then perform a controlled cooldown of the plant. Alarms and ind.ications would be provided via equipment not affected by the CMF to support operator action to trip the reactor. Figures 7A. 3. 2-1 through 7A. 3.2-7 demonstrate that the plant remains in a stable condition for at least 30 minutes. 3.
2.3 CONCLUSION
S The minimum DNBR was shown to remain well above the specified acceptable fuel design limit of 1.24 ensuring that no fuel failures occur. Also, the plant was shown to remain in a stable
/~'N condition for at least 30 minutes ensuring that the operator has (N sufficient time to trip the reactor and take control of the plant in order to execute a controlled cooldown.
Amendment P 7A.3-3 June 15, 1993
CESSAR 8!,uirlCATION O THIS PAGE INTENTIONALLY BLANK O O Amendment P 7A.3-4 June 15, 1993
CESSAR !!!nneui:,. (G TABLE 7A.3.2-1 SINGLE RCP SHAFT SEIZURE / BREAK INPUT PARAMETERS AND INITIAL CONDITIONS Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, *F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR 1.50 0 Amendment P June 15, 1993
A l s 3.00 , 2.50 - i 2.00 cc
$ 1.50 Q
1.00 g 0.50 0.00 O 12 24 36 48 60 TIME, SECONDS Amendment P June 15,1993
"""~
mre[/ d ""*" *"""";;; ";"!! ""* ^ =' " 7 A.3.2 1
3.00 2.50 -
)
2.00 1
$ 1.50 l
I 1.00 0 0.50 0.00 O 360 720 1080 1440 1800 TIME. SECONDS Amendment P June 15,1993 m Figure SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION [fd u DNBR vs TIME 7 A.3.2-2
t 1.10 1.00 5 0.90 f z i 9 U s u g 0.80 9 u. b a 0.70 - A l (G 0.60 0.50 O 12 24 36 48 60 TIME, SECONDS Amendment P \s June 15,1993
= Figure
/ u SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION RCS FLOW vs TIME 7 A.3.2-3
i 1.10 O 1.00 F 0.90 8 P O E 0.80 i 9 u. O 0,70 0 0.60 0.50 O 360 720 1080 1440 1800 TIME. SECONDS Amendment P June 15,1993 g adr / U SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION RCS FLOW vs TIME 7 A.3.2 - 4
.,/~x 's ) 2500 _
2400 - 2300 5 ? E 8! 3 2200 -
!O E
x 2100 '\ 2000 - 1900 O 360 720 1080 1440 1800 TIME. SECONDS l Amendment P G June 15,1993 m Figure jfd
/ u SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION RCS PRESSURE vs TIME 7 A.3.2--5
110 _ 100 e 7 90 6 5 80 5 3: 2 70 - O 60 i ,,,,! ' ' 50 0 360 720 1060 1440 1800 TIME, SECONDS Amendment P June 15,1993
,, Figure
/
/ SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION jfpg / / POWER vs TIME 7 A.3.2-6
f-~s, 700 650 LL. 600 - 2 IN a 2 fu n. b
- 550 0 -
e [' '\ ' 500 450 -
, i i '
400 0 360 720 1080 1440 1800 TIME, SECONDS i O Amendment P June 15,1993 w Figure jfd / u SHAFT SElZURE/ BREAK WITH NO RPS ACTUATION RCS TEMPERATURE vs TIME 7 A.3.2-7
CESSAR 8lMLwon ! I i l l / \ U 3.3 CEA EJE_CTION 3.3.1 IDENTIFICATION OF EVENTS A CEA ejection results from a circumferential rupture of the control element drive mechanism (CEDM) housing of the CEDM nozzle. However, the case presented in this section does not assume rupture in the primary system. The consequences of a CEA ejection event resulting in primary system rupture are discussed in Section 3.8 of this appendix. 3.3.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a CEA ejection event was simulated using a method of analysis based on that referenced in Section 15.0.3 of CESSAR-DC. B. Input Parameters and Initial Conditions The input parameters and initial conditions used to analyze the NSSS response to a CEA ejection event are presented in A Table 7A.3.3-1.
~
C. Results The dynamic behavior of important NSSS parameters following a CEA ejection event is provided in Figures 7A.3.3-1 through 7A.3.3-4. The ejection of the CEA causes the core power to spike to approximately 117% in less than 100 ms. The reactor coolant system pressure increases due to the increase in RCS temperatures caused by this power spike. The pressurizer pressure peaks at approximately 2280 psia within a few seconds of event initiation and is then reduced to nominal operating values by the pressurizer sprays due to the action of the pressurizer pressure control system. The Doppler and moderator reactivity feedback due to the heatup caused by the power spike, coupled with the constant turbine power demand, result in core power falling back to re-stabilize at 100% power within approximately 90 seconds following event initiation. The DNBR decreases rapidly following the power spike caused by the ejected CEA. The minimum DNBR is greater than 1.5, thus no fuel failures would be expected to occur. Subsequent to the minimum, the DNBR increases due the reduction in core power. The peak clad temperature obtained during the transient was less than 700 F, well below the 2200*F limit. Also the peak l centerline temperature was less than 2800*F, which is /]/ approximately half of that at which fuel melting could occur. The peak radially averaged fuel enthalpy was less j j than 40% of the 280 cal /gm value normally used for event i l Amendment P 7A.3-5 June 15, 1993 l l 1
CESSAR 8lnhia acceptance. The resulting radiological consequences of the O CEA ejection event are bounded by the doses presented in Section 3.8 of this appendix, since no fuel failure was predicted to occur. At 30 minutes the operator is assumed to take control of the plant in order to trip the reactor and execute a controlled cooldown. 3.
3.3 CONCLUSION
S The minimum DNBR was shown to remain well above the specified acceptable fuel design limit of 1.24 ensuring that no fuel failures occur. Also, the peak cladding temperature was shown to be well below the 2200'F limit. No fuel melting occurred and the peak radially averaged fuel enthalpy remained less than 280 cal /gm. The radiological consequences for this event meet 10 CFR 100 guidelines. The maximum RCS pressure was well below the Service Limit C value as defined in the ASME Code. O O Amendment P l 7A.3-6 June 15, 1993 j l i
(e! h h k bili ICATION j i i !\ ss/ l TABLE 7A.3.3-1 l CEA EJECTION INPUT PARAMETERS AND INITIAL CONDITIONS Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, *F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR Pre-ejected = 1.0 Post-ejected = 1.75 f 'u ) p G Amendment P June 15, 1993
1 .O j 2.0 t Ng 1.5 - t 2 9 w O tt u d w 3 o s CL 1.0 9 w 0 cc w w tr
/% i O O
(V 0.5 - i 0 ,ii ii,,ii.>>,,iiii,i,iii i,ii , i3 , ij,ii,,,i,i 0 400 800 1200 1600 2000 TIME. SECONDS I l I
-)
1 1 l
/
[ Amendment P
\ June 15,1993 m Figure
/ CEA EJECTION WITH NO RPS ESFAS ACTUATION CORE AVERAGE POWER vs TIME 7 A .3.3- 1 i
- G 4-3-
E z - 0 2-r 9 1-0 ,,,,i;iiiiiiiii,ii,,iiiiiiii,i;iiiiii,iijii,,,,ii, 0 400 800 1200 1600 2000 TIME, SECONDS Amendment P , June 15,1993 , m Figure ! [fd / u CEA EJECTION WITH NO RPS/ESFAS ACTUATION MINIMUM DNBR vs TIME 7 A.3.3-2 i
I l
,CN l (m) 1 l
664 - l J 662 - 660 - 658 - o _ ur
@ 656 -
a - a:
$ 654 -
2 ua - 0 652 - Z__ Q - f C t w 3 650 - a ~ d 2 648 - 646 - 644 - 642 - 0 400 800 1200 1600 2000 TIME, SECONDS C' Amendment P ( June 15,1993 tu Figure dfd I
/ u CEA EJECTION WITH NO RPS/ESFAS ACTUATION MAXIMUM CLADDING SURFACE TEMPERATURE vs TIME 7 A.3.3-3
2800 f 2700 - 2600 - 2500 -
- u. -
o ui 2400 - - 5 - E c. 2300 - E w 1 ~ W 2200~l ; N -
- 2100 -
b _ f I
- 2000 -1 1900 -
1800 - 1700 , , ;,, ,,,,,,,,,,,,,,ii,i,,,,,,,j,isi,, ,, 0 400 800 1200 1600 2000 TIME. SECONDS , l l Amendment P June 15,1993
= Figure ! / CEA EJECTION WITH NO RPS ESFAS ACTUATION MAXIMUM FUEL CENTERLINE TEMPERATURE vs TIME 7 A.3.3-4
CESSAR MAMication \ 3.4 LETDOWN LINE BREAK OUTSIDE CONTAINMENT 3.4.1 IDENTIFICATION OF EVENTS Direct release of reactor coolant may result from a break or leak outside containment of a letdown line, instrument line, or samplo line. The double-ended break of the letdown line outside containment, upstream of the letdown control valve was selected for this analysis because it is the largest line and, thus, results in the largest release of reactor coolant outside the containment. A letdown line break can range from a small crack in the piping to a complete double-ended break. The cause of the event may be attributed to corrosion which forms etch pits, or to fatigue cracks resulting from vibration or inadequate welds. 3.4.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a letdown line break event was simulated using the CESEC-III computer program. The minimum DNBR was based on the results of the steam generator tube rupture event results (see Section 3.5 of this appendix). The DNBR for the steam generator tube rupture was calculated using the CETOP computer code which uses the CE-1 CHF correlation. These codes are described in Section 15.0 of CESSAR-DC. B. Input Parameters and Initial Conditions l l The input parameters and initial conditions used to analyze l the NSSS response to a letdown line break event are i presented in Table 7A.3.4-1. l C. Results The dynamic behavior of important NSSS parameters following a letdown line break is provided in Figures 7A.3.4-1 through 7A.3.4-3. The letdown line break causes the RCS pressure to decrease due to the loss of primary coolant inventory out the break. The pressure decrease is arrested due to the action of the pressurizer heaters. However, the pressurizer liquid level continues to decrease. The small pressure decrease does cause a degradation in DNBR. This degradation is bounded by the results of the steam generator tube rupture event presented in Section 3.5 of this appendix since both events are loss of reactor coolant inventory events and the tube rupture results in a much more f ( significant reduction in pressure and thus DNBR than does the letdown line break event (see Figure 7A.3.5-1). Since no fuel failures were experienced in the tube rupture analysis, and in the Chapter 15 analysis event termination Amendment P ! 7A.3-7 June 15, 1993
CESSAR nuirlCATION O was assumed to be initiated manually at thirty minutes via isolation of the letdown line; the radiological consequences of this event will be bounded by those presented in Section 15.6.2 of CESSAR-DC. The capability to perform this isolation will be available with a CMF since the hardwired manual controls proposed in Reference 6 will be augmented to include a switch for closing a letdown isolation valve and containment purge valves. 3.
4.3 CONCLUSION
S The minimum DNBR was shown to remain well above the specified acceptable fuel design limit of 1.24 ensuring that no fuel failures occur. Also, the plant was shown to remain in a stable condition for at least 30 minutes ensuring that the operator has sufficient time to take control of the plant in order to execute a controlled cooldown. The radiological consequences meet 10 CFR 100 guidelines. O O Amendment P 7A.3-8 June 15, 1993
CESSAR HE"icari:n !
- r s ,
i TABLE 7A.3.4-1 L_EIDOWN LINE BREAK ') INPUT PARAMETERS AND INITIAL CONDITIONS l (CASE FOR MINIMUM DNBR) Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, *F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR 1.50 p'% f ( A3nendment P June 15, 1993
.r 3 2500 _
~
2400
<t 2300 -- -
ui s 8 y 2200 '- c. b u s g 2100 - E o. / () 2000 1900 1800 O 300 600 900 1200 1500 1800 TIME. SECONDS Amendment P June 15,1993
- 0 LETDOWN LINE BREAK, OUTSIDE CONTAINMENT, UPSTREAM OF LETDOWN LINE CONTROL VALVE PRESSURIZER PRESSURE vs TIME 7 A.3.4-1
i l 9 30 25 H 20 d 5a N 15 3 N w 10 c. 5
' '=' ' >
0 0 300 600 900 1200 1500 1800 TIME, SECONDS Amendment P June 15,1993 LETDOWN LINE BREAK, OUTSIDE CONTAINMENT, 0"
- UPSTREAM OF LETDOWN LINE CONTROL VALVE PRESSURIZER WATER LEVEL vs TIME 7 A.3.4-2
. w - (j 60000 _ 50000 - 2 3 ui O 8 40000 '- e Q 5 O 8 30000 - a . b -3 O E o 20000 - a 5 N s ~ 10000 - 0 0 300 600 900 1200 1500 1800 TIME, SECONDS .[ Amendment P June 15,1993 LETDOWN LINE BREAK, OUTSIDE CONTAINMENT, pyg Mimit f
' u UPSTREAM OF LETDOWN LINE CONTROL VALVE INTEGRATED PRIMARY COOLANT DISCHARGE vs TIME 7 A.3.4-3
CESSAR n!Hncm. ( v. 3.5 S.TGAM GENERATOR TUBE RUPTURE 3.5.1 IDENTIFICATION OF EVENTS The Steam Generator Tube Rupture (SGTR) accident is a penetration of the barrier between the RCS and the main steam system and results from the failure of a steam generator U-tube. The most likely failures involve the formation of etch pits or small cracks in the U-tubes or cracks in the welds joining the tubes to the tube sheet. However, for this evaluation a double-ended rupture is assumed as this is most limiting. 3.5.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a steam generator tube rupture was simulated using the CESEC-III computer program. The minimum DNBR was calculated using the CETOP computer code which uses the CE-1 CHF correlation. These codes are described in Section 15.0 of CESSAR-DC. B. Input Parameters and Initial Conditions ( (f The input parameters and initial conditions used to analyze the NSSS response to a steam generator tube rupture are presented in Table 7A.3.5-1. C. Results The dynamic behavior of important NSSS parameters following a steam generator tube rupture is provided in Figures 7A.3.5-1 and 7A.3.5-2. This evaluation focuses on the determination of the minimum DNBR since the radiological consequences of this event will be bounded by the CESSAR-DC Section 15.6.3.1 event if no fuel failure occurs. The Chapter 15 event assumed an early reactor trip as this was determined to be limiting with respect to radiological releases. Thus a trip at 30 minutes due to a CMF would
'esult in less adverse consequences provided the affected steam generator can be isolated. Steam generator isolation can be assumed to occur at 30 minutes with a CMP due the addition of the hardwired manual controls proposed in Reference 6.
Upon rupture of a steam generator tube, the PCS pressure , decreases due to the decrease in RCS inventory. This reduction in pressure results in a degradation of DNBR. This degradation continues until 30 minutes at which time (A the operator is assumed to trip the reactor and isclate the affected steam generator. The minimum DNBR of 1.35 occurs at 30 minutes. Since the DNBR remains above the specified Amendment P 7A.3-9 June 15, 1993
l CESSAR nn%mou O acceptable fuel design limit of 1.24 no fuel failures occur. Thus, the consequences of a steam generator tube rupture event with a CMF are bounded by the Chapter 15 event. Steam generator overfilling for this event prior to operator action will be prevented by the feedwater control system. Subsequent to operator action, utilizing the methods recommended in the Chapter 15 analysis will prevent overfilling. 3.
5.3 CONCLUSION
S The minimum DNBR was shown to remain well above the specified acceptable fuel design limit of 1.24 ensuring that no fuel failures occur. Also, overfilling of the affected steam generator will be prevented. Since the radiological consequences are bounded by the Chapter 15 analysis, the offsite doses meet 10 CFR 100 guidelines. O O Amendment P 7A.3-10 June 15, 1993
CESSAR Ennema ,
)
i
,c3 - i e
TABLE 7A.3.5-1 STEAM GENERATOR TUBE RUPTURE INPUT PARAMETERS AND INITIAL CONDITIONS l (CASE FOR MINIMUM DNBR) Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, 'F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR 1.50 f I , N l l l l l l l r l
\
l Amendment P June 15, 1993
~s
( ')
'm )
2600.0 2400.0 - A 2200.0 ~ c. LE s - tu 2000.0 E \ t
/~N.3 $
cc 1800.0 l 1600.0 1400.0 O.0 360.0 720.0 1080.0 1440.0 1800.0-TIME, SECONDS [ )
's,,
- Amendment P June 15,1993
- 0 "'8 STEAM GENERATOR TUBE RUPTURE WITH NO RPS ACTUATION RCS PRESSURE vs TIME 7 A.3.5- 1
O 2.5 - 2.0 -
~
x O b - E - ! ~ 1.5 - 1.0 ,,,,,,,,,i,,,,,,,,,ii,iii,,i,,,,,,, 0 500 1000 1500 TIME, SECONDS Amendment P June 15,1993
- gme STEAM GENERATOR TUBE RUPTURE WITH NO RPS ACTUATION MINIMUM DNBR vs TIME 7 A.3.5-2
CESSARnn%um l ( i l 3.6 MAIN STEAM LINE BREAK 3.6.1 IDENTIFICATION OF EVENTS This evaluation considers double-ended steam line breaks outside containment. The assumed absence of a reactor protection system automatic reactor trip and automatic main steam and feedwater isolation challenges the ability to maintain core coolability. However, the nominal overpower margin in the core and doppler reactivity feedback which limits the power increase help to mitigate the effect of the assumed failures. 3.6.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to a main steam line break with a postulated common mode failure of the plant protective system software was simulated using the CESEC-III computer program (CESSAR-DC, Section 15.0.3.1.3). The CESEC results were input to the STRIKIN-II computer program (CESSAR-DC, Section 15.0.3.1.5) to calculate fuel pin centerline and p cladding temperatures and into the TORC computer program (CESSAR-DC, Section 15.0.3.1.6) to calculate the minimum transient DNBR. B. Input Parameters and Initial Conditions Table 7A.3.6-1 presents the input parameters and initial conditions used to analyze the NSSS response, and the assumptions used in the calculation of the resultant offsite radiological doses for a double-ended break of a main steam line outside of containment with a postulated common mode failure of the plant protective system software. C. Results The dynamic behavior of important NSSS parameters following a double-ended break of a main steam line outside of containment with a postulated common mode failure of the plant protective system software is provided in Figures 7A.3.6-1 through 7A.3.6-6. The large energy extraction caused by the break reduces steam pressure dramatically and the turbine-generator shuts down, terminating the resupply of water to the feedwater system via condensation of the turbine steam. The feedwater control system will tend to increase flow to the steam generators based on the low level and high steam flow measured in the steam generator integral [ \ nozzle / venturis. It is conservatively assumed that initiation of the steam line break results in an immediate loss of all feedwater heating, causing the feedwater enthalpy to drop to that of the condenser hotwells. It also Amendment P 7A.3-11 June 15, 1993
CESSAR nuirlCATION O is conservatively assumed that the feedwater system and j feedwater control system are able to maintain the mass of j liquid in the steam generators essentially constant until the entire supply of main feedwater is exhausted. The resulting cooldown causes a rapid increase in core power which is calculated to peak at approximately 180% power within 50 seconds of event initiation, and thereafter, reaches a plateau near that value. The transient minimum DNBR of 1.00 occurs at approximately 50 seconds. Although this DNBR value is indicative of localized boiling, no credit was taken in the analysis for void reactivity feedback to reduce core power. The maximum cladding and fuel centerline temperatures follow the same trend as the power, reaching peak values of less than 1150*F and 4550*F, respectively, at about one minute into the transient. The mass of feedwater in the system at the beginning of the event is sufficient to supply feed to the steam generators at a rate equal to the steam flow through the break for about 6 minutes. Thereafter, it is assumed that the feedwater flow is drawn from the deaerator storage tank, which is at a somewhat higher enthalpy, until that source is also exhausted within a little more than two minutes. Since the feedwater enthalpy is higher during this interval, the rate of energy extraction and the resulting core power are calculated to be lower during this time period. As the feedwater in the deaerator storage tank is completely expended, the source of feedwater becomes the condensate storage tank, which is assumed to be at the same enthalpy as that of the original condenser hotwell liquid. The core power increases again, therefore, to its original level, remaining there until the feedwater supply is totally exhausted at 16 minutes into the transient. The core power then drops off quickly due to the heatup that occurs with the loss of feedwater flow. The steam generators begin to dry out. The emergency feedwater actuation setpoint is reached at 16.5 minutes. The drying out of the steam generators causes a large primary pressure spike, which results in a reactor trip on high pressurizer pressure by the Alternate Protection System at 17.1 minutes after event initiation. The RCS pressure peaks at less than 2950 psia within approximately 3 seconds of generation of the high pressurizer pressure trip signal. The steam generators are calculated to be completely dried out at 17.4 minutes into the event. Emergency feedwater delivery begins to reach the steam generators at 17.5 minutes. The reactor operator manually closes the main steam isolation valves 30 minutes after event initiation and initiates a controlled plant cooldown. The calculated maximum cladding and fuel centerline temperatures demonstrate that the core would remain coolable for this event. All pins with DNBRs below the specified Amendment P 7A.3-12 June 15, 1993
CESSAR nn%mou acceptable fuel design limit of 1.24 were assumed to experience DNB. The value of minimum DNBR results in less than 6% of the fuel to be computed to be in DNB. All fuel pins in DNB are assumed to fail. To obtain bounding values for offsite radiological doses, however, calculations were performed using the assumption that, in the limit, 100% of the fuel pins fail. The resulting two hour inhalation thyroid dose and whole body dose at the EAB are 92 and 3 REM, respectively. The eight hour doses for the LPZ are 41 REM for inhalation thyroid and 0.3 REM for whole body. These values are well within 10 CFR 100 guidelines. 3.
6.3 CONCLUSION
S The calculated maximum cladding and fuel centerline temperatures demonstrate that the core would remain coolable for a main steam - line break with a postulated common mode failure of the plant protective system software. Less than 6% of the fuel is computed to fail. Using a bounding value of 100% fuel failures, however, results in calculated offsite radiological doses which are well within 10 CFR 100 guidelines. The peak RCS pressure remains below the Level C limit of 3200 psia. i l Amendment P 7A.3-13 June 15, 1993
CESSAR !!ninemo O THIS PAGE INTENTIONALLY BLANK O O Amendment P 7A.3-14 June 15,-1993 i i
CESSAR innneuiu-t ~L , N, u
- j 1
TABLE 7A.3.6-1 STEAM LINE BREAK JNPUT PARAMETERS, INITIAL CONDITIONS AND ASSUMPTIONS INPUT PARAMETERS AND INJTIAL CONDITIONS Parameter Value Pressurizer. Pressure, psia 2250 : Cold Leg Temperature,_'F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 ASI - 0.07 FR 1.50 1 ASSUMPTIONS USED IN OFFSITE DOSE EVALUATION j Main Steam Line Isolation Manually at 30 Minutes , 100% Gap Fission Products Released , No SG Secondary Side Decontamination for the Affected SG -t No SG Secondary Side Decontamination for 30 Minutes l for the Intact SG Primary-to-Secondary Leakage per NUREG-0017 ! (Rev 01): 0.00625 gpm , EPRI URD Chi /Qs . NUREG-1465 Source Term I I Amendment P June 15,_1993
i
/3 s
\. 200 180 160 140 l-H
$ 120 8
e ci 100 b u; _ 3 ~ o c. 80
'~
f g b 8 60
~
40 20 :
.i .i, ,,,, ,,!,,,, , ,!,,, .!,,,, ,,-!, , ,,
g 1 0 200 400 600 800 1000 1200 1400 1600 1800 TIME SECONDS Amendment P (m s_, June 15,1993 FULL POWER STE AM Ll*4E BREAK OUTSIDE CONTAINMENT, . UPSTREAM OF MSIVs WITH NO RPS/ESFAS ACTUATION CORE POWER vs TIME 7 A.3.6 1 ]
O 400000 300000 2 DN
!5 N E_
$200000 4
2 5 0
!100000 -
N m 0 0 200 400 600 800 1000 1200 1400 1600 1800 TIME, SECONOS Amendment P June 15,1993
'" O FULL POWER STE AM LINE BREAK OUTSIDE CONTAINMENT, ggg asamy f s u UPSTREAM OF MSIVs WITH NO RPS/ESFAS ACTUATION STEAM GENERATOR MASS INVENTORIES vs TIME 7A.3.6-2
1 i l y -~ 1 l ) i
'wJ 1 3000 _
l 2750 2500 g - f t1. y ) l
~
5 m 2250 ^ E m o cc 2000 (> 1750 1500 0 200 400 600 800 1000 1200 1400 1600 1800 TIME, SECONDS i 1 l Amendment P - June 15,1993
- U" FULL POWER STEAM L NE BREAK OUTSIDE CONTAINMENT, UPSTREAM OF MSIVs WITH NO RPS/ESFAS ACTUATION I REACTOR COOLANT SYSTEM PRESSURE vs TIME 7 A.3,6-3
O 650 630 -
~
CORE OUTLET 610 5 \ J r 1 / o m V s K Lu_ \- g 590 i
'\
E ! CORE AVERAGE g 570 y
$ / %
w :
$ 550 8 ;
8 ! e 530 ~ 8 W g 510 490 (
~
7 \ l j CORE INLET 470
^ '" ' " ' ' ' ^' ' ' ^ ' ^' '
450 0 200 400 600 800 1000 1200 1400 1600 1800 TIME, SECONDS Amendment P _ June 15,1993
- U" FULL POWER STEAM LINE BREAK OUTSIDE CONTAINMENT, UPSTREAM OF MSIVs WITH NO RPS/ESFAS ACTUATION REACTOR COOLANT TEMPERATURES (A) vs TIME 7 A.3.6-4
o 5000 f HOT ROD 5 f 4000 2
? :
ui - g : E : o. 3000: AVG ROD s 3
# :_I N :
a _
$_2000{
5 - o : 1000 2 b 0-_ ,,,iiiiiii,,,,,,,,,i ,,,,,,,,,,,,,,,,,,j 0 400 800 1200' 1600 TIME, SECONDS Amendment P June 15,1993 UPSTREAM OF MSIVs ITH NO RPS/ESFAS ACT A ION FUEL CENTERLINE TEMPERATURE vs TIME 7 A.3.6 5 _ ___ _ = _ _ _ _ _ - _ - - _ _ _ - - _ - _ _ _
O 1500 ' HOT ROD
- x -
d 1000- ? - E 2 - N - AVG ROD , b - j 500 e
? O 1
1 1 1 Ol. i,ii,,,iii,i,,iiiiii>ii>>>iii,,,iiiii 0 400 800 1200 1600 TIME. SECONDS Amendment P _ June 15,1993 FULL POWER STEAM LINE BREAK OUTSIDE CONTAINMENT, 0# UPSTREAM OF MStVs WITH NO RPS/ESFAS ACTUATION FUEL CLADDING TEMPERATURE vs TIME 7 A.3.6-6
CESSAR Ennnemos n 3.7 FEEDWATER PIPE BREAK 3.7.1 IDENTIFICATION OF EVENTS The feedwater line break event is initiated by a break in the main feedwater system piping. The break is assumed to occur downstream of the feedwater line reverse flow check valves which are located inside containment. This location allows a continuous blowdown through the broken feedwater line.
~
This analysis focuses on the containment response as the primary system response will be bounded by the results of the Section 3.6 of this appendix, steam line break event. 3.7.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The containment response to the feedwater line break event was simulated using the SGN-III computer program. The reference for this computer program can be found in Section 6.2 of CESSAR-DC. [ B. Input Parameters and Initial Conditions ( The input parameters and initial conditions used to analyze the containment response to a feedwater line break event are presented in Table 7A.3.7-1. C. Results The containment pressure response is presented in Figure 7A.3.7-1. Upon rupture of the feedwater line, the steam generator mass and energy released to the containment results in a rapid increase in containment pressure. In this analysis a reactor trip on high pressurizer pressure via the Alternate Protection System occurs at 23 seconds. At 120 seconds the supply of high energy main feedwater is assumed to be exhausted, thus the rate of pressure increase decreases. Steam generator dryout occurs at 490 seconds further reducing the rate of containment pressure increase. At 30 minutes two containment spray trains and main steam isolation of the affected steam generator are assumed to be manually actuated. Containment pressure, steam generator pressure and level alarms would provide indication of the need for operator action. The actuation of containment sprays serves to terminate the pressure increase and causes the pressure to begin decreasing. Emergency feedwater was s assumed to be continuously added to both steam generators. The peak containment pressure obtained was 94 psig. This is less than the Level C limit of 130 psig. Subsequent to containment spray actuation and main steam isolation, the Amendment P 7A.3-15 June 15, 1993
CESSAR Ennneuion l operator can begin a controlled cooldown using the MSIV l bypass valves of the intact steam generator and the steam bypass systein or the atmospheric dump valves using the hand wheels if necessary. With respect to the primary system response, the consequences of the feedwater line break are bounded by those of the Section 3.6 of this appendix, steam line break. The steam line break resulted in high reactor power together with the nearly simultaneous dry out of both steam generators. The resulting primary to secondary power mismatch near the time of trip is greater than could be experienced for a feedwater line break event; thus peak RCS pressures will be lower for the feedwater line break event. With respect to offsite doses, since the steam line break dose calculation assumed 100% fuel f ailures and the blowdown of both steam generators along with an outside containment break, the offsite doses following the feedwater line break will be bounded by the steam line break event. 3.
7.3 CONCLUSION
S The peak containment pressure following a feedwater line break event remains less than the containment Level C limit of 130 psig. The peak RCS pressure remains less than the RCS Level C stress limit of 3200 psia. Also, the offsite doses meet 10 CFR 100 guidelines. m 9 Amendment P 7A.3-16 June 15, 1993
CESSAR 2!!nne.m. 7 O TABLE 7A.3.7-1 FEEDWATER LINE BREAK , INPUT PARAMETERS AND INITIAL CONDITIONS ! CONTA~fNMENT ANALYSIS .j i RCS Core Power, Mwt~ 3914 Pressurizer Pressure, psia. 2250 , i Cold Leg Temperature, 'F 556 ; STEAM GENERATOR Pressure, psia 1000 l CONTAINMENT Pressure,. psia 15.1 Temperature, 'F .110 .j Relative Humidity, % 10 . i l l
- l j
i l Amendment P June 15, 1993
,.; ~ ..;-
_ _ __ _ m_.. .. .. ,,
'1 1
I i I 100 ! CONTAINMENT DESIGN PRESSURE = 53 PSIC f
' CONTAINMENT LEVEL C LIMIT = 130 PSIG ~
60 h ;
~
0 uI STEAM CENERATOR 60 - DRYOUT
@ ~
en
$ ~
E e uJ
- N HIGH ENERGY
! 40 MAIN TEEDb'ATER y : EXHAUSTED z -
O - O
~
20 - l i i i i 0 0 400 800 1200 1600 2000 l TIME, SECONDS i k
.]
I Amendment P { t June 15,1993 FEEDWATER LINE BRE AK AT FUI.L POWER g as # [ Lt WITH NO RPSIESFAS ACTUATION CONTAINMENT PRESSURE ss TIME 7 A.3.7-1 i
-I
l CESSAR na%mou o b 3.8 LOSS OF COOLANT ACCIDENT 3.8.1 IDENTIFICATION OF EVENTS For pipes which are 12 inches or larger in diameter, a detectable leak would occur significantly in advance of a major rupture. Thus, the operator would have sufficient time to shut down and depressurize the plant prior to a large break occurrence. This evaluation credits this characteristic of large pipes and the System 80+ leak detection equipment to cope with large breaks. A failure of pipes smaller than 12 inches may not allow sufficient time for leak detection prior to break. Therefore, these small break loss of coolant accidents (SBLOCAs) require additional evaluation crediting the capability of diverse equipment and operator action for mitigation. The evaluation of these small pipe breaks conservatively envelopes the results of assumed failures of piping flanges, valve packings and gaskets or pump seals in pipes which are 12 inches or larger in diameter since their effective break areas are much smaller. The evaluation assumes the RCPs operate during the event until they are manually tripped by the operator. 3.8.2 ANALYSIS OF EFFECTS AND CONSEQUENCES A. Mathematical Models The NSSS response to SBLOCAs with a postulated common mode failure of the plant protective system software was simulated using the CEFLASH-4AS/ REM computer program (Reference 9). CEFLASH-4 AS/ REM is specifically designed for application to realistic analysis of SBLOCA transients. B. Input Parameters and Initial Conditions t Table 7A.3.8-1 presents the input parameters and initial conditions used to analyze the NSSS response for SBLOCAs with a postulated common mode failure of the plant protective system software. C. Results A realistic evaluation was performed of the response to breaks in branch lines connected to the RCS which are smaller than 12 inches in diameter. None of the breaks analyzed resulted in core uncovery for the events described ,, in Section 3.8.1 of this appendix. The results of a break of the largest branch line smaller than 12" in diameter, the 6 inch pressurizer safety valve nozzle, and a break in a 3 inch cold leg nozzle are presented in this section. The ( dynamic behavior of important NSSS parameters following these SBLOCAs with a postulated common mode failure of the plant protective system software is provided in Figures Amendment P 7A.3-17 June 15, 1993
CESSAR nai"icariou O 7A.3.8-1 through 7A.3.8-7 for the 6 inch break, and in Figures 7A.3.8-15 through 7A.3.8-21 for the 3 inch break. In addition, a 0.041 ft2 SBLOCA at the top of the upper head was analyzed in order to evaluate the potential radiological consequences of a CEA ejection with a postulated common mode failure of the plant protective system software. The dynamic behavior of the significant NSSS parameters for this SBLOCA is provided in Figures 7A.3.8-8 through 7A.3.8-14. An assumed double-ended guillotine break of a 6 inch pressurizer safety valve nozzle results in a rapid depressurization of the RCS. The consequent moderator voiding reduces core power. As discussed in Section 2.4 above, a reasonable estimate of reactor operator response would indicate that manual actuation of the reactor trip would occur within 3 minutes of event initiation. No credit for this trip was taken, however, for the analysis presented here. The results presented rely entirely on the moderator reactivity to shut the core down. The most important operator action for these events was found to be the manual actuation of the high pressure safety injection (HPSI) pumps. The initiation of HPSI flow adds liquid inventory to the RCS. Also, injection of the HPSI fluid into the steam space of the partially voided reactor vessel annulus contributes to a second RCS depressurization. This, in turn, results in safety injection tank (SIT) discharge. The flow from the SITS adds substantial inventory to the RCS and essentially terminates the event. A reasonable estimate of reactor operator response, as discussed in Section 2.4 of this appendix, would indicate that manual actuation of HPSI would take place within 15 minutes of initiation of this event. In this analysis the HPSIs were conservatively assumed to be activated 16 minutes after event initiation. Based upon the emergency procedures, no action would be taken to trip reactor coolant pumps (RCPs) prior to reactor trip and HPSI actuation. It was found to be conservative for this event to delay RCP trip, once HPSI actuation had occurred. Therefore, even though the operators could be reasonably expected to trip two RCPs within 16 minutes and two more within 22 minutes (Section 2.4 of this appendix), it was assumed that all four RCPs were tripped 23 minutes after event initiation. At no time during this event is there core uncovery. Therefore no cladding ballooning or consequential cladding rupture or high temperature oxidation are predicted. The reactor operator would initiate a controlled plant cooldown 30 minutes af ter event initiation. < Amendment P 7A.3-18 June 15, 1993 i
CESSAR nn% mon O l A 3 inch break in a cold leg nozzle results in a rapid i depressurization of the RCS. The consequent moderator voiding also reduces core power for this event. As discussed in Section 2.4 above, a reasonable estimate of reactor operator response would indicate that manual actuation of the reactor trip would occur within 3 minutes of event initiation. No credit for this trip was taken, however, for the analysis presented here. The results presented rely entirely on the moderator reactivity to shut the core down. Considering the assumed absence of a reactor trip, the most important operator action for this event was found to be the manual actuation of the high pressure safety injection (HPSI) pumps. The initiation of HPSI flow adds liquid inventory to the RCS. Also, injection of the HPSI fluid into the steam space of the partially voided reactor vessel annulus later in the transient contributes to a second RCS depressurization. However, this second depressurization does not result in safety injection tank discharge for this event. A reasonable estimate of reactor operator response, as indicated in Section 2.4 of this appendix, would indicate that manual actuation of HPSI would take place within 15 O minutes of initiation of this event. In this analysis the HPSIs were conservatively assumed to be activated 16 minutes after event initiation. Based upon the emergency procedures, no action would be taken to trip reactor coolant pumps (RCPs) prior to reactor trip and HPSI actuation. It was found to be conservative for this event to trip the RCPs early once HPSI actuation had occurred. Therefore, it was assumed that all four RCPs were tripped 17 minutes after event initiation. At no time during this event is there core uncovery. Therefore, no cladding ballooning or consequential cladding rupture or high temperature oxidation are predicted. The reactor operator would initiate a controlled plant cooldown 30 minutes after event initiation. A 0.041 ft2 SBLOCA at the top of the upper head due to a postulated CEA ejection naturally results in a somewhat less rapid depressurization of the RCS than that which is calculated to occur for the break of a 6 inch pressurizer safety valve nozzle. The general features of the event are, however, mainly the same, but more benign. The moderator voiding reduces core power from the peak it reaches consequent to the CEA ejection. As discussed in Section 2.4 above, a reasonable estimate of reactor operator response would indicate that manual actuation of the reactor trip ( would occur within 3 minutes of event initiation. However no credit was taken for this trip, thus, the results Amendment P 7A.3-19 June 15, 1993
CESSARnaib . O presented rely entirely on the moderator reactivity to shut the core down. A reasonable estimate of reactor operator response, as discussed in Section 2.4 of this appendix, would indicate that manual actuation of HPSI would take place within 15 minutes of initiation of this event. In this analysis the HPSIs were conservatively assumed to be activated 16 minutes after event initiation. The initiation of HPSI flow adds liquid inventory to the RCS at a rate sufficient to keep the core covered. (Since the mixture level in the reactor vessel downcomer is above the HPSI nozzles at the time of HPSI initiation, a further rapid RCS depressurization does not occur for this event. There is, therefore, no discharge of the SITS.) Based upon the emergency procedures, no action would be taken to trip reactor coolant pumps (RCPs) prior to HPSI actuation. It was assumed that all four RCPs were tripped one minute af ter HPSI initiation. At no time during this event is there core uncovery. Theref ore no cladding ballooning or consequentia) cladding rupture or high temperature oxidation ar predicted. The reactor operator would initiate a controlled plant cooldown 30 minutes after event initiation. An offsite dose evaluation was performed. The assumptions utilized in this evaluation are provided in Table 7A.3.8-1 and result in doses which bound the cases presented in this section. The resultant two hour EAB thyroid and whole body doses are less than 297 rem and 3 rem, respectively. The resultant 30 day LPZ thyroid and whole body doses are less than 46 rem and 0.7 rem, respectively. 3.
8.3 CONCLUSION
S A realistic evaluation of the response to breaks in branch lines connected to the RCS which are smaller than 12 inches in diameter shows that core uncovery is not calculated to occur for SBLOCAs with reactor coolant pump operation and postulated common mode f ailure of the plant protective system sof tware. Consequently no cladding rupture or high temperature oxidation are predicted. Also, the SBLOCAs were shown to result in dose consequences which meet 10 CFR 100 guidelines. The hardwired manual controls proposed in Reference 6 will be augmented to include a switch for closing the containment air purge valves to further reduce any potential for offsite radiological releases. O l i Amendment P 7A.3-20 June 15, 1993 l
CESSAR8!ninem f3 k%j TABLE 7A.3.8-1 LOSS OF COOLANT ACCIDENT INPUT PARAMETERS, INITIAL CONDITIONS AND ASSUMPTIONS INPUT PARAMETERS AND INITIAL CONDITIONS Parameter Value Pressurizer Pressure, psia 2250 Cold Leg Temperature, "F 556 Vessel Flow Rate, gpm 461,200 Core Power, Mwt 3914 Moderator Temperature Coefficient, 10" Ap/*F - 0.7 SITS 4 Tanks 0 600 psia Charging / Letdown PLCS in Automatic
/~N
, ) ASSUMPTIONS USED IN OFFSITE DOSE EVALUATION Containment Isolation and Spray Manually at 30 Minutes Annulus Ventilation System Operation Manually in 60 Minutes 100% Gap Fission Product Release Initiated at 30 Minutes Primary-to-Secondary Leakage per NUREG-0017 (Rev 01):
0.00625 gpm Maximum Containment Leakage 0.5% per Day Initial Primary Coolant Iodine Concentration: , 1 Micro-curie / gram i EPRI URD Chi /Qs j NUREG-1465 Source Term l l 1 s
\
d Amendment P June 15, 1993
. - . ~ . . . - . - - - . - - .. .
12 ;
=
l 1 1.0 1
=
6
~
0.8 z o : o i u 0.6 O o
^
? \
9 - 0.2 0.0 O 600 1200 1800 2400 3000-TIME, SECONDS 1
?
?
Amendment P June 15,1993 - SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE - WITH NO RPS/ESFAS ACTUATION
'j '
CORE POWER vs TIME 7 A.3.8- 1 -L m ._
, , ,y ,. -- . . _ . _
_ . - , _ , , . . . . . _ . , , , , 4_ . _ _ _ _ . . , # 3,.4._ ,
O 2400 . i 2000 1600 [- 5 E : uI E 1200 E - o O 800 -
~
400 - y j I j } I j 0 600 1200 1800 2400 3000 TIME, SECONDS Amendment P _ June 15,1993 SDLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE
'0" WITH NO RPS/ESFAS ACTUATION Jg RCS PRESSURE vs TIME 7 A.3.8 2
47500 39500 -
~
31500 r 8 - W -
! ! I s .
$23500 7 e :
O - d : w _
$ 15500 O ;
{
' ' ' ' " ' ' *^'
500 0 600 1200 1800 2400 3000 TIME, SECONDS
'i I
1 Amendment P June:15,1993
- 0" SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE WITH NO RPS/ESFAS ACTUATION CORE FLOW RATE vs TIME 7 A.3.8-3
1200 . 1000 7 800 0 ~ e
! [
. e 600 cc
~
r
$ 400
- 9 x
200 0 O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P _ June 15,1993 SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE gg WITH NO RPS/ESFAS ACTUATION BREAK FLOW RATE vs TIME 7 A.3.8-4
f% '\v, 300 _ 250 h a 200 h s : 3 : ui
$ 150 a:
5 : 5 : ./ 5 100
~
A rn 50 f 0 0 600 1200 1800 2400 3000 TIME, SECONDS Amendment P
] June 15,1993 SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE WITH NO RPS/ESFAS ACTUATION SAFETY INJECTION TANKS DISCHARGE R ATE vs TIME 7 A.3.8-5
48 P 40 b 32 w I J 24 ~
$ TOP OF Ft'EL ?
5
/
2 l 16 8 I l
~
O i 0 600 1200 1800 2400 3000 TIME, SECONDS , Amendment P _ June 15,1993 SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE WITH NO RPS/ESFAS ACTUATION J MIXTURE LEVEL IN CORE vs TIME 7 A.3.8-6
- ~. . .
.I l
l y ,( ;
%.) ' 4g _
r i 40 F : L d u. 32 TI d
- I
(
$ 24 : - -
a :
.%J '"Tl J - TOP OF FUEL RJ _
8
~
- .I'
~
0 0 600 1200 1800 2400 3000 I TIME, SECONDS ; Amendment P June 15,1993
- U" SBLOCA OF 6 INCH PRESSURIZER SAFETY VALVE NOZZLE WITH NO RPS/ESFAS ACTUATION J COLLAPSED LIQUID LEVEL IN CORE vs TIME 7 A.3.8-7
, . - . . . . . -. -. . . . - - - . . . , - - . ~ , - , , , , , , , . .
1 1.0
- 0.8 O
P _ O E 0.6 I 5 - 2 e v . 0.4 0.2 =Wh l
' t ' .., !
0.0 O 600 1200 1800 2400 3000 i ! TIME, SECONDS l l l l 1 Amendment P - June 15,1993 m 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure [CEA EJECTION] jff WITH NO RPS/ESFAS ACTUATION CORE POWER vs TIME 7 A.3.8-8
.- . - . . . - - .. .. . . . - .~. .
I v[ . 2400
!- l h .
'2000 1600 k :.
a : - - - - - - = - - -
$ 1200 7 e : .i
- c. _ ;
m - . t o -
~
2 _ 800' : , O !
- -i
~
400
~
O 0 600 1200 1800 2400 3000 TIME. SECONDS , t e 7 i n Amendment P l June 15,1993 w 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure [CEA EJECTION) J / ..WITH NO RPS/ESFAS ACTUATION RCS PRESSURE vs TIME 7 A.3.8-9
l 47500 _
- x l 39500 l
c 31500 - s 3 i d h 23500 l 3 ! 3 u. E O 15500 - 1 7500 l 1
-500 O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P -
June 15,1993
,, 0.041 FT2 SOLOCA AT TOP OF UPPER HEAD Figure '
[CEA EJECTION] gg / WITH NO RPS/ESFAS ACTUATION CORE FLOW RATE vs TIME 7 A.3.8- 10
i / . 5, )
%./
1200 _ 1 1000 8 800 _- 9 : 2 - , g . uI I ti 600 e 3: 9 u. x 9 g 400 - (V : 200 r h 0 O 600 1200 1800 2400 3000 TIME, SECONDS m Amendment P June 15,1993 (
,o 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure !
Jg / lCEA EJECTION) WITH NO RPS/ESFAS ACTUATION BREAK FLOW R ATE vs TIME 7 A.3,8-11 l
300 . O 250 7 0
- 200 b s :
- w. -
E : c: -
$ 150 [-
d . 8 5 ~ 5 100 g 7 O -
~
50 :
~
O O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P - June 15,1993
,, 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure
{CEA EJECTION] Jg / WITH NO RPS/ESFAS ACTUATION SAFETY INJECTION TANKS DISCHARGE RATE vs TIME 7 A.3.8-12
-?
OS 48 h 1 l 40 : 32 i g _ d
~
t !
$0 1 .'
G 24
~
I TOP OF FUEL W
? -
/
5 , 16 I 1 8 7 ; 0 0 600 1200 1800 2400 3000' TIME, SECONDS Amendment P' (w June 15,1993
,, 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure Jg / [CEA EJECTION]
WITH NO RPS/ESFAS ACTUATION MIXTURE LEVEL IN CORE vs TIME 7 A.3.8- 13 7 m -- , - - , - w v
48 _ O
~
40 32 i
"i e
o 24
- ~ ~ ~ ~ ~ ~ ~' - ~ ~ ~ ~ ~ ' - ~
TOP OF FUEL r 5 0 16 O 8 I O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P - June 15,1993 m 0.041 FT2 SBLOCA AT TOP OF UPPER HEAD Figure ' [CEA EJECTION] Jg / WITH NO RPS/ESFAS ACTUATION COLLAPSED LIQUID LEVEL IN CORE vs TIME 7 A.3.8-14
. - . . . . . - ....- ~ . .- . - . . .. . . . 1
'l -
4 V 1.2 l 1.0 h _y 4
.0.8 7 z '
O P : 0 - 4 - E : l 0.6 I a m- : r cc . O - 0 - 0.4 l ^ I. 0.2 l
~
' ' ' 1
,i ,,. ,i, ,
0.0 0 600 1200' 1800 2400 3000 TIME, SECONDS i P Amendment P , June ' 15,1993 O- '" Figure l SB 'LOCA OF 3 INCH COLD LEG NOZZLE WITH NO RPS/ESFAS ACTUATION CORE POWER vs TIME 7 A.3.8-15 !
.)
i
2400 O i f l-2000
~
1600 r s - E - N i
$ 1200 7
~
e o. b a 800 400 7 0 O 600 1200 1800 2400 3000 TIME, SECONDS l
\
Amendment P ! June 15,1993
- Figure SB LOCA OF 3 INCH COLD LEG NOZZLE WITH NO RPS/ESFAS ACTUATION RCS PRESSURE vs TIME 7 A.3.8-16
. . . -.. . . . - . ,. - . ~ . . . - . _ -
l
.i 47500 .
39500 h
~
o 31500 ~
~
'N
-s :
3 : a h23500 h k S : m : . E : 8 15500 7 (T :
'V :
7500
-500
' # ' ~
0 600 1200 1800 2400 3000
.i TIME, SECONDS b
.i Amendment P O "
SB LOCA OF 3 INCH COLD LEG NOZZLE June 15,1993 Figure WITH NO RPS/ESFAS ACTUATION 4 CORE FLOW RATE vs TIME 7 A.3.8- 17 i r$-, t,-e % , --
1200 _ O 1000 o 800 5
?
600 h l 3:: s i { 400 N
\
'\
200 ( i f l j/gfllk l lp ! O ' O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P - June 15,1993
- Figuro . -
SB LOCA OF 3 INCH COLD LEG NOZZLE WITH NO RPS/ESFAS ACTUATION BREAK FLOW RATE vs TIME 7 A.3.8-18
/
'v 300 _ 250 8 ~ h 200 r S : uI ~ D a:
$ 150 7 d -
E i I 3 100 7 (~) 5 V E
<n 50
, i i !
O 600 1200 1800 2400 3000 TIME, SECONDS Amendment P [, . j June 15,1993 %_J
- Figure SB LOCA OF 3 INCH COLD LEG NOZZLE
/ u WITH NO RPS/ESFAS ACTUATION SAFETY INJECTION TANKS DISCHARGE RATE vs TIME 7 A.3.8-19
4e D O 40 32 $ : h .1 : \ - 24 8
- TOP OF FUEL E
16 h O t
~
0 0 600 1200 1800 2400 3000 TIME, SECONDS Amendment P _ June 15,1993 SB LOCA OF 3 INCH COLD LEG NOZZLE Figure -
/ u WITH NO RPS/ESFAS ACTUATION MIXTURE LEVEL IN CORE vs TIME 7 A.3.8-20
l O Q 48 _ i 40 . :I : I J E 32 h l d : - E : J - o 24 .__, 1MWy V I : d : TOP OF FUEL 0 16 O : i 8
~
' ' ' ' i 0
0 600 1200 1800 2400' 3000 i TIME, SECONDS i (
- Amendment P -
June 15,1993 ~ > SB LOCA OF 3 INCH COLD LEG NOZZLE Figure
/ u WITH NO RPS/ESFAS ACTUATION COLLAPSED LIQUID LEVEL IN CORE vs TIME 7 A.3.8-21
CESSAR Eininemon O) \
%/
4.0 RE7ERENCES
- 1. SECY-93-087, " Policy, Technical, and Licensing Issues Pertaining to Evolutionary and 2dvar.ced Light-Water Reactor (ALWR) Designs," April 2, 1992.
- 2. ALWR-IC-DCTR-31, " Evaluation of Defense-In-Depth and Diversity in the ABB-CE NUPLEX 80+ Advanced Control Complex for the System 80+ Standard Design," ABB-CE, September 1992.
- 3. J. V. Palomer, R. H. Wyman (LLNLL), "A Review of the CE 80+
FMEA and D&DID Analysis," December 8, 1992.
- 4. January 6, 1993 Meeting of ABB-CE I&C staff and NRC I&C staff with Lawrence Livermore reviewers to discuss their review results for the ABB-CE D&DID Evaluation.
- 5. January 11, 1993 Meeting in Windsor, CT. of ABB-CE Management with NRC Management on the Status of the Design Certification Review of System 80+.
- 6. LD-93-011, "DSER (Open Item 7.2.2.2-1) Response Submittal,"
February 2, 1993. r 7. ANS/ ANSI-58.8-1992, draft dated November 5, 1992, "American (' National Standard Time Response Design Criteria for Safety-Related Operator Actions."
- 8. Accident Prevention Group Report # 12, Rev. 2, December, 1990, " Interim Report, Application of the EPRI Operator Reliability Experiments Data to Update the ANS-58.8 Standard."
- 9. CEN-420-P, "Small Break LOCA Realistic Evaluation Model, Volume 1, Part 1: Calculational Models", February 1993.
r l Amendment P 7A.4-1 June 15, 1993
CESSAR M59,cari:n ( ) TABLE OF CONTENTS CHAPTER 19 Section subiect Pace No. 19.
1.0 INTRODUCTION
19.1-1 19.1.1 PURPOSE 19.1-1 19.1.2 SCOPE 19.1-1 19.2 METHODOLOGY 19.2-1 19.2.1 PLANT FAMILIARIZATION 19.2-3 19.2.2 ACCIDENT SEQUENCE DEFINITION 19.2-4 19.2.3 SYSTEM MODELING 19.2-6 19.2.4 DATA ASSESSMENT 19.2-7 f_ 19.2.5 HUMAN RELIABILITY ANALYSIS 19.2-9 [ \ '\_,/ 19.2.5.1 Introduction 19.2-9 19.2.5.2 The HRA Team 19.2-10 19.2.5.3 Methodoloav 19.2-10 19.2.5.3.1 HRA Step 1 19.2-11 19.2.5.3.2 HRA Step 2 19.2-12 19.2.5.3.3 HRA Step 3 19.2-13 19.2.5.3.4 HRA Step 4 19.2-14 19.2.5.3.5 HRA Step 5 14.2-15 19.2.5.3.6 HRA Step 6 19.2-15 19.2.6 ACCIDENT SEQUENCE QUANTIFICATION 19.2-16 19.2.7 SENSITIVITY ANALYSIS 19.2-18 19.2.8 EXTERNAL EVENT ANALYSIS 19.2-19 19.2.9 SHUTDOWN RISK ASSESSMENT 19.2-20 19.2.10 CONTAINMENT RESPONSE ANALYSIS 19.2-21 19.2.11 CONSEQUENCE ANALYSIS 19.2-23 (A) L 19.2.12 ANALYSIS GROUNDRULES 19.2-24 Amendment N i April 1, 1993
CESSAR E5ificari:n TABLE OF CONTENTS (Cont'd) O CHAPTER 19 Section Subiect Pace No. 19.2.13 DESCRIPTION OF COMPUTER CODES 19.2-25 19.2.13.1 CAFTA 19.2-25 19.2.13.2 CESAM 19.2-25 19.2.13.3 CENTS 19.2-26 19.2.13.4 MAAP 19.2-27 19.2.13.5 MACCS 19.2-27 19.3 INITIATING EVENT EVALUATION 19.3-1 19.3.1 MASTER LOGIC DIAGRAM DEVELOPMENT 19.3-1 19.3.2 SELECTION OF INITIATING EVENTS 19.3-3 19.3.3 INITIATING EVENT FREQUENCY CALCULATION 19.3-9 19.3.3.1 LOCA Frecuencies 19.3-9 19.3.3.2 Steam Generator Tube Ruoture 19.3-14 19.3.3.3 harae Secondary Side Breaks 19.3-14 19.3.3.4 Transients 19.3-14 19.3.3.5 Loss of a Vital Bus 19.3-14 19.3.3.6 Loss of Component Coolina Water 19.3-14 19.3.3.7 Loss of Offside Powe_r 19.3-15 19.3.3.8 Anticipat_ed Transient Without Scram 19.3-15 19.3.3.9 Vessel Ruoture 19.3-16 19.3.3.10 Loss of HVAC 19.3-16 19.4 ACCIDENT SEOUENCE DETERMINATION 19.4-1 19.4.1 LARGE LOCA 19.4-1 1 Amendment N l 11 April 1, 1993
-CESSAR8a hia g-( )
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.4.1.1 Event Tree 1 Elements 19.4-1 19.4.1.1.1 Large LOCA Initiators 19.4-1 19.4.1.1.2 Safety Injection Tank Injection 19.4-2 19.4.1.1.3 Safety Injection System Injection 19.4-2 19.4.1.1.4 Containment Spray Cooling 19.4-3 19.4.1.2 Maior Dependencies 19.4-4 19.4.1.3 Operator Actions and Interfaces 19.4-4 19.4.1.3.1 Standard Operator Actions 19.4-4 19.4.1.3.2 Modeled Operator Actions 19.4-9 19.4.1.4 Maior Recovery Actions 19.4-10
-- 19.4.2 MEDIUM LOCA 19.4-11 \s / 19.4.2.1 Event Tree 2 Elements 19.4-12 19.4.2.1.1 Medium Loca Initiators 19.4-12 19.4.2.1.2 Safety Injection System Injection 19.4-12 19.4.2.1.3 Containment Spray Cooling 19.4-13 19.4.2.2 Maior Dependencies 19.4-14 19.4.2.3 Operator Actions and Interfaces 19.4-14 19.4.2.3.1 Standard Operator Actions 19.4-14 19.4.2.3.2 Modeled Operator Actions 19.4-19 19.4.2.4 Maior Recovery Actions 19.4-21 19.4.3 SMALL LOCA 19.4-23 19.4.3.1 Event Tree 3 Elements 19.4-23 19.4.3.1.1 Small LOCA Initiators 19.4-23 19.4.3.1.2 Safety Injection System Injection 19.4-23 19.4.3.1.3 Aggressive Secondary Cooldown 19.4-24 19.4.3.1.4 Shutdown Cooling System Injection 19.4-25 19.4.3.1.5 Deliver Feedwater 19.4-25
[~'N 19.4.3.1.6 Long Term Decay Heat Removal 19.4-25 i,
) 19.4.3.1.7 Safety Depressurization (Bleed) 19.4-26 Amendment N iii April 1, 1993
CESSAR 8!.%"1CATRIN IABLE OF CONTENTS (Cont'd) O CHAPTER 19 Section Bubiect Pace No. 19.4.3.1.8 Containment Heat Removal via'IRWST 19.4-26 Cooling 19.4.3.2 Maior Dependencies 19.4-28 19.4.3.3 Operator Actions and Interfaces 19.4-29 19.4.3.3.1 Standard Operator Actions 19.4-29 19.4.3.3.2 Modeled Operator Actions 19.4-37 19.4.3.4 Maior Recovery Actions 19.4-38 19.4.4 STEAM GENERATOR TUBE RUPTURE 19.4-39 19.4.4.1 Normal Transient Proaression 19.4-39 19.4.4.2 Accident Progression with 19.4-41 Coincident LOOP 19.4.4.3 Event Tree 4 Elements 19.4-41 19.4.4.3.1 Steam Generator Tube Rupture 19.4-41 Initiators 19.4.4.3.2 Safety Injection System Injection 19.4-41 19.4.4.3.3 Aggressive Secondary Cooldown 19.4-42 19.4.4.3.4 Shutdown Cooling System Injection 19.4-42 19.4.4.3.5 Deliver Feedwater 19.4-43 19.4.4.3.6 RCS Pressure Control 19.4-44 19.4.4.3.7 Long Term Decay Heat Removal 19.4 19.4.4.3.8 Unisolable Leak in Ruptured Steam 19.4-45 Generator 19.4.4.3.9 Refill the IRWST 19.4-46 19.4.4.3.10 Maintain Secondary Heat Removal 19.4-47 19.4.4.3.11 Safety Depressurization 19.4-48 19.4.4.3.12 Safety Injection (Feed) 19.4-48 19.4.4.3.13 Containment Heat Removal via 19.4-48 IRWST Cooling 19.4.4.4 Maior Dependencies 19.4-50 , I 19.4.4.5 Operator Actions and Interfaces 19.4-51 19.4.4.5.1 Standard Operator Actions 19.4-51 19.4.4.5.2 Modeled Operator Actions 19.4-56 l i Amendment N l iv April 1, 1993 l
CESSARiinincAm,.
