Text

Rev 0 to Plant Response Tree Notebook Steam Generator Tube Rupture
	ML20059H887
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	03/31/1992
From:	Astleford R, Holderbaum D, Osterrieder R; COMMONWEALTH EDISON CO.
To:	;
Shared Package
ML19303F780	List: ML20059H852; ML20059H873; ML20059H887; ML20059J113; ML20059K919;
References
	NUDOCS 9401310217
	Download: ML20059H887 (129)
	v • d • e

yp, -

':h) ;f t

COMMONWEALTH EDISON COMPANY--

j

' ZION NUCLEAR POWER STATION' UNITS 1 AND 2 i<

i f

PLANT RESPONSE TREE NOTEBOOK STEAM GENERATOR TUBE RUPTURE i

'i MARCH 1G?2

]

REVISION O f

Prepared By Individual Plant Evaluation Partnership (IPEP) l Date:3 - M2- -

Authored By:

D. F./loiderbaum Jj Reviewed By:

M d. 8 Date:.3/ '/

E R. A. Osterrieder Approved By:

TO /M(( 7c!

Date: 5//4/92 R. D. Astleford' 3b) 9N W

b Date:

Approved By:

= Accepted By:

MfC Date:

/

if

'Cd'mmdnwealth E%I6n Company

.f 9401310217 931021 PDR ADOCK 05000295 o

p PDR.,_

I WP1142:1D/030992 T,

J

l COMMONWEALTH EDISON COMPANY ZION NUCLEAR POWER STATIONS UNITS 1 AND 2 i

STEAM GENERATOR TUBE RUPTURE PLANT RESPONSE TREE NOTEBOOK f

TABLE OF CONTENTS

'i Section Eggg 1.0 DEFINITION SGTR-P1 2.0 ACCIDENT PROGRESSION SGTR-P1 3.0 PLANT RESPONSE TREE NODES SGTR-P4 3.1 Description of Nodes

. SGTR-P12 3.2 Success Criteria SGTR-P29 3.3 Operator Actions SGTR-P29 4.0 FUNCTIONAL REQUIREMENTS SGTR-P41 5.0 SEQUENCE IDENTIFIERS SGTR-P42 l

6.0 PLANT RESPONSE TREE MODEL SGTR-PS2 l

7.0 DIFFERENCES IN UNIT 1 AND 2 SGTR-P64 8.0 IPE/ ACCIDENT MANAGEMENT INSIGHTS SGTR-PSR

9.0 REFERENCES

SGTR-P71 APPENDIX A Steam Generator Tube Rupture Plant Respcase Trees

. SGTR-P74 Tre6 SGTR-1 initial Actions SGTR-P75 Tree SGTR-2 RWST Refill SGTR-P78 Tree SGTR-3 Bleed and Feed SGTR-P80 Tree SGTR-4 Core Damage SGTR-P83'

)

Tree SGTR Core Damage /No RWST

.SGTR-P85

-l l

WP1142:1D/030992 i

e

k

-- (

COMMONWEALTH EDISON COMPANY ZION NUCLEAR POWER STATIONS UNITS 1 AND 2 STEAM GENERATOR TUBE RUPTURE PLANT RESPONSE TREE NOTEBOOK TABLE OF CONTENTS (cont.)

Section Eggs APPENDIX B Review of Emergency Procedures for Steam Generator Tube SGTR-P86 Rupture TABLES Table 1 SGTR System Success Criteria SGTR-P33 Table 2 SGTR Operator Action Times SGTR-P37

.k WP1142:1D/030992.-

ii

(

STEAM GENERATOR TUBE RUPTURE PLANT RESPONSE TREE NOTEBOOK 1.0 DEFINITION A steam generator tube rupture (SGTR) event is the rupture of a single steam generator tube. For Zion, the rupture is considered to be a double-ended break of a single tube which results in a break area of 0.003276 sq. ft. This break area' corresponds to the Zion Model 51 steam generator tube inside diameter of 0.775 inches and is assumed to exist at the top of the tube sheet on the cold leg side of the steam generator. Following the SGTR event, automatic reactor trip, safety injection l

and auxiliary feedwater help to maintain primary inventory and a secondary heat sink.

However, appropriate operator actions are required to equalize RCS pressure with the ruptured steam generator pressure and to terminate safety injection in order to ultimately stop the primary to secondary break flow.

2.0 ACCIDENT PROGRESSION At the time of initiation of a SGTR, the reactor is assumed to be in an equilibrium -

condition at power; the heat generated in the core is being removed via the secondary system. The SGTR is initiated by a random or consequential failure of a single tube leading to a double-ended break of that tube. The SGTR results in a breach of the primary coolant boundary between the primary coolant and the secondary coolant within the steam generator. Although the Chemical Volume and Control System (CVCS) attempts to compensate for the inventory loss by increasing the net charging.

flow, the break flow rate of a double ended breakis greater that the charging pump capacity in normal charging mode, so the Reactor Coolant System (RCS) depressurization/ pressurizer level decrease continues. Eventually, reactor trip will occur on either low pressurizer level or overtemperature delta-T.

l WP1142:1D/030992 1

p t

The reactor trip signal will generate a turbine trip and the resulting generator trip will cause main feedwater trip. Safety injection (SI) actuation would occur soon thereafter due to low pressurizer pressure. The Si signal would automatically actuate the Auxiliary Feedwater (AFW) pumps (if they haven't already started on lo-lo SG level),

which take suction from the Condensate Storage Tank (CST), to deliver water to all I

steam generators. Operator action is required to control AFW to maintain water level in the steam generators. The Si signal also starts the Emergency Core Cooling System (ECCS) pumps. The charging and SI pumps take suction from the Refueling Water Storage Tank (RWST) and inject borated water into the RCS. The Residual Heat Removal (RHR) pumps are also started by the S! signal, but cannot inject water since the RCS pressure is above the shutoff head of the RHR pumps. The RHR pumps continue to operate on mini-flow recirculation during the event sequences or the operators may switch these pumps 'off'. Finally, the SI signal switches the Reactor Containment Fan Coolers (RCFCs) to low speed and initiates Phase A containment isolation.

Following reactor trip and initiation of safety injection, the RCS temperature will be controlled to no-load conditions via steam dump from the steam generators to the condenser, or if the condenser is unavailable via steam dump to the atmosphere through the Atmospheric Relief Valves (ARVs). The RCS pressure equilibrates at the point where incoming Si flow approximately equals the outgoing primary to secondary break fl4 w. The operator must perform severalimportant actions to terminate this primary to secondary break flow. These actions are prescribed in the Zion Emergency Operating Procedures (E-3, ' Steam Generator Tube Rupture,' Reference 1.1) and are summarized as follows:

1.

Identify and Isolate the Ruptured SG, 2.

Perform an initial cooldown using the intact SGs, 3.

Depressurize the RCS, 4.

Terminate ECCS Flow.

t WP1142:1D/030992 SGTR-P2 A

The ruptured SG can be identified by the pre-or post-trip SG level response and also by steamline or SG blowdown radiation indications. Isolation of the' ruptured SG requires closure of the Main Steam isolation Valve (MSIV) on the ruptured SG plus any other potential leak paths (i.e., the steam supply line to the turbine driven AFW pump). If the MSIV on the ruptured SG can not be closed, the ruptured SG is isolated from the others by closing the MSIVs on the intact SGs. Additionally, as part of the I

isolation of the ruptured SG, auxiliary feedwater flow to this SG must be terminated to minimize the accumulation of water in this SG.

Following isolation of the ruptured SG, the operator dumps steam from the intact SGs in order to cool the RCS to a temperature of approximately 515'F (the pressure in the ruptured SG is used to determine the exact temperature to be achieved during this initial cooldown). The intent of this initial corAdown is to establish or maintain a-temperature difference between the RCS and the intact SGs for decay heat removal and also to keep the RCS subcooled following the subsequent RCS depressurization.

The condenser will be used for steam dump, if available, assuming that the intact SGs are not isolated. Otherwise, the SG atmospheric relief valves will be used to perform this RCS cooldown.

+

Next, the RCS is depressurized to minimize the primary to secondary break flow and to refill the pressurizer, ideally, the depressurization will be stopped when the RCS pressure is less than the ruptured SG pressure. The depressurization is also stopped due to foss of subcooling or high pressurizer level. If the Reactor Coolant Pumps (RCPs) are in operation, normal pressurizer spray can be used to perform the RCS depressurization. If normal pressurizer spray is unavailable, then either one pressurizer Power Operated Relief Valve (PORV) or auxiliary spray will be used to perform the RCS depressurization.

f 1

WP1142:1D/030992 SGTR-P3

W I

Once the RCS depressurizationis complete, the high pressure ECCS flow is terminated to prevent er limit the RCS repressurization (and reinitiation of the primary to secondary break flow). After all ECCS flow is terminated, the RCS pressure will be approximately the same as the ruptured SG pressure and the primary to secondary leakage will be stopped (or minimal); thus a safe, stable state is achieved. Normal inventory and pressure controls will be established and a post-SGTR procedure will be used to cooldown and depressurize the plant to cold shutdown conditions.

t 3.0 PLANT RESPONSE TREE NODES To construct the SGTR plant response tree, the nodes necessary to fulfill the functions of RCS inventory control, containment heat removal and containment integrity are modeled. The combination of plant systems and operator actions, as laid out in the Zion Emergency Operating Procedures or EOPs (Reference 1), required to prevent core damage and containment failure determine the success sequences or plant response tree success states.

The following subsections present a brief description of each of the nodes, success criteria for the nodes and the operator actions modeled on the plant response tree.

The following assumptions for the modeling of the plant response trees are noted here:

Reactor trip is not modeled in the SGTR plant response tree.

The Anticipated Transient Without Scram (ATWS) plant response tree notebook (Reference 2) provides a discussion of SGTR with failure of reactor trip.

l

)

WP1142:1D/030992 SGTR-P4 1

l

(

The accumulators are not modeled in the plant response tree for the SGTR since there are no sequences in which they are required to prevent core damage.

RCP trip is not explicitly modeled in the SGTR plant response tree. For sequences with AFW available, a SGTR will not result in the criteria for RCP trip; however RCP trip is considered in the operator action to perform RCS depressurization since RCP operation is necessary to use normal pressurizer spray. For sequences with AFW unavailable, RCP trip is considered in the operator action to establish bleed and feed cooling.

For event sequences with the failure of charging pumps and auxiliary feedwater but success of at least one safety injection pump, bleed and feed cooling is initiated by opening both pressurizer PORVs. The reclosure of the pressurizer PORVs following successful restoration of feedwater to the steam generators (via the main feedwater pumps) is not modeled on the SGTR plant response tree. FR-H.1, ' Loss of Heat Sink,' (Reference 1.2) permits termination of bleed and feed cooling if a source of feedwater is restored; this could lead to a success path involving normal RHR cooling. The exclusion of this path from the SGTR plant response tree is not expected to significantly impact the overall results.

For event sequences in which bleed and feed is required by FR-H.1, but cannot be established, the alignment of service water to the steam generators is not modeled, it is assumed that this action will not significantly improve the probability of success for SGTR sequences.

T Operator actions to cooldown and depressurize the RCS using the steam generators, per FR-C.2, ' Response to Degraded Core Cooling,' (Reference WP1142:1D/030992 SGTR-P5 t

j 1.3) and FR-C.1, ' Response to inadequate Core Cooling,' (Reference 1.4) are not modeled. For a SGTR event, the indication to begin a RCS' cooldown with the steam generators is very early in the EOPs. Since there is a long time to accomplish tnese actions prior to the time at which degraded or inadequate core cooling indications are received, the probability of accomplishing this action is sufficiently high that.

consideration of RCS cooldown via FR-C.2 or FR-C.1 can be ignored.

Containment spray via the RHR pumps during recirculation as instructed by ES-1.3, ' Transfer to Cold Leg Recirculation,' (Reference 1.5) or FR-Z.1,

' Response to High Containment Pressure,' (Referenco 1.6) is not included on the plant response tree. This mode of operation is not required for containment heat removal during the initial'24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the accident.

For event sequences which lead to core damage, operator actions per FR-C.1 to open the pressurizer PORVs in order to achieve a low RCS pressure at the time of reactor vessel failure is not modeled in the SGTR plant response tree. Based on the results presented in Reference 18, the accident progression and consequences are not affected by the RCS pressure at vessel failure.

For event sequences in which RCS cooldown via any intact SG cannot be performed, it is assumed that RCS cooldown via the ruptured SG will also fail. Although the EOPs direct the operators to use the ruptured SG for-the scenario in which the intact SGs are unavailable for RCS cooldown, 4

the loss of steam dumping capability from all three intact SGs (either to condenser or atmosphere) is assumed to be a result of a common cause failure such that the ruptured SG would also be unavailable for RCS cooldown.

WP1142:1D/030992 SGTR-P6

p Steam generator overfill is assumed to exist when the secondary side of the ruptured SG is filled with water up to and including the vertical run of steam pipe above the steam generator. This encompasses a volume of 5780 ft3 (43,235 gallons).

For all event sequences which lead to steam generator overfill, it is assumed that water relief through the relief or safety valves results in the consequential failure of a valve to ressat. Since the precise behavior of the atmospheric relief valves and safety valves after water relief is not -

known, this simplifying assumption can be made.

It is noted that water relief through the ARVs or safety valves for a few cycles is not expected to cause valve failures; however the SG overfill sequences of greatest interest in the SGTR PRT involve continuous cycling of the relief valves for an extended period of time. This would result in continuous RCS inventory loss analogous to that of a stuck open relief valve. Accordingly, it can be assumed that SG overfill results in the failure of a relief valve to reseat.

The specific assumption for SG overfill sequences is that since the failure of an atmospheric relief valve can be mitigated by closure of the block valve, the consequential failure due to SG overfill is assumed to be a failure of one safety valve to reseat. As a result, the continued release from the ruptured steam generator results in a continual primary to secondary pressure differential such that the primary to secondary break flow continues. Continued ECCS injection depletes the RWST; since' ECCS recirculation is not possible, the ECCS flow must be reduced or-RWST refill must be accomplished. For further discussion of SG overfill, see also References 3 and 19.

WP1142:1D/030999 SGTR-P7 i

(~

As a result of the consequential failure of the safety valve to reseat, all SG overfill cases which lead to core damage are considered containment _

bypass sequences.

The response to a SGTR may result in a return to criticality for two specific scenarios:

1.

One of the initial operator actions during the response to a SGTR event is a* RCS cooldown via steam relief from the intact SGs at maximum rate (per Step 14 of E-3).

This RCS cooldown is continued at maximum rate until a ' target temperature'. is attained; this ' target temperature'is based on the pressure in the ruptured SG.

The intent of this RCS cooldown is to. establish a

pressure / temperature differential between the ruptured and intact SGs.

A return to criticality could occur during this relatively fast RCS cooldown (recall:

maximum steam relief) under certain circumstances. Specifically, the RCS cooldown must be on the order of > 150 F, and the initial. core conditions must correspond to minimum shutdown margin plus the most negative Moderator Temperature Coefficient (MTC). These conditions may occur if the ruptured SG continues to depressurize due to an unisolated steam path resulting in a reduced ' target temperature' and if the SGTR event occurs at end-of-life core conditions. Assuming that these conditions exist,.it may be postulated that the positive reactivity-Insertion ~ due to the RCS cooldown (i.e., negative MTC) in conjunction with the lack of negative reactivity insertion (recall that-WP1142:1D/030992 -

SGTR-P8

4 Zion no longer utilizes highly borated water in the Boron injection Tank (BIT))may result in return to criticality.

2.

A return to criticality has been postulated in Reference _14 for the scenario in which ' backfill' from the ruptured SG to the RCS is being utilized for RCS depressurization (per ES-3.1, ' Post-SGTR Cooldown Using Backfill,' Reference 1.7 or ES-3.3,' ' Post-SGTR Cooldown -

Using Steam Dump,' Reference 1.8).

In this situation, the RCS -

pressure is less than ' the ruptured 'SG pressure and relatively unborated secondary water is flowing back into the RCS. If a slug of this unborated water should be introduced to a region of the core (i.e., such as during RCP restart in the loop with the ruptured SG),

then return to criticality could occur.

Prerequisites to such a scenario include RCP trip for an extended time such that flow.

stagnation occurs in the ruptured loop and an accumulation of unborated water in the RCS piping of this loop.

It is noted that in either case, any return to criticality would be at low power, that which would be ' supported' by.the AFW flow and secondary.

steam relief.

To address these potential scenarios of return to criticality, the following _

assumptions are made. For Case 1 above,it is noted that the probability of the conditions needed to return to criticality are sufficiently small as to' preclude consideration of return to criticality. However,in the event that such circumstances occur, the consequences have been determined in an analysis which addresses return to criticality for steamline breaks 1

(Reference 13). This analysis uses conservative assumptions to address return to criticality following a steamline break including the assumption j

i i

WP1142:10/030992 SGTR-P9 I

4

(

of the most reactive control rod fully withdrawn (clearly a non-conservative assumption for a realistic PRA). The results of the analysis conclude that no fuel failures would occur. Since the results of this analysis would encompass the SGTR scenario described for Case 1 above, it is corcluded that return to criticality for a SGTR event will not-result in any fu.I failures. Therefore, return to criticality is not addressed in the SGTR pn it response trees.

For Case.2, the Westinghouse Owners Group Operations Subcommittee reviewed the Reference 14 report and concurred that although' the scenario has a low probability of occurrence, the issue of a return to criticality due to boron dilution during a SGTR event should be addressed.

Therefore, all affected plants (including Zion) were notified of this concern and although the relevant procedures direct the operator to verify and maintain adequate shutdown margin during ' backfill', the Emergency 1

Response Guidelines were modified to include a caution to restart the RCP(s) in the non-ruptured loop (s) first in order to provide boron mixing in the ruptured loop (Reference 15). On this basis, return to criticality via the scenario in Case 2 is not considered in the SGTR plant response trees.

b For those SGTR scenarios in which pressurizer pressure control is lost, RCS depressurization to cold shutdown via either backfill, blowdown or steam dump from the ruptured SG as instructed in ECA-3.3,' 'SGTR Without Pressurizer Pressure Control,' (Reference 1.9), Step 31 is not considered. The scenario of a loss of all pressurizer pressure control (normal spray, PORVs and auxiliary spray per E-3 and ECCS termination-per ECA-3.3) is assumed to be sufficiently small that the plant response tree need not include these paths.

i WP1142:1D/030992 SGTR-P10

-)

i For those SGTR scenarios in which the operator action to reduce ECCS e

1.

injection via E-3 or ECA-3.3 cannot be accomplished prior to SG overfill, L

it is assumed that subsequent steps in ECA-3.1, 'SGTR with Loss of Reactor Coolant-Subcooled Recovery,' (Reference 1.10) or ECA-3.2,

'SGTR with Loss of Reactor Coolant-Saturated Recovery,' (Reference 1.11) to establish RCS inventory control also fail.

For SGTR sequences in which the RHR pumps are required for ECC recirculation (i.e., loss of heat sink),it is assumed that component cooling water (CCW) flow to the RHR heat exchanger (OHX/RHX) for the purpose of pump cooling during miniflow recirculation is not needed.

Per Reference 8, the longest time the RHR pumps can operata with no miniflow recirculation is 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months .

Since the switchover to ECC recirculation will take place prior to this time for most SGTR sequences in which the RHR pumps are required (Reference 16), establishing CCW to the RHh baat exchangers is not modeled.

For SGTR sequences which result in SG overfill due to the failure to isolate the ruptured SG (failure of OAl/MSI or OAF /AFI), a SAM end state may be achieved upon success of RCS cooldown (ODS/DS) and ECCS reduction (OIR). It is assumed that the success criteria for ODS, DS and OIR will not be redefined for the SG overfill sequences and will thus utilize the criteria developed for the SGTR sequences in which ruptured SG isolation succeeds (Reference 16).

.l Consideration of RCS depressurization for SGTR sequences only includes RCS depressurization via the pressurizer PORVs (Reference 7).

.i WP1142:1D/030992 SGTR-P11

t 3.1 Description of Nodes A brief description of each of the nodes of the SGTR plant response tree is given in -

the following paragraphs. The plant response tree model and a discussion of the nodal dependencies are given in Section 6.0.

A.

Initiator SGTR1 This node is the SGTR initiator and represents a double-ended break of one (1) steam generator tube.

B.

Auxiliary Feedwater (AFW)

This node is auxiliary feedwater delivery to the steam generators with either the motor driven or turbine driven auxiliary feedwater pumps. The auxiliary feedwater system provides water to the steam generators to maintain steam generatorlevelin order to ensure that heat removal via the steam generators is effective. Auxiliary feedwater is also required to: 1) cooldown and depressurize the RCS and 2) prevent the EOPs from requiring the operators to initiate RCS bleed and feed cooling. The auto-opening of a safety valve is also included in this node. A detailed 1

description of AFW is provided in the Auxiliary Feedwater System Notebook'(Reference 4).

C.

