Text

Rev 0 to Zion Nuclear Power Station Units 1 & 2 Success Criteria Notebook Steam Generator Tube Rupture
	ML20059K919
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	03/31/1992
From:	Astleford R, Holderbaum D, Osterrieder R; COMMONWEALTH EDISON CO.
To:	;
Shared Package
ML19303F780	List: ML20059H852; ML20059H873; ML20059H887; ML20059J113; ML20059K919;
References
	NUDOCS 9402020354
	Download: ML20059K919 (87)
	v • d • e

,

I COMMONWEALTH EDISON COMPANY ZION NUCLEAR POWER STATION UNITS 1 AND 2 SUCCESS CRITERIA NOTEBOOK STEAM GENERATOR TUBE RUPTURE

' MARCH 1992

.\\

REVISION O Prepared by Individual Plant Evaluation Partnership (IPEP)

Authored by:

Date: 2-/D'?Z-D. Fpolderbaum Reviewed by: A. G 0Nd Date:

//

R R. A. Osterrieder N [ dY Date: 8/M///-

Reviewed by:

R. D. Astleford

/

' Date: 3fbf17--

Approved by:

/

-M. J. toftus Accepted by:.

14 Date:

4

~s dordmonwealth Egn Company L

9402020354 931021

.PDR ADOCK 05000295 P

PDR 4

WP1145:1D/030992 c('

I.

COMMONWEALTH EDISON ZION NUCLEAR POWER STATION UNITS 1 AND 2 STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA NOTEBOOK TABLE OF CONTENTS Section Eggg

1.0 INTRODUCTION

SGTR-S1 2.0 SUCCESS CRITERIA SGTR-S1 2.1 ECCS injection SGTR-S1 2.2 Manual SI Initiation SGTR-S3 2.3 Auxiliary Feedwater SGTR S3 2.4 Alternate Feedwater

. SGTR-S7 2.5 Operator Action to implement Alternate Feedwater SGTR-S8 2.6 Steam Generator Isolation SGTR-S10 2.7 Operator Action to isolate Ruptured Steam Generator SGTR-S13 2.8 RCS Cooldown SGTR-S15 2.9. Operator Action for RCS Cooldown SGTR-S17 2.10 RCS Depressurization SGTR-S19 2.11 Operator Action to Depressurize RCS SGTR-S21 2.12 Operator Action to Reduce ECCS Injection SGTR-S22 2.13 Operator Action to Establish Normal Charging SGTR-S25 2.14 Normal Charging SGTR-S26 2.15 Bleed and Feed SGTR-S27 2.16 Operator Action for Bleed and Feed SGTR-S28 2.17 RCFC Operation SGTR S28 2.18 Containment Spray Actuation and Operation SGTR-S30 2.19 RHR Heat Exchanger Cooling SGTR-S32 2.20 Operator Action to Establish RHR Heat Exchanger Cooling SGTR-S33

~

2.21 ECCS Recirculation SGTR-S34 2.22 Operator Action to Establish ECCS Recirculation SGTR-S35 2.23 RWST Refill SGTR-S38 2.24 Operator Action to Establish RWST Refill SGTR-S40 3.0

SUMMARY

SGTR-S42 4.0 ACCIDENT MANAGEMENT /IPE INSIGHTS SGTR-S50 1

5.0 REFERENCES

SGTR-SS1 1

WP1145:1D/030992 i

t STEAM GENERATOR TUBE RUPTURE SUCCESS CRITERIA NOTEBOOK

1.0 INTRODUCTION

A steam generator tube rupture (SGTR) event is the ruptJre of a single steam generator tube. For Zion, the rupture is considered to be a double-ended break of a single tube which results in a break area of 0.003276 sq. ft. This break area corresponds to the Model 51 steam generator tube diameter of 0.775 inches and is assumed to exist at the top of the tube sheet on the cold leg side of the steam generator.

Given this definition of a SGTR, the success criteria for the various systems and operator actions can be identified as summarized below.