' TABLE OF CONTENTS (Cont'd)
CHAPTER 19-Section Subiect Pace'No. - 19.4.4.6 Maior Recovery Actionq -.19.4-57 19.4.5 LARGE SECONDARY SIDE BREAKS 19.4-59: 't 19.4.5.1 Event' Tree 5 Elements- 19.4-60' l 19.4.5.1.1 Large Secondary-Side Break 19.4-60 ., Initiators 19.4.5.1.2 Stuck Rod at End of Cycle 19.4-60 19.4.5.1.3 Safety Injection System Injection 19.4 19.4.5.1.4 Deliver EmergencyLFeedwater 19.4-61 19.4.5.1.5 Long-Term Decay Heat Removal 19.'4-61 19.4.5.1.6 Safety Depressurization '19.4-61 19.4.5.1.7 Safety Injection (Feed) 19.4-62 r 19.4.5.1.8 Containment Heat' removal via 19.4-62 IRWST Cooling 'i [ 19.4.5.2 Maior Dependencies 19.4-64 \ . 19.4.5.3 Operator Actions and Interfaces 19.4-64 19.4.5.3.1 Standard Operator Actions ~ 19.4-64 19.4.5.3.2 Modeled Operator Actions 19.4-70 , 19.4.5.4 Maior Recovery Actions 19.4-71 . 19.4.6 TRANSIENTS - LOSS OF FEEDWATER 19.4 . 19.4.6.1 Event Tree 6 Elements - 19 .~ 4 -7 3 ! 19.4.6.1.1 Transient Initiator 19.4-73 19.4.6.1.2 Deliver Emergency Feedwater 19.4-73 ; 19.4.6.1.3 Long-Term Decay Heat Removal 19.4-74. Safety Depressurization (Bleed)~
~
19.4.6.1.4 -19.4-74' 19.4.6.1.5 Safety Injection (Feed) 19.4-75 , 19.4.6.1.6 Containment Heat Removal via- 19.4-75 ' IRWST Cooling 19.4.6.2 Maior Dependencies -19.4-77 l l 19.4.6.3 Operator Actions and Interfaces '19.4-77' l 1 19.4.6.3.1 Standard Operator Actions 19.4-77 19.4.6.3.2 Modeled Operator Actions 19.4-80
' Amendment N )
April 1, 1993 v
CESSAREna mu TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.4.6.4 Maior Recovery Actions 19.4-81 19.4.7 OTHER TRANSIENTS 19.4-83 19.4.7.1 Event Tree 7 Elements 19.4-83 19.4.7.1.1 Transient Initiators 19.4-83 19.4.7.1.2 Deliver Feedwater Flow 19.4-83 19.4.7.1.3 Long-Term Decay Heat Removal 19.4-84 19.4.7.1.4 Safety Depressurization (Bleed) 19.4-85 19.4.7.1.5 Safety Injection (Feed) 19.4-85 19.4.7.1.6 Containment Heat Removal via 19.4-85 IRWST Cooling 19.4.7.2 Maior Dependencies 19.4-87 19.4.7.3 9Derator Actions and Interfaces 19.4-87 19.4.7.3.1 Standard Operator Actions 19.4-87 19.4.7.3.2 Modeled Operator Actions 19.4-90 19.4.7.4 Maior Recovery Actions 19.4-91 19.4.8 LOSS OF OFFSITE POWER AND STATION 19.4-93 BLACKOUT 19.4.8.1 Normal Event Procression 19.4-93 19.4.8.2 Loss of Offsite Power Event Tree 19.4-94 19.4.8.2.1 Event Tree 8 Elements 19.4-94 19.4.8.2.1.1 Loss of Offsite Power 19.4-94 Initiator 19.4.8.2.1.2 Primary Safety Valve Rescat 19.4-95 19.4.8.2.1.3 Safety Injection System 19.4-95 Injection 19.4.8.2.1.4 Deliver Emergency Feedwater 19.4-95 19.4.8.2.1.5 Long-Term Decay Heat Removal 19.4-96 19.4.8.2.1.6 Safety Depressurization (Bleed) 19.4-96 19.4.8.2.1.7 Safety Injection (Feed) 19.4-97 1 19.4.8.2.1.8 Containment Heat Removal via 19.4-97 IRWST Cooling l l Amendment N l vi April 1, 1993
CESSAR E!ninem f~) ! i TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.4.8.2.2 Major Dependencies 19.4-99 19.4.8.2.3 Operator Actions and Interfaces 19.4-99 19.4.8.2.3.1 Standard Operator Actions 19.4-99 19.4.8.2.3.2 Modeled Operator Actions 19.4-103 19.4.8.2.4 Major Recovery Actions 19.4-104 19.4.8.3 Station Blackout Event 19.4-105 Procression 19.4.8.3.1 Station Blackout Fault Tree 19.4-106 Elements 19.4.8.3.1.1 Station Blackout 19.4-106 O I 19.4.8.3.2 Maj,or Dependencies 19.4-106 \m- 19.4.8.3.3 Major Recovery Actions 19.4-106 19.4.9 LOSS OF COMPONENT COOLING WATER 19.4-107 19.4.9.1 Event Tree 9 Elements 19.4-107 19.'.9.1.1 Transient Initiators 19.4-107 19.4.9.1.2 Deliver Feedwater 19.4-107 19.4.9.1.3 Long-Term Decay heat Removal 19.4-108 19.4.9.1.4 Safety Depressurization (Bleed) 19.4-109 19.4.9.1.5 Safety Injection (Feed) 19.4-109 19.4.9.1.6 Containment Heat Removal via 19.4-109 IRWST Cooling 19.4.9.3 Maior Dependencies 19.4-111 19.4.9.4 Operator Actions and Interfaces 19.4-111 19.4.9.4.1 Standard Operator Actions 19.4-111 19.4.9.4.2 Modeled Operator Actions 19.4-115 19.4.9.5 Maior Recovery Actions 19.4-115 19.4.10 LOSS OF A 125VDC VITAL BUS 19.4-117 [N q ) 19.4.10.1 Event Tree 10 Elements 19.4-117 Amendment N vii April 1, 1993
CESSARMEbmn TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section subiect Pace No. 19.4.10.1.1 Transient Initiators 19.4-117 19.4.10.1.2 Deliver Feedwater 19.4-117 19.4.10.1.3 Long-Term Decay heat Removal 19.4-118 19.4.10.1.4 Safety Depressurization (Bleed) 19.4-119 19.4.10.1.5 Safety Injection (Feed) 19.4-119 19.4.10.1.6 Containment Heat Removal via 19.4-119 IRWST Cooling 19.4.10.2 Maior Dependencies 19.4-121 19.4.10.3 Operator Actions and Interfaces 19.4-121 19.4.10.3.1 Standard Operator Actions 19.4-121 19.4.10.3.2 Modeled Operator Actions 19.4-125 19.4.10.4 Maior Recovery Actions 19.4-125 19.4.11 LOSS OF 4.16 KV VITAL BUS 19.4-127 19.4.11.1 Event Tree 11 Elements 19.4-127 19.4.11.1.1 Transient Initiators 19.4-127 19.4.11.1.2 Deliver Feedwater 19.4-127 19.4.11.1.3 Long-Term Decay heat Removal 19.4-128 19.4.11.1.4 Safety Depressurization (Bleed) 19.4-129 19.4.11.1.5 Safety Injection (Feed) 19.4-129 19.4.11.1.6 Containment Heat Removal via 19.4-129 IRWST Cooling 19.4.11.2 Maior Dependencies 19.4-131 19.4.11.3 Operator Actions and Interfaces 19.4-131 19.4.11.3.1 Standard Operator Actions 19.4-131 19.4.11.3.2 Modeled Operator Actions 19.4-135 19.4.11.4 Maior Recovery Actions 19.4-135 19.4.12 LOSS OF ONE DIVISION OF HEATING, 19.4-137 VENTILATION AND AIR-CONDITIONING l 19.4.12.1 Event Tree 12 Elements 19.4-137 19.4.12.1.1 Transient Initiators 19.4-137
- Amendment N viii April 1, 1993
LCESSAR inMncma f} - TABLE OF CONTENTS'(Cont'd) CHAPTER 19-Section Bubiect ' face No. 19.4.12.1.2 Deliver Feedwater 19.4-137 19.4.12.1.3 Long-Term Decay. Heat Removal 19.4-138 19.4.12.1.4 Safety Depressurization.(Bleed)f 19.4-139 19.4.12.1.5 Safety Injection (Feed). 19.4-139' 19.4.12.1.6 Containment Heat' Removal.via 19.4-139-IRWST Cooling 19.4.12.2 Maior Dependencies 19.4-141 19.4.12.3 Operator Actions and Interfaces 19.4-142 19.4.12.3.1 Standard Operator Actions 19.4-142 19.4.12.3.2 Modeled Operator Actions- 19.4-145-19.4.12.4 Maior Recovery Actions '19.4-146 19.4.13 ANTICIPATED TRANSIENTS WITHOUT SCRAM '19.4-147 19.4.13.1 ATWS Description 19.4-147 19.4.13.2 ATWS-Event Tree Elements 19.4-150-L 19.4.13.2.1 ATWS Initiators 19.4-150 19.4.13.2.2 Adverse Moderator' Temperature 19.4-150 Coefficient (MTC) [ 19.4.13.2.2a Adverse Moderator Temperature '19.4-150 Coefficient 2 19.4.13.2.3 Failure of Sufficient Primary .19.4-150. Safety Valves to Open 19.4.13.2.4 Primary Safety Valve (PSV) Stuck 19.4-150 Open 19.4.13.2.5 Consequential Steam Generator Tube 19.4-151 Rupture 19.4.13.2.6 De iver Emergency Feedwater 19.4-151 19.4.13.2.7 Deliver EFW to Intact Steam 19.4-151 Generator 19.4.13.2.8 Deliver Boron via Charging Pump 19.4-151 19.4.13.2.9 Safety Depressurization 19.4-152 19.4.13.2.10 Safety Injection 19.4-152 19.4.13.2.11 RCS Pressure Control 19.4-152 19.4.13.2.12 Unisolable Leak in the Ruptured 19.4-153 Generator 19.4.13.2.13 Long-Term Decay Heat Removal 19.4-154 (No SGTR) 19.4.13.2.14 Long-Term Decay Heat Removal 19.4-154 (SGTR) Amendment P ix June'15, 1993 l il
CESSAR 2nL"imi:n TABLE OF CONTENTS (Cont'd) CHAPTER 19 Sectio.D Subiect Pace No. 19.4.13.2.15 Refill the IRWST 19.4-155 19.4.13.2.16 Maintain Secondary Heat Removal 19.4-357 19.4.13.2.17 Containment Heat Removal via 19.4-157 IRWST Cooling 19.4.13.3 Maior Dependencies 19.4-163 19.4.13.4 Operator Actions and Interfaces 19.4-164 19.4.13.4.1 Standard Operator Actions 19.4-164 19.4.13.4.2 Modeled Operator Actions 19.4-180 19.4.13.5 Maior Recovery Actions 19.4-181 19.4.14 INTERFACING SYSTEMS LOCAS 19.4-183 19.4.14.1 Interfacina System LOCA via SCS 19.4-184 System Suction Lines 19.4.14.2 Interfacina System LOCA Via SCS 19.4-187 Return Lines 19.4.14.3 Interfacina System LOCA Frecuency 19.4-192 19.4.15 VESSEL RUPTURE 19.4-195 19.5 DATA ANALYSIS 19.5-1 l 19.5.1 COMPONENT HARDWARE FAILURE RATES 19.5-2 19.5.2 DEVELOPED EVENTS 19.5-3 19.5.3 COMMON CAUSE FAILURE RATES 19.5-4 1 19.5.3.1 Beta-factor Method 19.5-5 l 19.5.3.2 Multiple Greek Letter Method 19.5-6 19.5.3.3 Common Cause Event Probabilities 19.5-9 19.5.4 MAINTENANCE UNAVAILABILITIES 19.5-9 19.5.5 HUMAN ERROR PROBABILITIES 19.5-12 O Amendment N x April 1, 1993
CESSAR ML"lCAT15N i g! TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subject Pace Not 19.5.6 SPECIAL EVENT PROBABILITIES 19.5-14 19.5.6.1 Failure of the PSV to Reseat 19.5-14 19.5.6.2 A_dverse MTC Overoressurization 19.5-15 19.5.6.3 Consecuential SGTR Followino ATWS 19.5-15 19.5.6.4 Stuck Rod at End of Cycle 19.5-16 19.5.6.5 Primary Safety Valve Fails to 19.5-16 Open 19.5.6.6 MTC Between -0.3 and -0.42 AND 19.5-18 One PSV Fails to Open 19.5.7 NON-RECOVERY PROBABILITIES 19.5-19 (r~^)
%/
19.5.8 FLAGS 19.5-22 APPENDIX 19.5A DATA CALCULATION SHEETS FOR GENERIC 19.5A-1 COMPONENT DATA APPENDIX 19.5B DATA CALCULATION SHEETS FOR BASIC 19.5B-1 EVENTS APPENDIX 19.5C DATA CALCULATION SHEETS FOR COMMON 19.5C-1 CAUSE EVENTS APPENDIX 19.5D DATA CALCULATION SHEETS FOR MAINTENANCE 19.5D-1 UNAVAILABILITY EVENTS APPENDIX 19.5E DATA CALCULATION SHEETS FOR HUMAN ERROR 19.5E-1 PROBABILITIES 19.6 SYSTEMS ANALYSIS 19.6-1 19.6.1 GENERAL PLANT DESCRIPTION 19.6-1 19.6.1.1 Scone and Descriotion 19.6-1 19.6.1.2 Reactor Coolant System 19.6-1 fs 19.6.1.3 Encineered Safety Features 19.6-1 I b
'N~ ' 19.6.1.3.1 Containment Structure 19.6-1 Amendment P xi June 15, 1993
ks!hhkI il ICATl!N TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section g_ubiect Pace No. 19.6.1.3.2 Safety Injection System 19.6-2 19.6.1.3.3 Emergency Feedwater System 19.6-2 19.6.1.3.4 Safety Depressurization 19.6-2 System 19.6.1.3.5 Containment Spray System 19.6-2 19.6.1.4 Protection and Control Systems 19.6-3 19.6.1.4.1 Reactor Protective System 19.6-3 19.6.1.4.2 Alternate Protection System 19.6-3 19.6.1.4.3 Engineered Safety Features 19.6-3 Actuation System 19.6.1.4.4 Component Control System 19.6-4 19.6.1.5 Electrical System 19.6-4 19.6.1.6 Power Conversion System 19.6-4 19.6.1.7 Auxiliary Systems 19.6-5 19.6.1.7.1 Shutdown Cooling System 19.6-5 19.6.1.7.2 Chemical and Volume Control 19.6-5 System 19.6.1.7.3 Steam Generator Blowdown 19.6-6 System 19.6.1.8 Coolina Water Systems 19.6-6 19.6.1.8.1 Station Service Water System 19.6-6 19.6.1.8.2 Component Cooling Water 19.6-6 System 19.6.1.9 System Dependencies and 19.6-6 Commonalities 19.6.2 GENERAL OVERVIEW AND GROUNDRULEC 19.6-9 19.6.3 SYSTEMS ANALYSES DOCUMENTATION 19.6-13 19.6.3.1 Electrical Distribution System 19.6-13 19.6.3.1.1 System Description 19.6-13 19.6.3.1.1.1 System Function 19.6-13 19.6.3.1.1.2 System Success Criteria 19.6-13 Amendment N xii April 1, 1993
CESSARE!Sinem t TABLE OF CONTENTS (Cont'd) CHAPTER 19 section Bubiect Pace No. 19.6.3.1.1.3 System Configuration 19.6-14 19.6.3.1.1.4 Support and Interfacing 19.6-22 Systems 19.6.3.1.1.5 System Operation 19.6-22 19.6.3.1.1.6 Technical Specifications 19.6-24 19.6.3.1.2 System Logic Models 19.6-25 19.6.3.1.3 System Quantification 19.6-28 19.6.3.2 Station Service Water System 19.6-29 19.6.3.2.1 System Description 19.6-29 19.6.3.2.1.1 System Function 19.6-29 19.6.3.2.1.2 System Configuration 19.6-29 19.6.3.2.1.3 Support and Interfacing 19.6-29 Systems 19.6.3.2.1.4 System Operation 19.6 ((}j 19.6.3.2.1.5 System Success Criteria 19.6-31 19.6.3.2.1.6 Technical Specifications 19.6-32 19.6.3.2.2 System Logic Models 19.6-32 19.6.3.2.2.1 Analysis Assumptions 19.6-32 19.6.3.2.2.2 Interface with Event Trees 19.6-33 19.6.3.2.3 System Quantification 19.6-33 19.6.3.3 Component Coolina Water System 19.6-35 19.6.3.3.1 System Description 19.6-35 19.6.3.3.1.1 System Function 19.6-35 19.6.3.3.1.2 System Configuration 19.6-35 19.6.3.3.1.3 Support and Interfacing 19.6-35 Systems 19.6.3.3.1.4 System Operation 19.6-36 19.6.3.3.1.5 System Success Criteria 19.6-37 19.6.3.3.1.6 Technical Specifications 19.6-37' 19.6.3.3.2 System Logic Models 19.6-38 19.6.3.3.2.1 Analysis Assumptions 19.6-38 19.6.3.3.2.2 Interface with Event Trees 19.6-39 b Amendment N xiii April 1, 1993
CESSARMnkm. TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect E_ ace No. 19.6.3.2.3 System Quantification 19.6-39 19.6.3.4 Instrument Air System 19.6-41 19.6.3.4.1 System Description 19.6-41 19.6.3.4.1.1 System Function 19.6-41 19.6.3.4.1.2 System Configuration 19.6-41 19.6.3.4.1.3 Support and Interfacing 19.6-42 Systems 19.6.3.4.1.4 System Operation 19.6-42 19.6.3.4.1.5 System Success Criteria 19.6-43 19.6.3.4.1.6 Technical Specifications 19.6-43 19.6.3.4.2 System Logic Models 19.6-44 19.6.3.4.2.1 Analysis Assumptions 19.6-44 19.6.3.4.2.2 Interface with Event Trees 19.6-45 19.6.3.4.3 System Quantification 19.6-45 19.6.3.5 Heatina. Ventilation and Air 19.6-47 Conditioning System 19.6.3.5.1 System Description 19.6-47 19.6.3.5.1.1 System Function 19.6-47 19.6.3.5.1.2 System Configuration 19.6-47 19.6.3.5.1.3 Support and Interfacing 19.6-48' Systems 19.6.3.5.1.4 System Operation 19.6-49 19.6.3.5.1.5 System Success Criteria 19.6-50 19.6.3.5.2 Effect on ESF Equipment 19.6-50 19.6.3.5.2.1 RPS and ESF-CCS Equipment 19.6-51 19.6.3.5.2.2 Diesel Generator Load 19.6-51 Sequencer 19.6.3.5.2.3 ESF Equipment Room Cooling 19.6-52 19.6.3.5.2.4 Class 1E Battery Room 19.6-52 Cooling 19.6.3.5.3 System Logic Module 19.6-52 O Amendment N l xiv April 1, 1993 l
CESSAR EnL"icari3. (\ ( I
"#' TABLE OF QONTENTS (Cont'd)
CHAPTER 19 section subiect Pace No. 19.6.3.6 Gafety Iniection System 19.6-55 19.6.3.6.1 System Description 19.6-55 19.6.3.6.1.1 System Function 19.6-55 19.6.3.6.1.2 System Configuration 19.6 19.6.3.6.1.3 Support and Interfacing 19.6-57 Systems 19.6.3.6.1.4 System Operation 19.6-59 19.6.3.6.1.5 System Success Criteria 19.6-59 19.6.3.6.1.6 Technical Specifications 19.6-60 19.6.3.6.2 System Logic Models 19.6-62 19.6.3.6.2.1 Analysis Assumptions 19.6-62 19.6.3.6.2.2 Interface With Event Trees 19.6-64 yx 19.6.3.6.3 System Quantification 19.6-64 k
\'
)
19.6.3.6.3.1 System Unavailability 19.6-64 19.6.3.6.3.2 Dominant Contributors to 19.6-65 System Unavailability 19.6.3.7 Emeroency Feedwater System 19.6-67 19.6.3.7.1 System Description 19.6-67 19.6.3.7.1.1 System Function 19.6-67 19.6.3.7.1.2 System Configuration 19.6-67 19.6.3.7.1.3 Support and Interfacing 19.6-68 Systems 19.6.3.7.1.4 System Operation 19.6-69 19.6.3.7.1.5 System Success Criteria 19.6-69 19.6.3.7.1.6 Technical Specifications 19.6-70 19.6.3.7.2 System Logic Models 19.6-71 , l 19.6.3.7.2.1 Analysis Assumptions 19.6-71 ) 19.6.3.7.2.2 Interface with Event Trees 19.6-73 ] 19.6.3.7.3 System Quantification 19.6-74 19.6.3.7.3.1 System Unavailability 19.6-74 () r~s 19.6.3.7.3.2 Dominant Contributors to System Unavailability 19.6-74 I Amendment P xv June 15, 1993
CESSAR En91 CATION TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.6.3.8 Startup Feedwater System 19.6-75 19.6.3.8.1 System Description 19.6-75 19.6.3.8.1.1 System Function 19.6-75 19.6.3.8.1.2 System Configuration 19.6-75 19.6.3.8.1.3 Support and Interfacing 19.6-75 Systems 19.6.3.8.1.4 System Operation 19.6-76 19.6.3.8.1.5 System Success Criteria 19.6-77 19.6.3.8.1.6 Technical Specifications 19.6-77 19.6.3.8.2 System Logic Models 19.6-77 19.6.3.8.2.1 Analysis Assumptions 19.6-77 19.6.3.8.2.2 Interface with Event Trees 19.6-78 19.6.3.8.3 System Quantification 19.6-78 19.6.3.8.3.1 System Unavailability 19.6-78 19.6.3.8.3.2 Dominant Contributors to 19.6-79 System Unavailability 19.6.3.9 Shutdown Coolina System 19.6-81 19.6.3.9.1 System Description 19.6-81 19.6.3.9.1.1 System Function 19.6-81 19.6.3.9.1.2 System Configuration 19.6-81 19.6.3.9.1.3 Support and Interfacing 19.6-83 Systems 19.6.3.9.1.4 System Operation 19.6-83 19.6.3.9.1.5 System Success Criteria 19.6-84 19.6.3.9.1.6 Technical Specifications 19.6-84 19.6.3.9.2 System Logic Models 19.6-86 19.6.3.9.2.1 Analysis Assumptions 19.6-86 19.6.3.9.2.2 Interface with Event Trees 19.6-87 19.6.3.9.3 System Quantification 19.6-87 19.6.3.9.3.1 System Unavailability 19.6-87 19.6.3.9.3.2 Dominant Contributors to 19.6-88 l System Unavailability l Amendment N xvi April 1, 1993 I
'CESSAR E!MAm2
,a (
} TABLE OF CONTENTS (Cont'd)
CHAPTER 19 Section Subiect Pace No. 19.6.3.10 Safety Depressurization System 19.6-89 19.6.3.10.1 System Description 19.6-89 19.6.3.10.1.1 System Function 19.6-89. 19.6.3.10.1.2 System Configuration 19.6-89 19.6.3.10.1.3 Support and Interfacing 19.6-90 Systems 19.6.3.10.1.4 System Operation 19.6-90 19.6.3.10.1.5 System Success Criteria 19.6-91 19.6.3.10.1.6 Technical Specifications 19.6-91 19.6.3.10.2 System Logic Models 1 9 '. 6 - 9 2 19.6.3.10.2.1 Analysis Assumptions 19.6-92 19.6.3.10.2.2 Interface with Event Trees 19.6-93 [ 19.6.3.10.3 System Quantification 19.6-93 19.6.3.10.3.1 System Undvailaoility 19.6-94 19.6.3.10.3.2 Dominant Contributors to 19.6-94 System Unavailability 19.6.3.11 Plant Protection System 19.6-95 19.6.3.11.1 System Description 19.6-95 19.6.3.11.1.1 System Function 19.6-95 19.6.3.11.1.2 System Configuration 19.6-95 19.6.3.11.1.3 Support and Interfacing 19.6-98 Systems 19.6.3.11.1.4 System Operation 19.6-99 19.6.3.11.1.5 System Success Criteria 19.6-100 19.6.3.11.2 System Locic Models 19.6-101 19.6.3.11.2.1 Analysis Assumptions 19.6-102 19.6.3.11.2.2 Interface with Event Trees 19.6-103 19.6.3.11.3 Systen Quantification 19.6-104 19.6.3.12 Encineered Safety Features 19.6-105 Actuation Systen ("~) l V Amendment N xvii April 1, 1993
CESSAR 8lMincma TABLE OF CONTENTS (Cont'd) O CHAPTER 19 Section Subiect Pace No. 19.6.3.12.1 System Description 19.6-105 19.6.3.12.1.1 System Function 19.6-105 19.6.3.12.1.2 System Configuration 19.6-105 19.6.3.12.1.3 Support and Interfacing 19.6-107 Systems 19.6.3.12.1.4 System Operation 19.6-108 19.6.3.12.1.5 System Success Criteria 19.6-109 19.6.3.12.2 System Logic Models 19.6-110 19.6.3.12.2.1 Analysis Assumptions 19.6-111 19.6.3.12.2.2 Interface with Event Trees 19.6-112 19.6.3.12.3 System Quantification 19.6-112 19.6.3.13 Containment Spray System 19.6-113 19.6.3.13.1 System Description 19.6-113 19.6.3.13.1.1 System Function 19.6-113 19.6.3.13.1.2 System Configuration 19.6-113 19.6.3.13.1.3 Support and Interfacing 19.6-115 Systems 19.6.3.13.1.4 System Operation 19.6-116 19.6.3.13.1.5 System Success Criteria 19.6-117 19.6.3.13.1.6 Technical Specifications 19.6-117 19.6.3.13.2 System Logic Models 19.6-118 19.6.3.13.2.1 Anal} sis Assumptions 19.6-118 19.6.3.13.2.2 Interface with Event Trees 19.6-119 19.6.3.13.3 System Quantification 19.6-119 19.6.3.13.3.1 System Unavailability 19.6-120 19.6.3.13.3.2 Dominant Contributors to 19.6-120 System Unavailability 19.6.3.14 Chemical and Volume Control 19.6-121 System 19.6.3.14.1 System Description 19.6-121 j O! Amendment N l xviii April 1, 1993 i
CESSAR Hai"lCATION
,f"%
[V b TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.6.3.14.1.1 System Function 19.6-121 19.6.3.14.1.2 System Configuration 19.6-121 19.6.3.14.1.3 Support and Interfacing 19.6-122 Systems 19.6.3.14.1.4 System Operation 19.6-123 19.6.3.14.1.5 System Success Criteria 19.6-123 19.6.3.14.1.6 Technical Specifications 19.6-123 19.6.3.14.2 System Logic Models 19.6-124 19.6.3.14.2.1 Analysis Assumptions 19.6-124 19.6.3.14.2.2 Interface with Event Trees 19.6-126 19.6.3.14.3 System Quantification 19.6-126 19.6.3.14.3.1 System Unavailability 19.6-127 19.6.3.14.3.2 Dominant Contributors to 19.6-127 (N System Unavailability 19.6.3.15 Emeroency Containment Sprav 19.6-129 Backup System 19.6.3.15.1 System Description 19.6-129 19.6.3.15.1.1 System Function 19.6-129 19.6.3.15.1.2 System Configuration 19.6-129 19.6.3.15.1.3 Support and Interfacing 19.6-129 Systems i 19.6.3.15.1.4 System Operation 19.6-129 19.6.3.15.1.5 System Success Criteria 19.6-130 19.6.3.15.1.6 Technical Specifications 19.6-130 19.6.3.15.2 System Logic Models 19.6-130 1 19.6.3.15.2.1 Analysis Assumptions 19.6-131 19.6.3.15.2.2 Interface with Event Trees 19.6-132 ' 19.6.3.15.3 System Quantification 19.6-132 1 19.6.3.15.3.1 System Unavailability 19.6-132 l 19.6.3.15.3.2 Dominant Contributors to 19.6-133 I System Unavailability /"'N 19.6.3.16 Cavity Floodino System 19.6-135 Amendment N xix April 1, 1993
CESSAR Enn'umn ! TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Bubiect Pace No. 19.6.3.16.1 System Description 19.6-135 19.6.3.16.1.1 System Function 19.6-135 19.6.3.16.1.2 System Configuration 19.6-135 19.6.3.16.1.3 Support and Interfacing 19.6-136 Systems 19.6.3.16.1.4 System Operation 19.6-136 19.6.3.16.1.5 System Success Criteria 19.6-136 19.6.3.16.1.6 Technical Specifications 19.6-137 19.6.3.16.2 System Logic Models 19.6-137 19.6.3.16.2.1 Analysis Assumptions 19.6-138 19.6.3.16.3 System Quantification 19.6-139 19.6.3.16.3.1 System Unavailability 19.6-139 19.6.3.16.3.2 Dominant Contributors to 19.6-139 System Unavailability l 19.6.3.17 Annulus Ventilation System 19.6-141 19.6.3.17.1 System Description 19.6-141 19.6.3.17.1.1 System Function 19.6-141 19.6.3.17.1.2 System Configuration 19.6-141 15.6.3.17.1.3 Support and Interfacing 19.6-142 Systems 19.6.3.17.1.4 System Operation 19.6-142 19.6.3.17.1.5 System Success Criteria 19.6-143 19.6.3.17.1.6 Technical Specifications 19.6-143 19.6.3.17.2 System Logic Models 19.6-143 19.6.3.17.2.1 Analysis Assumptions 19.6-144 19.6.3.17.3 System Quantification 19.6-145 19.6.3.17.3.1 System Unavailability 19.6-145 19.6.3.17.3.2 Dominant Contributors to 19.6-145 System Unavailability 19.6.4 SPECIAL FUNCTION ANALYSES 19.6-147 19.6.4.1 Lona Term Decay Heat Removal 19.6-147 Amendment N xx April 1, 1993
(# hhk T ICAT12N l (S
~'
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Bubiect Pace No. 19.6.4.1.1 Function Description 19.6-147 19.6.4.1.1.1 Shutdown Cooling System 19.6-147 19.6.4.1.2 Function Logic Models 19.6-154 19.6.4.1.2.1 Analysis Assumptions 19.6-154 19.6.4.1.2.2 Interface with Event Trees 19.6-156 19.6.4.1.3 Function Quantification 19.6-156 19.6.4.1.3.1 System Unavailability 19.6-157 19.6.4.1.3.2 Dominant Contributors to 19.6-157 System Unavailability 19.6.4.2 Coolina of the IRWST 19.6-159 O k) 19.6.4.2.1 Function Description 19.6-159 19.6.4.2.1.1 Function Configuration 19.6-159 19.6.4.2.1.2 Support and Interfacing 19.6-160 Systems 19.6.4.2.1.3 Function Operation 19.6-161 19.6.4.2.1.4 Function Success Criteria ~19.6-162 19.6.4.2.1.5 Technical Specifications 19.6-162 19.6.4.2.2 Function Logic Models 19.6-164 19.6.4.2.2.1 Analysis Assumptions 19.6-164 19.6.4.2.2.2 Interface with Event Trees 19.6-165 19.6.4.2.3 Function Quantification 19.6-166 19.6.4.2.3.1 Function Unavailability 19.6-166 19.6.4.2.3.2 Dominant Contributors to 19.6-166 Function Unavailability 19.6.4.3 Accressive Secondary Cooldown 19.6-169 19.6.4.3.1 Function Description 19.6-169 19.6.4.3.1.1 Function 19.6-169 19.6.4.3.1.2 Function Configuration 19.6-169 Amendment N xxi April 1, 1993
CESSAREnnce,. TABLE OF CONTENTS (Cont'd) O CHAPTER 19 Section Subiect Pace No. 19.6.4.3.1.3 Support and Interfacing 19.6-169 Systems 19.6.4.3.1.4 Function Operation 19.6-169 19.6.4.3.1.5 Function Success Criteria 19.6-169 19.6.4.3.1.6 Technical Specifications 19.6-170 19.6.4.3.2 Function Logic Models 19.6-170 19.6.4.3.2.1 Analysis Assumptions 19.6-170 19.6.4.3.2.2 Interface with Event Trees 19.6-170 19.6.4.3.3 Function Quantification 19.6-170 19.6.4.4 RCS Pressure Control 19.6-173 19.6.4.4.1 Function Description 19.6-173 19.6.4.4.2 Pressurizer Spray System 19.6-173 19.6.4.4.2.1 System Function 19.6-173 19.6.4.4.2.2 System Configuration 19.6-173 19.6.4.4.2.3 Support and Interfacing 19.6-173 Systems 19.6.4.4.2.4 System Operation 19.6-174 19.6.4.4.2.5 System Success Criteria 19.6-174 19.6.4.4.2.6 Technical Specifications 19.6-174 19.6.4.4.3 Function Logic Models 19.6-175 19.6.4.4.3.1 Analysis Assumptions 19.6-175 19.6.4.4.4 Function Quantification 19.6-175 19.6.4.4.4.1 Function Unavailability 19.6-175 19.6.4.4.4.2 Dominant Contributors to 19.6-176 Function Unavailability 19.6.4.5 1solate Ruptured Steam Generator 19.6-177 19.6.4.5.1 Function Description 19.6-177 19.6.4.5.1.1 Function Configuration 19.6-177 19.6.4.5.1.2 Steam Generator Blowdown 19.6-177 System O Amendment N xxii April 1, 1993
hh E. ICATION
/%
i ) l \ x ,) ' TABLE OF CONTENTS (Cont'd) CEAPTER 19 Section Subiect Pace No. 19.6.4.5.2 Function Logic Models 19.6-180 19.6.4.5.2.1 Analysis Assumptions 19.6-180 19.6.4.5.2.2 Interface with Event Trees 19.6-180 19.6.4.5.3 Function Quantification 19.6-180 19.6.4.5.3.1 Function Unavailability 19.6-181 19.6.4.5.3.2 Dominant Contributors to 19.6-181 Function Unavailability 19.6.4.6 Steam Removal 19.6-183 19.6.4.6.1 Function Description 19.6-183 19.6.4.6.1.1 Function 19.6-183 19.6.4.6.1.2 Function Configuration 19.6-183 f) 19.6.4.6.1.3 Support and Interfacing 19.6-185 (j 19.6.4.6.1.4 Systems Function Operation 19.6-185 19.6.4.6.1.5 Function Success Criteria 19.6-187 19.6.4.6.1.6 Technical Specifications 19.6-187 19.6.4.6.2 Function Logic Models 19.6-188 19.6.4.6.2.1 Analysis Assumptions 19.6-188 19.6.4.6.2.2 Interface with Event Trees 19.6-189 19.6.4.6.3 Function Quantification 19.6-189 19.7 EXTERNAL EVENTS 19.7-1 19.7.1 QUALITATIVE EXTERNAL EVENT EVALUATION 19.7-1 19.7.1.1 Aircraft Hazards 19.7-2 19.7.1.2 Avalanche 19.7-3 19.7.1.3 Hazardous Material Releases On Site 19.7-3 19.7.1.4 Coastal or Lake Edae Erosion 19.7-3 ' 19.7.1.5 Droucht 19.7-4 %s Amendment N xxiii April 1,.1993
CESSAR nL"icui:u TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Bubiect Pace No. 19.7.1.6 Internal Fires 19.7-4 19.7.1.7 External Fires 19.7-4 19.7.1.8 Internal Floods 19.7-5 19.7.1.9 External Floods 19.7-6 19.7.1.10 Eog 19.7-6 19.7.1.11 Low Temperature 19.7-6 19.7.1.12 Tornados 19.7-7 19.7.1.13 Hazardous Material Releases Off Site 19.7-8 l 19.7.1.14 Landslide 19.7-8 19.7.1.15 Lichtnina 19.7-8 19.7.1.16 Meteorite 19.7-8 19.7.1.17 Sandstorm 19.7-8 19.7.1.18 Seismic Activity 19.7-8 19.7.1.19 Soil Shrink-Swell Consolidation 19.7-10 19.7.1.20 Transportation 19.7-10 19.7.1.21 Turbine-Generated Missiles 19.7-10 19.7.1.22 Volcanic Activity 19.7-11 19.7.1.23 Sabotaae and Terrorism 19.7-11 19.7.1.24 Summary of Events to be Evaluated 19.7-11 19.7.2 TORNADO STRIKE ANALYSIS 19.7-13 19.7.2.1 Identification of Key Components 19.7-13 and Vulnerabilities O Amendment N xxiv April 1, 1993
CESSARn%ncucu
TABLE OF CONTENTS (Cont'd)
CHAPTER 19 Section Subiect Pace No. 19.7.2.1.1 Turbine Building 19.7-13 19.7.2.1.2 Containment Penetration Room 19.7-14 19.7.2.1.3 Service Water Intake 19.7-14 19.7.2.1.4 Switchyard and Feeder Lines 19.7-14 19.7.2.1.5 Diesel Generator Intake and Exhaust 19.7-15 19.7.2.1.6 Auxiliary and Reactor Building 19.7-15 19.7.2.1.7 Condensate Storage Tank 19.7-15 19.7.2.1.8 Refueling Water Storage Tank 19.7-16 19.7.2.1.9 Diesel Generator Fuel Oil Tank 19.7-16 19.7.2.1.10 Transformers 19.7-16 19.7.2.1.11 Diesel Generators 19.7-17 19.7.2.1.12 Combustion Turbine 19.7-17 19.7.2.2 Tornado Site Strike Frecuency 19.7-17 Calculation 19.7.2.3 Tornado Strike Secuence Analysis 19.7-18 Event Progression (' ') 19.7.2.3.1 19.7.2.3.2 Tornado Strike Event Tree Elements 19.7-18 19.7-20 19.7.2.3.2.1 Tornado Strike Initiators 19.7-20 19.7.2.3.2.2 Primary Safety Valve Rescat 19.7-20 19.7.2.3.2.3 Safety Injection System 19.7-20 Injection 19.7.2.3.2.4 Deliver Emergency Feedwater 19.7-21 19.7.2.3.2.5 Long-Term Decay Heat Removal 19.7-21 19.7.2.3.2.6 Safety Depressurization 19.7-21 (Bleed) 19.7.2.3.2.7 Safety Injection (Feed) 19.7-22 19.7.2.3.2.8 Cooling the IRWST 19.7-22 19.7.2.3.2.9 Major Dependencies 19.7-23 19.7.2.3.2.10 Major Recovery Actions 19.7-23 19.7.2.3.3 Station Blackout Event Progression 19.7-23 19.7.3 INTERNAL FIRE ANALYSIS 19.7-25 19.7.3.1 Oualitative Fire Risk Assessment 19.7-25 19.7.3.1.1 Overview 19.7-25 19.7.3.1.2 Methodology 19.7-26 19.7.3.1.3 System 80+ Plant Design 19.7-26 fI
</
Amendment N xxv April 1, 1993
CESSAREna mu TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subject Pace No. 19.7.3.1.3.1 Overview 19.7-26 19.7.3.1.3.2 Fire Areas 19.7-27 19.7.3.1.3.3 System List 19.7-27 19.7.3.1.3.4 Equipment by Fire Area 19.7-28 19.7.3.1.3.5 Adjacent Fire Areas 19.7-28 19.7.3.1.4 Fire Protection Information System 19.7-28 19.7.3.1.5 Results of the Fire Hazards 19.7-28 Assessment 19.7.3.1.6 List of Assumptions 19.7-29 19.7.3.2 Internal Fire Frecuency Calculation 19.7-31 19.7.3.3 Internal Fire Analysis 19.7-33 Ouantification 19.7.4 INTERNAL FLOOD ANALYSIS 19.7-35 19.7.4.1 {Lualitative Flood Protection 19.7-35 Assessment 19.7.4.2 Internal Flood Event Frecuency 19.7-37 Calculation 19.7.4.3 Internal Flood Analysis 19.7-39 Ouantification 19.8 SHUTDOWN RISK ASSESSMENT 19.8-1 19.8.1 SHUTDOWN PRA
SUMMARY
AND CONCLUSION 19.8-1 19.8.1.1 Results 19.8-1 19.8.1.2 Insichts 19.8-2 19.
8.2 BACKGROUND
19.8-5 19.8.2.1 Methodology 19.8-6 19.8.3 INITIATING EVENT FREQUENCIES 19.8-9 19.8.4 ACCIDENT SEQUENCES 19,8-11 19.8.4.1 Loss of DHR 19.8-11 Amendment N xxvi April 1, 1993
ks! h h k kkICATl;N !
-w j \~
TABLE OF CONTENTS (Cont'd) i 1 l CHAPTER 19 l Section Subiect Pace No. 19.8.4.1.1 Loss of DHR, Mode 4, 5, 6F 19.8-12 19.8.4.1.2 Loss of DHR, Modes SR, 19.8-14 Reduced Inventory 19.8.4.1.3 Loss of DHR, Mode 6E, IRWST 19.8-18 Empty 19.8.4.1.4 Loss of DHR, Mode 6I, IRWST 19.8-19 Empty, Upper Internals in Place 19.8.4.2 LOCA 19.8-23 19.8.4.2.1 LOCA, Modes 4,5,6F 19.8-23 19.8.4.2.2 LOCA, Modes SR, Reduced Inventory 19.8-26 19.8.4.2.3 LOCA Outside Containment, 19.8-29 Modes 6E, 6I 19.8.4.2.4 LOCA Inside Containment, 19.8-30 Modes 6E, 6I 19.8.4.3 Fire Risk Analysis 19.8-33 ('S +
' 19.8.4.3.1 Approach 19.8-33 19.8.4.3.2 Frequency of Fired During Pos i 19.8-35 19.8.4.3.3 Probability of Severe Fire 19.8-36 19.8.4.3.4 Probability of Core Damage 19.8-37 19.8.4.3.5 Conclusions 19.8-37 19.8.4.4 Internal Floodino Risk 19.8-39 19.8.4.5 Loss of Offsite Power 19.8-43 19.8.4.6 Criticality Events 19.8-45 19.8.5 FAULT TREE ANALYSIS 19.8-47 19.8.5.1 OI. Operator Isolates Leak 19.8-47 19.8.5.2 OIC. Operator Isolates Leak at 19.8-48 C_o_ptainment Boundarl 19.8.5.3 OR, Operator Restores SCS Train 19.8-51 19.8.5.4 ORL: Operator Restores SCS 19.8-53 Train Given Isolated LOCA l -s i us Amendment N j xxvii April 1, 1993 )
CESSARE5Ence TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.8.5.5 MUI. Operator Uses CVCS to 19.8-55 Makeup Inventory 19.8.5.6 SCS-F. Operator Initiates Feed 19.8-55 With Standby SCS Train 19.8.5.7 0S1. Operator Starts Standby 19.8-59 SCS Train 19.8.5.8 OSI-PR. Operator Realians SCS 19.8-61 for Heat Removal 19.8.5.9 CSS Pumo Used for DHR Removal 19.8-63 19.8.5.10 SDS-B. Operator Initiates Bleed 19.8-67 Usina SDS 19.8.5.11 LTOP-B. LTOP Valve Opens for 19.8 Bleed 19.8.5.12 SIS-F. SIS System Feed 19.8-69 19.8.5.13 BOC. Boil-off Coolina Usina 19.8-73 CVCS 19.8.5.14 REC-L, Operator DHR Recoverv. 19.8-75 With Makeuo 19.8.5.15 REC-S. Operator DHR Recoverv. 19.8-75 Without Makeup 19.8.6 IMPORTANCE AND SENSITIVITY ANALYSIS 19.8-77 19.8.6.1 System and Branch Point 19.8-77 Importance 19.8.6.2 Pos Imoortance 19.8-78 19.8.6.3 Sensitivity Analysis 19.8-78 19.8.7 RADIOLOGICAL CONSEQUENCES 19.8-81 APPENDIX 19.8A SYSTEM 80+ SHUTDOWN RISK EVALUATION REPORT 19.8A-1 , O Amendment N xxviii April 1, 1993
CESSAR E5;nem:n I
/N I ) '~'
TABLE OF CONTENTS (Cont'd) l CHAPTER 19 Section Bubiect Pace No. 19.9 ACCIDENT SEOUENCE OUANTIFICATION 19.9-1 19.9.1
SUMMARY
OF CORE DAMAGE FREQUENCY 19.9-1 19.9.2 CORE DAMAGE FREQUENCY CONTRIBUTION 19.9-3 FOR DOMINANT SEQUENCES FOR INTERNAL EVENTS 19.9.2.1 Large Loss-Of-Coolant-Accident 19.9-3 19.9.2.2 Medium Loss-Of-Coolant-Accident 19.9-5 19.9.2.3 Small Loss-Of-Coolant-Accident 19.9-7 19.9.2.4 Steam Generator Tube Rupture 19.9-8a 19.9.2.5 Larce Secondary Side Break 19.9-11 /~' ( )N 19.9.2.6 Loss Of Feedwater Flow 19.9-13 19.9.2.7 Other Transients 19.9-17 19.9.2.8 Loss Of Offsite Power 19.9-19 19.9.2.9 Loss of Component Coolina Water 19.9-21 Division 2(B) 19.9.2.10 Loss of 125 VDC Vital Bus B 19.9-23 19.9.2.11 Loss of 4.16 KV B 19.9-25 19.9.2.12 Loss of Heatina, Ventilation 19.9-27 and Air-Conditionina 19.9.2.13 Anticipated Transient Without 19.9-29 Scram 19.9.2.14 Interfacina System LOCA 19.9-31 19.9.2.15 Vessel Rupture 19.9-31
^g Amendment N xxix April 1, 1993
CESSAR Haincyiu. TABLE OF CONTENTS (Cont'd) . CHAPTER 19 Section Subiect Pace No. 19.9.3 CORE DAMAGE FREQUENCY CONTRIBUTION 19.9-33 FOR DOMINANT SEQUENCES FOR EXTERNAL EVENTS 19.9.3.1 Tornado Strike Event 19.9-33 19.9.3.2 Internal Fire Event 19.9-35 19.9.3.3 Internal Flood Event 19.9-35 19.9.4 INSIGHTS 19.9-37 19.9.4.1 System Importance 19.9-37 19.9.4.2 Component Importance 19.9-41 19.10 SENSITIVITY ANALYSES - LEVEL 1 19.10-1 19.10.1 OPERATOR ERROR RATE - GENERAL 19.10-1 19.10.2 OPERATOR ERROR RATE - CONTROL ROOM 19.10-2
RESPONSE
19.10.3 MOTOR-OPERATED VALVE FAILURE RATE 19.10-2 19.10.4 SITS FOR MEDIUM LOCAS 19.10-3 19.10.5 AGGRESSIVE SECONDARY COOLDOWN NOT 19.10-3 FEASIBLE 19.10.6 RCP SEAL FAILURE ON STATION BLACKOUT 19.10-4 19.10.7 COMPONENTS UNAVAILABLE DUE TO 19.10-10 MAINTENANCE 19.10.8 ADVERSE MTC 19.10-11 19.10.9 LOSS OF OFFSITE POWER FREQUENCY 19.10-11 19.10.10 OTHER SENSITIVITY ANALYSES 19.10-12 19.10.10.1 Vessel Rupture 19.10-12 19.10.10.2 Common Cause Failures 19.10-12 19.10.10.3 Startup Feedwater System Actuation 19.10-13 Amendment P' xxx June 15, 1993
CESSAR MMicari .
,\
t \ TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Bubiect Pace No. 19.11 SEVERE ACCIDENT PHENOMENOLOGY AND 19.11-1 CONTAINMENT PERFORMANCE FOR THE SYSTEM 80+ PWR 1 19.