Refueling Water Storage Tank (TK)

This node is the RWST. The RWST provides the source of borated water i

necessary fur safety injection (and containment spray, if necessary) 1 following a SGTR event. It is shown as a separate node because it is -

WP1142:1D/030992 SGTR-P12

shared by several systems. Separate suction lines from the RWST supply g

water to the following sets of pumps: two centrifugal charging pumps, two safety injection pumps, two RHR pump 3 and three containment spray pumps. If the RWST fails, all ECCS injection fails and containment spray injection fails.

D.

Centrifugal Charging Pumps (CCP)

This node is high pressure safety injection via the centrifugal charging pumps.

The Si signal would immediately start the two centrifugal charging pumps and align them to take suction from the RWST and deliver water to the RCS via the ECCS cold leg injection pipes. ~ The charging pumps can also be used to inject subcooled, borated water to the RCS during ECCS high-pressure recirculation. During recirculation, the charging s

pumps take suction from the discharge of the RHR pumps. The charging pumps can also be used to continue injection of water from the RWST if the RWST is refilled. In terms of subsequent nodes, for event sequences in which auxiliary feedwater has failed and at least one charging pump is operational, restoration of an alternate feedwater source to'the steam generators takes precedence over initiation of bleed and feed cooling.

Finally, at least one charging pump is required to be operationalin order to implement the-shutdown cooling mode of the RHR system for continued cooldown to cold shutdown conditions. A detailed description of CCP is provided in the ECCS notebook'(Reference 5).-

E.

Safety injection Pumps (SIP)

This node is high pressure safety injection via the safety injection pumps.

The Si signal would immediately start the two safety injection pumps WP1142:1D/030992 SGTR-P13

.(

which would deliver water to the RCS via the ECCS cold leg injection pipes. The safety injection pumps can also be used to inject subcooled, borated water to the RCS during ECCS high-pressure recirculation. During recirculation, the safety injection pumps take. suction from the discharge of the RHR pumps. The safety injection pumps can also be used to continue injection of water from the RWST if the RWST is refilled. The safety injection pumps are not required for ECCS injection if the charging pumps are successful.

In terms of subsequent nodes, for. event sequences which include the failure of auxiliary feedwater and the charging pumps, at least one safety injection pump must be operational to initiate bleed and feed cooling. A detailed description of SIP is provided in the ECCS notebook (Reference 5).

F.

Operator Action to Establish Alternate Feedwater (ORF)

This node is the operator action to establish an alternate source of feedwater to the steam generators in the event that auxiliary feedwater is not available. This node represents the operator action to establish alternate feedwater per Step 9 of FR-H.1.

Sources of alternate feedwater from Step 9 include the main feedwater pumps and the condensate booster pumps. However, as a simplifying assumption, this node only considers the operator action to establish alternate feedwater with the main feedwater pumps. The rapid SG depressurization needed for condensate booster pump injection is not modeled here.- Note that operation of the condensate booster pumps is necessary for successfulinjection with the main feedwater pumps. The alignment for injection with the main feedwater pumps to the steam generator (s) includes opening the feedwater isolation Motor Operated WP1142:1D/030992 SGTR-P14

.(

Valves (MOVs), the feedwater regulating bypass valve manual isolation valves and throttling the feedwater regulating bypass valves.

l The detailed evaluation of the operator action ORF is given in the Human Reliability Analysis Notebook (Reference 6).

G.

Alternate Feedwater (ALT)

This node is alternate feedwater delivery to the steam generators with the main feedwater pumps. If auxiliary feedwateris not available, an alternate feedwater source is required to cooldown and depressurize the RCS. For the SGTR scenario, the main feedwater pump (s) can provide sufficient water to the steam generators in order to ensure steam generator heat removal capability.

For injection with the main feedwater pump (s), this node represents the successful start and continued operation of the main feedwater pump (s) along with the operation of the associated valves required to realign the main feedwater pump (s) for injection to the steam generator (s). The main feedwater pump will be fed by the condensate booster pump (s); therefore successful injection with the main feedwater pump (s) also includes the successful start and continued operation of the condensate booster pumps along with the operation of the associated valves required-for the condensate booster pumps to feed the main feedwater pump (s).

However, no steam generator depressurization is necessary for injection with the main feedwater pump (s).

A detailed description of ALT is provided in the Miscellaneous Systems Notebook (Reference 7).

WP1142:1D/030992 -

SGTR-P15 a

4

J H.

Operator Action to initiate RCS Bleed (OBL)

This node is the operator action to initiate ' bleed and feed' via the opening of at least one pressurizer PORV. The actions considered at this node are dependent upon the event sequence path,'as follows:

a) for al! event sequences in which at least one charging pump is I

available but no feedwater injection to the steam' generators is available (auxiliary feedwater or alternate supplies), this node models the operator actions to initiate bleed and feed cooling, per FR-H.1, Step 16 when the steam generatorlevel reaches 24% of wide range -

indication and, b) for all event sequences in which at least one Si pump is available but no charging pump and no auxiliary feedwater injection to the steam generators is available, this' node models the operator actions to immediately initiate bleed and feed cooling per FR-H.1, Steps 4 and 16.

Note that for scenario (a) above, the operators may initially transfer out I

of FR-H.1, but based on logic presented in Section B (and Appendix B),

the operators will return to FR-H.1 to initiate bleed and feed cooling due to loss of level in all SGs and lack of AFW flow.

j i

The detailed evaluation of the operator actions OBL is given in the Human

-I Reliability Analysis Notebook (Reference 6).

1 i

WP1142:1D/030992 SGTR-P16

(

l.

RCS Bleed via Pressurizer PORV(s) (BL)

This node is the action of at least one pressurizer PORV to open and remain open upon demand. As part of this equipment, the associated block valve must also open (if not already) and remain open. A detailed description of BL is provided in the Miscellaneous Systems Notebook (Reference 7).

J.

Operator Action to isolate Steam Flow from the Ruptured Steam Generator (OAI)

This node represents the operator action to diagnose a SGTR event, identify the steam generator with the ruptured tube, and to take the necessary steps to isolate this steam generator from the 3 intact steam generators. Indications of a SGTR event include pre-or post-trip SG level response as well as steamline and blowdown radiation indications.

Isolation of the ruptured steam generator provides a pressure / temperature differential between this ruptured steam generator and the intact steam generators; such a differential is important in the subsequent actions during a SGTR event. Isolation requires closure of the ruptured SG MSIV and other potential leak paths (i.e., the steam supply line to the turbine driven AFW pump). If the MSIV for the ruptured SG can not be closed, the ruptured SG is isolated from the others by closure of the MSIVs on the intact SGs. Operator guidance for steam generator isolation is given in Zion EOP E-3, Step 4.

The detailed evaluation of operator action OAl is given in the Human.

Reliability Analysis Notebook (Reference 6).

WP1142:1D/030992 SGTR-P17

(

K.

Isolation of Steam Flow from Ruptured SG (MSI)

This node includes the equipment to isolate steam flow from the ruptured SG. Specifically, this includes the MSIV on the ruptured steam generator.

Isolation of the ruptured steam generator also includes isolation of other steam flow paths such as the turbino driven AFW pump steam supply line, etc.

Success of this node may also be achieved by closing the MSIVs on the intact steam generators. This action effectively isolates the ruptured SG from the intact SGs since the steam dumps should stay closed. A detailed description of MSI is given in the Miscellaneous Systems Notebook (Reference 7).

L.

Operator Action to isolate Feedwater Flow to the Ruptured SG (OAF)

This node represents the operator action to terminate all feedwater flow to the ruptured steam generator. This action is necessary to prolong the time available to stop the primary to secondary break flow through the ruptured tube before steam generator overfill occurs. Operator guidance for feedwater isolation is given in Zion EOP E-3, Step 6.

The detailed evaluation of operator action OAF is given in the Human Reliability Analysis Notebook (Reference 6).

I WP1142:1D/030992 SGTR-P18

i M.

Isolation of Feedwater Flow to Ruptured SG (AFI)

This node includes the equipment to isolate feedwater flow to the ruptured SG.

Specifically, this equipment includes the AFW flew regulating valves on the motor driven AFW pump line (FWOO51, FWOO53, FWOO55, FWOO57) and on the turbine driven AFW pump line (FWOO50, FWOOS2, FWOO54, FWOOS6). For feedwater to the SGs via the main feedwater pumps, the equipment includes the main feedwater flow regulating valve on each line (LCV-FW510, LCV-FW520, LCV-FW530, LCV-FW540) as well as the main feedwater bypass line flow regulating.

valve on each line (LCV-FW510A, LCV-FW520A, LCV-FW530A, LCV-FW540A).

An evaluation of node AFI is given in the Auxiliary Feedwater Systems Notebook (Reference 4) for auxiliary feedwater.

control and the Miscellaneous Systems Notebook (Reference 7) for alternate feedwater control.

N.

Operator Action to Perform RCS Cooldown via Steam Dump from Intact Steam Generators (ODS)

This node represents the operator action to initiate RCS cooldown via steam dump from the intact steam generators in order to attain a desirable level of subcooling in the RCS. The operator instructions for this action comes from Zion EOP E-3, Step 14: the operators are instructed to dump steam from the intact SGs via the condenser or atmospheric relief valves at maximum rate in order to attain a desirable level of subcooling in the RCS prior to the subsequent RCS depressurization step.

Operator instruction for RCS cooldown is also provided in Zion EOP ECA-3.1,~ Step 8 for the cases in which isolation of steam flow from the ruptured SG fails and RCS cooldown is needed to achieve subcooling for the subsequent WP1142:1D/030992 SGTR-P19

't ECCS reduction step. The detailed evaluation of operator action ODS is given in the Human Reliability Analysis Notebook (Reference 6).

O.

Steam Dump from Intact SGs to Condenser or Atmosphere (DS)

This node is the action of the condenser steam dump valves or the atmospheric relief valves on the intact steam generators to function upon -

demand. The opening of either the condenser steam dump valves or the atmospheric relief valves permits depressurization of the steam generators and removes heat from the reactor coolant system. Success of AFW or alternate feedwater is necessary to permit SG depressurization (this equipment is covered by separate nodes). A detailed description of DS is provided in the Miscellaneous Systems Notebook (Reference 7).

P.

Operator Action to Depressurize the RCS (ODP)

This node represents the operator action to depressurize the RCS via normal pressurizer spray (if the RCPs have not been tripped), one PORV or auxiliary spray.

The purpose of this RCS depressurization is to equilibrate the primary and secondary pressures in order to terminate the i

primary to secondary break flow, and to recover levelin the pressurizer for easier inventory control. Operator guidance for the RCS depressurization is given in Zion EOP E-3, Step 14f (if concurrent RCS cooldown and depressurization) or Step 18 (if separate RCS cooldown and depressurization).

4 The detailed evaluation of operator action ODP is given in the Human Reliability Analysis Notebook (Reference 6).

WP1'142:1D/030992 SGTR-P20

i 1-Q.

RCS Depressurization with Pressurizer PORV (DP)

This node is the operation of one pressurizer PORV for RCS depressurization. As noted in Section 3.0, this RCS depressurization step i

does not consider normal pressurizer spray or auxiliary spray.

An evaluation of node DP, as defined above, is provided in ' the Miscellaneous Systems Notebook (Reference 7).

R.

Operator Action to Reduce ECCS Injection (OIR) t This node represents the operator action to reduce the ECCS injection to no greater than one (1) high pressure injection pump (either 1 charging pump or 1 SI pump). For sequences in which the recovery actions of identification, isolation and RCS cooldown have been successful, the ECCS flow must be reduced as a necessary precursor to establishing -

normal charging. Normal charging (discussed later) is necessary for RCS inventory control and subsequent termination of the primary to secondary.

break flow (i.e., success end state). For sequences in which the charging -

{

pumps are not available or in which SG overfill occurs prior to ECCS reduction, the ECCS flow must be reduced to extend the time that the RWST will be available (i.e., SAM end state). [ Recall that SG overfill is assumed to result in the consequential failure of a secondary safety valve to reclose, thereby necessitating continued ECCS injection.)- Operator guidance to perforrn this ECCS reduction is provided in different procedures depending upon the specific path considered:

a)

Zion EOP E-3, Steps 22 and 26 - ECCS flow is reduced to 1 charging pump following RCS cooldown and depressurization as a procursor WP1142:1D/030992 SGTR-P21

3.

(

to establishing RCS inventory control. Also, for cases in which charging pumps are not available or in which SG overfill has occurred, the ECCS pumps (typically 1 charging pump or 1 SI pump, as applicable) are restarted as necessary to maintain adequate RCS l

subcooling and pressurizer level.

b)

Zion EOP ECA-3.3, Steps 11 and 14 - For the sequence in which there is no pressurizer pressure control (i.e., failure of ODP/DP),

ECCS flow is reduced to 1 charging pump following RCS cooldown as a precursorto establishing RCS inventory control. Also, for cases in which charging pumps are not available or in which SG overfill has I

occurred, the ECCS pumps (typically 1 charging pump or 1 Si pump, as applicable) are restarted as necessary to maintain adequate RCS subcooling.

c)

Zion EOP ECA-3.1, Steps 16, 20 and 21 - For the sequence in which steam flow from the ruptured SG cannot be isolated (i.e.,

failure of OAl/MSI), ~ ECCS flow is reduced.to 1 charging pump following RCS cooldown and depressurization as a precursor to' establishing RCS inventory control.

Also, for cases in which.

charging pumps are not available or in which SG overfill has occurred, the ECCS pumps (typically 1 charging pump or 1 SI pump, as applicable) are restarted as necessary to maintain adequate.

subcooling and pressurizer level.

T d)

Zion EOP ECA-3.2, Steps 11,15 and 16 - For the sequence in which steam flow from the ruptured SG cannot be isolated (i.e., failure of OAl/MSI) in conjunction with high SG wide-rttnge level or low RWST level, ECCS flow is reduced to 1 charging pump following RCS WP1142:1D/030992 SGTR-P22

h cooldown and depressurization as a precursor to establishing RCS inventory control. Also, for cases in which charging pumps are not 4

available or in which SG overfill has occurred, the ECCS pumps (typically 1 charging pump or 1 Si pump, as applicable) are restarted as necessary to maintain adequate subcooling and pressuriter level.

The detailed evaluation of operator action OIR is provided in the Human Reliability Analysis Notebook (Reference 6).

S.

Operator Action to Establish Normal Charging (ONC)

This node represents the operator action to initiate normal charging with the remaining charging pump. This action is undertaken following the successful operator action to reduce ECC injection to 1 charging pump.

The operator must realign the charging p. umps to their normal flow control -

alignment in order to permit RCS inventory control via throttling of flow; flow throttling capability is not possible with the charging pump aligned in the injection mode. The action to establish normal charging flow is -

necessary because continued ECC injection will result in _ the repressurization of the RCS and reinitiation of the primary.to secondary break flow.

Note that letdown is not modeled in this node since the operator can control RCS inventory (pressurizer level) with only the normal charging throttling capability. Operator guidance for establishing normal charging is provided in several different procedures depending upon the specific path considered:

WP1142:1D/030992 SGTR-P23

(.

a)

Zion EOP E-3, Step 24 - Normal charging flow is established as a necessary precursor to establishing RCS inventory control and eventually terminating the primary to secondary break flow.

b)

Zion EOP ECA-3.3, Step 13 - For the sequence in which there is no pressurizer pressure control (i.e., failure of ODP/DP), normal charging flow is established as a necessary precursor to establishing RCS inventory control and eventually terminating the primary to secondary break flow.

The detailed evaluation of operator action ONC is provided in the Human Reliability Analysis Notebook (Reference 6).

T.

Establish Normal Charging (NC)

This node represents the equipment necessary to realign normal charging flow. Refer to Zion EOP E-3 for normal charging components.

An evaluation of node NC is given in the ECCS Notebook (Reference 5).

U.

Reactor Containment Fan Coolers (FC)

This node is the RCFCs which provide cooling for the containment' atmosphere and can prevent automatic spray actuation for the scenario in which the pressurizer PORVs are opened for bleed and feed cooling.

This node is included in the plant response tree since it can impact the time at which ECCS recirculation is required (i.e., whether operation of the RCFCs can prevent automatic containment spray injection). Also, the WP1142:1D/030992 SGTR-P24

a, i

k number of operating Fan Coolers will impact the containment pressure-response for core damage sequences.

The Reactor Containment Fan Coolers Notebook provides a detailed description of this system (Reference 9).

l V.

Containment Spray injection (CSI)

This node is Containment Spray during the ECC injection mode. CSI,'

when delivering water from the RWST, rapidly reduces the pressure in the containment atmosphere.

CSI also scrubs the atmosphere of radionuclides, reducing the severity of the release if CSI is operating after core damage occurs. CSI will not prevent core damage or containment failure. Operation of the containment spray system after core damage can also provide for draining the RWST water inventory to the containment.

A detailed description of this system is provided in the Containment Spray Notebook (Reference 10).

W.

Operator Action to Establish RHR Heat Exchanger Cooling (OHX)

This node represents the operator action to establish cooling to the RHR heat exchangers by opening the Component Cooling Water (CCW) valves from the RHR heat exchangers. This node is addressed for those plant response tree paths where the RHR heat exchangers are needed for heat removal during ECCS recirculation (bleed and feed). Operator guidance for establishing CCW to the RHR heat exchangers is provided in'several procedures:

WP1142:1D/030992 SGTR-P25

(

a)

Zion EOP E-0, ' Reactor Trip or Safety injections,' (Reference 1.12)

Step 8 - The operators are instructed to provide CCW to the RHR heat exchangersif the RCS pressureis above the shutoff head of the RHR pumps, b)

Zion EOP ES-1.3, Step 4 - The operators are instructed to verify that CCW flow is directed to the RHR heat exchangers, c)

Zion EOP FR-H.1, Step 19 - The operators are instructed to provide CCW to the RHR heat exchangers after bleed and feed has been initiated.

The detailed evaluation of operator action OHX is given in the Human Reliability Analysis Notebook (Reference 6).

X.

RHR Heat Exchanger (RHX)

This node is the equipment for RHR heat exchanger cooling and includes the CCW isolation valves to the RHR heat exchanger.

A detailed description of RHX is given in the ECCS notebook (Reference 5).

Y.

Operation Action to Establish ECC Recirculation (ORC)

This node is the operator action to establish high-pressure recirculation.

This node is addrcssed for the FR-H.1 bleed and feed scenario since the operators will eventually be instructed to transfer to ES-1.3 due to low RWST level. This action includes aligning the ECCS system for low _

pressure recirculation and starting and stopping the RHR pumps, as directed by ES-1.3. Since high pressure recirculation is required for this WP1142:1D/030992 SGTR-P26

sk

~

i k

event, this node also includes the operator actions to isolate the high pressure pump suction (charging pumps and/or Si pumps) from the RWST 9

and align the RHR pump discharge to the high pressure pump suction.

The detailed evaluation of the operator action ORC is given in the Human Reliability Analysis Notebook (Reference 6).

Z.

High Pressure Recirculation (HPR)

This node is the equipment for high pressure recirculation with either the charging pumps or the safety injection pumps, aligned to take suction from the RHR pumps. This node intludes the components requ red to operate in the high pressure recirculation mode associated with the operator action ORC, including sump valves open, RWST suction valves to RHR pumps and high head pumps closed,' RHR pumps restarted, and valves opening and closing to align the high pressure pumps to the RHR f

pumps. Note that operation of the low pressure injection (RHR) pumps is also necessary for success of HPR since it is the RHR pumps which take suction from the sump. HPR is required to maintain the plant in a long term stable condition during bleed and feed cooling.

A detailed description of HPR is given in the ECCS notebook (Reference 5).

AA. Operator Action to Refill the RWST (ORT)

This node represents the operator action to refill the RWST. If high.

pressure recirculation fails during bleed and feed cooling, the operators are instructed to transfer to ECA-1.1, ' Loss of Emergency Coolant 3

WP1142:1D/030992 SGTR-P27

3,-

l d

i i

Li k

Recirculation,' (Reference 1.13) where RWST refill would be initiated.

i RWST refill will also be addressed for those event sequences'in which the operators are instructed to begin bleed and feed, but the pressurizer j

PORVs will not open. In this case, low RWST level will result in operator transition to RWST refill since there would be no water in containment for recirculation. Finally, RWST refill is addressed for those paths in 'which SG overfill occurs and RWST refill is necessary to maintain RCS inventory.

The detailed evaluation of the operator action ORT is given in the Human Reliability Analysis Notebook (Reference 6).

BB. Refilling the RWST (RTK)

This node includes the components required to retil: the RWST and-continue ECCS injection associated with the operator ac tion ORT. If.the l

flow to refill the RWST is sufficient to match the injectio n flow from one -

of the ECCS pumps, then the reactor core would' remain covered and core damage would be averted for a prolonged time.

l A detailed description of the components required for node RTK is given -

in the ECCS notebook (Reference 5).

[

t CC. Containment isolation (Cl)

This node is containment isolation. Clis not required for success of either core or containment cooling. Failure of Cl,~given core damage, will result" in a release of fission products to the environment.

~

l WP1142.1D/030992 SGTR-P28 '

5 I

A detailed description of node Cl is given in the Containment isolation 4

l notebook (Reference 11).