2.0 SUCCESS CRITERIA 2.1 ECCS injection Question: What is the minimum ECCS injection capability required for successful.

core cooling during the initialphase of the accident, without any operator actions?

i Answer:

For cases with AFW available, ECCS injection is not needed to ensure adequate core cooling provided that the ruptured SG can be isolated. For cases with failure of AFW, at least one high pressure injection pump is necessary to provide successful core cooling.

Question: What is the mission time for the ECCS injection pumps?

I WP1145:1D/030392 SGTR-S1 w

i Answer:

The mission time for the ECCS injection pumps is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Discussion:

Analyses from Reference 1 (Cases 1 and 2) indicate that for the scenario in which all high pressure injection fails, the RCS pressure will decrease to near the secondary.

pressure, ultimately resulting in the reduction of the primary to secondary break flow.

Provided that the ruptured SG can be isolated, the RCS and ruptured SG pressures will equilibrate and the break flow will be terminated. If feedwater flow control can also be provided, the decay heat is removed via primary to secondary heat transfer in the intact SGs, and the plant will be in an equilibrium condition.

i Other analyses from Reference 1 (Cases 3 and 4) indicate that for the scenario in which AFW fails, the operation of one charging or one safety injection pump is sufficient to maintain adequate core cooling. The analyses indicate that the RCS pressure equilibrates at a pressure below the shutoff head of the respective ECCS high pressure injection pumps such that the outgoing break flow is matched by the incoming SI flow thereby removing the decay heat.

in all cases with ECCS injection, the ECCS pump (s) are required to deliver flow to two of the four cold legs; this is based on the ECCS injection success criteria developed for the large LOCA in Reference 8.

The requirements for ECCS injection for the SGTR event are identical whether the emergency AC power buses are energized from offsite sources or from the diesel generators. In the case of offsite power available, the pumps would deliver flow to the RCS within 5 seconds of the Si signal, in the case of offsite power not available, the pumps would deliver flow to the RCS within 25 second of the Si signal (Reference 2). Analyses (Reference 3) show that this delay in Si actuation would not WP1145:1D/030992 SGTR-S2

impact core cooling for a LOCA; this conclusion is also applicable to the SGTR event.

I Tbt s, the power source for the ECCS pumps is not significant for the SGTR event.

The missi.~1 time for the ECCS injection pumps is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This is chosen as a representative time for the ECCS pumps since it is expected that operator action to stop ECCS flow should occur within this time frame for most SGTR sequences.

2.2 Manual SI Initiation Question: What is the maximum time for operator action to manually initiate SI, in the event of a failure of automatic initiation in conjunction with failure of AFW, in order to prevent core damage?

e Answer:

If high pressure injection can be manually initiated within 2 hou s, core damage is ~evented. However, this may preclude other actions from being taken n; loss of heat sink considerations.

Discussion:

Analyses from Reference 1 (Cases 5 and 6)indicat

a for the case with no ECCS and no AFW, the onset of core ancovery begins at slig' uy greater than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Thus if high pressure injection can be initiated before the onset of core uncovery H.e.,2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ), core damage can be prevented.

The manualinitiation of the ECCS pumps is not modeled in the SGTR plant response

trees, 2.3 Auxiliary Feedwater WP1145:1D/030992 SGTR-S3

3,.. _

_J.

Question: What is the minimum number of auxiliary feedwater pumps required for i

successful core cooling?

Answer:

Auxiliary feedwater is not required for core cooling following a SGTR provided that at least one high pressure injection pump is operating.

Question: What is the minimum number of Auxiliary Feedwater pumps required to prevent the operato:s from going to the Loss of Heat Sink Procedure (FR-H.1)?

Answer:

To prevent initiation of the Loss of Heat Sink EOP, one of the following configurations is required:

a.

1 motor-driven or 1 turbine-driven AFWpump delivering flow to 4 out of 4 steam generators, or b.

1 motor-driven or 1 turbine-driven AFWpump delivering flow to 3 out of 4 steam generators with operator action to open the throttle valves on the delivering AFWlines.

Question: What is th"

%imum number of Auxiliary Feedwaterpumps required for:

1.

initial RCS cooldown per Step 14 of E-3, 2.

maintenance of a 100*F/hr RCS cooldown.