11.1 INTRODUCTION
19.11-1 19.11.2 SCOPE 19.11-2 19.11.3 SYSTEM 80+ DESIGN FEATURES FOR SEVERE 19.11-3 ACCIDENT MITIGATION 19.11.3.1 Containment DesiGB 19.11-3 19.11.3.1.1 Description of the Steel Containment 19.11-3 19.11.3.1.2 Containment Shell Pressure Limits 19.11-3 19.11.3.1.2.1 Design Basis Pressure Capacity 19.11-4 (N 19.11.3.1.2.2 ASME Service Level "C" Stress 19.11-5 t,'' ) 19.11.3.1.2.3 Evaluation System 80+ Ultimate Capacity 19.11-5 Evaluation for PRA 19.11.3.1.2.4 Containment Fragility Curve 19.11-7 19.11.3.1.3 Containment Penetrations 19.11-8 19.11.3.1.4 Containment Penetration Seals 19.11-9 19.11.3.2 Secondary Containment Deslan 19.11-11 19.11.3.2.1 Purpose of System 19.11-11 19.11.3.2.2 Description of the System 19.11-11 19.11.3.2.3 Impact on PRA 19.11-12 19.11.3.3 Cavity ?looding System 19.11-13 19.11.3.3.1 Purpose of the CFS 19.11-13 19.11.3.3.2 System Description 19.11-13 19.11.3.3.3 Role of the CFS in Accident 19.11-15 Mitigation 19.11.3.4 Hydrocen Mitigation System 19.11-17 19.11.3.4.1 Purpose of the HMS 19.11-17 19.11.3.4.2 System Description 19.11-17 (N, 19.11.3.4.3 Igniter Placement 19.11-18 Amendment P xxxi June 15, 1993
()l fhjh/(l{ CESl?N CERTIFICATION TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section pubiect Pace No. 19.11.3.4.4 IRWST Vents 19.11-19 19.11.3.4.5 Role of the HMS in Accident 19.11-20 Management 19.11.3.4.6 Role of the HMS in the PRA 19.11-20 19.11.3.5 Safety Deoressurization System 19.11-21 19.11.3.5.1 Purpose of the SDS 19.11-21 19.11.3.5.2 System Description 19.11-22 19.11.3.5.3 System Performance During Severe 19.11-22 Accidents 19.11.3.5.4 Analysis of SDS Operation During 19.11-23 Severe Accidents 19.11.3.5.5 Role of the SDS in Accident 19.11-24 Management 19.11.3.5.5.1 Feed and Bleed Cooling 19.11-24 19.11.3.5.5.2 RCS Depressurization Without 19.11-25 Inventory Makeup I I 19.11.3.6 Reactor Cavity Desian 19.11-27 19.11.3.6.1 Reactor Cavity Design Philosophy 19.11-27 19.11.3.6.2 Description of the Reactor Cavity 19.11-27 19.11.3.6.2.1 Large Cavity Volume 19.11-27 19.11.3.6.2.2 Closed Vertical Shaft 19.11-27 19.11.3.6.2.3 Convoluted Gas Vent Escape 19.11-28 Pathway 19.11.3.6.2.4 Core Debris Chamber 19.11-28 19.11.3.6.2.5 Floor Area 19.11-29 19.11.3.6.2.6 Floor Thickness / Sump Protection 19.11-30 19.11.3.6.2.7 Cavity Strength 19.11-30 19.11.3.6.2.8 Impact of Cavity Wall Damage 19.11-32 19.11.3.6.2.9 Cavity Fragility Curve 19.11-32 19.11.3.6.2.10 Basemat Composition 19.11-33 19.11.3.6.3 Response to Severe Accidents 19.11-33 19.11.3.6.3.1 HPME Loads Including DCH 19.11-33 O Amendment P xxxii June 15, 1993
CESSAR Mncucu
~'
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.11.3.7 Missile Protection 19.11-35 19.11.3.7.1 Purpose 19.11-35 19.11.3.7.2 Protection From Hot Core Debris 19.11-35 19.11.3.7.3 Protection From Missiles Generated 19.11-36 via Top Head Failures 19.11.3.7.4 Protection Following Induced 19.11-36 Missiles Caused by Rapid Deflagrations / Hydrogen Detonations and Ex-Vessel Steam Explosions 19.11.3.7.5 Application of Missile Generation 19.11-37 Within the PRA 19.11.3.8 Containment Sprav System 19.11-39 19.11.3.8.1 Purpose of the CSS 19.11-39 19.11.3.8.2 System Description 19.11-39
g 19.11.3.8.3 Role of CSS in Accident Management 19.11-40 b 19.11.3.9 Hydrocen Purce Vent 19.11-43 19.11.3.9.1 Description of System 19.11-43 19.11.3.9.2 Potential Application 19.11-43 19.11.3.10 References for Section 19.11.3 19.11-44 19.11.4 SEVERE ACCIDENT PHENOMENOLOGY 19.11-45 19.11.4.1 Mechanism for Early Containment 19.11-45 Failure 19.11.4.1.1 Direct Containment Heating 19.11-46 19.11.4.1.1.1 Description of Phenomena 19.11-46 19.11.4.1.1.2 Parameters Affecting DCH 19.11-47 19.11.4.1.1.3 RCS Depressurization Prior 19.11-52 to VB 19.11.4.1.1.4 RCP Seal Failure 19.11-57 19.11.4.1.1.5 Quantitative Assessments of 19.11-59 DCH Challenge for System 80+
19.11.4.1.1.6 Significance of DCH Containment 19.11-64 Threat to System 80+ 19.11.4.1.1.7 Application to the PRA 19.11-65
,rx
' ) \._/ Amendment P xxxiii June 15, 1993 ;
CESSAR n5?Picari n TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.11.4.1.2 Rapid Steam Generation 19.11-75 19.11.4.1.2.1 In-Vessel Steam Explosions 19.11-75 (IVSEs) 19.11.4.1.2.2 Ex-Vessel Steam Explosions 19.11-78 19.11.4.1.2.3 Post-Vessel Breach Steam Spikes 19.11-90 19.11.4.1.3 Hydrogen Combustion 19.11-95 19.11.4.1.3.1 Deflagrations 19.11-95 19.11.4.1.3.2 Hydrogen Detonation 19.11-106 19.11.4.1.4 Other Early Containment Failure 19.11-113 19.11.4.1.4.1 Direct Shell Attack via Corium 19.11-113 ImpingemenL 19.11.4.1.4.2 Cavity Overpressure Failure 19.11-114 19.11.4.1.4.3 Rocket Induced Containment Failure 19.11-115l l 19.11.4.1.4.4 Synergistic Issues 19.11-121 19.11.4.1.4.5 Loss of Containment Isolation 19.11-121 Prior to Core Melt 19.11.4.1.4.6 Containment Bypass 19.11-123 19.11.4.2 Late Containment Failure 19.11-127 19.11.4.2.1 Gradual Overpressurization 19.11-127 19.11.4.2.1.1 Steam Overpressurization 19.11-127 19.11.4.2.1.2 Overpressure via Steaming in 19.11-130 the Presence of Non-Condensibles 19.11.4.2.2 Basemat Melt-Through 19.11-135 19.11.4.2.2.1 Description of the Phenomena 19.11-135 19.11.4.2.2.2 Parameters Affecting Basemat 19.11-136 Melt-Through 19.11.4.2.2.3 Debris Bed Coolability 19.11-137 19.11.4.2.2.3 System 80+ Specific CCI 19.11-142 Investigations 19.11.4.2.2.4 Significance to System 80+ 19.11-144 19.11.4.2.2.5 Applicr ion to the PRA 19.11-145 Ol Amendment P l xxxiv June 15, 1993
CESSAR Enn"icamu m TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.11.4.2.3 Temperature Induced Failure of 19.11-147 Containment Penetration Sealant 19.11.4.2.3.1 Significance to System 80+ 19.11-147 19.11.4.2.3.2 Application to the PRA 19.11-147 19.11.4.2.4 Delayed Combustion 19.11-147 19.11.4.2.4.1 Description of the Phenomena 19.11-147 19.11.4.2.4.2 Significance to System 80+ 19.11-148 19.11.4.2.4.3 Application to the PRA 19.11-148 19.11.4.3 Fission Product Release. Transport 19.11-151 and Retention 19.11.4.3.1 Models for Fission Product Release 19.11-151 and Depletion
'~'T 19.11.4.3.2 Advanced Source Term 19.11-152 (G 19.11.4.3.2.1 Fission Product Release 19.11-152 19.11.4.3.2.2 Fission Product Removal 19.11-158 In Containment 19.11.4.3.2.3 Significance of Natural 19.11-160 Deposition Processes 19.11.4.3.2.4 Fission Product Retention and 19.11-160 Filtering in the Secondary Containment 19.11.4.3.3 Significance to System 80+ 19.11-163 19.11.4.3.4 Application to the PRA 19.11-163 19.11.4.3.5 Summary 19.11-163-19.11.4.4 System 80 Severe Accident Manacement 19.11-165 Issues 19.11.4.4.1 Equipment Availability for 19.11-165 Recoverable Beyond Design Basis Accidents 19.11.4.4.1.1 Definition of Safety Functions 19.11-166 19.11.4.4.1.2 Instrumentation / Equipment 19.11-167 Requirements in Support of "In-Vessel" Recovery V
Amendment P xxxv June 15, 1993
a CESSAR "E*.TiriCATi1N C;
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section pub. ject Pace No. 19.11.4.4.1.3 Summary of Required 19.11-171 Instrumentation and Equipment 19.11.4.4.1.4 Severe Accident Instrumentation 19.11-171 Qualification 19.11.4.4.1.5 Post Accident Operation of 19.11-176 System 80+ Severe Accident Mitigation Systems 19.11.4.4.1.6 Summary 19.11-177 19.11.4.4.2 Accident Management Guidance ,19.11-177 19.11.4.4.2.1 AMG for Severe Accident 19.11-178 Sequences with "In-Vessel" Corium Retention 19.11.4.4>2.2 Application of AMG to 19.11-179 "Ex-Vessel" Sequences 19.11.4.4.2.3 Summary 19.11-182l I' 19.11.4.5 References for Section 19.11.4 19.11-183 19.11.5 SYSTEM 80+ CONTAINMENT PERFORMANCE 19.11-191 ANALYSIS 19.11.5.1 Introduction 19.11-191 19.11.5.2 Modifications to MAAP 3.0B 19.11-191 19.11.5.3 System 80+ MAAP Model 19.11-192 19.11.5.4 Transient Analyses 19.11-193 19.11.5.4.1 Station Blackout Sequence 19.11-193 19.11.5.4.1.1 Station Blackout Sequence with 19.11-193 Battery Power Unavailable and Cavity Flood System Actuated 19.11.5.4.1.2 Station Blackout Sequence with 19.11-195 Battery Power Unavailable and Cavity Flood System Unavailable 19.11.5.4.1.3 Station Blackout Sequence with 19.11-197 Battery Power Available and Cavity Flood System Actuated l l Amendment P xxxvi June 15, 1993
CESSAR innficarisu (s\ TABLE OF CONTENTS (Cont'd) CHAPTER 19 Bection Subiect Pace No. 19.11.5.4.2 Large Break LOCA 19.11-199 19.11.5.4.2.1 Large Break LOCA with Wet Cavity 19.11-200 19.11.5.4.2.2 Large Break LOCA with Dry Cavity 19.11-201 19.11.5.4.3 Small Break LOCA 19.11-201 19.11.5.4.3.1 Small Break LOCA with Wet Cavity 19.11-202 19.11.5.4.3.2 Small Break LOCA with Dry Cavity 19.11-203 19.11.5.4.4 Total Loss of Feedwater 19.11-204 19.11.5.4.4.1 Total Loss of Feedwater with a 19.11-204 Wet Cavity 19.11.5.4.4.2 Total Loss of Feedwater with a 19.11-205 Dry Cavity [ 19.11.5.4.5 Steam Generator Tube Rupture with 19.11-205 \ Stuck Open MSSV 19.11.5.4.5.1 Primary and Secondary System 19.11-205
Response
19.11.5.4.5.2 Containment Performance 19.11-206 19.11.5.4.5.3 Fission Product Releases 19.11-206 19.11.5.4.6 V Sequence 19.11-207 19.11.5.4.6.1 RCS Response 19.11-207 Characteristics 19.11.5.4.6.2 Containment Response 19.11-207 Characteristics 19.11.5.4.6.3 Fission Product Releases 19.11-208 19.11.5.5 Summary 19.11-209 19.11.5.6 References for Section 19.11.5 19.11-210 19.11.6
SUMMARY
AND CONCLUSIONS 19.11-211 1 ["'N l (- / i Amendment P xxxvii June 15, 1993
CESSARnnL m TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section _Subiect Eace No. APPENDICES: App. 19.11A REPRESENTATIVE CALCULATIONS REGARDING 19.11A-1 REGARDING A SYSTEM 80+ THERMALLY INDUCED STEAM GENERATOR TUBE CREEP FAILURE IN THE PRESENCE OF A STEAM GENERATOR PARTIALLY FILLED WITH LIQUID App. 19.11B BOUNDING ANALYSES FOR DCH FOR THE 19.11B-1 C-E EVOLUTIONARY PWR App. 19.11C ASSESSMENT OF THE DE-ENTRAINMENT 19.11C-1 CAPABILITY OF THE SYSTEM 80+ REACTOR CAVITY App. 19.11D TWO CELL ADIABATIC EQUILIBRIUM MODEL 19.11D-1 FOR DIRECT CONTAINMENT HEATING l l App. 19.11E METHODOLOGY FOR THE CALCULATION OF 19.11E-1 CONTAINMENT PRESSURE FOLLOWING A HYDROGEN BURN App. 19.11F REACTOR VESSEL LOWER HEAD FAILURE AREA 19.11F-1 App. 19.11J DESCRIPTION OF S80SOR SYSTEM 80+ 19.11J-1 SOURCE TERM METHODOLOGY 19.12 CONTAINMENT RESPONSE ANALYSIS 19.12-1 19.12.1 DEFINITION AND QUANTIFICATION OF THE 19.12-1 PLANT DAMAGE STATES 19.12.1.1 Oualitative Evaluation of 19.12-1 Containment Performance Phenomena 19.12.1.2 Definition of Plant Damaae State 19.12-6 Parameters 19.12.1.2.1 Reactor Coolant System Leakage Rate 19.12-6 19.12.1.2.2 Reactor Coolant System Pressure 19.12-7 19.12.1.2.3 Point of Release 19.12-7 19.12.1.2.4 Steam Generator Availability 19.12-9 19.12.1.2.5 Containment Spray System Status 19.12-9 l I' l Amendment P xxxviii June 15, 1993
o CESSAR Ealincum l l 7s I Vl TABLE OF CONTENTQ (Cont'd) CHAPTER 19 Section Bubiect Pace No. 19.12.1.2.6 Containment Heat Removal Status 19.12-9 19.12.1.2.7 Cavity Condition 19.12-10 19.12.1.2.8 Core Melt Timing 19.12-10 19.12.1.3 Definition of Plant Damaae States 19.12-10 19.12.1.4 Ouantification of the Plant Damace 19.12-11 States 19.12.1.4.1 Containment Safeguards Event Tree 19.12-11 19.12.2 DEFINITION AND QUANTIFICATION OF THE 19.12-17 CONTAINMENT EVENT TREE 19.12.2.1 Definition of the Containment 19.12-17 Event Tree [' ' 19.12.2.1.1 Definition of CET Top Events 19.12-18 19.12.2.1.1.1 "Is Containment Bypass 19.12-18 Prevented?" 19.12.2.1.1.2 "Is the Containment Isolated?" 19.12-18 19.12.2.1.1.3 "Is Containment Failure Before 19.12-18 Core Damage Prevented?" 19.12.2.1.1.4 "Is Early Containment Failure 19.12-19 Prevented?" 19.12.2.1.1.5 "Is Late Containment Failure 19.12-20 Prevented?" 19.12.2.1.1.6 "Is In-Vessel Fission Product 19.12-21 Scrubbing Available?" l 19.12.2.1.1.7 "Is a Vaporization Release 19.12-22 Prevented?" , 19.12.2.1.1.8 "Is a Revaporization Release 19.12-22 ! Prevented?" 19.12.2.1.1.9 Additional Fission Product 19.12-23 I Scrubbing , l 19.12.2.2 Ouantification of the Containment 19.12-25 Event Tree Top Events , 19.12.2.2.1 Quantification Process 19.12-25 19.12.2.2.2 Assessment of System 80+ Structural 19.12-25 Capabilities Q Amendment P xxxix June 15, 1993
EEFN
! hkh/khg CEJTIFICATl2N -
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.12.2.2.2.1 Ultimate Capacity of Containment 19.12-25 to Quasi-Static Loading 19.12.2.2.2.2 Dynamic Capacity of Containment 19.12-26 19.12.2.2.2.3 Reactor Cavity Design Strength 19.12-26 19.12.2.2.2.4 Reactor Cavity Dynamic 19.12-27 Characteristics 19.12.2.2.2.5 Response of RCS Piping Following 19.12-27 RV Failure 19.12.2.2.3 Top Event 1: Containment Bypass 19.12-28 19.12.2.2.4 Top Event 2: Containment Isolation 19.12-29 Failure 19.12.2.2.4.1 Containment Piping Penetrations 19.12-29 Analysis 19.12.2.2.4.2 Estimated Value for Failure of 19.12-40 Containment Isolation 19.12.2.2.5 Containment Failure Before Core Melt 19.12-43 I I 19.12.2.2.6 Top Event 3: Early Containment 19.12-43 Failure 19.12.2.2.6.1 "In Vessel" Steam Explosion 19.12-43 (IVSE) 19.12.2.2.6.2 Direct Containment Heating 19.12-49 19.12.2.2.6.3 Hydrogen Combustion 19.12-54 19.12.2.2.6.4 Rapid Steam Generation 19.12-67 19.12.2.2.6.5 RVRFAIL: Rocket Induced 19.12-70 Containment Failure 19.12.2.2.6.6 HPMEFAIL: HPME Induced 19.12-71 Containment Failure 19.12.2.2.7 Top Event 4: Late Containment Failure 19.12-73 19.12.2.2.7.1 LCPFAIL: Late Containment 19.12-73 Overpressure Failure Occurs 19.12.2.2.7.2 LCTFAIL: Late Containment 19.12-88 Overtemperature Failure Occurs 19.12.2.2.7.3 CVMFAIL: Containment Vessel 19.12-89 Melt-Through Occurs O Amendment P l x1 June 15, 1993 I l 1
CESSAR Ennema 7S t 1 TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section subiect Pace No. 19.12.2.2.8 Top Event 5: IV-FPSCRUB: "In Vessel" 19.12-95 Fission Product Releases Scrubbed 19.12.2.2.8.1 SPRY-SCRUB: Spray Scrubs 19.12-95 Fission Product Releases from Intact Vessel 19.12.2.2.8.2 IRWST-SCRUB: IRWST Scrubs 19.12-95 Fission Product Release 19.12.2.2.8.3 SGTR-SCRUB: Secondary Systerm 19.12-96 Scrub Release 19.12.2.2.9 Top Event 6: VRP: Vaporization 19.12-97 Release Prevented 19.12.2.2.10 Top Event 7: Revaporization Release 19.12-97 Prevented (N 19.12.2.2.10.1 REVAP-IV: Revaporization of 19.12-98 () Fission Products Deposited in Vessel 19.12.2.2.10.2 REVAP-EV: Revaporization of 19.12-101 Ex-vessel Fission Product Release 19.12.2.2.11 Top Event 8: Are Revaporization 19.12-103 Releases Scrubbed 19.12.2.2.11.1 CSSPRAY: Containment Spray 19.12-103 System Scrubs Releases 19.12.2.2.11.2 RVRS-IRWST: Revaporization 19.12-103 Release Through the IRWST Scrubbed 19.12.2.2.12 Top Event 9: VAP-SCRUB: Are CCI 19.12-103 Vaporization Releases Scrubbed? 19.12.2.2.13 Top Event 10: Radionuclides Released 19.12-104 Through the Auxiliary Building 19.12.2.2.14 Secondary Containment Filter 19.12-105 Operating (SCFO) 19.12.2.3 Ouantification of the Containment 19.12-107 (N Event Tree Amendment P xli June 15, 1993
CESSARE!L mu TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.12.3 DEFINITION OF RELEASE CLASSES 19.12-111 19.12.3.1 Characterization of the Release 19.12-111 Classes 19.12.3.2 Description of Release Classes 19.12-115 19.12.3.2.1 Intact Containment Releases 19.12-115 19.12.3.2.1.1 Release Class 1.1E 19.12-115 19.12.3.2.1.2 Release Class RC1.1M 19.12-115 19.12.3.2.2 Late Containment Failure 19.12-116 19.12.3.2.2.1 Release Class RC2.1E 19.12-116 19.12.3.2.2.2 Release Class RC2.2E 19.12-116 19.12.3.2.2.3 Release Class RC2.4E 19.12-117 19.12.3.2.2.4 Release Class RC2.5E 19.12-118 19.12.3.2.2.5 Release Class RC2.6E 19.12-118l I 19.12.3.2.2.6 Release Class RC2.7E 19.12-119 19.12.3.2.2.7 Release Class RC2.2M 19.12-119 19.12.3.2.2.8 Release Class RC2.5M 19.12-120 19.12.3.2.2.9 Release Class RC2.6M 19.12-120 19.12.3.2.2.10 Release Class RC2.7M 19.12-121 19.12.3.2.3 Early Containment Failure 19.12-121 19.12.3.2.3.1 Release Class RC3.1E 19.12-121 19.12.3.2.3.2 Release Class RC3.2E 19.12-122 19.12.3.2.3.3 Release Class RC3.4E 19.12-123 19.12.3.2.3.4 Release Class RC3.6E 19.12-123 19.12.3.2.3.5 Release Class RC3.2M 19.12-124 19.12.3.2.3.6 Release Class RC3.6M 19.12-125 19.12.3.2.4 Containment Isolation Failure 19.12-125 19.12.3.2.4.1 Release Class RC4.4E 19.12-125 19.12.3.2.4.2 Release Class RC4.8E 19.12-126 19.12.3.2.4.3 Release Class RC4.12E 19.12-126 19.12.3.2.4.4 Release Class RC4.18L 19.12-127 19.12.3.2.5 Release Class RCS.1E 19.12-128 O Amendment P xlii June 15, 1993
CESSAR n%"icari:n (,>) TABLE OF CONTENTS (Cont'd). CHAPTER 19 i Section Subject Pace No. 19.13 CONSEOUENCE ANALYSIS 19.13-1 19.14 LEVEL II AND LEVEL III SENSITIVITY 19.14-1 ANALYSES 19.14.1 CONTAINMENT RESPONSE SENSITIVITY ANALYSES 19.14-1 19.14.1.1 Availability of Hydrocen Ionitors 19.14-1 19.14.1.2 Containment Characteristics More 19.14-2 Favorable to DDT 19.14.1.3 Low Heat Transfer Rate for " WET" 19.14-2 Cavity 19.14.1.4 Cavity Not Always Fill with Water 19.14-3 19.14.1.5 Recovery of Containment Heat -gs! Removal Function 19.14-3 \_) 19.14.1.6 Induced Failure of RCS Pioina 19.14-4 19.14.1.7 Depressurization of RCS by SDS 19.14-5 19.14.1.8 Containment Isolation 19.14-6 19.14.2 SENSITIVITY ANALY9"S OF RELEASE 19.14-7 CONSEQUENCES 19.14.2.1 Location of Release Point 19.14-7 19.14.2.2 Iodine and Cesium Release Fractions 19.14-8 19.14.2.3 Containment Bvoass Releases 19.14-9 Unscrubbed 19.14.2.4 Reliability of Containment Isolation 19.14-9 Systems 19.14.2.5 Basemat Melt-throuch 19.14-10 19.14.2.6 Interfacing System LOCA 19.14-11 (D) (wJ Amendment P xliii June 15, 1993
C E S S A R E! % % m . TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.15
SUMMARY
OF PRA-BASED DESIGN INSIGHTS 19.15-1 19.15.1 SPECIAL DESIGN FEATURES 19.15-2 19.15.1.1 Desian Feature for Preventina 19.15-2 Core Damace 19.15.1.2 Desian Features for Miticatina 19.15-7 Consecuences of Core Damace 19.15.2 INTERNAL EVENTS RISK PROFILE INSIGHTS 19.15-11 19.15.2.1 Core Damace Frecuency of the 19.15-11 Level I PRh 19.15.2.1.1 Core Damage Frequency by Initiating 19.15-11 Events 19.15.2.1.2 Dominant Accident Sequences for 19.15-12 Internal Events { } 19.15.2.1.3 Risk-Reduction Design Features 19.15-21 19.15.2.1.4 Insights from the Uncertainty, 19.15-22 Sensitivity, and Importance Analyses 19.15.2.1.4.1 Insights from the Uncertainty 19.15-22 Analysis 19.15.2.1.4.2 Insights from Level I 19.15-23 Sensitivity Analyses 19.15.2.1.4.3 Insights from the Importance 19.15-28 Analyses 19.15.2.2 Analysis of Containment Performance 19.15-31 gnd Source Terms - Level II PRA 19.15.2.2.1 Containment Failure Frequency 19.15-32 19.15.2.2.2 Dominant Contributors to Containment 19.15-33 Failure 19.15.2.2.3 Fission Product Release 19.15-34 Characteristics 19.15.2.2.4 Insights from Level II 19.15-35 Sensitivity Analyses O Amendment P xliv June 15, 1993
CESSAR EEnncue,. \
~
)
TABLE OF CONTENTS (Cont'd) CHAPTER 19 Section Subiect Pace No. 19.15.2.3 Release Consecuences 19.15-36 Assessment - Level III PRA 19.15.2.3.1 Dominant Contributors to Risk 19.15-37 19.15.2.3.2 Insights from Level III Sensitivity 19.15-41 Analyses 19.15.3 EXTERNAL EVENTS RISK PROFILE INSIGHTS 19.15-43 19.15.3.1 Insichts from the Tornado Strike 19.15-43 Analysis 19.15.3.2 Insichts from the Fire Risk 19.15-44 Assessment 19.15.3.3 Insichts from Internal Flood 19.15-45 Analysis /O () 19.15.4 SHUTDOWN AND LOW-POWER OPERATION RISK INSIGHTS 19.15-49 19.15.4.1 Results 19.15-49 19.15.4.2 Insichts 19.15-50 19.15.5 USE OF PRA IN THE DESIGN PROCESS 19.15-55 19.15.6 USE OF PRA TO SUPPORT CERTIFICATION 19.15-59 ACTIVITIES 19.16 REFERENCES 19.16-1 (G") Amendment P xlv June 15, 1993
CESSAR USWicaritu LIST OF TABLES CHAPTER 19 Table Subiect 19.3.2-1 General PWR Transient Categories 19.3.2-2 Zion Unit 1 and 2 Initiating Event Categories 19.3.2-3 Potential Initiating Events From Oconee PRA 19.3.2-4 Initiating Events From Calvert Cliffs IREP Study 19.3.2-5 Recommended ALWR Initiating Events and Frequencies 19.3.2-6 Events Analyzed in CESSAR-F 19.3.2-7 Initial List of Initiating Events for Analysis 19.3.2-8 Final List of Initiating Events 19.3.3-1 HEP Quantification for Inadvertent SDS Opening 19.3.3-2 Initiating Event Occurrence Frequencies 19.4.14-1 Potential Paths For Interfacing System LOCAs 19.5-1 Generic Component Failure Rates 19.5-2 Independent Component Hardware Failure Probabilities 19.5-3 Common Cause Failure Probabilities 19.5-4 Test and Maintenance Unavailability Basic Events 19.5-5 Operator Actions 19.5-6 Special Events Probabilities 19.5-7 Recovery Actions 19.5-8 PWR Scrans O Amendment N xlvi April 1, 1993
CESSAR EE"lCATION f~ ! )
\ /
LIST OF TABLES (Cont'd) CHAPTER 19 Table subiect 19.5-9 System 80+ Fault Tree / Event Tree Flags 19.5-10 System 80+ Event Tree Flag Settings 19.6.1-1 System 80+ System Dependency and Commonality Matrix 19.6.3.1-1 Power Assignments for System bo* Equipment 19.6.3.1-2 EDS Fault Tree Models 19.6.3.3-1 Component Cooling Water System Fault Trees 19.6.3.6-1 Safety Injection System Unavailabilities 19.6.3.6-2 Dominant Cutsets for Failure of the SITS to Inject for Large LOCA O (' ~ ~ 19.6.3.6-3 Dominant Cutsets for Failure of SITS to Inject for Aggressive Secondary Cooldown 19.6.3.6-4 Dominant Cutsets for Failure of the SIS to Inject Flow for Large LOCA 19.6.3.6-5 Dominant Cutsets for Failure of the SIS to Inject Flow for Small LOCA 19.6.3.6-6 Dominant Cutsets for Failure of the SIS for Feed Operation 19.6.3.7-1 Dominant Cutsets for Failure to Deliver EFW to Either Steam Generator 19.6.3.7-2 Dominant Cutsets for Failure to Deliver EFW to the Intact Steam Generator 19.6.3.8-1 Dominant Cutsets for Failure to Deliver Startup Feedwater to Either Steam Generator 19.6.3.8-2 Dominant Cutsets for Failure to Deliver Startup Feedwater to the Intact Steam Generator 19.6.3.9-1 Dominant Cutsets for Failure of SCS Injection Amendment N xlvii April 1, 1993
CESSAR E!L"icmu LIST OF TABLES (Cont'd) CHAPTER 19 Table subiect 19.6.3.10-1 Dominant Cutsets for Failure of SDS (Bleed) System 19.6.3.13-1 Dominant Cutsets for Failure of Containment i Spray System 19.6.3.14-1 Dominant Cutsets for Failure to Borate RCS l via Charging Pumps 19.6.3.14-2 Dominant Cutsets for Failure to Replenish IRWST via CVCS 19.6.3.15-1 Dominant Cutsets for Failure of Emergency Containment Spray Backup System 19.6.3.16-1 Dominant Cutsets for Failure of Cavity ' Flooding System 19.6.3.17-1 Dominant Cutsets for Failure of Annulus Ventilation System l 19.6.4.1-1 Dominant Cutsets for Failure of Shutdown Cooling System for Long-Term Decay Heat Removal } 19.6.4.2-1 Dominant Cutsets for Failure to Successfully Cool the IRWST 19.6.4.4-1 Dominant Cutsets for Failure of RCS Pressure Control 19.6.4.5-1 Dominant Cutsets for Failure to Isolate the Ruptured Steam Generator l 19.7.1-1 Initial List of External Events For Evaluation 19.7.1-2 External Events Groupings 19.7.1-3 Final List of External Events 19.7.2-1 Equipment and Structures Vulnerable to Tornado Strike O Amendment N xlviii April 1, 1993
CESSAREninema 1 1
.m
! \ ' '%.,) l LIST OF TABLES (Cont'd) l l CHAPTER 19 Table Bubiect 19.7.2-2 Tornado Recurrence Frequency by Region and F-Scale Intensity 19.7.2-3 Tornado Path Length and Width 19.7.2-4 Tornado Occurrence Frequencies 19.7.3.1-1 Fire Area List 19.7.3.1-2 System List 19.7.3.1-3 Equipment by Fire Area 19.7.3.1-4 Adjacent Fire Areas 19.7.3.1-5 Effect of Fire in Area on Safe S..utdown Capability / \ \ ) 19.7.3.1-6 Drawings Referenced in the Fire Analysis 19.7.3.2-1 Fire Ignition Sources and Frequencies by Applicable Fire Areas 19.8.1-1 Frequency of Core Damage from Shutdown Events 19.8.1-2 Table of Leading CDF Sequences, Internal Events During Shutdown 19.8.1-3 Comparison of Shutdown PRAs 19.8.2-1 Plant States and Initiating Events 19.8.2-2 Termination Points for Shutdown Modes 19.8.3-1 Mapping of BNL Pos Onto ABB-CE Pos 19.8.3-2 Initiating Event Frequency for Plant States 19.8.3-3 Example of Distribution of Outage Time Among Modes 19.8.3-4 Distribution of LOCAs and Containment Boundary / O Amendment N xlix April 1, 1993
CESSAREnGncma LIST OF TABLES (Cont'd) CHAPTER 19 , Table subject 19.8.4.3-1 Description of Possible Cause for the Loss of Decay Heat Removal 19.8.4.3-2 Fire Occurrence Frequencies by Mode and Location 19.8.4.3-3 Fire-Related Core Damage Frequencies 19.8.4.5-1 CDF from Station Blackout During Shutdown Operation 19.8.4.5-2 Cumulative Non-Recovery Probabilities for Offsite Power 19.8.5-1 Table of Event Tree Branch Points 19.8.5.6-1 Cutset Report for Event SCS-F 19.8.5.6-2 Cutset Report for Event SCS-F2 19.8.5.7-1 Cutset Report for Event 0S1 19.8.5.8-1 Cutset Report for Event OSI-PR 19.8.5.9-1 Cutset Report for Event CSS-DHR 19.8.5.10-1 Cutset Report for Event SDS-B 19.8.5.12-1 Cutset Report for Event SIS-F 19.8.5.13-1 Cutset Report for Event BOC l 19.8.6.1-1 Internal Event Branch Point Fussel-Vesely Importance Measures ; 19.8.6.2-1 Percent of CDF in Each Mode 19.8.7-1 Fractional Core Radioactivity Following l Shutdown 19.8.7-2 Fractional Decay of Select Radioactive Nuclide Groups Following Shutdown O' Amendment N 1 April 1, 1993
CESSARMinem / \ (
/
LIST OF TABLES (Cont'd) CHAPTER 19 Table Bubiect 19.9.1-1 Core Damage Frequency Contribution by Initiating Event 19.9.1-2 Core Damage ". 7uency Contribution for Dominant Accidet.c Sequences by Initiating Internal Event 19.9.1-3 Core Damage Frequency Contribution for Dominant Accident Sequences by Initiating External Event 19.9.1-4 Comparison of Core Damage Frequency Contributions by Initiating Event 19.9.2.1-1 Core Damage Frequency Contributions for Large Loss of Coolant Accident Core Damage Sequences [h, ! ') 19.9.2.1-2 Dominant Cutsets for Large LOCA Sequence Number 2 19.9.2.1-3 Dominant Cutsets for Large LOCA Sequence Number 3 19.9.2.1-4 Dominant Cutsets for Large LOCA Sequence Number 4 19.9.2.2-1A Core Damage Frequency Contributions for Medium Loss of Coolant Accident 1 Core Damage Sequences 19.9.2.2-1B Core Damage Frequency Contributions for Medium Loss of Coolant Accident 2 Core Damage Sequences 19.9.2.2-2 Dominant Cutsets for Medium LOCA 1 Sequence Number 2 19.9.2.2-3 Dominant Cutsets for Medium LOCA 1 Sequence Number 3 19.9.2.2-4 Dominant Cutsets for Medium LOCA 2 Sequence Number 2 (3 \v) Amendment N li April 1, 1993
CESSAR5!% m, l LIST OF TABLES (Cont'd) CHAPTER 19 j l I Table Subiect i I 19.9.2.2-5 Dominant Cutsets for Medium LOCA 2 Sequence Number 3 19.9.2.3-1 Core Damage Frequency Contributions for Small Loss of Coolant Accident Core Damage Sequences : 19.9.2.3-2 Dominant Cutsets for Small LOCA Sequence Number 3 19.9.2.3-3 Dominant Cutsets for Small LOCA Sequence Number 4 f 19.9.2.3-4 Dominant Cutsets for Small LOCA Sequence Number 7 19.9.2.3-5 Dominant Cutsets for Small LOCA Sequence Number 9 19.9.2.3-6 Dominant Cutsets for Small LOCA Sequence Number 10 19.9.2.3-7 Dominant Cutsets for Small LOCA Sequence Number 11 19.9.2.4-1 Core Damage Frequency Contributions for Steam Generator Tube Rupture Core Damage Sequences l 19.9.2.4-2 Dominant Cutsets for SGTR Sequence Number 3 l 19.9.2.4-3 Dominant Cutsets for SGTR Sequence Number 4 19.9.2.4-4 Dominant Cutsets for SGTR Sequence Number 6 19.9.2.4-5 Dominant Cutsets for SGTR Sequence Number 8 19.9.2.4-6 Dominant Cutsets for SGTR Sequence Number 9 19.9.2.4-7 Dominant Cutsets for SGTR Sequence Number 11 19.9.2.4-8 Dominant Cutsets for SGTR Sequence Number 12 19.9.2.4-9 Dominant Cutsets for SGTR Sequence Number 15 O Amendment N lii April 1, 1993
CESSAR aninema i 7-~ .
\ '~' Y LIST OF TABLES (Cont'd)
CHAPTER 19 Table Subiect 19.9.2.4-10 Dominant Cutsets for SGTR Sequence Number 16 19.9.2.4-11 Dominant Cutsets for SGTR Sequence Number 17 19.9.2.5-1 Core Damage Frequency Contributions for Large Secondary Side Break Core Damage Sequences 19.9.2.5-2 Dominant Cutsets for Large Secondary Side Break Sequence Number 3 19.9.2.5-3 Dominant Cutsets for Large Secondary Side Break Sequence Number 4 19.9.2.5-4 Dominant Cutsets for Large Secondary Side Break Sequence Number 5 19.9.2.5-5 Dominant Cutsets for Large Secondary Side (N, Break Sequence Number-7 \' '/ 19.9.2.5-6 Dominant Cutsets for Large Secondary Side Break Sequence Number 8 19.9.2.5-7 Dominant Cutsets for Large Secondary Side Break Sequence Number 9 19.9.2.6-1 Core Damage Frequency Contributions for Loss of Feedwater Flow Core Damage Sequences 19.9.2.6-2 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 3 19.9.2.6-3 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 4 19.9.2.6-4 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 5 19.9.2.6-5 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 7 19.9.2.6-6 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 8 l
-s
\
/ \ \~ ,
l l Amendment N liii April 1, 1993 i
CESSARM % . LIST OF TALLES (Cont'd) CHAPTER 19 Table Subiect 19.9.2.6-7 Dominant Cutsets for Loss of Feedwater Flow Sequence Number 9 19.9.2.7-1 Core Damage Frequency Contributions for Other Transients Core Damage Sequences 19.9.2.7-2 Dominant Cutsets for Other Transients Sequence Number 3 19.9.2.7-3 Dominant Cutsets for Other Transients Sequence Number 4 19.9.2.7-4 Dominant Cutsers for Other Transients Sequence Number 5 19.9.2.7-5 Dominant Cutsets for Other Transients Sequence Number 7 19.9.2.7-6 Dominant Cutsets for Other Transients Sequence Number 8 19.9.2.7-7 Dominant Cutsets for Other Transients Sequence Number 9 19.9.2.8-1 Core Damage Frequency Contributions for Loss of Offsite Power Core Damage Sequences 19.9.2.8-2 Dominant Cutsets for Loss of Offsite Power Sequence Number 3 19.9.2.8-3 Dominant Cutsets for Loss of Offsite Power Sequence Number 4 19.9.2.8-4 Dominant Cutsets for Loss of Offsite Power Sequence Number 5 19.9.2.8-5 Dominant Cutsets for Loss of Offsite Power Sequence Number 7 19.9.2.8-6 Dominant Cutsets for Loss of Offsite Power Sequence Number 8 19.9.2.8-7 Dominant Cutsets for Loss of Offsite Power Sequence Number 9 Amendment N liv April 1, 1993
CESSAR EE"lCATl;N ,~. N h
~
LIST.OF TABLES (Cont'd) CHAPTER 19 Table Subiect 19.9.2.8-8 Dominant Cutsets for Loss of Offsite Power Sequence Number 11 19.9.2.8-9 Dominant Cutsets for Loss of Offsite Power Sequence Number 12 19.9.2.8-10 Dominant Cutsets for SBO with Battery Depletion 19.9.2.9-1 Core Damage Frequency Contributions for Loss of Component Cooling Water Div 2(B) Core Damage Sequences 19.9.2.9-2 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 3 19.9.2.9-3 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 4
~'
19.9.2.9-4 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 5 19.9.2.9-5 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 7 19.9.2.9-6 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 8 19.9.2.9-7 Dominant Cutsets for Loss of Component Cooling Water Div 2 Sequence Number 9 19.9.2.10-1 Core Damage Frequency Contributions for Loss of 125 VDC Vital Bus B (125VB) Core Damage Sequences 19.9.2.10-2 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 3 19.9.2.10-3 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 4 19.9.2.10-4 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 5 (O V) Amendment N lv April 1, 1993
CESSAREnnnc-LIST OF TABLES (Cont'd) CHAPTER 19 Table Subiect 19.9.2.10-5 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 7 19.9.2.10-6 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 8 19.9.2.10-7 Dominant Cutsets for Loss of 125 VDC Vital Bus B Sequence Number 9 19.9.2.11-1 Core Damage Frequency Contributions for Loss , of 4.16 KV Bus B (416KB) Core Damage Sequences 19.9.2.11-2 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 3 19.9.2.11-3 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 4 19.9.2.11-4 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 5 19.9.2.11-5 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 7 19.9.2.11-6 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 8 19.9.2.11-7 Dominant Cutsets for Loss of 4.16 KV Bus B Sequence Number 9 19.9.2.12-1 Core Damage Frequency Contributions for Loss of HVAC Core Damage Sequences 15.9.2.12-2 Dominant Cutsets for LHVAC Sequence Number 3 19.9.2.12-3 Dominant Cutsets for LHVAC Sequence Number 4 19.9.2.12-4 Dominant Cutsets for LHVAC Sequence Number 5 19.9.2.12-5 Dominant Cutsets for LHVAC Sequence Number 7 19.9.2.12-6 Dominant Cutsets for LHVAC Sequence Number 8 O Amendment N lvi April 1, 1993
CESSAR nii"lCATl!N + n } LIST OF TABLES (Cont'd) CHAPTER 19 Table Subiect 19.9.2.12-7 Dominant Cutsets for LHVAC Sequence Number 19.9.2.13-1 Core Damage Frequency Contributions for Anticipated Transient Without Scram Core Damage Sequences 19.9.2.13-2 Dominant Cutsets for ATWS Sequence Number 4 19.9.2.13-3 Dominant Cutsets for ATWS Sequence Number 5 19.9.2.13-4 Dominant Cutsets for ATWS Sequence Number 7 19.9.2.13-5 Dominant Cutsets for ATWS Sequence Number 8 19.9.2.13-6 Dominant Cutsets for ATWS Sequence Number 9 19.9.2.13-7 Dominant Cutsets for ATWS Sequence Number 10 A () 19.9.2.13-8 Dominant Cutsets for ATWS Sequence Number 14 19.9.2.13-9 Dominant Cutsets for ATWS Sequence Number 16 19.9.2.13-10 Dominant Cutsets for ATWS Sequence Number 20 19.9.2.13-11 Dominant Cutsets for ATWS Sequence Number 23 19.9.2.13-12 Dominant Cutsets for ATWS Sequence Number 26 19.9.2.13-13 Dominant Cutsets for ATWS Sequence Number 27 19.9.2.13-14 Dominant Cutsets for ATWS Sequence Number 28 19.9.2.13-15 Dominant Cutsets for ATWS Sequence Number 30 l 19.9.3.1-1 Core Damage Frequency Contributions for Tornado Strike Event Core Damage Sequences 19.9.3.1-2 Dominant Cutsets for Tornado Strike Event Sequence Number 3 19.9.3.1-3 Dominant Cutsets for Tornado Strike Event Sequence Number 4 m (\_ ,/) l l Amendment P l lvii June 15, 1993 )
CESSAR "Ec.TIFICATl3N C LIST OF TABLES (Cont'd) CHAPTER 19 Table Bubiect 19.9.3.1-4 Dominant Cutsets for Tornado Strike Event Sequence Number 5 19.9.3.1-5 Dominant Cutsets for Tornado Strike Event Sequence Number 8 19.9.3.1-6 Dominant Cutsets for Tornado Strike Event Sequence Number 9 19.9.3.1-7 Dominant Cutsets for Tornado Strike Event Sequence Number 11 19.9.3.1-8 Dominant Cutsets for Tornado Strike Event Sequence Number 12 19.9.3.1-9 Dominant Cutsets for Tornado Induced Station Blackout with Battery Depletion Sequence 19.9.4-1 Systep Importance for System 80+ PRA for Internal Events 19.9.4-2 Component Importances for System 80+ PRA for Internal Events 19.10-1 Summary of System 80+ PRA Sensitivity Analysis Results 19.10-2 Dominant Cutsets for Sensitivity Case 1 - Operator Error Rate - General 19.10-3 Dominant Cutsets for Sensitivity Case 2 - Operator Error Rate - Control Room Response 19.10-4 Dominant Cutsets for Sensitivity Case 3 - Motor Operated Valve Failure Rate 19.10-5 . Dominant Cutsets for Sensitivity Case 4 - Aggressive Secondary Cooldown Not Feasible 19.10-6 Events With Loss of Cooling to RCP Pumps O Amendment N lviii April 1, 1993
CESSAR EL"icari:n l \
- / l
'~'
LIST OF TABLES (Cont'd) CHAPTER 19 j l Table Subiect 19.11.3.1-1 Axisymmetric Ultimate Stress Pressure Valves 19.11.4.1.1-1 Melt Composition at VB Following a Station Blackout Based on Reference 4.61 19.11.4.1.1-2 Comparison of Various Exothermic Reactions Associated with DCH Processes 19.11.4.1.1-3a Summary of Low Temperature Dispersal Simulant Experiments 19.11.4.1.1-3b Summary of DCH/HPME Experiments 19.11.4.1.1-4 Initial Conditions for "Two Cell" DCH Pressure Calculation 19.11.4.1.1-5 Predicted HPME Pressures (PSIA) Using "2 O Cell" DCH Model
\- Conditional Containment Failure Probability 19.11.4.1.1-6 Associated with DCH 19.11.4.1.2-1 Summary of Subjective Containment Conditional Failure Probability Due to "In-Vessel" Steam Explosion 19.11.4.1.2-2 TNT Equivalent Loadings for Various Mass Discharges into a Subcooled Liquid Pool (Efficiency = 3%, Initial Superheat = 5040'R 19.11.4.1.2-3A Probability Distribution for the Corium Mass Involved in EVSE 19.11.4.1.2-3B Cavity Failure Probability for Various Combinations of Parameters Mass and EFF 19.11.4.1.2-4 Steam Induced Containment Pressure Spike for System 80+ Following Vessel Lower Head Breach 19.11.4.1.3-1 Summary of Experimental Data on Zircaloy Oxidation and Hydrogen Generation 19.11.4.1.3-2 System 80+ Bounding "In Vessel" Hydrogen
(% Production Estimates N_.Y Amendment P lix June 15, 1993
CESSAR M%nCATISN LIST OF TABLES (Cont'd) CHAPTER 19 Table subiect 19.11.4.1.3-3 Summary of PRA Assumptions for System 80+ Early Burn Event 19.11.4.1.3-4 Classification of Mixture Detonability (From Reference 28) 19.11.4.1.3-5 Classification of Geometric Features Conducive to DDT (From Reference 28) 19.11.4.1.3-6 Dependence of Sherman/Berman Result Class on Mixture and Geometry Class 19.11.4.1.4-1 Rocket Induced Failure Probability for High and Intermediate Pressure Sequences 19.11.4.2.1-2 Comparison of Properties of Common Concretes 19.11.4.2.1-3 Comparison of Concrete Constituents 19.11.4 2.1-4 Gas Evolution During the Thermal Degradation of Concrete.2 t 19.11.4.2.2-1 Summary of Debris Coolability Investigations 19.11.4.2.2-2 Effect of Degraded Heat Transfer on Corium Debris Coolability 19.11.4.2.2-3 Summary of ANL CORCON-MOD 3 Erosion Studies 19.11.4.2.2-4 Surface Heat Flux From Corium Debris Required to Concrete Erosion at Various Times After Reactor Scram 19.11.4.2.4-1 Summary of Late Hydrogen Burn Conditions 19.11.4.3.2-1 XSOR Radionuclide Grouping for NUREG-1150 Reference PWRs 19.11.4.3.2-2 Mean and Median Values for Fission Product Releases from the Core into RCS (FCOR) (Taken from Reference 76) O Amendment P lx June 15, 1993
CESSAR EnWicari:n I k ) LIST OF TABLES (Cont'd) CHAPTER 19 Table subiect 19.11.4.3.2-3 Mean and Median Values for Fission Product Transmission within RCS (FVES) (Taken from Reference 76) 19.11.4.3.2-4 Mean and Median Values of Fraction of Fission Products Species Product Present in the Melt Participating in HPME that is Released to Containment in a Direct Containment Heating Event (FDCH) (Taken from Reference 76) 19.11.4.3.2-5 Mean and Median Values for the Fractions of Radionuclide Group I Released During Core-Concrete Interaction (FCCI) for PWRs (Taken from Reference 76) 19.11.4.3.2-6 Mean and Median Values for the Fraction of Radionuclide Group I Retained in RCS Released g} into Containment After Vessel Failure (FREV)
-' 19.11.5.4.1.1-1 Summary of MAAP Predicted Key Event Timings for System 80+
19.11.5.4.1.1-2 Summary of Key Parameters 19.11.5.4.1.1-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.1.2-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.1.2-2 Summary of Key Parameters 19.11.5.4.1.2-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.1.3-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.1.3-2 Summary of Key Parameters 19.11.5.4.1.3-3 Summary of Fission Product Group (FPG) Concentrations bh / \
%j Amendment P lxi June 15, 1993
CESSAR H"lCAT12N LIST OF TABLES (Cont'd) C11 APTER 19 Table subiect 19.11.5.4.2.1-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.2.1-2 Summary of Key Parameters 19.11.5.4.2.1-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.2.2-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.2.2-2 Summary of Key Parameters 19.11.5.4.2.2-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.3.1-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.3.1-2 Summary of Key Parameters 19.11.5.4.3.1-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.3.2-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.3.2-2 Summary of Key Parameters 19.11.5.4.3.2-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.4.1-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.4.1-2 Summary of Key Parameters 19.11.5.4.4.1-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.4.2-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.4.2-2 Summary of Key Parameters Amendment P lxii June 15, 1993
CESSAR ML"lCATION ( f LIST OF TABLES (Cont'd) CHAPTER 19 Table Bubiect 19.11.5.4.4.2-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.5.1-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.5.1-2 Summary of Key Parameters 19.11.5.4.5.1-3 Summary of Fission Product Group (FPG) Concentrations 19.11.5.4.6-1 Summary of MAAP Predicted Key Event Timings for System 80+ 19.11.5.4.6-2 Summary of Key Parameters 19.11.5.4.6-3 Summary of Fission Product Group (FPG) Concentrations 19.12.1-1 Plant Damage State Parameters 19.12.1-2 Plant Damage State Parameter Combination Deletion Rules 19.12.1-3 Plant Damage States 19.12.1-4 Containment Safeguards States 19.12.1-5 Core Damage Sequence Linking with Containment Safeguards States 19.12.1-6 Plant Accident Sequences 19.12.1-7 Plant Accident Sequence to Plant Damage State Mapping 19.12.2.2.3-1 Probability of Containment Bypass Failure 19.12.2.2.4-1 Containment Penetration Summary 19.12.2.2.4-2 Containment Isolation Failure Rates from Other PRAs
/N 19.12.2.2.6-1 Basic Events for Alpha Mode Failure Model Amendment P lxiii June 15, 1993
h)(ggCESl?N CE6TIFICAT12N LIST OF TABLES (Cont'd) CHAPTER 19 Table Subiect 19.12.2.2.6-2 Basic Events for DCH Model 19.12.2.2.6-3 Basic Events for Early Hydrogen Burn Model 19.12.2.2.6-4 Basic Events for Rapid Steam Generation Model 19.12.2.2.7-1 Basic Events for Late Containment overpressure Failure Model 19.12.2.2.7-2 Basic Events for Containment Vessel Melt-Through Failure 19.12.2.2.10-1 Basic Events for the Revaporization Release Model 19.12.2.3-1 CET and Supporting Logic Model Basic Event List 19.12.2.3-2 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-3 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-4 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-5 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-6 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-7 CET and SLM Basic Event Values by Plant Damage State 19.12.2.3-8 Definition of Major Intermediate Gates 19.12.2.3-9 CET Endpoint Probabilities by PDS Early Core Damage Time Sequences 19.12.2.3-10 CET Endpoint Probabilities by PDS Early Core Damage Time Sequences O Amendment P lxiv June 15, 1993
LIST OF TABLES (Cont'd) CHAPTER 19 l Table Subiect 19.12.2.3-11 CET Endpoint Probabilities by PDS Early Core Damage Time Sequences 19.12.2.3-12 CET Endpoint Probabilities by PDS Early Core Damage Time Sequences 19.12.2.3-13 SLM Intermediate Conditional Probabilities by PDS Early Core Damage Time Sequences 19.12.2.3-14 SLM Intermediate Conditional Probabilities by PDS Early Core Damage Time Sequences 19.12.2.3-15 SLM Intermediate Conditional Probabilities by PDS Early Core Damage Time Sequences
~
s 19.12.2.3-16 SLM Intermediate Conditional Probabilities by-PDS Early Core Damage Time Sequences b ( / 19.12.2.3-17 CET Endpoint Probabilities by PDS Mid Core Damage Time Sequences 19.12.2.3-18 SLM Intermediate Item Conditional Probabilities by PDS Mid Core Damage Time Sequences , 19.12.2.3-19 CET End Point Probabilities for PDS194 Late Core Damage Time Sequence 19.12.2.3-20 SLM Intermediate Gate Conditional Probabilities for PDS194 Late Core Damage Time Sequence 19.12.3-1 Release Parameter Data for System 80+ Release Class ) 19.12.3-2 Release Fractions by Release Class 19.12.3-3 S80SOR Input String Value Definition 19.13-1 Whole-Body Dose at 300 Meters for the System j 80+ Release Classes j l 19.13-2 Whole-Body Dose at 0.5 Miles for the system 80+ Release Classes ( Amendment P lxv June 15, 1993
CESSAR !!Mi"lCATION LIST OF TABLES (Cont'd) CHAPTER 19 Table Bubiect 19.13-3 Whole-Body Doses with Specified Probabilities of Exceedance at Selected Distances 19.14.1-1 Summary of Containment Response Sensitivity Analysis Results for System 80+ 19.14.2-1 Summary of Sensitivity Results of Risk-Consequences for System 80+ 19.15.1-1 Major System 80+ Preventive and Mitigative Design Features 19.15.2-1 Comparison of Core Damage Frequency Contributions by Initiating Event 19.15.2-2 Core Damage Frequency Contributions for Dominant Accident Sequences by Initiating
-Internal Event 19.15.2-3 Major Contributors to the Uncertainty of CDF (Internal Events) for System 80+
19.15.2-4 Summary of System 80+ PRA Sensitivity Analysis Results 19.15.2-5 System Importance for System 80+ PRA for Internal Events 19.15.2-6 Component Importances for System 80+ PRA for Internal Events 19.15.2-7 Overall Containment Failure Modes 19.15.2-8 Containment Failure M'.ics for Early Core Damage Sequences 19.15.2-9 Containment Failure Modes for Mid Core Damage Sequences 19.15.2-10 Release Parameter Data for System 80+ Release Classes ; l 19.15.2-11 Release Fractions by Release Class l 1 l Amendment P lxvi June 15, 1993
CESSAR s!L*ICAT12N I
,m I 1
- t. / i LIST OF TABLES (Cont'd)
CKAPTER 19 Table Subiect 19.15.2-12 Summary of Containment Response Sensitivity Analysis Results for System 80+ 19.15.2-13 Summary of Sensitivity Results of Risk Consequences for System 80+ 19.15.3-1 Core Damage Frequency Contributions for Dominant Accident Sequences by Initiating External Event 19.15.3-2 Fire Ignition Sources and Frequencies by Applicable Fire Areas 19.15.4-1 Frequency of Core Damage for Shutdown Events 19.15.4-2 Core Damage Frequency Contribution by Initiating Event 19.15.4-3 Core Damage Frequency Contributions for (G'-) Dominant Accident Sequences by Initiating Internal Event During Shutdown & Low-Power Operation 19.15.4-4 Comparison of Shutdown PRAs 19.15.5-1 Summary of the Risk Reductions of the Design Alternatives O) (G Amendment P lxvii June 15, 1993
CESSAR Bin?lCAT12N LIST OF FIGURES CHAPTER 19 Fiqure Bubiect 19.2.0-1 Major PRA Tasks 19.3.1-1 Master Logic Diagram 19.3.3-1 Human Reliability Analysis for Erroneous Initiation of Feed and Bleed Cooling 19.3.3-2 Human Reliability Tree for the Diagnosis Phase 19.3.3-3 Fault Tree for ATWS Occurrence Frequency Quantification 19.4.1-1 Large LOCA Event Tree 19.4.1-2 Failure of Containment Heat Removal for Large LOCA 19.4.2-1 Medium LOCA1 Event Tree 19.4.2-2 Medium LOCA2 Event Tree 19.4.2-3 RCS Level Vs. Time for 0.5FT2 LOCA, 1 HPSI Pump, No SIT, No Secondary Side Heat Removal 19.4.2-4 RCS Pressure Vs. Time for 0.5FT2 LOCA, 1 HPSI Pump, No SIT, No Secondary Side Heat Removal 19.4.3-1 Small LOCA Event Tree 19.4.3-2 RCS Pressure Vs. Time for Aggressive Secondary Cooldown 19.4.3-3 RCS Level Vs. Time for Aggressive Secondary Cooldown 19.4.3-4 RCS Temperature Vs. Time for Aggressive Secondary Cooldown 19.4.3-5 Top Logic for Aggressive Secondary Cooldown 19.4.3-6 Top Logic for Failure of Containment Heat Removal for Small LOCAs and Transients O , Amendment N lxviii April 1, 1993
CESSARimincm g] \
'/ LIST OF FIGURES (Cont'd)
CHAPTER 19 Ficure Bubiect 19.4.4-1 Steam Generator Tube Rupture Event Tree 19.4.4-2 Top Logic for Failure to Perform Aggressive Secondary Cooldown Following an SGTR 19.4.4-3 Top Logic for Failure to Replenish IRWST Inventory Following an SGTR 19.4.5-1 Large Secondary Side Break Event Tree 19.4.6-1 Loss Of Main Feedwater Event Tree 19.4.7-1 Other Transients Event Tree 19.4.8-1 Loss of Offsite Power Event Tree 19.4.8-2 Station Blackout / Battery Depletion Fault Tree ( 19.4.9-1 Loss of Component Cooling Water Event Tree 19.4.10-1 Loss of A 125 VDC Vital Bus Event Tree 19.4.11-1 Loss of A 4.16 KV Vital Bus Event Tree 19.4.12-1 Loss of One Division of HVAC Event Tree 19.4.13-1 Peak RCS Pressure Vs MTC 19.4.13-2 ATWS Event Tree 19.4.14-1 SCS Suction Line Valve Arrangement 19.4.14-2 SCS Return Line Valve Arrangement 19.5-1 RCS Pressure Vs Time for LOOP 19.5-2 MTC Vs Time in Cycle 19.6.3.1-la Main Non-Safety Power System - One Line Diagram x- > Amendment P lxix June 15, 1993
CESSAR8HWice LIST OF FIGURES (Cont'd) CHAPTER 14 Fiqure Subiect 19.6.3.1-1b Main Safety Related Power System - One Line Diagram ' 19.6.3.1-2 Class 1E DC and AC Instrument and Control Power System - One Line Diagram 19.6.3.1-3 Non-Class 1E DC and AC Instrument Power - One Line Diagram 19.6.3.1-4 Fault Tree for Loss of Power to Components on 4.16KV PNS Bus 19.6.3.1-5 Fault Tree for Loss of Power to Component on 4.16 KV ESF Bus 19.6.3.1-6 Fault Tree for Loss of Power to Components on 480 V LC 19.6.3.1-7 Fault Tree for Loss of Power to Components on 480 V MCC 19.6.3.1-8 Fault Tree for Loss of Power to Components on 125 VDC Bus 19.6.3.2-1 Fault Tree for Station Service Water System-Division I 19.6.3.2-2 Fault Tree for Station Service Water System-Division II 19.6.3.3-1 A Simplified Schematic of Component Cooling Water System Division I 19.6.3.3-2 A Simplified Schematic of Component Cooling Water System Division II 19.6.3.3-3 Simplified Schematic of RCP Cooling Loads for CCWS - Division I 19.6.3.3-4 Simplified Schematic of RCP Cooling Loads for CCWS - Division I 19.6.3.3-5 Simplified Schematic of RCP Cooling Loads for CCWS - Division II Amendment N i lxx April 1, 1993 l
CESSARE!5Unc-O) \ LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure subiect 19.6.3.3-6 Simplified Schematic of RCP Cooling Loads for CCWS - Division II 19.6.3.3-7 A Simplified Schematic of Station Service Water System 19.6.3.3-8 Fault Tree for Componcnt Cooling Water System Division 1 19.6.3.3-9 Fault Tree for Component Cooling Water System Division 2 19.6.3.4-1 Instrument Air System Schematic 19.6.3.4-2 Fault Tree for Loss of Instrument Air System 19.6.3.6-1 A Simplified Schematic of the Safety f} Injection System 19.6.3.6-2 A Simplified Schematic of the Safety Injection Tanks 19.6.3.6-3 Fault Tree for Failure of 3 of 4 SITS for Large LOCA 19.6.3.6-4 Fault Tree for Failure of SITS for Aggressive Secondary Cooldown 19.6.3.6-5 Fault Tree for Failure of the SIS for Large LOCA 19.6.3.6-6 Fault Tree for Failure of the SIS for Small LOCA 19.6.3.6-7 Fault Tree for Failure of the SIS for Feed Operation 19.6.3.7-1 A Simplified Schematic of the Emergency Feedwater System 19.6.3.7-2 Fault Tree Model for Emergency Feedwater System \ Amendment N lxxi April 1, 1993
CESSAR8Eacm LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure Bubiect 19.6.3.8-1 A Simplified Schematic of the Startup Feedwater System 19.6.3.8-2 Fault Tree for Failure of the Startup Feedwater System to Deliver Flow 19.6.3.9-1 A Simplified Schematic of SCS Injection 19.6.3.9-2 Fault Tree for Failure of SCS Injection 19.6.3.10-1 A Simplified Schematic of Safety Depressurization System 19.6.3.10-2 Fault Tree for Failure of Safety Depressurization System 19.6.3.11-1 A Schematic of the Plant Protection System 19.6.3.12-1 A Functional Schematic of the SIAS-19.6.3.12-2 A Functional Schematic of the CSAS and CIAS 19.6.3.12-3 A Functional Schematic of the MSIS 19.6.3.12-4 A Functional Schematic of the EFAS-1 and EFAS-2 19.6.3.12-5 A Functional Schematic of the ESF-Component Control System 19.6.3.12-6 Fault Tree for EFAS - Train A 19.6.3.12-7 Fault Tree for EFAS - Train B 19.6.3.12-8 Fault Tree for SIAS - Train A 19.6.3.12-9 Fault Tree for SIAS - Train B 19.6.3.12-10 Fault Tree for CSAS - Train A 19.6.3.12-11 Fault Tree for CSAS - Train B 19.6.3.13-1 A Schematic of the Containment Spray System O.l
. Amendment N lxxii April 1, 1993 ,
I
CESSAR EL"icua
,- \
I l t LIST OF FIGURES (Cont'd) CHAPTER 19 Ficure Rubiect 19.6.3.13-2 Fault Tree for Fnilure of Containment Spray System 19.6.3.14-1 Simplified Schematic for RCS Boration via Charging Pumps 19.6.3.14-2 Simplified Schematic for Replenishing IRWST via CVCS 19.6.3.14-3 Fault Tree for Failure to Borate RCS via the Charging Pump 19.6.3.14-4 Fault Tree for CVCS Unable to Replenish IRWST Inventory 19.6.3.15-1 Conceptual Design of Emergency Containment Spray Backup System !,' ') 19.6.3.15-2 Fault Tree for Failure of Emergency Containment Spray Backup System 19.6.3.16-1 Depth of Water in Cavity Versus Time 19.6.3.16-2 A Schematic of the Cavity Flooding System 19.6.3.16-3 Fault Tree for Failure of Cavity Flooding System 19.6.3.17-1 Simplified Schematic of the Annulus Ventilation System 19.6.3.17-2 Fault Tree for Failure of Annulus Ventilation System 19.6.4.1-1 A Simplified Schematic of SCS for Long-Term Cooling 19.6.4.1-2 Fault Tree for Failure of Shutdown Cooling System for Long-Term Decay Heat Removal 19.6.4.2-1 A Simplified Schematic of Cooling the IRWST - Path 1 r I
\_
Amendment N lxxiii April 1, 1993
CESSAR EnMnCATl!N LIST OF FIGURES (Cont'd) O CHAPTER 19 Fiqure Subject 19.6.4.2-2 A Simplified Schematic of Cooling the IRWST - Path 2 19.6.4.2-3 A Simplified Schematic of Cooling the IRWST - Path 3 19.6.4.2-4 A Simplified Schematic of Cooling the IRWST - Path 4 19.6.4.2-5 Fault Tree for Failure to Successfully Cool the IRWST 19.6.4.4-1 A Simplified Schematic of the Pressurizer Spray System for RCS Pressure Control 19.6.4.4-2 Fault Tree for Failure to Provide RCS Pressure Control 19.6.4.5-1 A Simplified Schematic of the Steam Generator Blowdown System For The Isolation of the Ruptured SG 19.6.4.5-2 Fault Tree for Failure to Isolate Ruptured l Steam Generator 19.6.4.6-1 A Simplified Schematic of the Atmospheric Dump Valves and Main Steam Safety Valves 19.6.4.6-2 A Simplified Schematic of the Turbine Bypass Valves 19.7.2-1 Tornado Regions for the United States 19.7.2-2 Tornado Strike Event Tree 19.7.2-3 Fault Tree for Tornado-Induced Station Blackout with Battery Depletion 19.8.2-1 Plant States and Termination Points for Restoration of DHR 19.8.4.1-1 Event Tree for Loss of DHR, Mode 4,5,6F O Amendment P lxxiv June 15, 1993
CESSAR 8!5Gemw {~~\ N. LIST OF FIGURES (Cont'd) CHAPTER 19 Figure Bubiect 19.8.4.1-2 Event Tree for Loss of DHR, Mode SR, Reduced Inventory 19.8.4.1-3 Event Tree for Loss of DHR, Mode 6E, IRWST Empty 19.8.4.1-4 Event Tree for Loss of DHR, Mode 6I, Upper Internals in Place 19.8.4.2-1 Event Tree for LOCA, Modes 4,5, 6F 19.8.4.2-2 Event Tree for LOCA, Mode SR, Reduced Inventory 19.8.4.2-3 Event Tree for LOCA, Mode 6E, 6I, LOCA Outside Containment fN 19.8.4.2-4 Event Tree for LOCA, Modes 6E, 6I LOCA in ( Containment 19.8.4.3-1 Event Tree for Fire, Mode 4,5, 6F 19.8.4.3-2 Event Tree for Fire, Mode SR, Reduced Inventory 19.8.4.3-3 Event Tree for Fire, Modes 6E, IRWST Empty 19.8.4.3-4 Event Tree for Fire, Modes 6I, Upper Internals in Place 19.8.5.3-1 OR - Operator _ Restores SCS Train 19.8.5.6-1 OR - Operator Initiates Feed With Standby SCS Train 19.8.5.6-2 Fault Tree for Failure to Makeup Inventory With (One) SCS Train ; l 19.8.5.6-3 Fault Tree for Failure of Shutdown Cooling l System for Feed (2 Trains) ; i 19.8.5.7-1 OS1, Operator Starts Standby SCS Train f-
N 19.8.5.7-2 Fault Tree for Failure of Decay Heat Removal I
() Via SCS Second Train Amendment N lxxv April 1, 1993
"'~"
CESSAR "CE TIFICATl!N LIST OF FIGURES (Cont'd) CHAPTER 19 Ficure Subiect 19.8.5.9-1 CSS-DHR - Operator Uses CSS Pump for Heat Removal 19.8.5.9-2 Fault Tree for Containment Spray Loop 1 Pump Flow Path Unavailable During DHR 19.0.5.8-1 OS1-PR - Operator Realigns SCS for Heat Removal 19.8.5.8-2 Fault Tree for Failure of DHR Via SCS Second Train Given SCS Feed Was successful 19.8.5.10-1 SDS-B - Operator Initiates Bleed Using SDS 19.8.5.10-2 Fault Tree for Failure of Safety Depressurization Bleed System 19.8.5.12-1 SIS-F - Operator Initiates Feed Using SIS 19.8.5.12-2 Fault Tree for Failure of Safety Injection for Feed (Two Trains) 19.8.5.13-1 BOC - Operator Initiates Boil-off Cooling Using CVCS 19.8.5.13-2 Fault Tree for Failure to Deliver Boron to RCS Via Charging Pump 19.8.5.15-1 REC-S, Operator DHR Recovery, Without Makeup 19.8.5.15-2 Fault Tree for Recovery, Without Makeup (2 Hour Period) 19.10-1 Fault Tree for Core Damage Due to RCP Seal LOCA on SBO 19.10-2 Fault Tree for Core Damage Due to RCP Seal LOCA Following Loss of CCW 19.11.3.1-1 System 80+ Containment Internal Structure Arrangement 19.11.3.1-2 Pressure Limit Based on ASME Service Level "C" Criteria Amendment P lxxvi June 15, 1993
CESSAR E!L"icui:n i \ \~'/ LIST OF FIGURES (Cont'd) CHAPTER 19 Figure Bubiect 19.11.3.1-3 Comparison of Fragility Curves for System 80+ (Containment Temperature = 290*F) 19.11.3.2-1 Elevation View of System 80+ Containment Shell and Shield Building 19.11.3.3-1 IRWST Spillway and Cavity Flooding System 19.11.3.3-2 Predicted CFS Performance 19.11.3.3-3 Predicted CFS Performance 19.11.3.5-1 RCS Depressurization with SDS Actuation at PSV Lift (Instantaneous Total Loss of Feedwater) 19.11.3.5-2 RCS Depressurization with SDS Actuation at
/~s PSV Lift + 1 Hour (Instantaneous Loss of Feedwater) 19.11.3.6-1 System 80+ Reactor Cavity with Core Debris Chamber 19.11.3.6-2 System 80+ Reactor Cavity Schematic 19.11.3.6-3 Fragility Curves for Concrete Cavity Walls 19.11.3.8-1 Conceptual Design of Emergency Containment Spray Backup System 19.11.3.9-1 Effect of Vent Opening on Containment Pressurization 19.11.4.1.1-1 Comparison of "Two Cell" DCH Model to Experimental Data 19.11.4.1-2 Bounding Estimates of ALWR Containment Responses to DCH 19.11.4.1.1-3 Expert Elicitation Quantification for Core Ejection Fraction (Draft B:4551, Vol. 2:
"In-Vessel Issues")
t N~-li l Amendment P lxxvii June 15, 1993 j
l (#! h h k k bb.b ICATl*A LIST OF FIGURES (Cont'd) CHAPTER 19 E1qure Subiect 19.11.4.1.1-4A Decomposition Tree for Quantification of DCHSTREN for PDSs (LEAK =CRV; CAVT= DRY; CHR={ANY}) 19.11.4.1.1-4B Decomposition Tree for Quantification of DCHSTREN for PDSs (LEAK ={NOT CRV}; CAVT= DRY; CHR=CSU) 19.11.4.1.1-4C Decomposition Tree for Quantification of DCHSTREN for PDSs (LEAK ={NOT CRV); CAVT= DRY; CHR=CSA) 19.11.4.1.2-1 Explosion Conversion Ratio and Debris Diameter as a Function of Coolant-to-Fuel Mass Ratio 19.11.4.1.2-2 EVSE Decomposition Event Tree 19.11.4.1.3-1 System 80+ Combustion Potential (Hydrogen Concentration Based on Oxidation of 100% of Active Fuel Cladding) 19.11.4.1.3-2 Comparison of Ignition Source Energies with Source Required for Detonation 19.11.4.1.4-1 Nodal Model of System 80+ Reactor Cavity 19.11.4.1.4-2 Supporting Logic Model for Rocket Induced Containment Failure 19.11.4.1.4-3 RV Loading Due to Instantaneous Decompression of a German-PWR 19.11.4.2.1-1 Time to Containment Failure for Various ! Severe Accident Challenges (CFS Actuated) I 19.11.4.2.2-1 Comparison of Dryout Heat Flux Data 19.11.4.2.2-2 Predicted Basemat Erosion Depths for System 80+ 19.11.4.2.2-3 CORON-MOD 3 Predicted Radial and Axial Erosion l Profiles for the System 80+ Basemat O l Amendment P lxxviii June 15, 1993
CESSAR EEn"icavitu \ l LIST OF ACRONYMS (Cont'd) CHAPTER 19 BCRONYM MEANING mph miles per hour MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSRS Main Steam Relief System MSSV Main Steam Safety Valve MTC Moderator Temperature Coefficient MTU Metric Ton Uranium MWD Megawatt Days NPRDS Nuclear Plant Reliability System NRC Nuclear Regulatory Commission NPSH Net Positive Suction Head NREP National Reliability Evaluation Program NSSS Nuclear Steam Supply System PAS Plant Accident Sequence PC Personal Computer PDS Plant Damage State pga peak ground acceleration
'~'N PPLC Pressurizer Pressure & Level Control PPM Parts Per Million '-' PPS Plant Protection System PPA Probabilistic Risk Assessment PSA Probabilistic Safety Analysis psia pounds per square inch absolute PSV Primary Safety Valve PTS Pressurized Thermal Shock PWR Pressurized Water Reactor RCGVS Reactor Coolant Gas Vent System RCP Reactor Coolant Pump RCS Reactor Coolant System rem Roentgen Equivalent Man RO Reactor Operator RPS Reactor Protection System RWST Refueling Water Storage Tank rx Reactor SBCS Steam Bypass Control System SCS Shutdown Cooling System SG Steam Generator SGTR Steam Generator Tube Rupture SI Safety Injection SIAS Safety Injection Actuation Signal SIS Safety Injection System SIT Safety Injection Tank SRO Senior Reactor Operator NI } SRP Standard Review Plan Amendment N lxxxix April 1, 1993
k hkh/klg CESl?N CERTIFICATl2N LIST OF FIGURES (Cont'd) CHAPTER 19 Ficure Subiect 19.11.5.4.2.1-6 Containment Temperature vs Time 19.11.5.4.2.2-1 Containment Pressure vs Time 19.11.5.4.2.2-2 Lower Compartment Gas Temperature vs Time 19.11.5.4.2.2-3 Cavity Concrete Erosion vs Time
+
19.11.5.4.3.1-1 RCS Pressure vs Time 19.11.5.4.3.1-2 RCS Two Phase Level vs Time 19.11.5.4.3.1-3 SG Broken Loop Water Level vs Time 19.11.5.4.3.1-4 SG Unbroken Loop Water Level vs Time 19.11.5.4.3.1-5 SG Broken Loop Pressure vs Time 19.11.5.4.3.1-6 SG Unbroken Loop Pressure vs Time 19.11.5.4.3.1-7 IRWST Water Level vs Time 19.11.5.4.3.2-1 IRWST Water Level vs Time 19.11.5.4.3.2-2 Containment Pressure vs Time 19.11.5.4.3.2-3 Containment Temperature vs Time 19.11.5.4.3.2-4 Cavity Concrete Erosion vs Time 19.11.5.4.4.1-1 Reactor Vessel Water Level 19.11.5.4.4.2-1 Containment Pressure 19.11.5.4.5.1-1 RCS Pressure vs Time 19.11.5.4.5.1-2 RCS Two Phase Level vs Time 19.11.5.4.5.1-3 SG Broken Loop Water Level vs Time 19.11.5.4.5.1-4 Containment Pressure vs Time 19.11.5.4.5.1-5 Containment Temperature vs Time O Amendment P lxxx June 15, 1993
CESSAR n5ncuim s f\ )\ LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure subiect 19.11.5.4.5.1-6 Cavity Concrete Erosion vs Time 19.11.5.4.6.1-1 RCS Pressure vs Time 19.11.5.4.6.1-2 RCS Two Phase Level vs Time 19.12.1-1 Containment Safeguards Event Tree 19.12.2.3-1 Listing of the CET Master Model File 19.12.2.3-2 . Bat File for Solving CETs for all PDSs CETSOLVE. BAT 19.12.2-1 Containment Event Tree for Early Core Melts 19.12.2-2 Isolation Failure Containment Event Tree for Early Core Melts (3 ( ) 19.12.2-3 Containment Event Tree for Mid Core Melts 19.12.2-4 Isolation Failure Containment Event Tree for Mid Core Melts 19.12.2-5 Containment Event Tree for Late Core Melts 19.12.2-6 Isolation Failure Containment Event Tree for Late Core Melts 19.12.2-7 Early Containment Failure Supporting Logic Model 19.12.2-8 Late Containment Failure Supporting Logic Model 19.12.2-9 In-Vessel Fission Product Supporting Logic Model 19.12.2-10 Vaporization Releases Supporting Logic Model 19.12.2-11 Revaporization Releases Supporting Logic Model 19.12.2-12 Revaporization Releases Scrubbed Supporting l [ Logic Model 1 km Amendment P lxxxi June 15, 1993
CESSAREnnnc-LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure Subiect 19.12.2-13 Vaporization Releases Scrubbed Supporting Logic Model 19.12.3-1 Listing of Release Class Input Data for S80SOR 19.12.2-14 Containment Fragility Curves for System 80+ 19.13-1 Total CCDF of Whole-Body 0 300 Meters for All Release Classes 19.13-2 Total CCDF of Whole-Body 0 1/2 Mile for All Release Classes 19.13-3 Dose vs. Distance for Various Exceedance Probabilities 19.13-4 CCDF of Whole-Body Dose 0 300 Meters for RC 1.1E 19.13-5 CCDF of Whole-Body Dose 0 300 Meters for RC 1.1M 19.13-6 CCDF of whole-Body Dose 0 300 Meters for RC 2.1E 19.13-7 CCDF of Whole-Body Dose 0 300 Meters for RC 2.2E 19.13-8 CCDF of Whole-Body Dose 0 300 Meters for RC 2.4E 19.13-9 CCDF of Whole-Body Dose 0 300 Meters for RC 2.5E 19.13-10 CCDF of Whole-Body Dose 0 300 Meters for RC 2.6E 19.13-11 CCDF of Whole-Body Dose 0 300 Meters for RC 2.7E 19.13-12 CCDF of Whole-Body Dose 0 300 Meters for RC 2.2M l Amendment P lxxxii June 15, 1993
CESSARM h mu (m) LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure Bubiect 19.13-13 CCDF of Whole-Body Dose @ 300 Meters for RC 2.5M 19.13-14 CCDF of Whole-Body Dose 6 300 Meters for RC 2.6M 19.13-15 CCDF of Whole-Body Dose 0 300 Meters for RC 2.7M 19.13-16 CCDF of Whole-Body Dose 0 300 Meters for RC 3.1E 19.13-17 CCDF of Whole-Body Dose 0 300 Meters for RC 3.2E 19.13-18 CCDF of Whole-Body Dose 0 300 Meters for RC 3.4E /O !s
' ) 19.13-19 CCDF of Whole-Body Dose 0 300 Meters for RC 3.6E 19.13-20 CCDF of Whole-Body Dose 0 300 Meters for RC 3.2M 19.13-21 CCDF of Whole-Body Dose 0 300 Meters for RC 3.6M 19.13-22 CCDF of Whole-Body Dose 0 300 Meters for RC 4.4E 19.13-23 CCDP of Whole-Body Dose 0 300 Meters for RC 4.8E 19.13-24 CCDF of Whole-Body Dose 0 300 Meters for RC 4.12E 19.13-25 CCDF of Whole-Body Dose 0 300 Meters for RC~4.18L 19.13-26 CCDF of Whole-Body Dose 0 300 Meters for RC 5.1E 19.13-27 CCDF of Whole-Body Dose 0 1/2 Mile for RC 1.1E Amendment P lxxxiii June 15, 1993
CESSARinec-LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure Subiect 19.13-28 CCDF of Whole-Body Dose 0 1/2 Mile for RC 1.1M 19.13-29 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.1E 19.13-30 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.2E 19.13-31 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.4E 19.13-32 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.5E 19.13-33 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.6E 19.13-34 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.7E 19.13-35 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.2M 19.13-36 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.5M 19.13-37 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.6M 19.13-38 CCDF of Whole-Body Dose 0 1/2 Mile for RC 2.7M 19.13-39 CCDF of Whole-Body Dose 0 1/2 Mile for RC 3.1E 19.13-40 CCDF of Whole-Body Dose 0 1/2 Mile for RC 3.2E 19.13-41 CCDF of Whole-Body Dose 0 1/2 Mile for RC 3.4E 19.13-42 CCDF of Whole-Body Dose 0 1/2 Mile for RC 3.6E i 1 Amendment P lxxxiv June 15, 1993
.I
CESSAR EL"icari3n w ! ! l N.)\ LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure 89biect 19.13-43 CCDF of Whole-Body Dose @ 1/2 Mile for RC 3.2M 19.13-44 CCDF of Whole-Body Dose @ 1/2 Mile for RC 3.6M 19.13-45 CCDF of Whole-Body Dose @ 1/2 Mile for RC 4.4E 19.13-46 CCDF of Whole-Body Dose @ 1/2 Mile for RC 4. 8E 19.13-47 CCDF of Whole-Body Dose 0 1/2 Mile for RC 4.12E 19.13-48 CCDF of Whole-Body Dose @ 1/2 Mile for RC 4.18L ("\ i 19.13-49 CCDF of Whole-Body Dose @ 1/2 Mile for
'"#) RC 5.1E 19.14.2-1 CCDF of Whole-Body Dose @ 300 Meters for Case 1A 19.14.2-2 CCDF of Whole-Body Dose @ 1/2 Mile for Case 1A 19.14.2-3 CCDF of Whole-Body Dose @ 300 Meters for Case 1B 19.14.2-4 CCDF of Whole-Body Dose @ 1/2 Mile for Case 1B 19.14.2-5 CCDF of Whole-Body Dose @ 300 Meters for Case 2 19.14.2-6 CCDF of Whole-Body Dose 0 1/2 Mile for Case 2 19.14.2-7 CCDF of Whole-Body Dose @ 300 Meters for Case 3 19.14.2-8 CCDF of Whole-Body Dose @ 1/2 Mile for Case 3 1
19.14.2-9 CCDF of Whole-Body Dose @ 300 Meters for (} Case 4 l Amendment P lxxxv June 15, 1993
CESSAR 8lninCATION LIST OF FIGURES (Cont'd) CHAPTER 19 Fiqure subiect 19.14.2-10 CCDF of Whole-Body Dose @ 1/2 Mile for Case 4 19.14.2-11 CCDF of Whole-Body Dose 0 300 Meters for Case 5 19.14.2-12 CCDF of Whole-Body Dose 0 1/2 Mile for Case 5 19.14.2-13 CCDF of Whole-Body Dose @ 300 Meters for Case 6 19.14.2-14 CCDF of Whole-Body Dose 0 1/2 Mile for Case 6 19.15.2-1 Relative Contributions of Internal Events to Total CDF 19.15.2-2 Contributions to Containment Failure Frequency 19.15.2-3 Total CCDF of Whole-Body Dose 0 300 Meters for All Release Classes 19.15.2-4 Total CCDF of Whole-Body Dose 0 1/2 Mile for All Release Classes 19.15.2-5 Dose vs. Distance for Various Exceedance Probabilities l l l I
\
l O Amendment P lxxxvi June 15, 1993
CESSARina mn tp) U LIST OF ACRONYMS CHAPTER 19 ACRONYE MEANING ac/AC Alternating Current ADV Atmospheric Dump Valve ALWR Advanced Light Water Reactor ANS American Nuclear Society ANSI American National Standards Institute AO Auxiliary Operator AOO Anticipated Operational Occurrence APS Alternate Protection System ARO All Rods Out ARTS Alternate Reactor Trip System ARSAP Advanced Reactor Severe Accident Program ATWS Anticipated Transient Without Scram BNL Brookhaven National Laboratory BOP Balance of Plant BWR Boiling Water Reactor CAFTA Computer Aided Fault Tree Analyzer C-E Combustion Engineering /~'N CCDF Complementary Cumulative Distribution Function () CCF CCS Common Cause Failure Component Control System CCW Component Cooling Water CCWS Component Cooling Water System CDC Control Data Corporation CEA Control Element Arsepbly CEDM Control Element Dr1 > Mechanism CENTS Combustion Engineering Nuclear Transient Simulator CEOG Combustion Engineering Owners Group CET Containment Event Tree CIAS Containment Isolation Actuation Signal CPC Core Protection Calculator-CRAC Calculation of Reactor Accident Consequences CRDM Control Rod Drive Mechanism CS Containment Spray CSAS Containment Spray Actuation Signal CSET Containment Safeguards Event Tree CSS Containment Spray System CST Condensate Storage Tank CVCS Chemical and Volume Control System DC Direct Current DCH Direct Containment Heating DEC Digital Equipment Corporation DG Diesel Generator DOE Department of Energy [) DVI Direct Vessel Injection G Amendment N lxxxvii April 1, 1993
CESSARELbitu LIST OF ACRONYMS (Cont'd) CHAPTER 19 ACRONYM MEANING ECCS Emergency Core Cooling System EDS Electrical Distribution System EFAS Emergency Feedwater Actuation Signal EFW Emergency Feedwater EFWS Emergency Feedwater System EFWST Emergency Feedwater Storage Tank EHC Electrohydraulic Control EPRI Electric Power Research Institute ERF Error Factor ESF Engineered Safety Features ESFAS Engineered Safety Features Actuation Signal (or System) F Fahrenheit FP Fission Products ft feet FW Feedwater g unit of acceleration equal to the acceleration of gravity gpm Gallons Per Minute HCR Human Cognitive Reliability HEP Human Error Probability HPSI High Pressure Safety Injection HRA Human Reliability Analysis IBM International Business Machines, Inc. IDCOR Industry Degraded Core Rulemaking Program IPE Individual Plant Evaluation IPEM Individual Plant Evaluation Methodology IREP Interim Reliability Evaluation Program IRRAS Integrated Reliability and Risk Assessment System IRWST In-containment Refueling Water Storage Tank ISLOCA Interfacing System Loss Of Coolant Accident KAG Key Assumptions and Groundrules i KV Kilovolts ' LOCA Loss of Coolant Accident LOOP Loss of Offsite Power j LSSB Large Secondary Side Break LWR Light Water Reactor MAAP Modular Accident Analysis Program MACCS MELCOR Accident Consequence Code System MCC Motor Control Center MFIV Main Feedwater Isolation Valve l MFW Main Feedwater System l MGL Multiple Greek Letter MLD Master Logic Diagram i MLOCA Medium Loss Of Coolant Accident Amendment N lxxxviii April 1, 1993
CESSAR sinince ,9
\ '~/ LIST OF FIGURES (Cont'd)
CHAPTER 19 Fiqure subiect 19.11.4.2.2-4 CORON-MOD 3 Predicted Heat Flux at the Corium-Water Interface 19.11.4.3-1 Decontamination Factor for a Saturated Water Pool Overlying a Corium Debris Bed 19.11.5.4.1.1-1 RCS Pressure vs Time 19.11.5.4.1.1-2 RCS Two Phase Level vs Time 19.11.5.4.1.1-3 Containment Pressure vs Time 19.11.5.4.1.1-4 Containment Temperature vs Time 19.11.5.4.1.1-5 Cavity Concrete Erosion vs Time 19.11.5.4.1.2-1 Cavity Concrete Erosion vs Time O I, 19.11.5.4.1.2-2 Containment Pressure vs Time 19.11.5.4.1.2-3 Containment Temperature vs Time 19.11.5.4.1.3-1 RCS Pressure vs Time 19.11.5.4.1.3-2 RCS Two Phase Level vs Time 19.11.5.4.1.3-3 SG Water Level vs Time 19.11.5.4.1.3-4 Containment Pressure vs Time 19.11.5.4.1.3-5 Containment Temperature vs Time 19.11.5.4.1.3-6 Basemat Erosion vs Time 19.11.5.4.2.1-1 RCS Pressure vs Time 19.11.5.4.2.1-2 RCS Two Phase Level vs Time 19.11.5.4.2.1-3 SG Broken Loop Water Level vs Time 19.11.5.4.2.1-4 SG Unbroken Loop Water Level vs Time 19.11.5.4.2.1-5 Containment Pressure vs Time (%
)
Amendment P I lxxix June 15, 1993 '
CESSA.R E!L"lCATl;M LIST OF ACRONYMS (Cont'd) CHAPTER 19 BCRONYM HEANING SSHR Secondary Side Heat Removal SSW Station Service Water STA Shift Technical Advisor SW Service Water TBS Turbine. Bypass System TBV Turbine Bypass Valve TGGB Turbine Generator Governor Valve TOTH Other Transients VDC Volts - Direct Current yr year O O' Amendment N xc April 1, 1993
CESSAR nainema ! l O 19.