3.2 Success Criteria The Success Criteria Notebook (Reference 16) details the best estimate analyses and bases used to determine the combination of frontline systems necessary to define the success sequences on the plant response tree and the mission times required for each of the systems. A summary of the success criteria as detailed in the Success Criteria Notebook is provided in Table 1.

3.3 Operation A::tions The Zion Emergency Operating Procedures (Reference 1) provide the bases used to -

determine the operator actions that are included on the plant response tree model.

The reactor trip and SI signal cause the operators to enter the EOPs at E-0, " Reactor Trip or Safety injection". The operators would continue in E-0 and diagnose the event as a SGTR. Step 15 of E-0 would instruct the operators to transfer to E-3, " Steam Generator Tube Rupture". Upon exiting from E-0, the operators would then begin to -

monitor the Critical Safety Function Status Trees (CSFSTs). These status trees indicate degraded plant conditions that would require the operators to transfer to specific emergency procedures to implement further actions.

Six other EOPs are of interest for the SGTR event:

a.

ECA-3.1, SGTR with Loss of Reactor Coolant - Subcooled Recovery; b.

ECA-3.2, SGTR with Loss of Reactor Coolant - Saturated Re,covery; c.

ECA-3.3, SGTR without Pressurizer Pressure Control; i

d.

FR-H.1, Response to Loss of Secondary Heat Sink; WP1142:1D/030992 SGTR-P29 y

)

m P

i e.

ES-1.3, Transfer to Cold Leg Recirculation; f.

ECA-1,1, Loss of Emergency Coolant Recirculation.

F The ECA-3.1 procedure is implemented for a number of circumstances from E-3 including if a ruptured SG can not be isolated from the intact SGs, if the intact SGs can not be used for RCS cooldown,if a pressurizer PORV can not be closed, and loss of RCS subcooling. The ECA-3.2 procedure is typically implemented from ECA-3.1 due to low RWST level or high levelin the ruptured SG. The ECA-3.3 procedure is-implemented if pressurizer pressure control can not be established in E-3.

If no l

auxiliary feedwater is available, then FR-H.1 is implemented; ES-1.3 would be implemented from FR-H.1 on low RWST level. Finally, the ECA-1.1 procedure would be implemented upon entry into ECA-3.2 or if ECCS recirculation can not be established in ES-1.3.

To a lesser extent, Zion EOPs FR-C.1 and FR-Z.1 were reviewed for the scenarios which lead to core damage and containment failure, respectively.

Based on a review of these EOPs (detailed in Appendix B), the following operator actions are identified and included on the plant response tree:

The operators diagnose, identify and isolate the ruptured steam generator by stopping steam flow from, and feedwater flow to, this generator (OAl

& OAF /E-3).

The operators initiate an RCS cooldown by dumping steam from the intact i

steam generators in order to achieve a desirable level of subcooling in the RCS (ODS/E-3 or ECA-3.1).

i WP1142:1D/030992 SGTR-P30

e i

The operators initiate an RCS depressurization via normal pressurizer j-spray, one pressurizer PORV or auxiliary pressurizer spray in order to stop or reduce the primary to secondary break flow and to recover pressurizer level (ODP/E-3).

The operators reduce ECCS injection to no greater than one high pressure injection pump (either 1 charging pump or 1 Si pump) as either a precursor to establishing normal charging flow or to extend the ECCS injection time (OIR/E-3, ECA-3.3, ECA-3.1 or ECA-3.2).

The operators establish normal charging flow with the remaining charging pump for RCS inventory control; this wil! nrevent repressurization of the RCS and reinitiation of the primary to secondary break flow (ONC/E 3 or ECA-3.3).

For the scenario in which AFW is not available, the operators attempt to initiate alternate feedwater via the main feedwater pumps (ORF/FR-H.1).

For the scenario in which AFW is not available, the operators initiate bleed and feed cooling by opening at least one pressurizer PORV (OBL/FR-H.1).

Note that although FR-H.1 instructs the operators to open both pressurizer PORVs, MAAP analyses (Reference 16) indicate that 1 out of 2 pressurizer PORVs will be sufficient for bleed and feed.

-)

The operators align component cooling water to the RHR heat exchangers for decay heat removal during ECCS recirculation (OHX/E-0, FR-H.1 or ES-1.3).

l WP1142:1D/030992 SGTR-P31

4, If cold leg recirculation is required, the operators align the ECCS systems

+

for recirculation to provide long term RCS inventor. control and decay heat removal (ORC /ES-1.3).

If needed, the operators refill the RWST to provide a continued source of water for ECCS injection (ORT /ECA-1.1).

The times available to accomplish each of these operator actions are documented in the Success Criteria notebook. These times are listed in Table 2.

i l

I WP1142:1D/030992 SGTR-P32

.A

,~.

j TABLE 1 (Page 1 of 4)

STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA PLANT RESP. TREE N00AL SUCCESS OPERATOR MISSION N00E DEPENDENCIES CRITERIA ACTIONS TIME Auxiliary Feed-None 1 out of 3 psps injecting verification 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months water Injection to 4 out of 4 SGs -OR-(AFW) 1 out of 3 pmps injecting to 3 out of 4 SGs with ope,rator action 13 open throttle valves

' Refueling Water None 1 224,890 gattons; Verification 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Storage Tank 1 1700 ppe boron (TK)

Charging Pupp ATW-Falled 1 out of 2 pupps injecting Verification 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Injection TK-Success to 2 out of 4 cold legs (CCP) 4 St Pug AFU-Failed 1 out of 2 pwps injecting Verification 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months injection TK-Success to 2 out of 4 cold legs (SIP)

CCP-Falled Note 1: Operator Action to open throttle valves modeled in AFW fault tree (Reference 4).

WP1142:1D/030992 SGTR-P33

-- s

[M. -

9 TABLE 1 (page 2 of 4)

STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA PLANT RESP. TREE-NODAL SUCCESS OPERATOR MISSION NODE DEPENDENCIES

'CRtTERIA ACTIONS.

TIME Alternate Feed-AFW-Falled 1 out of 5 MFW pimps Align MFW d C8 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months water injection ORF-Success' injecting to 1 out of 4 SGs-

. pumps (ORF);

'<;5 (ALT).

Stop RCPs RCS Bleed with AFW-Falled 1 out of 2 Pressurtter PORVs Depressurite RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Pressurizer PORVs ORF/ ALT-Felled for bleed & Feed CCP or SIP-Success:

(08L)

(BL).

08L-Success Isolation of Steam OAl-Success

. 1 out of 1 CsVs on Close MSIV(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Flow from Ruptured rwtured SG; or 3 out of (041)

Steam Generator 3 MSIVs on intact SGs (MSI)

.J isolation of Feed DAF-Success 1 out of 1 AFW flow reg velve Close AFW reg valves 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Flow to R gtured from m ptmp and 1 out of 1 AFW to ruptured SG; or Steam Generator flow reg valve from TD puup to close MFW reg valve (AFI) r gtured SG; or 1 out of 1 MFW to r W tured SG flow reg velve to rwtured SG (OAF)

RCS Cooldown AFW-Success 2 out of 3 intact SG ARVs or Depressurite SGs 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (DS) or

.2 out of 3 steam dap velves to achieve -40'Ft ORF/ ALT-Success; RCS cooldoun

.ODS Success (ODS)

RCS Mone Normat pressuriter sprey; or Depressurire RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Depressuritation 1 out of 2 pressurfter PORVs;-

to terminate-(see OL)

(DP) or auxiliary pressurizer sprey break flow (ODP) x

}

WP1142:1D/030992 SGTR-P34,

~

I-m

TABLE 1 (Page 3 of 4)

STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA PLANT RESP. TREE N@AL SUCCESS OPERATOR MISSION t

MODE DEPENDENCIES CRITERIA Attl0NS.

TIME Normal OIR-Success 1 of 2 charging pu ms aligned for Reduce ECCS 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Charging TK-Success norinal charging pirips (OIR),

(NC)

CCP-Success Establish Normat charging (ONC)

Reactor Conteirynent ATW-Failed 2 out of 5 fan cooters verification 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Fan Cooters to DBL /BL-Success Prevent CSI (FC)

Reactor Contairinent AFW-Failed 1 out of 5 fan cooters verification 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Fan Coolers to OBL/BL-Success Remove Decay Heat OHX/RMX-Failed (FC)

ORC /MPR-Success t

Reactor Contaltunent None 1 out of 5 fan cooters verification 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Fan Cooters to Prevent Cont-alrvnent Falture (FC)

Conta t rinent

<2 FCa 1 out of 2 m pw ps; or verification 2.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Spray injection 1 out of I dieset pupp (CSI)

RHR Heat Exchanger AFW Failed 1 out of 2 RNR un in train Align CCW to 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months to prevent OBL/BL-Success with an operating RMR pimp RHR Hz (OMX) core damage 0 FCs (RMX)

OMX-Success ORC /HPR* Success WP1142:1D/030992 SGTR-P35

.=

TABLE 1 (Page 4 of 4)

STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA PLANT RESP. TRtE N00AL SUCCESS OPERATOR MISSION NODE DEPENDENCIES CRITERIA ACTIONS TIME High Pressure AFW-Failed 1 out of 2 SI punps or Align SI/ Charging 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Recirculation OBL/81-Success 1 out of 2 charging ptrps pwp for suction (HPR)

ORC-Success to 2 out of 4 cold legs from RHR; align RMR planp to swp (ORC)

Refitting the ORT-Success Refitt flow g 400 gpn w/ bleed Align charging 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months RWST and feed; > 500 gpm if no ptmp to refitt (RTK) bleed and feed RWST Contairment None Alt lines > 2 inches vertitcation 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Isolation isolated (Cl)

WP1142:1D/030992

. SGTR-P36

P 4:'

TABLE 2 (Page 1 of 4)

OPERATOR ACTION TIMES OPERATOR ACTION TIME AVAILABM CONDITIONS GOR Align Alternate Feedwater 25 minutes AFW Failed Return to E-3, terminate breakftew (ORF)

At t ECCS prior to SG overfitt 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AFW-Falled No ECCS Align Alternate Feedwater 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AFW-Falled Avoid bleed & feed cooling per FR M.1 (ORF)

Att ECCS 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months AFW Falled 1 CCP Ocpressurize RCS for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months AFW Failed 8 teed and Feed Cooling 8 teed and Feed ORF/ ALT-Failed (OBL)

CCP-Success or AFW-Failed CCP-Falled SIP-Success Isolate Steam Flow 20 minutes AFW-Success or Pressure /Te gerature differential from R @ tured SG ORF/ ALT Success; between r wtured & intact SGs (OAI)

CCP-Success isolate Steam Flow 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months s-AFW-Success or Equilibrate RCS pressure with from R@tured SG ORF/ ALT-Success; rw tured SG pressure (OAI)

CCP-Falture-StP-Falture WP1142:1D/030992 SGTR-P37

TABLE 2 (Page 2 of 4)

OPERATOR ACTION TIMES OPERATOR ACTION TIME AVAILABLE CONDITIONS GOA d

Isolate Feed Flow to 20 minutes AFW-Success or Limit addition of mass to Ruptured SG ORF/ ALT-Success; ruptured SG thereby (OAF)

CCP-Success prolong time to SG overfitt OAl/MSI-Success Cooldown RCS 25 minutes AFW-Success or Establish adequate RCS subcooling

'(005)

ORF/ ALT-Success; for ECCS Reduction prior to CCP-Success SG overfitt OAI/Mst-Success OAF /AFI-Success Cootdown RCS 1 i hour AFW-Success or Establish adequate RCS subcooling (ODS)

ORF/ ALT-Success; for ECCS Redxtion after SG overfill CCP-Falture, SIP-Success

. og.

AFW-Success or ORF/ ALT-Success; CCP-Success CAI/MSI-Failed or OAF /AFI-Falled Depressurire RCS 40 minutes AFW-Success or Terminate break flow;

-(CDP)

ORF/ ALT-Success; Establish prar levet CCP-Success OAI/MSI-Success OAF /AFI-Success ODS/DS-Success Reduce ECCS Injection 52 minutes AFW-Success or Prevent RCS repressuritation and (OIR)

ORF/ ALT-Success; reinitiation of breakflow CCP-Success OAl/MSt-Success OAF /AFI-Success ODS/DS-Success CDP /DP-Success 45 minutes AFW-Success or ORF/ ALT-Success; CCP-Success OAI/MSI-Success OAF /AFI-Success ODS/DS-Success ODP/DP-Falled WP1142:1D/030992 SGTR-P38

#w.:

4 TABLE 2 (Page 3 of 4)

OPERATOR'4CTION. TIMES P

OPERATOR ACTION TIME AVAILABLE CON 0lil0NS.

QOA,(

'(CIR)

-< 1 Hour AFW-Success or Extend time of RWST evaitebility Reduce ECCS Injection

~ORF/ ALT-Success; for ECCS Injection following CCP Success SG Overfitt ODS/DS-Soccess Onl/MSI-Felled or OAF /AFI-Felled

.OR-AFW-Success or ORF/ ALT Success; CCP Felled SIP-Success (BS/DS-Success Establish Normal Chargirig 52 minutes AfW-Success or-Centrol of RCS Inventory (i.e.,

(ONC)

ORF/ ALT-Success; pressurizer level) es precursor to CCP-Success to terminating primary to OAl/Mst-Success secondary breek flow OAF /AFI-Success CDS/DS-Success CDP /DP* Success 45 minutes AFW-Success or ORF/ ALT-Success; CCP-Success OAI/MSI Success OAF /AFI-Success ODS/DS-Success (BP/DP Falled Align RMR Meet Emenengers 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months AfW Fetted Decay Heat removat during (OMX)

'ORF/ ALT-Feiled ECCS recircutetton CCP or SIP-Success 05L/DL-Success.

0 FCs

- WP1142:1D/030992 SGTR-P39

...- c u.-.

~...

.a..

.. ~..

.2._.;._._..

u.-

A4 b

m TABLE 2 (Page 4 of 4)

OPERATOR ACTION TIMES OPERATOR ACTION TIME AVAILABLE CONDITIONS 04AL Align for High Pressure 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months AFW-Falled Continue core cooling via Recirculation ORF/Ali-Falled high pressure recirculation (ORC)

CCP or SIP-Success OBL/8L-Success CSI-Success 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months AFW-Falled ORF/ Alt-Falled CCP or SIP-Success OBL/9L-Success CSI-Falled IMtiate RWSi Refitt 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months OBL/8L-NA or Failed Continue core cooling via (ORT)

RWST refitt 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months ost/BL-Success CSI-Success 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months OBL/8L-Success CSI-falted WP1142:1D/030992 SGTR-P40

.e.

i

(

4.0 FUNCTIONAL REQUIREMENTS The nodes modeled on the SGTR plant response tree address the following functional requirements:

1.

Initial Inventory Control Refueling Water Storage Tank (TK)

High Pressure injection (CCP & SIP)

Operator Actions to Terminate Break Flow Before SG Overfill Isolate Ruptured SG (OAl/MSI, OAF /AFI)

RCS Cooldown (ODS/DS) t RCS Depressurization (ODP/DP)

ECCS Reduction (OIR)

Establish Normal Charging (ONC/NC) 2.

Long Term Inventory Control ECCS Reduction (OIR)

High Pressure Recirculation (ORC /HPR) 1 RWST Refill (ORT /RTK) l 3.

Core Heat Removal Auxiliary Feedwater (AFW)

Alternate Feedwater (ORF/ ALT)

Bleed and Feed (OBL/BL)

P WP1142:1D/030992 SGTR-P41 1

s; j

4.

Containment Heat Removal RHR Heat Exchanger Cooling (OHX/RHX) during High Pressure Recirculation Reactor Containment Fan Coolers (FC) 5.

Containment Integrity Containment Isolation It is noted that the containment spray node is modeled in order to address the timing of RWST depletion plus fission product scrubbing following core damage.

Containment spray also provides a means of ex-vessel' debris cooling following core damage.

5.0 SEQUENCE IDENTIFIERS An identifier is assigned to each plant response tree sequence, if the end state results q

in a safe, stable plant configuration as defined in the success c'riteria notebook with no additionallong term operator actions or system actuations required, the sequence is labeled as success (SCS).

If additional activities (accident management) are required beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the sequence is labeled as success with accident management (SAM). Core damage sequences are further identified to describe the t

unique core and containment response characteristics determined by the combinations of success and/or failure of the nodes. These core damage identifiers are used as an intermediate step so that the source term / release categories can be assigned. The plant state sequence identifiers are described with four designators as follows:

First designator: initiating event behavior WP1142:1D/030992 SGTR-P42 r

.(

Second designator: core damage timing Third designator: functional failures resulting in core melt and disposition of the RWST inver>xory Fourth designator: source term including containment failure definition.

These designators are discussed in more detail in the following paragraphs.

1.

The first designator identifies the type of initiating event behavior:

R=

Steam Generator Tube Rupture 2.

The second designator identifies the estimated time that core damage occurs.

E=

Early core damage (i.e., occurs within 0 - 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of initiation I

of event).

The timing for 'early' core damage of less than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months was chosen primarily for accident management purposes.

Specifically, it is felt that any sequences in which core damage occurs within the first two hours of the event would not benefit by any accident management strategies. Any improvements for these type of sequences would need to be reflected in updated -

procedures or operating training, for example. Additionally, it is noted that there would be relatively little fission product decay during this time period, thus resulting in a large source term release.

WP1142:1D/030992 SGTR-P43

4 i=

Intermediate core damage (i.e., occurs within 2 - 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of -

initiation of event).

The timing for ' intermediate' core damage was chosen primarily for accident management purposes. For the-2-6 hour interval in which core damage would occur, it is felt that some limited accident management strategies would be beneficial and should be investigated; however no offsite support could be credited.

An example of this would include local operator actions for event mitigation. Additionally, although some fission ptoduct decay would occur during the time period considered, the -

source term would still remain relatively high.

1 L=

Late core damage (i.e., occurs within 6 - 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of initiation of event).

The timing for ' late' core damage was chosen primarily for accident management purposes.

For times greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , there is a high probability that the offsite support groups would be available and accident management strategies could be effectively implemented. Examples include directives from TSC, operator actions for ex-vessel debris cooling, etc.

3.

The third designator is a number that identifies the failure of key functions. The key functions are those whose failure causes the core melt and/or affects the disposition of RWST water. The identification of the i

functional failure that caused the core melt is important in determining which s'ystems merit attention for accident management development.

The identification of the disposition of RWST water is important.in WP1142:1D/030992 SGTR-P44

e

(

determining whether vessel failure after core melt can be prevented via external vessel flooding. If the vessel does fail, the disposition of RWST water is important in determining the extent of core debris cooling and fission product scrubbing via sprays or via a water layer over the debris.

Given the success of certain functions, the status of other functions are not important and therefore, are not indicated. For example, if high pressure injection is successful, the status of low pressure injection is not important (for injection) because it is not needed to keep the core from melting and it is not needed to inject the RWST water into the containment. The case of high pressure injection successful and low pressure injection failed will be identified as the failure of recirculation.

If high pressure injection fails, then the status of low pressure injection is important. Therefore, the ECCS injection failures are broken down into high pressure injection fails and all injection fails.

1=

Reactivity control fails

'(CSI is successful)

The failure of reactivity control causes the core melt (failure of reactivity controlis defined as the failure of the control rods to insert to trip the reactor and/or the failure of the control rods and other systems to maintain the core in a subcritical condition following reactor trip). The CSI system injects the RWST-inventory into the containment for debris cooling, and fission product scrubbing. The status of the ECCS injection system is-l WP1142:1D/030992 SGTR-P45

~.

i not important since the RWST inventory is injected via the containment sprays.

2=

Reactivity control fails, CSI fails (ECCS injection is successful)

The failure of reactivity control causes the core melt. The failure of the CSI system means that ECCS injection is required to inject the RWST inventory into the containment for_ debris cooling and fission product scrubbing (the fission product scrubbing will be different then if the sprays had actuated).

There is no need to delineate between high pressure injection and low pressure injection since the RCS pressure will be close to containment pressure following vessel failure. The different l

rates of injection between HPI and LPI do not significantly affect the results.

3=

Reactivity control fails, all ECCS injection fails, CSI fails The failure of reactivity control causes the core melt.. The failures of all ECCS and containment spray injection means that there will be no RWST inventory injected to the containment.

The water inventory available for debris cooling and fission product scrubbing will be limited to the reactor coolant system inventory (including the accumulator inventories if injected) that gets to containment through the failed vessel.

WP1142:1D/030992 SGTR-P46

~

High Pressure ECCS injection fails 4=

(CSI is successful)

The failure of the high pressure injection system to inject water to the RCS causes the core melt. ~ The failure is due either to a system failure or to the RCS pressure limiting the amount of.

injection to less than that required to prevent core melt. The CSI system injects the RWST inventory into the containment for debris cooling and fission product scrubbing. The status of the ECCS injection systems is not important since the RWST Inventory is injected via the containment sprays.