Answer:

To perform the initial RCS cooldown per Step 14 of E-3, the initial secondary inventoryin the unisolated, intact SGs is sufficient to peric m this limited cooldown; therefore no auxiliary feedwater is needed (physically) for this initial RCS cooldown.

However, there must be.

I WP1145:1D/030992 SGTR-S4

L a

i-sufficient auxiliary feedwater (see Answer above) to maintain the nati ral' progression through the EOPs to Step 14 of E-3.

For maintenance of a 100*F/hr RCS cooldown, either of the A' FW N

configurations noted above are sufficient.

i r

Question: What is the mission time for AFWpumps?

Answer:

The mission time for the AFWpumps is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

.i Discussion:

The unique ster. cess criteria which have been established for the operation of the Auxiliarv Feedwater System (AFW) include: 1) the minimum AFW requirements for decay heat removal,2) the minimum requirements to prevent implementation of the Loss of Heat Sink Procedure (FR-H.1), and 3) the minimum requirements' to accomplish RCS cooldown. Each of these requirements are discussed in the following paragraphs.

Analyses of the SGTR using the TREAT computer code (Reference 1, Cases 3 and 4) show that auxiliary feedwater is not required in order to remove decay heat following a SGTR with at least one high pressure injection pump operational. For thm cases without AFW to the strism generators, the RCS does not pressurize above the <hutoff head of the charging or Si pumps; rather the RCS is maintained at an equilibrium pressure at which the decay heat is being' removed via the combination of primary to t

secondary break flow and the addition of relatively :Sid Sl water from the high pressure injection pump.

WP1145:1D/030992 SGTR-SS

J T

Per the Zion EOPs, the minimum AFW flow necessary to prevent implementation of i

the ' Loss of Heat Sink' procedure is 340 gpm. This flow is based on the assumed i

AFW f!ow for the main feedwater line break safety analysis for Zion. Evaluations of the AFW system performance (Reference 4) indicate that although the AFW throttle

{

valves are set in a restricted position during startup testing (GOP-2) and monthly surveillance (PT-7), the total AFW flow will be greater than this 340 gpm minimum requirement for accident conditions provided that flow is delivered to all four steam-i generators. Therefore, the success criterion for AFW can be specified as 1 motor-driven or 1 turbine-driven AFW pump delivering flow to 4 out of 4 steam generators.

[Nute that with the AFW flow throttled, flow from 1 AFW pump to less than 4 out of 4 steam generators will not exceed 340 gpm.]

Alternately, a review of the Zion EOPs show that if AFW flow is not delivered to all 4 steam generators and the turbine-driven AFW pump is not operable, the operators would be required to open the AFW throttle valves to achieve the desired AFW flow (i.e.,340 gpm). Therefore, inclusion of the operator action to open the AFW throttle valve has been considered as an alternate success criterion for AFW flow. Although flow to 1 SG with the AFW throttle va!ve in the open position would be sufficient to achieve the desired 340 gpm flow rate, the success criterion is. defined as i

1 motor-driven or 1 turbine-driven AFW pump delivering flow to 3 out of 4 steam generators with operator action to open the throttle valves on the delivering AFW lines. ' AFW flow to at least 3 SGs is necessary since 2 SGs are needed for success of the initial RCS cooldown (Section 2.8), and the ruptured SG is not used for the cooldown, it is noted that the operator action to open the AFW throttle valves is modeled in the AFW fault tree (Reference 15).

Analyses presented in Reference 1, Case 7 show that the initial RCS cooldown of-approximately 40 F can be completed without any AFW flow, provided that the inventory of the unisolated, intact SGs is utilized. However, such a scenario'cannot i

WP1145:1D/030992 SGTR-S6

A happen due to the structure of the Zion EOPs; specifically, with no AFW the operators are instructed to use FR-H.1, Loss of Heat Sink and no RCS cooldown would be.

initiated without verification of at least 340 gpm of AFW flow.

Other analyses (Reference 5) show that approximately 250 gpm of AFW flow is-required to mairitain a 100 F/hr RCS cooldown.

Therefore, either of the.

configurations identified above to provide the minimum 340 gpm flow rate to avoid a ' Loss of Heat Sink' will be sufficient to maintain a 100*F/hr RCS cooldown.