1.0 INTRODUCTION
19.1.1 PURPOSE One of the requirements of 10 CFR Part 52m is that an application for design certification must contain a design specific Probabilistic Risk Assessment (PRA). This section documents thel results of the probabilistic risk assessment for the System 80+ Standard Plant Design. The System 80+ Standard Design PRA has three primary purposes. The first purpose is to identify the dominant contributors to severe accident risk. The second purpose is to provide an analytical tool for evaluating the impact of design modifications on core damage probability and the overall risk to the health and safety of the public. The final purpose is to calculate the core damage frequency and large release frequency for the System 80+ Standard Design. 19.1.2 BCOPE The System 80+ Probabilistic Risk Assessment is a Level III PRA for the System 80+ Standard Plant Design. This PRA addresses both internal and external initiators of accident sequences which lead l to core damage. Bounding plant site characteristics were used for s the evaluation of external events such as seismic and tornado strike events and for evaluating public risk. O Amendment P 19.1-1 June 15, 1993
CESSARsaGem t \ \ considered to be a special initiator and was kept distinct from the other transient initiators. The event initiators were then grouped into initial initiating event classes based on the bottom events on the MLD, the transient grouping in Cha ter 15, thel initiating events analyzed in the other PRAsutio n,10g02o , and the special initiators as described above. An iterative process was then used to select the final set of initiating events and to define the event sequences. First, an initial draft of an event tree was developed for each of the initial initiating event classes based on plant system responses to the specific type of initiator. These event trees were then compared and where the system responses with respect to preventing core damage were the same or equivalent, the classes were combined. The event trees were then briefly evaluated for the individual initiators within the class. If the system responses to the specific initiator were not covered by the class event tree, the initiator was either transferred to an event class for which the system responses were appropriate, or a new event class was created and a new draft event tree was developed. This process was repeated until a set of initiating event classes were defined that included all the initiators in the original list and the event tree for each event class covered the system responses for each 3 initiator. The final event trees were then prepared and the [d
\
} description and success criteria were defined for each element on the event trees. In general, the success criteria for the event tree elements were based on the system performance used for the Chapter 15 and Chapter 6 analyses. For elements not a dressed in l the Chapter 15 and Chapter 6 analyses, success criteria were based on other transient analyses for equivalent plants"O12) and the judgement of the transient analysts with confirmatory thermal-hydraulic transient analyses using codes such as CENTS (2n or MAAPt20 2n as appropriate.
The set of initiating events and the event tree structure for each initiating event also evolved as the plant system designs evolved. As design changes were made, the set of initiating events was reviewed to determine if there were any changes (additions or deletions) and the event trees were reviewed to determine if any changes were needed due to changes in system responses or responding systems. The event tree structure also changed to reflect the truncation of sequences with very low probabilities. The PRA was used as a design evaluation tool. Thus, the event trees were quantified at several times to evaluate the impact of major design evolutions. These quantifications reflected the following major design change groups: A. Incorporation of the front line system design enhancements. /] B. Incorporation of component cooling water system changes. V Amendment P 19.2-5 June 15, 1993 i
CESSAREnnnce C. Incorporation of the electrical distribution system design changes. At each quantification step, low frequency sequences were tagged for truncation. These sequences were deleted only after determining that they were not impacted by other design changes. The event trees presented in Section 19.4 represent the final System 80+ design. All transients require reactor trip for reactivity control. Failure of reactor trip leads to an Anticipated Transient Without Scram (ATWS). Because of the special nature of this type of an event, ATWS was treated as a separate initiating event with a specific event tree. Thus, failure of reactivity control was not included in the transient event trees. 19.2.3 SYSTEM MODELING Each system event tree, as described in Section 19.2.2, represents a distinct set of system accident sequences, each of which consists of an initiating event and a combination of various system successes and failures that lead to an identifiable plant state. Quantification of the system accident sequences requires knowledge of the failure probability or probability of occurrence for each element of the system accident sequence. The initiating event frequency and the probability of failure for a system accident sequence element involving the failure of a single component can be quantified directly from the appropriate raw data using methods de ~"" 2 bed in Reference 6. However, if the system accident sequence clement represents a specific failure mode for a system or subsystem, a fault tree model of the system or subsystem must be constructed and quantified to obtain the desired failure probability. Construction of the fault tree requires a complete definition of the functional requirements for the system, given the initiating event to which it is responding, and the physical layout of the system. The system fault tree is a graphic model of the various parallel and serial combinations of component failures that would result in the postulated system failure mode <20, The evaluation of each fault tree yields both qualitative and quantitative information. The qualitative information consists of the "cutsets" of the model. The cutsets are the various combinations of component failures that result in the top event, i.e. the failure of the system. The cutsets form the basis of the quantitative evaluation which yields the failure probability for the system accident sequence element of concern. The quantitative evaluation of the fault trees yields several numerical measures of a systems failure probability, two of which are typically employed in the event tree quantification, i.e., the unavailability and unreliability. The unavailability is the Amendment M 19.2-6 March 15, 1993
CESSARnabou C At each major design evolution, the set of initiating events and their associated event trees were re-evaluated to ensure that they completely and accurately reflected the current state of the design. First, the list of initiating events was reviewed to determine in any events could be eliminated or combined with other events, or in new events had to be created. Next, the design changes were reviewed to determine their impact on plant response and transient progression to see in the event trees needed to be modified. Then, as the system models were updated to reflect the design changes, the impact of the support systems was assessed to determine if any new special event tree models were needed of if existing ones needed to be modified or deleted. These re-evaluations also included quantification of the event sequences. Event tree elements which only appeared in sequences with very low probabilities were tagged for possible truncation. During preparation of the final set of event trees, the tagged elements were reviewed to see if they reflected any unique aspect of the plant or its response to transients. If not, and if the element only appeared in low probability sequences (<1.0E-15), the element was dropped from the event trees. The final set of initiating event groups and their constituent initiating events are presented in Table 19.3.2-7. The following paragraphs briefly discuss the rationale for the individual grouping. The primary system LOCA class break sizes were established based on design requirements, the needed injection system capacity, the need for secondary side heat removal, and the need for hot leg injection to prevent boron precipitation. The lower end of the Large LOCA class was defined by the design requirement that a quillotine break of a direct vessel injection (DVI) line could be mitigated even with a simultaneous loss of offsite power and the failure of one diesel generator. This in essence establishes the requirement th..c LOCAs with an area less than or equal to that of the DVI line (0.50 ft2 ) can be mitigated with only one injection pump. This defines the lower end of the large LOCA class. (Note: the DVI line is a 12 inch pipe, but the nozzle I.D. is limited so the cifective break size for a DVI line is limited to 0.50 f tz. ) Vessel failure was removed from the large LOCA class and establlsned as a separate initiator defined to be "any loss of coolant accident in excess of the ECCS capacity". Small LOCAs are defined to be LOCAs for which the break is not large enough to remove the decay heat and secondary side heat reroval is therefore needed. Best Estimate 2 analysis has shown that for break sizes down to about 0.03 ft, secondary side heat renoval is not needed. Therefore, for this analysis, small LOCAs are defined to be LOCAs with a break sizes of 0.03 ft2 and less. Medium LOCAs are defined to be LOCAs with break sizes between 0.50 ft2 and 0.03 ft. 2 To facilitate the level 2 analyses, medium LOCAs were divided into two classes based on whether in-vessel pressure at the time of core melt was greater than or less than about 250 psia. The dividing point corresponded Amendment P 19.3-5 June 15, 1993
CESSAR EHLuou to a break size of about 0.2 ft 2 , so Medium LOCA 1 is defined to be 2 a LOCA with a break size between 0.50 ft2 and 0.2 ft, and Medium LOCA 2 is defined to be a LOCA with a break size between 0.2 ft2 2 and 0.03 ft. CEA ejections were included in the small LOCA class. C-E plants typically operate with all rods out (ARO) or with a few CEA's slightly inserted when at power, thus, power perturbations, if any, would be minimal, and the major impact would be the breach of the primary pressure boundary. Failure of one primary safety valve (PSV) to reseat following PSV opening as a consequence of a transient or the spurious opening of one PSV were included in the Medium LOCA 2 LOCA class because of the energy relief capability of the valves given their location. (Note: based on size, one PSV would fall in the small LOCA class.) Loss of offsite power / station blackout was removed from the turbine trip category and established as a separate initiator category because of the impact of these events on the front line systems. " Station Blackout" is addressed within the " Loss of Offsite Power" Event tree via the treatment of in-plant power supply systems in the system fault tree models. " Total loss of RCS flow" is also considered to be covered by this category because loss of offsite power is the most likely means of losing all RCS flow and the response to a loss of offsite power is bounding with respect to systems available for mitigation. Loss of RCS flow in one loop was included in the transient category. Large steam line breaks, inside or outside of containment, and large feedwater line breaks downstream of the main feedwater isolation valves (MFIVs), result in a rapid blowdown of the secondary system with the attendant rapid cooldown of the primary system. The response of the front line systems is equivalent for all of the breaks. Therefore, a single event initiator category, large secondary side breaks, was established. This category includes large steam line breaks inside or outside of containment, main feedwater line breaks downstream of the MFIVs, and spurious openings of multiple turbine bypass valves, atmospheric dump valves or main steam safety valves. Small steam losses which do not result in a significant blowdown of the secondary system were included in the transient category. An evaluation of the process perturbations and the front line system responses for transient initiators with the exception of loss of offsite power and large steam and feedwater line breaks indicated that the process perturbations and the needed safety system responses were similar for all of the transient events. These events produce process perturbations which result in a , reactor and turbine trip. Main feedwater flow cuts back to 5% and i startup feedwater is initiated if available. If main feedwater flow and startup feedwater flow is lost on the ramp back or the transient was loss of main feedwater, the emergency feedwater system actuates. Steam removal following the trip is via the turbine bypass valves, the atmospheric dump valves or the main 1 Amendment M i 19.3-6 March 15, 1993 i i
CESSAREMnc- / Given that the SDV has failed, the probability the Block Valve (BV) will fail before the plant is shutdown is estimated as: Q3y = Ar = (7.7E-7/hr) * (7 20 hrs) = 5.5E-4 (egn 19.3.3-4) Therefore, the probability of a spurious opening of both valves in one SDS train is estimated as: Qu = Qsev
- Qav = 6.7E-3
- 5.5E-4 = 3.7E-6 (egn 19.3.3-5)
Because there are two trains, the total probability that a medium LOCA will occur due to mechanical failure of the SDS valves is: Qs c3 = 7.4E-6/ year. (egn 19.3.3-6) The probatliity that an SDS train would be inadvertently opened by an opera'm was estimated using the HRA methodology described in section 2.5. Two basic scenarios were considered; a) during normal operation an operator randomly opens the SDV and the SDV block valve for no apparent reason, and b) the operator erroneously decides that Feed and Bleed cooling is needed to respond to a transient. Sabotage was specifically excluded from evaluation. The scenario that is considered is an inadvertent operation of the Safety Depressurization System on a System 80+ plant due to the V inappropriate initiation of Feed and Bleed cooling. Feed and Bleed cooling would be used when the operator realizes that he no longer has any method of decay heat removal. Then he would initiate feed and bleed cooling af ter consulting with the Shif t Supervisor or the Technical Support Center. In order for the operator to determine that the initiation of feed and bleed cooling is necessary, there are some vital indications that must be observed: High RCS temperatures High Steam Generator Pressures Low or no Steam Generator Level l Loss of primary coolant subcooling l Unexplained rise in pressurizer level (indicative of void ; formation in the core). ! Unexplained change in pressurizer level not indicative of l pressurizer or reactor coolant system water inventory. Given these indications, the operator would perform the following actions (see Figure 19.3.3-1): A. Identify the need for Feed and Bleed Cooling and consult with the Shift Supervisor or the Technical Support Center. l q i
) B. Ensure all RCPS are tripped.
Amendment P 19.3-11 June 15, 1993
CESSAR nn%- C. Verify that the Safety Injection System is lined up for DVI. O D. Verify that all SI pumps are available and operating. l E. Open Safety Depressurization Block Valves RC-461 and RC-463. F. Monitor the flow through the Safety Injection System and ensure that it is operating properly. Therefore, since it was assumed that there would be no malicious operation of this system, and since random fiddling is so rare, the scenario for inadvertent actuation would be: The operator erroneously identifies that the indications that indicate total loss of all feed exists and omits to consult the Technical Support Center before initiating Feed and Bleed Cooling. In order to quantify the frequency of this event occurring, inadvertent actuation of the Safety Depressurization System (SDS), some assumptions must be made with respect to the initiating event. Consultation with operations staff indicates that it may be possible to mis-diagnosis a Loss of Main Feedwater event and classify this as a total loss of feedwater. Other more complicated scenarios could be identified but the combination of equipment faults and operator errors that would lead to these make their inclusion infeasible with respect to this analysis. So the event then becomes the inadvertent actuation of the Safety Depressurization system when the operator mis-diagnoses a Loss of Main Feedwater as a Total loss of Feedwater. The indications for a loss of Main Feedwater are similar to the loss of all feed until emergency feedwater initiates on low-low steam generator level. Once emergency feedwater initiates then the recovery proceeds as if there were an uncomplicated reactor trip. The scenario that is being postulated is one where the operator sees and acknowledges the low-low steam generator level but fails to realize that the emergency feedwater system has initiated. Then the operator would assume that now more than one event is occurring (i.e. , Loss of Main Feedwater and Loss of Emergency Feedwater), and move to the Functional Recovery Procedure, and directly to Success-path HR-4 Feed and Bleed Cooling. While the procedure would obviously be utility specific, a reasonable assumption would be that the operator would need to obtain authorization, or at least consult with, the Shift Supervisor or the Technical Support Center. The assumption for this analysis is that the operator skips this l step in the procedure and immediately embarks on the steps to establish Feed and Bleed cooling. This would be an expedited action because without Feedwater, core uncovery would occur relatively quickly. Amendment P 19.3-12 June 15, 1993
k)! kh h k I hbb FICATISM (~g ( ) Thus the errors that occur in diagnosis are:
- 1) Failure to identify the initiation of emergency feedwater:
assume, a) Emergency feedwater pump indication (non-annunciated) b) Emergency feedwater flow indication (non-annunciated) c) Steam Generator Level increasing (non-annunciated) d) Clearing of Steam Generator Low-Low Level Alarm (annunciated)
- 2) Go to Wrong procedure i.e. , Functional recovery and Success-path HR-4 Feed and Bleed Cooling
- 3) Fail to perform step that requires communication with the Shift Supervisor or the Technical Support Center.
These items identified above all fall under the classification
" Operator Erroneously Identifies Need for Feed and Bleed Cooling" in Figure 19.3.3-1 and are modelled in Figure 19.3.3-2.
Therefore, Total HEP for diagnosis phase = P (la) *P (2 ) *P (3) + P (1b) *P (2) *P (3 ) +
,-s. P(1c)*P(2)*P(3)+
(% P(1d)*P(2)*P(3) 4 (egn 19.3.3-7)
= 4.26*10 (egn 19.3.3-8)
Since the initiating frequency for a Loss of Main Feedwater is given as
= 4.10*104 /yr And assuming the HEP for failing to initiate Feed and Bleed is <10" then the frequency of inadvertent actuation of the Safety Depressurization System due to erroneous initiation of Feed and Bleed Cooling is:
= 4.26*10 4
- 4.10*104 /yr (egn 19.3.3-9)
= 1.75*107 (egn 19. 3. 3-10)
The total probability of a medium LOCA due to an inadvertent opening of an SDS train is the sum of the mechanical contribution as given in equation 19.3.3-6 and the human error contribution given in equation 19.3.3-10. Therefore, the total probability is given as: Qraa = QMech + Qup = 7.4E-6 + 1.8E-6 = 9.2E-6 (egn 19.3.3-11) The value previously calculated value for Medium LOCA 2 is 6.97E-5/ year. The value for SDS LOCAs as presented in equation 19.3.3-11 was added to the medium LOCA 2 frequency. The total Medium LOCA 2 [h frequency is therefore calculated to be 7.89E-05/ year. \s / Amendment P 19.3-13 June 15, 1993
CESSAR nai"icariou The calculation of the interfacing systems LOCA frequency is presented in Section 19.4.13 of this report. 19.3.3.2 Steam Generator Tube Rupture The KAG recommends an occurrence frequency of 4.5E-3/yr for steam generator tube ruptures based on operating experience. This frequency was accepted for this analysis. An error factor of 5.0 was assigred for use in uncertainty calculations. 19.3.3.3 Large Secondary Side Breaks The KAG recommends an occurrence frequency of 1.5E-3/yr for steam line breaks based on operating experience. This frequency was accepted for this analysis. An error factor of 10.0 was assigned for use in uncertainty calculations. 19.3.3.4 Transients The KAG recommends an occurrence frequency of 0.41/yr for loss of main feedwater transients and a frequency of 2.8/yr for other reactor / turbine trip transients. The goal for ALWRs is to have less than one unplanned trip per year. Based on current operating experience which indicates that scram frequencies have decreased to in the range of 1.5 cer year, a scram frequency of less than one per year is believed to be achievable. Therefore, the loss of feedwater trip frequency of 0.41/ year is used and the frequency for other transients is set to 1.0 - 0.41, or 0.59/ year. An error factor of 3.0 was assigned to both values for use in uncertainty calculations. This value for the error factor is twice that derived for the transient occurrence frequency error factor derived for use in the System 80 baseline PRA(3) based on EPRI NP-2230c27) data. 19.3.3.5 Loss of a Vital Bus The KAG presents an occurrence frequetcy of 1.5E-3/yr for the transient, " Loss of a Major AC Power Bus". This occurrence frequency was used for the transient class, " Loss of a 4.16KV Vital Bus", and the transient class, " Loss of a 125VDC Vital Bus". An error factor of 3.0 was assigned to both frequencies for use in uncertainty calculations. 19.3.3.6 Loss of Component Cooling Water The final release of the KAG does not present a value for " loss of component cooling water", but the initial draft contained a value of 2.4E-3/yr for loss of equipment cooling. This was apparently based on EPRI NP-2230 data which includes a value of 1.5E-3/yr for " Loss of component cooling water" and a value of 1.0E-3/yr for " loss of service water". For System 80+, loss of one division of component cooling water and loss of one division of service water have the same impact because the service water system only provides cooling for the Amendment M 19.3-14 March 15, 1993
CESSAR 8lniflCATION O TABLE 19.3.3-1 HEP OUANTIFICATION FOR INADVERTENT SDS OPENING Median Human Error Performance Reference Error Probability Shaping Factor Total INUREG/CR-12781 la 0.001 STRESS = x2 0.002 Table 20-9 lb 0.003 STRESS - x2 0.006 Table 20-11 Ic 0.003 STRESS - x2 0.006 Table 20-11 Id 0.0001 STRESS - x2 0.0002 Table 20-23 2 0.025 STRESS - x2 0.05 Table 20-7 3 0.003 STRESS - x2 0.006 Table 20-7 i O Amendment M l March 15, 1993 ; l i
CESSAR Ennneimu O TABLE 19.3.3-2 INITIATING EVENT OCCURRENCE FREQUENCIES Occurrence Freauency Initiatina Event Mean ERF Large LOCA 6.97E-5/yr 5.0 Medium LOCA 1 6.97E-5/yr 5.0 Medium LOCA 2 7.89E-5/yr 5.0 Small LOCA 3.00E-3/yr 5.0 Steam Generator Tube Rupture 4.50E-3/yr 5.0 Large Secondary Side Breaks 1.50E-3/yr 10.0 Loss of Main Feedwater Transients 4.10E-1/yr 3.0 Other Transients 5.90E40/yr 3.0 Loss of Offsite Power 5.00E-3/yr 5.0 Loss of Component Cooling Water 2.40E-2/yr 5.0 Loss of a 125VDC Vital Bus 1.50E-3/yr 3.0 Loss of a 4.16KV Vital Bus 1.50E-3/yr 3.0 Loss of one Division of HVAC 4.08E-2/yr 10.0 Anticipated Transient Without Scram 4.75E-6/yr 5.0 l Interfacing System LOCA 3.01E-9/yr 18.5 Vessel Rupture 1.00E-7/yr 10.0 9' Amendment P June 15, 1993 4 l
CESSARnahmu n N ,) 19.4 ACCIDENT SEQUENCE DETERMINATION 19.4.1 LARGE LOCA The large LOCA event tree, Event Tree 1 (Figure 19.4.1-1), applies to all breaches of the Reactor Coolant Cystem (RCS) inside 2 containment with an effective break area greater than 0.50 ft, This includes the design basis accident, a double ended guillotine RCS pipe break, as well as any breach of the reactor vessel itself which is within the capability of the Safety Injection System (SIS) to maintain RCS inventory control and RCS heat removal such that severe core damage does not occur. Large LOCA is a severe event in which blowdown of the RCS occurs within a very short period of time; from seconds to a few minutes. The safety injection tanks refill the reactor vessel lower plenum and downcomer, and the safety injection pumps restore and maintain water in the reactor vessel. Because of rapid depressurization, the nuclear reaction is quickly shutdown due to voiding in the core region. A reactor trip is not required for this sequence. After the reflood, the subcriticality is assured by the boron in the injected water. Decay heat is removed through the break. Long p term removal of the decay heat from within containment is provided by the Containment Spray System and Component Cooling Water System. t, N Reactor coolant discharged through the break will drain to the holdup sump and then into the In-containment Refueling Storage Tank (IRWST). The containment spray pumps pump water from the IRWST through the containment spray heat exchangers where it is cooled by the Component Cooling Water System and then back to the In-containment Refueling Water Storage Tank. Core inventory is replenished from the IRWST by the safety injection pumps. The following paragraphs described the individual elements of the Large LOCA event tree. 19.4.1.1 Event Tree 1 Elements 19.4.1.1.1 Large LOCA Initiators A Large LOCA event tree is initiated by a random Reactor Coolant System break with an effective break area greater than 0.50 ft 2, For reactor vessel breaks of this size to be included in this class of initiators, its location must be within the capabilities of the Safety Injection System. Large LOCAs which create a direct path outside containment are treated as a separate type of event (Interfacing System LOCA). LOCAs arising as a consequence of another type of event are evaluated within the context of that event. 7 lC} Amendment M 19.4-1 March 15, 1993
CESSAR nnincari:n 19.4.1.1.2 Safety Injection Tank Injection The Safety Injection Tanks (SITS) provide the initial injection of borated water needed to cool the core following a Large LOCA. The SIT isolation valve (s) receive confirmatory open signal on Safety Injection Actuation Signal (SIAS). There are four SITS, one per Reactor Coolant System direct vessel injection (DVI) line. Best estimate thermal / hydraulic analysis indicates that water l injected from two SITS will be sufficient to provide initial core cooling. Therefore, the success criterion for SIT injection is that two of the four SITS inject into the reactor vessel. 19.4.1.1.3 Safety Injection System Injection Safety Injection System (SIS) provides coolant inventory control following flooding by the SITS for Large LOCA. The SIS is actuated by the Engineered Safety Features Actuation System (ESFAS) on a SIAS, which is generated on low pressurizer pressure or high containment pressure. The SIS consists of four separate and redundant trains. Each train consists of a motor-driven pump, safety injection isolation and other valves, and piping. The success criterion for the SIS during the initial SIS injection phase is that flow from two of the four SIS trains must be delivered to the reactor vessel from the In-containment Refueling Water Storage Tank (IRWST). Following the initial blowdown and recovery phases for large cold leg breaks, simultaneous hot leg and direct vessel injection must be established to provide a circulation flow through the core to prevent boric acid crystallization. Based on the Post-LOCA long term cooling analysis presented in Section 6.3.3.4 of CESSAR-DC, it is estimated that hot leg injection should be initiated within 2-4 hours to prevent boric acid crystallization. There are two hot leg injection paths. Hot leg injection is established by manually opening the hot leg injection valves from the control room. For this analysis, it is conservatively assumed that hot leg injection is required for both cold and hot leg breaks. t The success criterion for hot leg injection is that the hot leg injection valves in 1 of the 2 hot leg injection paths be opened l and sufficient flow be delivered from the associated safety injection pump to an intact RCS hot leg. l The safety injection failure is, therefore, defined to be 3 of the 4 SIS trains not available during the initial phase of safety injection or both hot leg injection paths unavailable during hot l leg injection phase. The IRWST provides the source of borated water (-4400 PPM) required for safety injection and containment spray following a Large LOCA 1 Amendment P 19.4-2 June 15, 1993
CESSAR 88HNm O event. The IRWST is a large dishlike steel tank utilizing the lower section of the spherical containment as its outer boundary and has a cylindrical inner boundary. The IRWST contains sufficient borated water to meet all post-accident safety injection (SI) and containment spray (CS) pump operation requirements. The IRWST has four suction lines that supply flow to four SI pumps. Two of the lines also supply to the CS pumps and Shutdown Cooling (SCS) pumps. 19.4.1.1.4 Containment Spray Cooling Following a large LOCA, the decay heat in the core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory flows out of the RCS and into the containment via the break, thus transferring the core energy to containment. Normally, the decay heat energy is removed from containment by the containment spray system. The spray condenses the steam in containment. The hot condensate flows to the Holdup volume tank and then, when the Holdup volume tank fills, to the IRWST. Thus, the core decay heat energy has been transferred to the IRWST. The Containment spray pump takes suction from the IRWST and discharges to containment through the containment spray heat exchanger. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus (Vp) transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. If containment heat removal via the Containment Spray System is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a large LOCA with no containment heat removal from time 0, the containment will fail at about 41 hours. At this point, the steam that was inside containment will be discharged to atmosphere via the containment breach. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere at this point. Core heat removal is still being successfully accomplished via safety injection from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup f pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. ( The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a Amendment M 19.4-3 March 15, 1993
CESSARE!h mu normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boiloff rate from the core due to decay heat at 48 hours is approximately 137 gpm. Figure 19.4.1-2 presents the topic logic for long term containment heat removal using the containment spray system. 19.4.1.2 Maior Dependencies The following functional dependencies are important for Event Tree 1: A. If the IRWST is unavailable, safety injection and containment spray coolin g would fail because there is no source of cooling water. B. If SIAS f ails, there is no actuation signal for SIS equipment. Hence, safety injection would fail. C. If CSAS fails, there is no actuation signal for CSS equipment. Hence, containment spray cooling would fail. 19.4.1.3 Operator Actions and Interfaces 19.4.1.3.1 Standard Operator Actions Since the large LOCA event will incur an automatic reactor trip on either thermal margin or Low Pressurizer Pressure, the Standard Post Trip Actions will be implemented by the operators. These actions require the operator to check the safety functions and implement standard remedial actions that have been devised to attempt to regain control of these safety functions. The safety functions that would be challenged are RCS inventory control, RCS pressure control, and core heat removal. Containment isolation, containment temperature and pressure control would also be challenged with less severity. The challenge to these safety functions would be indicated by alarms on the critical function monitoring section of the information system hierarchy and the annunciators on the plant monitoring and control panel, and IPSO (Integrated Process Status Ovtrview). Since the operators would also be required to check the specific unambiguous acceptance criteria they would be required to confirm the system annunciators with the following indications: RCS Inventory control Pressurizer level not within 26% to 60% (Pressurizer level - Discrete Indication and Alarm System, DIAS, in the control room) Amendment P 19.4-4 June 15, 1993
CESSAR8 rbu N v
] l RCS Pressure Control Pressurizer pressure not between 1905 !
to 2375 psia and not trending to 2225 to 2300 psia (Pressurizer pressure - DIAS in the control room l Containment Environment Containment Pressure less than 0 .4 psig, no containment area radiation monitors are alarming and no steam { plant radiation monitors are alarming. l (Containment pressure - DIAS in the l control room) { Containment Temperature Containment temperature is less than and Pressure 120*F and Containment pressure less than 0 .4 psig (Containment Temperature - DIAS in the control room) These indications would be found either on discrete indicators for that parameter, i.e. Pressurizer pressure, or in the message l associated with the critical function alarm. RCS inventory loss would initially be mitigated by passive safety Q (y injection tank injection. The indication of this systems success is an annunciation of the level and pressure in the Safety Injection Tanks. This is indicated on annunciator windows on DIAS in the control room. Also this alarm will be shown on the CRTs. l RCS pressure control is initially lost as the RCS depressurizes because of the loss of inventory out of the break. For the large break scenario, the RCS would depressurize in 10 seconds to 3 minutes to typically below 300 psia. The operator would never regain RCS pressure control and the RCS would remain depressurized. Significant voiding would occur in the vessel. The operator would be directed to ensure that SIAS is initiated. Also, because of the magnitude of the depressurization, the operator would be required to trip two of the RCPs in opposite loop, at this point in the accident. Once the Standard Post Trip Actions have been accomplished the operators would be directed to the diagnostic aid which would help the operators in determining whether an optimal recovery procedure were appropriate or not. With the information gathered from the Standard Post Trip Actions, the operators would be led to the LOCA recovery procedure. There are six major recovery actions that the operators are required to perform in the LOCA procedure, in order to bring the 7 plant to cold shutdown following the accident. The first major j ( action consists of maximizing the Safety Injection flow into the j
\
RCS and attempting to isolate the source of the leak. This step l l Amendment P 1 l 19.4-5 June 15, 1993
)
(,EE!ifi/ Lit !!airication l 1 reduces the risk of core uncovery and facilitates the recovery from the LOCA. Ol The second and third major actions do not apply to the large LOCA as these are done when the leak is isolable. Since a large LOCA is un-isolable, only the fourth through the sixth major actions are applicable. The fourth major action involves a rapid plant cooldown using the steam generators. Although this is of little help in a large LOCA situation, no distinction of the size of the break is made in the operating procedure and thus this method is still employed. The fifth major recovery action is the , commencement of post-LOCA Long Term Cooling (LTC). Safety ' Injection flow is switched, by manually realigning pumps 3 and 4, to simultaneous hot / direct vessel injection. The sixth major action is to determine whether simultaneous hot / direct vessel injection in a recirculation mode should continue. The operator actions, as stipulated in the procedures, take place in the following fashion: Since LOCAs have very similar characteristics to other events, such as Excess of Steam Demand Event (ESDE) and Steam Generator Tube Rupture (SGTR), the operator would be directed to the Break Identification Chart for confirmation of the diagnosis of the event. With the large LOCA, the decision process would probably progress as follows: Pressurizer level changing and Pressurizer pressure rapidly decreasing? l YES Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment pressure increasing? l YES (indicates a LOCA inside Containment) With the successful diagnosis of a LOCA inside containment, the operator would then move on to check whether the safety injection system has actuated. This is done by checking that the pressurizer pressure has decreased to or below the SIAS setpoint of 1825 psia. If SIAS has failed then the operator is directed to initiate SIAS manually from the ESF panel using the momentary actuation switch. This is a safety check since this is one of the contingency actions l in the standard post trip actions. ; O i Amendment P 19.4-6 June 15, 1993
CESSARHHem The next action required by the procedure, to maximize safety injection flow, would be verified by the operator. Safety injection flow rate will follow pressurizer pressure according to plant specific SIS delivery curves. In the case of the large break LOCA the pressurizer pressure would have decreased so much that safety injection system output will already be at a maximum if all safety injection pumps were running. If any safety injection pumps have not actuated the operator is instructed to manually achieved this in the control room, for safety injection. l The next two steps of the LOCA procedure refer to the RCP operating strategy. The operator would already have tripped two of the RCPs. At this point,they would be required to verify that pressurizer pressure had decreased to less than 1300 psia following an SIAS, before tripping the rest of the RCPs. This is performed in the control room. Analyses have shown that continued operation of the RCPs can decrease core cooling capability, in the case of a break of this size, because of lost inventory being flushed out the break. The next stage of the procedure requires the operator to isolate potential sources of other leaks of inventory as a precaution. The following steps are done in order to achieve this goal: check that the safety depressurization valves are closed, check the head vents, check that the isolation of the letdown system on SIAS (O
,/ happened correctly, and check that all RCS sampling lines were isolated on SIAS. In the case of the systems that should have isolated automatically on SIAS, the only indication that these systems may not have isolated properly will be inherent in the switch position of the isolation valve.
The operators would now be concerned with verifying that the LOCA is not outside of containment. A LOCA outside of containment would not challenge any of the containment safety functions and the operator would be directed to skip all of the procedural actions associated with the containment safety functions. The indications that a LOCA has occurred outside of containment are auxiliary building radiation alarms and unexplained increases in the auxiliary building sumps levels. The next set of actions that the operators would be required to do by the LOCA procedure, are associated with the containment safety functions. First, the operator would check that CIAS had actuated on high containment pressure, typically 2.7 psig. If CIAS had not actuated correctly, then the operators' task would be to manually position the containment isolation valves in the control room. l Amendment P l 19.4-7 June 15, 1993
CESSAR EnWicariou Typically, the highest increases in containment pressure occur with a large break LOCA. The next step would be to ensure that since containment pressure is above 10 psig, that containment spray actuation has occurred, and at least one spray is working. The next issue, that the operators are required to address, is associated with the containment combustible gas control safety function. The evaluation associated with this situation is solely the responsibility of the Plant Technical Support Center. Various options are available to the PTSC. Decisions and actions taken are not to bc evaluated in this analysis. The procedure, at this point in the progression of the accident recovery, directs the operators to take one of two paths depending on whether the break has been isolated or not. This analysis pertains to a large un-isolable LOCA. The actions that the operators would take for the next, approximately, 20 steps are associated with regaining RCS inventory control, while maintaining RCS heat removal. The goal of the operator is to establish shutdown cooling, if possible, as the means of core heat removal. The technique that the procedure requires makes use of a rapid cooldown via the steam generators. An aggressive cooldown, while holding the cooldown rate within Technical Specifications Limitations, improves RCS heat removal by enhancing natural circulation and reflux boiling. For the large break LOCA, the RCS has depressurized to an equilibrium pressure with the containment. In this condition, the RCS fluid is at a lower temperature than that of the steam generators. The steam generators, therefore, act as a heat source, superheating any steam in the RCS which may be flowing through the S/G to the break. By cooling down the steam generators, heat input to the RCS is reduced. For this analysis the condenser and the turbine bypass system is available. In order to achieve this " aggressive cooldown", the operator must maintain steam generator levels in the normal band (indications and controllers found on the condensate and f eed water panel) . The operators must also ensure that adequate condensate inventory is available by monitoring the condensate storage tank, and replenished from the available sources as necessary to continually provide a secondary heat sink. Examples of alternate sources of condensate are non-seismic tanks, fire mains, lake water etc. Plant specific sources should be available and this will be credited in the analysis. Since the large LOCA has reduced the RCS pressure to equilibrium with containment pressure, there would be no need to depressurize the system, which is the next step indicated by the procedure. Since the RCPs are not operating, it may be necessary to evaluate restarting the RCPs. This is unlikely, however, due to the severity of the large break. Amendment M 19.4-8 March 15, 1993
CESSAR Enacua \J' Since the conditions for re-start of the RCPs are not met, the operators would be monitoring for natural circulation conditions in the RCS. In order to verify that natural circulation was occurring the operator would be monitoring: A. Loop AT(T ,t 3 -- Tcota) less than full power AT. l B. Hot and Cold leg temperatures RCS subcooling is at least 20* based on average Core Exit l Temperature. C. No abnormal differences between Tuot RTDs and average Core Exit Temperature. The operators will necessarily be making use of two phase natural circulation and flow through the break. In order to for this to maintain heat removal, the following must be verified by the operator: A. The SIS system is operating within specified limits. l B. Steam generator steaming and feeding are being properly controlled. (
- C. Average Core Exit Temperature is maintained less than
(' superheated. A superheated condition indicates core uncovery. The next step that the operators would take would.be to initiate simultaneous hot leg and direct vessel injection. This is achieved by manually opening the hot leg injection valves. This ensures that there is no boric acid crystallization at the openings in and out of the core and maintains a constant flow through the core. At this point the core is now in long term cooling and the LOCA optimal recovery procedure is exited. 19.4.1.3.2 Modeled Operator Actions Based ca the description above, the following actions were modeled in tne Large LOCA event trees and associated fault tree models: A. Failure to verify that the SIAS was generated, and to manually initiate the SIAS signal at the ESF panel if the signal was not automatically generated. B. Failure to verify that the CSAS was generated, and to manually initiate the CSAS signal at the ESF panel if the signal was not automatically generated. p Amendment P 19.4-9 June 15, 1993 i
CESSARE!'Uncm C. Failure to initiate simultaneous hot leg and direct vessel injection. This is achieved at the ESF panel by manipulation of the valves associated with the-line ups and the pumps. D. Failure to align the CVCS to the IRWST and refill the IRWST following ecntainment failure due to failure of long term containment beat removal. E. Pre-existing unintenance errors were included in the system fault tree models as appropriate. 19.4.1.4 Maior Recovery Actions The following major recovery actions were addressed in the recovery analysis for the Large LOCA Event Sequences: A. In early stages of the postulated Large LOCA, no recovery actions are possible because of rapid event progression. However, for the sequences wherein the power to the SIS pumps has been lost due to loss of offsite power and subsequent operating failure of the diesel generators, power to these pumps may be restored by either aligning the standby alternate power source or restoring the offsite power. This is possible in the later stages of the postulated accident because sufficient time is available to take the actions. Accordingly, power to the SIS pumps was restored in the hot leg injection phase and CSS pump in the later stages of the accident. SCS pump can be used for containment cooling if the containment spray pump is unavailable. This requires starting the SCS pump and aligning valves such that the SCS pump discharge is aligned to the containment spray heat exchanger. B. For seglences in which there was sufficient time available, manuallr opening valves for which the valve operators had failed Vas credited. O Amendment M 19.4-10 March 15, 1993
CESSAR nn% mon p. k In-containment Refueling Water Storage Tank (IRWST) supplies borated water to the SIS. 19.4.2.1.3 Containment Spray Cooling Following a medium LOCA, the decay heat in the core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory flows out of the RCS and into the containment via the break, thus transferring the core energy to containment. Normally, the decay heat energy is removed from containment by the containment spray system. The spray condenses the steam in containment. The hot condensate flows to the Holdup volume tank and then, when the Holdup volume tank fills, to the IRWST. Thus, the core decay heat energy has been transferred to the IRWST. The Containment spray pump takes suction from the IRWST and discharges to containment through the containment spray heat exchanger. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. If containment heat removal via the Containment Spray System is p lost, the core decay heat is retained inside the containment, and ( the containment pressure begins to increase. Eventually, the N containment pressure will increase to the point at which the , containment will fail due to overpressure. MAAP analyses show that for a large LOCA with no containment heat removal from time 0, the containment will fail at about 41 hours. At this point, the steam that was inside containment will be discharged to atmosphere via the containment breach. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere at this point. Core heat removal is still being successfully accomplished via safety injection from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate from the core due to decay heat at 48 hours ) is approximately 137 gpm. ! Figure 19.4.1-2 presents the top logic for long term containment heat removal using the containment spray system. Amendment M 19.4-13 March 15, 1993
CESSAR naincavitu 19.4.2.2 Maior Dependencies The following functional dependencies are important for Event Tree 2: A. If the IRWST is unavailable, safety injection and containment spray cooling would f ail because there is no source of cooling water. B. If SIAS f ails, there is no actuation signal for SIS equipment. Hence, safety injection would fail. C. If CSAS f ails, there is no actuation signal for CSS equipment. Hence, containment spray cooling would fail. 19.4.2.3 Operator Interfaces and Actions 19.4.2.3.1 Standard Operator Actions Since the Medium LOCA event will incur an automatic reactor trip on either thermal margin or Low Pressurizer Pressure, the Standard Post Trip Actions will be implemented by the operators. These actions require the operator to check the safety functions and implement standard remedial actions that have been devised to try to regain control of these functions. The safety functions that would be challenged are RCS inventory control, RCS pressure control, and core heat removal. Containment isolation, containment temperature and pressure control would also be challenged with less severity. The challenge to these safety functions would be indicated by alarms on the critical function monitoring section of the information system hierarchy and the annunciators on the plant monitoring and control panel and IPSO. Since the uperators would also be required to check the specific unambiguous acceptance criteria they would be required to confirm the system annunciators with the following indications: RCS Inventory control Pressurizer level not within 26% to 60% (Pressurizer level - DIAS in the control room) RCS Pressure Control Pressurizer pressure not between 1905 to 2375 psia and not trending to 2225 to 2300 psia (Pressurizer pressure -DIAS in the control room) Containment Environment Containment Pressure less than 0 i.4 psig, no containment area radiation monitors are alarming, no steam plant radiation monitors are alarming. i Amendment P 19.4-14 June 15, 1993
l CESSARHEnc- i m $ (Containment pressure - DIAS in the control room) l 1 Containment Temperature Verify containment temperature is less and Pressure than 120* and pressure is less than 0 .4 psig. (Containment temperature - DIAS in the control room) These indications would be found either on discrete indicators for that parameter, i.e. Pressurizer pretsure or in the message l associated with the critical function alarm. RCS inventory loss would be great but does not require passive safety injection tank injection. Initiation of the safety injection is enough to keep the core covered. RCS pressure control is initially lost as the RCS depressurizes because of the loss of inventory out of the break. The RCS would depressurize to typically below 300 psia. The operator would never regain RCS pressure control and the RCS would remain depressurized. Significant voiding would occur in the vessel. The operator would be directed to ensure that SIAS is initiated. Also, because of the n magnitude of the depressurization, the operator would be required (d i to trip two of the RCPs in opposite loops. once the Standard Post Trip Actions have been accomplished the operators would be directed to the diagnostic aid which would aid the operator in determining whether an optimal recovery procedure were appropriate or not. With the information gathered from the Standard Post Trip Actions the operator would be led to the LOCA recovery procedure. There are six major recovery actions that the operators are required to perform in the LOCA procedure, in order to bring the plant to cold shutdown following the accident. The first major action consists of maximizing the Safety Injection flow into the RCS and attempting to isolate the source of the leak. This step reduces the risk of core uncovery and f acilitates the recovery from the LOCA. The second and third major actions do not apply to the medium LOCA as these are done when the leak is isolable. Since a s medium LOCA is assumed to be un-isolable, only the fourth through the sixth major actions are applicable. The fourth major action involves a rapid plant cooldown using the Steam generators. Although this is of little help in a medium LOCA situation, no distinction of the size of the break is made in the operating procedure and thus this method is still employed. The fifth major recovery action is the commencement of post-LOCA Long Term Cooling (LTC). Safety Injection flow is switched, by manually aligning [T \ pumps 3 and 4, to simultaneous hot leg /DVI injection. The sixth major action is to determine whether simultaneous hot / direct vessel injection in a recirculation mode should continue. Amendment P 19.4-15 June 15, 1993
CESSAREin% - The operator actions, as stipulated in the procedures, take place in the following fashion: Since LOCAs have very similar characteristics to other events, Excess of Steam Demand Event (ESDE) and Steam Generator Tube Rupture (SGTR), the operator would be directed to the Break Identification Chart for confirmation of the diagnosis of the event. With the medium LOCA, the decision process would probably progress as following: Pressurizer Level Changing and Pressurizer pressure rapidly decreasing? l YES Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment Pressure Increasing? l YES (indicates a LOCA inside Containment). With the successful diagnosis of a LOCA inside containment, the operator would then move on to check whether the safety' injection system has actuated. This is done by checking that the pressurizer pressure has decreased to or below the SIAS setpoint of 1825 psia. If SIAS has failed, then the operator is directed to initiate SIAS manually. This is a safety check since this is one of the l contingency actions in the standard post trip actions. The next action required by the procedure, to maximize safety injection flow, would be verified by the operator. Safety injection flow rate will follow pressurizer pressure according to plant specific SIS delivery curves. In the case of the medium break LOCA safety injection tanks have not released and the pressurizer pressure would have decreased so much that safety injection system output will already be at a maximum. If any y safety injection pumps have not actuated, the operator is instructed to manually start them. l The next two steps of the LOCA procedure refer to the RCP operating strategy. The operators would already have tripped two of the RCPs, at this point. They would be required to verify that pressurizer pressure had decreased to less than 1300 psia following an SIAS, before tripping the rest of the RCPs. Analyses have shown l that continued operation of the RCPs can decreases core cooling capability, in the case of a break of this size, because of lost inventory being flushed out the break. Amendment P 19.4-16 June 15, 1993
CESSAR8E bon g \ N The next stage of the procedure requires the operator to isolate potential sources of other leaks of inventory as a precaution.- The following steps are done in order to achieve this goal: check that the safety depressurization valves are closed, check the head vents, check that the isolation of the letdown system on SIAS happened correctly, and check that all RCS sampling lines were isolated on SIAS. In the case of the systems that should have isolated automatically on SIAS, the only indication that these systems may not have isolated properly will be inherent in the switch position of the isolation valve. The operators would now be concerned with verifying that the LOCA is not outside of containment. A LOCA outside of containment would not challenge any of the containment safety functions and the operator would be directed to skip all of the procedural actions associated with the containment safety functions. The indications that a LOCA has occurred outside of containment are auxiliary building radiation alarms and unexplained increases in the auxiliary building sumps levels. The assumptions, for this scenario, is that the medium LOCA is occurring inside containment. The next set of actions, that the operators would be required to do by the LOCA procedure, is associated with the containment safety functions. First, the operator would check that CIAS had actuated
- on high containment pressure, typically 2.7 psig. If CIAS had not actuated correctly, then the operators' task would be to manually position the containment isolation valves to their accident positions. l The next step would be to ensure that, since containment pressure is above 10 psig, containment spray actuation has occurred, and at least one spray is working.