S=

High pressure ECCS injection fails and CSI fails (High pressure injection and/or Low pressure ECCS injection are/is successful after vessel failure)

This scenario is the same as '4' except that containment spray-injection has also failed. After vessel failure the RCS pressure drops and either high pressure (if the system hasn't failed) or low pressure injection or both inject the RWST inventory into containment. Fission product scrubbing will be different than for case 4 since containment spray injection has failed.

6=

All ECCS injection fails (CSI is successful)

In this instance, there is no ECCS injection and no recirculation (low pressure or high pressure).

The operation of the containment sprays will inject the RWST contents into the WP1142:1D/030992 SGTR-P47

g m

I

's;

.j c

i containment and either prevent the vessel from. falling or j

((

accomplish ex-vessel core debris cooling and fission product.

scrubbing following vessel failure.

7'=-

All ECCS injection fails and CSI fails

-j This scenario is the same as '6', except that the RWST would-not be injected into the containment and thus the vessel will' fail. The water inventory available for debris cooling and fission' product scrubbing will be limited to the reactor coolant system inventory (including the accumulator inventories if injected) that gets to containment through the failed vessel.-

8.=

ECCS recirculation fails (ECCS injection is successful, CSR is successful) fj in this instance, there is ample injection early in the event to

~

maintain core cooling; however, ECCS recirculation (either high pressure or low pressure or both) fails and core cooling is lost '

following RWST depletion. [NOT USED FOR ZION]

9=

ECCS recirculation fails, CSR fails

~

J

~ This scenario'is the same as '8' except that containment spray; recirculation fails which affects fission product scrubbing.

1 1

f i

[

i L WP1142:1D/030992 SGTR-P48 2

~

(

0=

ECCS recirculation fails due to containment failure Most of the cases where ECCS injection and recirculation have been successful will result in either a success (SCS) state or a success with accident management (SAM) state. However, if heat is not being removed from containment, late containment -

failure can occur followed by core damage. The mechanism for core damage after containment failure is the flashing of water in the RHR pump suction due to the sudden depressurization of containment.

This flashing / voiding of injection water is i

assumed to result in failure of the RHR pumps thereby leading-to loss of ECCS recirculation and subsequent core damage.

4.

The fourth designator addresses the timing and magnitude of fission product releases for severe accident sequences. It also implicitly includes the containment heat removal function and containment failure modes as 1

it incorporates impaired containment (bypass or isolation failure) as well as containment failures (early or late) due to severe accident containment loadings.

The designator of 'A' implies that no containment failure is predicted within the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months mission time used for sequence quantification but containment failure could occur if no recovery actions were taken.

Accident management actions have failed to prevent core damage', but are successful to prevent containment failure.

i The combinations of containment failure timing and fission product release -

magnitudes are addressed by the following designators:

i I

?

WP1142:1D/030992 SGTR-P49

.y; -

y

,}

i.

A-

. No containment failure within 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months mission time but failure -

could eventually occur without accident management action;'

l noble gases and less than 1/10% volatiles released.

-l B-Containment bypassed with noble gases plus less than 1/10%

1 of the volatiles released.

C-Containment bypassed with noble gases plus up to 1% of the volatiles released.

(

D-Containment bypassed with noble gases and up to 10% of the volatiles released.

E-Cor.lainment failure prior to vessel failure with the noble gases and less than 1/10% of the volatiles released (containment not l

bypassed; containment isolation impaired or isolation successful but late containment failure).

F-Containment failure prior to vessel failure with noble gases and.

up to 1% of the volatiles released (containment not bypassed, containment isolation impaired or isolat!on successful but late containment failure).

.i G-Containment failure prior to vessel fallore with noble gases and t

up to 10% of the volatiles released (containment not bypassed;.

containment isolation impaired or isolation successful but late -

containment failure).-

i WP1142:1D/030992 SGTSP50

~

e I

{-

H-Early containment failure with the noble gases and less than

']

1/10% volatiles released (containment failure at or immediately after vessel failure; containment not bypassed; isolation successful).

I-Early containment failure with noble gases and up to 1 % of the volatiles released (containment failure at or immediately after vessel failure; containment not bypassed; isolation successful).

J-Early containment failure with noble gases and up to 10% of the volatiles released (containment failure at or immediately after vessel failure; containment not bypassed; isolation successful).

K-Late containment failure with noble gases and less than 1/10%

volatiles released (containment failure approximately 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or lon0er after vessel failure; containment not bypassed; isolation successful).

L-Late containment failure with noble gases and up to 1% of the volatiles released (containment failure approximately 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or longer after vessel failure; containment not bypassed; isolation successful).

M Late containment failure with noble gases and up to 10% of the volatiles released (containment failure approximately 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or longer after vessel failure; containment not bypassed; isolation' successful).

WP1142:1D/030992 SGTR-P51

t i

N Late containment failure with noble gases and up to 1 % of the g

volatiles and up to 1/10% of the non-volatiles released (containment failure approximately 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or longer after vessel failure; containment not bypassed; isolation successful).

S No containment failure (leakage only, successful maintenance.

of containment integrity; containment not bypassed; isolation successful).

Containment bypassed with noble gases and up to 50% of the T

volatiles released.

6.0 PLANT RESPONSE TREE MODEL The nodes for the plant response tree are:

SGTR1 SGTR Initiator AFW Auxiliary Feedwater F

TK Refueling Water Storage Tank CCP ECCS Injection Using the Centrifugal Charging Pump (s)

SIP ECCS Injection Using the Sa'fety injection Pump (s)

ORF Operator Action to Establish Alternate Feedwater ALT Alternate Feedwater to Steam Generators COL Operator Action to initiate Bleed and Feed BL RCS Bleed via Two Pressurizer PORVs OAl Operator Action to isolate the Ruptured SG MSI Closure of Ruptured SG MSIV (and associated steam paths) OR Closure of Intact SGs MSIVs (and associated steam paths)-

OAF Operator Action to isolate Feedwater Flow to Ruptured SG t

R WP1142:1D/030992 SGTR-PS2

,s AFI Closure or Throttling of Feedwater Pump (s) Discharge Valve (s)

g ODS Operator Action to initiate RCS Cooldown via intact SGs DS RCS Cooldown via Steam Dump from Intact SGs (to condenser or atmosphere)

ODP Operator Action to Depressurize the RCS DP RCS Depressurization via Normal Pressurizer Spray OR Pressurizer PORV OR Auxiliary Pressurizer Spray OIR Operator Action to Reduce ECCF injection ONC Operator Action to Establish Norma', Charging NC Realign Centrifugal Charging Pumps to VCT for Normal Charging FC Reactor Containment Fan Coolers CSI Containment Spray injection OHX Operator Action to Establish RHR Heat Exchanger Cooling t

RHX RHR Heat Exchanger ORC Operator Action to Establish ECCS Recirculatica HPR High Pressure Recirculation ORT Operator Action to Refill the RWST RTK RWST Refill Cl Containment Isolation TREE SGTR-1: INITIAL ACTIONS TREE SGTR-1 shows the nodes for the initial response to the SGTR event.

Following reactor trip and/or safety injection, Zion EOP E-0 addresses the availability of auxiliary feedwater (AFW). If AFW succeeds, the.following nodes address the-availability of the RWST (TK) and subsequently high pressure injection.via the 0

centrifugal charging pumps (CCP) or the safety injection pumps (SIP). Although high pressure safety injection flow is desirable for a SGTRi the failure to inject any SI water WP1142:1D/030992 SGTR-P53 i

,8-(

(due to failure of TK, or CCP/ SIP) may not result in a detrimental end state. This will be discussed subsequently.

Following the verification of AFW and high pressure safety injection the Zion EOPs instruct the operators to diagnose the cause of the reactor trip and/or safety injection.

The presence of a SGTR may be identified by rising level in one SG, steamline radiation or blowdown radiation. Following the diagnosis of a SGTR event (included in OAI), the operators will transition to E-3 and perform a series of actions. Once the steam generator with the ruptured tube has been identified, the E-3 procedure instructs the operators to isolate steam flow from, and feedwater flow to, the ruptured SG (OAl and OAF, respectively). Steam flow from the ruptured SG is e

isolated by closing the MSIV on the ruptured SG or by closing the MSIVs on the intact SGs (MSI). Isolation of feedwater flo'w to the ruptured SG is accomplished by closing the auxiliary and main feed regulating valve (s) (AFI). Once steam flow from and feedwater flow to the ruptured SG have been irolated, the procedures instruct the operator to perform an RCS cooldown by dui sing steam from the intact steam generators at maximum rate (ODS). The steam dump may be accomplished via the condenser steam dump valves or the atmosp!.aric relief valves (DS). The RCS cooldown will provide a pressure and temperature differential between the ruptured and intact SGs as a necessary precursor to the next operator action. Following the i

RCS cooldown, the procedures next instruct the operators to depressurize the RCS in order to restore level to the pressurizer (i.e., inventory control) and if possible, equilibrate the primary and secondary pressures thereby terminating the break flow through the ruptured tube (ODP). This RCS depressurization may be performed with normal pressurizer spray (if RCPs are not tripped), pressurizer PORV or auxiliary spray (DP).

Once the primary and secondary. pressures have equilibrated (or nearly 7

equilibrated), the next operator action is to reduce the ECCS flow to 1 charging pump (OIR). The injection flow must be reduced in order to limit any RCS re-pressurization (and reinitiation of primary to secondary break flow) and as a necessary precursor to P

WP1142:1D/030992 SGTR-P54

(

termination of the break flow. The final operator action is to align the charging pump flow for normal charging so that throttling capability is available for RCS inventory control (ONC). The equipment for this step involves the valve alignment for no mal charging flow (NC). If these steps can be completed and RCS inventory control establishod prior tu overfill 6t the SG, then the end state is success.

For the scenario in which the operator actions to cooldown (ODS/DS) and depressurize (ODP/DP) the RCS are successful, ECCS reduction to 1 charging pump (OIR) is accomplished, but normal charging (ONC/NC) cannot be established prior to SG overfill, the end state is Success with Accident Management (SAM). The reduction of ECCS will extend the RWST availability following SG overfill (and the consequential failure to close of a safety valve) such that no core damage will occur for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Reference 16).

For the sequence in which the operator action to cooldown (ODS/DS) and depressurize (ODP/DP) the RCS are successful but ECCS reduction (OIR) fails, SG overfill will occur and the path is transferred to TREE SGTR-2 (RWST REFILL). Recall that SG overfill results in the consequential failure of a safety valve to ressat; the continual primary to secondary pressure differential results in continued primary to secondary break flow through the ruptured tube. The inability to terminate the break flow and establish RCS inventory control dictates the necessity for continued ECCS injection to ensure core cooling. Since ECCS recirculation is not possible, the ECCS flow must be reduced or RWST refill must be accomplished (Section 3.0).

Per definition of this particular sequence, ECCS reduction has failed; therefore RWST refill must be accomplished for continued core cooling.

It is noted that although the operator would be directed to actions in ECA-3.1 or ECA-3.2 following SG overfill which provide instructions to sequentially terminate the ECCS pumps, it is assumed that since this action has already failed via E-3, the operators would not be able to succeed in ECA-3.1 or ECA-3.2 either (Section 3.0).

WP1142:1D/030992 SGTR-P55

J

(

For the case in which pressurizer pressure control (ODP/DP) cannot be established, the operetors will transition to ECA-3.3. Here, the operators will be instructed to reduce ECCS injection (OIR) and establish normal charging flow (ONC/NC) if the ruptured SG narrow range level exceed 70%. Success of establishing RCS inventory control in this instance will also result in a safe, stable state and a ' success' end state. Analogous to the path in which RCS depressurization succeeds, the path in which pressurizer pressure control fails, ECCS reduction succeeds but normal charging cannot be established, the end state is Success with Accident Management (SAM).

Similarly, the path in which pressurizer pressure control fails and ECCS reduction fails, the path is transferred to TREE SGTR-2 (RWST REFILL).

For any scenario in which no intact SG is available for RCS cooldown (ODS/DS), the path is transferred to TREE SGTR-2 to address RWST refill. As noted in Section 3.0, RCS cooldown via the ruptured SG is not considered; the inability to perform an RCS cooldown results in SG overfill since a lack of subcooling will prevent reduction of ECCS flow. Additionally, the inability to reduce ECCS flow.following SG overfill necessitates RWST refill for continued core cooling.

For those sequences in which feedwater to the ruptured SG cannot be stopped (OAF /AFI), SG overfill will occur. Regardless of feedwater isolation, the operators are instructed to perform an RCS cuoidown (ODS/DS) and establish RCS inventory control via ECCS reduction (OIR) and establishing normal charging flow (ONC/NC). These instructions may be in E-3, or in ECA-3.1 or ECA-3.2 following SG overfill. Success of RCS cooldown and ECCS reduction will extend the RWST availability such that no core damage will occur for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; thus the end state for this path is Success with Accident Management (SAM). Failure of RCS cooldown or ECCS reduction results in path trsosic to SGTR-2 (RWST REFILL) to address the ' capability.

to continue ECCS injection via refill ot the RWST.

WP1142:1D/030992 SGTR-P56

4 't i

(

For the scenario in which the ruptured SG cannot be isolated from the intact SGs (OAl/MSI), the operators will be instructed to transition to ECA 3.1 to complete the actions. However, it is assumed that the additional timing involved in this sequence wiil result in the overfill of the ruptured SG. The ECA-3.1 procedure instructs the operators to perform an RCS cooldown (ODS/DS) and reduce ECCS (OIR). Success of RCS cooldown and ECCS reduction will extend the RWST availability such that not core damage will occur for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; thus the end state for this path is Success with Accident Management (SAM). Failure of RCS cooldown or ECCS reduction results in path transfer to SGTR-2 (RWST REFILL) to address the capability to continue ECCS injection via refill of the RWST.

For those scenarios in which high pressure injection is available with the Si pumps only (CCP fails, SIP success), a successful end state cannot be achieved since normal charging (ONC/NC) cannot be established. Therefore, RCS cooldown (ODS/DS) and ECCS reduction (OIR) are addressed. If RCS cooldown is successful and the ECCS flow reduced to 1 Si pump, tra RWST availability is extended such that no core damage occurs for the first 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; thus the end state for this path is Success with Accident Managemer t (SAM). Failure of RCS cooldown or ECCS reduction results in i

core damage; in these cases an end state is assigned.

For the cases in which AFW is available but high pressure injection (CCP and SIP) fails, the RCS pressure will decrease to near the secondary pressure, ultimately resulting in the reduction of the primary to secondary break flow. If steam flow from the ruptured SG is stopped by isolating that SG (OAl/MSI), the RCS and ruptured SG pressure will equilibrate and the SGTR flow will be stopped. Provided that feedwater flow controlis provided (OAF /AFI), primary to secondary heat removal is provided by the steam generators and the plant will be in an equilibrium condition (albeit saturated). Long term actions include RCS cooldown and depressurization to cold shutdown conditions. Since the break flow has been terminated and the steam WP1142:1D/030992 SGTR-P57

V

(

generators are providing heat transfer capability, this scenario will be considered Success with Accident Management (SAM). If isolation of the ruptured SG cannot be completed, a small delta-P across the ruptured tube will exist thereby resulting in continued primary to secondary break flow. This break flow will eventually drain the RCS to the level of the ruptured tube (i.e., top of tube sheet), and the lack of water in the primary side of the steam generator tubes will result in degraded primary to secondary heat transfer and eventual core damage.

In this case, the path is transferred to SGTR-4 (CORE DAMAGE) to address the availability of containment spray (CSI).

For the case in which AFW is available but the RWST (TK) fails, successfulisolation of steam flow from (OAl/MSI) and feed flow to (OAF /AFI) the ruptured SG will result in an end state of Success with Accident Management. The logic is identical to that discussed in the proceeding paragraph. However, failure of either of these isolation steps will result in core damage; an end state is assigned on this tree since the failure-of the RWST results in the failure of the containment sprays.

For those cases in which AFW flow cannot be verified via the instructions in E-0, the operators will be instructed to transition to FR-H.1, Loss of Secondary Heat Sink.

Once in FR-H.1, the operaters verify operability of at least one centrifugal charging pump (TK and CCP). If TK and CCP are successful, the procedures instruct the operator to establish an alternate feedwater source to the steam generators (ORF).

As the event progresses, level will return to the ruptured SG due to the primary to secondary break flow regardlessif alternate feedwater is established. Based on a level check in any SG, the operator will be instructed to transition back to E-0 due to level indis wr. ion in the ruptured SG, However, since the intent of the ' level check' step (s) in FR-H.1 is to verify feedwater to the SGs, and since the level return is not due to the establishment of any auxiliary feedwater or alternate feedwater, the operator may remain in FR-H.1. Thus, the path would continue based on FR-H.1 procedures.

l WP1142:1D/030992 SGTR-P58

(

If the operator does transfer back to E-0, the operators will subsequently return to FR-H.1 due to monitoring of the Critical Safety Function Safety Trees, specifically loss of heat sink indication (no levelin any SGs and no auxiliary / alternate feedwater flow).

Consider the transfer back to E-0. Following identification of the SGTR in E-0, the operators will begin a series of actions in E-3 including RCS cooldown, as discussed above. However, the lack of AFW flow to the intact SGs will limit the cooldown via the intact SGs and force the operators to transition to ECA-3.1 or result in the operators using the ruptured SG for RCS cooldown since it is the only available heat sink, based ca levelindication. The primary to secondary break flow is not sufficient to keep up with the steam production in the ruptured SG during RCS cooldown and the level subsequently decreases in the ruptured SG. Once levelis lost in all SGs, the operators will return to FR-H.1 via the CSFSTs. Thus, in either case the operators continue via FR H.1.

As noted, the next major action in FR-H.1 for the scenario in which AFW has failed,.

but CCP is available, is the attempt to establish an alternate source of feedwater (ORF/ ALT). Success of alternate feedwater results in transition back to E-0 and subsequent transition to E-3 since there is now feedwater available for a RCS cooldown. If a source of alternate feedwater cannot be' established, the operators are instructed to initiate bleed and feed cooling by opening both pressurizer PORVs (OBL/BL). Success of this node results in initiation of bleed and feed cooling, and since no heat sink exists, the operators will continue bleed and feed cooling until RWST depletion forces transition to ES-1.3, Transfer to Cold Leg Recirculation. This results in a path transfer from TREE SGTR-1 to TREE SGTR-3 (BLEED & FEED).

Failure of OBL/BL results in path transfer to TREE SGTR-2 (RWST REFILL) since there would be no water in containment available for recirculation and RWST refill would be the only means of continuing decay heat removal.

WP1142:1D/030992 SGTR-P59

t Should the charging pumps be unevailable once the operators are in FR-H.1, the operators will be instructed to verify that at least one safety injection pump (SIP) is available, and if so to immediately begin ' bleed and feed' cooling by opening both pressurizer PORVs (OBL/BL). This RCS depressurization enables EC OS water to be injected to the RCS via the safety injection pumps; it is further noted that the rapid -

RCS depressurization caused by the opening of the PORVs results in RCS/ secondary pressure equilibration and break flow termination. Since further efforts to establish alternate feedwater are not modeled (Section 3.0), the operators will remain in FR-H.1 and continue bleed and feed cooling until depletion of the RWST results in transition to ES-1.3, Transfer to Cold Leg Recirculation. This scenario is modeled as a path transfer from TREE SGTR-1 to TREE SGTR-3 (BLEED & FEED). Failure of OBL/BL results in core damage for these sequences since RWST refill is not possible without the charging pumps; core damage end states are assigned to these sequences.

Failure of all high pressure injection (TK success, CCP fails and SIP fails) in conjunction with failure of auxiliary feedwater (AFW) results in the operators attempting to establish alternate feedwater (ORF/ ALT) to maintain the SGs as a heat sink. Success of ORF/ ALT for this scenario results in a subsequent end state of Success with Accident Management (SAM) provided that stesm flow from (OAl/MSI) and alternate feedwater to (OAF /AFI) the ruptured SG can be isolated (as discussed above for the case with no high pressure injection). Failure to isolate steam flow or feed flow following the success of alternate feedwater will result in core damage and path transfer to TREE SGTR-4 (COPE DAMAGE). Additionally, failure to establish alternate feedwater in conjunction with failure of high pressure injection and auxiliary feedwater results in core damage and path' transfer to TREE SGTR-4 (CORE 2

DAMAGE).

WP1142:1D/030992 SGTR-P60

4 i

For those paths in which both auxiliary feedwater (AFW) and the RWST (TK) fail, the operator attempts to establish alternate feedwater (ORF/ ALT) in order to maintain the SGs as a heat sink. Success of ORF/ ALT for this scenario results in a subsequent end state of Success with Accident Management (SAM) provided that steam flow from (OAl/MSI) and alternate feedwater to (OAF /AFI) the ruptured SG can be isolated (as discussed above for the case with no RWST). Failure to isolate steam flow or feed flow following the success of alternate feedwater will result in core damage; the end states are assigned here since containment sprays would not be available.

Additionally, failure to establish alternate feedwater ;n conjunction with failure of the RWST and auxiliary feedwater results in core damage and path transfer to TREE' SGTR-5 (CORE DAMAGE /NO RWST) in order to address containment heat removal with the fan coolers (FC) since this scenario is NOT a containment bypass (no SG overfill).