The mission time for the AFW pumps is taken to be 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This time is consistent with the actions needed to terminate the primary-to-secondary break flow; all a'ctions should be completed within this time.

2.4 Alternate Feedwater Question: What is the minimum number of main feedwater pumps required to maintain steam generatorinventory in a SGTR event with loss of AFW7 Answer:

With one main feedwater pump delivering flow to 1 out of the 3 intact steam generators, the steam generatorinventory can be maintained for all circumstance.rs in a SGTR event with loss of AFW.

Question: What is the mission time for the main feedwaterpumps?

Answer:

The mission time for the main feedwater pumps is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

WP1145:1D/030992 SGTR-S7 1.

f

(

Discussion:

One main feedwater pump can deliver over 1000 gpm and is not limited by the flow -

i restrictors in the AFW lines. The action to implement main feedwater flow in the event of a loss of AFW flow is governed by FR-H.1, Loss of Heat Sink. In order to escape the FR-H.1 procedure, the water levelin at least one steam generator must be restored to greater than 4% narrow range. Therefore, one main feedwater pump delivering flow to 1 out of the 3 intact steam generators will satisfy this requirement.

The mission time for the main feedwater pump (s)is taken to be identical to that for the AFW pumps, or 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2.5 Operator Action to implement Afternate Feedwater Question: What is the maximum time available to implement alternate feedwater to the steam generators in the event of a loss of AFW?

Answer:

In order to return to the SGTR recovery procedure and terminate the primary to secondary break flow prior to SG overfill, the maximum time after the initiation of the SGTR event to restore alternate feedwater to the steam gene: ator(s) is:

a.

25 minutes if all ECCS is availa ole, b.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if no ECCS is available.

In order to avoid ' bleed and feed' cooling per FR-H.1, the maximum time after the initiation of the SGTR event to restore alternate feedwater to the steam generator (s) is:

WP1145:1Dl030992 SGTR-S8 m

L

\\

a.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if all ECCS h' available, b.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months if only one charging pump is available.

Discussion:

For the scenario in which AFW fails, the purpose of implementing an alternate feedwater supply to the steam generator (s) is to first return to the normal EOP used -

for recovery from a SGTR (E-3), or second to prevent the possibility of going to ' Bleed -

and Feed Cooling' per FR H.1 due to loss of secondary heat sink.

Following alternate feedwater injection to the steam generator (s), level recovery will result in transfer to the original procedure and subsequent transfer to E-3 for-mitigation or a SGTR event. A Reference 1 analysis (Case 8) shows that for the scenario with all ECCS but no AFW, the ruptured SG level reaches 100% at 30 minutes. Based on logic discussed in Section 2.7, isolation of the ruptured SG.

must occur by the time the level reaches 100% in order to successfully terminate the primary to secondary break flow prior to SG overfill. it is assumed that the operators will take approximately 5 minutes for the EOP transfer from FR-H.1 to E-O to E-3 to obtain the instructions to isolate the ruptured SG; thus attemate feedwater injection '

to the steam generator (s) must be established by 25 minutes following the initiation of the SGTR event in order to stop the break flow prior to SG overfill.

'f For the scenario with no AFW and no ECCS (Reference 1, Case 5), adequate core cooling is provided if alternate feodwater can be restored by 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This will enable the use of the steam generators for decay heat removal; subsequent isolation of the ruptured SG will equilibrate the RCS and ruptured SG pressures thereby terminating-the primary to secondary break flow. ' Bleed and Feed' would not be initiated.for this case due to the lack of ECCS injection.

WP1145:1D/030992 SGTR-S9 I

1 (g

The implementation of ' Bleed and Feed' is triggered by a steam generator water level i

below 24% of wide range indication in any 3 steam generators. Thus, the time available to implement an alternate feedwater source is limited by the time at which

' Bleed and Feed' would be implemented due to low level. Based on analyses in Reference 1 (Cases 3 and 8), the time to 24% wide range levelis dependent on the number of ECCS pumps which are operating. For the scenario in which all ECCS is available and operating (i.e., both charging pumps and both Si pumps), this time is slightly over 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Presuming that the indication to establish alternate feedwater is early in the event, on the order of 10 minutes, the operators would have approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to perform this action.