The next issue that the operators are required to address, is associated with the containment combustible gas control safety function. The evaluation associated with this situation is solely the responsibility of the Plant Technical Support Center. Various options are available to the PTSC. Decisions and actions taken are not to be evaluated in this analysis. The procedure, at this point in the progression of the accident recovery directs the operators to take one of two paths depending on whether the break has been isolated or not. This analysis pertains to a medium un-isolable LOCA. The actions that the operator would take for the next, approximately 20 steps, are associated with regaining RCS inventory control, while maintaining RCS heat removal. The goal of the operator is to establish shutdown cooling, if possible, as the means of core heat removal. In the case of a medium LOCA, Long-kO)' Term cooling is all that is achievable. The technique that the procedure requires makes use of a rapid cooldown via the steam Amendment P 19.4-17 June 15, 1993
CESSARnu% - generators. An aggressive cooldown, while holding the cooldown O' rate within Technical Specifications Limitations, improves RCS heat removal by enhancing natural circulation and reflux boiling. The RCS is assumed to have depressurized to an equilibrium pressure with the containment. In this condition, the RCS fluid is at a lower temperature than that of the steam generators. The steam generators, therefore, act as a heat source, superheating any steam in the RCS which may be flowing through the S/G to the break. By cooling down the steam generators, heat input to the RCS is reduced. For this analysis, the condenser and the turbine bypass system is available. In order to achieve this " aggressive cooldown", the operator must maintain steam generator levels in the normal band (indications and controllers found on the condensate and faed water panel) . The operators must also ensure that adequate condensate inventory is available by monitoring the condensate storage tank, and replenished from the available sources as necessary to continually provide a secondary heat sink. Examples of alternate sources of condensate are non-seismic tanks, fire mains, lake water etc. Plant specific sources should be available and this will be credited in the analysis. Since the RCS pressure is at equilibrium with containment pressure, there would be no need to depressurize the system, which is the next step indicated by the procedure. Since the RCPs are not operating, it may be necessary to evaluate restarting the RCPs. This is unlikely, however, due to the severity of the break. Since the conditions for re-start of the RCPs are not met, the operators would be monitoring for natural circulation conditions in the RCS. In order to verify that natural circulation was occurring the operator would be monitoring: A. Loop AT ( Tnot -Tcoig) less than full power AT. l B. Hot and Cold leg temperatures ( Tm and T cue DIAS indicators) O Amendment P 19.4-18 June 15, 1993
CESSAR nuirlCATION n V 19.4.3.3 Operator Interfaces and Actions 19.4.3.4.1 Standard Operator Actions 1 A reactor trip is required for this event. This qualitative I description will begin with the reactor trip. The Standard Post i Trip Actions will be implemented by the operators. These actions require the operator to check the safety functions and implement standard remedial actions that have been devised to r again control of these safety functions. The safety functions that would be challenged are RCS inventory control, RCS pressure control, and core heat removal. Containment isolation, containment temperature and pressure control, would also be challenged with less severity. The challenge to these safety functions would be indicated by alarms on the critical function monitoring section of the information system hierarchy and the annunciators on the plant monitoring and control panel, and IPSO. Since the operators would also be required to check the specific unambiguous acceptance l criteria, they would be required to confirm the system annunciators with the following indications: RCS Inventory control Pressurizer level not within 26% to 60% (Pressurizer Level - DIAS in the control i room) G RCS Pressure Control Pressurizer pressure not between 1905 to 2375 psia and not trending to 2225 to 2300 psia (Pressurizer Pressure - DIAS in the control room) Containment Environment Containment Pressure less than 0 .4 psig, no containment area radiation i d monitors are alarming and no steam plant radiation monitors are alarming. (Containment Pressure - DIAS in the control room) Containment Temperature Containment temperature is less than and Pressure 120 F and Containment pressure is less than 0 .4 psig. (Containment Temperature - DIAS in the control room) These indications would be found either, on discrete indicators for that parameter, i.e. Pressurizer pressure or in the message l associated with the critical function alarm. RCS inventory loss would be high but not high enough to require ( safety injection tank injection to be initiated by the ESFAS Amendment P 19.4-29 June 15, 1993
CESSARnn% - l system. Initiation of the safety injection is enough to keep the I core covered. RCS pressure control is initially lost as the RCS depressurizes because of the loss of inventory out of the break. The RCS would depressurize, typically, to the pressure in the steam generators. The operators would attempt to regain RCS pressure control. The operator would be directed to ensure that SIAS is initiated. Also, because of the depressurization, the operator would be required to trip two of the RCPs in opposite loops. l Once the Standard Post Trip Actions have been accomplished the operators would be directed to the diagnostic aid which would aid the operator in determining whether an optimal recovery procedure were appropriate or not. With the information gathered from the standard post trip actions, the operator would be led to the LOCA recovery procedure. There are six major recovery actions that the operator is required to perform in the LOCA procedure, in order to bring the plant to cold shutdown following the accident. The first major action consists of maximizing the Safety Injection flow into the RCS and attempting to isolate the source of the leak. This step reduces the risk of core uncovery and facilitates the recovery from the LOCA. The second and third major actions apply to the small LOCA when the leak is isolable. The second major action involves regaining control of the RCS pressure and inventory while maintaining sufficient RCS heat removal. Third major action is to perform a controlled cooldown to the SDC entry conditions. The fourth through the sixth major actions are applicable when the leak is un-isolable. The fourth major action involves a rapid plant cooldown using the steam generators. The fifth major recovery action is the commencement of post-LOCA Long Term Cooling (LTC) if I this all that is possible. The suction for the charging pumps is switched to the IRWST for boron concentration control. The sixth major action is to determine whether Shutdown Cooling operation is appropriate and if so, to initiate it. The operator actions, as stipulated in the procedures, take place in the following fashion: Since LOCAs have very similar characteristics to other events, such as Excess of Steam Demand Event (ESDE) and Steam Generator Tube Rupture (SGTR), the operator would be directed to the Break Identification Chart for confirmation of the diagnosis of the event. With a small LOCA, the decision process would probably progress as follows: Amendment P 19.4-30 June 15, 1993
CESSAR Ei% nema . l
~'
Pressurizer level changing and Pressurizer pressure rapidly decreasing? l YES Subcooling increasing or one or both Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment pressure increasing? l YES (indicates a LOCA inside Containment) With the successful diagnosis of a LOCA inside containment, the operator would then move on to check whether the safety injection system has actuated. This is done by checking that the pressurizer pressure has decreased to or below the SIAS setpoint of 1825 psia. If SIAS has failed, the operator is directed to initiate SIAS manually. This is a safety check since this is one of the l contingency actions in the standard post trip actions. The next action required by the procedure, to maximize safety n injection flow, would be achieved in order to restore RCS inventory [ ') control and subsequently RCS pressure control. Safety injection im! flow rate will follow pressurizer pressure according to plant specific SIS delivery curves. If any safety injection pumps have not actuated, then the operator is instructed to manually start them. The next two steps of the LOCA procedure refer to the RCP operating strategy. The operator would already have tripped two of the RCPs. N The operator would be required to verify that pressurizer pressure had decreased to less than 1300 psia, following an SIAS, before tripping the rest of the RCPs. ThisSince is done because it ensures a l conservative recovery approach. the operators are not required to distinguish between the sizes of breaks, and since prolonged RCP operation, for breaks in particular locations, can increase the probability of core damage, the operator would trip the remaining two RCPs. The next stage of the procedure requires the operator to isolate potential sources of other leaks of inventory as a precaution. The following steps are done in order to achieve this goal: check that the safety depressurization valves are closed, check the head vents, check that the isolation of the letdown system on SIAS happ'ned correctly, and check that all RCS sampling lines were isolated on SIAS. In the case of the systems that should have isolated automatically on SIAS, the only indication that these
'] systems may not have isolated properly will be inherent in the
( ,/ switch position of the isolation valve. Amendment P 19.4-31 June 15, 1993
CESSAR naikuios The operator would now be concerned with verifying that the LOCA is NOT outside of containment. A LOCA outside of containment would not challenge any of the containment safety functions and the operator would be directed to skip all of the procedural actions associated with the containment safety functions. The indications that the LOCA has NOT occurred inside of containment are auxiliary building radiation alarms not alarming and NO unexplained increases in the auxiliary building sumps ievels. The emphasis on verifying that the LOCA not outside containment is done to minimize the possibility of mistakenly assuming the LOCA is outside containment. The next set of actions, the operator would be required to do by the LOCA procedure, is associated with the containment safety functions. First, the operator would check that CIAS had initiated correctly on the SIAS initiation. If this had not occurred, then the operator would check if containment pressure were high, typically 2.7 psig. If CIAS had not actuated correctly and containment pressure were high, then the operators' task would be to manually position the containment isolation valves to their accident positions. l The procedure, at this point in the progression of the accident recovery directs the operator to take one of two paths depending on whether the break has been isolated or not. If the LOCA had been isolated when the other isolation actions were being performed the operator would proceed along the following lines: The operators would be constantly evaluating, as the cooldown and depressurization progresses, whether they should stop or throttle F the safety injection pumps. The safety injection system could be stopped if the all of the following were true; A. RCS subcooling at least 20 F based in average Core Exit Temperature Pressurizer Level is greater than 30% (i.e. covering the heaters) and not decreasing B. At least one steam generator is available for removing heat from the RCS RVLMS indicates a minimum level at the top of the hot leg nozzles Making the assumption that the safety injection system would have been running long enough that these criteria are met, the operators would move on to restoring the pressurizer level to within 10%-70% making use of the CVCS makeup process controller. If at any point the above criteria, f or cessation of the SI pumps, are violated the safety injection pumps would be restarted. With the pressurizer level restored, the operators would proceed to depressurize the RCS to approximately 300 psia using one of the following; Amendment P 19.4-32 June 15, 1993
CESSARHa% - p A. Pressurizer Sprays l B. Control of Charging and Letdown j Throughout the cooldown, the operator will be monitoring pressurizer pressure to make sure that it is being maintained l within the Post Accident P-T limits or that the cooldown is less than 100oF/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization sti)1 exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The operators would be maintaining steam generator levels in the normal band by using main of auxiliary feedwater. They would also l be monitoring the available condensate and replenishing it from other available sources. The next step, the operator would perform, is boration of the plant to maintain shutdown margin within Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the ( operator would borate the RCS to the minimum shutdown margin < corresponding to T c. Then during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The next actions the operators would take would be to perform the controlled cooldown within Technical Specifications. The preferred method of cooling would be to use the turbine bypass system and the condenser. This is done by maintaining steam generator levels and making use of the natural circulation, driven by the density dif ference between the steam generator and the reactor vessel. The operators would monitor single phase natural circulation by the following conditions: > A. Loop AT(Tact -Tcata) less than full power AT. l B. Hot and Cold leg temperatures (Tact and Tccia DIAS indicators) C. RCS subcooling is at least 20*F based on average Core Exit Temperature.
) No abnormal dif ferences between Tnct RTDs and average Core Exit Q D.
Temperature. Amendment P 19.4-33 June 15, 1993 J
CESSARHL bu During this phase of the recovery the automatic operation of certain safeguard systems is undesirable. Therefore the operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 30% and constant or increasing. l B. RCS subcooling should be at least 20*F C. RCS pressure should be at or below the shutdown cooling entry pressure of 300 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 300 F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety J Injection system for Direct vessel injection and initiate shutdown l
> cooling.
The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than Charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel t D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling and the LOCA optimal recovery procedure is exited. In the case of an un-isolable small LOCA the following actions would be taken: The actions that the operator would take for the next, approximately, 20 steps are associated with regaining RCS inventory Amendment P 19.4-34 June 15, 1993
CESSARnn% - o V control while maintaining RCS heat removal. The goal of the operator is to establish shutdown cooling, if possible, as the means of core heat removal, in the case of a small LOCA. The technique that the procedure requires is makes use of a rapid cooldown via the steam generators. An aggressive cooldown, while holding the cooldown rate within Technical Specifications Limitations, improves RCS neat removal by enhancing natural circulation and reflux boiling. The RCS is assumed to have depressurized to an equilibrium pressure with the steam generators. The aggressive cooldown hastens depressurization and allows for higher safety injection flow which aids in RCS inventory control. For this analysis the condenser and the turbine bypass system are not available, and the atmospheric dump valves are utilized instead. In order to achieve this " aggressive cooldown", the operators must maintain steam generator levels in the normal band. The operators l must also ensure that adequate condensate inventory is available by monitoring the condensate storage tank, and replenished from the available sources as necessary to continually provide a secondary heat sink. Examples of alternate sources of condensate are non-seismic tanks, fire mains, lake water etc. Plant specific sources should be available and this will be credited in the p analysis. I \ The next set of actions the operators would be equired to perform involve the controlled cooldown and depressurization of the RCS to ) shutdown cooling entry conditions. The operators would achieve this by using one of the following methods: A. Pressurizer Sprays l B. Control of Charging and Letdown l C. Throttling Safety Injection l Throughout the cooldown, the operator will be monitoring pressurizer pressure to make sure that it is being maintained l within the Post Accident P-T limits or that the cooldown is less than 100 F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: l A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l , l C. If overpressurization still exists and is caused by SI flow or charging flow, then throttle or stop the SI pumps and manually O control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l Amendment P l 19.4-35 June 15, 1993
CESSAR EnWicarian Assuming the conditions for re-start of the RCPs are not met, the 9 operators would be monitoring for natural circulation conditions in the RCS. In order to verify that natural circulation was occurring the operator would be monitoring: A. Loop AT(Tut - T(31e ) less than full power AT. l B. Hot and Cold leg temperatures (Tut and Tbou DIAS indicators) C. RCS subcooling is at least 20*F based on average Core Exit Temperature. D. No abnormal dif ferences between Tut RTDs and average Core Exit Temperature. Since RCS inventory and pressure are being controlled, the operators will be able to make use of single phase natural circulation. The operators will be using the same heat transport path as used in forced circulation cooling, with the liquid density between the steam generators and the reactor vessel providing the driving flow. At this point, within one hour af ter the start of the accident, the operators would be realigning the charging pumps from the concentrated boron source to the IRWST, in order to help limit f build up of excessive boric acid in the core. l The operators would now begin evaluating the possibility of entering shutdown cooling conditions. The criteria that need to met are: A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20'F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for Direct vessel injection and initiate shutdown l cooling. Amendment P 19.4-36 June 15, 1993
(,EEfi5s/ Lit 8larificari:n
/
)
~
The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than Charging flow. l B. Prcssurizer level increasing significantly more than expected while operating pressurizer spray. j C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling and P.he LOCA optimal recovery procedure is exited. 19.4.3.3.2 Modeled Operator Actions Based on the description above, the following actions were modeled in the Small LOCA event tree and associated fault tree models: A. Failure to verify that the SIAS was generated, and to manually initiate the SIAS signal at the ESF panel if the signal was fx not automatically generated.
\ 4
( xI B. Failure to initiate an aggressive secondary cooldown to depressurize the RCS so that the SCS pumps could be used for injection. C. Failure to align the SCS system for injection operation. D. Failure to initiate Shutdown Cooling. E. Failure to align the SCS system for long term cooling. F. Failure to align the condensate storage tanks to the emergency feedwater storage tanks for long term cooling using the emergency feedwater system. G. Failure to initiate feed and bleed operation. H. Failure to align the CVCS to the IRWST and refill the IRWST following containment failure due to failure of long term containment heat removal. I. Failure to bleed and restart safety injection pumps following containment failure due to loss of containment heat removal. J. Pre-existing maintenance errors were included in the system /,,i fault tree models as appropriate. \ / N.s Amendment P 19.4-37 June 15, 1993
CESSAR Mnificaries 19.4.3.4 Maior Recovery Actions The following major recovery actions were addressed in the recovery analysis for the Small LOCA Event Sequences: A. In the later stages of a Small LOCA accident, for the sequences wherein the power to the pumps has been lost due to loss of offsite power and subsequent operating failure of the diesel generators, power to the pumps may be restored by either aligning the standby alternate power source or restoring the offsite power. Accordingly, power to the SIS pumps, SCS pumps and motor-driven EFW pumps was restored. B. For sequences in which there was sufficient time available, manually opening valves for which the valve operators had failed was credited. Y 0 0 Amendment M 19.4-38 March 15, 1993 l I
CESSAR nai?tCATCN 7 1 O water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a failure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time M 0, the containment will fail at about 41 hours. At this point, the steam that was inside containment will be discharged to atmosphere l ( via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has p been reestablished, the operators will have to dispatch an , equipment operator to bleed the injection pumps so that they can be
\ restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur.
The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Bor.c Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for the element, " Failure of Long Term Containment l j Heat Removal Via IRWST Cooling" is presented in Figure 19.4.3-3. Core damage results if containment fails due to f ailure to cool the
._s IRWST inventory and core cooling is not maintained after l
( ) containment failure. The success criteria for IRWST cooling are j (/ that at least one CS pump deliver flow from the IRWST through its j containment spray heat exchanger to the containment spray header i l 1 r Amendment P ) 19.4-49 June 15, 1993 ! j
CESSAR nai"icarios and that the decay heat energy be transferred to the Component O Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire , imp . The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to y- provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.4.4 M._ajor Dependencies The following functional dependencies are displayed on Event Tree 4: A. If Safety Injection System (SIS) is not available and Aggressive Secondary Cooldown cannot be performed, there is insufficient time to stabilize the plant before core uncovery occurs. B. If the SIS fails, both steam generators must be used for secondary heat removal in order to depressurize the primary system to establish residual heat removal entry conditions. In other words, Aggressive Secondary Cooldown is required to establish residual heat removal entry conditions. C. If the RCS is depressurized for SCS injection due to the unavailability of the SIS, pressurizer spray is not needed for RCS pressure control because RCS pressure and temperature will be within residual heat removal entry conditions limits. (Note: during the cooldown some voiding may occur but the core will remain covered.) D. If emergency feedwater is not available or the Long-Term Decay Heat Removal fails via the SCS System, no success path for decay heat removal is available, therefore, the Safety Depressurization (Bleed) must be used to remove heat from the RCS. E. When Safety Injection and Safety Depressurization are used, the IRWST must be available and successfully cooled to prevent containment damage. O Amendment M 19.4-50 March 15, 1993
CESSARn!Liw F. If there is an unisolable leak to atmosphere from the ruptured generator, secondary heat removal must be maintained to prevent core uncovery. 19.4.4.5 Operator Interfaces and Actions 19.4.4.5.1 Standard Operator Actions After the reactor trip on low thermal margin or low pressurizer pressure, the operators would implement Standard Post Trip Actions. l 'N Safety functions that would be challenged by this are RCS inventory control, RCS pressure control and containment isolation. RCS l inventory and pressure control is challenged because of the loss of inventory through the break since there is a differential in pressure between the steam generators and the RCS. Also containment isolation would be affected since the reactor coolant boundary has been broken and control of the spread of contamination is provided by the secondary plant alignment and isolation. The operator actions that would be taken in the Standard Post Trip Actions are: A. Verify the proper operation of the pressurizer level control p system. l B. Take manual control of the charging and letdown system to restore pressurizer level. l C. Take control of the pressurizer heaters and sprays to restore and maintain pressurizer pressure. l D. Ensure SIAS initiated when pressure decreases below 1825 psia. E. Trip two RCPs in opposite loops. F. Verify steam plant radiation levels are at or above the alarm setpoint. l With the completion of the Standard Post Trip Actions, the operators would move on to the diagnostic aid and the Break Identification Chart. The diagnostic aid would lead the operators, based on the information gathered during the Standard Post Trip Actions, to identify a Steam Generator Tube Rupture (SGTR). The Break Identification chart would ask the following questions, and get the following answers: Pressurizer level changing and Pressurizer pressure rapidly decreasing? l [~'} YES U Amendment P 19.4-51 June 15, 1993 l
CESSAR EnGema Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment pressure increasing? l NO F Activity in Steam Plant? l YES (indicates a Steam Generator Tube Rupture) With the Steam Generator Tube Rupture identified the operators will select the SGTR optimal recovery procedure. The actions, as stipulated in the procedures, will occur in the following fashion. Since an SIAS had occurred on low pressurizer presLure, the operators would be directed to maximize the charging flow and SI flow. This is done by starting all idle safety injection pumps. The operators would be aware that, in this situation, maximization of charging and safety injection can result in excess RCS inventory and possibly filling the pressurizer to a solid condition. The l operators would be prepared to throttle or terminate the SIS pumps. The next concern of the operators would be to evaluate the RCP operating strategy. The generic operating strategy for all depressurization events determined to be LOCAs, is to trip the remaining two RCPs, but allows the continued operation of two RCPs (in opposite loops) for diagnosed, non-LOCA, depressurization events. In the case of the SGTR, if the operators trip the other two RCPs, through miss diagnosis or some other error, this will not be a catastrophic error as is the most conservative recovery action. The operators are required by the procedure to monitor the RCP operating requirements, and trip any that do not satisfy these limits. l The operators would now attempt to cool down the RCS to 525'F so l that when the affected steam generator is isolated, the main steam safety valves will not lift. Since the isolated steam generator will be at essentially T 3 ,t, since it will no longer be a heat sink, the RCS must be at a temperature which will not correspond to a pressure that will lift the main steam safety valves. This cooldown is achieved by feeding the steam generators with main feedwater and dumping the steam to the condenser via the turbine bypass control system. A less desirable, but optional, destination for the steam is the Atmospheric Dump Valves. This step is procedurally presented before the location, and isolation, of the affected steam generator, as it would be necessarily performed then ' if natural circulation were being used. If there is forced circulation, this step is much easier and would be performed in Amendment P 19.4-52 June 15, 1993
CESSARna% - N./ parallel with the location and isolation of the affected Steam Generator. Steam generator levels are maintained within the normal band, by the operators, by using main or auxiliary feedwater. This is done l to ensure an adequate heat sink for removing heat from the RCS. The damaged steam generator is located by performing the following actions: A. Sampling the steam generators for activity, B. Monitoring the main steam piping for activity, and C. Monitoring the steam generator levels. l The steam generator with higher activity, higher radiation levels or increasing water levels would be isolated. This is an attempt to re-establish the containment isolation safety function. However, should the pressure in an isolated steam generator approach the lift setpoint for the MSSVs it is desirable from the perspective of positive operator control that the ADV open first. The operator would accomplish this by raising the ADV manually at w 950 psia. I The operators would isolate the affected steam generator in the following manner: A. Close the main steam isolation valve. l B. Close or verify that closed, the main steam isolation bypass valve. l C. Close the main feedwater isolation valve. l D. Isolate the steam generator blowdown. l E. Isolate the vents, drains, exhausts, and bleedoffs for the steam system. l Once this is done, the operators would verify that the correct steam generator has been isolated by checking radiation indications, sampling for activity and noting any possible increase in the isolated steam generator level. l ( The next concern for the operators would be to regain RCS pressure l control. This will provide subcooling to support the core heat l removal processes. Additionally it will minimize the pressure differential between the steam generator and the RCS which will minimize the leakage. The depressurization is achieved by using ( the main pressurizer spray or the Reactor Coolant Gas Vent System. The associated cooldown is achieved by using the unaffected steam l Amendment P 19.4-53 June 15, 1993
1 CESSAR na"lCATION i i i i generator and the turbine bypass system. If the turbine bypass O ' system is unavailable the atmospheric dump valves may be utilized. 1 The potential exists for flow of the reactor coolant via the tabe rupture into the isolated steam generator, as long as the pressure in the RCS is above that in the steam generator. The steam l generator steam space may fill, and the main steam piping to the MSIV may fill. Draining the steam generator via the blowdown system or steaming the generator to the condenser via the turbine bypass system will solve this problem. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that it is being maintained l within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The operators would be constantly evaluating, as the cooldown and depressurization progresses, whether they should stop or throttle the safety injection pumps. The safety injection system could be stopped if the all of the following were true; A. RCS subcooling at least 20'F based in average Core Exit Temperature Pressurizer Level is greater than 30% (i.e. covering the heaters) and not decreasing B. At least one steam generator is available for removing heat from the RCS RVLMS indicates a minimum level at the top of the hot leg nozzles. At this point in the accident, the RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operator would borate the RCS to the minimum shutdown margin corresponding to T.c Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. Amendment P 19.4-54 June 15, 1993
CESSAR !ancmon (~hi r V The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, fire mains, lake water supplies, portable tanks, etc. The procedures would now require the operators to consider the cooling and depressurization of the affected steam generator. Although heat from the RCS is being removed by the other steam generator, the affected steam generator will remain at high temperature and pressure. This is because of thermal stratification of the secondary water because without boiling and recirculation, the fluid is not well mixed. Since the goal of depressurization of the RCS is to reach the pressure of the steam generator, the pressure cannot then continue to shutdown cooling entry conditions until the affect steam generators pressure is reduced. This is achieved by one of the following methods: A. Feed and Bleed using main or auxiliary feedwater and the blowdown system. This is, however, slow, and if the leak rate is comparable to or greater than the blowdown system's flow capacity, this method would not be effective. B. Short duration steaming of the isolated steam generator will O rapidly depressurize it. If the ADVs are used this will result in radiological release, however this can be minimized by steaming to the condenser, while maintaining the SG level above the U-tubes. At this point in the accident the operators would be required to carry-out some activity surveys for the secondary side to access the amount of contamination that has occurred. Area that would be sampled are condensate, and all connecting systems, turbine building sumps, the turbine building ventilation system, auxiliary building ventilation system and other applicable radiation monitors. During this phase of the recovery the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This o. valuation would continue throughout the depressurization and cooldown until they are met; d Amendment M 19.4-55 March 15, 1993
CESSAR U.%"icuiu. A. Pressurizer level control should be established (cleared or O clearing RCS pressure control alarms) and verified by a level greater then 30% and constant or increasing RCS subcoolingl should be at least 20*F. B. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l C. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350'F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for Direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than Charging flow. l B. Pressurizer level increasing mignificantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling and the SGTR optimal recovery procedure is exited. 19.4.4.5.2 Modeled Operator Actions Based on the description above, the following actions were modeled in the Steam Generator Tube Rupture event tree and associated fault tree models: A. Failure to verify that the SIAS was generated, and tv manually initiate the SIAS signal at the ESF panel if the signal was not automatically generated. B. Failure to initiate an aggressive secondary cooldown to depressurize the RCS so that the SCS pumps could be used for injection. C. Failure to align the SCS system for injection operation. D. Failure to throttle SI pumps for RCS pressure control Amendment P 19.4-56 June 15, 1993
i ( EESifi/Liti!!n?'icari:n 1
/- x \
l (_-J E. Failure to actuate pressurizer spray flow for RCS pressure control F. Failure to open the RCGVS Valves for RCS pressure control G. Failure to initiate Shutdown Cooling. H. Failure to align the SCS system for long term cooling I. Failure to align CVCS to replenish the IRWST inventory following an SGTR J. Failure to align the condensate storage tanks to the emergency feedwater storage tanks for long term cooling using the emergency feedwater syctem. K. Failure to initiate feed and bleed operation. L. Failure to align the CVCS to the IRWST and refill the IRWST following containment failure due to failure of long term containment heat removal. M. Failure to bleed and restart safety injection pumps following containment failure due to loss of containment heat removal. Ch 's_s N. Failure to restart the EFW system to use for long term decay heat removal (SCS system unavailable). O. Pre-existing maintenance errors were included in the system fault tree models as appropriate. 19.4.4.6 Maior Recovery Actions The following major recovery actions were addressed in the recovery analysis for the steam generator tube rupture sequences. A. In the later stages of a SGTR event, for the sequences wherein the power to the pumps has been lost due to loss of offsite power and subsequent operating failure of the diesel generators, power to the pumps may be restored by either aligning the standby alternate power source or restoring the of fsite power. Accordingly, power to the SIS pumps, SCS pumps and motor-driven EFW pumps was restored. B. For sequences in which there was sufficient time available, manually opening valves for which the valve operators had failed was credited. V Amendment M 19.4-57 March 15, 1993
CESSAR !!=ncum, O THIS PAGE INTENTIONALLY BLANK l l
" Amendment P 19.4-58 June 15, 1993
CESSARnahou r \ pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will fail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow f rom the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The heldup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boiloff rate from the core due to decay heat at~ 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal via IRWST cooling is presented in Figure 19.4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that s train may be used as a backup. The System 80+ design includes a Amendment P 19.4-63 June 15, 1993
CESSARnn% e standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.5.2 Maior Dependencies The following functional dependencies are displayed on Event Tree 5: A. If emergency feedwater is not available or the Long-Term Decay Heat Removal fails, no success path for decay heat removal is available and, therefore, Safety Depressurization (Bleed) must be used to remove heat from the RCS. B. When Safety Injection and Safety Depressurization (Feed and Bleed) is used, the IRWST must be available and successfully cooled to prevent containment damage. 19.4.5.3 Operator Actions and Interfaces 19.4.5.3.1 Standard Operator Actions The large secondary side break, either inside or outside containment, is characterized as an Excess of Steam Demand Event. This is any event that leads to an unexpected, rapid increase in steam generator steam flow or loss of steam generator inventory that requires and/or results in a reactor trip. The following parameter changes usually characterize an ESDE: A. Increased steam flow from the steam generators. l B. Increasing steam generator pressure and water level. l C. Decreasing RCS average temperature causing a decrease in pressurizer pressure and level. l D. Reactor trip cased by thermal margin, high core power, low steam generator level, low pressurizer level, low steam generator pressure, or high containment pressure depending in the size and location of the break. l E. SIAS may be generated from low pressurizer pressure or high containment pressure (if the ESDE is within containment). l Amendment P 19.4-64 June 15, 1993
CESSAREnecmw U F. Possible increase in containment pressure, temperature, humidity, and/or containment sump level. l G. Possible increase in containment hydrogen concentration due to corrosion of zinc and aluminum by the containment spray system. l The safety functions that will be affected are reactivity control, RCS heat removal, and containment temperature and pressure for events inside containment. l A significantly large break usually results in excess steam flow on the secondary side, which will lead to a reactor trip. The decrease in reactor heat input due to the trip, combined with the increase in steam generator heat removal due to the excess steam flow, rapidly reduces RCS temperature (Tact and Tcow temperature). A reduction in temperature causes an apparent inventory decrease due to volume contraction, a system pressure decrease and possible RCS voiding. The inventory shrinkage will usually cause an SIAS if the pressurizer empties. This shrinkage will be reversed by subsequent RCS heatup (if heat removal is not established with the intact steam generator) and/or the safety injection system and charging pumps. If the break can be isolated, either manually or automatically, the ESDE is essentially over. For the situation g where the break cannot be isolated, the operators lose control of N the affected steam generator and must isolate that steam generator and boil it dry. It is important to establish heat removal capability, via the unaffected steam generator prior to boiling the steam generator dry. As the steam generator pressure decreases due to energy loss, MSIS will occur and isolate the main steam line from the steam generator. If the event is occurring down stream of the MSIVs, then the break will be isolated. There are five major recovery actions to carry the plant to SDC entry conditions. The first major action consists of stopping the uncontrolled cooldown of the RCS. If the break is upstream of the MSIVs, this is accomplished by isolation of the affected steam generator. Feedwater is supplied only to the unaffected steam generator as continued feeding of the affected steam generator will continue the RCS depressurization. This action also reduces the risk of radioactive relief from the plant. The second major action is to stabilize the RCS pressure and temperature. It may not be necessary to cooldown the plant if it can be maintained in a stable condition while the break is repaired. The third action, therefore, is to evaluate the necessity of a plant cooldown. The factors affecting this decision include the amount of condensate available, the status / availability of auxiliary systems, the extent p of the damage and the time required for repair. If the plant can be maintained at a stable condition, then the fourth action is to \ do just that. While the plant is in this condition it is necessary i Amendment P l 19.4-65 June 15, 1993 ]
CESSAR EnnflCATl3N to keep evaluating and be prepared for a cooldown if conditions warrant. The fifth major action consists of cooling the plant on either forced circulation or on natural circulation in the RCS, all the way to SDC entry conditions. This cooldown is performed using the unaffected steam generator if the break is upstream of the MSIVs or both steam generators and the ADVs of the break is down stream of the MSIVs. The operators would first, after the trip, perform the Standard Post Trip Actions associated with the safety functions that are not being maintained. The actions taken would be: A. Verify the proper operation of the pressurizer level control system. l B. Take manual control of the charging and letdown system to restore pressurizer level. l C. Take control of the pressurizer heaters and sprays to restore and maintain pressurizer pressure. l D. Ensure SIAS initiated when pressure decreases below 1825 psia. l E. Trip two RCPs in opposite loops. l Upon entering the ESDE optimal recovery procedure, the operators would be required to verify the diagnosis of the ESDE by means of the Break Identification Chart. The verification would proceed as follows: Pressurizer level changing and Pressurizer pressure rapidly decreasing? I YES Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? YES (indicates an Excess, Steam Demand Event) Containment pressure increasing? YES (ESDE in containment), or NO (ESDE outside containment) The next operator action would be to reverify the initiation of SIAS or to check that if the depressurization had progressed far enough that SIAS had initiated correctly. If SIAS had not initiated, and it should have, the operators would be directed to initiate it manually. ' I i Amendment P ! 19.4-66 June 15, 1993 j
CESSARnna m o U Since the ESDE may reduce the temperature in the RCS by as much as 250*F, and this temperature reduction could bring the reactor back to criticality, safety injection and charging must be maximize in order to borate as much as possible. The boric acid is needed to mitigate this possibility. The operators would also be monitoring for the possibility of excess RCS inventory, and would terminate the SI pumps if the criteria are met. Next the operators would be evaluating the RCP operating strategy. Given that two RCPs had already been tripped, the operators would just be verifying the trips. It is important to note that the most conservative action, tripping all four RCPs, would present difficulties in performing the normal plant cooldown. The operators would be monitoring the operating limits of the RCPs throughout the optimal recovery procedure. The operators would now move on to determining the affected steam generator by comparing the following parameters: A. Steam Generator pressures, B. RCS cold leg temperatures, 7-~s C. Steam Generator levels. L These dif ferences will be more pronounced af ter MSIS actuation. If the break is downstream of the MSIVs, and MSIS occurs, both steam generator pressures and loop temperatures should approach-approximately the same values and then start to increase following MSIV closure. At this point the operators will be able to evaluate whether the MSIVs (MSIS) stopped the ESDE, since neither SG will be "affected". If this is not the case then the operators will be required to attempt to isolate the affected steam generator. The operators would isolate the af fected steam generator in the following manner: A. Close the main steam isolation valve. l B. Close or verify that closed, the main steam isolation bypass valve. l C. Close the main feedwater isolation valve. l D. Isolate the steam generator blowdown. l E. Isolate the vents, drains, exhausts, and bleedoffs for the ; steam system. l l d O If these actions cannot be achieved in the control room, they may be performed locally. j Amendment P 19.4-67 June 15, 1993 ) l
CESSAR Einhos The un-isolated steam generator's level is maintained, or restored, to the normal band using main or auxiliary feedwater. This ensures a heat sink for removing heat from the RCS. The next task the operators are required to perform, by the procedure, is to stabilize the RCS by controlled steaming of the unaffected steam generator. This is done before the isolated steam generator dries out because if this is not done the RCS temperature will begin to rise. The controlled heat removal is achieved by dumping the steam through the turbine bypass system if the break is upstream of the MSIVs. If the break is not upstream of the MSIVs then the atmospheric dump valves must be used. The operators would be constantly evaluating whether they should stop or throttle the safety injection pumps. The safety injection system could be stopped if the all of the following were true; A. RCS subcooling at least 20*F based in average Core Exit Temperature Pressurizer Level is greater than 26% (i.e. covering the heaters) and not decreasing B. At least one steam generator is available for removing heat from the RCS RVLMS indicates a minimum level at the top of the hot leg nozzles If the above criteria are not maintained at any point then the operators would restart the appropriate SI pumps and full SIS flow would be restored. The operator would now attempt to regain RCS level control by restoring and maintaining pressurizer level to between 26% and 60%. This also allows the operators to regain RCS pressure control as the water level of the pressurizer, is above the heaters, 26%, which gives them the control. A pressurizer level of 26% to 60% with a saturated bubble will be the goal. At this point in the recovery the operators should decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. J At this point in the accident, the RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operator would borate the RCS to the minimum shutdown margin corresponding to T.c Then, during the controlled cooldown phase, 1 l Amendment M 19.4-68 March 15, 1993
CESSAR !!*La m U as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, fire mains, lake water supplies, portable tanks, b etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20*F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling sistem entry temperature of 350*F. l l Amendment M j 19.4-69 March 15, 1993 l l 1
CESSAR EnWicaritu The activity level of the RCS inventory must be determined, in O order to evaluate the dangers associated with routing the fluid outside containmant. l If these criteria are met, then the operator would align the Safety Injection system for Direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than Charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling and the ESDE optimal recovery procedure is exited. 19.4.5.3.2 Modeled Operator Actions Based on the description above, the following operator actions were modeled in the in the Large Secondary Side Break event tree and associated fault tree models: A. Failure to verify that the SIAS was generated, and to manually initiate the SIAS signal at the ESF panel if the signal was not automatically generated. B. Failure to verify that the AFAS was generated, and to manually generate the AFAS signal at the ESF panel if the signal was not automatically generated. C. Failure to initiate shutdown cooling. D. Failure to align the SCS system for long-term cooling. E. Failure to restart the EFW system for long term cooling (SCS system unavailable). F. Failure to align the condensate storage tanks to the emergency feedwater storage tanks for long term cooling using the emergency feedwater system. G. Failure to initiate feed and bleed operation. Amendment P 19.4-70 June 15, 1993
CESSAR naincmou I i ( H. Failure to align the CVCS to the IRWST and refill the IRWST i l following containment failure due to failure of long term l containment heat removal. I. Failure to bleed and restart safety injection pumps following containment failure due to loss of containment heat removal. J. Pre-existing maintenance errors were included in the system fault tree models as appropriate. 19.4.5.4 Maior Recovery Actions The following major recovery actions were addressed in the recovery analysis for the large secondary break sequences: A. In the later stagec of an LSSB event, for the sequences wherein the power to the pumps has been lost due to loss of offsite power and subsequent operating failure of the diesel generators, power to the pumps may be restored by either aligning the standby alternate power source or restoring the offsite power. Accordingly, power to the SIS pumps and motor-driven EFW pumps was restored. B. For sequences in which there was sufficient time available, O manually opening valves for which the valve operators had failed was credited. Amendnent M 19.4-71 March 15, 1993 1
CESSARnehnu O THIS PAGE INTENTIONALLY BLANK O Amendment M 19.4-72 March 15, 1993
l CESSAR naiPICATION O Safety Depressurization valve path must be available in conjunction with one SIS pump. 19.4.6.1.5 Bafety Injection (Feed) If the long-term decay heat removal fails via either the SCS System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criteria for this element are that one sis pump must be available in conjunction with one safety Depressurization valve path and water supply from the IRWST must be available to that SIS pump. 19.4.6.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" \ cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then diccharged to the IRWST via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a f ailure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. i If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure ; will increase to the point at which the containment will fail due ; to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful ( feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, the l Amendment P 19.4-75 June 15, 1993 . 1
CESSARnahuou steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs)or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The beiloff rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in figure 4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this Amendment M 19.4-76 March 15, 1993
CESSAR Eniincmon ,/ ~ t analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.6.2 Major Dependencies The following functional dependencies are important for Event Tree 6: A. If emergency feedwater is not available or the Long-Term Decay Heat Removal fails, no success path for decay heat removal is available and, theref ore, Safety Depressurization (Bleed) must be used to remove heat from the RCS, B. When Safety Injection and Safety Depressurization (Feed and Bleed) is used, the IRWST must be available and successfully cooled for the Feed and Bleed to succeed. 19.4.6.3 Operator Actions and Interfaces 19.4.6.3.1 Standard Operator Actions Since the transient, as defined, causes a reactor trip, the () /"N operators will perform Standard Post Trip Actions. The loss of main feedwater would cause the downward trend of steam generator level till emergency feedwater is activated on low-low steam generator level. No safety functions, that are checked by the Standard Post Trip Actions, should be challenged. This would lead the operators to implement the uncomplicated reactor trip optimal recovery procedure. The first actions are to verify that an uncomplicated. reactor trip has occurred. First the operators check that pressurizer level has not decrease below 10% nor increased above 70%. The pressurizer level control system should be controlling the pressurizer level and trending up to 26% to 60%. If this is not the cause then the operator would be instructed to take control of charging and letdown to control the pressurizer level to this range. The next issue, for the operators, would be to verify that the pressurizer heaters and sprays were controlling the pressurizer pressure within 1905 to 2375 psia. The availability of the heaters would be dependent on the pressurizer level being above the heater cutoff point of 26%. If there are no other complications then pressurizer pressure will be trending to 2225 to 2300 psia. Satisfying the post accident pressure temperature limits will ensure that brittle fracture limits are not exceeded, RCP NPSH and RCS subcooling requirements are not exceeded and the RCS cooldown ( / rate or upper subcooling limit are not exceeded. Amendment M 19.4-77 March 15, 1993
CESSAR nairlCATION RCS T m will be controlled at 525'F to 535'F by the turbine bypass system. If condenser vacuum is lost, the turbine bypass system is not available, or the MSIVs have closed then the atmospheric dump valves must be used to control RCS temperature. This allows the operators to verify adequate decay heat removal. While the main feedwater is assumed to have been lost, emergency feedwater would be actuated by ESFAS. Therefore steam generator levels should be restored and be maintained in the normal band. Adequate heat removal will be maintained if at least one steam generator is available for removing heat. At this point in the recovery the operators would decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borate the RCS to the minimum shutdown margin corresponding to T. c Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the ; operators and replenished, as necessary, from the available i sources. Examples of alternate sources of condensate inventory are Amendment P 19.4-78 June 15, 1993
CESSAR n%"icarien
.m nonseismic tanks, fire mains, lake water supplies, portable tanks, etc.
During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the- RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20*F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l n D. RCS hot leg temperature should be at or below the shutdown (d i cooling system entry temperature of 350"F. The activity level of the RCS inventory must be determined, in l order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. A Amendment P
.19.4-79 June 15, 1993
CESSARMEnces If long-term decay heat removal fails either by the shutdown O cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this .oint the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. 19.4.6.3.2 Modeled Operator Actions Based on the description above, the following operator actions were modeled in the Loss of Feedwater event tree and associated fault tree models: A. Failure to verify that the AFAS was generated, and to manually generate the AFAS signal at the ESF panel if the signal was not automatically generated. B. Failure to initiate shutdown cooling. C. Failure to align the SCS system for long-term cooling. D. Failure to restart the EFW system for long term cooling (SCS system unavailable). O Amendment M 19.4-80 March 15, 1993 l l
CESSARnnL - ( V 19.4.7.1.4 Safety Depressurization (Bleed) If the long-term decay heat removal fails via either the SCS System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criterion for this element is that one Safety Depressurization valve path must be available in conjunction with one SIS pump. 19.4.7.1.5 Safety Injection (Feed) If the long-term decay heat removal fails via either the SCS System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrit? Therefore, the success criteria for this element are that one Sls pump must deliver water from the IRWST to the RCS and one Safety Depressurization valve path must be available. 19.4.7.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via "Fced and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then discharged to the IRWST via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is f finally rejected to the Ultimate Heat Sink via the Service Water ( System. In the event of a f ailure in the CSS, the Shutdown Cooling Amendment M 19.4-85 March 15, 1993
CESSARnaNow System (SCS) pumps and/or heat exchangers can be aligned to provide O IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, thel steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in Figure 19.4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS Amendment P 19.4-86 June 15, 1993
CESSARininc-( can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as. a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.7.2 Maior Dependencies The following functional dependencies are important for Event Tree 7: A. If emergency feedwater is not available, no success path for steam removal is available, therefore, the Safety Depressurization (Bleed) must be used to remove heat from the
-s RCS.
{ L B. When Feed and Bleed are used, the IRWST must be available and successfully cooled for the Feed and Bleed process to succeed. 19.4.7.3 Operator Actions and Interfaces 19.4.7.3.1 Standard Operator Actions Since the transient, as defined, causes a reactor trip, the operators will perform Standard Post Trip Actions. The ramping down of main feedwater will cause the downward trend of steam generator level till Startup feedwater provides a low pressure source of feed on low steam generator level. No safety functions, that are checked by the Standard Post Trip Actions, should be challenged. This would lead the operators to implement the uncomplicated reactor trip optimal recovery procedure. The first actions are to verify that an uncomplicated reactor trip has occurred. First the operators check that pressurizer level has not decrease below 10% nor increased above 70%. The pressurizer level control system should be controlling the pressurizer level and trending up to 26% to 60%. If this is not the cause then the operator would be instructed to take control of charging and letdown to control the pressurizer level to this range. A Amendment M 19.4-87 March 15, 1993 , I
CESSAR nancuion The next issue, for the operators, would be to verify that the O pressurizer heaters and sprays were controlling the pressurizer pressure within 1905 to 2375 psia. The availability of the heaters would be dependent on the pressurizer level being above the heater cutoff point of 26%. If there are no other complications then pressurizer pressure will be trending to 2225 to 2300 psia. Satisfying the post accident pressure temperature limits will ensure that brittle fracture limits are not exceeded, RCP NPSH and RCS subcooling requirements are not exceeded and the RCS cooldown rate or upper subcooling limit are not exceeded. RCS T m will be controlled at 525 F to 535'F by the turbine bypass system. If condenser vacuum is lost, the turbine bypass system is not available, or the MSIVs have closed then the atmospheric dump valves must be used to control RCS temperature. This allows the operators to verify adequate decay heat removal. If Startup feedwater is lost, emergency feedwater would be actuated by ESFAS. Therefore steam generator levels should be restored and be maintained in the normal band. Adequate heat removal will be maintained if at least one steam generator is available for removing heat. At this point in the recovery the operators would decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borate the RCS to the minimum shutdown margin corresponding to T. c Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown Amendment P 19.4-88 June 15, 1993
CESSAR ME"icarian 7-(v) B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or atop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, fire mains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20'F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350'F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l l cooling. j The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l b J Amendment P 19.4-89 June 15, 1993
CESSARn h mu B. Pressurizer level increasing significantly more than expected O while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. 19.4.7.3.2 Modeled Operator Actions Based on the description above, the following operator actions were modeled in the Other Transients event tree and associated fault tree models: O Amendment P 19.4-90 June 15, 1993
CESSAR 8!ai"lCAT13N /% If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criterion for this element is that one Safety Depressurization valve path must be available in conjunction with one SIS pump. 19.4.8.2.1.7 Safety Injection (Feed) If the long-term decay heat removal fails via either the SCS System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criteria for this element are that one SIS pump must deliver water from the IRWST to the RCS and one Safety Depressurization valve path must be available. 19.4.8.2.1.8 Containment Heat Removal Via IRWST Cooling [Gj During the plant cooldown following a transient, the : ore decay D heat is normally transferred to the secondary side inv.mtory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still he accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then discharged to the IRWST via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a failure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment Q (',/ pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due tc overpressure. MAAP analyses show that for a Loss of Feedwater Amendment M 19.4-97 March 15, 1993
CESSAR8lna mn 1 1 (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot i saturated equilibrium condition at about 170 psia. When the i containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at . atmospheric pressure. (This will be true if the containment fails I catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will huve to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow f rom the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in Figure 19.4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as , a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS Amendment P 19.4-98 June 15, 1993
CESSAR naincmon O the operator will verify the automatic initiation of the emergency feedwater system, if this system has not initiated then this should be done manually. This is all performed in order to maintain the plant at hot standby till the non-vital AC bus can be restored. At this point, if the condenser is available due to the regain of AC power then this is the preferred method of RCS heat removal. The operators would take control of the pressurizer level control in order to restcre the RCS inventory to acceptable limits. Since forced circulation is not available the operator must verify that natural circulation has been established. In order to verify that natural circulation was occurring the operator would be monitoring: A. Loop AT(Tnot -Tcoid) less than full power AT. l B. Hot and Cold leg temperatures. l C. RCS subcooling is at least 20* based on average Core Exit Temperature. D. No abnormal dif ferences between Taot RTDs and average Core Exit Temperature. Once decay heat removal had been established the operators would be monitoring the pressurizer pressure control and pressurizer level N cont -l in order to verify that adequate RCS inventory was being mainta :ed. At this point in the recovery the operators would decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borate the RCS to the minimum shutdown margin corresponding to T. c Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cosidown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are Amendment P 19.4-101 June 15, 1993
C E S S A R En nncaricu violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonsoismic tanks, fire mains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20*F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in j order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: Amendment P 19.4-102 June 15, 1993
CESSAR Ennnmion i / A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by gs performing the following actions:
\
(V A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Safety injection pumps aligned for Direct vessel injection. C. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. 19.4.8.2.3.2 Modeled Operator Actions Based on the description above, the following operator actions were modeled in the in the Loss Of Offsite Power event tree and associated fault tree models: A. Failure to verify that the AFAS was generated, and to manually p generate the AFAS signal at the ESF panel if the signal was i not automatically generated. Amendment P l 19.4-103 June 15, 1993 l
f CESSAR !!aincu,w B. Failure to initiate shutdown cooling. C. Failure to align the SCS system for long-term cooling. D. Failure to restart the EFW system for long term cooling (RR system unavailable). E. Failure to align the condensate storage tanks to the emergency feedwater storage tanks for long term cooling using the emergency feedwater system. F. Failure to initiate feed and bleed operation. G. Failure to align the CVCS to the IRWST and refill the IRWST following containment failure due to failure of long term containment heat removal. 11 . Failure to bleed and restart safety injection pumps following containment failure due to loss of containment heat removal. I. Pre-existing maintenance errors were included in the system fault tree models as appropriate. 19.4.8.2.4 Major Recovery Actions The following major recovery actions were addressed in the recovery analysis for the transients discussed above. A. In the later stages of the LOOP transient, power to the pumps may be restored by either aligning the standby alternate power source or restoring the offsite power. Accordingly, power to the SIS pumps and motor-driven EFW pumps was restored. B. For sequences in which there was sufficient time available, manually opening valves for which the valve operators had failed was credited. O Amendment M 19.4-104 March 15, 1993
CESSARHEnce,. t N later fails during long-term decay heat removal, secondary side heat removal can be re-established by restarting the EFW System. Operator has at least one hour to re-establish emergency feedwater flow because of the low decay heat levels and the inventory in the steam generators. The success criteria for this element are that the RHR or the EFW System must be available for the mission time of 24 hours and the CST must be properly aligned to provide additional inventory to the EFW System. 19.4.9.1.4 Safety Depressurization (Bleed) If the long-term decay heat removal f ails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criterion for this element is that one Safety Depressurization valve path must be available in conjunction with one SIS pump. \d 19.4.9.1.5 Safety Injection (Feed) If the long-term decay heat removal fails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Because of the loss of one component cooling water division, two of the SIS pumps will not be available. Therefore, the success criteria for this element are that one of the two unaffected SIS pumps must deliver water from the irwst and one Safety ; Depressurization valve path must be available to that SIS pump. l 19.4.9.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety l Q depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to I the core. The core heats up the IRWST inventory being delivered to Amendment.M 19.4-109 March 15, 1993
CESSARHELwo the core by the injection pumps. This heated inventory is then discharged to the IRWST via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a failure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, j will be lost directly to the atmosphere. If an alternate supply of ; borated water to the IRWST is not established, core heat removal j will eventually be lost due to the loss of IRWST inventory. At i that point, core damage will occur. The CVCS can provide borated water to the I.WSTR from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm Amendment P 19.4-110 June 15, 1993
i CESSAREEnc- i I I A l
~
The cooldown and depressurization to shutdown cooling entry l conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that l the cooldown is less than 100*F/hr. If at any point these are ' violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of \s certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20*F. C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l l Amendment P 19.4-113 June 15, 1993
CESSAR HainCAMN If these criteria are met, then the operator would align the Safety O Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. O Amendment P 19.4-114 June 15, 1993
CESSAR nai?ication : 1 g ( ,
\ l 19.4.10.1.4 Safety Depressurization (Bleed) l If the long-term decay heat removal fails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed).
If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Since one Bleed path becomes unavailable due to loss of 125 VDC vital bus, the success criterion for this element is that unaffected Safety Depressurization valve path must be available in conjunction with one SIS pump. 19.4.10.1.5 Safety Injection (Feed) If the long-term decay heat removal f ails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. ( ( If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criteria for this element are that one unaffected SIS pump must deliver water from the IRWST to the RCS and the unaffected Safety Depressurization valve path must be available. 19.4.10.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then oischarged to the IRWST via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay (/ heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water Amendment M 19.4-119 March 15, 1993
CESSAR nanCATEN System. In the event of a f ailure in the CSS, the Shutdown Cooling O System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, thej steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs)or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boiloff rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in Figure 19.4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its Amendment P 19.4-120 June 15, 1993
CESSAR Ennnearien n) (J containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the RHR pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.10.2 Maior Dependencies The following functional dependencies are important for Event Tree 10: A. If feedwater is not available, no success path for steam removal is available, therefore, the Safety Depressurization (Bleed) must be used to remove heat from the RCS. B. When Safety Injection and Safety Depressurization are used, the IRWST must be available and successfully cooled to prevent containment damage. 19.4.10.3 Operator Actions and Interfaces 19.4.10.3.1 Standard Operator Actions Since the transient, as defined, causes a reactor trip, the operators will perform Standard Post Trip Actions. The ramping down of main feedwater will cause the downward trend of steam generator level until Startup feedwater provides a low pressure source of feed on low steam generator level. No safety functions, that are checked by the Standard Post Trip Actions, should be challenged. This would lead the operators to implement the uncomplicated reactor trip optimal recovery procedure. The first actions are to verify that an uncomplicated reactor trip has occurred. First the operators check that pressurizer level has not decrease
,. below 10% nor increased above 70%. The pressurizer level control system should be controlling the pressurizer level and trending up
[ to 26% to 60%. If this is not the cause then the operator would be v Amendment M 19.4-121 March 15, 1993
l CESSAR EnWICATION l instructed to take control of charging and letdown to control the O , pressurizer level to this range. l The next issue, for the operators, would be to verify that the pressurizer heaters and sprays were controlling the pressurizer pressure within 1905 to 2375 psia. The availability of the heaters would be dependent on the pressurizer level being above the heater cutoff point of 26%. If there are no other complications then pressurizer pressure will be trending to 2225 to 2300 psia. Satisfying the post accident pressure temperature limits will ensure that brittle fracture limits are not exceeded, RCP NPSH and RCS subcooling requirements are not exceeded and the RCS cooldown rate or upper subcooling limit are not exceeded. RCS T m will be controlled at 525*F to 535*F by the turbine bypass system. If condenser vacuum is lost, the turbine bypass system is not available, or the MSIVs have closed then the atmospheric dump valves must be used to control RCS temperature. This allows the operators to verify adequate decay heat removal. If Startup feedwater is lost, emergency feedwater would be actuated by ESFAS. Therefore steam generator levels should be restored and be maintained in the normal band. Adequate heat removal will be maintained if at least one steam generator is available for removing heat. At this point in the recovery the operators would decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borate the RCS to the minimum shutdown margin corresponding to T. Then, during the controlled c cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100 F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: Amendment P 19.4-122 June 15, 1993
CESSAR 8lniNwon O 'd A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. eg Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue (( /) throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20'F C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l 1 Amendment P j 19.4-123 June 15, 1993 l I
CESSAREBinema B. Pressurizer level increasing significantly more than expected O while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. O Amendment P 19.4-124 June 15, 1993
CESSAREiniN m 19.4.11.1.4 Bafety Depressurization (Bleed) If the long-term decay heat removal fails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criterion for this element is that one Safety Depressurization valve path must be available in conjunction with one unaffected SIS pump. 19.4.11.1.5 Safety Injection (Feed) If the long-term decay heat removal f ails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the. Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be
) capable of maintaining core coolability and, thus, core integrity.
(w/ Since the loss of 4.16 KV bus results in loss of two SIS pumps, the success criteria for this element are that one of the two unaffected SIS pumps must deliver water from the'IRWST to the RCS and one Safety Depressurization valve path must be available. 19.4.11.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then discharged to the IRW3T via the safety depressurization valves, thus transferring the core decay heat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay , heat energy to the component cooling water system. This energy is ' y finally rejected to the Ultimate Heat Sink via the Service Water I System. In the event of a f ailure in the CSS, the Shutdown Cooling Amendment M 19.4-129 March 15, 1993
CESSAR =% mon System (SCS) pumps and/or heat exchangers can be aligned to provide O IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will fail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow f rom the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate f rom the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in Figure 19.4.3-3. Core damage results if containment fails due to failure to cool the IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Componcat Cooling Water System. If the CS header is not available, the CSS Amendment P 19.4-130 June 15, 1993
CESSAR Ennneuion J can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the RHR pump associated with that train may be used as a backup. The System 80+ design includes a standby containment spray connection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. 19.4.11.2 Major Dependencies The following functional dependencies are important for Event Tree 11: A. If emergency feedwater is not available, no success path for steam removal is available, therefore, the Safet( Depressurization (Bleed) must be used to remove heat from tue RCS. ( B. When Safety Injection and Safety Depressurization are used, the IRWST must be available and successfully cooled to prevent containment damage. 19.4.11.3 Operator Actions and Interf aces 19.4.11.3.1 Standard Operator Actions Since the transient, as defined, causes a reactor trip, the operators will perform Standard Post Trip Actions. The ramping down of main feedwater will cause the downward trend of steam generator level until Startup feedwater provides a low pressure source of feed on low steam generator level. No safety functions, that are checked by the Standard Post Trip Actions, should be challenged. This would lead the operators to implement the uncomplicated reactor trip optimal recovery procedure. The first actions are to verify that an uncomplicated reactor trip has occurred. First the operators check that pressurizer level has not decrease below 10% nor increased above 70%. The pressurizer level control system should be controlling the pressurizer level and trending up to 26% to 60%. If this is not the cause then the operator would be instructed to take control of charging and letdown to control the pressurizer level to this range. Amendment M 19.4-131 March 15, 1993
CESSAR naihmon The next issue, for the operators, would be to verify that the pressurizer heaters and sprays were controlling the pressurizer pressure within 1905 to 2375 psia. The availability of the heaters would be dependent on the pressurizer level being above the heater cutoff point of 26%. If there are no other complications then pressurizer pressure will be trending to 2225 to 2300 psia. Satisfying the post accident pressure temperature limits will ensure that brittle fracture limits are not exceeded, RCP NPSH and RCS subcooling requirements are not exceeded and the RCS cooldown rate or upper subcooling limit are not exceeded. RCS T,y, will be controlled at 525 F to 535 F by the turbine bypass system. If condenser vacuun is lost, the turbine bypass system is not available, or the MSIVs have closed then the atmospheric dump valves must be used to control RCS temperature. This allows the operators to verify adequate decay heat removal. If Startup feedwater is lost, emergency feedwater would be actuated by ESFAS. Therefore steam generator levels should be restored and be maintained in the normal band. Adequate heat removal will be maintained if at least one steam generator is available for removing heat. At this point in the recovery the operators would decide if a cooldown to shutdown cooling entry conditions is necessary. One of the factors to be considered is existing plant status. If the continued availability of any systems required for maintenance of hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borute the RCS to the minimum shutdown margin corresponding to Tc. Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100 F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Coeldown Amendment P 19.4-132 June 15, 1993
CESSARELb,2 v' B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate lnventory would be monitored by the operators and replenishc , as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l B. RCS subcooling should be at least 20*F. C. RCS pressure should be at or below the shutdoan cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: Amendment P 19.4-133 June 15, 1993
CESSARn h mw A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. O Amendment P 19.4-134 June 15, 1993
CESSAR anUICATION o h flow because of the low decay heat levels and the inventory in the steam generators. The success criteria for this element are that the RHR or the EFW System must be available for the mission time of 24 hours and the CST must be properly aligned to provide additional inventory to the EFW System. 19.4.12.1.4 Safety Depressurization (Bleed) If the long-term decay heat removal fails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. Therefore, the success criterion for this element is that one Safety Depressurization valve path must be available in conjunction with one SIS pump. 19.4.12.1.5 Safety Injection (Feed) p ( If the long-term decay heat removal fails via either the RHR System or the secondary heat removal using the EFWS, decay heat removal can still be provided by the safety injection and safety depressurization (Feed and Bleed). Safety injection (or Feed) provides cooling water to remove decay heat removal. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), 1 SIS pump and 1 Safety Depressurization valve will be capable of maintaining core coolability and, thus, core integrity. With the loss of one division of HVAC, it is assumed that the controls for one division of SIS will not be available. Thus, two of the four SIS pumps will not be available. Therefore, the success criteria for this element are that one of the two unaffected SIS pumps must deliver water from the irwst and one Safety Depressurization valve path mus,t be available to that SIS j pump. 19.4.12.1.6 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The [' injection pumps are then used to supply inventory from the IRWST to k, the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then Amendment M 19.4-139 March 15, 1993
CESSAR nenncmon i I discharged to the IRWST via the safety depressurization valves, O thus transferring the core decay heat energy to the IRWST. - Normally, the Containment Spray System (CSS) is used to transfer the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a failure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at utmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an equipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm Amendment P 19.4-140 June 15, 1993
CESSARna hou hot standby is in doubt, a cooldown will be performed before the ability to cooldown is lost. The RCS would be sampled for activity and boron concentration. The operators would determine the need to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. If the letdown system were not available, the operators would borate the RCS to the minimum shutdown margin corresponding to T,. Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that l it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, ett During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; ( ( A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l I Amendment P 19.4-143 June 15, 1993 I
CESSAR EnWicariou B. RCS subcooling should be at least 20*F O C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety Injection system for direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feodwater, "once thorough cooling" can be achieved. This is.an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: O Amendment P 19.4-144 June 15, 1993
CESSAR EUAi"lCATION
, 1 19.4.13 ANTICIPATED TRANSIENTS WITHOUT SCRAM 19.4.13.1 ATWS Description Anticipated Transient Without Scram (ATWS) is not an initiating event, but rather is a faulted response to an event requiring control element assemblies (CEAs) insertion for reactivity control.