As noted in the previous discussion, the 'end states' or ' conditions' of TREE SGTR-1 are either accident sequences with success, success with accident management, core damage / containment bypass sequences with the end state defined, core damage sequences which require further consideration of containment survival, or accident sequences requiring further treatment of possible recovery paths. For each accident sequence path of TREE SGTR-1 not ending in success, an extended plant response tree is attached to provide the required considerations. These additional plant response trees represent RWST Refill (TREE SGTR-2), Bleed & Feed (TREE SGTR-3),

Core Damage (TREE SGTR-4) and Core Damage /No RWST (TREE SGTR-5).

TREE SGTR-2: RWST REFILL TREE SGTR-2 shows the remainder of the nodes for the plant response tree for all sequences from TREE SGTR-1 in which SG overfill occurs and a safe, stable end state is attainable via further action to refill the RWST.

WP1142:1D/030992 SGTR-P61

(

Since SG overfill occurs, the sequence is a containment bypass sequence due to the consequential failure of the safety valve to reseat (Section 3.0).

Accordingly, containment heat removal (FC) and containment isolation (Cl) are not addressed. The only nodes addressed are those for RWST refill (ORT /RTK). Successful RWST refill results in Success with Accident Management (SAM). Failure of ORT or RTK results in a core damage / containment bypass sequence.

TREE SGTR-3: BLEED & FEED TREE SGTR-3 shows the remainder of the nodes for the plant response tree for all sequences from TREE SGTR-1 in which bleed and feed cooling is initiated. Since it is assumed that no auxiliary or alternate feedwater can be established to any steam generator, bleed and feed cooling will continue until the RWST water is depleted and the operator is instructed to transfer to ES-1.3, Transfer to Cold Leg Recirculation.

High pressure ECCS recirculation is required for long term decay heat removal and RCS inventory control.

The first node on TREE SGTR-3 addresses containment heat removal (FC). Two (2) fan coolers will prevent containment spray as well as prevent containment overpressurization failure. One (1) fan cooler will not prevent automatic actuation of containment spray but will prevent containment overpressurization failure.

Additionally, ECCS recirculation with 1 fan cooler will prevent core damage. For the paths with 0 fan coolers, ECCS recirculation with success of the RHR heat exchangers is necessary to prevent core damage and containment failure.

For those paths in which less than 2 fan coolers are operational, the availability of the containment sprays (CSI) is addressed. If the containment sprays are available, the draining of the RWST occurs much more quickly and the time to switchover to ECCS recirculation is reduced for these accident sequences.

WP1142:1D/030992 SGTR P62

?

The next actions during bleed and feed cooling is providing CCW to the RHR heat exchangers (OHX/RHX) and establishing high pressure recirculation (ORC /HPR). In this instance, the RHR heat exchanger (s) will be used as a heat transfer mechanism during high pressure ECCS recirculation. For the case with 1 or greater fan coolers operating, there is no requirement for operation of the RHR heat exchangers during recirculation.

For sequences with no (0) FC and success of high pressure recirculation, the operation of at least one RHR heat exchanger will prevent core damage. Failure of the RHR heat exchanger in this case will result in core damage-after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

For those cases in which high pressure recirculation fails, the next nodes on the plant response tree address the possibility of refilling the RWST (ORT /RTK) and continuing ECCS injection in order to prevent core damage if high pressure recirculation can not be established. Nodes ORT and RTK are addressed fe all event sequences in which there is failure to go to ECCS recirculation cooling. successful refilling of the RWST will result in an end state of Success with Accident Management (SAM).

The final node of TREE SGTR-3 addresses containment isolation (Cl) for core damage i

sequences.

TREE SGTR-4: CORE DAMAGE TREE SGTR-4 shows the remainder of the nodes for the plant response tree for all sequences on TREE SGTR-1 which end in core damage.

The only nodes addressed on TREE SGTR-4 are those dealing with containment spray (CSI). By definition, the paths which lead to this tree have resulted in SG overfill.

Therefore, this tree represents core damage / containment bypass sequences.

WP1142:1D/030992 SGTR-P63

(

TREE SGTR-5: CORE DAMAGE / NO RWST TREE SGTR-5 shows the remainder of the nodes for the plant response tree for all sequences on TREE SGTR-1 which end in core damage, and in which the RWST is not available.

Since the RWST is not available, there would be no ECCS injection and thus no SG overfill. Accordingly, containment heat removal (FC) and containment isolation (Cl) are addressed on this tree. Containment spray is not addressed since the RWST is unavailable.

7.0 DIFFERENCES IN UNIT 1 AND UNIT 2 The emergency procedures are written for Unit 1 or Uni 2; no specific instructions are listed for the two units except:

" Note: Unit 2 BIT inlet isolation valves 2MOV-Sl8803A and B are OPEN De-ENERGlZED per TECH SPECS,"

Service water valves to the auxiliary building coolers are listed specifically for each unit.

The control rooms are designed as duplicates (not mirror images) and the operators routinely switch shifts betweeil the two units. Thus, there should be no increased chance of operator confusion in the control room due to differences in procedures or control room design.

.]

The success criteria and best estimate analyses apply to both units. Therefore, the event tree model applies to both units.

WP1142:1D/030992 SGTR-P64

i 8.0 IPE/ ACCIDENT MANAGEMENT INSIGHTS A number of insights have been identified during the analyses and evaluations leading to the construction of the SGTR plant response tree.

These insights may be considered IPE insights and are noted here.

AFW Termination to Ruotured SG in ECA-3.1 For the scenario in which the ruptured SG can not be isolated from the intact SGs, Zion EOP E-3, Step 4 instructs the operators to complete Step 5 and then transition to ECA-3.1. Step 5 of E-3 instructs the operators to isolate [ steam] flow from the ruptured SG. It is noted that Step 6 instructs the operators to isolate [feedwater] flow to the ruptured SG. Upon transition to ECA-3.1, there is no guidance to isolate

[feedwater) flow to the ruptured SG. Therefore, for this scenario, the operators are not explicitly instructed to isolate [feedwater] flow to the ruptured SG This would appear to be a ' loophole' in the procedures. It is suggested that E-3, Step 4 instruct the operators to complete Steps 5 AND 6 prior to transition to ECA-3.1 for the scenario in which the ruptured SG can not be isolated from the intact SG.

(This matter was also discussed with the Plant Operational Engineering group at Westinghouse; this group is responsible for updates to the Emergency Response Guidelines. Apparently this oversight was also recognized in late 1990 by Seabrook personnel. To correct this oversight, ERG maintenance item DWR DW-90-047 was approved February 1991).

l WP1142:1D/030992 SGTR P65

(

Steamino SGs with no AFW Consider the following two scenarios:

I 1.

Due to the lack of AFW, the operators transition to FR H.1.

If the.

centrifugal charging pumps are unavailable, the procedure instructs the operators to begin bleed and feed (Step 16). Subsequent steps include establishing alternate feedwater to the SGs (Step 22), checking for SG level (Step 23a) and continuing in FR-H.1 if level raturns to at least one SG. The very next step in FR-H.1 (Step 23b) instructs the operator to maintain the cooldown rate at less than 100'F/hr.

1 2.

Due to the lack of AFW, the operators transition to FR-H.1.

If the centrifugal charging pumps are available the procedure instructs the operators to establish alternate feedwater to the SGs (Steps 7-11), and I

if level returns in any SG return to E-0. From E-0, the operators would be expected to diagnose a SGTR event, transition to E-3 and begin the operator actions which include SG isolation and RCS cooldown.

For each case, it is probable that level would return in the ruptured SG due to the primary to secondary break flow. If the operator interprets this levelindication as an available heat sink, then in either case he is instructed to begin a RCS cooldown. For case 1, the procedures do not explicitly tell the operators which SG(s) to use for the RCS cooldown; thus he may use only the SG with the available heat sink OR if he has wide range level indication, he may use all SGs. For case 2, E-3 instructs the operators to perform the RCS cooldown with the intact SGs. Thus he may use the intact SGs since there is wide range level and since he does not realb want to dump

/

steam from the ruptured SG. Nevertheless, the pointis that there is no clear guidance to the operators as to what is the criteria for using a SG for a RCS cooldown.

WP1142:1D/030992 SGTR-P66

Therefore, it is suggested that the availability of any SG for RCS cooldown be better defined in the EOPs to cover the scenarios in which AFW is not available.

On a semantics note, for the Case 1 scenario noted above, Step 23b of FR-H.1 instructs the operators to ' maintain' a 100'F/hr RCS cooldown. If no charging pumps are available, the operators skip over the step to depressurize the SGs for condensate

- booster pump injection. Thus no RCS cooldown has ever been initiated, so how can it be maintained?

Imoortance of the interoretation of a secondarv heat sink Again, consider the scenario in which AFW has failed, and the centrifugal charging pumps are available. The operators are in FR H.1 att'empting to establish alternate feedwater. During the SG level checks (4% narrow range) in Steps 10 and 12 of FR-H.1, there ultimately will be level return to the ruptured SG due to the primary to secondary break flow, it becomes important whether the operators interpret the level return as an available heat sink. This insight is divided into two 'sub-insights'.

A.

If the operators decide that the ruptured SG does not represent an available heat sink and remains in FR-H.1, then he continues in his attempts to establish an alternate feedwater source to any SG. This would continue until wide range levelin 3 of 4 SGs falls below 24%, at which time the operators are instructed to initiate bleed and feed by-opening the two pressurizer PORVs.. The rapid depressurization of the I

RCS effectively terminates the primary to secondary breakflow. However, during the time that the wide range levelin the 3 intact SGs decreases to less than 24%, water is accumulating in the ruptured SG due to the primary to secondary break flow and it is likely that SG overfill will occur.

I WP1142:1D/030992 SGTR-P67

(

This is undesirable and may lead to the failure of a safety valve to rescat; this results in the necessity for further operator actions for recovery.

On the other hand,if the ruptured SG is considered an available heat sink, the operators will transfer back to E-0, diagnose a SGTR and transition to E-3 and ultimately begin operator actions. First, the operators will isolate -

the ruptured SG and then initiate a RCS cooldown by dumping steam.

However, narrow range level in the intact SGs is offscale low; it is not clear as to which SG(s) the operators would use for RCS cooldown (See item above). If he uses the intact SGs, the RCS cooldown will deplete the -

inventory such that the RCS cooldown would only be effective for a short period of time; thus the operators would be forced to transfer to ECA-3.1 and use the ruptured SG for RCS cooldown. If the operators decide not to cooldown the intact SGs since the narrow range levels are offscale low, then he would transition to ECA-3.1 to use the ruptured SG. In either scenario, the ruptured SG will be used for RCS cooldown via ECA-3.1.

The action to cooldown the RCS via the ruptured SG reverses the level increase due to the phase transition of water to steam (recall that the water in the ruptured SG is much warmer than the auxiliary feedwater would be).

Continued steaming of the ruptured SG will result in a reduction of the narrow range levelindication to below 4%'such that the operators are forced to return to FR-H.1 due to the Critical Safety Function Status Trees (CSFSTs). Since there are no instructions in FR-H.1 to stop the RCS cooldown, the RCS cooldown continues via the ruptured SG, although the rate of cooldown decreases. The important point is that RCS cooldown with the ruptured SG results in additional time prior to SG ovodill so that there is higher probability of recovering auxiliary or 4

alternate feedwater.

WP1142:1D/030992 SGTR-P68

B.

Additionally, it is important to note that initiation of steam dump from the ruptured SG essentially terminates heat transfer to the remaining intact SGs thereby stabilizing the level. Once back in FR-H.1, the operators wait for less than 24% wide range levelindication in 3/4 SGs. This will take a very long time due to the sequence of events described above. This-also allows a long time to recover auxiliary or alternate feedwater, but also results in the operators being ' caught' in FR-H.1 waiting for level return t

in the ruptured SG or level reduction in the intact SGs. It may be wise to add a caution to FR-H.1 to discuss this scenario.

RWST Refill in EOP ECA-3.1, the operators are instructed to transition to ECA-3.2 if the RWST level falls below 19.5 ft; the initial step in ECA-3.2 instructs the operators to initiate RWST refill and continue with the ECA-3.2 actions. This levelindication corresponds to approximately half of the RWST volume. Considering the expected equilibrium break flow /SI flow, it is noted that the guidance to begin RWST refill is sufficiently early (i.e., before RWST empties) to ensure a high probability of success of preventing core damage.

Chance for Recovery it is noted that for a SGTR event, there is a very long time to perform recovery actions prior to the onset of core damage.

Additionally, the EOPs are structured for contingency actions during a SGTR (i.e., ECA-3.1, ECA-3.2 and ECA-3.3) such that there are many different paths to achieve ones' objective; namely termination of the primary to secondary break flow. Finally, although the incidents of steam generator tube ruptures indicate that this' is a credible event,' those plants which have experienced tube ruptures were able to use the resources available and shutdown the WP1142:1D/030992 SGTR-P69

t plant with no adverse circumstances. In short, the progression of a steam generator tube rupture to a core damage state is expected to be a remote possibility, while recovery from a steam generator tube rupture with no adverse effects is expected to be a high probability event, No ECCS i

11is interesting to note that analyses have indicated that lack of ECCS for a SGTR event does not automatically resultin a core damage sequence (unlike the other LOCA events analyzed). In fact, lack of ECCS actually results in additional time for the operators to perform the necessary actions to prevent SG overfill. The only negative to such a scenario is that the RCS may become saturated,'an undesirable but manageable situation. No procedure enhancements are noted here as a result of this insight, E-3 includes a note that ECCS flow must be terminated when the termination criteria are met. The only suggestion here is that this scenario be ' touched on' in training.

h i

WP1142:1D/030992 SGTR-P70 1

1

9.0 REFERENCES

1.

Zion Units 1 and 2 Emergency Operating Procedures, revisions through October 1,1989.

1.1 E-3, Steam Generator Tube Rupture, Revision 8 through 1t '1/89.

1.2 FR-H.1, Response to Loss of Secondary Heat Sink, Revision 5 through 9/8/89.

1.3 FR-C.2, Response to Degraded Core Cooling, Revision 7 through 10/1/89.

1.4 FR-C.1, Response to inadequate Core Cooling, Revision 7 through 10/1/89.

1.5 ES-1.3, Transfer to Cold Leg Recirculation, Revision 5 through 12/10/88.

1.6 FR-Z.1, Response to High Containment Pressure, Revision 2 through 9/8/89.

1.7 ES-3.1, Post-SGTR Cooldown Using Backfill, Revision 2 through 4/4/89.

1.8 ES-3.3, Post-SGTR Cooldown Using Steam Dump, Revision 4 through 4/4/89.

1.9 ECA-3.3, SGTR Without Pressurizer Pressure Control, Revision 7 through 4/4/89.

1.10 ECA-3.1, SGTR with Loss of Reactor Coolant - Subcooled Recovery, Revision 7 through 4/4/89.

1.11 ECA-3.2, SGTR with Loss of Reactor Coolant - Saturated Recovery, Revision 7 through 4/4/89.

1.12 E-0, Reactor Trip or Safety injection, Revision 7 through 10/1/89.

1.13 ECA-1.1, Loss of Emergency Coolant Recirculation, Revision 4 through 12/10/88.

WP1142:1D/030992 SGTR-P71

i i

1.14 FR-S.1, Response to Nuclear Power Generation /ATWS, Revision 4 through 10/1/89.

1.15 ES-1.1, Si Termination, Revision 5 through 4/4/89.

2.

ATWS Plant Response Tree Notebook for Zion Station Units 1 and 2, prepared by IPEP, Revision 0, March 1992.

3.

WCAP-11002, Evaluation of Steam Generator Overfill due to a Steam Generator Tube Rupture Accident, R. N. Lewis, et. al., February,1986.

4.

System Notebook for Auxiliary Feedwater System, Zion Station Units 1 and 2,--

prepared by IPEP, Revision 0, January 1992.

5.

System Notebook for Emergency Core Cooling System, Zion Station, Units 1 and 2, prepared by IPEP, Revision 0, March 1992.

6.

Human Reliability Analysis Notebook for Zion Station Units 1 and 2, prepared by IPEP, Revision 0, March 1992.

7.

Miscellaneous Systems Notebook, Zion Station Units 1 and 2, prepared by iPEP, Revision 0, March 1992.

8.

CECO Loter of February 5,1991 from Xavier Polanski (CECO) to Mike Loftus (Westinghouse) regarding RHR pump survivability with no CCW while on mini flow recirculation.

9.

System Notebook for Reactor Containment Fan Cooler System, Zion Station, Units 1 and 2, prepared by IPEP, February 1992.

10.

System Notebook for Containment Spray System, Zion Station Units 1 and 2, prepared by IPEP, February 1992.

11.

Containment isolation Notebook for Zion Station Units 1 and 2, prepared by IPEP, February 1992.

12.

CECO Memo of April 18,1990 from George Klopp (CECO) to Beverly Cassidy (Westinghouse).

13.

CECO Letter of June 9,1988 from Glenn E. Trzyna (CECO) to Director of Nuclear Reactor Regulation regarding BIT Removal (includes Westinghouse Report " Boron Concentration Reduction / Boron in}ection Tank Elimination for Zion Units 1 and 2," J. C.' Bass,1985.)

WP1142:1D/030992 SGTR-P72

14.

" Local Boron Dilution Transient in PWRs," S. Jacobson, Swedish State Power Board,.1989.

15.

Westinghouse Emergency Response Guidelins (ERG) Maintenance issue No.

DW-89-041, Revision 1, June 12,1989.

16.

SGTR Suc:ess Criteria Notebook, Zion Station Units 1 and 2, prepared by IPEP, March 1992.

17.

Equipment Survivability Notebook for Zion Station Units 1 and 2, prepared by IPEP, Revision 0, March 1992.

18.

Source Term Notebook for Zion Station Units 1 and 2, prepared by IPEP, April 1992.

19.

A PhenomenologicalEvaluation Summary on Contaiment Bypass During Servere Accidents for the Zion Nuclear Station Individual Plant Evaluation, prepared by FAl, April 1992.

WP1142:1D/030992 SGTR-P73

(.

APPENDIX A-STEAM GENERATOR TUBE RUPTURE q

PLANT RESPONSE TREES 4

f 1;

'i

-l WP1142:1D/030992 SGTR-P74 i

+,

m v..

03/02/92 15:50:32 CADET 1.00 Ogtr/setr 1.ed STEAM GENERATOR TUsE ROTURE VREE 1 - ICITIAL ACTIONS Pege 1 of 2 i

SGTR AFnt TK CCP SIP ORF ALT OBL BL DA!

Msl DAF AFI 00s Ds 00P DP Off DNClWC

(

1 SCs l

2 SAM i

i 3 SAM 4 *$GTR 2 5 ses 6 SAM i

i 7 SAM 8 *sGTR 2 9 SCS M

10 SAM i

11 SAM 12 *sGTR 2 13 *sGTR 2 14 *sGTR 2 15 SAM I

16 *sGTR-2 i

1 17 *sGTR-2 18 *sGTR-2 19 $AM l

20 ' *sGTR 2 i

l 21 *sGTR 2 22 *sGTR 2 23 SAM l

24 *SGTR 2 i

1 25 *sGTR 2 26 *sGTR 2 27 SAM l

28 *$GTR-2 i

I 29 *sGTR 2' 30 *sGTR-2 31 SAM l

32 RL97 i

i 33 RL97 34 RL9T 35 $AM l

36 *sGTR-4 t

t 37 *sGTR-4 1

38 *sGTR*4 i

39 *sGTR 4 40 SAM l

41 RL7C i

i 42 RL7C 43 RL7C 44 RL7C 45 SCs l

46 SAM

i I

47 SAM 48 *sGTR 2 **

49 SCs l

50 SAM i

i 51 SAM-52 *sGTR 2 53 sCs l

54 SAM i

i 55 SAM 56 *sGTR 2 57 *sGTR-2 58 *sGTR 2 59 SAM l

60 *sGTR-2 i

i 61 *sGTR 2 62 *sGTR 2 -

63 SAM I

64 *sGTR-2 i

SGTR-P75

g.

4 t

03/02/92'15:56:32-GADET 1.00 '

setr/cstr 1.ed:

STEAM GENERATOR TUDE RUPTURE TREE 1 - INITIAL ACTIONS.

.i Pese 2 of 2-l

'i SGTR' AFW TK.

CCP

$1P ORF ALT OBL BL OAI MSI DAF AFI 00S 101 ODP DP O!R ONC NC

]

..U-l i

65 *sGTR 2.

' 66 *SGTR-2 67 $AM.

l 68 *SGTR,

g I

69. *$GTR 2 '

70 *sGTR-2

-l

. 71 $AM l

.1, <~r,TR 2 l i

1 73 64GTR 2 74 *sGTR-2 l l'

'*75 *SGTR-3 I

' 76.> *$GTR 2 i

y I

77 *sGTR 2 '

4 78 *$GTR 3 '

l 79 *sGTR 2 i

I 80 *SGTR 2 - !