For the scenario in which only one charging pump is available, the time until the SG wide range level reached 24% is slightly over 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The time is slightly shorter for this scenario since the lower equilibrium break flow rate results in less energy transfer via the break flow and more SG heat transfer, causing quicker boiloff of the secondary inventory. Presuming that the indication to establish alternate feedwater is early in the event, on the order of 10 minutes, the operators would have approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to perform this action.

It must be noted that for the scenario in which only Siis available, the SG wide range level is not used as an indication to begin ' bleed and feed' cooling; rather ' bleed and feed' is initiated immediately upon failure of charging pumps in conjunction with failure of AFW.

2.6 Steam Generator Isolation Question: What equipment is necessary to isolate steam flow from the ruptured SG7 l

i WP1145:1D/030992 SGTR-S10 c....

7 l

1 i

C Answer:

To isolate steam flow from the ruptured SG, the main steam isolation 1

valve (MSIV) for the ruptured SG must be closed.

Alternately, if the MS/V for the ruptured SG cannot be closed, isolation of the ruptured SG may be accomplished by performing the following actions:

.q closing the MSIVs for the intact SGs l

closing the steam dump valves isolating steam flow to the moisture separator reheaters, the steam jet air ejectors and the main feed pumps.

Question: What equipment is necessary to isolate feedwater flow to the ruptured SG7 Answer:

Isolation of feedwater flow to the ruptured SG entails the closure of the flow regulating valves controlling feedwater flow to the ruptured SG. This.

includes feedwater via the auxiliary feedwater pump (s) or the main feedwater pump (s).

Question: What is the mission time for the equipment used to isolate the ruptured SG (i.e., MSiVs, feedwater regulating valves, etc.)?

Answer:

The mission time for the MSIVs and the feedwaterpump flow regulating i

valves is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

I i

WP1145:1D/030992 SGTR-S11 J

h....

(

Discussion:

Isolation' of steam flow from the ruptured SG provides a pressure / temperature differential between the ruptured SG and the intact SGs as a necessary precursor to I

perform subsequent operator actions to terminate the primary to secondary break flow 1

through the ruptured steam generator tube. This isolation is performed via closure of-the MSIV for the ruptured SG. It is noted that the Zion EOPs instruct the operators to close the MSIV bypass valves on the ruptured SG, close the blowdown isolation valves on the ruptured SG and isolate steam flow to the turbine driven AFW pump as part of the isolation process. However, these actions are not included here in the 1

success criteria sirce these paths are relatively small steam leak paths compared to l

the main steam lir 9. Additionally, these steam leak paths would be expected to be isolated automatically or manually per procedural guidance. (Note that there is only i

a 50% chance that the steam supply line to the turbine driven AFW pump would be H

from the ruptured SG since these lines only originate from SGs A and D).

Should the ruptured SG MSIV f ail to close, successfulisolation of the ruptured SG can l

also be performed by closure of the MSIVs for the intact SGs, closure of the steam dump (to condenser) valves, and isolation of steam flow to the moisture separator reheaters, main feed pumps plus steam jet air ejectors. As with the previous case, steam flow via the MSIV bypass valves, the blowdown isolation valves and the steam supply line to the turbine drivon AFW pump is not included in this success criteria.

It is noted that closure of the MSIV for the ruptured SG is preferable since this gives the operator the option of using steam dump to the condenser for the subsequent RCS cooldown.

Isolation of the ruptured SG also includes stopping all feedwater flow to the ruptured SG. Control of feedwater flow to the ruptured SG is necessary to prevent overfilling the ruptured SG.

For AFW flow, this control is provided by using the AFW flow WP1145:1D/030992.

SGTR-S12

1 I

regulating s Js on the motor driven AFW pump line (FWOO51, FWOO53, FWOO55,-

. FW0057). and the turbine driven AFW pump line (FWOO50, FWOOS2, FWOO54, FW0056). For feedwater flow to the SGs with the main feedwater pumps, control is provided by using the main feedwater flow regulating valve on each line (1LCV FW510,1LCV-FW520,1LCV-FW530,1LCV-FW540) as well as the main feedwater bypass line flow regulating valve on each line. (1LCV-FW510A, 1 LCV-FW 520 A, 1 LC V-FW530 A, 1 LCV-FW 540 A).