However, because of the significant impact that an ATWS has on plant responses, it is included as a separate initiating event class. The initiating event is defined to be the occurrence of a transient requiring reactor trip for reactivity control coupled with f ailure of a trip to occur due to either mechanical failure of the CEAs to insert or the failure of both the Reactor Protection System (RPS) and the Alternate Protection System (APS) to generate a trip signal. Because ATWS is included as a separate event, failure to trip was not addressed in the event trees for the other transient initiating event classes. The ATWS is potentially a severe event in which the Reactor Coolant System goes through a pressure excursion due to a mismatch between the core heat generation rate and the Reactor Coolant System energy removal capability. Although 10CFR50.62 0" defines a prescriptive solution for the ATWS scenario in terms of prevention and mitigation, the success criteria for the event is given in NUREG-0460, Volume 3"" and can be summarized as follows: A. For the Reactor Coolant System (RCS) pressures calculated, the integrity of the reactor coolant pressure boundary and the functionability of valves needed for long term cooling shall be demonstrated. B. The calculated radiological consequences shall be within the guidelines set forth in 10 CFR100"U. C. The reactor fuel rods shall be shown to withstand the internal l and external transient pressure so as to maintain a long term l coolable geometry. i D. The peak fuel enthalpy of the hottest fuel pellet shall not result in significant fuel melting. E. The probability of departure from nucleate boiling for the hot rod shall be shown to be low. F. The maximum cladding temperature and the extent of the Zr-H 2 O reaction shall be determined and shown not to result in significant cladding degradation. For the limiting ATWS scenario, the criteria relating to the pressure boundary integrity and functionability of the valves x required for long term cooling are of primary interest. The concern is that if the peak pressure in the RCS exceeds Level C Amendment M 19.4-147 March 15, 1993 e
CESSAR naincmo, ? stress limits, a breach of the primary coolant pressure boundary O will occur and that the Safety Injection System check valves will be jammed closed. This would result in a LOCA with no RCS makeup available. The NRC ATWS Task Force assumed a Level C pressure of 3200 psia in their value/ impact analysis of ATWS plant modifications (63) . During the ATWS rulemaking process, C-E performed stress evaluations of all major primary and auxiliary RCS components within C-E's scope of supply for specific application for ATWS concerns c 62. o ) . Stress evaluations were conducted in the 3800 psia to 4300 psia pressure range and included all representative C-E PWR classes. Based on these evaluations, it was concluded that ATWS generated pressures below 4300 psia would not jeopardize RCS integrity or the operability of the equipment needed for a safe shutdown. Other calculations indicated that above a pressure of 3750 psia, the upper head begins to lift off from the upper head seal. Based on the above discussion and the C-E stress analyses in Appendix E of Reference 47, it is believed that the ATWS level C pressure limit for System 80+ should be 3700 psia. During startu), the plant will be hydro-tested to meet ASME requirements. The test requires that the RCS be pressurized so that the lowest pressure in the RCS is above 125% of the design pressure of 2500 psia. During a typical RCS hydro test, RCS pressures will range between 3150 and 3300 psia. This lends further credence to an ATWS level C pressure limit in excess of 3200 psia. However, at the request of the NRC, an ATWS level C pressure limit of 3200 psia was used for this analysis. The course of an ATWS event is primarily dictated by a macroscopic energy balance on the Reactor Coolant System. Energy generated in the core and deposited in the coolant can be removed by various means. They are: the steam generators, the primary safety relief valves, Reactor Coolant System leakage. Changes in the Reactor Coolant System pressure and temperature are produced as a result of an imbalance between the rates of energy deposition into and removal from the reactor coolant. All ATWS consequences are determined directly by the core power transient and the power imbalance transient. The relative consequences of ATWS events are thus determined by the relative magnitude of those plant parameters which govern these transients. The energy generation within the core during the period of peak RCS pressure and maximum potential for clad damage is determined by the relative magnitude of Doppler and moderator temperature reactivity feedback. A power imbalance which produces an increase in moderator temperature and pressure coupled with a negative moderator temperature coefficient also produces a negative reactivity feedback which tends to reduce the core power and hence reduces the core power imbalance. During an ATWS event, primary coolant temperature increases. Since the assumed moderator temperature coefficient in the core is negative, the temperature increase results in an insertion of negative reactivity which reduces the core power. The moderator temperature coef ficient will Amendment P 19.4-148 June 15, 1993
CESSAR Enac-n become more negative over the core cycle. Therefore, as the cycle progresses, the consequences of an ATWS event would become less severe, in that the core power reduction via moderator feedback will.be greater, thus reducing the imbalance between the core heat generation rate and the RCS heat removal capability. Since RCS peak pressure and associated system stresses are the primary concerns during an ATWS, it has been determined by analysis that the complete loss of feedwater event with failure of turbine trip is the limiting at-power peak pressure event"U. The loss of normal feedwater flow could result from a malfunction in the feedwater/ condensate system or its control system. This malfunction can be caused by a closure of all feedwater control valves, trip of all condensate pumps, or, trip of all main feedwater pumps. The loss of normal feedwater causes a reduction in feedwater flow to the steam generators when operating at power. This produces a reduction in the water inventory in the steam generators. Consequently, the secondary system can no longer remove the heat that is generated in the reactor core. Due to the assumed failure of the CEAs to insert on reactor trip, the core power remains at or n near 100% of the initial level during the early part of the transient. The heat buildup in the primary system is indicated by (V) rising RCS temperature and pressure, and by increasing pressurizer water level due to the insurge of expanding reactor coolant. The initiation of the ATWS event may be identified by means of the failure of CEA insertion on the reactor trip signal, sharp increases in RCS pressure and temperature, and a rise in steam generator pressure. The heat capacity of the primary and secondary coolant inventories, the discharge capability of the RCS and steam generator Safety and Atmospheric Dump Valves, and the action of the Emergency Feedwater System, Steam Bypass Control System, and the Chemical and Volume Control System all combine to provide the heat removal capability to limit the consequences of the reactor power generated during this incident. Realistic best estimate thermohydraulic analyses of a total Loss of Feedwater without Turbine Trip or Scram were run for a series of MTCs for the System 80+ Standard designHM. As shown on Figure 19.4.13-1 (extracted from Reference 65), the peak RCS pressures l generated in these analyses were approximately 3150 psia for an MTC of -0.30E-4 Ap/ F and 2975 psia for an MTC of -0.50E-4 Ap/ F given that four PSVs open. With three PSVs open, the peak pressures were approximately 3375 psia for an MTC of -0.30E-4 Ap/ F and approximately 3200 psia for an MTC of -0.42E-4 Ap/*F. Therefore, l since total Loss of Main Feed-water Flow without Turbine Trip is the limiting ATWS, an ATWS event will not exceed Level C stress limits for MTCs of -0.30 to -0.42 if all four PSVs open. It will O] \ not exceed Level C stress limits for MTCs of -0.42 or less if three or more PSVs open. Amendment P 19.4-149 June 15, 1993
CESSAR 88Lmu Figure 19.4.13-2 presents the core damage event tree for ATWS. following subsections describe the individual elements on this The 9 event tree. 19.4.13.2 ATWS Event Tree Elements 19.4.13.2.1 ATWS Initiators ATWS is defined to be an anticipated operational occurrence coupled with failure to insert negative reactivity via the CEAs. ATWS initiators, for this study, are defined to be all transients which tend to produce RCS pressure transients. These include Loss of Feedwater events, Other Transients (turbine trips, MSIV closures and loss of RCS flow events), Loss of Offsite Power, Loss of Component Cooling Water, Loss of a 125 VDC vital bus, Loss of a 4.16 KV vital bus and Loss of one division of HVAC. 19.4.13.2.2 Adverse Moderator Temperature coefficient (MTC) This element is defined to be that the MTC is such that a severe ATWS will produce peak RCS pressures in excess of the Level C stress limits (approximately 3700 pcia). C-E best estimate analyses have shown that for an MTC between -0.30 and 0.42, an ATWS initiated by a total loss of main feedwater without turbine trip l results in peak pressures of less than 3200 psia as long as alll four primary safety valves open. 19.4.13.2.2a Adverse Moderator Temperature Coefficient 2 As previously discussed, if the MTC is between approximately -0.30 and 0.42, a severe ATWS will result in RCS pressures less than 3200 psia if all four PSVs lift. This element is defined to be: "MTC is between -0.30 and -0.42 AND one of the four PSVs fails to lift.". If this event occurs, core damage is assumed to result. 19.4.13.2.3 Failure of Sufficient Primary Safety Valves to Open C-E best estimate analyses have shown that for an MTC of -0.42, an ATWS initiated by a total loss of main feedwater without turbine trip results in peak pressures of less than 3200 psia as long as at least three or four of the four primary safety valves open. Therefore, the success criteria for this element is that at least three primary safety valves open to relieve pressure. The failure criterion is that two or more safety valves fail to open. 19.4.13.2.4 Primary Safety Valve (PSV) Stuck Open One of the consequences of an ATWS is the high RCS pressure. The primary safety valves (PSVs) will lift to relieve peak RCS pressure. Following lifting of the PSVs, RCS pressure would Amendment P 19.4-150 June 15, 1993
CESSAR Ennncmon O decrease below the lif ting pressure of the PSVs and the PSVs should close. However, if any PSV fails to resent, reactor coolant will be lost through the stuck open PSV. This leak is equivalent to a medium Loss of Coolant Accident (LOCA). Hence, safety injection will be required to control the RCS inventory as well as supply the necessary boron for reactivity control. 19.4.13.2.5 Consequential Steam Generator Tube Rupture (BGTR) In the event of an ATWS, reactor coolant at higher than nominal RCS pressure is circulated inside of the steam generator tubes whereas feedwater at lower pressure is circulated outside the tubes. Therefore, if any degradation of the tube (s) exists, there is a potential for a rupture in the steam generator tube. This steam generator tube rupture is identified as a Consequential SGTR on the ATWS event tree. 19.4.13.2.6 Deliver Emergency Feedwatar Following the ATWS transient (with a presumed consequential loss of main feedwater), emergency feedwater must be supplied to the steam generators in order to remove decay heat from the RCS. Emergency feedwater is automatically actuated by the Engineered Safety 7 . Features Actuation System (ESFAS). It can also be manually I actuated from the control room. C-E best estimate analyses have shown that for MTCs of -0.30 or less, one emergency feedwater pump can deliver sufficient flow to maintain RCS pressure peaks below 3200 PSIA, even with a total loss l of main feedwater. Therefore, the success criterion for this element is that emergency feedwater flow must be delivered from one of the two EFW System trains to its respective steam generator. 19.4.13.2.7 Deliver EFW to Intact Steam Generator If a consequential SGTR has occurred following an ATWS, emotgency feedwater must then be supplied to the intact steam generator for removing the RCS heat. The success criterion for this element is that flow from one EFW must be delivered to the intact steam generator. 19.4.13.2.8 Deliver Boron via Charging Pump Following an ATWS, the RCS pressure may remain high enough so that the Safety Injection System (SIS) cannot be put in operation to deliver borated water to the RCS for the reactor coolant inventory and reactivity control. In this case, the charging pump (s) may be used to provide boron for reactivity control and, thus, prevent core damage, b ( Amendment P 19.4-151 June 15, 1993
CESSAR nuirlCATION One charging pump will deliver sufficient boron to stabilize the O plant. Therefore, the success criterion for this element is that one charging pump must deliver boron to the RCS. 19.4.13.2.9 Bafety Depressurization If boron delivery via the charging pump fails, reactivity control and reactor coolant inventory control would have to be provided using the SIS. However, before the SIS can be put in operation, the RCS pressure must be reduced to a pressure that is below SIS pump shutoff head. This can be accomplished by using the Safety Depressurization or Bleed System. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), one safety depressurization valve will be capable of reducing the RCS pressure to the point where the SIS can be actuated. Safety Depressurization System is also used in the Feed and Bleed process to remove decay heat for long term cooling if the Long-Term Decay Heat Removal process via either the SCS System or the secondary heat removal using the EFWS fails. Therefore, the success criterion for this element is that one safety depressurization valve path must be opened to initiate safety depressurization. 19.4.13.2.10 Bafety Injection If boron delivery via the charging pump fails, reactivity control and RCS inventory control would have to be provided using the SIS. Once the RCS pressure is reduced to that below SIS pump shutoff head using the Safety Depressurization System, the SIS can be put in operation. If the bleed is initiated at lifting of the Primary Safety Valves (PSVs), one SIS pump is capable of providing sufficient borated water to the RCS for RCS inventory control and reactivity control. Safety Injection System is also used in the Feed and Bleed process to remove decay heat for long term cooling if the Long-Term Decay Heat Removal process via either the RHR System or the secondary heat removal using the EFWS fails in maintaining the core coolable. Therefore, the success criterion for this element is that one SIS pump must deliver borated water to the RCS. 19.4.13.2.11 RCS Pressure Control If a consequent SGTR happens following an ATWS, leakage from the primary side to the secondary side occurs. To minimize the leakage from primary to secondary during the plant cooldown, RCS pressure l must be maintained at or near the pressure in the ruptured steam i Amendment M 19.4-152 March 15, 1993
CESSAR E h m (3 i V generator. If pressure control is not established, the IRWST inventory will be lost through the ruptured tube. Pressure control must be established in sufficient time to permit bringing the plant to cold shutdown conditions and stopping the leak before the inventory in the IRWST is depleted. The two actions involved in establishing RCS pressure control are throttling the safety injection pumps once pressurizer level and RCS subcooling have been re-established, and starting pressurizer spray flow. If two RCPs are running, the Pressurizer Spray System may be used. If the RCPs are not running, either the RCGVS or the Bleed System valves can be used. The auxiliary spray is not credited in the analysis. The success criteria for the RCS Pressure Control are that SIS flow must be throttled and pressurizer spray flow must be established. If the pressurizer spray is unavailable, either the RCGVS or the Bleed System must be used to control RCS pressure. 19.4.13.2.12 Unisolable Leak in the Ruptured Generator If an unisolable path exists from the ruptured steam generator to the atmosphere, the ruptured generator could be at or near atmospheric pressure. Thus, the differential pressure between the n RCS and the ruptured generator will remain high with the attendant (' high leak rate between the RCS and the ruptured steam generator. The RCS ," essure would have to be decreased to atmospheric pressure to terminate the leak prior to depletion of the available inventory. This would be accomplished by cooling and depressurizing the RCS to residual heat removal conditions using the intact steam generator and the pressurizer spray. The RHR System would then be used to cool and depressurize the plant to atmospheric pressure and less than 212*F. On natural circulation, other means of depressurization would be used to bring the plant to residual heat removal entry conditions. The success criterion for this element is that there is no unisolable path from the ruptured generator to the atmosphere. Equivalently, the success criteria are that the ruptured steam generator be successfully isolated and all releases from the generator be controlled. The potential failure paths for this element are: A. One or more MSSVs are stuck open, or B. One or both ADVs are stuck open. The mechanisms for achieving one of the above two conditions are: A. TBVs fail to open on reactor trip, C,' MSSVs open on both generators, One or more MSSVs on the ruptured generator fail to rescat; Amendment M 19.4-153 March 15, 1993
CESSAR EE"icarien B. Isolated ruptured generator begins to fill, O Steam Generator Blowdown System unavailable, ADVs on the ruptured generator unavailable, Ruptured generator fills, MSSVs on the ruptured generator lift, MSSV fails to rescat; C. ADVs on both generators opened for initial cooldown, ADV on the ruptured generator fails to close; D. Isolated ruptured generator begins to fill, Steam Generator Blowdown System unavailable, Operator opens ADV on the ruptured generator, ADV fails to close. 19.4.13.2.13 Long-Term Decay Heat Removal (No SGTR) Decay heat must be continually removed from the RCS following the initial response to the transient. For the purpose of this analysis, it is assumed that the plant will always be brought to cold shutdown following a transient if it is at all possible. Thus, during the initial response to the transient, the plant would normally be brought down to residual heat removal entry conditions using secondary side heat removal. This can be accomplished in about 6 to 8 hours. 1 The Shutdown Cooling System (SCS) , which is the preferred nears, is then used for long-term decay heat removal. If the SCS System is not available, secondary side heat removal must be maintained for long-term decay heat removal by maintaining emergency feedwater flow. In this case, the Condensate Storage Tank (CST) must be aligned to provide additional inventory to the EFW System once the emergency feedwater storage tank empty (nominally between 16 to 20 hours after the initiation of the event). Following successful establishment of long-term decay heat removal, emergency feedwater is normally shut down after the steam generators are filled to appropriate levels. If the SCS System later fails during long-term decay heat removal, secondary side heat removal can be re-established by restarting the EFW System. Operator has at least one hour to re-establish emergency feedwater flow because of the low decay heat levels and the inventory in the steam generators. The success criteria for this element are that the SCS or the EFW ' System must be available for the mission time of 24 hours and the CST must be properly aligned to provide additional inventory to the . EFW System. I 19.4.13.2.14 Long-Term Decay Heat Removal (SGTR) In the case in which a Steam Generator Tube rupture occurred as a l result of the ATWS, decay heat must be continually removed from the ) l Amendment M 19.4-154 March 15, 1993 1 i
CESSAR nn%mou O RCS following the initial response to the transient. During the initial response to the transient, the plant would be brought down to shutdown cooling entry conditions using secondary side heat removal from the intact steam generator. This can be accomplished , in about 8 hours. The Shutdown Cooling System, which is the preferred means, is then used for long-term decay heat removal. If the SCS System is not available, secondary side heat removal via the intact steam generator must be maintained for long-term decay heat removal by maintaining emergency feedwater flow to the intact steam generator. In this n e, the Condensate Storage Tank (CST) must be aligned to provide e itional inventory to the EFW System once the emergency feedwa- , storage tank empties (nominally between 16 to 20 hours after the initiation of the event). Following successful establishment of long-term decay heat removal, emergency feedwater is normally shut down after the intact steam generator is filled to an appropriate level. If the SCS System later fails during long-term decay heat removal, secondary side heat removal can be re-established by restarting the EFW System. Operator has at least one hour to re-establish emergency feedwater flow because of the low decay heat levels and the inventory in the steam generators. The success criteria for this element are that the SCS must provide long term decay heat removal for the mission time of 24 hours or the EFW System must provide long term decay heat removal via the intact steam generator available. If the EFW system is used for long term decay heat removal, the CST must be properly aligned to provide additional inventory to the EFW System. 19.4.13.2.15 Refill the IRWST (RF) Given a consequential SGTR with loss of RCS pressure control and an unisolable leak in the ruptured SG, the pressure differential between the RCS and the ruptured generator will remain relatively high and the leak rate from the primary side to the secondary side will remain relatively high. This raises the possibility of depleting the IRWST inventory before the plant cooldown is completed. Initially, the tube leak rate is in the critical flow regime and will remain so throughout most of the transient. Therefore the leak rate will be a function of the RCS pressure. Figure 15.6.3-34B in CESSAR-DC presents the RCS pressure trace for an SGTR with Loss of Offsite Power and a stuck open ADV which is equivalent to the conditions of concern as discussed above. Figure 15.6.3-42B presents a trace of leak rate versus time for the same transient. As can be see from these two figures, as pressure decreases, the tube leak decreases proportionately. For the transient as described in Section 15.6.3.3, the operators recover RCS pressure control and isolate the open ADV at about 8000 seconds (2.2 hours) . The leak rate at about 8000 secs is approximately 55 lbm/sec. Amendment M 19.4-155 March 15, 1993 j
CESSAR EL"lCATl!N Assuming a density of 60 lbm/ft2 and a specific volume of .1337ft2/ gal, this is equivalent to a leak rate of 411 gpm. The total inventory lost to this point, as shown on Figure 15.6.3-43B, is 360,000 lbm which is equivalent to about 45,000 gallons. The RCS hot leg temperature at this point in time is about 460*F. For the transient as described in Section 15.6.3.3 of CESSAR-DC, the operators at this point initiate a controlled cooldown at 20*F/ hour using the intact steam generator. For the condition where RCS pressure control could not be re-established, the plant would be cooled down and depressurized using only secondary side cooling which is a slow process. Assuming an average cooldown rate of 10*F/ hour, it will take approximately 26 additional hours to cooldown and depressurize from 460*F to about 200*F. As discussed above, the rate of depressurization parallels the rate of cooldown and the leak rate is a function of pressure. It is not unreasonable to assume that the average tube leak rate during the cooldown period is about one half the leak rate at 8000 seconds. Thus, the average leak rate during the cooldown was assumed to be 200 gpm. The total usable inventory in the IRWST is approximately 500,000 gallons. With 45,000 gallons of inventory lost during the initial response to the SGTR, the remaining inventory is 455,000 gallons. At an average leak rate of 200 gpm, the IRWST inventory will be depleted in approximately 38 hours. Thus, at the above cooldown rate, there is more than enough inventory in the IRWST to make up the inventory lost through the leaking tube. On the other hand, if an average leak rate of 300 gpm is assumed, it will take approximately 25 hours to deplete the IRWST inventory and the IRWST inventory would have to be replenished to comp]ete the cooldown. If it is assumed that the plant is cooled down at a rate of 10*F/ hour from 460*F to 350*F and at an average rate of 5'F/ hour from 350' to 200*, it will take a total of 41 hours to cool down and depressurize the plant. With an assumed average leak rate of 200gpm, the IRWST inventory would be depleted approximately three hours before the cooldown was completed. Thus, in this scenario, the IRWST inventory would need to be replenished. The IRWST inventory can be replenished from the Boric Acid Storage Tank (BAST) using the Boric Acid Makeup Pumps (BAMP). The BAST nominally contains 156,000 gallons of borated water. The normal flow rate of the BAMPs is 165 gpm each. The transfer would require realigning several manual valves and starting the BAMP(s). However, this is the normal source for makeup to the IRWST so there are appropriate operational procedures available and the staff will have had experience in establishing the proper alignments. Using one pump, the entire nominal contents of the BAST can be transferred to the IRWST in about 16 hours. I i Amendment M 19.4-156 March 15, 1993 1 l
CESSARnuhou n During the latter part of the cooldown, the tube leak rate will be much less than the assumed average leak rate of 200 gpm. Thus, a single BAMP will be able to transfer inventory to the IRWST faster than it is being lost due to the tube leak. Therefore, the transfer of inventory from the BAST to the IRWST would not need to be initiated until just prior to depletion of the IRWST inventory. For this analysis, is assumed that the transfer must be initiated at least 1 hour prior to depletion of the IRWST inventory to be successful. Given the worst case scenario discussed above, the IRWST inventory would be depleted at about 27 hours after the initiating event. For this case, transfer should be started at or before 26 hours. The operating crew would be aware of the potential need to transfer inventory to the IRWST significantly prior to this point. However, it is assumed that they would not begin to refill the IWRST until they received an IRWST low level alarm. I suming that the alarm setpoint is at 5% of useable inventory and that the average leak rate over the last several hours is 100gpm, the alarm would occur approximately 4 hours before the "dryout point". Thus, the operators have three hours in which to initiate refilling of the IRWST. The top logic for the element " Fail to Replenish IRWST Inventory Following an SGTR", is presented in Figure 19.4.4-3. 19.4.13.2.16 Maintain Secondary Heat Removal (MSHR) If the feedwater is available but the RCS pressure control fails, the plant may be maintained in a stable condition via continued secondary heat removal. This is accomplished by providing emergency feedwater to the intact steam generator. Therefore, the success criteria for this element are that the emergency feedwater be available and the additional water inventory must be provided by the CST if the emergency feedwater storage tank empties at between 16 and 20 hours following the event. 19.4.13.2.17 Containment Heat Removal Via IRWST Cooling During the plant cooldown following a transient, the core decay heat is normally transferred to the secondary side inventory via the steam generator. If main or emergency feedwater flow is lost, core heat removal can still be accomplished via " Feed and Bleed" cooling. For this mode of core heat removal, the safety depressurization valves are opened to depressurize the RCS. The injection pumps are then used to supply inventory from the IRWST to the core. The core heats up the IRWST inventory being delivered to the core by the injection pumps. This heated inventory is then discharged to the IRWST via the safety depressurization valves, i thus transferring the core decay _aat energy to the IRWST. Normally, the Containment Spray System (CSS) is used to transfer ( the decay heat energy from the IRWST to the Ultimate Heat Sink. The CSS pumps take suction from the IRWST and discharge back to the Amendment P 19.4-157 June 15, 1993
CESSAR n=r"ic41,2n IRWST through the CSS heat exchangers. The containment spray flow is cooled by the component cooling water flow through the containment spray heat exchanger, thus transferring the core decay heat energy to the component cooling water system. This energy is finally rejected to the Ultimate Heat Sink via the Service Water System. In the event of a failure in the CSS, the Shutdown Cooling System (SCS) pumps and/or heat exchangers can be aligned to provide IRWST cooling. If containment heat removal via IRWST Cooling is lost, the core decay heat is retained inside the containment, and the containment pressure begins to increase. Eventually, the containment pressure will increase to the point at which the containment will fail due to overpressure. MAAP analyses show that for a Loss of Feedwater (LOFW) transient with a loss of emergency feedwater and successful feed and bleed cooling with no containment heat removal from time 0, the containment will f ail at about 41 hours. At this point, the l steam that was inside containment will be discharged to atmosphere via the containment breach. Because the SDS valves discharge directly to the IRWST, the contents of the IRWST will be in a hot saturated equilibrium condition at about 170 psia. When the containment fails, it is postulated that there will be momentary flashing in the IRWST as equilibrium is reestablished at atmospheric pressure. (This will be true if the containment fails catastrophically. It is slightly conservative if the containment does not fail catastrophically.) It is assumed that the Injection pumps will cavitate and trip at this point. Once equilibrium has been reestablished, the operators will have to dispatch an enuipment operator to bleed the injection pumps so that they can be restarted. Approximately 33% of the total water inventory inside containment will be discharged to atmosphere when the containment fails. With restart of the injection pumps, core heat removal can still be successfully accomplished using the safety injection flow from the IRWST to the core. However, as the core decay heat energy heats up the IRWST inventory, this inventory, in the form of steam, will be lost directly to the atmosphere. If an alternate supply of borated water to the IRWST is not established, core heat removal will eventually be lost due to the loss of IRWST inventory. At that point, core damage will occur. The CVCS can provide borated water to the IRWST from the Holdup tank (HUT) and the Boric Acid Storage Tank (BAST) using the Holdup pumps (HUPs) or the Boric Acid Makeup pumps (BAMPs) respectively. The BAST has a maximum capacity of 180,000 gallons and the HUT has a maximum capacity of 435,000 gallons. The holdup pumps have a normal flow of 50 gpm each. The BAMP have a normal flow of 165 gpm each. The boilof f rate from the core due to decay heat at 48 hours is approximately 137 gpm. The top logic for failure to provide long term containment heat removal by cooling the IRWST is presented in Figure 19.4.3-6. Core l damage results if containment fails due to failure to cool the l l Amendment P 19.4-158 June 15, 1993 ; I 1
CESSAR En#iCATION ( \' IRWST inventory and core cooling is not maintained after containment failure. The success criteria for IRWST cooling are that at least one CS pump deliver flow from the IRWST through its containment spray heat exchanger to the containment spray header and that the decay heat energy be transferred to the Component Cooling Water System. If the CS header is not available, the CSS can be aligned to discharge directly to the IRWST. If the CS pump in one train is not available, the SCS pump associated with that train may be used as a backup. The System 80+ design includes a , standby containment spray cor.nection. This consists of a flanged connection to the Containment spray line just outside containment and a standpipe that can be connected to a pumping device such as a skid mounted pump of a fire pump. The standpipe would be connected to the CS line using a spool piece. If the CSS and SCS pumps are not available, this backup system could be aligned to provide spray flow. Heat removal would be via adding large amounts of cold water. This was treated as a recovery action in this analysis. In addition, though not credited in this analysis, the containment purge valves could be opened to provide a controlled depressurization of containment prior to failure. During an ATWS event with a consequential steam generator tube rupture and feed and bleed cooling, primary system heat removal is accomplished by several means. These include heat removal by: A. Steam generator inventory boiloff during the early part of the transient, B. Release of primary system fluid through the primary safety valves to the IRWST, C. Release of primary system fluid through the Safety Depressurization (SDS) Valves to the IRWST during the feed and bleed cooling phase of the transient, and D. release of primary fluid through the rupture in the steam generator tube. With only one CSS pump and one CSS heat exchanger used to cool the IRWST inventory, the prolonged use of feed and bleed cooling of the primary system would ultimately result in saturation of some portion of the IRWST inventory. However, due to the hydrostatic head of the IRWST inventory at the suction side of the safety injection and CSS pumps and the location of the IRWST spargers through which the PSVs and the SDVs discharge to the IRWST being located far away from the pump suction lines, the safety injection and CSS pumps are expected to have adequate NPSH and are not expected to be exposed to steam or steam / water mixture. Based on the following calculations, it was concluded that one CSS pump and one CSS heat exchanger provide adequate IRWST cooling
. Amendment M 19.4-159 March 15, 1993
CESSAR Enificuion following an ATWS event with a consequential SGTR and feed and bleed cooling. Heat Removal via the IRWST durina an ATWS Event Time Period I. PSV releases from 100 seconds to reactor shutdown (300 seconds) It is conservatively assumed that during this initial time frame when the PSVs discharge at high reactor power, the fluid is discharged at the setpoint of the valves (2500 psia) and is assumed to be at saturated steam enthalpy. The energy transferred to the IRWST during this time frame is: Q1
=
Mesv1
- h, [19.4.13-1]
where: Mrsvi is the integrated mass release via the PSVs during the early part of the transient. Mrsvi = 160,000 lbm. h, is the saturated steam enthalpy at 2500 psia
= 1093.3 Btu /lbm.
Q1 = 160,000 lbm
- 1093.3 Btu /lbm = 175 E+6 Btu.
Ilme Period II. From 301 second to Operator Action at 1800 O seconds The PSVs cycle open/ closed to remove decay heat up until operator action at 1800 seconds (30 minutes), when the SDS and safety injection system are placed in operation to permit " feed and bleed" removal of decay heat. The integrated amount of decay heat during this time period is: QrI == 13 5.1 E+ 6 Btu Time Period III: From 1801 seconds to 14400 seconds (4 hours) The heat removal capacity of the CSS pump and heat exchanger at maximum flow rate is equivalent to about 1% decay heat (see calculation of CSS heat exchanger heat removal rate provided later in this subsection. For the limiting ATWS event, this decay power is reached slightly before 4 hours (14400) seconds) . Subsequently, the CSS heat exchanger energy removal meets and then exceeds the energy input from the core, thereby terminating the heatup of the IRWST inventory. The integrated amount of decay heat removed prior to 14400 seconds and after 1800 seconds is: Q111 = 680.9E+6 Btu Amendment P 19.4-160 June 15, 1993
CESSARnai 6 3 (V The RCS would be sampled for activity and boron concentration. The operators would attempt to continue to borate the RCS in order to achieve the required shutdown margin, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would try to borate the whole RCS including the mass in the pressurizer. Since the RCS would be at such a high pressure, the operators would borate the RCS to the minimum shutdown margin corresponding to-T. e Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The cooldown and depressurization to shutdown cooling entry conditions would begin at this point. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that j it is being maintained within the Post Accident P-T limits or that the cooldown is less than 100*F/hr. If at any point these are violated, the operator must perform one of the following actions as appropriate: A. Stop the Cooldown B. Operate the main or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l [ C. If overpressurization still exists and is caused by charging \ flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, etc. During this phase of the recovery, the automatic operation of certain safeguard systems is undesirable. The operators would be directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, to ensure that these engineered safeguards remain available until the RCS is cooled and depressurized. Entry to shutdown cooling cor.d itions, would be evaluated by the operators, at this point. Thic evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 26% and constant or increasing. l s Amendment P 19.4-167 June 15, 1993
CESSAR EENNmos B. RCS subcooling should be at least 20*F O C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350'F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. Constant evaluation of the boron l concentration of the RCS would be performed by the operators as they would be constantly fighting the reduction in the negative moderator coefficient as the inventory cooled down. If these criteria are met, then the operator would align the Safety Injection system f or direct vessel injection and initiate shutdown l cooling. The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once thorough cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would establish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. ; l Amendment P 19.4-168 June 15, 1993 ,
CESSARnuiNum l l 4 B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. Consequential Steam Generator Tube Rupture With the completion of the Standard Post Trip Actions and the beginning of emergency boration, the operators would move on to the diagnostic aid and the Break Identification Chart. The diagnostic aid would lead the operators, based on the information gathered during the Standard Post Trip Actions, to identify a Steam Generator Tube Rupture (SGTR). The Break Identification chart would ask the following questions, and get the following answers: l Pressurizer level changing and Pressurizer pressure rapidly decreasing? l YES Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment pressure increasing? l NO -~ Activity in Steam Plant? l YES (indicates a Steam Generator Tube Rupture) With the Steam Generator Tube Rupture identified the operators will select the SGTR optimal recovery procedure. The actions, as stipulated in the procedures, will occur in the following fashion: Since the boration of the plant would be of utmost concern to the operators, they would be directed to maximize the charging flow and { SI flow. This is done by starting the charging pump and the safety injection pumps. The operators would be aware that, in this Amendment P 19.4-169 June 15, 1993 )
CESSAR ERW"lCATION situation, maximization of charging and safety injection can result in excess RCS inventory and possibly filling the pressurizer to a solid condition. The operators would be prepared to throttle or terminate the SIS pumps. The next concern of the operators would be to evaluate the RCP operating strategy. The generic operating strategy for all depressurization events determined to be LOCAs, is to trip the remaining two RCPs, but allows the continued operation of two RCPs (in opposite loops) for diagnosed, non-LOCA, depressurization events. In the case of the SGTR, if the operators trip the other two RCPs, through miss diagnosis or some other error, this will not be a catastrophic error as is the most conservative recovery action. The operators are required by the procedure to monitor the RCP operating requirements, and trip any that do not satisfy these j limits. l ! The operators would now attempt to cool down the RCS to 525*F so l that when the affected steam generator is isolated, the main steam l safety valves will not lift. Since the isolated steam generator l will be at essentially Tm , since it will 7 longer be a heat sink, l the RCS must be at a temperature which will not correspond to a pressure that will lift the main steam safety valves. This cooldown is achieved by feeding the steam generators with main feedwater and dumping the steam to the condenser via the turbine bypass control system. A less desirable, but optional, destination for the steam is the Atmospheric Dump Valves. This step is procedurally presented before the location, and isolation, of the af fected steam generator, as it would be necessarily performed then if natural circulation were being used. If there is forced circulation, this step is much easier and would be performed in parallel with the location and isolation of the affected Steam Generator. The cooldown would be performed while concurrently monitoring reactor power and boron concentration. Steam generator levels are maintained within the normal band, by the operators, by using main or auxiliary feedwater. This is done l to ensure an adequate heat sink for removing heat from the RCS. The damaged steam generator is located by performing the following actions: A. Sampling the steam generators for activity, B. Monitoring the main steam piping for activity, and C. Monitoring the steam generator levels. l The steam generator with higher activity, higher radiation levels or increasing water levels would be isolated. This is an attempt to re-establish the containment isolation safety function. However, should the pressure in an isolated steam generator Amendment P 19.4-170 June 15, 1993
CESSAR E!L"icari:n b(3 approach the lift setpoint for the MSSVs, it is desirable from the perspective of positive operator control that the ADV open first. The operator would accomplish this by raising the ADV manually at 950 psia. The operators would isolate the affected steam generator in the following manner: A. Close the main steam isolation valve. l B. Close or verify that closed, the main steam isolation bypass valve. l C. Close the main feedwater isolation valve. l D. Isolate the steam generator blowdown. l E. Isolate the vents, drains, exhausts, and bleedoffs for the steam system. l Once this is done, the operators would verify that the correct steam generator has been isolated by checking radiation indications, sampling for activity and noting any possible increase in the isolated steam generator level. l l The next concern for the operators would be to regain RCS pressure control. This will provide subcooling to support the core heat l removal processes. Additionally it will minimize the pressure differential between the steam generator and the RCS which will minimize the leakage. The depressurization is achieved by using the main pressurizer spray or the Reactor Coolant Gas Vent. System. The associated cooldown is achieved by using the unaffected steam generator and the turbine bypass system. If the turbine bypass system is unavailable the atmospheric dump valves may be utilized. Since depressurization may mean a decrease in pressure also, the operators would be constantly monitoring temperature and reactivity. The potential exists for flow of the reactor coolant via the tube rupture into the isolated steam generator, as long as the pressure in the RCS is above that in the steam generator. The steam l generator steam space may fill, and the main steam piping to the MSIV may fill. Draining the steam generator via the blowdown system or steaming the generator to the condenser via the turbine bypass system will solve this problem. Throughout the cooldown, the operators will be monitoring pressurizer pressure to make sure that it is being maintained l within the Post Accident P-T limits or that the cooldown is less f G than 100*F/hr. If at any point these are violated, the operator
) must perform one of the following actions as appropriate:
Amendment P 19.4-171 June 15, 1993
CESSAR nai"icarion A. Stop the Cooldown B. Operate the .aain or auxiliary spray as necessary to depressurize the pressurizer pressure to the P-T limits. l C. If overpressurization still exists and is caused by charging flow, then throttle or stop the pumps and manually control letdown to restore and maintain pressure limits within the Post Accident P-T limits. l The operators would be constantly evaluating, as the cooldown and depressurization progresses, whether they should stop or throttle the safety injection pumps. The safety injection system could be stopped if the all of the following were true; A. RCS subcooling at least 20*F based in average Core Exit Temperature Pressurizer Level is greater than 30% (i.e. covering the heaters) and not decreasing B. At least one steam generator is available for removing heat f rom the RCS RVLMS indicates a minimum level at the top of the hot leg nozzles. At this point in the accident, the RCS would be sampled for activity and boron concentration. The operators would determine the need to continue to borate the RCS in order to achieve the required shutdown margin, given no control rods in the core, including the mass in the pressurizer, for entry to shutdown cooling conditions per Technical Specifications. The operators would, at this point, be already trying to borate the whole RCS including the mass in the pressurizer. If the RCS pressure and temperature were already high, the operator would borate the RCS to the minimum shutdown margin corresponding to T . c Then, during the controlled cooldown phase, as RCS shrinkage occurs, the operators would borate until the cold shutdown margin were reached. The available condensate inventory would be monitored by the operators and replenished, as necessary, from the available sources. Examples of alternate sources of condensate inventory are nonseismic tanks, firemains, lake water supplies, portable tanks, etc. The procedures would now require the operators to consider the cooling and depressurization of the affected steam generator. Although heat from the RCS is being removed by the other steam generator, the affected steam generator will remain at high temperature and pressure. This is because of thermal stratification of the secondary water because without boiling and recirculation, the fluid is not well mixed. Since the goal of depressurization of the RCS is to reach the pressure of the steam generator, the pressure cannot then continue to shutdown cooling Amendment P 19.4-172 June 15, 1993
CESSAR naricariou O entry conditions until the affect steam generators pressure is reduced. This is achieve by one of the following methods: ; A. Feed and Bleed using main or auxiliary feedwater and the blowdown system. This is, however, slow, and if the leak rate is comparable to or greater than the blowdown system's flow capacity, this method would not be effective.
]
B. Short duration steaming of the isolated steam generator will rapidly depressurize it. If the ADVs are used this will result in radiological release, however this can be minimized by steaming to the condenser, while maintaining the SG level above the U-tubes. At this point in the accident the operators would be required to carry-out some activity surveys for the secondary side to access the amount of contamination that has occurred. Area that would be sampled are condensate, and all connecting systems, turbine building sumps, the turbine building ventilation system, auxiliary building ventilation system and other applicable radiation monitors. During this phase of the recovery the automatic operation of certain safeguard systems is undesirable. The operators would be O directed to manually reset the CIAS, SIAS, CSAS and MSIS setpoints to lower than the originals, safeguards remain available to ensure that these engineered until the RCS is cooled and depressurized. Entry to shutdown cooling conditions would be evaluated by the operators, at this point. This evaluation would continue throughout the depressurization and cooldown until they are met; A. Pressurizer level control should be established (cleared or clearing RCS pressure control alarms) and verified by a level greater then 30% and constant or increasing. l B. RCS subcooling should be at least 20*F. C. RCS pressure should be at or below the shutdown cooling entry pressure of 400 psia. l D. RCS hot leg temperature should be at or below the shutdown cooling system entry temperature of 350*F. l The activity level of the RCS inventory must be determined, in order to evaluate the dangers associated with routing the fluid outside containment. l If these criteria are met, then the operator would align the Safety (' Injection system for Direct vessel injection and initiate shutdown l cooling. Amendment P 19.4-173 June 15, 1993
CESSAR !aWication The operator must continually monitor for voids in the RCS. This is done by monitoring the following parameters: A. Letdown flow greater than Charging flow. l B. Pressurizer level increasing significantly more than expected while operating pressurizer spray. l C. RVLMS indicating voiding in the Reactor Vessel D. Unheated thermocouple temperature indicates saturated conditions in the reactor vessel head. Assuming voids do not occur, at this point the core is now in shutdown cooling. If long-term decay heat removal fails either by the shutdown cooling system failing or emergency feedwater, "once through cooling" can be achieved. This is an RCS heat removal success path that, when deemed necessary, can allow inventory in through the safety injection system and out thorough the top of the pressurizer using the safety depressurization valves. This will cause the containment spray system to actuate with the increase in containment temperature and pressure. The operators would esNblish this method of heat removal by performing the following actions: A. Open the steam dump and bypass valves and the atmospheric dump valves. This is done to utilize any remaining inventory in the steam generators to lower RCS pressure to as low as possible to initiate once through cooling. B. Trip all RCPs. This is done because with the safety depressurization valves open the RCS may be in a saturated condition and this is not desirable for RCP operation. C. Safety injection pumps aligned for Direct vessel injection. D. Switch on all available charging and safety injection pumps. The operators must also check that the containment spray has actuated in high containment pressure. If this is not so then do it manually. At this point the containment spray pumps will be circulating the IRWST inventory thorough the CS heat exchangers. This recirculation would be monitored for any failure in heat removal from the IRWST, as failure could potentially lead to a break in containment. O I I Amendment P 19.4-174 June 15, 1993 i
C E S S A R En &"icaries O Hedium LOCA (due to failure of the Primary Safety Valves to rescat) There are cix major recovery actions that the operators are required to perform in the LOCA procedure, in order to bring the plant to cold shutdown following the accident. The first major action consists of maximizing the Safety Injection flow into the RCS and attempting to isolate the source of the leak. This step reduces the risk of core uncovery and facilitates the recovery from the LOCA. The second and third major actions do not apply to the medium LOCA as these are done when the leak is isolable. Since a medium LOCA through the Primary Safety Valves is un-isolable, only the fourth through the sixth major actions are applicable. The fourth major action involves a rapid plant cooldown using the Steam generators. Although this is of little help in a medium LOCA situation, no distinction of the size of the break is made in the operating procedure and thus this method is still employed. The fifth major recovery action is the commencement of post-LOCA Long Term Cooling (LTC). Safety Injection flow is switched, by manually aligning pumps 3 and 4, to simultaneous hot leg / DVI injection. The sixth major action is t, determine whether simultaneous hot / direct vessel injection in a recirculation mode should continue. The operator actions, as stipulated in the procedures, take place in the following fashion: L Since LOCAs have very similar characteristics to other events, Excess of Steam Demand Event (ESDE) and Steam Generator Tube Rupture (SGTR), the operator would be directed to the Break Identification Chart for confirmation of the diagnosis of the event. With the medium LOCA, the dccision process would probably progress as following: Pressurizer Level Changing and Pressurizer pressure rapidly decreasing? l YES Subcooling increasing or one, or both, Steam Generators indicate pressure LOW? l NO (indicates a primary side break) Containment Pressure Increasing? l YES (indicates a LOCA inside Containment) . With the successful diagnosis of a LOCA inside containment, the operator would then move on to check whether the safety injection e' system has actuated. Safety injection now serves two purposes, to ( replenish the rapidly depleting RCS inventory and to add the boron L Amendment P 19.4-175 June 15, 1993
CESSAR nai"icariou to achieve the required shutdown margin for a core with no control O rods inserted. The next action required by the procedure, to maximize safety injection flow, would be verified by the operator. Safety injection flow rate will follow pressurizer pressure according to plant specific SIS dalivery curves. In the case of the medium break LOCA safety injection tanks have not released. If any safety injection pumps have not actuated, the operator is instructed to manually start the pumps. l The next two steps of the LOCA procedure refer to the RCP operating strategy. The operators would already have tripped two of the RCPs, at this point. They would be required to verify that pressurizer pressure had decreased to less than 1300 psia following an SIAS, before tripping the rest of the RCPs. Analyses have shown l that continued operation of the RCPs can decreases core cooling capability, in the case of a break of this size, because of lost inventory being flushed out the break. The next stage of the procedure requires the operator to isolate potential sources of other leaks of inventory as a precaution. The following steps are done in order to achieve this goal: check that the safety depressurization valves are closed, check the head vents, check that the isolation of the letdown system on.SIAS happened correctly and check that all RCS sampling lines were isolated on SIAS. In the case of the systems that should have isolated automatically on SIAS, the only indication that these systems may not have isolated properly will be inherent in the switch position of the isolation valve. The operators would now be concerned with verifying that the LOCA is not outside of containment. A LOCA outside of containment would not challenge any of the containment safety functions and the operator would be directed to skip all of the procedural actions associated with the containment safety functions. The indications that a LOCA has occurred outside of containment are auxiliary building radiation alarms and unexplained increases in the auxiliary building sumps levels. The assumptions, for this scenario, is that the medium LOCA is occurring inside containment. The next set of actions, that the operators would be required to do by the LOCA procedure, is associated with the containment safety functions. First, the operator would check that CIAS had actuated on high containment pressure, typically 2.7 psig. If CIAS had not actuated correctly, then the operators' task would be to manually position the containment isolation valves to their accident positions. l The next step would be to ensure that, since containment pressure is above 10 psig, containment spray actuation has occurred, and at , least one spray is working. Amendment P l 19.4-176 June 15, 1993 )
CESSARn h a s
'/ The next issue that the operators are required to address, is associated with the containment combustible gas control safety l function. The evaluation associated with this situation is solely the responsibility of the Plant Technical Support Center. Various options are available to the PTSC. Decisions and actions taken are not to be evaluated in this analysis.
The procedure, at this point in the progression of the accident recovery directs the operators to take one of two paths depending on whether the break has been isolated or not._ This analysis pertains to a medium un-isolable LOCA. The actions that the operator would take for the next, approximately 20 steps, are associated with regaining RCS inventory control, while maintaining RCS heat removal. The goal of the operator is to establish shutdown cooling, if possible, as the means of core heat removal. In the case of a medium LOCA, Long-Term cooling is all that is achievable. The technique that the procedure requires makes use of a rapid cooldown via the steam generators. An aggressive cooldown, while holding the cooldown rate within Technical Specifications Limitations and maintaining reactivity control, improves RCS heat removal by enhancing. natural circulation and reflux boiling. The RCS is . assumed to have depressurized to an equilibrium pressure with the containment. In this condition, the RCS fluid is at a lower temperature than that V of the steam generators. The steam generators, therefore, act as a heat source, superheating any steam in the RCS which may be flowing through the S/G to the break. By cooling down the steam generators, heat input to the RCS is reduced. For this analysis, the condenser and the turbine bypass system is available. In order to achieve this " aggressive cooldown", the operator must maintain steam generator levels in the normal band. The operators l must also ensure that adequate condensate inventory is available by monitoring the condensate storage tank, and replenished.from the available sources as necessary to continually provide a secondary heat sink. Examples of alternate sources of condensate are non-seismic tanks, firemains, lake water etc. Plant specific sources should be available and this will be credited in the analysis. Since the RCS pressure is at equilibrium with containment pressure, there would be no need to depressurize the system, which is the next step indicated by the procedure. Since the RCPs are not operating, it may be necessary to evaluate restarting the RCPs. This is unlikely, however, due to the severity of the break. Since the conditions for re-start of the RCPs are not met, the operators would be monitoring for natural circulation conditions in p the RCS. In order to verify that natural circulation was occurring the operator would be monitoring: (] Amendment P 19.4-177 June 15, 1993
C E S S A R 8!E n u m ,. A. Loop AT(T 3,t - T ,,1a) less than full power AT. l O B. Hot and Cold leg temperatures. l C. RCS subcooling is at least 20' based on average Core Exit Temperature. D. No abnormal differences between T 3,t RTDs and average Core Exit Temperature. The operators will necessarily be making use of two phase natural circulation and flow through the break. In order to for this to maintain heat removal, the following must be verified by the operator: O O Amendment P I 19.4-178 June 15, 1993
,i, A s
-K a a eoe
- 8 8 e ea a ee a ea eoea eeea eeeee g e' ; ; ; - . - . . e : e : t e : s e : --- . .-. ,
!!!!!!!!!!!$$.$.$.$.$.$.$.i.5.!.$.f..III i I
[%) s v, 5
.s , _.,
- 2 : :
E 7 y
. r. i
.m1
-- -- -- __ __ {
Ih ~~
.: v e
'. :n:
=- -
_.": v. m.;, v.e .
?
I j
.! I r
,i ve ;
6fE- 1
+n ?'
tb x,r
.' O C (4
A . i
.r,tk. .
c q:;s - e.. n. m sh: ( -rw s n .. g -:. ! v ;;,, r n-r t.~ e e.n v i:2 o:.*r
.r ;:> :
- ri.
b'
- .s L
0.. t.
. e, .
M f L . fes ,
}t - Amendment P June 15,1993 ~
TM 9#' gy37f //@ ATWS EVENT TREE 19.4.13-2
CESSAREn h a f% ( ) 1 E. Relief valve fails to open (grii) j Mean = 2.0E-5/ demand Median = 1.36E-5/ demand i Error Factor = 4.22 : The ultimate pressure of the SCS System piping is greater than normal RCS pressure. Therefore, the probability of a pipe break in the SCS System when exposed to the full RCS pressure is less than
- 1. For this study, a mean value of 0.1 is used for the SCS System pipe break probability. An error factor of 5 was assumed for this value. The corresponding median value is therefore 6.21E-2/ demand.
As shown in Figure 19.4.14-1, there are four paths for Interfacing l System LOCA via the SCS System suction lines. Therefore, the following expression is used to estimate the frequency of Interfacing System LOCA via these lines. F(ISL)2 = 4 < A,,) x P3 [19.4-16] F(ISL)1=4q,)',TP3 [19.4-17) is the frequency of Interfacing System LOCA via the Where,F(ISL)dtionlines,P SCS System su 3 is the conditional probability of pipe break in the SCS System, and the other variables are as previously defined. The following expression is used to estimate the frequency of Interfacing System LOCA via the SCS return lines: F(ISL)2 =2 <hscsn> x P3 [19.4-18] S Al c 5 3 F(ISL)2 =4 8 (120 A'cA 5 C ' + q# C 8 4 3 7#
+ q3 t 3+ 3 qcq3bt 2 24 6 [19,4_19)
MAc s g24 qc3 Ms 2
+3q e 6 2 2
Ae 2
+ 3 qc q$ g,qc3 qsy)pc b Where, F(ISL)2 is the frequency of Interfacing System LOCA via the SCS System return lines, P3 is the conditional probability of pipe break in the SCS System, and the other variables are as previously ' defined.
Amendment P 19.4-193 June 15, 1993
CESSAREnFnceu CESAM was used to estimate the total frequency of Interfacing System LOCA by summing equationa [19.4-17] and [19.4-19) and substituting appropriate failure rates and an value of 1.5 years for T in these equations. The results are: Mean = 5.16E-10/ year Median = 1.35E-12/ year Error Factor = 2.34E+2 O O Amendment M 19.4-194 March 15, 1993
CESSAREMiNmu (3 ') Section 19.2.5 describes the methodology used for the Human Reliability Analysis (HRA) for the System 80+ PRA. The detailed calculation for each Human Error Probability (HEP) is presented in the failure rate calculation worksheets in Appendix 19.5E. The calculation sheets for the HEPs are presented in the following manner; a) the scenario, b) the HRA tree, c) the calculation of the HEP and d) the worksheet presentation of the manipulations required to calculate the uncertainty bounds for the HEP. The scenario is a qualitative description of the action, the conditions under which it is performed and the components of the task that are required to achieve the action. Other information is also provided such as whether the actions are governed by a procedure and the time assumed for completion of this action. The HRA tree represents the model that was generated for the human error. Each of the branches that fall to the right represent a f ailure in a component of the action that will result in failure to complete the action. Sometimes there is an inherent dependency such as when the branch represents the opening of two valves. This is reflected in the calculation. There may also be a (/ conditionality on a failure branch such as when it is comprised of two or more failures. Recovery actions are represented by dashed lines returning to the success branches. The calculation is reflected in a table that contains 5 columns.
" TASK" is an alphanumeric designation of the failure branch in the HRA model. Typically, they refer to the failure branches in sequential order i.e., Task A is reflected by the first failure, task B the second and so on, horizontally down the model. A prime symbol, " ' ", is used to denote another failure that is equally ac appropriate at that point in the model but reflects a different l'EP . "BHEP" is the Basic Human Error Probability. This is provided by Swain & Guttman, (1983)(3D, and the reference is found in the " Source" column. " PSF" refers to the Performance Shaping Factors that are used to modify the BHEP in order to more accurately reflect the analyst's interpretation of the scenario.
Finally, " HEP" reflects the number that is used for the combinatorial calculation found below the table that reflects the HEP that will be used in the PRA. The worksheet representation of the uncertainty bound calculation shows the various stages of the algorithm for propagating uncertainty bounds as prescribed by Swain and Guttman, 1983(3D, Appendix A. This algorithm makes use of the assumption of the lognormality of the distribution to propagate the uncertainty bounds associated with the various failure branches of each HEP [mV) calculation. A distribution is generated for the HEP based on the Amendment M 19.5-13 March 15, 1993
CESSARnn% - manipulations used to calculate the HEP. Given the mean and O standard deviation of this distribution, the upper (95% tile) and lower (5% tile) bounds are calculated and subsequently used to calculate the UCB. Table 19.5-5 summarizes the human error probabilities used in this study. The probabilities that the operator fails to perform appropriate recovery actions are not included in this table. They are presented in Section 19.5.7. 19.S.6 SPECIAL EVENT PROBABILITIES As discussed in Section 19.2.2, the system level accident sequences leading to core damage were identified using event tree analysis. Each system level accident sequence consists of an initiating event and one or more additional elements. Each element represents either a front-line system or a special event, such as failure to restore offsite power within a given time or failure of a primary safety valve to reclose. Failure to restore offsite power within a given time and other recovery actions are discussed in Section 19.5.7 of this report. The following special events, excluding the restoration of power, appear as elements in the event trees:
- SE-PSV -
Failure of a primary safety valve to rescat
- SE-MTC -
Adverse moderator temperature coef ficient for overpressurization
- SE-CSGTR -
Consequential steam generator tubt rupture following ATWS event
- SE-SREOC -
Stuck rod at end of cycle
- SE-PSVFTO - Primary Safety Valves fail to open (2 or more)
- SE-MTC1 -
MTC between -0.30 and -0.42 and one PSV fails to open , Usually, elements of an event tree are quantified using fault tree analysis. However, the above special elements were quantified without recourse to fault tree analysis. The following subsections discusses the quantification for these special events. The special event probabilities are summarized in Table 19.5-6. 19.5.6.1 Failure of a PSV to Resent Failure of a primary safety valve (PSV) to reseat, given that it opened, appears as an element on the Loss of Offsite Power and ATWS event trees. Operating experience indicates that the PSVs do not lift following a loss of offsite power. A best estimate transient analysis also indicates that RCS pressure would remain below the Amendment P 19.5-14 June 15, 1993
CESSAR Enncmos n PSV setpoint following a loss of offsite power with RCP trip and failure of the Steam Bypass Control System. (see Figure 19.5-1.) There, it was assumed that the probability of the PSVs opening following a loss of offsite power event was 0.1. According to the ALWR data base"), the probability that a PSV fails to reseat is 7.0E-3. Four PSVs are included in the System 80+ Design. All valves have the same setpoint and therefore, all will open -if challenged. Since there are four PSVs, the probability that any one out of the four fails to rescat is 4x7.0E-3 or 2.8E-2. An error factor of 3.0 is assumed. Therefore, for a loss of offsite power event, the probability of a PSV failing to reseat equals the probability that the PSVs open times the probability that a PSV fails to reseat given that they have opened. SE-PSV(LOOP) = (0.1)*(2.8E-2) = 2.8E-3 [19.5-10] For ATWS, the probability that the PSVs open is assumed to be 1.0. Therefore: SE-PSV(ATWS) = (1.0)*(2.8E-2) = 2.8E-2 [19.5-11] 19.5.6.2 Adverse MTC Overpressurization Adverse moderator temperature coefficient (MTC) appears as an ( element on the ATWS Event Tree. In previous ATWS risk analysis"3) , the NRC used a value of 0.5 for adverse MTC overpressurization. Because this value does not agree with best estimate calculations, it is not used in this study. Instead best estimate calculations and engineering judgement were used to determine the probability of an adverse MTC. Best estimate calculations have shown that for a typical System 80+ plant, level C stress pressures (3200 psia for this analysis) will not be exceeded for MTC of -0.30 or less, even for a total loss of feedwater without turbine trip if all four PSVs open. For a typical System 80+ fuel cycle, as shown on Figure 19.5-2, the 100% power MTC decreases to -0.30 within the first 1% of the fuel cycle. Therefore, for this study, a value of 0.01 and an error factor of 3.0 was used for the probability of an adverse MTC. 19.5.6.3 Consequential SGTR Following ATWS Consequential steam generator tube rupture (SGTR) appears as an element on the ATWS Event Tree. During an ATWS event the pressure of the primary side increases without any significant increase in secondary side pressure. Therefore, the differential pressure across the tubes of the steam generators also increases. Such increase in differential pressure can lead to consequential tube rupture of the generators. There is little or no operating data O available that may be used to estimate the probability of a Amendment P 19.5-15 June 15, 1993
CESSAR nainemon consequential SGTR. Therefore, engineering judgement was used to estimate the probability of this event. For this study, the probability that a consequential SGTR following an ATWS event is assumed to 0.1 with an error factor of 3.0. In previous risk analyses" " "), an empirical steam generator tube strength model was developed to determine the probability of tube rupture due to excess primary / secondary pressure differences. A review of the model shows that it predicted a probability of 0.01. The model made no provisions for including non-mechanical i degradation of the tube. Therefore, a larger and more conservative probability value was used in this study to account for these uncertainties. 1 9 ., 5 . 6 . 4 Stuck Rod at End of Cycle A stuck rod appears as an element on the Large Secondary Side Break (LSSB) Event Tree. This element is defined as failure of the most reactive rod to insert into the reactor core at the end of cycle. A review of PWR operating experience from C-E Reliability Data System"" and the NRC Graybooks oz) indicates that U.S. PWRs had a total of 4343 scrams between January 1961 and January 1989. Table 5-8 presents the number of scrams for each plant. During the same time period, there were five events in which rods did not insert on a scram, according to Nuclear Power Experience *). Using this information, the probability of a stuck rod during a scram is estimated as: P= 11u ber f cram with stuck rod (39,5_333 Total number of Scrams 5 P= 4353
= 1.15E-3 (19.5-12]
Assuming that end of cycle represents the last 10% of the cycle, then the probability of a stuck rod at the end of cycle becomes 1.15E-4. An error factor of 5.0 is assumed. 19.5.6.5 Primary Safety Valve Fails to Open The primary safety valves (PSVs) are required to open to mitigate the pressure peak associated with an ATWS. Analyses have shown that with an MTC of -0.42, the RCS pressure will remain below 3200 psia if 3 or 4 of the 4 primary safety valves open. If 2 or more of the primary safety valves fail to open, the RCS pressure will exceed 3200 psia for an MTC of -0.42. SE-PSVFTO is defined as j
" failure of 2 or more primary safety valves to open on demand".
Amendment P 19.5-16 June 15, 1993
CESSAR 8ancma ? \
~\/
The failure of two or more primary safety valves can occur as a result of random failures or common cause failures. Thus, the probability of failure can be expressed as: P(SE-PSVFTO) = Q ,.naa, + Qco ,cou,, [19.5-13] For the random failure of 2 or more valves of a set of 4 valves, there are 5 combinations of failure of two valves, 4 combinations of the failure of 3 valves and one combination of the failure of all 4 valves. Therefore, the random failure element can be expressed as: Q,,ngo, = 5
- Q,2 + 4*Q,3 + Or' [19.5-14]
The basic demand probability for failure of safety valves to open on demand is: Q, = 1. 0E-3 / demand with an error factor of 4.22 (see calculation sheet VRA in Appendix 19.5A) The common mode failure element is quantified using the Multiple Greek Letter (MGL) method described in Reference 7. The common cause factor for the failure of 2 of 4 components is given as: C2 = 1/3S*(1 7) [19.5-15] a The common cause factor for failure of 3 of 4 components is given as: C 3 = 1/ 3Sy* (1-6) [19.5-16] The common cause factor for failure of 4 of 4 components is given as: C. = Sy6 [19.5-17] The common mode failure element can now be expressed as: Qcomon cause
=
(SC2 + 4C 3+ C. )
- Q, [19.5-18]
The parameter values are taken from Reference 7. These values are:
$ = 19.5.7E-02 y = 0.5 6 = 0.9 The value for S is based on the BWR relief valve parameters. The other parameter values are generic common cause factor values provided in Reference 7. Reference 7 does not provide error factor
[~N values for the parameters or a methodology for calculating the ij error factor for the common cause failure rate. Therefore, the Amendment M 19.5-17 March 15, 1993
CESSAR nutricarian error factor for the basic safety valve failure rate is used for the common cause failure rate. The common cause failure rate is:
=
Qc ,mn cou,, [5*(.33*5.7E-02*{1-0.5}) + 4*(.33*5.7E-2*0.5*{1-0.9})
+ 5.7E-02*0.5*0.9)
- 1.0E-03a Qc o mo cou,, =
(4.70E-02 + 3.76E-03 + 2.57E-02)
- 1.0E-03 Oc. m,n c a,. = 7.64E-05 with an error factor of 4.22 The random f ailure element can be approximated using only the first term of the equation, yielding:
Q , ,n y, = 5
- Q,2 [19.5-19]
Q n,n y, = 5*(1.0E-03)2 Q , ,n &, = 5.0E-06 with an error factor of 4.22 The total failure rate is now calculated as: P(SE-PSVFTO) = Q,, nam, + Qc _ n c,u,, = 7.64E-05 + 5.0E-06 [19.5-20] P(SE-PSVFTO) = 6.14E-05 with an assigned error factor of 4.22. 19.5.6.6 MTC Between -0.3 and -0.42 AND One PSV Fails to Open Best estimate thermo-hydraulic analyses have shown that for an ATWS with an MTC of between -0.30 and -0.42, the peak RCS pressure will remain below 3200 psia if all four PSVs open. This element is defined as "MTC is between -0.30 and -0.42 AND one of four PSVs fails to open". The probability of occurrence for this event can be expressed as: P(SE-MTC1) = P(-0.30 > MTC < -0.42)*P(1 of 4 PSVs fails to open) As can be seen from Figure 19.5-2, System 80+ will have an MTC in the range of -0.30 to -0.42 approximately 1% of the time. An error factor of 3 is assumed. There are four ways in which one of four PSVs can fail to open.
- Thus, P(1 of 4 PSVs fails to open) = 4*P(one PSV fails to open)
O Amendment P 19.5-18 June 15, 1993
CESSAR 8lnamu n V' The probability that one PSV fails to open is 1.00E-03/ demand with an error factor of 4.22. (See calculation sheet VRA in Appendix 19.5A.) The value for SE-MTC1 was calculated based on the above values using the CESAM utility code. The mean value is 3.98E-05/ demand with an error factor of 6.0. 19.5.7 NON-RECOVERY PROBABILITIES During the progression of an accident, the operator can perform certain actions that will restore the operability of a system or function that has failed and prevent the core from melting. This study credits such actions provided there is sufficient time. The recovery actions are limited to restoring offsite power, aligning the standby Combustion turbine to provide 4.16 KV power, and manual opening of motor-operated valves. Failure to perform any of these actions is not included as an element of the event trees or as a component of the fault trees, but rather the fault is applied directly to those core damage cut sets that can be recovered. The following paragraphs present the probabilities that the operator fails to perform these recovery actions. g Offsite power is the preferred source of power. The plant is designed such that upon loss of offsite power the emergency diesel (V ) generators or the alternate AC power source will provide power to shutdown the plant. Loss of all AC power sources will lead to core damage if power is not restored within a specified time period for certain initiating events. Therefore, core damage cut sets that include loss of offsite power and failure of the diesel generators are evaluated to determine the allowable time for restoring of fsite power to prevent core damage. Depending on the initiating event and systems affected, the elapsed time periods considered for restoring offsite power include 1, 3, 4, 6, 7, 9, 12, 13, 15, and 16 hours. The probabilities that offsite power is not restored within the specified times are presented in Table 19.5-7. These probabilities are extracted from ALWR data baseW . They apply only to events initiated during power operation of the plant. The alternate AC power source is included in the System 80+ Design as a backup to loss of offsite power events. This source provides power at the 4.16 KV level. Upon loss of power to the 4.16 KV buses, which is usually associated with loss of offsite power, the alternate AC power source is actuated. Because the alternate AC source can be aligned to various combinations of two 4.16 KV buses, including class 1E and non-1E, operator action is required to ensure that it is properly aligned to a 4.16 KV class 1E bus when required. N. Amendment P 19.5-19 June 15, 1993
CESSAR nn%mos The alignment of the alternate AC source is treated as another way of restoring power to prevent core damage. This recovery action includes starting and loading the alternate AC source. The requirements of the ALWR specifies that the reliability of the alternate AC source should be at least 0.98. Without plant specific details, proper alignment of this power source is regarded as a critical step in restoring offsite power early in the accident sequence and a value of 0.03 is assigned for the probability that the operator f ails to perform this recovery action. Therefore, the non-recovery probability for the alternate AC power source is 0.05. An error factor of 3.0 is assumed. Note that the alternate AC power source is designed to be available approximately 15 minutes after the loss of an offsite power event and is treated as a recovery action for those core damage cut sets that can be recovered after 15 minutes into the accident. Failure of a motor-operated valve outside containment is considered to be partially recoverable. Failure of a motor-operated valve (MOV) may be due to mechanical failure of the valve hardware or failure of the valve actuator. If the MOV failure is due to failure of the valve actuator, the MOV failure can be recovered by manually opening the valve. If the MOV failure is due to mechanical failure of the valve itself, the MOV failure is not recoverable. A recovery factor can be applied for the recoverable portion of the MOV failure. This is accounted for in estimating the non-recovery probabilities. The f ailure probability for a motor-operated valve can be expressed as: 0 = (03+ 0,) = (f3 +f) O [19.5-21) where; Q : overall failure probability of MOV Os : failure probability of MOV due to hardware failure Q, : failure probability of MOV due to valve actuator failure fn : fraction of failures due to valve hardware faults
- f. : fraction of failures due to actuator faults Manual recovery is possible only for valve actuator failures.