81 *SGTR 3 l

82 RL9T i

I 83 RL97 84 SAM.

i l

85 *sGTR 4 I

86 *$GTR 4 87 *SGTR 4 l

88 *$CTR 4,-

89 *SGTR 4 90 *sGTR 91 SAM.,

l

. 92. RL7C i

f 93 RL7C '

94. ' RL7C -

95. RL7C 3

^ 96 *SGTR-5 97 *sGTR 5. i i

i'

-[

i 1

SGTR-P76 i

i v,

+

R F

F I

O j

' ~

D

. F P

/

r P

.o D

O

.S SD 5.

/

.S F'

. S' F

S n

DO l

l

+

)

IE IFT

~

SAA

~

M/L

,S 9

..F F

F

/FO IAS AOI O

(

Y RA T

l' M

N L

M E

B

~

U M

/

S F

S S

P L

I B

N U

O O

Q I

E T

s I

t

~

D n

N T

e O

R n

L C

O o

A F

Y W

S S af8 S

.F F

P S

F p

/F m

R F

o R

^

T A

c O

NE la T

ll n

R o

P i

R P

4 t

T I

S F

F ar G

S p

e S

e '

o u

l fo P

C

.s S

3 8

.S S

F F

F r.

e b 'e C

ml ub nac s

si K

el T

.s S

.- S S

.S S

S S

S F

tp ap nA g

w itso eN

)

) -

d"

~

) -

)^

)"

)

4' 5

1 2

e

+

1-2' 3 -

('"

O cs l'

(

(:

(

N ie EE 2

2--

2 '-

2'-

3) 3)

4) 4)

5.

Sert

)

2 ')

D D

E E

E R

G G

G SReo

-Q RE RE R

R

t)

T RL)

RL) w.L L

E E

A A

R A EUmn R

R L

L L

t TI T

T T M TM TM Clue Tl TI TL F

F I

R GF GF GF GF GF G

G G

UA d G

G CIn A

A A

E S E S&

S&

S S

E S

T SE SE S

D D

D G

R R

.R D

D SFak S

ET ET ET RT ET EE EE EE EE EE) hn T

E E

E EE EE ER E R E R S

- - pa 3

S s

S S

R W RW R W RW RW RL RL R U R O R OW ll R

R R

B B

C C

C T(

T(

T( R SFAB i'

(Q$'. 44 D

g

t

~

CADET 1.00 01/23/92 08:59:54 SGTR\\sGTR 2.ED STEAM GENERATOR TUBE RUPTURE TREE 2 - RWST REFILL Page 1 of 1 SGTR2 -

FC CSI OHX RMX ORC HPR ORT RTK CI

-t 1 SAM t

2 RL97 1

i 8

3 RL9T t

Y 9

4 b '

P

}

SGTR-P78

w R

F F

I O

P F

D

/

r P

o DO S

S a

D

/

S F

SDO

+

)

IE

^.

IFT SAA M/L S

S F

F F

/FO IAS AOI O

(

YR A

T M

N L

M E

B U

M

/

F S

S P

L I

B N

U O

O Q

I E

T s

I t

D n

N O

^

R T en L

C O

o A

T F

/

S S

F F

F S

F p

^

Y W

m F

R F

o R

T A

c O

N E

l a

T n

R 1

o P

i t

R P

/

T I

S F

F ar G

S e

S p

l o

fo P

C S

S S

S cF F

F r.

e C

b "e ml ub nac si el K

S S

S F

tp T

.~

ap nA g

1tso eN d"

)

)'-

.)"

) -

)

., ?

1 2

3 4

5

.1*

O cs

(

.(

(

( -

(

N ie E

j3P 4) 4)

5 v 3'D Sert E

2 2

2

)

D E

E E

G G

G SReo R

)

-)

)

T RL RL RL R L RL

..RE RE R

R A R A EUmn L

L L

E A

TI TI TI TI TI

..T

.TE T M TM GTM Clue F

F CI nd R

GF GF GF GF GF

. G G

G G

E E

E A

A A

T S

S S

~. S&

S&

S S

S UA k G

R R

R D

D D

SFa

.T D

D S

ET ET E T ET ET EE EE EE EE EE) hn T

E E

EE EE E R ER E R S pa S

S S

E R W R W R W R W R W

..RL RL R O R O R OW ll R

R R

B B

C C

C T(

T(

,T(

T(

T( R SFAB

)

?" y U

ggl~-

01/23/92 08:21:19 CADET 1.00 s

. setrVetr 3.ed '

j STEM GENERATOR TUBE RUPTURE TREE 3

SLEED & FEED Pese 1 of 2 l

sGTR3 FC '

CSI OMX' RHX '

ORC HPR ORT RTK Cl I

\\

(

1(-

1 SCS

-2 SM l

3

3. RL95 l

4 - RL9E I

y

.5 RL9S j

6 RL9E -

~~ 7. SAM 3

8 ' RL95.-

9 RL9E

.)

i 10 RL95 '

l

' 11 RL9E

'i 12 SCS 13 SM.

,j 3

14 - RL98

_l l

15 RL9E1 n

16 RL95 I

- 17 RL9E 18 sm I

19 RL9S :

l 20 RL9E

5 21 RL95 1

l 22 RL9E -

23 SCS 24' SM

. 25 RL95 l

l 26 RL9E 27 RL95; i

l 28 RL9E 29 SM 8-30 RL9s i

l 31 RL9E l

32 RL95 l

33 RL9E -

t 34 SC$ -

35 SM 8

36 RL9K l

37 RL9E I

' 38 RL9K

'l l

39 RL9E 40 ; SM

+

I 41-RL9K l

42 RL9E 43 RL9K -

l 44 RL9E 45 SM i

46 ' $M I l

3 47 RL9K..

l 48 RL9E.

49 RL9K'

?

l 50 RL9E-

. 51 - SAM -

I 52 RL9K -

l 53 RL9E I

54 RL9K

!i l

55 RL9E -

~

56 ' SAM 57 SAM I

58 RL9K-59 RL9E 60 RL9K 1

l' 61 RL9E 62 sM 63 RL9K i

l I

64 RL9E l

SGTR-P80

-1l t

.. ~

01/23/92 08:21:19..

CADET'1,00-l estrisstr*3.ed' STEAM GENERA 70R TUBE RUPTURE' TREE 3 BLEED & FEED

-[

Pese 2 of 2 I

SGTR3 FC.

CSI ONX RMX ORC HPR ORT.

RTK; CI

..s..

'j

-65: RL9K -

'\\

l

= 66 - RL9E -

-l 67 SCS 68 SAM -

l g

'I 69 RL9K(;

70 RL9E' i

-- 73 ' gg9g /

'{

l 72 RL9E 73 SAM 8

74 RL9K il 1

3 -RL9E' E

- 76 RL9K '

-[

l 77 RL9E -

78 SAM 79 SAM i

80 RL9K l

21' RL9E

'}

82 RL9K l

83 RL9E '

'I 84 SAM i

85 RL9K l

86 ' RL9E :-

87 ' RL9K l

88 RL9E,

89 SAM -

90 SAM -

I 91 RL9K l l

92 RL9E 93 RL9K' l

94'. RL9E '

95-SAM 96 RL9K -

l-

- 97 RL9E I

98 RL9K I

99 RL9E 1

i l

e b

-i i

i

)

1 i

1

}

SGTR-P81

9 b 4 R

F y

/

I O

P F

D

/

r P

o D

O S

_Iil S

N' D

/

S p

SDO

~

l

,j

^

+

)

IE IFT SAA f:

M/L S

S y

p IF

/FO

!L IAS AOI

~

O

(

/.

YR A

r T

M N

L M

E B

U M

/

F S

S S

P L

I B

N U

O O

Q I

E T

s I

t D

n N

T e

O R

t L

r

/

S S

F F

F

[ i.

C O

o A

F p

F Y

W

. S

?

m h'

F R

P dP o

R T

A c

O N

^

E la T

n R

o P

i s

t R

P T

I S

. P F

ar G

S e

^

S p

o s

f o

P

?.

r.

.-'F k!P C

S S

F e

C b "e ml ub nac si el

~

KT

,- 8

[S F

tp S

S S

ap nA g

itso eN d"

)^

1 2

3 4

5 1

2 l'

)2 '"

)

O cs

(

i"~

(

E N

ie E

2 2

2 3) 3)

4) h)

5 Sert

)

-)

- )

-)

- D D

E I E E

G G

SReo RT RL R L R L R L R L RE RE bG R A EUmn L

L L

E A

RA-TI TI TI TI TI T

T E TM h3M-GTM CInd Clue F

F R

GF GF GF GF GF G

G G

A A

E E

E S&

S&

S A h

S UA-(

T S

S S

G R

R R

.D

- D D

SFek D

D S

ET ET ET ET ET EE EE EE EE EED Pn EE EE ER ER E R S pa S

S S

E E

E W RL RL R O R O R OW R W R W R W R W R

ll R

R R

B B

C C

C T(

T(

T( R SFAB l

1 fG. g0N 3

D

)

(

02/13/92 17:37:10 CADET 1.00 setr/:str 4.ed STEAM GENERATOR TUBE Rt.1PTURE TREE 4 - CORE DAMAGE Page 1 of 1

$GTR4 FC CSI OHX RMX ORC HPR ORT RTK CI I

1 RL6C l

2 RL7C N

SGTR-P83

))ilij ll!II l

j' l

i' 4'

i_

i le

?

i R

F F

I O

~

P F

D

/

r P

o DO S

SD

/

S F

SDO

+

)

IE IPT SAA M/L S

S F

F F

/PO IAS AOI O

(

YRA T

M N

L M

E B

U M

/

F S

S S

P L

I B

N U

O O

Q I

E T

s I

t D

n

^

N T

n e

O R

L C

O A Y

o

/

S S

F F

F S

F p

Y W

m F

R F R o

T A

c O

NE l

a T

n R

o P

i t

R P

T I

S P

F a

r G

S e

S p

o-f o

P C

S S

F P

F r.

~

e C

b "e ml

^

ub na c

O si el I:

K S

S S

F tp T

ap nA g

i t so It il,.

eN

)

s d"

1 2

3 4

5 1

2 1

2

N,"

oo cs

(

E "5

i e Sert E

2 2

2 3) 3)

4) 4)

E E

s" D

D SReo R

)

-)

)

G G

o T

R L R L RL RL R L RE RE R A A

R A EUmn R

L L

L E

E TI TI TI TI TI T

T T

T M TM Clue R

GF GF GF GF GF G

G GM F

F G

G CI nd A

A A

E E

E S&

S&

S S

SD "/

UA-T S

S S

G

.R R

R R

R D

D

'EE)

- hn D

D SFak S

E T ET ET ET ET EE EE EE EE E>7 5

S S

S R 3

- - pa E

E E

E EE EE E R E R S

E W R W R W R W R W RL RL Ro Ro RtW ll R R R

R R

R B

B C

C T(

T(

TC(R SFAB

)UO(-D'ymb Il jll!

l l,

I!lllIll ll!!!l!

l!lI!l

!t fl

?

L

CADET 1.03 02/13/92 97:37:10 setr/cstr 5.ed STEAM GENERATOR 7USE RVPTURE TREE 5 CC2E DAMAGE /NO RWST Page 1 of 1

$GTR5 FC CSI OHX RNX ORC HPR ORT RTK CI i

1 RL7s 21 2 RLTE i

3 RL7K O

& AL7E i

f 6

4 k

e.

SGTR PS5 a

=

APPENDIX B g

B.1 REVIEW OF EMERGENCY PROCEDURES FOR SGTR B.

1.1 INTRODUCTION

The Emergency Operating Procedures (EOPs) provide the bases used to determine the 1

operator actions that are included on the event tree model. Figure B-1 is a flow diagram to show the relationship between the various emergency procedures. If the operators are in a specific procedure and plant conditions indicate that a more severe condition is occurring, guidance is then provided to transfer to a separate emergency procedure that provius more detailed instructions.

For a SGTR event, reacte *f,p results due to low pressurizer pressure -or overtemperature delta-T.

Sefety injection occurs soon thereafter due to low pressurizer pressure. The reactor trip and Si signal cause the operators to enter the -

Zion EOPs at the " Reactor Trip or Safety injection" procedure (E-0). Coincident with the transfer from the E-O procedure, the operators begin to monitor the Critical Safety Functions (CSFs) via the CSF Status Trees (F-0.1 through F-0.6). Once in E-0, the operators are instructed to check for reactor trip; if reactor trip cannot be verified, the :

operators are directed to the suberiticality or Anticipated Transient Without Scram (ATWS) procedure (FR-S.1, Reference 1.14).

This type of an event sequence transfers from the SGTR plant response tree to the ATWS plant response tree. The next steps in E-0 verify the status of the safety systems which should have been activated. The only step in E-0 which transfers to another procedure during the verification of safety systems operation is the status of the auxiliary feedwater system.

WP1142:1D/030992 SGTR-P86

x B.1.2 FAILURE OF AFW - BLEED & FEED If 340 gpm auxiliary feedwater flow cannot be established, the operators are directed to implement the " Response to Loss of Secondary Heat _ Sink" procedure, FR-H.1. In FR-H.1, the operators are again instructed to attempt to restore auxiliary feedwater.

Failing this, if at least one charging pump is available and the condensate system can be placed in service, the operators are directed to attempt to establish main feedwater by starting the main feedwater pumps and aligning them for injection into the steam generators. If flow cannot be established via the main feedwater pumps to at least one SG, the operators are directed to depressurize the steam generators in order to reduce pressure below the shutoff head of the condensate booster pumps and align the condensate booster pumps to at least one SG. If feedwater flow to a SG can be restored, the level in the SG will begin increasing and the operators are instructed to return to the E-0 procedure. However, as noted in Section 3.0, even if alternate feedwater has not been established, the operator may return to E-0 due to level recovery in the ruptured SG (via the primary to secondary break flow) but will ultimately return to FR-H.1.

k if no charging pump is available but at least one Si pump is available, the' operators are instructed to immediately begin bleed and feed operations in FR-H.1. If charging is available, but alternate feedwater to at least one SG cannot be established, the operators are instructed to begin bleed and feed operations in FR-H.1 when the level in at least 3 SGs falls below 24% on the wide range indication.

In the bleed and feed operations described in FR-H.1, the operators are instructed first to verify that an ECCS high pressure injection path is available. If ECCS injection (at least one charging pump or one Si pump) is not available, the operators are instructed to return to the beginning of FR-H.1 and attempt to recover a source of feedwater.

If a high pressure injection path is established, the operators are instructed to open WP1142:1D/030992 SGTR-P87

{

both of the pressurizer PORVs and associated block valves;if both PORVs cannot be opened, the operators are instructed to open all reactor head vents, depressurize one.

steam generator to atmospheric via steam dump to the atmosphere, and align service water to the depressurized SG. The next step is to establish component cooling water flow to the RHR heat exchanger. For all cases in which FR-H.1 is entered, the operatcre are eventually placed in a ' loop' until a secondary heat sink to at least one steam generator can be established (i.e., narrow range levelindication greater than 4%). Based on priorities in implementing procedures, the operators will remain in this

' loop' until RWST level decreases to less than 13.6 feet, at which point the operators are instructed to align the ECCS system for cold leg recirculation using ES-1.3,

" Transfer to Cold Leg Recirculation", and then return to bleed and feed operations.

The only other transfer out of FR-H.1 without establishing a source of feedwater is for the scenario in which the core uncovers and begins to heatup; for this case the operators would transfer to FR-C.1, " Response to inadequate Core Cooling."

While in the bleed and feed mode of cooling, if level can be recovered in at least one steam generator, the procedures direct the operators to begin terminating high pressure safety b.: tion and closing the PORVs (i.e., terminating bleed and feed cooling mode), antil pressurizer level returns. If pressurizer level can be established and normal charging flow implemented, the operators are directed to transfer to the SI termination procedure (ES-1.1, Reference 1.15).

B.1.3 AFW AVAILABLE - NORMAL ACTIONS For the accident seqdence path in which a secondary heat sink is available (or has been reestablished), the procedures then provide criteria for stopping the RCPs (one charging pump running and RCS pressure less than 1250 psig). For a SGTR event, the pressure criteria is not expected to be met thus the RCPs would not be tripped.

The operators are then directed to the " Steam Generator Tebe Rupture" procedure WP1142:1Di030902 SGTR-P88

(E-3) once the event has been diagnosed per Step 15 of E-0. It is noted that if Si and 1

charging flow cannot be verified during previous steps in E-0, then the operators are simply instructed to align the injection path and manually start the pumps.

The first major action in E-3 is to verify that the RCPs should not be tripped. The subsequent steps in E-3 include the actions for termination of the primary to secondary break flow:

1.

Identification and Isolation of the Ruptured SG, 2.

RCS Cooldown, 3.

RCS Depressurization, 4.

ECCS Flow Termination.

First, the operators are instructed to identify the SG with the ruptured tube (via level response and/or steamline radiation), and isolate this SG from the remaining intact SGs by stopping steam flow from and feedwater flow to this SG. Steam flow from the ruptured SG is stopped by closing the Main Steam Isolation Valve (MSIV) and other associated steam paths from the ruptured SG. Alternately, the MSIVs on the intact SGs may be closed to isolate the ruptured SG from the intact SGs. The feedwater flow to the ruptured SG is stopped by terminating auxiliary or alternate feedwater flow to that SG. The only exception to this isolation is: 1) steam flow from the ruptured SG to the turbine driven AFW pump should not be stopped if this is the only AFW pump available and steam from the ruptured SG is the unly steam supply to the pump,2) feedwater flow should not be stopped but rather controlled if the ruptured SG is the only SG receiving AFW flow. Isolation of the ruptured SG is necessary before continuing with the subsequent steps, unless the ruptured SG must be used for RCS cooldown. If steam flow from a ruptured SG cannot be stopped, the operator is instructed to transfer to ECA 3.1, "SGTR with Loss of Reactor Coolant -

Subcooled Recovery."

WP1142:1D/030992 SGTR-P89

Once the ruptured SG has been isolated, there are severalinterim steps before RCS cooldown including verifying that the pressurizer PORVs are closed, verifying that no SG is faulted, verifying that a heat sink exists in the intact SGs, resetting SI, and establishing instrurnent air to containment. Next the RCS cooldown is started by dumping steam from the intact SGs to either the condenser, or if the condenser is unavailable, to the atmosphere via the atmospheric relief valves. This cooldown is necessary to establish or maintain a temperature difference between the RCS and the intact SGs for decay heat removal, plus to keep the RCS subcooled following subsequent RCS depressurization. The amount of RCS cooldown needed is dependent on the ruptured SG pressure; typically the RCS cooldown would be to a core exit temperature of approximately 515 F (based on the ruptured SG pressure being controlled to no-load conditions). Once this target temperature is attained, steam dump is utilized to control the RCS at or less than this temperature. If steam dump from the intact SGs is not possible, the operators are instructed to transfer to ECA-3.1, "SGTR with Loss of Reactor Coolant - Subcooled Recovery."

The next step is RCS depressurization. The RCS is depressurized to minimize the prirnary to secondary break flow and to refill the pressurizer. Per the shift supervisor's discretion, RCS depressurization may be done concurrently with RCS cooldown IF normal pressurizer spray is available. Otherwise, the RCS depressurization is not started until the RCS cooldown is completed. Ideally, the depressurizationis stopped when the RCS pressure is less than the ruptured SG prenure.

However, the depressurization is also stopped due to a high pressurizer level or due to a loss of RCS subcooling.

Typically, normal pressurizer spray will be used for RCS depressurization since the RCPs are not tripped; however one pressurizer PORV or auxiliary pressurizer spray can also be used to depressurize the RCS.

If RCS depressurization cannot be I

WP1142:1D/030992 SGTR-P90

o.

{

accomplished via any of these means, the operators are directed to ECA-3.3, "SGTR Without Pressurizer Pressure Control."

After RCS depressurization is complete, high pressure safety injection flow from the charging and/or safety injection pumps is _ terminated to prevent or limit RCb repressurization and reinitiation of primary to secondary break flow.

After SL termination, the RCS pressure is approximately the same as the ruptured SG pressure and the primary to secondary leakage is minimal. Normal inventory and pressure controls are established and a post-SGTR procedure, such as ES-3.1 -'" Post SGTR Cooldown Using Backfiil", would be used to complete the coofdown and depressurization of the plant to cold shutdown conditions. Using this procedure, the operators maintain the pressurizer level with normal charging and letdown while depressurizing the RCS. The ruptured SG will backfill the RCS as the pressure decreases.

The operators maintain ruptured SG level by controlling auxiliary feedwater. Other options for post-SGTR cooldown include blowdown (to radwaste) from the ruptuted SG and steam dump (to condenser or atmosphere) from the ruptured SG.

B.1.4 ECA-3.1 As noted previously, continuation of a SGTR via actions in ECA-3.1 "SGTR with Loss or Reactor Coolant, Subcooled Recovery" occurs for instances in which the ruptured SG cannot be isolated or steam dump from the intact SGs is not possible.

Another possibility of transition to ECA-3.1 is for the scenario in which SG overfill occurs, if SG overfill occurs, water will be relieved from the SG relief and/or safety valves. Since these valves are not designed for water relief, such a scenario may result in the failure of a relief or safety valve to reseat, thus resulting in an uncontrolled loss of RCS/ secondary inventory. Thus for this scenario, ECA-3.1 will be used.

WP1142:1D/030992 SGTR-P91 l

1

The actions in ECA-3.1 are very similar to those in E-3. The operators are instructed 4

to establish a 100 F/hr RCS cooldown via steam dump from the intact SGs, or the ruptured SG if the intact SGs are unavailable. Next the RCS is'depressurized to minimize the primary to secondary break flow and to refill the pressurizer. Next, two RCPs are tripped, or restarted if already tripped. The ECCS pumps are sequentially-terminated based on subcooling criteria. Specifically, first one charging pumps is stopped, then the second charging pump is aligned to the VCT for normal charging.

Finally, the last two Si pumps are stopped in order. However, the criteria for the Si termination is based on the availability of normal charging flow so establishing this normal charging is very important.

9 Once all ECCS is stopped, normal charging flow is used to control pressurizer level and the RCS is again depressurized to minimum subcooling, 30-40*F. The RCS cooldown and depressurization steps are continued until RHR conditions are attained and RHR cooldown can continue until cold shutdown conditions are reached. For the case in which SG overfill occurs and a safety valve fails to reseat, it is necessary to achieve cold shutdown in order to terminate the primary to secondary break flow and the release to the atmosphere through the open safety valve.

B.1.5 ECA-3.2 Continuation of a SGTR via actions in ECA-3.2, "SGTR with Loss of Reactor Coolant

- Saturated Recovery", occurs due to transition from ECA-3.1 on low RWST level or high level in the ruptured SG. The actions in ECA-3.2 are basically identical to ECA-3.1 except that the subcooling criteria for the RCS depressurization is relaxed in order to attain RHR conditions sooner. Additionally, the operators are instructed to initiate RWST refill upon entry into this procedure.

WP1142:1D/030992 SGTR-P92

.[

B.1.6 ECA 3.3 As noted previously, continuation of a SGTR via actions in ECA-3.3, "SGTR without Pressurizer Pressure Control", occurs for those cases in which RCS depressurization via normal spray, PORV or auxiliary spray cannot'be accomplished. ECA 3.3 instructs the operators to recover some means of RCS depressurization; failing that the operators are instructed to stop all ECCS flow except for one charging pump when the ruptured SG level rises above 70% narrow range. The remaining charging pump is then aligned to the VCT for normal charging. The RCS cooldown initiated in E-3 is maintained at 100*F/hr, and RCS depressurization to RHR cut-in is achieved via backfill, blowdown or steam dump.

During any of these RCS depressurization mechanisms, normal charging and the pressurizer heaters are utilized to maintain RCS subcooling.

RCS and SG depressurization using backfill involves using normal charging and letdown flow to depressurize the RCS thereby 'backfilling' the ruptured SG into the RCS. The ruptured SG levelis maintained via operator control of auxiliary feedwater.

RCS and SG depressurization using blowdown involves steam dump from the ruptured SG to radwaste via the blowdown isolation valve. Again, auxiliary feedwater is used to control the levelin the ruptured SG. Finally, RCS and SG depressurization using steam dump involves ~ steam dump from the ruptured SG to the condenser or the atmosphere using steam dump valves and atmospheric relief valves, respectively.

Secondary levelis maintained via auxiliary feedwater.

B.1.7 COLD LEG RECIRCULATION Since a SGTR involves a loss of primary coolant to the secondary system, and not to the containment, the only scenario in which recirculation would be necessary is during bleed and feed cooling (due to failure of AFW). In this instance, low RWST level WP1142:1D/030992 SGTR-P93

during bleed and feed cooling directs the operators to ES-1.3, " Transfer to Cold Leg

.q Recirculation",

in this procedure, the operators are first instructed to stop all but one containment spray pump. (Containment spray may have been initiated depending upon the number 1

l of operational Reactor Containment Fan Coolers (FCs)). Next the operators are I

instructed to verify that the RHR pumps and the RHR heat exchanger are available and that the containment sump levelis at least 37 inches. If these indications are not l

available, the operators are instructed to transfer to ECA-1.1, " Loss of Emergency Coolant Recirculation." If the recirculation system is operable, the operators are next instructed to check the RCS pressure to determine whether the SI pumps or charging pumps are required. For this case, one of the high pressure injection pumps will be necessary for high pressure recirculation. The operators are then directed to manually align the ECCS system for recirculation. If the containment spray system was actuated during the event, the operators are then instructed to close the isolation valves to the two cold legs from one of the operating RHR pumps and align that pump l

to the containment spray header. If these actions are successful, the plant will be maintained in a coolable core condition. If recirculation can not be implemented or maintained, the operators are instructed to transfer to the " Loss of Emergency Coolant Recirculation" procedure. Once ECCS recirculation cooling has been established, the procedures prohibit the operators from attempting to establish normal RHR cooling.

B.1.8 RWST REFILL The ECA-1.1 procedure," Loss of Emergency Coolant Recirculation", is entered if ECCS recirculation cannot be established. The operators are first instructed to initiate makeup to the RWST and then to trip all RCPs. A 100*F/hr cooldown using the steam generators is initiated using whatever means is available. If the RWST levelis greater than 5 feet, the operators are instructed to minimize containment spray flow, WP1142:1D/030992 SGTR-P94

5 and to minimize ECCS flow. The operators then begin a ' loop' between the beginning of this procedure and the minimization of ECCS flow until the RWST level falls to less than 5 feet, if the RWST level falls to less than 5 feet, all pumps taking suction from the RWST are stopped and normal charging flow from the VCT is initiated. The operators are then instructed to depressurize the steam generators to 700 psig using whatever means are available. The operators are then instructed to continue to depressurize the steam generators to 160 psig in order to actuate accumulator injection. Further depressurization of the steam generators to atmospheric pressure, after isolating or venting the accumulators, is then directed by the procedure.

l At this point a determination is to be made by the TSC concerning whether the normal RHR system can be placed in service for heat removal. If normal RHR cooling cannot be established, cold shutdown can be achieved through continued steam generator cooling if sufficient inventory is available in the VCT. If the RWST refill results in an increasing levelin the RWST above 5 feet, the operators are instructed to return to the beginning of ECA-1.1 which deals with maintaining minimum draining of the RWST via the ECCS and containment spray pumps. If the RWST level can not be restored and normal makeup cannot be established and maintained, the' accident would progress to core overheating. The final instruction in this procedure is to consult the TSC for further directions.

B.1.9 INADEQUATE CORE COOLING The operators are directed to FR-C.1, " Response to inadequate Core Cooling", by the CSF Status Tree from an indication of either 1) core exit thermocouple temperatures in excess of 1200'F, or 2) core exit thermocouple temperatures in excess of 700*F-and the Reactor Vessel Level Instrumentation System (RVLIS) narrow range reading of less than 40%. The major actions in FR-C.1 are to open'both PORVs and block valves, and the reactor vessel head vent; also depressurize all steam generators to WP1142:1D/030992 SGTR-PS5

4 atmospheric pressure. Core damage is predicted to occur for all SGTR scenarios

{

which lead to inadequate core cooling indications.

B.1.10 HIGH CONTAINMENT PRESSURE if the containment pressure exceeds 23 psig (orange path) or 47 psig (red path), the.

operators are instructed via the CSFSTs to transfer to the " Response to High Containment Pressure" procedure (FR-Z.1).

B.2 PLANT RESPONSE TREE MODELING OF EOPs The plant response tree includes operator actions that are necessary to prevent core damage and containment failure. The emergency procedures listed below were reviewed to determine the expected tasks that the operators would perform.

EOP/FRP Name Reviewed in E-0 Reactor Trip or Safety injection Table B-1 E-3 Steam Generator Tube Rupture Table B-2 ECA-3.1 SGTR with Loss of Reactor Coolant Subcooled Table B-3 Recovery ECA-3.2 SGTR with Loss of Reactor Coolant Saturated Table B-4 Recovery ECA 3.3 SGTR without Pressurizer Pressure Control Table B-5 FR-H.1 Response to Loss of Secondary Heat Sink Table B-6 WP1142:1D/030992 SGTR-P96

~

Reviewed in EOP/FRP MitrDg ES-1.3 Transfer to Cold Leg Recirculation Detailed in Human Error i

Analysis EC A-1.1 Loss of Emergency Coolant Recirculation Table B FR-S.1 Suberiticality (ATWS)

Modeled e

in ATWS Event Tree IR-C.1 Response to inadequate Core Cooling Table B-8 FR-Z.1.

Response to High Containment Pressure Table B-9 1

The EOPs/FRPs were reviewed in detail to:

l t

o Determine the key actions that the operators must perform to prevent core damage or containment failure.

o Evaluate the impact of the EOPs in terms of the frontline success criteria.

o Ensure that all appropriate alternate means to satisfy the safety functions are.

addressed.

o Ensure that the EOPs do not lead the operators to perform unnecessary tasks or allow them to enter a " logic loop" that is difficult to exit.

E WP1142:1D/030992 SGTR-P97

l-;

i o Ensure that the EOPs do not lead the operators to perform activities which could 4

worsen an event sequence which progresses to core damage.

I' s

WP1142:1D/030992 SGTR-P98

i TABLE B 1 OPERATOR ACTIONS FOR E-0 STEP IMPACT ON PLANT RESPONSE TREE MODEL

1. Verify Reactor trip Decreasing neutron _ flux and power range -

channels less than 5% will be indicated if reactor trip; otherwise transfer to ATWS plant response tree.

2. Verify Turbine trip Turbine trip and generator trip should occur on reactor trip. Turbine can be tripped manually.

This operator action is not modeled.

3. 4KV ESF Buses Availability of Engineered Safeguards Features (ESP) buses included in support state, operator

- ALL ENERGlZED actions to establish failed buses are notincluded on the event tree or in the support state model.

4. Check if St Actuated SI signal and manual actuation of Si modeled in support state.

5. Verify ESF equipment Manual actuation included in support Alignment state model.

b. Verify affected Unit's Room coolers do not need to be auxiliary building specifically modeled in system analyses cooler SW supply valve (Reference 17)

OAOV SWOO20 -open (U1)

OAOV SWOO21 -open (U2)

6. Verify BIT flow No impact on accident for failure of BIT to open.

7. Check if SI pumps should have flow:

a. RCS pressure less RCS pressure expected to bo < 1850 psig, than 1850 psig Si pumps should have flow,

b. Verify SI pump Manual action modeled in support states.

flow WP1142:1D/030992 SGTR-P99

4 TABLE B 1 i

OPERATOR ACTIONS FOR E 0 STEP IMPACT ON PLANT RESPONSE TREE MODEL

8. Check RHR pumps should have flow:

a. RCS pressure less RCS pressure expected to be greater than than 500 psig 500 psig, therefore no flow expected; CCW established for RHR mini-flow recirculation, HX isolation valves MOV-CC9412 A & B opened. CCW to HXs prevents RHR pump failure while on miniflow.

Operator actions specifically modeled.

b. Verify RHR flow RHR pumps will not have flow.

9. Verify total AFW If flow is less than 340 gpm, go to FR-H.1, flow Step 1. This action is specifically modeled.

10. Verify CS flow Containment pressure < 23 psig, therefore no spray pumps running; Go to Step 11.

11. Check RCS Avg.

If T less than 547'F verify steam Temp trending to dump valves, SG atmospheric relief valves, and main Feodwater (FW) regulating valves CLOSED; isolate steam to Main Steam Reheaters (MSRs), close MSIVs.

If T. greater than 547'F, operators would dump steam -

as described above.

12. Check PZR PORVs Open PORV(s) or active spray not expected due

& Spray to depressurization transient; action not rnodeled.

13. Transfer Steam Dump Steam dump to control Tavg via condenser to Steam Pressure-or atmospheric relief valves gives same Mode results; action not modeled.

l i

WP1142:1D/030992 SGTR-P100 i

l i

P TABLE B-1 (continued)

OPERATOR ACTIONS FOR E-0 STEP IMPACT ON PLANT RESPONSE TREE MODEL i

14. Check if RCPs should RCS pressure expected to be greater be stopped than 1250 psig; RCPs not stopped. inadvertent trip of RCPs considered in Node DP via inability to use normal spray for RCS depressurization.

15. Go to E-3 Steamline radiation, pressure and rising SG level will cause transfer to EOP E-3.

]

i WP1142:1D/030992 SGTR-P101

4 TABLE B 2 OPERATOR ACTIONS FOR E-3 SIEP IMPACT ON PLANT RESPONSE TREE MODEL

1. Notify Support Personnel Action not modeled, task will not impact progression of event nor success criteria.

2. Stop RCPs RCS pressure expected to be greater than 1250 psig; RCPs not stopped. Inadvertent trip of RCPs considered in Node DP via inability to use normal spray for RCS depressurization.

3. Identify Ruptured SG Ability to identify ruptured SG affects time available to perform actions to stop SGTR break flow.

Action modeled as part of isolation steps in PRT.

4. Close Ruptured SG MSIV Action specifically modeled in PRT.

If Ruptured SG MSIV can not be closed, close intact SGs MSIVs; this action specifically modeled in PRT.

If any ruptured SG can not be isolated from intact SGs, Go to ECA-3.1; this action specifically modeled in PRT.

5. Isolate Flow from Action modeled in PRT as part of operator Ruptured SG -

action to close MSiV (Step 4), thereby isolating ruptured SG from intact SGs.

- Close ARV

- Close TD AFW pump Steam Supply

- Close Blowdown isolation Valve

6. Isolate AFW Flow to Action Specifically Modeled in PRT.

Ruptured SG

7. Check PZR PORVs PZR PORVs not expected to be open due and Block Valves to RCS depressurization; action not modeled.

WP1142:1D/030992 SGTR-P102

4 I

TABLE B-2 (continued)

OPERATOR ACTIONS FOR E-3 STEP IMPACT ON PLANT RESPONSE TREE MODEL

8. Check for Faulted SG Secondary break not expected as consequential event; action not modeled.

9. Control intact SG Level Level should be stable with AFW flow; failure of AFW modeled in E-0. Action not modeled here.

10. Verify AC Buses Actions to ensure service air and

- Energized by instrument air in the event of a loss Offsite Power of offsite power are not specifically modeled.

11. Reset St If offsite power is lost after Si reset, some safeguards equipment would have to be restarted; the probability of a loss of offsite power during this time intervalis small and not modeled. Action not modeled.

12. Establish Instrument Action not specifically modeled; task will air to containment not impact progression of event nor success criteria.

13. Check Ruptured SG Press Pressure expected to be controlled to

- LESS THAN 600 PSIG no-load Temp, thus greater than 600 psig.

However, if SG overfill occurs, failure to reseat of a safety valve may result in response obtained and transfer to ECA-3.1; action specifically modeled via SG overfill.

14. Initiate RCS cooldown Action specifically modeled in PRT.

via steam dump from Intact SGs

f. Begin concurrent Action not modeled; assumption in PRT that RCS depressurization RCS cooldown complete prior to RCS if normal spray depressurization available -

WP1142:1D/030992 SGTR-P103 1

a

i TABLE B-2 (continued)

OPERATOR ACTIONS FOR E-3 ETfP IMPACT ON PLANT RESPONSE TREE MODEL

{

1S. Check Ruptured SG Press Action implicitiy modeled via transfer i

- STABLE OR INCREASING; to ECA-3.1 after SG overfill, failure of safety valve to ressat and ruptured SG depressurization.

16. Check RCS Subcooling Action implicitly modeled via

- GREATER THAN 30'F consideration of RCS cooldown in Step 14 and SG overfill.

17. Check if RCS Depress Action not model6d, Concurrent RCS should be stopped,IF depressurization not assumed.

in progress

18. Depress.we RCS Action specifically modeled in PRi.

If RCS depressurization can not be performed, transfer to ECA-3.3; action specifically modeled in PRT.

l

19. Stop RCC Depress Action specifica!!y modeled as part of Step 18.

20. Check RCS Pressure Failure to stop RCS depressurization s

- INCREASING not specifically modeled; task will not impact progression of event' nor success criteria.

l

21. Check. for Si termination Action specifically modeled in PRT as part of Step 22.

If criteria for Si termination not met, go to ECA-3.1; action specifically modeled in PRT via SG overfill.

22. Stop all ECCS Pumps Action specifically modeled in PRT.

but one charging pump

23. Close IVSW Injection to Action implicitly modated in PRT as part i

Letdown and RCP Seal of Step 24 to establish normal charging.

Return Lines WP1142:1D/030992 SGTR-P104 9

9k t

TABLE B-2 (continued)

OPERATOR ACTIONS FOR E-3 STEP IMPACT ON PLANT RESPONSE TREE MODEL i

24. Establish Normal Action specifically modeled in PRT.

Charging Flow with remaining charging pump f

NOTE: Successful completion of these 24 steps will result in termination of primary to secondary break flew, and a ' successful' end state.

Otherwise,- the operators will be in a different EOP.

Thus there will be no further.

consideration of E-3.

r r

L i

t P

f l

}

i WP1142:1D/030992 SGTR-P105

w d

TABLE B-3 OPERATOR ACTIONS FOR ECA-3.1 -

STEP IMPACT ON PLANT RESPONSE TREE MODEL

1. Reset SI Action not specifically modeled in PRT.

~

See Step 11 in E-3.

r

2. Verify all AC Buses Action to ensure service air and

- Energized by instrument air in the event of a loss Offsite Power of offsite power are not specifically modeled.

3. Establish Instrument Air Action not specifically modeled; task will to Containment not impact progression of event nor success criteria.

4. Check Containment Spray Spray pumps not expected to be running;

- pumps running Go to step 5.

5.' initiate Evaluation of Action not modeled; task will not impact Plant Status progression of event nor success criteria.

6. Check for Faulted SG Secondary break not expected as consequential event; action not modeled.

-l

7. Controlintact SG Level Level should be stable with AFW flow; failure of.

AFW modeled in E-0. Action not modeled here.

8. Initiate RCS Cooldown Action to initiate RCS cooldown with with intact SGs OR intact SGs specifically modeled in PRT.

ruptured SG OR RHR

'l

9. Check RCS Subcooling Action modeled implicitly as a necessity :

- GREATER THAN 30'F '

before next modeled operator action:

ECCS reduction.

10. Check for transfer to Action implicitly modeled in PRT via ECA-3.2:

SG overfill.

- RWST Level > 19.5 ft

- SG Level > 96% NR WP1142:10/030992 SGTR-P106

j TABLE B-3 (Continued)

OPERATOR ACTIONS FOR ECA-3.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL

11. Check if ECCS in Service Action not specifically modeled; task will not impact progression of event nor success criteria.

12. Turn off PZR Heaters Action not specifically modeled; task will not impact progression of ever,' nor success criteria.

13. Depressurize RCS to fill PZR Action not specifically modeled in PRT. Once in ECA-3.1, only RCS cooldown and ECCS reduction to 1 high pressure injection pump is considered.

14. Check RCP Cooling RCP Cooling expected; action not specifically modeled.

15. Start /Stop 2 RCPs insignificant impact on transient; only impact on normal spray capability. Action not modeled.

I

16. Stop 1 Charging Pump Action specifically modeled in PRT as part of Si reduction step.

17. Check if Normal Charging Action not specifically modeled in PRT.

should be established Once in ECA-3.1, only RCS cooldown and ECCS reduction to 1 high pressure injection pump is considered.

18. Close IVSW Injection to Action not specifically modeled in PRT.

RCP Seal Water Return Once in ECA-3.1, only RCS cooldown and ECCS Valves reduction to 1 high pressure injection pump is considered.

19. Establish Normal Action not specifically modeled in PRT.

Charging Flow Once in ECA-3.1, only RCS cooldown and ECCS' reduction to 1 high pressure injection pump is considered.

20. Stop 1 Si Pump Action specifically modeled in PRT as part of SI reduction step.

WP1142:1D/030992 SGTR-P107 i

i TABLE B-3 (continued)

OPERATOR ACTIONS FOR ECA-3.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL h

-6

21. Stop Last St Pump Action specifically modeled in PRT as part of Si reduction step.

NOTE: Successful RCS cooldown and reduction of ECCS to 1 high pressure injection pump will result in Success with Accident Management (SAM) end state; no further steps are considered.

r 1

r t

WP1142:1D/030992 SGTR-P108 t

- ~

k

(

TABLE B-4 OPERATOR ACTIONS FOR ECA-3.2 STEP-IMPACT ON PLANT RESPONSE TREE MODEL 1.

Initiate Makeup to RWST Action specifically modeled in PRT.

2.

Check for Faulted SG Secondary break not expected as consequential event; action not modeled.

3.

Cc-. trol intact SG Level Level should be stable with AFW flow; failure of AFW modeled in E-0. Action not modeled here.

4.

Initiate RCS Cooldown Action to initiate RCS cooldown with with intact SGs OR intact SGs specifically.modeled in PRT.

ruptured SG OR RHR 5.

Check RCS Subcooling Action modeled implicitly as a necessity

- GREATER THAN 30*F before next modeled operator action:

ECCS~

Reduction.

6.