Thus, the failure probability of a motor-operated valve after recovery can be represented as: O Amendment M 19.5-20 March 15, 1993
CESSA.R 8lninema k O '= (03 +N,0,) = (f 3+N,f,) D=R D f [19.5-22) where; Or : failure probability of MOV after recovery N, : failure probability of local manual action to open the MOV given actuator failure Rr : Non-recovery factor (f n + N,f,) The fractions of motor-operated valve failures due to valve hardware faults and valve actuator faults (f3 and f) can be estimated by reviewing operating experience data. Based on a review of the data on motor-operated valves in EPRI/NP-3967(au, the following factors were obtained: f3 = 0.1, f, = 0.9 N, is estimated by engineering judgement based on a survey of NUREG/ CR-2 7 2 8 (7" and NUREG/CR-4 8 3 4(72) . The following non-recovery probabilities were extracted from NUREG/CR-2728(70 and NUREG/CR-4834(72); a) from NUREG/CR-2728 'd available time mean 15-20 min. 0.25 20-30 min. 0.10 30-40 min. 0.05 40-70 min. 0.03 5 70 min. 0.01 b) from NUREG/CR-4834 available time mean upper bound 60 min. 1.0E-2 1.0E-1 120 min. 2.9E-3 2.9E-2 180 min. 1.3E-3 1.3E-2 300 min. 4.7E-4 4.7E-3 600 min. 9.9E-5 9.9E-4 Based on the above information, a value of 0.1 was selected for N,. Thus, the recovery is: Rf =- (f3 + N,f ) = (.1 + .1*.9) = 0.19 [19.5-23] Table 19.5-7 contains a summary of the probabilities that the various recovery actions considered in this study are not performed. b Amendment M 19.5-21 March 15, 1993
CESSAR Ebuincmon 19.5.8 FLAGS As described in Sections 19.2.3 and 19.2.6, a number of the fault trees constructed for this analysis contained subtrees that were not applicable for selected initiated events or were only applicable for specific initiating events. When solving the event trees the applicable subtrees were turned on or eff as needed through the use of flags. Table 19.5-9 describes the flags used in this analysis, and Table 19.5-10 presents the settings for these flags for each initiating event. O O Amendment M 19.5-22 March 15, 1993
[' '% TABLE 19.5-5 (Sheet 1 of 2) OPERATOR ACTIONS Name Prob. Description i ANFDCST 1.10E-04 OPERATOR FAILS TO ALIGN CST TO EFW STORAGE TANKS AHFDXvLV 6.50E-03 OPERATOR FAILS TO ODEN CROSS-CONNECT VALVES AMFF-RSEFW 1.05E-03 OPERATOR FAILS TO RE-START THE EFW PUMPS / SYSTEM AHFFASCSGTR 7.10E-02 OPERATOR FAILS TO PERFORM AGGRESSIVE SECONDARY COOLDOWN FOR SGTR AHFFASCSLOCA 6.40E 02 OPERATOR FAILS TO PERFORM AGGRESSIVE SECONDARY COOLDOWN FOR SMALL LOCA AHFLEF-338 8.73E-04 EFWP-101 MANUAL DISCHARGE VALVE EF-338 MISPOSITIONED AHFLEF-339 8. 73E -04 EFWP-103 MAWUAL DISCHARGE VALVE EF-339 MISPOSITIONED AMFLEF-340 8. 73E-04 EFWP-102 MANUAL DISCHARGE VALVE EF-340 MISPOSITIONED ANFLEF-341 8.73E-04 EFWP-104 MANUAL DISCHARGE VALVE EF-341 MISPOSITIONED AHFLP102V 5.55E-04 EFWP-102 RECIRCULATION VALVES MISPOSITIONED AHFLP104V 5.55E-04 EFWP-104 RECIRCULATION VALVES MISPOSITIONED AHFLTP101V 5.55E-04 EFWP-101 RECIRCULATION VALVES MISPOSITIONED AMFLTP103V 5.55E-04 EFWP-103 RECIRCULATION VALVES MISPOSITIONED CHFFCC102-103 3. 75E -03 OPERATOR FAILS TO CLOSE NON-ESSENTI AL COMPONENT CCW ISOLATION VALVES CHFFCC202-203 3.75E-03 OPERATOR FAILS TO CLOSE NON-ESSENTI AL COMPONENT CCW ISOLATION VALVES CHFFCCWP1B 1.20E-03 OPERATOR FAILS TO START CCWP 18 CHFFCCWP2B 1.20E-03 OPERATOR FAILS TO START CCWP 2B CHFFISOLATECCWS 5.60E-02 OPERATOR FAILS TO ISOLATE CCW TO SPENT FUEL HEAT EXCHANGER FOLLOWING A SEISMIC EVENT l CHFFSFPHX1 4.50E-03 OPERATOR FAILS TO ISOLATE SFP HX1 CHFFSFPHX2 4.50E-03 OPERATOR FAILS TO ISOLATE SFP HX2 CHFFSSWP1B 1.20E-03 OPERATOR FAILS TO START SSWP 18 CHFFSSWP2B 1.20E-03 OPERATOR FAILS TO START SSWP 28 CHFFSTBMX1B 3. 75E-03 OPERATOR FAILS TO OPEN CCW HX 1B ISOLATION VALVES CHFFSTBHX28 3. 75E -03 OPERATOR FAILS TO OPEN CCW HX 2B ISOLATION VALVES CHFLCC-1305 8. 73E-04 VALVE CC-1305 NOT DPENED DUE TO PRE-EXISTING MAINTENANCE ERROR CHFLCC-2305 8. 73E-04 VALVE CC-2305 NOT OPENED DUE TO PRE-EXISTING MAINTENANCE ERROR CHFLSW 13D5 8. 73E- D4 VALVE SW-1305 NOT DPEN DUE TO PRE-EXISTING MAINTENANCE ERROR CHFLSW-2305 8.73E-04 VALVE SW-2305 NOT OPEN DUE TO PRE-EXISTING MAINTENANCE ERROR OMFFCTMTISOVLVS 3.14E-03 OPERATOR FAILS TO REOPEN CONTAINMENT ISOLATION VALVES (UV-006 AND UV-008) DNFFRECLOSEADV 3. 75E-03 OPERATOR FAILS TO RECLOSE ADVs ON THE RUPTURED SG-2 FHFFCSAS 4.60E-03 OPERATOR FAILS TO GENERATE CONTAINMENT SPRAY ACTUATION SIGNAL FHFFEFWS 4.60E-03 OPERATOR FAILS TO ACTUATE EFWS COMPONENTS FHFFSIAS 4.60E-03 OPERATOR FA!LS TO GENERATE SAFETY lNJECTION ACTUATION SIGNAL GHFFCFSMOVS 4.50E-02 OPERATOR FAILS TO INITIATE CAVITY FLOODING SYSTEM GHFFCFSMOYSB0 2.00E-01 OPERATOR FAILS TO INITIATE CAVITY FLOODING SYSTEM FOR 580 GHFFCSOUT 3.04E-02 OPERATOR FAILS TO CONNECT DUTSIDE WATER SOURCE TO CONTAINMENT SPRAY HEADER GHFFCSS 3.00E-02 OPERATOR FAILS TO INITIATE CONTAINMENT SPRAY SYSTEM GMFFRECOGNIZE GNFLBDAMPER1 2.40E-02 5.55E-04 OPERATOR FAILS TO RECOGNIZE THE NEED FOR THE EMERGENCY CONTAINMENT SPRAY BACKUP SYSTEM AVS TRAIN 1 BALANCING DAMPER MISPOSITIONED DUE TO RAINTENANCE ERROR
-l GMFLBDAMPER2 5.55E-04 AVS TRAIN 2 BALANCING DANPER MISPOSITIONED DUE TO KAINTENANCE ERROR GMFLSI-110 4.85E-03 OPERATOR FAILS TO ALIGN SCS FLOWPATH 1 TO COOL THE IRWST VIA SCS 1 PATH GHFLSI-110/430 3.92E-03 OPERATOR FAILS TO ALIGN SCS PUMP 1 TO COOL THE 1RWST VIA CSS 1 PATH GHFLS!-111 4.85E-03 OPERATOR FAILS TO ALIGN SCS FLOWPATH 2 TO COOL THE IRWST VIA SCS 2 PATH GHFLSI-111/431 3.92E-03 OPERATOR FAILS TO ALIGN SCS PUMP 2 TO COOL THE IRWST VIA CSS 2 PATH GMFLSt-430 4.85E-03 OPERATOR FAILS TO ALIGN SCS HX1 TO COOL THE IRWST VIA CSS PUMP /SCS HX 1 PATH GHFLSI-431 4.85E-03 OPERATOR FAILS TO ALIGN SCS HX 2 TO COOL THE IRWST VIA CSS PUMP /SCS HX 2 PATH GHFLVD AMPER1 5.55E-D4 AVS TRAIN 1 UNIT VENT DAMPER MISPOSITIONED DUE TO MAINTENANCE ERROR CH F LVD AMPER2 5.55E-04 AVS TRAIN 2 UNIT VENT DAMPER MISPOSITIONED DUE TO MAINTENANCE ERROR GHFMBTPASS1 1.8 7E-04 CSS /IRWST RETURN LINE 1 MOVs MISPOSITIONED AFTER TEST Amendment P June 15, 1993
TABLE 19.5-5 (Sheet 2 of 2) OPERATOR ACTIONS Nesne Prob. Description GMFMBYPASS2 1.87E-04 CSS /IRWST RETURN LINE 2 MOVs MISPOSIT!DNED AFTER TEST GMFMCSS11RWST 3.85E-03 DPERATOR FAILS TO IN!TI ATE COOLING THE IRWST V! A CSS 1 PATH GMFMCSS2tRWST 3.85E-03 OPERATOR FAILS TO INITI ATE COOLING THE 1RWST VIA CSS 2 PATH HHFFHOTLEG 1.38E-04 OPERATOR FAILS TO INITIATE HOT LEG INJECTION HHFLSI-218 7.63E-04 PUMP 1 ORIFICE BYPASS VALVE SI-218 MISPOSITIONED AFTER PREVIOUS USE HHFLSI-219 7.63E-04 PUMP 2 ORIFICE BYPASS VALVE Si-219 MISPOSITIONED AFTER PREVIOUS USE HHFLSI-254 7.63E-04 PUMP 3 ORIFICE BYPASS VALVE SI-254 MISPOSITIONED AFTER PREVIOUS USE HHFLSI-255 7.63E-04 PUMP 4 ORIFICE BYPASS VALVE SI-255 MISPOSITIONED AFTER PREVIOUS USE HHFLSI-435 8.73E-04 St PUMP 3 DISCHARGE ISO VALVE S1-435 MISPOSITIONED AFTER MAINTENANCE HHFLSI-447 8.73E-04 JI PUMP 4 DISCHARGE ISO VALVE SI-447 MISPOSITIONED AFTER MAINTENANCE HHFLSI-476 8.73E-04 SI PUMP 1 DISCHARGE ISO VALVE St-476 MISPOSITIONED AFTER MAINTENANCE HHFLSI-478 8. 73E- 04 51 PUMP 2 DISCHARGE ISO VALVE SI-478 MISPOSITIONED AFTER MAINTENANCE JHFDRHRI 3.30E-03 OPERATOR FAILS TO ALIGN SHUTDOWN COOLING SYSTEM FOR INJECTION OPERATION JHFDRSSIPMP 2.50E-02 OPERATOR FAILS TO BLEED AND RESTART St PUMPS FOLLOWING CONTAINMENT BREACH JHFDSCSLTC 1.10E-04 OPERATOR FAILS TO ALIGN SHUTDOWN COOLING SYSTEM FOR LONG-TERM COOLING JHFDXCON1LTC 1.67E-03 OPERATOR FAILS TO CONNECT SCS/ CSS TRAIN 1 CROSSOVER PATH DURING LTC JHFDXCON2LTC 1.67E-03 OPERATOR FAILS TO CONNECT SCS/ CSS TRAIN 2 CROSSOVER PATH DURING LTC JHFDX0VER1 2.20E-03 OPERATOR FAILS TO CONNECT SCS/ CSS TRAIN 1 CROSSOVER PATH JHFDX0VER2 2.20E-03 OPERATOR FAILS TO CONNECT SCS/ CSS TRAIN 2 CROSSOVER PATH JHFLSIXCON1 2.60E-03 OPERA 10R FAILS TO AllGN SCS PUMP 1 FOR BACKUP TO CSS PUMP 1 JHFLSIXCoh2 2.60E-03 DPERATOR FAILS TO ALIGN SCS PUMP 2 FOR BACKUP TO CSS PUMP 2 JHFMBYPASS1 1.87E- 04 SCS/1RWST RETURN LINE 1 M-0 ISO VALVES MISPOSITIONED AFTER TESTING JHFM8YPASS2 1.87E- 04 SCS/IRWST RETURN LINE 2 M-0 ISO VALVES MISPOSITIONED AFTER TESTING MHFDCST 3.10E-04 DPERATOR FAILS TO ALIGN START-UP FEEDWATER PUMP TO CONDENSATE STORAGE TANK OP!GNITOFF 3.00E-02 OPERATOR FAILS TO ENERGIZE H, IGNITORS PHFFP2RSPRAY 4.43E-03 OPERATOR FAILS TO ACTUATE PRESSURIZER SPRAY FLOW PHFFSIPUMP 2.00E-04 OPERATOR FAILS TO THROTTLE SAFETY INJECTION PUMP IN TIME UHFDRFIRWSTCHR-T 5.70E-03 OPERATOR FAILS TO ALIGN CVCS TO REFILL IRWST FOLLOWING CONTAINMENT BREACH UHFDRFIRWSTSG1R 3.70E-03 DPERATOR FAILS TO ALIGN CVCS TO FILL IRWST FOLLOWING SGTR UHFFBORONRCS 3.25E-02 DPERATOR FAILS TO INITIATE BORON DELIVERY TO RCS VIA CHARGING PUMP UMRFDFIRWSTLOCA 5.70E-03 OPERATOR FAILS TO ALIGN CYCS TO REFILL IRWST AFTER CNTMNT BREACH (LOCA LTCHR) UHFLCH-152 8.73E-04 BORIC ACID MAKEUP PUMP 1 DISCHARGE VALVE CH-152 UNAVAILABLE DUE TO MAINTENANCE UHFLCH-153 8.73E-04 BORIC ACID MAKEUP PUMP 2 DISCHARGE VALVE CH-153 UNAVAILABLE DUE TO MAINTENANCE VHFFFEEDBLEED 9.15E-03 OPERATOR FAILS TO INITIATE FEED & BLEED SYSTEM VHF FPZRVENT 1.17E-02 DPERATOR FAILS TO OPEN RCGVS PATHS FROM THE PRESSURIZER VHFFRVVENT 1.17E-02 OPERATOR FA!LS TO DPEN RCGVS PATHS FROM THE REACTOR VESSEL Amendment G G March 15,
O O O TABLE 19.5-6 SPECIAL EVENTS PROBABILITIES NAME DESCRIPTION PROBABILITY ERROR FACTOR SE-PSV (LOOP) Pricary Safety Valve Fails to Reseat given LOOP 2.8E-3 3.0 SE-PSV (ATWS) Primary Safety Valve Fails to Reseat given ATWS 2.8E-2 3.0 SE-MTC Adverse MTC 0.01 3.0 i SE-CSGTR Consequential SGTR following an ATWS 0.1 3.0 SE-SREOC - Stuck Rod at End-of-Cycle 1.15E-4 5.0 SE-PSVFTO Primary Safety Valves Fail to Open (2 or more) 8.14E-5 4.22 j SE-MTCl MTC between -0.30 and -0.42 and 1 PSV Fails to 3.98E-5 6.00 Open T T Amendment P. June 15,-1993
T ABLE 19.5-7 RE00VERY ACTIONS ERROR DESCRIPTION FACTOR PROB. NAME C FACTOR 0 1.90E-01 FAILURE TO MANUALLY CPEN MOTOR OPERATED VALVE 3.00 1.80E-01 RCVRMOV 0 6.20E-01 FAILURE TO RECOVER OFFSITE PouER IN 1 HOUR 1.00 6.20E-01 RCVRPWRO1 0 3.20E-01 FAILURE TO RECOVER OFFSITE POWER IN 3 HOURS 1.00 3.20E-01 RCVRPWR03 0 2.40E-01 FAILURE TO RECOVER OFFSITE POWER IN 4 HOURS T.00 2.40E-01 RCVRPWR04 0 1.80E-01 FAILURE TO RECOVER OFFSITE POWER IN 5 HOURS 1.00 1.80E-01 R CVRPWR05 0 1.40E-01 FAILURE TO RECOVER OFF;ITE POWER IN 6 HOURS 1.00 1.40E-01 RCVnPWR06 0 1.00E-01 FAILURE TO RECOVER OFFSITE POWER IN 7 HOURS 1.00 1.00E-01 RCVRPWR07 0 8.10E-02 FAILURE TO RECOVER OFFSITE POWER IN 8 HOURS 1.00 8.10E-02 RCVRPWR08 0 6.30E-02 FAILURE TO RECOVER OFFSITE POWER IN 9 HOURS 1.00 6.30E-02 RCVRPWRD9 0 4.90E-02 FAILURE TO RECOVER OFFSITE POWER IN 10 HOURS 1.00 4.90E-02 RCVRPWR10 0 3.10E-02 FAILURE TO RECOVER OFFSITE POWER IN 12 HOURS 1.00 3.10E-02 RCVRPWR12 0 2.40E-02 FAILURE TO RECOVER OFFSITE POWER IN 13 HOURS 1.00 2.40E-02 RCVRFWR13 0 1.60E-02 FAILURE TO RECOVER OFFSITE POWER IN 15 HOURS 1.00 1.60E-02 RCVRPWR15 0 1.30E-02 FAILURE TO RECOVER OFFSITE POWER IN 16 HOURS 1.00 1.30E-02 RCVRPWR16 0 5.00E-02 FAILURE TO START AkD LOAD STANDBY AC POWER 3.00 5.00E-02 RCVRSBAC Amendment March 15,
d CESSAR Ennr"ic-R U B.ASIC EVENT PROBABILITY CALCULATION WORKSHEET
SUMMARY
Date: 5/26/92 Page 1 of 2 , Basic Event ID: ESXXSEO Revision: 0' l Basic Event
Description:
COMMON CAUSE FAILURE OFI)G LOAD SEQUENCERS Plant / Study: System 80+ PRA Tag Number: DGA,DGB Model(s): PEBN01A1 ,PEBN0181 PEBN01C1 ,PEBN0101 Event Type (check one): Random - operating _; Random-demand _; , CCF - operating .X_; CCF - demand _; Developed Event - operating _; Developed Event - demand. _, Developed Event - operating-CCF _; Developed Event - demand-CCF _; Human Error _ _; Initiating Event - _; Test / Maintenance Unavailability _; Special Event _; Other (describe below) _; _QODES System: ,_f_, ELECTRICAL DISTRIBUTION SYSTEM Component Type: SX, DIESEL GENERATOR LOAD SEQUENCERS. Failure Mode: _X,., COMMON CAUSE OPERATING FAILURE Location: _ _ , PROBABILITY CALCULATION
SUMMARY
Mean : G.25E-07/hr ' (2,25E-04)* l Median: 5th Percentile: 95th Percentile: Error Factor: 11.19 REFERENCES ,
- 1) EPRI ALWR Utility Reouirements Document Volume ll, ALWR Evolutionary Plant Chapter 1.
Appendix A "PRA Key Assumptions and Groundrules". Rev 3,11/91. +
- 2) NURES/CR-4639. " Nuclear Computerized Library for Assessino Reactor Reliability" Vol. 5.
Rev. 3. " Data Manual. Part 3: Hardware Component Failure Data (HCFD)" December,1990.
- 3) IEEE Std 500-1984
- 4) EJG-EA-5887 JUNE,1982 (NREP Database)
A fault exposure time of one month is assumed. Amendment P 19.5C-109 June 15, 1993
CESSARnnL a,. BASIC EVENT PROBABILITY CALCULATION WORKSHEET CALCULATION Date: 5/26/92 Page 2 of 2 Basic Event ID: ESXXSEO Revision: O Plant / Study System 80+ PRA CALCULATION (use additional sheets if needed): The Multiple Greek Letter method is used to estimate the common cause failure probability of the diesel genarator load sequencers. At least one of the two load sequencers is required in order to load the associated diesel generator to the 4.16 kv ESF bus. Therefore, failure of both load sequencers will result in loss of power from the diesel generators. The expression used to estimate the common cause failure rate of the load sequencers is: 0,,,, = #A, fegn 1.]
- where, Oy ,, = Common cause f ailure rate of the load sequencers A, = Independent failure rate of the load sequencer (1.23E-05/hr)
# = Beta factor (0.05)
The value of the beta factor was taken directly from the EPRI Key Assumptions and Groundrules Document (KAG), Reference 1, while the mean failure rate was obtained from Reference 2. Note that according to KAG, no useful source could be found for common cause failure of load sequencers. Therefore, the recommended beta factor is used in this calculation. By substituting the above values in Equation 1, the common cause failure rate becomes: Ou ,, = (0.05)(1.25E-05)
= 6.25E-07/hr The diesel generator load sequencers are usually in standby and are assumed to be tested every month.
For a fault exposure time of one month, the failure probability is 2.25E-04. The KAG does not provide error factors. Therefore, the error factor used for independent failure of the load sequencers is also used for the common cause failure probability. (See calculation sheet SXR.) O Amendment M 19.5C-110 March 15, 1993
CESSAR E hm,. n(,) BASIC EVENT PROBABILITY ! CALCULATION WORKSHEET
SUMMARY
l Date: 1/22/92 Page 1 of 2
]
Basic Event ID: GIPXPTRANSMITTER Revision: 0 Basic Event
Description:
COMMON CAUSE OPERAT!NG FAILURE OF AVS PRESSURE TRANSMITTERS Plant / Study: System 80+ PRA Tag Number: Model(s): PGHB01 BX , , Event Type (check one): Random - operating _; Random-demand _; 1 CCF - operating ,X .; CCF - demand _, Developed Event - operating _; Developed Event - demand __; Developed Event - operating-CCF _; Developed Event - demand-CCF _; Human Error _; initiating Event _; Test / Maintenance Unavailability _, Special Event _; I Other (describe below) _; CODES System: _G__ . CONTAINMENT COOLING SYSTEM (ANNULUS VENTILATION SYSTEM) Component Type: .J P_, PRESSURE TRANSMITTER Failure Mode: _X__, COMMON CAUSE OPERATING FAILURE Location: _ _ , PROBABILITY CALCULATION
SUMMARY
Mean : 1,73E-06 Median: 5th Percentile: 95th Percentile: Error Factor: 4.85 REFERENCES
- 1) EPRI ALWR Utility Reauirements Document, Volume 11 ALWR Evolutionary Plant, Chapter 1.
Appendix A. "PRA Key Assumptions and Groundrules". Rev 3.11/91.
- 2) NUREGICR-4639. " Nuclear Computerized Library for Assessino Reactor Reliability" Vol. 5.
Rev. 3. " Data Mar.ual. Part 3: Hardware Comoonent Failure D_gia (HCFD)". December,1990.
- 3) IEEE S_td 500-1984
- 4) EGG-EA-5887 JUNE,1982 (NREP Database) 0 5) NUREGICR-4550, " Analysis of Core Damaae Freauency: Internal Events Methodoloav". Vol.
1, Rev.1 January.1SJ_0,_ Q Amendment M 19.5C-139 March 15, 1993 L- _ _ _ _ _ _ _ - . _ _ -. _ _ _ - . . - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
CESSARnaincma BASIC EVENT PROBABILITY CALCULATION WORKSHEET CALCULATION Date: 1/22/92 l Page 2 of 2 Basic Event ID: GlPXPTRANSMITTER Revision: 0 l Plant / Study System 80+ PRA CALCULATION (use additinnal sheets if needed): The mean f ailure rate (per hour or per demand) was calculated using the " multiple greek letter (MGL)" methodology with the values for those parameters taken directly from the EPRI Key Assumptions and Groundrules Document (KAG), Reference 1. Also, the KAG and MGL methodology do not provide for calculating the error f actor, and, therefore, the error factor used was that associated with the basic event " Pressure Transmitter Fails to Operate" The common cauw failure of two transmitters can be represented as: CCF Factor = B The value # for 2 pressure transmitters failing to operate is not specifically given in Reference but a l B = 0.05 is given for generic operating failure cases. Therefore, B = 5.0E-02. The f ailure of a pressure transmitter to operate is given to be 4.80E-07/ hour. (see IPP calculation sheet) Hence, the mear' probability of common cause failure of two AVS pressure transmitters to operate is: mean = CCF Factor x Basic Event failure rate x mission time - 5.00E-02 x 4.80E-07/hr x 72 hours
= 1.73E-06.
The error factor used is 4.85. O Amendment P 19.5C-140 June 15, 1993
CESSAR n!H"lCATl3N
, ~~
Shutdown Cooling System (SCS) pumps, if they become unavailable due to any reason. 19.6.1.4 Protection and Control Systems A Plant Protection System (PPS) initiates a reactor trip if the reactor approaches prescribed safety limits, or provides an actuation signal to the Engineered Safety Feature (ESP) systems when a fluid system or containment parameter approaches a prescribed safety limit. 19.6.1.4.1 Reactor Protective System The controllable reactor parameters are normally maintained within acceptable operating limits by the inherent characteristics of the reactor, the reactor regulating system, soluble boron concentration, and the plant operating procedures. Four independent channels of the Reactor Protective System (RPS) normally monitor each of the selected plant parameters. The RPS logic is designed to initiate protective action whenever the signal of any two channels of a given parameter reach the preset limit. Should this occur, the power to the Control Element Drive Mechanism
,c_ is interrupted, releasing the Control Element Assemblies (CEAs)
( which drop into the core to shutdown the reactor. The RPS is ( maintained independent of and separate from the manual and automatic control systems. 19.6.1.4.2 Alternate Protection System The Alternate Protection System (APS) augments plant protection by generating an Alternate Reactor Trip Signal (ARTS) and an Alternate Feedwater Actuation Signal (AFAS) that are separate and diverse from the Plant Protection System. This system is provided to address Anticipated Transient Without Scram (ATWS) and ATWS Mitigating Systems Actuation Circuitry ( AMSAC) design requirements. The ARTS will initiate a reactor trip when the pressurizer pressure exceeds a pre-determined value. The AFAS will initiate emergency feedwater when the level in either steam generator decrease below a predetermined value. The APS sensors and circuitries are diverse from those of the RPS and the Engineered Safety Features Actuation System (ESFAS). 19.6.1.4.3 Engineered Safety Features Actuation System The ESFAS operates in a manner similar to the RPS to automatically actuate the ESF systems. Again, it has a selective two-out-of-four g-sg actuation logic and is completely independent of the control ( ) systems. Amendment M 19.6-3 March 15, 1993
CESSAR !!nincuiou 19.6.1.4.4 Component Control System The Component Control System (CCS) is designed to control discrete state components such as pumps, valves, heaters and fans within the Nuclear Plant Module (NPM) and Balance of Plant (BOP) plant l systems. The CCS consists of the ESF-CCS and Process-CCS assemblies to provide control for the different channels of Class 1E equipment, as well as non-Class 1E equipment. Although they perform different plant control functions, the CCS Class 1E and non-Class 1E Assemblies utilize the same type but diverse electronic and software components. 19.6.1.5 Electrical System An offsite power system and an onsite power system are provided to supply power to the unit auxiliaries and ESF equipment during normal operation and during abnormal conditions. The turbine generator unit is connected to a switchyard and thereby to the transmission system via two separate and independent transmission lines. The generator circuit breaker, along with the unit step-up transformers, allows one of these lines not only to supply power to the transmission system during normal operation, but also to serve as an immediate available source of preferred power. The other separate transmission line is connected, via a reserve transformer, to provide an independent second immediatel source of offsite power to the onsite power distribution system for safety and permanent non-safety loads. The onsite power system consists of the main generator, the generator circuit breaker, main unit transformers, the unit auxiliary transformers, standby auxiliary transformer, the diesel generators, an alternate AC source, the batteries, and the auxiliary power system. Under normal operating conditions, the main generator supplies power through isolated phase bus and generator circuit breaker to the unit main step-up and unit auxiliary transformers. The unit auxiliary transformers are connected to the bus between the generator circuit breaker and the unit main trrnsformers. 19.6.1.6 Power Conversion System The function of the Steam and Power Conversion System is to convert the heat energy generated by the nuclear reactor into electrical energy. The heat energy produces steam in two steam generators capable of driving a turbine generator. The Steam and Power Conversion System utilizes a condensing cycle with a regenerative feedwater heating. Turbine exhaust steam is condensed in a conventional surface type condenser. The condensate Amendment P 19.6-4 June 15, 1993
CESSAR HMncari:n l n where two systems interface with one another but one system does not depend on other system to perform its function or support the other system in performing other system's function.
- One system actuates another system; for example, Safety Injection Actuation Signal (SIAS), which is a part of the Engineered Safety Feature Actuation System (ESFAS),
actuates (starts) the Safety Injection System (SIS) pumps.
- One system isolates another system; for example, an ESFAS signal will isolate the Steam Generator Blowdown System.
- One system supports another system for the latter's functionality; for example, Component Cooling !?ater System supports the Shutdown Cooling System ISCS) enabling it to perform its function.
Commonality results when the system shares the whole or a part of an another system, or when two systems (or components, or a system and other components) participate in performing a certain function. For example, the SCS shares piping and other components (e.g., valves) with the SIS in performing the plant cooldown. The dependency and commonality relationships between the various m systems are presented in Table 19.6.1-1. The purpose of thisj matrix is to demonstrate the way each system interfaces with other (j\ \ systems in the plant. Both the vertical axis and the horizontal axis contain the same list of systems. In order to properly read a matrix, a system is selected from the horizontal list of systems across the top of the matrix. This is considered to be the reference system. This reference system may then be compared to other (interfacing) system by reading down the vertical list of systems and looking at the point of intersection of the two systems. The reference system either:
- shares common element (s) with the interfacing system (C.E.),
- supports tae interfacing system (S),
- actuates or isolates the interfacing system (A),
a depends on the interfacing system (D),
- has relationship with the interfacing system but neither depends on the interf acing system to perform its function nor supports the interfacing system in performing the interfacing system's function (I), or
- has no relationship to the interfacing system (blank).
For example, if the Emergency Feedwater System (EFWS) is chosen as the reference system, the matrix shows that the EFWS is:
- dependent on 4.16 KV buses, 480 VAC MCCs, 125 VDC buses, p Component Cooling Water (CCW) , Engineered Safety Features
(% Actuation System (ESFAS), Alternate Protection System Amendment P 19.6-7 June 15, 1993
CESSAR nuiricuim (APS) and the steam generators for steam for turbine-driven pumps.
- supports the steam generators in performing their function of heat removal.
- interfaces with the Instrument Air System (IAS) (for air supply to air-operated valves) but does not depend on the IAS in performing its function of delivering feedwater to tne steam generators.
O O Amendment M i 19.6-8 March 15, 1993
. . .. . - .-. . . . . . . . . ~ . . . . . -. -, ,
DESIGN CESSAR CERTIFICATION , 1 l TABLE 19.6.1-1 (Cont'd) (Sheet 11 of 12) , SYSTEM 80+ SYSTEM DEPENDENCY AND CDOGONALITY MATRIX , REFFRENCE SYSTEM ~ SAFETY DEPRESSURIZATION. MAIM STEM . PRESSU - SC SYSTEM (SDS) SYSTEM. RIZER BLOW-INTFHFACING SYSTEM 4 SPRAY D(Rai RCGV VALVES RD or ' I BLEED VA1VES 480 V MCC TRAIN A __. { 480 V MCC TRAIN B 480 V MCC TRAIN C i 480 V MCC TRAIN D 480 V MCC TRAIN X D 480 V MCC TRAIN Y 'D 125 VDC BUS SA0801 D D D 1?5 VDC BUS SB0801 D D D D , 125 VDC BUS SC0801 D D D f 125 VDC BUS SD0801 D D D D 125 VDC NS BUS Pr0801 D ! 125 VDC WS BUS PYO801 D D D 'I INSTRUMENT AIR SYS I -D I STARTUP FEEDWATER D(2) EFWS TRAIN 1A D(2),5(3)
'{
ErWS TRAfW 18 D(2) ' EFWS TRAIN 2A D(2),$(3) EFWS TRAIN 2B D(2) ! ESFAS TRAIN A AND B ! ! IRWST D(1) D(1) d NOTES: (1) RCGV and RD valves discharge into the Reactor Drain Tank (RDT) or, alternately, to the IRWST. . (2) Steam generators requires f eedwater f rom the Startup Feedwater System or EFWS f or heat removal. I (3) Main Steam System provides steam for the turbine-driven pumps. ;
.i i
Amendment M
- March 15, 1993
- e. --n... .- .,. e- en. e -~r,,- ,
CESSARna bion O TABLE 19.6.1-1 (Cont'd) (Sheet 12 of 12) SYSTEM 80+ SYSTEM DEPENDENCY AND cop 940NAllTY MATRIX REFERENCF SYSTEM -* ENGINEERED SAFETY ALTERNATE FEATURES ACTUATION PROTECTION INTERFACING SYSTEM 4 SYSTEM (ESTAS) SYST'30 (APS) TRAIN A TRAIN B SIS TRAIN 1 A SIS TRAIN 2 A SIS TRAIN 3 A SIS TRAIN 4 A CSS TRAIN 1 A CSS TRAIN 2 A EFWS TRAIN 1A A A EFWS TRAIN 1B A A EFWS TRAIN 2A A A EFWS TRAIN 28 A A CHEMICAL AND VOLUME CONTROL SYSTEM A(1) A(1) (CVCS) MAIN STEAM SYSTEM A(2) A(2) STEAM GENERATOR BLOWDOWN SYS1EM A(3) A(3) (SGBS) Wo1ES: (1) Some portion of the CVCS (e.g., VCT discharge valve) is isolated by an ESFAS signal. (2) Some portion of the Main Steam System (e.g., MSIVs) is isolated by an ESFAS signal. (3) Some portion of the Steam Generator Blowdown System (e.g. containment isolation valves) is isolated by an ESFAS signal. NOTATION: C.E. Systems have cortstion element S. Reference system supports interfacing system A Reference system activates interfacing system 0 Reference system depends on interfacing system 1 Systems interface but have no functional dependency O Amendment P ' June 15, 1993 i
CESSAR an@imion l O \ l 19.6.3 SYSTEMS ANALYSES DOCUMENTATION 19.6.3.1 Electrical Distribution System 19.6.3.1.1 System Description 19.6.3.1.1.1 System Function The electrical distribution system is designed to provide AC power and DC power necessary for normal operation and mitigation of any abnormal events. These events may affect systems which are used to shutdown the reactor, remove decay heat from the reactor, and prevent the release of radioactivity to the environment. The electrical distribution system also provides power for instrumentation needed for monitoring plant parameters and for input to the reactor trip and engincering safety features trip logic. 19.6.3.1.1.2 System Success Criteria The electrical distribution system (EDS) is divided into two portions, a non-safety class portion and a safety class portion. The non-safety class portion of the EDS provides power to equipment s that are not required to operate for plant safe shutdown while the l safety class portion provides power to equipment that are required s to operate in order to shutdown the plant and maintain it in a safe state. Both the safety and non-safety class portions of the EDS provide AC and DC power. AC power is divided into divisions I and Il for the safety class portion and divisions X and Y for the non-safety class portion. Each division provides power, as appropriate, for the normally operating or mitigating systems of the plant. Similar to the non-safety class AC portion, the non-safety DC portion of the EDS is divided into divisions X and Y. Each division supplies power to one non-safety DC bus and its associated instrument invertor. The safety related DC portion of the EDS is divided into two divisions. Each division contains three channels of DC power sources which provide control and instrument power for one train of the mitigating systems. The other three channels provide power for the other train of the mitigating systems. , Although power from both divisions of the safety-related class 1E portion of the EDS is preferred for plant shutdown, either divisica of the EDS can provide the required power to specific trains of Engineered Safety Feature (ESP) systems for plant shutdown. However, the availability of offsite power is considered in the definition of the success criteria. Following a large Loss of Coolant Accident (LOCA) and if offsite g power is available, at least two of the four safety-related class 1E AC buses are required to remain operable. The three 125 VDC class 1E buses whose battery chargers are powered indirectly from Amendment P 19.6-13 June 15, 1993
1 CESSARns% - the available AC bus must also be operable. Following a large LOCA and coincident loss of offsite power, at least one of the two emergency diesel generators must be available to power the i associated two safety-related class 1E AC buses. Three 125 VDC class 1E buses are also required to be operable. For transients or non-large LOCA events with offsite power ! available, at least one of the four safety-related class 1E AC buses is required to remain operable. If there is a coincident ; loss of offsite power following these events, then at least one of the two emergency diesel generators must be available to provide power to one of the two safety-related class 1E AC buses associated with the diesel generator. The success criteria for DC buses are the same as above when offsite power is available. 19.6.3.1.1.3 System Configuration The electrical distribution system, as shown in Figures 19.6.3.1-la&b, 2, and 3 consists of the following power systems:
- Main power system
- 13.8 KV power system
- 4.16 KV non-class 1E power system
- 4.16 KV class 1E power system
- 480 VAC non-class 1E power system
- 480 VAC class 1E power system
- 208/120 VAC non-class 1E power system
- 120 VAC class 1E power system
- 125/250 VDC non-class 1E power system
- 125 VDC class 1E power system 19.6.3.1.1.3.1 Main Power System The main power system consists of the main generator, associated isolated phase bus, generator circuit breaker, three unit step-up transformers, two unit auxiliary transformers, and two reserve auxiliary transformers. The primary function of this system is to generate and transmit power to the transmission system while simultaneously supplying power to the unit auxiliaries. In the event that the main generator is not in service, this system is used to supply power f rom the switchyard or grid system to the unit auxiliaries.
19.6.3.1.1.3.2 13.8 KV Power System The 13.8 KV power system consists of two non-safety switchgear load groups. The first switchgear group is normally connected through a main breaker to one of the dual voltage unit auxiliary transformers. A second switchgear group is normally connected to the other independent unit auxiliary transformer. The primary function of the 13.8 KV power system in to provide power to large Amendment M 19.6-14 March 25, 1993
CESSAR 8!ssncm2 o I \ TABLE 19.6.3.1-1 (Cont'd) (Sheet 3 of 7) POWFR ASSIGNMENTS FOR SYSTEM 80+ EQUIPMENT SYSTI:M CtMPOWENT' 4.16 KV 480 V LC 480 V MCC 125 VDC 120 VAC IRWST Return Valve: SI-300 - - SAM 301 - - SI-301 - - SBM301 - - SI-314 - - SAM 302 - -
$1-315 - -
SBM302 - -
$1-688 - -
SCH302 - -
$1-693 - -
SOM302 - -
$1-657 - -
SAM 302 - -
$1-658 - -
SBM302 - -
$1-686 - -
SCH302 - - 51-696 - - SDM302 - - EFW ! sol Valve: EF-100 - - - SA0801 - EF-101 - - - S80801 - EF 102 - - SCM304 - - EF 103 - - SDM304 - - EFW Steam Supply Valve: EF-108 - - - SA0801 - EF-109 - - - 580801 - g EF-112 - - - SA0801 - EF-113 - - - SB0801 - EFW Control Valve: EF-104 - - - SC0801 - EF-106 - - SAM 304 - - EF-105 - - - 500801 - EF-107 - - SBM3D4 - - Startup FW ' et SF-005 ( i - - PXM302 - - SF-002 ( ) - - PXM302 - - MF Bypass Valve: MF-020 ( ) - - PXM301 - - MF-021 ( ) - - PYM301 - - ADV: SG-178 - - - SA0801 - SG-179 - - - SB0801 - SG-184 - - - SC0801 - SG-185 - - - SD0801 - ADV Block Valves: SG 105 - - SBM304 - - SG-106 - - SDM304 - - SG 107 - - SCH304 - - SG-108 - - SAN 304 - - I See the footnotes on the test page. \ Amendment P June 15, 1993
CESSAR nennCATION O TABLE 19.6.3.1-1 (Cont'd) (Sheet 4 of 7) POWER ASSIGNMENTS FOR SYSTEM 80+ EQUIPMENT SYSTEM COMPOWENT' 4.16 KV 480 V LC 48G V MCC 125 VDC 120 VAC Yurbine Bypass Valve: 50 1001 - - - PX0801 - SG-1002 - - - PX0801 - SG-1003 - - - PX0801 - SG-1004 - - - PX0801 - SG-1005 - - - PX0801 - SG-1006 - - - PX0801 - 3G-1007 - - - PXlOO1 - SG 1008 - - - PX0801 - MSIVs: SG-150 - - - SA0801 - SG-140 - - - SC0801 - SG-141 - - - 580801 - SG-151 - - - 500801 - SG Blowdown Valve: UV-006 ( ) - - - SB0801 - UV-008 ( ) - - - SD0801 - HV-010 ( ) - - - PY0801 - HV 012 ( ) - - - PY0801 - RC Gas Vent Valve: RC-414 - - - SA0801 - RC-415 - - - SB0801 - RC-416 - - - SC0801 - RC-417 - - - S00801 - RC-411 - - - SA0801 - RC 410 - - - SB0801 - RC-413 - - - SC0801 - RC 412 - - - 500801 - RC-418 - - - SB0801 - RC-419 - - - SA0801 - Pritrery Bleed Valvet RC-409 - - - SA0801 - RC 407 - - - SC0801 - RC 408 - - - S80801 - RC-406 - - - S00801 - PZR Spray Cntrl Valve: RC-100E - - - PXO801 - RC-100F - - - PYO801 - RC-443 - - PXM301 RC-442 - - PYM301 Instrument Air: Cornpressor 1 A PXS201 - - PX0801 - Conpressor 1B PXS201 - - PX0801 - Conpressor 2A PYS201 - - PY0801 - Compressor 2B PYS201 - - PY0801 - 6 See the footnotes on the last page. l Amendment M March 15, 1993
CESSAR En#lCATION o i
\ \
TAntE 19.6.3.1-1 (Cont'd) j l (sheet 5 of 7) j l POWR ASSIGNMENTS FOR SYSTEM 80+ FCRJIPMf NT 1 SYSTEM C0MPON(NT' 4.16 KV 480 V LC 480 V MCC 125 VDC 120 VAC i CVCS Valves: CH 530 - - PXM305 - - CH-534 - - PXM305 - - CH 536 - - PYM305 - - CH 514 - - PYM305 - - CH 501 - - PXM305 - - CH 504 - - PYM305 - - CH-208 - - PXM305 - - CCW Valves: CC-102 - - - PXD801 - CC-103 - - - PX0801 - CC-202 - - - PYOB01 - CC-203 - - - PYo801 - CC-106 - - SAM 301 - - CC-107 - - SCH301 - - CC-108 - - SAM 301 - - CC-109 - - SCM301 - - CC 122 - - - PXD801 - CC-123 - - - PXD801 - p CC 206 - - SBM301 - - CC 207 - - SDM301 - - (s CC-208 - SBM301 - - CC 209 - - SOM301 - - CC-222 - - - PY0801 - C- 223 - - - PYO801 - CS Heat Exchangers CCW 1s0. Valves: CC 114 - - SCM302 - - CC 214 - - SDM302 - - Fuel Pool Heat Exchng. Iso. Valves: CC-113 - - SAM 302 - - CC-213 - - SBM302 - - SC Heat Cxchanger CCW lsn. Valves: CC-111 - - SAM 302 - - CC-211 - - SBM302 - - SSW Valves: SW-120 - - SAM 301 - - SW 122 - - SAM 301 - - SW 121 - - SCM301 - - SW 123 - - SCM301 - - SW 220 - SDM301 - - SW 222 - - SBM301 - - SW-221 - - SDM301 - - SW 223 - - SDM301 - - 1 See the footnotes on the last page. A Amendment P June 15, 1993
CESSAR EMHncumn O taste 19.6.3.1-1 (Cont'd) ( (sheet 6 of 7) POWER ASSIGNMENTS FOR SYSTIM 80+ EQUIPME_]Q SYSTEM COMPOWENT' 4.16 KV 480 V LC 480 V MCC 125 VDC 120 VAC CFS Valves: SI-390 - - - SA0801 -
$1-391 - - - SB0801 -
$1-392 - - -
SC0801
$1-393 - - - 500801 -
S1-394 - - - SA0801
$1-395 - - -
5B0801 - AVS fans: fan 1 - SAL 301 - SA0801 Fan 2 - SBL301 - 580801 - l AVS Danpers: Train 1 - - SAM 301 Train 2 - - SSM301 - - 125 VDC Battery Charg: l Division 1 - - SAM 301 - - thannel A - SAC 301 - - SAM 301 Channel C - SCC 301 - - SCM301 Division !! - - SBM301 -
- 1 Channel B - SBC301 - -
SBM301 Channel D - SDC301 - - SDM301 Division X PxC301 - - PXM301 - - Division Y - PYC301 - - PfM301 - 120 VAC Voltage Reg.. Division 1 - S1R301 - - SAM 303 - - Channel A SAR301 - - SAM 302 Channel C - SCR301 - - SCM302 Division !! - $2R301 - - SBM303 Channel B SBR 301 - - SBM302 Channel D - SDR301 - - SDM302 l l Division X PXR301 - - PXM302 - - Divis on Y - PYR301 - - PYM302 Ctrl Rm Air Handling Unit: I Division A - SAL 301 - SA0801 - Division B - SBL301 - SB0801 - Aux Rm & ESF Equip Rm Air Handling Unit: Division A - SCL301 - SC0801 - Division B - SDL301 - 500801 - 1 See the foo. notes on the last page. O Amendment P June 15, 1993 L_________.__.________._. _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
CESSAR EnWicariou I l l 19.6.3.2 Station Service Water System 19.6.3.2.1 System Description 19.6.3.2.1.1 System Function The station service water system (SSWS) is an open loop system that takes suction from the ultimate heat sink and provides cooling water to remove the heat released from plant systems, structures and components. The SSWS then returns the heated water to the ultimate heat sink. The SSWS provides cooling water to the component cooling water heater exchangers which in turn remove heat from safety-related and non-safety-related reactor auxiliary loads. 19.6.3.2.1.2 System Configuration Refer to Figure 19.6.3.3-7 in Section 19.6.3.3 " Component Cooling Water System" for the simplified schematic for the station service water system (SSWS) . The SSWS consists of two separate, redundant, open loop safety-related divisions. Each division consists of two pumps, valves, piping, controls and instrumentation. Each pump is capable of taking suction from a pump structure, located inside the ultimate heat sink, and delivering flow through the component cooling water heat exchanger and then back to the ultimate heat sink. The pumps are of the vertical centrifugal motor-driven type. The pump motors are powered from the 4.16 KV class 1E buses. The pumps in division 1 are powered from division I of the 4.16 KV class 1E buses. Similarly, the pumps in division 2 are powered from division 2 of the 4.16 KV class 1E buses. Piping and valves to and from the component cooling water heat exchangers are made of corrosion resistant materials. The cupply and return lines in one division are completely separated from the supply and return lines in the other redundant division. 19.6.3.2.1.3 Support and Interfacing Systems In order for the station service water system to perform its functions it depends on various support systems to operate. These support systems include:
- 4.16 KV class 1E power system
- 480 VAC class 1E power system l
- 125 VDC class 1E power system
- Ultimate Heat Sink The 4.16 KV class 1E power system provides motive power to operate the SSWS pumps. The 125 VDC class 1E power system provides control power for the pump control circuitries which close and trip the pump breakers when required. The valves in the supply and return Amendment P I 19.6-29 June 15, 1993
1 CESSAR Ennne-lines are locked in the desired position to ensure that only the pumps are required to operate in order for the system to perform
- its function. For this study, power assignments for the SSWS pumps l are assumed to be as follows
Fvstem Component 4.16 KV bus 125 VDC bus Pump 3 (Div. 1) SAS201 SA0801 Pump 2 (Div. 1) SCS201 SC0801 Pump 1 (Div. 2) SBS201 SB0801 Pump 2 (Div. 2) SDS201 SD0801 The 480 VAC class 1E power system provides motive power to reposition (i.e. open and close) the SSW motor operated valves. 480 VAC class 1E power is also provided to operate the travelling screen and SSW strainer. The power assignments for the SSW motor operated valves modeled in the PRA are as follows: System Component 480 VAC MCC f SW-121 SCM301 1 SW-123 SCM301 SW-221 SDM301 SW-223 SDM301 l l The ultimate heat sink is regarded as a large body of water which ! can accommodate the heat removed from the reactor auxiliary components. The type of heat sink is site specific and may include j an ocean, lake, river, or spray ponds with cooling towers. The SSWS interfaces with the component cooling water system. It accepts the heat which is removed by the component cooling water heat exchangers. I j 19.6.3.2.1.4 System Operation During norma) plant operation, one pump in each of the two divisions of the SSWS takes suction from the ultimate heat sink and delivers the cooled water to the associated component cooling water heat exchanger. The heat exchanger removes heat from the reactor i auxiliary components and in doing so heats up the cooling water of 1 the SSWS. The heated water of the SSWS is then returned to the ultimate heat sink. This on going process enables the heat that is generated by reactor auxiliary components, such as the reactor , coolant pumps, to be removed. j The standby pump in each division of the SSWS starts automatically on a low discharge pressure condition. During a loss of offsite power event the operating SSWS pump; trip and are restarted in accordance with the diesel generator load sequencing. Manual starting and stopping of the pumps is provided from the control room to override the automatic actuation mode of operation. This feature enables the operator to remove a division or pump from Amendment P 19.6-30 June 15, 1993
_ a - - - CESSARnub . O service after automatic actuation if it is not required. Valves in the supply and return lines are locked in their open positions so that only actuation of the pumps are required to place a division in service. The SSWS has two redundant and separate divisions. Each division has 100% heat dicsipation capacity for a safe shutdown. Although a normal reactor shutdown can be accomplished by the operation of both SSWS divisions, a single division can be used to shutdown the plant over a 36 hour period during emergency conditions. The SSWS operates continuously to provide cooling for reactor auxiliary components such as the reactor coolant pumps (RCP). Loss of cooling for the seals of an.RCP will result in tripping of the affected RCP. This in turn will result in a plant trip on low reactor coolant flow. Loss of any division of the SSWS during normal operation will result in the tripping of two RCPs and eventually a plant trip. Also, loss of any division of the SSWS will result in loss of cooling to all appropriate ESF components in the affected division. Therefore, loss of one division of the SSWS is selected as a common initiating event because it initiates an abnormal event and renders one division of ESF components inoperable. 19.6.3.2.1.5 System Success Criteria The station service water system is used during normal plant operations as well as during emergency operations. 7uring normal plant operation, only one SSWS pump per division is required to operate in order for the system to perform its function. There are two divisions of station service water. The SSWS pumps circulate cooling water through the component cooling water heat exchangers which remove heat the non-safety-related reactor auxiliary components. During a normal reactor shutdown of twenty four hours, successful operation of the SSWS requires all four station service water pumps and both component cooling water heat exchangers to operate. With all pumps and heat exchangers operating, a cooldown rate of 75 degrees per hour is maintained for the reactor coolant system to reach a temperature of 140 degrees within the 24 hours. During emergency conditions, one pump of one SSWS division is capable of cooling down the plant. However, the cooldown will be extend beyond 36 hours. Successful operation of the SSWS during omergency conditions is of importance in this study. This success criterion for emergency conditions is used to develop the fault tree models for cooling water systems. i Successful operation of the SSWS is contingent upon successful operation of its support systems. These systems include the 4.16 KV class 1E power system, and the 125 VDC class 1E power system. ) Amendment M 19.6-31 March 15, 1993 I i
CESSAR nuiLou Support systems and their success criteria are described in other sections of this report. 19.6.3.2.1.6 Technical Specifications The Technical Specifications (Chapter 16) require that two Station Service Water System (SSWS) divisions shall be operable for modes 1, 2, 3, and 4. If one SSWS division is inoperable, the inoperable SSWS division must be restored to operable status within 72 hours, and, any inoperable Essential System must also be restored to operable in the operable SSWS division within 4 hours. If these conditions are not met, the plant must be placed in mode 3, and possibly mode 5. If two SSWS divisions are inoperable, the plant must be placed in mode 4 within 12 hours, and, action must also be initiated to place the unit in mode 5 with an adequate complement of SSWS components immediately if one SSWS division cannot be restored within the specified 12 hours. The most frequent surveillance requirement for the SSWS is to verify that each SSWS manual, power-operated or automatic valve in the flowpath servicing essential equipment, that is not locked, scaled, or otherwise secured in position, is in its correct position. This test is performed every 31 days. Additionally, there is a surveillance requirement that every 18 months it must be demonstrated that each SSWS pump starts on an actual or simulated actuation signal. 19.6.3.2.2 System Logic Models The small event tree large fault tree approach is used in this study to quantify event sequences. By choosing the large fault tree approach, all support systems are developed and then integrated with the front-line or mitigating systems as appropriate. The SSWS is one of the support systems addressed in ; this study. l l 19.6.3.2.2.1 Analysis Assumptions In developing the fault tree model for SSWS, the following assumptions were made:
- 1. One SSWS pump is required to operate in order for the system to perform its function successfully.
- 2. The support systems for SSWS such as electrical distribution system and actuation signal are similar to those addressed in the front-line systems that indirectly or directly depend on station service water. Therefore, the duplication of these l
Amendment M 19.6-32 March 15, 1993
CESSAR Ennemon L support systems in the fault tree model for SSWS is not warranted.
- 3. Each division of the SSWS consists of two motor-driven pumps and two component cooling water heat exchangers. The discharge piping of the pumps is crossed tied so that they can circulate flow through either heat exchanger. Although each division consists of two heat exchangers, only one of the heat exchangers is in operation. The other is regarded as an installed spare. It is valved in and used only when the normally operating heat exchanger becomes inoperable.
- 4. The technical specifications do not allow both standby station service water pumps to be in maintenance at the same time.
- 5. The ultimate heat sink is assumed to be available. Therefore, it is not included in the fault tree models for SSWS.
Figures 19.6.3.2-1 and 19.6.3.2-2 provide the fault tree models developed for the SSWS, divisions 1 and 2, respectively. 19.6.3.2.2.2 Interface with Event Trees As mentioned in Section 19.6.3.2.1.4.1, loss of one division of the O SSWS is treated as an initiating event. Other than an initiating event, loss of SSWS does not appear as an element on the event trees. This is a support system which interf aces directly with the component cooling water system. The component cooling water system removes heat from safety-related and reactor auxiliary components. Safety-related systems interXuce directly with appropriate event trees. The specific event trees are identified in the system descriptions for the safety related systems. 19.6.3.2.3 System Quantification The SSWS is treated as a support system. It interfaces directly with the Component Cooling Water System. Therefore, the fault tree models for SSWS are developed and integrated, as appropriate, into the models for the Component Cooling Water System. Because the SSWS models are integrated into other systems, no quantification is performed for these models. Amendment M 19.6-33 March 15, 1993 l
CESSAR !!aincomu O l 1 THIS PAGE INTENTIONALLY BLANK 01 O Amendment M 19.6-34 March 15, 1993 1 1 l
CESSARnah . O 19.6.3.3 Component Coolinc Water System 19.6.3.3.1 System Description 19.6.3.3.1.1 System Function The Component Cooling Water System (CCWS) is a closed loop system that provides cooling water flow to remove heat released from plant systems, structures and components. The CCWS functions to cool the safety-related and non-safety-related reactor auxiliary loads. Heat transferred by these components to the CCWS is rejected by the Station Service Water System (SSWS) via the CCWS heat exchangers. 19.6.3.3.1.2 System Configuration The CCWS, as shown in Figures 19.6.3.3-1 through 19.6.3.3-6, consists of two separate, redundant, closed loop safety-related divisions. Each division of the CCWS consists of two pumps, valves, piping, controls and instrumentation. Either division of the CCWS or a single pump in each division is capable of supporting 100% of the cooling functions required for a safe reactor shutdown. For post-Loss-Of-Coolant-Accident (LOCA) cooling, only one of the four pumps is required af ter cooling supply to the non-safety loads and fuel pool cooling heat exchangers are isolated. The component cooling water (CCW) pumps are of the vertical centrifugal motor-driven type. The pump motors are powered from the 4.16 KV class 1E buses. The pumps in division 1 are powered from division 1 of the 4.16 KV class 1E buses. Similarly, the pumps in division 2 are powered from division 2 of the 4.16 KV class 1E buses. Piping and valves to and from the component cooling water (CCW) heat exchangers are made of corrosion resistant materials. The supply and return lines to and from components in a division are completely separated from the supply and return lines in the redundant division. 19.6.3.3.1.3 Support and Interfacing Systems In order for the CCWS to perform its functions it depends on various support systems to operate. These support systems include:
- 4.16 KV class 1E power system
- 125 VDC class 1E power system
- 480 VAC class 1E power system l
- Engineering Safety Features Actuation System
- Station Service Water System The 4.16 KV class 1E power system provides motive power to operate the CCW pumps. The 125 VDC class 1E power system provides control power for the pump control circuitries which close and trip the Amendment P 19.6-35 June 15, 1993
CESSAREnHnema pump breakers when required. The valves in the supply and return lines are locked in the desired position such that only the pumps are required to operate in order for the system to perform its function. For this study, power assignments for the CCW pumps are assumed to be as follows: System Component 4.16 KV bus 125 VDC bus Pump 1 (Div. 1) SAS201 SA0801 Pump 2 (Div. 1) SCS201 SC0801 Pump 1 (Div. 2) SBS201 SB0801 Pump 2 (Div. 2) SDS201 SD0801 The 480 VAC class 1E power system provides motive power to reposition (i.e. open and close) 480 VAC motor operated valves. The power assignment for mhe CCW motor operated valves modeled in the PRA are as follows: Sy_s_ tem Component 480 V MCC CC-207 SDM301 CC-209 SDM301 CC-107 SCM301 CC-109 SCM301 The Engineered Safety Features Actuation System signals isolate the non-safety related portion of the CCWS following an accident condition. The CCWS interfaces with the Station Service Water System (SSWS). The SSWS accepts the heat rejected by the component cooling water heat exchangers. 19.6.3.3.1.4 S'jstem Operation The CCWS provides cooling water to safety-related and non-safety-related components. Heat rejected by these components is then rejected to the SSWS via the CCW heat exchangers. The heated water of the SSWS is then returned to the ultimate sink. This on going process enables the heat that is generated by reactor auxiliary equipment such as the Reactor Coolant pumps (RCPs) to be removed from the equipment. During emergency conditions, the equipment in the Engineered Safety Features (ESF) systems are actuated to mitigate the transient or a LOCA. The CCWS provides cooling to safety equipment and components. During a loss of offsite power event, the pumps stop and are restarted in accordance with the diesel generator load sequencing. Manual start and stop actuation is provided from the control room to override the automatic actuation mode of the pumps. This feature enables the operator to remove a division or pump from service af ter automatic actuation if it is not required. Valves in 1 l 1 Amendment P l 19.6-36 June 15, 1993 i l i l
CESSAR E54ibon f ( the supply and return lines are locked in their open positions so that only actuation of the pumps are required to place a division in service. The CCWS has two redundant and separate divisions. Each division has 100% heat dissipation capacity for a safe shutdown. Although, . a normal reactor shutdown is accomplished by operation of both CCWS divisions, emergency cooldown over a 36 hour period may be accomplished using a single division. 19.6.3.3.1.4.1 Potential for Initiating Events The CCWS operates continuously to provide cooling for reactor auxiliary equipment such as the RCPs. Failure of one division of the CCWS during normal operation will result in a loss of heat removal from two RCPs and one division of ESF components. Loss of heat 1 noval from the RCP will result in a plant trip on a
" equipment protection" parameter. Therefore, loss of one division of the CCWS is selected as a common initiating event.