Check if ECCS in Servico Action. not specifically modeled; task will not impact progression of event nor success criteris.

7.

Turn off PZR Heaters Action not specifically modeled; task will not impact progression of event nor success criteria.

8.

Depressurize RCS Action not specifically modeled in PRT.

(to fill PZR)

Once in ECA-3.2, only RWST refill or RCS cooldown and ECCS reduction to 1 high pressure injection pump considered.

9.

Check RCP Cooling RCP Cooling expected; action not specifically modeled.

10. Start /Stop 2 RCPs insignificant impact on transient;.only linpact on normal spray capability. Action not modeled.

~

11. Stop 1 Charging Pump Action specifically modeled in PRT as part of Sl~

reduction step.

i WP1142:1D/030992 SGTR-P109

.e.

4 -

.(

TABLE B-4 (continued)

OPERATOR ACTIONS FOR ECA-3.2 STEP IMPACT ON PLANT RESPONSE TREE MODEL

12. Check if Normal Charging Action not specifically modeled in PRT.

should be established Once in ECA-3.2, only RWST refill _ or RCS cooldown and ECCS reduction to 1 high pressure injection pump considered.

13. Close IVSW Injection to Action not specifically modeled in PRT.

RCP Seal Water Return Once in ECA-3.2, only GWST refill or Valves RCS cooldown and 'iCCS reduction to 1 high pressure injection pump considered.

14. Establish Normal Action not specifically modeled in PRT.

Charging Flow Once in ECA-3.2, only RWST refill or RCS cooldown and ECCS reduction to 1 high pressure injection pump are considered.

'!. Stop 1 Si Pump Action specifically modeled in PRT as part of Si reduction step.

16. Stop Last S1 Pump Action specifically modeled in PRT as part of Si reduction step.

NOTE: Successful RCS cooldown and reduction of ECCS to 1 high pressure injection pump will result in Success with Accident Management (SAM) end state; no further steps are considered.

6 WP1142:10/030992 SGTR-P110

w i

TABLE B 5 OPERATOR ACTIONS FOR ECA-3.3 STEP IMPACT ON PLANT RESPONSE TREE MODEL 1.

Check Ruptured SG Level Assume level at or near 70% by the time

~

- less than 70%

ECA-3.3 implemented or during unsuccessful attempt to restore pressurize pressure control; therefore go to Step 10.

NOTE: Steps 2 through 7 involve establishing pressurizer pressure. control. These actions are not modeled in the PRT since it is assumed that there is no pressurizer pressure control.

8.

Control Intact SG Level Level should be stable with AFW flow; failure of AFW modeled in E-0. Action not modeled here, 9.

Check PRZR Level Level not expected in pressurizer without

- GREATER THAN 4%

PRZR pressure control, Go to next step.

10. Check for Si termination Action specifically modeled in PRT as part of Step 11.

11. Stop all ECCS Pumps Action specifically modeled in PRT.

but one charging pump

12. Close IVSW Injection to Action implicitly modeled in PRT as part i

Letdown and RCP Seal of Step 13 to establish normal charging.

Return Lines i

13. Establish Normal Action specifically modeled in PRT.

Charging Flow with l

remaining charging pump I

NOTE: Successful completion of these 13 steps will result in termination of primary to secondary break flow, and a ' successful' end state. Thus there will be no

-i further consideration of ECA-3.3.

WP1142:1D/030992 SGTR-P111 J

a.

[

TABLE B.6 OPERATOR ACTIONS FOR FR-H.1 SIf,E IMPACT ON PLANT RESPONSE TREE MODEL

1. Check for Secondary RCS Pressure > SG Pressure, therefore Heat Sink operator stays in FR-H.1.

2. Try to Establish AFW Flow Manual actuation of AFW modeled in -

fault trees.

3. Stop all RCPs Action modeled in subsequent action to initiate RCS deed and feed.

4. Check if at least.1 Action specifically modeled in PRT; charging ~ pump available if no charging pump available, go to Step 14 and begin bleed and_ feed.

5. Check for Offsite Power Action not modeled in PRT; task will not impact event progression nor success criteria.

6. Check Condensate System Action. modeled as part of action to establish alternate feedwater.

7. Align Safeguards for Action modeled,as part of action FW pump to establish alternate feedwater.

8. Check Condenser Hotwell Action modeled as part of action

^

level to establish alternate feedwater.

- GREATER than (-) 30 in.

9. Establish Main FW Flow Action specifically modeled in PRT.

to at least 1 SG If FW pump can not be started, go to Step 11.

10. Check SG Level Action specifically modeled in PRT; if GREATER THAN 4%

Step 9 successful, return to E-0.

Otherwise continue with FR-H.1.

WP1142:1D/030992 SGTR-P112

(

TABLE B.6 (continued)

OPERATOR ACTIONS FOR FR-H.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL j

l

11. Establish Flow from Action modeled as part of action to -

l Condensate System establish alternate feedwater..

12. Check SG Level Action specifically modeled in PRT; if GREATER THAN 4%

Step 11 successful, return to E-0.

Otherwise i

continue with FR-H.1.

NOTE: Due to return of level in ruptured SG, operator may transfer back to E-0.

However, loss of levelin all 4 SGs following attempted RCS cooldown will return operator to FR-H.1

13. Check SG Level:

Action specifically modeled in PRT;

- <24% in 3 SGs go to next step. If > 24%, operator will continue attempts - to establish alternate-feedwater.

14. Initiate Manual SI High pressure injection already modeled.

15. Verify ECCS injection High pressure injection already modeled.

path

16. Establish RCS Bleed path Action specifically modeled in PRT.

17. Verify RCS Bloed path Action modeled as part of Step 16.

l

18. Maintain RCS heat Action not specifically modeled; task will I

removal not impact event progression nor success criteria.

19. Open CC water from RHR Action specifically modeled in PRT.

HX isolation valves l

Action not specifically modeled; task will not 20.' Reset St l.

l impact event progression nor success criteria.

21. Establish Instrument Air Action not specifically modeled; task will to. Containment not impact event progression nor success criteria.

WP1142:1D/030992 SGTR-P113

,c.

?-

TABLE B.6 (continued)

OPERATOR ACTIONS FOR FR-H.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL

22. Continue attempts to Action to establish alternate feedwater establish heat sink after bleed and feed initiation not modeled; see also Section 3.0.

23. Check SG level No SG levelif heat sink not established; return to Step 22.

Operator remains ' caught' between Steps 22 and 23 until RWST low level alarm. At this time, transfer to ECA-3.1, Cold Leg Recirculation.

9 NOTE: Operator may continue with FR-H.1 due to level in the ruptured SG.

Subsequent actions include closing PORVs, and sequentially stopping ECCS pumps. However, lack of RCS cooldown capability will result in reinitiation-of bleed and feed.

WP1142:1D/030992 SGTR-P114

h

/

TABLE B-7 t

OPERATOR ACTIONS FOR ECA-1.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL 1.

Try to Restore ECCS Action not specifically modeled; task will Recirculation Equipment not impact event progression nor success criteria.

)

l 2.

Initiate Makeup to RWST Discussed separately.

]

Using Appendix A 3.

Stop All RCPs RCPs expected to be stopped, action not modeled.

1 4.

Initiate RCS Cooldown RCS cooldown already initiated, action not to Cold Shutdown modeled.

j 5.

Verify RCFCs -RUNNING Fault tree models RCFCs running in low IN LOW SPEED speed.

6.

Check RWST Level-If less than 5 feet go to step 12.

GREATER THAN 5 FEET 7.

Minimize Containment Spray Flow, if Activated:

a. Check CS - ACTIVATED CS expected to be activated,if not go to step 8.

l l

b. Check containment Containment pressure expected to be less L

pressure LESS than than 47 PSIG (if not stop all but two CS 47 PSIG pumps; go to step 8).

c. Check containment Containment pressure expected to be less pressure LESS than than 23 PSIG if ECCS injection is 23 PSIG successful (if not and if at least 3 RCFCs are running in LOW speed, then stop all CS pumps).

d. Roset Phase B Action not modeled; task will not impact event progression nor success criteria.

e. Stop all CS pumps Action not specifically modeled, but flow rate would depend on no CS pumps operating.-

8.

Reset St Action not modeled; task will not impact event progression nor success criteria.

WP1142:1D/030992 SGTR-P115

___ _ __________ _ __z______ _ __________

w.

1 i

4 4'~

TABLE B-7 (continued)~

H OPERATOR ACTIONS FOR ECA-1.1 l

STER IMPACT _ON PLANT RESPONSE TREE-MODEL I

9. Minimize ECCS flow Action specifically modeled in refill

' ~

operator actions.

i

10. Verify Adequate ECCS flow Action not specifically. modeledi task will not i

impact progression of event nor success criteria, o

11. Check RWST Level-If greater than 5. feet return to step 1, observe LESS Than 5 feet caution which states that "If ECCS recirculation -

capability is restored during this; procedure, further actions should continue by returning to procedure and step in effect.'. lf suction source is lost to any ECCS o'r spray pump, the pump must:

be stopped." - Action not specifically modeled.

q

12. Stop Pumps Taking Suction Action not specifically modeled; task will

g From RWST

-not impact progression of event nor success criteria.

13. Maximize Makeup to VCT Action not specifically modeled; task will not.

3 impact progression of event nor success criteria.

14. Establish Normal Charging Action modeled in refill node on PRT.

1 Flow

15. Depressurize All Intact SGs RCS already depressurized below 700 PSIG.

to 700 PSIG at maximum rate l

16. Depressurize All Intact SGs Action not specifically modeled; task.will 9

. inject Accumulators not impact progression' of event nor success criteria.

1_

Energize and close all SI Action not specifically modeled; task will 7

Accumulator Isolation not impact progression of. event nor success 1

criteria.

g Valves

)

WP1142:1D/030992 SGTR-P116

6 TABLE B-7 (continue'd) i i-OPERATOR ACTIONS FOR ECA-1.1 STEP IMPACT ON PLANT RESPONSE TREE ' MODEL'

18. Initiate Depressurization of RCS cooldown already initiated.

intact SGs to Atmospheric Pressure j

19. Check if RHR should be Action implicitly modeled in refill placed in service operation in PRT.

l 6

h v

WP1142:1D/030992 SGTR-P117

i

'i TABLE B-7 (continued)

OPERATOR ACTIONS FOR ECA-1.1 APPENDIX A STEP IMPACT ON PLANT RESPONSE TREE MODEL

1. Refill RWST Using Any Method Available Refill RWST using blender Method included as part of refill node makeup on PRT.

1. Close makeup injection to VCT isolation valve FCV-VC01118

2. Close makeup injection to charging pump header isolation valve FCV-VC0110B

3. Locally open blender to RWST stop VC-8434

4. Lacally_ open blender isolation to RWST VC-8434.

5. Adjust makeup controls for MAXIMUM primary water and boric acid flows

6. Start makeup flow Refill RWST from other Unit's RWST:

Gravity feed by opening Method included as part of refill node refueling water purification on PRT.

pump suction from RWST valves 1SF8758 and 2SF8758 OR Use portable sump pump Method NOT included, since item above was included and this is an OR statement.

OR-Use refueling water Method NOT included, since item above was purification pump included and this is an OR statement.

WP1142:1D/030992 SGTR-P118

~,

i TABLE B-7 (continued)

OPERATOR ACTIONS FOR ECA-1.1 APPENDIX A IMPACT ON PLANT RESPONSE TREE MODEL STEP Refill RWST from spent Method included as part of refill node fuel pit on PRT.

1 Consult TSr an refilling These methods were NOT included since RWST from:

they are not borated and the TSC is to be consulted prior to using.

Primary Water

- Domineralized Water

- Fire Water i

I 4

t I

N WP1142:1D/030992 SGTR-P119

1 i

'I TABLE B 8 OPERATOR ACTIONS FOR FR-C.1 NOTE: FR-C.1 actions not modeled on PRT (See assumptions in section 3.0). The description of actions are included here for completeness.

STEP IMPACT ON PLANT RESPONSE TREE MODEL 1.

Verify ESF Equipment Recovery of ESF equipment not Lineup specifically modeled on PRT; task will not impact event progression nor success criteria.

b. Verify affected Room coolers do not need to be Unit's Aux Building specifically modeled in system

[

coolers SW supply analyses (Reference 17).

open 2.

Verify Bit Flow if BIT flow cannot be verified, then operators.

start charging pumps and align valves.

Action not modeled.

3.

Check if Si pumps should Credit for manual action included have flow in support state model.

4.

Check if RHR pumps should Credit for manual action included have flow in support state model.

5.

Check RCP support conditions RCPs will probably be stopped. No available impact on accident; action not modeled.

6.

Align SI Accumulators Accumulators are assumed to discharge if

. pressure is _<_650 psig; accumulators already aligned; manual alignment not modeled.

7.

Check Core Cooling

a. Exit TCs < 1200*F If TCs > 1200*F, go to step 8.

b. Check Reactor Vessel Level Instrumentation (RVLIS)

- narrow range Action not modated; task will not available impact event progression nor success criteria.

WP1142:1D/030992 SGTR-P120

+

i

-[

TABLE B-8 (Continued)

OPERATOR ACTIONS FOR FR-C.1 SlEE IMPACT ON PLANT RESPONSE TREE MODEL

c. RVLIS narrow range - greater than 40% (50% adverse if increasing return to step 1.

~

containment)

If RVLIS either not available or decreasing go to 7.e.

d. Return to procedure and if inadequate core cooling, then step in effect would not return to step in effect.

e. Check core exit TCs -

If decreasing return to step 1, if less than 700 F decreasing go to step 8.

Step 7 not specifically modeled as actions in steps 1-through 6 are not modeled.

8.

Check Containment Hydrogen

a. notify Rad Chem to align Rad Chem is notified to sample hydrogen analyzer containment for hydrogen concentration. This action is not modeled.

b. Hydrogen concentration if greater than 0.5%, consult TSC for actions to reduce hydrogen concentration. This step should be evaluated (what will TSC do?).

9.

Reset SI Action not specifically modeled; task will not impact progression of event nor success criteria.

10. Check Intact SG Levels Action not required or modeled; task will not impact progression of event nor success criteria.

l

11. Check RCS Vent Paths Action to close vent paths not specifically modeled on event tree.

12. Depressurize all intact Action not required or modeled; task SGs to 160 psig will not impact progression of event nor success criteria.

q WP1142:1D/030992 SGTR-P1 1

~

I TABLE B-8 (Continued)

OPERATOR ACTIONS FOR FR-C.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL

13. Close all SI Accumulator Action not modeled; task will not Isolation Valves impact progression of event nor success criteria.

14. Stop all RCPs RCPs should be stopped or not functional, action not modeled.

15. Depressurize all intact This would be a continuation of SGs to atmospheric depressurization in ES-1.3; action not modeled.

16. Verify ECCS flow Credit for manual action is included in support state model.

17. Check Core Cooling

a. Core exit TCs < 1200 F If Core exit TCs stable or decreasing and RVLIS greater than 70% (adverse) then go to step 18. If > 1200*F go to step 19. Action not modeled.

18. Go to E-1 Only if conditions on core cooling are okay.

19. Core Exit TCs < 1200 F If > 1200*F, perform the following:

start RCPs, open PORVs and block valves, open reactor head vent valves.

Operator action to open PZR PORVs specifically modeled.

20. Depressurize all intact Minimal impact and not modeled.

SGs to Atmospheric 21 Check if SI Accumulators Accumulators expected to inject should be isolated.

for most cases; action not modeled.

22. Check if RCPs should be RCPs not expected to be operable.

stopped.

Action not modeled.

WP1142:1D/030992 SGTR-P122

(-

TABLE B-8 (continued)

OPERATOR ACTIONS FOR FR-C.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL

23. Verify ECCS flow Verification action not specifically modeled.

24. Check core cooling if inadequate, return to step 19.

May continue indefinitely in procedure if-core cooling cannot be established.

25. Go to E-1, Step 11 if step 19 successful, and RHR pumps have flow, would return to E-1.

t E

'h 8

WP1142:1D/030992 SGTR-P123

i TABLE B-9 OPERATOR ACTIONS FOR FR-Z.1 NOTE: FR Z.1 actions not modeled on PRT (See assumptions in section 3.0). The description of actions are included here for completeness.

STEP IMPACT ON PLANT RcSPONSE TREE MODEL 1.

Verify containment isolation Not modeled on event tree until and IVSW injection containment isolation is addressed.

2.

Verify RCPs - off Action not modeled; task will not impact event progression nor success criteria.

3.

Verify CS flow Manual start of pumps included in system analysis, operator action not modeled on.

event tree.

4.

Verify RHR aligned for RHR spray recirculation not required -

for containment heat removal for initial 24 spray hours of event;. action not modeled.

5.

Verify proper RCFCs Manual start of non-running RCFCs operation included in system analysis, operator action not modeled on event tree.

6.

Verify MSIVs & bypass Action not specifically modeled on valves closed event tree, MSIVs expected to close on Phase B isolation.

7.

Check if faulted SGs are Not expected and action is not isolated and modeled.

verify feedwater system isolated Action r.ot specifically modeled on event tree.

8.

Check Containment Hydrogen

a. notify Rad Chem to align Rad Chem is notified to senole containment for hydrogen concentration. This action is not modeled.

i o

1 WP1142:10/030992 SGTR-P124 1

d TABLE B-9 OPERATOR ACTIONS FOR FR-Z.1 STEP IMPACT ON PLANT RESPONSE TREE MODEL i

b.-Hydrogen concentration if greater'than 0.5%, consult TSC for actions to reduce hydrogen concentration. This step should be evaluated (what will TSC do?).

i 9.

Periodically Monitor Action not modeled; task will not Hydrogen in Containment impact progression of event nor success criteria.

l WP1142:1D/030992 SGTR-P125

-l

i I

i i

j Figure'B.1 [Page 1 of 2]

Flow of Zion EOPs For SGTR i

FR S.1; RESPONSE TO -

.I E-0; REACTOR TRIP OR $AFETY INJECTION NUCLEAR POWER CENERATION Step 1 - Failure of Reactor Trip

[ Power Range > 5%)

c-Step 9 - Loss of Heat Sink FR-H.1; RESPONSE 70 Loss 0F SECONDARY HEAT $1NK (AFW Flow < 340 ppm)

Step 15 - SGTR Diagnosis (Steamline red./Hi SG level)

E 3; STEAM GENERATOR TUBE RUPTURE F-0; CRITICAL SAFETY i

E 3; STEAM GENERATOR TUBE RUPTURE FUNCTION STATUS TREES Step 0 Begin Monitoring Critical Safety Ftnetions ECA-3.1; SGTR w/ LOSS OF Step 4 - No R @tured SG isolation REACTOR COOLANT -

SU8C00 LED RECOVERY Step 14 - No Intact SGs Available for RCS Cooldown Step to - High SG Level Step 15 - Ruptured SG Depressur.

or Low RWST Level

($G Overfill, Safety Valve Fallure to Reseet) l Step 18 - No Prtr Pressure control ECA 1.2; SGTR w/ LOSS OF (Failure of Normal Spray, REACTOR COOLANT -

Aux Sprey, & PORVs)

SATURATED RECOVERY ECA-3.3; SGTR WITHOUT PRESSURIZER PRESSURE CONTROL i

WP1142:10/030992-SGTR-P126

Figure B.1 (Page 2 of 2) 1 Flow of Zion EOPs For SGTR FR 5.1; RESPONSE To F-0; CRITICAL SAFETY FUNCTIONS NUCLEAR POWER GENERATION F.0-1

- SU6 CRITICALITY (Power Range > 5%)

FR-C.1; RESPONSE TO F.0-2

- CORE C00 LING

[T/C > 1200 F)

INADEQUATE CORE COOLING F.0 3

HEAT SINK

[AFW Flow > 340 gpm)

FR H.1; RESPONSE TO Loss F.0-6

- INTEGRITY 0F SECONDARY HEAT $1NK

[RCS Press /Tertp Limits)

F.0 5 CONTAINMENT ICTMT Press. > 47 psig)

FR P.1; RESPONSE TO PRESSURIZED THERMAL SHOCK F.0 6 INVENTORY (No irrnediate Actions Req'c0 FR Z.1; RESPONSE TO HIGH CONTAINMENT PRESSURE FR-H.1; LOSS OF SECONDARY ES 1.3; TRANSFER TO COLD HEAT SINK

->~

LEG RECIRCULATION Step 0 - Transfer to cold Leg Recirc.

[RwST Levet < 13.6 ft.]

c i

ES 1.3; TRANSFER TO COLD LEG RECIRCULATION ECA 1.1; LOSS OF EMERG.

Step 3 - Inadequate Stanp Lent COOLANT RECIRCULATION (Surp Level < 37 inches)

Step 8/9-No RNR Ptrps Aligned

[No RNR Train Operable) l i

WP1142:1D/030992 SGTR-P127

ML20059H887

Contents

Text

9.0 REFERENCES

9.0 REFERENCES

1.1 INTRODUCTION

Navigation menu

ML20059H887

Text

9.0 REFERENCES

9.0 REFERENCES

1.1 INTRODUCTION

Navigation menu

Search