19.6.3.3.1.5 System Buccess Criteria The CCWS is used during normal plant operations as well as during emergency operations. During normal plant operation, one CCW pump per division is required to operate in order for the system to perform its function. The pumps circulate cooling water through the component cooling water heat exchangers in order to accept the heat rejected by the non-safety-related auxiliary loads. During normal reactor shutdown of twenty four hours, successful operation of the CCWS requires all four CCW pumps and both CCW heat exchangers to operate in order to reach a RCS temperature of 140 degrees. A normal cooldown rate of 75 degrees per hour is assumed. Successful operation of the CCWS during emergency conditions requires the operation of at least two station service water pumps. The operation of one pump per division or two pumps in one division will satisfy the requirement. Successful operation of the CCWS is contingent upon successful l l rration of its support systems. These systems include 4.16 KV motive power, 125 VDC control power, Engineering Safety Features Actuation System, and the SSWS. These support systems and their success criteria are described in other sections of this report. 19.6.3.3.1.6 Technicel specifications The Technical Specifications (Chapter 16) require that two Component Cooling Water (CCW) divisions shall be operable in modes l 1, 2, 3, and 4. If one CCW division is inoperable, the inoperable y division must be restored to operable status within 72 hours, and, any inoperable Essential Systems must also be restored to operable Amendment M 19.6-37 March 15, 1993
CESSAR !!ai"lCATION status in the operating CCW division within 4 hours. If these conditions are not satisfied, the plant must be placed in mode 3, and possibly mode S. If tw . CCW divisions are inoperable, the plant must be placed in mode 4 within 12 hours, and, action must also be initiated to place the unit in mode 5 with an adequate complement of CCW components immediately if one CCW division can not be restored to operable status within the specified 12 hours. The most frequent surveillance requirement for the CCWS is to verify that each CCW manual, power-operated or automatic valve in the flowpath servicing essential equipment, that is not locked, sealed, or otherwise secured in position, is in its correct position. This test is performed every 31 days. Additionally, there is a surveillance requirement that every 18 months it must be demonstrated that each CCW automatic valve actuates and each CCW pump starts on an actual or simulated actuation signal. 19.6.3.3.2 System Logic Models The small event tree large fault tree approach is used in this study to quantify event sequences. By choosing the large fault tree approach, all support systems are developed and then integrated with the front-line or mitigating systems as appropriate. The CCWS is one of the support systems addressed in this study. 19.6.3.3.2.1 Analysis Assumptions In developing the fault tree model for CCWS, the following assumptions were made:
- 1. One CCWS pump is required to operate in order for the system to perform its function successfully.
- 2. The support systems for CCWS such as electrical distribution system and actuation signal are similar to those addressed in the front-line systems that directly depend on the component cooling water. Therefore, the duplication of these support systems in the fault tree model for CCWS is not warranted.
- 3. Each division of the CCWS consists of two motor-driven pumps and two heat exchangers. The discharge piping of the pumps is crossed tied so that they can circulate flow through either heat exchanger. Although each division consists of two heat exchangers, only one of the heat exchangers is in operation.
The other is regarded as an installed spare. It is valved in and used only when the normally operating heat exchanger becomes inoperable. Amendment M 19.6-38 March 15, 1993
CESSARna% - n I V) 4. The technical specifications do not allow both standby component cooling water pumps to be in maintenance at the same time.
- 5. Both the spent fuel pool heat exchanger and the non-essential loads must be isolated so that one CCWP and its associated CCW heat exchanger can remove sufficient heat following the initiating event.
- 6. The motors of operating CCW pumps are cooled to remove the heat generated. As a result, the operating CCWPs are considered to be operating in an environment that differs from the standby CCWP prior to being started. Hence, separate basic events are used to distinguish the common mode failures of the operating and standby CCW pumps.
- 7. Post maintenance testing of a CCW pump would not detect that the pump discharge isolation valve is mispositioned due to operator error. Therefore, this failure mode is included in the fault tree model for the standby CCW pump discharge isolation valve.
- 8. To realign CCW heat exchanger 1B or 2B for operation requires the operator to open the CCW inlet and outlet valves as well I as the SSW inlet and outlet valves. The realignment of the valves is considered to be a highly coupled event (i.e., the operator would realign all valves or not at all). Therefore, a single event that represents failure of the operator to realign the valves is included in the fault tree model.
Figures 19. 6. 3. 3-8 and 19. 6. 3. 3-9 provide the fault tree models for CCWS, divisions 1 and 2, respectively. 19.6.3.3.2.2 Interface with Event Trees The component cooling water does not directly interface with any initiating event tree. The component cooling water system removes heat from safety related and reactor auxiliary components. Safety related systems interface directly with appropriate event trees. The specific event trees are identified in the system descriptions for safety related systems. 19.6.3.3.3 System Quantification The CCWS is treated as a support system. Therefore, the fault tree models that are developed for the CCWS are integrated, as appropriate, into the models for other support systems, front-line systems, or mitigating systems. Because the CCWS models are integrated into other systems, no quantification is performed for these models. Amendment M 19.6-39 March 15, 1993
CESSAR !anscuiou l 1 0!l l 1 l l THIS PAGE INTENTIONALLY BLANK l l l l t Amendment M i 19.6-40 March 15, 1993 l
CESSAR 8annCATION Pump in division I (SI Train 1) is assumed to be the pump that may be unavailable due to maintenance. 1
- 4. The SI pump full-flow recirculation valves are normally )
closed. In the case of a mispositioned valve, flow is diverted from the reactor vessel to the IRWST during SI injection. Therefore, mispositioning of the full-flow recirculation valves is included in the model.
- 5. For large LOCAs, failure of the SIS is defined as the inability of three of the four SITS to deliver their contents into the reactor vessel via the associated DVI nozzles or the inability of three of the four SI trains to deliver borated water form the IRWST to the associated DVI nozzles. The inability to provide hot leg injection via the two paths is also considered in the fault tree model.
- 6. For Large Secondary Side Breaks (LSSBs) , f ailure of the SIS is defined as the inability of three of four SI trains to deliver borated water from the IRWST to the associated DVI nozzles.
- 7. For a small LOCA, transient, SGTR, or ATWS, failure of SIS is defined as the inability of all four SI trains to deliver borated water from the IRWST to the associated DVI nozzles.
It should be noted that certain transients such as loss of a
\ Component Cooling Water / Station Service Water train and loss of a 4.16 KV class 1E bus will render two of the four trains of SI inoperable. In such cases, system failure is defined as the inability of the remaining two trains to deliver borated water to the reactor vessel.
- 8. For all LOCAs and LSSBs, the SIS is initiated automatically.
For transients and other special event initiators, the SIS is used in conjunction with the SDS to perform feed and bleed operation when the preferred means of long term decay heat removal is lost. In such cases the SIS is manually initiated.
- 9. For a medium LOCA, failure of SIS is defined as the inability of three of three SI trains, with a break in the cold leg, or the loss of four of four SI trains without a cold leg break to deliver borated water to the reactor vessel. Both cases consider hot leg injection.
- 10. The inventory of the SITS and the IRWST is verified every 8 hours and every 7 days, respectively, to demonstrate that the borated water of these tanks is within proper limits. Alarms annunciate in the control room when the temperature, level, or pressure of the borated water falls below a minimum setpoint.
The frequent surveillance prevents any of these tanks from being unavailable for an extended period of time. The unavailability of any of the SITS or the IRWST is considered Amendment M 19.6-63 March 15, 1993
CESSARn!Meum to be small and is therefore not included in the fault tree models for SIS. The fault tree models developed for the SIS are contained in Figures 19.6.3.6-3 through 19.6.3.6-7. 19.6.3.6.2.2 Interface with Event Trees The SIS appears as an element of the following event trees:
- Large LOCA
- Medium LOCA
- Small LOCA
- Steam Generator Tube Rupture
- Large Secondary Side Break
- Transients
- Other transients
- Loss of one 4.16 KV vital bus
- Loss of one 125 VDC vital bus Loss of one CCW/SW train
- Loss of Offsite Power
- ATWS 19.6.3.6.3 System Quantification In order to estimate the frequency of core damage for those sequences which include failure of the SIS, the fault tree models presented in Figures 19.6.3.6-3 through 19.6.3.6-7 were quantified.
The CAFTA 2.2"" computer code was used to perform the quantification. The data used in the quantification is discussed in Section 19.5. l This section presents the results of the SIS quantification in terms of the system failure probability or unavailability and the dominant ways in which the system may fail. 19.6.3.6.3.1 System Unavailability The fault tree models presented in Figures 19.6.3.6-3 through 19.6.3.6-7 were used to determine the unavailabilities of the SIS for several cases considered in this study. The results of the unavailability quantification are presented in Table 19. 6. 3. 6-1 f or the various cases. The result for each case is presented as a distribution which is represented by the mean and the error factor. The total system unavailability for each case is also presented in Tables 19.6.3.6-2 through 19.6.3.6-6, respectively. The values presented in these tables are referred to as the "mincut Upper Bound". These values are regarded as point estimates and may dif fer slightly from the mean values presented in Table 19.6.3.6-1. O Amendment P 19.6-64 June 15, 1993
CESSAR nancuion n) TABLE 19.6.3.6-1 SAFETY INJECTION SYSTEM (* AVAILABILITIES Case No. Fault Tree Name DescrIDtf on Mean EF 1 PLA101BX Failure of Safety injection Tanks 6.86E-05 2.33 l (SITS) for large LOCA 2 PLA101CX Failure of Safety injection Tanks 1.62E-03 3.19 (SITS) for Aggressive Secondary Cooldown
! PHAH01BX Failure of Safety injection System 2.23E-03 1.50 for large LOCA 4 PHSG01BX Failure of Safety Injection System 8.83E-04 2,06 for small LOCA 5 PHBB02BX Failure of Safety injection System 8.75E-04 2.10 for Feed operat ion \v
( t ( Amendment P June 15, 1993
CESSAR nM?lCATION n
/
that opening of the cross-connect valves is a tightly coupled operator action, i.e., operator would open both valves or would not open any valve at all. Therefore, a single basic event is used to model failure of the operator to open the cross-connect valves.
- 10. Power supplies for the steam generator motor-driven isolation valves in the turbine-driven pump subtrains are assumed to be 125 VDC class 1E busses.
- 11. For the Loss of (normal) Feedwater flow events, the failure of the EFW system is modeled in the analysis as inability to deliver flow to either steam generator. For the LSSB or SGTR event, the failure is modeled as inability to deliver emergency feedwater to the unaffected steam gener ator from either the unaffected EFWS train or the motor-driven subtrain in the affected line via the cross-connection.
- 12. For the events that require long term cooling and the EFWS, it is assumed that the EFWST will be depleted prior to stabilizing the plant operation. For this scenario, the CST l is credited to gravity feed the depleted tank. The operator action assumed in this case is the alignment of the non-safety source to the depleted EFWST by opening appropriate locked closed manual valves.
- 13. The inventory of the Emergency Feedwater Tanks is normally verified every shift (approximately 8-12 hours) to demonstrate that emergency feedwater is within its proper level. There will be some sort of annunciation if the level is below the minimum limit. The frequent surveillance prevents the EFWSTs from being unavailable for an extended period of time. The unavailability of the EFWSTs is considered to be small and is, therefore, not included in the fault tree model for the EFWS.
The fault tree model for the Emergency Feedwater System is presented in Figure 19.6.3.7-2. 19.6.3.7.2.2 Interface with Event Trees The EFWS addressed in this section appears as an element in the following event trees: Loss Of normal Feedwater flow Loss Of Offsite Power (and Station Blackout) Large Secondary Side Break
- Steam Generator Tube Rupture 1 Small Loss-Of-Coolant-Accident (LOCA) l Other Transients (Non-Accident /Non-Loss of main Feedwater ;
g Flow) l L I Amendment P 19.6-73 "" ' l 1 l
CESSAR annr"lCATION
- Loss of one 4.16 KV vital bus
- Loss of one 125 VDC vital bus
- Anticipated Transient Without Scram (ATWS) 19.6.3.7.3 System Quantification In order to estimate the frequency of core damage for those sequences which include failure of the EFWS, the fault tree models presented in Figure 19.6.3.7-2 was quantified. The CAFTA 2.2W computer code was used to perform the quantification. The data used in the quantification is discussed in Section 19.5. l This section presents the results of the EFWS quantification in terms of the system failure probability or unavailability and the dominant ways in which the system may fail.
19.6.3.7.3.1 System Unavailability The fault tree model presented in Figure 19.6.3.7-2 was used to determine the unavailability of the EFWS for two cases, one case was the failure of the EFWS to deliver flow to either steam generator and the second case was the failure of EFWS to deliver flow to the intact SG. The model for second case was obtained by the use of a flag which prunes out the appropriate part of the . basic model. The result for each case is presented as a distribution which is represented by the mean and the error factor. Based on these models, the mean unavailability for the EFWS to deliver flow to either steam generator is 5.86E-05 with an error factor of 2.37 and that for the EFWS to deliver flow to the intact SG is 1.37E-04 with an error factor of 2.18. The total system unavailability is also presented in Tables 19.6.3.7-1 and 19.6.3.7-2, respectively and is referred to as the "Mincut Upper Bound". This value is regarded as a point estimate. It is used to determine the relative percent contribution of the individual cutsets. 19.6.3.7.3.2 Dominant Contributors to System Unavailability A list of the dominant cut sets for each case presented in Tables 19.6.3.7-1 and 19.6.3.7-2, respectively. The cut set that contributes the most to system unavailability is listed first followed by the next dominant and so forth. In addition, the information presented in these tables for each cut set includes:
- the probability of the cut set, and
- the element or elements of the cut set.
l O' Amendment P 19.6-74 June 15, 1993
CESSAR nuirimion m U 19.6.3.8.1.5 System Success Criteria For the postulated accident and transients where the startup feedwater is credited in this study, successful operation of the Startup Feedwater System is defined as the delivery of feedwater from the CST to the steam generator (s) by the Startup Feedwater pump. 19.6.3.8.1.6 Technical Specifications There are no technical specifications that are applicable to the Startup Feedwater System. 19.6.3.8.2 System Logic Models The small event tree large fault tree approach is used in this study to quantify event sequences. By choosing the large fault tree approach, all support systems are developed and then integrated with the front-line or mitigating systems as appropriate. The Startup Fendwater System is the mitigating system for the transients in which che main feedwater is unavailable for secondary heat removal. 19.6.3.8.2.1 Analysis Assumptions
- 1. The Startup Feedwater System is actuated by the FWCS, Actuation of the system involves opening of the motor-operated valves and starting of the Startup Feedwater pump.
- 2. For the cases for which the Startup Feedwater System is credited, its success is assumed to be its operation until the Shutdown Cooling System is actuated or the plant is brought to a stable condition. The analysis assumed a mission time of 24 hours as a bounding case.
- 3. A partially successful performance of any active or passive component was not credited. Each component and each operator action was assumed to be either completely successful or failed.
- 4. For the Steam Generator Tube Rupture event, it is assumed that operator will isolate the affected steam generator. This action involves verifying isolation of the path from the Startup Feedwater pump discharge header to the affected steam generator.
- 5. For the cases other than SGTR, the failure of the Startup Feedwater System is modeled in the analysis as inability to deliver flow to either steam generator. For the SGTR event, the failure is modeled as inability to deliver startup O feedwater to the unaffected steam generator.
Amendment M 19.6-77 March 15, 1993
CESSAR 88&"lCAT10N
- 6. The Startup Feedwater pump is assumed to be air-cooled. It is assumed that this pump would be located in the turbine building and that ambient air would be used to cool the pump motor. Hence, the Startup Feedwater pump is assumed to not be dependent on either the Component Cooling Water or Heating, Ventilation and Air-Conditioning systems.
- 7. The inventory of the Condensate Storage Tank (CST) is normally verified every shift (approximately 8-12 hours) to demonstrate that condensate (feedwater) is within its proper level. A feedwater low level condition will be annunciated in the control room. The frequent surveillance prevents the CST from being unavailable for an extended period of time. The unavailability of the CST is considered to be small and is, therefore, not included in the fault tree models for the Startup Feedwater System.
19.6.3.8.2.2 Interface with Event Trees The Startup Feedwater System addressed in this section appears as an element in the following event trees as a mitigating system:
- Small Loss-Of-Coolant Accident (LOCA)
- Steam Generator Tube Rupture (SGTR)
- Other Transients (Non-Accident /Non-Loss Of Normal Feedwater Flow and Non-Large Secondary Side Break) including
- Loss of one 4.16 KV vital bus
- Loss of one 125 VDC vital bus 19.6.3.8.3 System Quantification In order to estimate the frequency of core damage for those sequences which include f ailure of the feedwater systems, the f ault tree model presented in Figure 19.6.3.8-2 was quantified. The CAFTA 2.2"" computer code was used to perform the quantification.
The data used in the quantification is discussed in Section 19.5. l This section presents the results of the Startup Feedwater System quantification in terms of the system failure probability or unavailability and the dominant ways in which the system may fail. 19.6.3.8.3.1 System Unavailability The fault tree model presented in Figure 19.6.3.8-2 was used to determine the unavailability cf the Startup Feedwater System for two cases, one case was the f ailure of the Startup Feedwater System to deliver flow to either steam generator and the second case was tne failure of Startup Feedwater System to deliver flow to the intact SG. The model for second case was obtained by the use of a flag which prunes out the appropriate part of the basic model. The Amendment P 19.6-78 June 15, 1993
CESSARE!a h ou p result for each case is presented as a distribution which is represented by the mean and the error factor. Based on these models, the mean unavailability for the Startup Feedwater System to deliver flow to either steam generator is 1.26E-02 with an error factor of 1.57 and that for the Startup Feedwater System to deliver flow to the intact SG is 1.77E-02 with an error factor of 1.51. The total system unavailability is also presented in Tables 19.6.3.8-1 and 19.6.3.8-2, respectively and is referred to as the "Mincut Upper Bound". This value is regarded as a point estimate. It is used to determine the relative percent contribution of the individual cutsets. 19.6.3.8.3.2 Dominant Contributors to System Unavailability A list of the dominant cut sets for each case is presented in Tables 19.6.3.8-2 and 19.6.3.8-3, respectively. The cut set that contr ibutes the most to system unavailability is listed first followed by the next dominant and so forth. In addition, the information presented in these tables for each cut set includes: the probability of the cut set, and the element or elements of the cut set. s l l O Amendment P l 19.6-79 June 15, 1993
CESSAR EniinCAHON t O THIS PAGE INTENTIONALLY BLANK O Amendment P June 15, 1993 19.6-80
=
j v n .; , = , v I 8 1 A '
.NI**
1 4 F W O g F_ 2 - C t. J T N 1 r - O
- ES 6
O
=
1 C L C - W F L r 14 F R A
& O s .
s 4 W F E W O s Sl s P M} . 2 F O M n 1 4 S S
' o W O W F L N
m O o 0 N n W 1 4 P E e F W C W 2lia F J F L A gT&IFW .
*A T k F n
G G S 2 y S M M W F L eN= wG FS i * := _'
- =
JRer R LVs E N L R t 4 ay
*'S>
4 o 2 W c ' C O F NuW y j o=m% g4,, S l s N C i R i W o , 3 C NP 2 C S D R WMf gE D E P U .m m*o N E T E A o= F D W
+
= D m=
E E F A3oc s2 N L7sr mo
>@P C A M
s I 1 2 4 N A3ta G L7s F wt r N N T. AE E %' . G SG N D~ *Om N E D NN OS Mt s C C c - g.g3@% _ I g .p . e8 - l g - (A K-o-- O niOyg>dO O 4E r - $sa i 3C . N5 mmf> m3 u)$4.m* . a_5 J, C ll i -
- CESSAR 8!ai"ication
\
considered as a contributor to the unavailability of SCS injection. Therefore, the SCS heat exchangers are not-included in the fault tree model for SCS injection. In addition, the SCS heat exchanger bypass valves, SI-312 and SI-313, are used to maintain a constant cooldown rate. These valves are normally open and failure of a valve to operate will not prevent the reactor coolant from passing through the corresponding heat exchanger. Therefore, they are not included in the model for shutdown cooling injection.
- 7. The inventory of the IRWST is verified every shift (approximately 8 -12 hours) to demonstrate that the borated water is within proper limits. Alarms annunciate in the control room when the temperature or pressure of the borated water falls below a minimum setpoint. The frequent surveillance prevents the IRWST from being unavailable for an '
extended period of time. The unavailability of the IRWST is considered to be small and is, therefore, not included in the fault tree model for SCS injection. 19.6.3.9.2.2 Interface with Event Trees The top event of the SCS injection fault tree model appears an element in the Small LOCA and Steam Generator Tube Rupture Event f Trees. The fault tree model developed for SCS injection is presented in Figure 19.6.3.9-2. 19.6.3.9.3 System Quantification In order to estimate the frequency of core damage for those sequences which include failure of the SCS injection, the fault tree modeggresented in Figure 19.6.3.9-2 was quantified. The CAFTA 2. 2 computer code was used to perform the quantification. The data used in the quantification is discussed in Section 19.5. l This section presentt, the results of the quantification for SCS injection in terms of the system failure probability or unavai] ability and the dominant ways in which the system may f ail. 19.6.3.9.3.1 System Unavailability The fault tree model presented in Figures 19.6.3.9-2 was used to ! determine the unavailability of Shutdown Cooling System injection. This value of unavailability is presented as a distribution whicn is represented by the mean and error factor. Based on this model, the mean unavailability for SCS injection is 4.16E-3 with an error factor of 2.85. The total system unavailability is also presented in Table 19.6.3.9-1 and is referred to as the "Mincut Upper Bound". s Amendment P 19.6-87 June 15, 1993
CESSAR 8lninemou This value is regarded as a point estimate. It is used to determine the relative percent contribution of the individual cutsets. 19.6.3.9.3.2 Dominant Contributors to System Unavailability A list of the dominant cutsets for SCS injection is presented in Table 19.6.3.9-3. The cutset that contributes the most to system unavailability is listed first followed by the next dominant and so forth. In addition, the information presented in these tables for each cutset includes:
- the probability of the cutset, and
- the element or elements of the cutset.
9 O Amendment P 19.6-88 June 1", 1993 0
CESSAR 8B'acwou ~ deprescurization rate is controlled by modulating the valves in the vent lines from the top of the pressurizer and by opening and closing tha RCGV valves from the top of the reactor vessel head. 19.6.3.10.1.4.2 Rapid Depressurization (Bleed operation) Rapid Depressurization is performed by opening the bleed valves located on the top of the pressurizer. The " feed" function is performed by the safety Injection pumps (see Section 19.6.3.6) which are actuated automatically on low RCS (pressurizer) pressure or manually by the operator. The Bleed operation is normally used to mitigate the consequences beyond a design basis event such as a total loss of normal and emergency feedwater, or when the main spray and the nCGVS valves are not available to mitigate RCS pressure increase or to allow plant cooldown. In addition, the bleed valves may be used to reduce the RCS pressure in the highly improbable case that a severe accident occurs. During the bleed process, the core is also cooled. Opening the bleed valves results in a rapid depressurization of the RCS which allows the Safety Injection pumps to be used to refill the RCS and
, provide makeup or " feed" function. Core decay heat removal, using the " Feed and Bleed" operation, is accomplished by a once-through cooling process in which water is injected directly into the reactor vessel downcomer via the Safety Injection System. Once in the reactor vessel, the cooling fluid passes through the vessel downcomer to the lower plenum, up through the core, and out to the hot leg, through the surge line to the pressurizer and out through the dedicated bleed valves to the IRWST where quenching and cooling of the bleed flow is accomplished. Cooling of the IRWST (described in Section 19.6.4.2) is provided by the safety grade Component Cooling Water System and the Shutdown Cooling System (SCS) or Containment Spray System (CSS) Heat Exchangers (refer to Sections 19.6.3.9 and 19.6.3.13, respectively).
19.6.3.10.1.5 Bystem Success Criteria The success criterion for the depressurization function of the RCGVS is that one of two flow paths from the pressurizer to the RDT or one of two flow paths from reactor vessel to the RDT must be available. The success criterion for the Bleed System is that one of two vent flow paths from the pressurizer to the IRWST must be available. 19.6.3.10.1.6 Technical Specifications A The limiting conditions of operation and surveillance requirements for the rapid depressurization valves are summarized in this (N section. 1 Amendment P j 19.6-91 June 15, 1993 -
CESSAR naLion During modes 1, 2, 3 and 4, at least one of the two vent paths of the Rapid Depressurization System shall be operable and both paths shall be closed. If one of the valves in the depressurization (or bleed) path is opened, the affected valve must be closed within 12 hours or the plant must be placed in mode 3 or 5 within the next 6 or 36 hours, respectively. Periodic surveillance is performed to demonstrate that the rapid depressurization valves will open when required. The major surveillance requirements are:
- Verify, every 18 months, that the manual valves to the pressure instrumentation in each path are in the open position.
- Cycle the valves, every 18 months, in each vent path at least on complete cycle from the control room for all valves.
- Verify, from the control room every 7 days, that each of the position indications is '7dicating that the associated valve is correctly aligned.
- Verify, from the control room every 7 days, that the valve breakers are correctly aligned and power is available to each valve.
19.6.3.10.2 System Logic Models The small event tree /large fault tree approach is used in this study to quantify event sequences. By choosing the large fault tree approach, all support systems are developed and then integrated with the front-line or mitigating systems as appropriate. The SDS is one of the front-line systems addressed in this study. Figure 19.6.3.10-1 provides the schematic for the SDS showing the alignment for the Reactor Coolant Gas Vent and the Rapid Depressurization functions. The fault tree model for the Bleed function is presented in Figures 19.6.3.10-2. 19.6.3.10.2.1 Analysis Assumptions In developing the f ault tree model for the Reactor Coolant Gas Vent function of the SDS, the following assumptions were made:
- 1. Failure of the system is defined as the loss of both flow paths from the pressurizer to the Reactor Drain Tank (RDT) and the loss of both flow paths from the reactor vessel to the RDT.
Amendment P 19.6-92 June 15, 1993
CESSARnainemo r
\'
- 2. Each RCGVS valve is powered from the 125 VDC class 1E power system via its own dedicated inverter.
In developing the fault tree model for the Rapid ~Depressurization function of the SDS, the following assumptions were made:
- 1. Failure of the system is defined as the loss of both vent flow paths from the pressurizer to the IRWST; i.e., the failure of one of two bleed valves in path A and the failure of one of two bleed valves in path B.
- 2. Each bleed valve is also powered from the 125 VDC class 1E power system via its own dedicated inverter.
The fault tree model for the Bleed System is presented in Figure 19.6.3.10-2. 19.6.3.10.2.2 Interface with Event Trees The SDS interfaces with the following Event Trees: Small Loss-Of-Coolant-Accident (LOCA)
- Steam Generator Tube Rupture
- Large Secondary Side Break
/
- Loss of Feedwater
(
- Other transients (Non-accident /Non-Loss of Feedwater Flow and Non-Large Secondary Side Break)
Loss of one Component Cooling Water division Loss of one 4.16 KV vital bus
- Loss of one 125 VDC vital bus
- Loss of Offsite Power
- Anticipated Transients Without Scram (ATWS) 19.6.3.10.3 System Quantification The quantification for the RCGVS is a part of quantification for the special function, Reactor Coolant System (RCS) Pressure Control, presented in Section 19.6.4.4. The quantification for the Rapid Depressurization System or Bleed System is presented below.
In order to estimate the frequency of core damage for those sequences which include f ailure of the Bleed System, the fault tree model presented in Figure 19.6.3.10-2 was quantified. The CAFTA"U computer code was used to perform the quantification. The data used in the quantification is discussed in Section 19.5. l This section presents the results of the Bleed System quantification in terms of the system failure probability or unavailability and the dominant ways in which the system may fail.
.s
\ Amendment P 19.6-93 June 15, 1993
CESSAR Enn,*icarieu 19.6.3.10.3.1 System Unavailability . l The fault tree model presented in Figure 19.6.3.1.0-2 was used to determine the unavailabilities of the Bleed System. The result of the unavailability quantification is presented in Table 19.6.3.10-1. The system unavailability result is presented as a distribution which is represented by the mean and the error factor. 19.6.3.10.3.2 Dominant Contributors to System Unavailability A list of the dominant cutsets for the Bleed System is provided in Table 19.6.3.10-1. The cutset that contributes the most to system I unavailability is listed first followed by the next dominant and so I forth. The total system unavailability presented in Table 19.6.3.10-1 is ref erred to as the "Mincut Upper Bound" . This value is regarded as a point estimate. The point estimate value is used to determine l the percent contribution of the individual cutsets. In addition to i the system unavailability, the information presented in the table l for each cutset includes the probability of the cutset, and the I element or elements of the cutset. The results of the analysis indicate that the most dominant contributor to overall Bleed System unavailability is human error (operator fails to initiate bleed). This cutset contributes 90.6% ; of the total system unavailability. l The next most dominant cutset is the common cause failure of the bleed valves. This cutset contributes 7.9% of the total system unavailability. The third most dominant cutset is the cogon cause failure of the bleed valve inverters, contributing 1.0% of the total system unavailability. 1 O Amendment P 19.6-94 June 15, 1993
CESSAR nuirlCATION O 19.6.3.11 ELant Protection Bvster 19.6.3.11.1 System Description I 19.6.3.11.1.1 Bystem Function The functions of the plant protection system (PPS) are to protect the core fuel design limits and the reactor coolant system pressure (RCS) boundary during anticipated operational occurrences. In addition to protecting the core and RCS pressure boundary, the PPS assists in mitigating the consequences of accidents. Nuclear steam supply system parameters and containment conditions are monitored by the PPS continuously. If monitored conditions approach specific safety limits the PPS rapidly shuts down the reactor to protect the fuel design limits and/or prevent a breach of the RCS pressure boundary. The PPS communicates with the engineering safety features component control system (ESF-CCS) which enables it to actuate mitigating systems when nuclear steam supply system parameters and containment conditions approach safety limits. 19.6.3.11.1.2 Bystem Configuration The plant protection system (PPS), as shown in Figure 19.6.3.11-1, consists of four redundant channels. The system configuration [ shown in this figure is for illustration purposes only. l \ Each channel contains measurement devices such as sensors, bistable trip processors, local coincidence logic processors, initiation logic circuits, and actuation logic circuits. A trip is generated when a coincidence of two like trip signals of the monitored plant parameters or containment conditions reach a pre-set safety limit. These trips include: Variable overpower High logarithmic power level High local power density Low departure from nucleate boiling ratio Hign pressurizer pressure Low pressurizer pressure
- Low steam generator water level
- High steam generator water level Low steam generator pressure High containment pressure Hi Hi containment pressure
- l Low reactor coolant flow Manual reactor trips, located in the control room and the Remote Shutdown Room, are also provided to permit the operator to trip the reactor. A set of four pushbutton switches are provided for such purpose at each location. Actuation of a selective two out of four of these switches causes AC power to be interrupted to the control Amendment P 19.6-95 June 15, 1993
CESSAR nai"lCATION element assemblies (CEAs) and causes them to be rapidly inserted into the core to produce a reactor trip. 19.6.3.11.1.2.1 Measurement Devices Monitored parameters such as pressures, levels, and temperatures are measured by four instrument channels which consist of a sensor / transmitter, a loop power supply, current resistors, and a fiber-optic transmitter output. The piping, wiring, and components of each channel are separated from other like channels to provide independence. Monitored parameters such as CEA positions, neutron flux, and reactor coolant pump speed are measured by methods other than that described above. The following is a brief description of the devices used to measure such parameters. CEA positions are monitored by the core protection calculators and CEA calculators of the plant protection system (PPS). The core , protection calculators monitor the position of one target CEA in each subgroup while the CEA calculators monitor the positions of all CEAs. CEA positions are measured by two reed switch assemblies on each CEA. Each reed switch assembly consists of a series of magnetically actuated reed switches spaced at intervals along the CEA housing and wired with precision resistors in a voltage divider network. A magnet attached to the CEA extension shaf t actuates the adjacent reed switches, causing voltages proportional to position to be transmitted for each assembly. Ex-core neutron flux is monitored by four nuclear instrumentation channels. These channels are separate and redundant. Each channel consists of three fission chambers, a preamplifier and a signal conditioning drawer containing power supplies, a logarithmic amplifier, linear amplifiers, test circuitry, and a rate-of-change of power circuit. The fission chambers are stacked vertically along the length of the reactor core. The use of multiple fission chambers in this arrangement permits the determination of axial power shape during power operation. Preamplifier / filter assemblies for the fission chambers are mounted outside the reactor containment building in the penetration area. The four nuclear instrmnentation channels provide the PPS with information which is used for rate-of-change of power, departure form nucleate boiling ratio, local power density, power dependent steam generator level setpoints and over-power protection. There are four reactor coolant pumps. The speed of each pump is measured to provide a basis for calculating reactor coolant flow through each pump. The speed of each pump is measured by two metal discs which are scanned by proximity devices. Each disc consists of 44 uniformly spaced slots about its periphery. The discs are attached to the pump shaf t, one to the upper portion and one to the ! lower portion. Each scanning device produces a voltage pulse signal. The pulse signals are transmitted to the core protection Amendment P 19.6-96 June 15, 1993
CESSAR nuincmou l I l calculators which use these signals to calculate the mass flow rate. 19.6.3.11.1.2.2 Distable Trip Processors As shown in Figure 19.6.3.11-1, each of the four channels for the plant protection system (PPS) consists of two bistable comparator processors which are used to compare signals from the measurement channels to either fixed or variable set-points. The function of the bistable trip processors is to generate a trip signal when a coincidence of two like trip signals of monitored plant parameters or containment conditions reach or exceed their setpoints. A pre-trip alarm is also provided as part of the bistable trip processors. In addition to the trip and pre-trip functions, the bistable processors contain test circuit logics. These circuits allow testing of the following bistable information: i
- Analog input Trip setpoint Pre-trip setpoint Status information 19.6.3.11.1.2.3 Coincidence and Initiation Logic Circuits There are two local coincidence logic processors per PPS channel, l as shown in Figure 19.6.3.11-1. One local processor is associated with each bistable processor of each channel. Each processor receives four trip signals, one from its associated bistable processor in the channel and one from each of the equivalent bistable processors located in the other three channels. The function of the coincidence processor is to generate a signal whenever two or more like bistable processors are in a trip condition.
There is an initiation circuit in each channel for each PPS function such as reactor trip, safety injection actuation, and containment isolation. The inputs to the initiation logic are the outputs from the appropriate coincidence logic circuits. 2.9.6.3.11.1.2.4 Actuation Logic l The actuation logic for reactor trip is in the power path to the control element drive mechanisms control system. This actuation logic is called the reactor trip switchgear system (RTSS). The RTSS consists of four trip circuit breakers. Each trip circuit breaker contains a shunt trip devicn, an under-voltage trip device, and a breaker load contact. Two breaker load contacts are arranged in series to form an electrical path from one of the two motor generator sets to the control element drive mechanism. The other 1 two breaker load contacts are arranged in a similar manner to form Amendment P 19.6-97 June 15, 1993
CESSAR nabuou ! another redundant electrical path. The appropriate relays of the initiation logic interface with the shunt trip and undervoltage trip devices to trip the circuit breakers and interrupt power to ) the CEAs. 1 19.6.3.11.1.3 Support and Interfacing Systems The Plant Protection System (PPS) relies on the 125 VDC system to provide power to the RTSG shunt trip coils to perform its trip functions. An Alternate Protection System (APS) is provided to augment tripping the reactor. This system complies with the requirements for risk reduction of anticipated transients without scram " . The APS generates an alternate reactor trip signal and an alternate feedwater actuation signal which are separate and diverse from the PPS. An alternate reactor trip signal is generated when pressurizer pressure exceeds a predetermined value or when a turbine trip occurs and the reactor cutback system is out of service. An alternate feedwater actuation signal is generated when the level in either steam generator decreases below a predetermined value. The APS utilizes a two-out-of-two logic arrangement to generate alternate signals for tripping the reactor or actuating emergency feedwater. Although the PPS does not rely on support from other systems to trip the plant, it relies on the following systems in order to maintain plant availability.
- 480 VAC class non-1E power system
- 125 VDC class 1E power system
- 120 VAC class 1E power system
- Heating, ventilation and air-conditioning system The 480 VAC class non-1E power system provides motive power for the motor generator sets. The generator sets supply power to the holding coils of the CEA which enables them to be repositioned as required. Loss of power results in rapid insertion of CEAs into the reactor core.
The 125 VDC class 1E power system maintains the reactor trip breakers in their closed positions until a trip signal is generated by the plant protection system. Loss of power from two selected buses of the 125 VDC class 1E system will result in a reactor trip. Power from the 120 VAC class 1E system is reduced to a lower voltage level and is then used by various processors and circuits of the PPS to properly monitor plant parameters and containment conditions. Loss of power from two 120 VAC class 1E buses will result in a reactor trip and actuation of ESF systems. l Amendment P 19.6-98 June 15, 1993
CESSAREn%ma n In addition to other rooms, the Heating, Ventilation and Air-Conditioning (HVAC) system provides temperature and humidity control for the four rooms containing the PPS, one channel per room. Loss of control room HVAC is recognized as an event that may impact electronic systems such as the PPS. It is also recognized that failure or unavailability of electronic equipment due to loss of HVAC depends on several factors such as layout, heat loads, and configuration of the rooms. The exact layout of the PPS is not known at the time. For this study, it is assumed that the plant will be tripped manually when there is a loss of cooling to two of the four rooms that house the PPS. This event will affect two channels of the PPS. However, the failure mode of the affected channels is not well defined. For conservatism, it is assumed that loss of room cooling will render the affected channels of the PPS inoperable. The affected PPS channels will gradually fail as the temperature increases. It is very unlikely that the failed portion of the HVAC system will be restored prior to the expiration of the allowed outage time which governs the operation of the PPS in this two channel configuration. Not restoring the HVAC system to full operability will result in a forced plant shutdown. Therefore, loss of HVAC has little or no impact on PPS trip functions. Refer to Section 19.6.3.5.2 for further discussions on HVAC. The PPS interfaces with the following systems or modules: /% ( ,) Main control room operator module Remote shutdown panel Discrete indication and alarm system Data processing system Engineered safety feature component control system Reactor trip switchgear system The PPS communicates to or receives feedback information from these systems or modules. 19.6.3.11.1.4 System Operation During normal plant operation, various process protective parameters along with neutron flux and reactor coolant pump speed are measured by the redundant measurement channels of the plant protection system (PPS). Except for the core protection calculators (CPCs), signals from process measurement channels are sent to bistable processors. The processor in each channel compares its input signal to either a fixed or a variable setpoint. When the measured parameter reaches or exceeds its setpoint the bistable processor produces a trip signal. The CPCs provide trip states directly to the local coincidence logic processors. l Trip signals generated by the bistable processors are sent to the local coincidence logic processors. Each bistable processor sends ( a trip signal to one of the four coincidence processors in the same Amendment P l 19.6-99 June 15, 1993
CESSARnaiLos channel and the appropriate processor in each of the other three channels. In addition to the four trip signals from the bistable processors, each coincidence processor also receives trip channel bypass states. If no channel is bypassed then the processor generates a coincidence signal when two or more like bistables are in a trip condition. When one channel is bypassed it is not included in the two or more trip combinations required to produce a signal. Under such conditions, the processor generates a coincidence signal based on two or more of the three unbypassed bistable processors being in a trip condition. Coincidence signals are sent to the initiation logic circuit for each PPS protective function. These circuits filter out noise or transient signals. This is accomplished by monitoring the continuous presence of an input for a minimum period of time. If the signal is present for the required time, the signal is transmitted to the initiation relay. Initiation relays interf ace with actuated devices such as the shunt trip and the undervcitage devices of the reactor trip switchgear system (RTSS). To completely remove power from the CEDMs, a minimum of two actuation relays are required to operate. The operable relays must be in opposite legs of the RTSS circuit. Opening of the circuit breakers interrupts power to the CEAs and causes the reactor to trip. Two sets of manual trip switches are provided to open the trip breakers if desired. The manual trip is independent of the trip logic. Both manual trip switches in a set must be actuated to initiate a reactor trip. There are also reactor trip switches on the Remote Shutdown Panel (RSP). An Alternate Protective System (APS) is provided to trip the reactor in the event that the trip circuit breakers of the RTSS do not open. The APS provides a diverse means of tripping the reactor. Pressurizer pressure is monitored by the APS which generates an alternate reactor trip signal when the monitored pressure exceeds a pre-determined value. Turbine trip signals can also be used to generate an alternate reactor trip signal if the reactor power cutback system is out of service. The APS generates an alternate reactor trip signal based on a two-out-of-two coincidence logic arrangement. The generated signal opens the contactors of the motor generator sets of the control element drive mechanism thus removing power from the CEAs and tripping the reactor. 19.6.3.11.1.5 System Buccess Criteria Each of the PPS channels contains an initiation circuit for each , PPS function such as reactor trip and engineered safety features 1 l Amendment P 19.6-100 June 15, 1993 l ( l
CESSARnn%mou O actuation. The success criteria for reactor trip signal are discussed in this section while those for engineered safety features actuation are discussed in Section 19.6.3.12.1.5. 1 The function of the reactor trip signal is to interrupt power to the reactor trip switchgear system (RTSS). The RTSS consists of four trip circuit breakers and associated shunt trip and undervoltage trip devices. Load contactors on two breakers are wired in series to form an electrical path from one of the two motor generator sets to the control element drive mechanism. The load contactors for the other two breakers are also wired in series to form a parallel path from the other motor generator set to the control element drive mechanism. The reactor trip signal performs its function successfully when any two breakers in opposite paths open. Tripping (opening) the breakers in the parallel paths interrupts power to the CEAs and causes a reactor trip. 19.6.3.11.2 System Logic Models The PPS consists of a reactor protection system (RPS) and an engineered safety features actuation system (ESFAS). The RPS generates a signal for tripping the reactor. A reactor trip occurs when power to the control element drive mechanism is removed and the CEAs are inserted into the reactor core. For this study, the RPS, the RTSS, and the CEAs are regarded as the constituent parts of the reactor trip system. Only the RPS and the RTSS portions of the reactor trip system are included in this section. The CEA portion is addressed in Section 19.4.12. For this study, the boundaries of the teactor trip system are defined to be from the sensors of the monitored trip parameters to and including the trip circuit breakers. Several portions of the RPS for the Standard System 80 Design were changed or modified. The modified RPS is included as part of the Standard System 80+ Design. The RPS of the Standard System 80+ Design includes programmable logic controllers for comparing monitored parameters against their setpoints and for determining coincidence conditions. Although several enhancements and modifications are included for the RPS, ' the trip circuit breaker configuration is similar to that used in the Standard System 80 design. No design changes have been made in this area. Also, no design changes have been made to the measurement loops. ! In response to Generic Letter 83-28" ) on the Salem ATWS, a complete f ault tree analysis of the dif ferent classes of RPS designs for C-E NSSS supplied plants was performed. The results of the anrlysis l are documented in CE NPSD-277"3' and CEN 3 2 7 m,55) . For Standard System 80, the results show that the dominant contributors to RPS unavailability are failure of the trip circuit breakers (91%) and failure of the primary and diverse trip channels and operator fails Amendment M 19.6-101 March 15, 1993
CESSAR nai"lCATION to initiate a manual trip (8%). Because System 80+ Design uses the same trip circuit breaker arrangement and measurement loops as Standard System 80, it can be concluded that the dominant contributors to RPS unavailability for the Standard System 80 and the Standard System 80+ Designs are the same. As previously mentioned, several changes are incorporated in the RPS for the System 80+ Design. These design changes and features include the use of programmable logic controllers with on-line continuous testing capability. Such features will enhance the reliability of the PPS logic circuits. Protection system data that l is accessible to the test task is read into the channelized interface test processors. The data is then analyzed to determine if the protection system is operating properly. Although reliability improvements are expected in the individual PPS logic circuits, there will be no significant improvement in the overall system reliability because no design changes have been made to the reactor trip switchgear system which was identified as the dominant contributor to RPS unavailability. Approximately 99% of RPS unavailability is due to portions of the system for which no design changes or modifications are made. Keep in mind that the PPS of the System 80+ Design is a modified version of the Standard System 80 PPS design and both designs are functionally equivalent. Because no design changes are made to the configuration of the reactor trip switchgear system, no insight would be gained in developing a fault tree models for the System 80+ RPS. Also, sufficient design detail information is not currently available to support such a task. Therefore, the analyses 03- "*
- for the Standard System 80 RPS unavailability are used as the basis for RPS unavailability in this study.
19.6.3.11.2.1 Analysis Assumptions Although no fault tree models were developed for the RPS of the System 80+ Design, certain assumptions were made regarding the system. These assumpticns are as follows:
- 1. System failure is defined as failure of the RPS to trip the reactor on demand by interrupting power to the control element drive mechanism.
- 2. System boundaries are defined to be from the trip parameter sensor to but not including the control element drive mechanism. The motor generator sets are considered outside the system boundarias.
- 3. The RPS operates in a de-energized-to-trip mode. Loss of power has the same effect as a trip signal. The failure of power supplies is not included in the fault tree analysis except for failure of the protective channel power supply at Amendment P 19.6-102
CESSARna hou the sensor level for high pressurizer pressure function and the shunt trip power supplies.
- 4. Since only one channel of the RPS can be in a bypass condition I at any given time, unavailability contributions due to a l channel in bypass are included for Channel D. (The bypass condition includes bypass for test and maintenance.)
- 5. The unavailability of a channel of the RPS due to test or maintenance is determined based on the limiting conditions for operation and the surveillance intervals as specifled by the technical specifications (Chapter 16). Certain assumptions regarding the applicable limiting conditions for operation and surveillance intervals of the RPS channels were made.
In addition to on-line continuous testing, periodic surveillance is performed on RPS. For this study, periodic surveillance on a monthly basis is assumed. If the limiting conditions for operation cannot be met, then the mode of plant operation must be changed within a specified time period. This may result in plant shutdown. For this study, the mode of plant operation is regarded as normal power operation (MODE 1) prior to the occurrence of an abnormal event.
- 6. The Standard System 80+ and the Standard System 80 designs use the same type of configurations for the reactor trip switchgear system (RTSS) and measurement loops. For the Standard System 80, the dominant contributors (99%) to RPS unavailability include failure of the RTSS and measurement loop. Therefore, the unavailability of the RPS for Standard System 80+ is assumed to be no worse than Standard System 80.
19.6.3.11.2.2 Interface with Event Trees A successful reactor trip is implicitly included as an element in all event trees, except the ATWS event tree. This element is used for reactivity control. An unsuccessful reactor trip will result in one of the ATWS event sequences. To accomplish a reactor trip, a trip signal is generated by the RPS or the Alternate Protection system which interrupts power to the control element drive mechanism and causes the CEAs to be inserted into the reactor core. Failure of the reactor to trip may result from failure of the RPS and the Alternate Protection System or failure of the CEAs to insert. These faults are included in the frequency of an ATWS event. Therefore, the RPS interfaces implicitly with all event trees. Amendment M 19.6-103 March 15, 1993
CESSARnahon 19.6.3.11.3 Bystem Quantification The results of the fault tree analysis for System 80 RPS sa,54,55) t show that RPS unavailability is 6.62E-06 per demand with an error f actor of approximately 5.0. As shown in the above reference, the dominant contributors to RPS unavailability for System 80 are:
- Common cause mechanical failure of trip circuit breakers (91%), and
- Common cause f ailure of trip channels, f ailure of diverse trip parameter, and operator fails to initiate manual trip (8%).
Note that the reactor trip switchgears are divided into three constituent parts. They are the shunt trip device, the undervoltage trip device, and the mechanical portion of the breakers. The above RPS unavailability is used in this study. O O Amendment M 19.6-104 March 15, 1993
CESSAR Ennemon O 19.6.3.12 Engineered Safety Features Actuation System 19.6.3.12.1 System Description 19.6.3.12.1.1 System Function The function of the engineered safety features actuation system (ESFAS) is to generate signals for actuating engineered safety features (ESF) systems when monitored plant variables reach levels i that are indicative of conditions which require protective action. l ESF systems provide the required protection. The following i actuation signals are generated by the ESFAS: l
- Containment Isolation Actuation Signal (CIAS)
- Containment Spray Actuation Signal (CSAS)
- Main Steam Isolation Signal (MSIS)
- Safety Injection Actuation Signal (SIAS)
- Emergency Feedwater Actuation Signal (EFAS) 19.6.3.12.1.2 System Configuration The ESPAS consists of four redundant channels. Each channel consists of sensors, bistable processors, and coincidence and initiation logic circuits which monitor selected plant parameters.
Each channel also consists of a corresponding channel (or train) of k engineered safety features - component control system (ESF-CCS). The ESF-CCS consists of actuation and component control logic circuits which generate appropriate signals for actuating ESF system components when needed. Actuation signals are generated if the selected plant parameters reach predetermined setpoints. The process of generating each actuation signal is similar, except that specific inputs and logic (blocks where provided) vary from signal to signal and the actuated devices are different. The functional logic for generating the various actuation signals are shown in Figures 19.6.3.12-1 through 19.6.3.12-4. As shown in these figures, the bistable trip processors, local coincidence logic and initiation logic of the plant protection system (PPS) are used, as appropriate, to generate the various initiation signals of the ESFAS. A description of these logic circuits is presented in Sections 19.6.3.11.1.2.1 through 19.6.3.11.1.2.3 of this report. This section discusses the configuration of the ESF-CCS. Each local coincidence logic of the PPS employs a full two-out-of-four logic for generating an output signal which is used to operate the initiation logic. The initiation logic controls the initiation relays that interface with the ESF-CCS. Initiation signals from the initiation relays are directed to the selective two-out-of-four logic in the ESF-CCS where they are logicElly combined. A functional diagram of a typical train of the ESF-CCS is shown in ( Figure 19.6.3.12-5. There are four such trains. As shown, each train contains multiple subsystems. Each subsystem consists of a Amendment M 19.6-105 March 15, 1993
CESSAR naincarios pair of processors, local and remote multiplexers, and communications interfaces. One of the processors is designated as the primary processor while the other is designated as the standby or secondary processor. The primary processor actively performs the control functions while the standby processor monitors the actions of the primary processor. Control tasks are automatically transferred to the standby processor upon detection of failure of the primary processor and confirmation that the standby processor is operable. Local and remote multiplexing is incorporated in the ESF-CCS to reduce and simplify plant wiring. Remote multiplexers are physically located in the main control panels, the remote shutdown panel, and ESF-CCS remote multiplexer cabinets. Remote multiplexer cabinets of the ESF-CCS are located near plant component and instrumentation interface locations. Fiber-optic cable provides electrical isolation where required to meet channel independence provisions. In addition to the system level selective two-out-of-four logic for ESF actuation, the ESF-CCS also provides subgroup control logic, component control logic, selective group test logic, and diesel loading sequencer logic. The subgroup control logic performs supervisory control of subgroups of components. The component control logic monitors the various digital inputs, such as manual on-off demands, interlocks, and automatic subgroup control signals from the main control panel, and produces digital output si.gnals to control the component (i.e., start /stop, on/off) through power level interface devices. This logic also generates digital outputs for status indication. The sequencer logic for diesel generator loading ensures that one group of safety-related components is loaded at a time. However, the logic has the intelligence to vary the loading sequence in response to changing plant conditions. Selective group testing is used for testing equipment beyond the j selective two-out-of-four coincidence logic which is overlapped by the PPS automatic testing scheme. The selective group testing logic is also used to perform complete testing of ESFAS, through to the actuated devices. Components of the ESFAS are divided into groups so that they can be tested one at a time. This approach prevents undesired actuation of ESF system components during testing. ESF functions are assigned to different subsystems within each train of the ESF-CCS. For example, safety injection and emergency feedwater to steam generator No. 1 are assigned to the first subsystem while containment spray and emergency feedwater to steam l generator No. 2 are assigned to the second subsystem. Main steam i isolation and containment isolation functions are assigned to a l Amendment P 19.6-106 June 15, 1993
CESSAR 8lnhou i signals, one from its associated bistable processor in each channel. In addition to the four trip signals (one from each channel) from I the bistable processcrs, each local coincidence logic processor also receives trip channel bypass states. If no channel is bypassed then the processor generates a coincidence signal when two or more like bistables are in a trip condition. When one channel is bypassed it is not included in the two or more trip combinations required to produce a signal. Under such conditions, the processor generates a coincidence signal based on two or more of the three un-bypassed bistable processors being in a trip condition. Coincidence signals are sent to the initiation logic circuit for each channel of PPS protective function. These circuits filter out noise or transient signals. This is accomplished by monitoring the continuous presence of an input for a minimum period of time. If the signal is present for the required time, it is then transmitted to the initiation relays. The initiation relays interf ace with the engineered safety features
-- component control system (ESF-CCS) to generate the various signals of the ESFAS such as SIAS, CSAS, EFAS, and CIAS. A signal from the initiation relay in each channel of the PPS is sent to the f \
actuation logic circuits in all four trains of the ESF-CCS. The initiation signal is selectively combined in the two-out-of-four logic in the ESF-CCS to produce a signal for actuating the required ESF components. There is no diverse means of automatically generating the various signals of the ESFAS, except for the EFAS. Generation of an EFAS may also be accomplished by using inputs from the alternate protective system (APS). The APS provides a diverse means of tripping the reactor and actuating emergency feedwater system. Emergency feedwater is initiated by APS when the level in either steam generator decreases below a predetermined value. The alternate feedwater actuation signal is sent from the APS directly to component control logic circuits of the emergency feedwater system components. 19.6.3.12.1.5 System Success Criteria Each channel of the PPS contains an initiation circuit f or each PPS function such as reactor trip and engineered safety features actuation. The success criteria for engineered safety features actuation signals are discussed in this section while those for reactor trip are discussed in the PPS description, Section 19.6.3.11.1.5. The function of the ESFAS is to actuate selective groups of components in the engineered safety features (ESP) systems when measured plant parameters reach levels that are indicative of Amendment M 19.6-109 March 15, 1993
CESSAR1HL mn conditions that require protective actions. ESFAS success is defined as the processing of all signals to actuate appropriate ESF systems to accomplish the following functions as needed:
- Safety injection,
- Containment spray, a Containment isolation
- Main steam isolation
- Emergency feedwater 19.6.3.12.2 Bystem Logic Models The System 80+ ESFAS design is functionally equivalent to the otandard System 80 ESFAS design. l The current level of detail does not provide sufficient information for developing detailed fault tree models for the ESFAS. For this l study, the unavailabilities of the various signals of the ESFAS are considered to be no worse than those of the Standard System 80 design because certain features such as the measurement loops remain unchanged.
In response to Generic Letter 83-28" ) on the Salem ATWS, a complete fault tree analysis of the different ESFAS designs for C-E NSSS supplied plants which include Standard System 80 was performed. The results of the analysis are documented in CEN 32703) . For standard System 80, the results show that the dominant contributors to the unavailability of a specific signal of the ESFAS are " operator fails to manually initiate the appropriate signal" and any of the following common cause faults:
- Operator sets bistables incorrectly,
- Common cause failure of sensors, or
- Common cause failure of bistables.
Although changes have been made to improve the reliability of several portions of ESFAS, no improvements to the measurement loops have been made. It is expected that ESFAS reliability for the System 80+ Design will be better than the Standard System 80 Design. This is based on the improvements that are being incorporated in the System 80+ ESFAS design, the levels of redundancy in the ESFAS, and the dominant contributors ESFAS unavailability for the Standard System 80 Design. However, the reliability of the ESFAS for the Standard System 80+ cannot be determined without a detailed design. Based on these observations, high level modularized fault trees are developed for the various signals of the ESFAS4 The structure of the fault trees are similar, but the inputs differ to reflect the signol of concern. O Amendment P 19.6-110 June 15, 1993
CESSAR nai"icari n p)
- 6. The containment spray pump mini-flow heat exchangers are considered to be an integral part of the pump, and therefore were not modeled separately.
- 7. Each return line to the IRWST from the discharge of the containment spray heat exchanger contains three (3) normally closed motor-operated valves. All of these valves must transfer open in order to have flow diversion. This is a low probability event and therefore the failure of all three valves to remain closed is not included in the fault tree model for CSS. However, the valves being mispositioned due to operator error is modeled.
- 8. The CSS pump mini-flow recirculation lines are not modeled as a flow diversion paths as the diameter of the mini-flow lines is two inches versus the CSS floupath diameter of 14 inches and they are closed loop paths.
- 9. The mispositioning of manual valves associated with the CSS and SCS pumps (including CCW valves) is not modeled.
Mispositioned pump manual isolation valves due to maintenance would be detected during test and corrective actions taken prior to declaring the pumps operable. O i
- 10. Flow diversion via SCS heat exchanger motor-operated valves 3
(SI-310 and SI-601 for Train 1 and SI-311 and SI-602 for Train
- 2) are not modeled as both motor-operated valves would have to transfer open. This is a low probability event.
The fault tree model developed for Failure of Containment Spray is presented in Figure 19.6.3.13-2. 19.6.3.13.2.2 Interface with Event Trees The top event of the CSS fault tree model addressed in this section appears as an element in the following Event Trees:
- Large LOCA
- Medium LOCA 19.6.3.13.3 System Quantification In order to estimate the frequency of core damage for those ,
sequences which include Failure of Containment Spray, the fault l tree models presented in Figure 19.6.3.13-2 were quantified. The l CAFTA Version 2.2W computer code was used to perform the quantification. The data used in the quantification is discussed in Section 5 of this report. This section presents the results of the CSS quantification in b} g ( terms of the system failure probability or unavailability and the dominant ways in which the system may fail, i 1 Amendment P 19.6-119 June 15, 1993
CESSAR nahion 19.6.3.13.3.1 System Unavailability The fault tree model presented in Figure 19.6.3.13-2 was used to determine the unavailability of the containment spray. Based on this model, the mean unavailability for failure of the containment spray system is 6.98E-4 with an error factor of 1.31. l 19.6.3.13.3.2 Dominant Contributors to System Unavailability A list of the dominant cutsets for Failure of Containment Spray is presented in Table 19.6.3.13-1. The cutset that contributes the most to system unavailability is listed first followed by the next dominant and so forth. The total system unavailability presented in Table 19.6.3.13-1 is ref erred to as the "Mincut Upper Bound". This value is regarded as a point estimate. The point estimate value is used to determine l the percent contribution of the individual cutsets. In addition to the system unavailability, the information presented in the table , for each cutset includes the probability of the cutset, and the element or elements of the cutset. The unavailability of the CSS is dominated by the common cause failure of the containment spray header isolation motor-operated valves and the common cause failure of the containment spray heat exchanger outlet component cooling water motor-operated valves. These cutsets each contribute 29.2% to the total system unavailability. Other cutsets of significance are, listed in order of hierarchy:
- common cause failure of containment spray pump suction check valves (5.2%),
- common cause failure of containment spray pump discharge check valves (5.2%), and a common cause failure of containment spray pump breakers to close (4.4%).
Refer to Table 19.6.3.13-1 for the complete list of cutsets that contribute to the total containment spray system unavailability. O Amendment P 19.6-120 June 15, 1993
O
$Q e& W lO q,
i& agf/* IMAGE EVALU ATION
/
4 [p 4,4f# //g
/
\;,g// Tf TEST TARGET (MT-3)
'fs
\ Rff /$
+ %
l.0 ES M lf !@ L23 l,l L24 l! =1.8 1.25 . l.4 P L6
= il-150mm >
4-6" > 4-av 4*yf. J>>%+,9jy,
/ &+<$s 44 fj6 \
4[h* g %
- ~
~ ~~'
~ g"6 ,;/
j /y , p~ '
, 4 "g'e,
,3/,
\ g- Rb,.pj;g.
4* ' Oy [-
., d_
k .. d
s
/
.eN* v%th@
/
O
!$ h IMAGE EVAL.UATION / I$
g'%\ //o/77 y' g $f* TEST TARGET (MT-3)
# /
<j(f(($g,
. ///// .. %, 4(lg 4
V@+ jp r x %'4 1.0 lt a M if
,_ G u im 1.1 bd
~
hN
~~
I.25 1.4 1.6
==
s 150mm > 4 6" > 4 A w's m h; 4,)/ emw^
" ~ ~ ~ ~ ~ ~ " ' " * -
~~_
4+ lfd,w
,\ V S jtg p
/,*8 x s/,0*\ w Q , Qy .
j/ ' ' 4,% ^4% 0' >,3)Qi
% ( /, r "M 4l}M4 > @sp Oy I .
n a
m: 6 p '4 ,/ /0 (h '$9 IMAGE EVALUATION
\ q)I' TEST TARGET (MT-3) /fY /[k!) (s 4e 'k V>+ t 4
$$$ '[_2 0 !! 2.5 i.0 ,;. -
u 31, ' 12.2
- m b S; ( 23 1.1 e l I.8
! er=a 1.25 L _1.4 1.6
=.
i 150mm
- 4 6"
- 4_ -
>> %cyy, /s\
en@,3 y /,// 4$%+ *,,u a //7,N b$ kh , /
~ ~~~~~~
~ ' ~ ~' m #6)f^, b c
v< g .
/7(,r Lq * '~ ~ y.
,1g g.e.
0/?
/
L t a
<p
, ::.it
'#d;,;$ . ,
' x45
- 5A*A*
i CESSAR: Jab a System Conoonent 4.16 K\ bus 125 VDC non-1E bus 480 V MCC 480 VAC LC Charging Pm ps CHGP1 PXS201 PX0801 CHGP2 PYS201 PYO801 BAMPs BAMP1 PXO801 PXL302 BAMP2 PY0801 PYL302 CVCS Valves: CH-208 PXM305 CH-501 PXM305 CH-504 PYM305 CH-514 PYM305 CH 530 PXM305 CH-534 PXH305 CH-536 PYM305 19.6.3.14.1.4 System Operation For the function of using the Chemical and Volume Control System to deliver borated water to the RCS during emergency conditions when the SIS is not available to provide reactivity control via}}