The mission time for the MSlVs and feedwater pump discharge valves is taken to be 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months since the ruptured SG must remain isolated for this duration of time.

2.7 Operator Action to isolate Ruptured Stcam Generator Question: What is the maximum time available for operator action to isolate the rupturedsteam generator for cases with ECCS available, and still recover via Zion procedure E-3?

Answer:

The operators must initiate isolation of the ruptured steam generator by the time levelindication is 100% in the ruptured steam generator; this corresponds to 20 minutes following initiation of the SGTR.

. Question: What is the maximum time available for operator action to isolate the rupturedsteam generator for cases with no ECCSinjection, but with AFW or alternate feedwater available?

Answer:

The operators must initiate isolation of the ruptured steam generator within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of the initiation of the SGTR event in order to avoid core damage.

eP WP1145:1DIO30992 SGTR-S13

~

Discussion:

.i The criteria to initiate isolation of the ruptured SG was chosen as such for two reasons (Reference 1, Cases 0,9 and 10). First, by the time the level reaches 100%

indication in the ruptured SG, the disparity between the intact SGs and the ruptured SG levels is approximately 25% for wide range and 90% for narrow range indications.-

This increasing disparity with time in conjunction with radiation alarms in the steam line is judged to give a clear indication of a SGTR event, such that the identification of a SGTR can be reasonably accomplished by the time the level reaches 100% in the ruptured SG. Second, with minimal equipment for the subsequent EOP recovery actions (i.e., RCS cooldown and RCS depressurization), the primary to secondary break flow can still be terminated prior to SG overfill IF the operator actions are started at this time. On these bases, isolation of the ruptured SG must be initiated by 20 minutes following initiation of the SGTR for the case with AFW available,in order to terminate the primary to secondary break flow prior to SG overfill via E-3.

Otherwise, the operators will transfer to ECA-3.1 and it is nssumed that the primary to secondary break flow cannot be terminated prior to SG overfill.

For the case with no AFW, successfulimplementation of alternate feedwater by 25 minutes (see Section 2.5) will result in the ability of the operator to terminate the primary to secondary break flow prior to SG overfill. In this scenario, the time to reach 100% level is extended by 10 minutes since break flow only is filling the ruptured SG. However, earlier implementation of alternate feedwater at 1000 gpm will rapidly fill the ruptured SG and negate any additional available time due to the failure of AFW. Therefore, the time to isolate the ruptured SG will remain as 20 minutes for the scenario in which AFW is not r.vailable but alternate feedwater is established within 25 minutes.

WP1145:1D/030992 SGTR-S14

t

'For the case with no ECCS but AFW or alternate feedwater to the steam generators, decay heat removal is provided by primary to secondary heat transfer. However, without isolation of the ruptured SG a pressure differential between the RCS and the-ruptured SG will exist leading to continued primary to secondary break flow. Failure to isolate the ruptured SG will result in RCS drainage and eventual core uncovery.

The timing for core uncovery for this scenario has been determined to be approximately 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months (Reference 1, Case 11); thus isolation of the ruptured SG must occur in this instance by 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months in order to stop the primary to secondary.

break flow prior to core damage.

2.8 RCS Cooldown Question: What steam relief caprity (from the steam generators) is required to achieve RCS cooldown, per Step 14 of Zion procedure E-3, prior to SG r

overfill?

Answer:

2 out of 3 atmospheric relief vab^es on the intact SGs or 2 out of 3 steam dump valves wiH provide the necessary steam relief to achieve this initial RCS cooldown prior to SG overfiH.

Question: What steam relief capacity (from the steam generators) is required for RCS cooldown of SG overfiH sequences?

Answer:

2 out of 3 atmospheric relief valves on the intact SGs or 2 out of 3 steam dump valves wiH provide the necessary steam relief to achieve this RCS cooldown for SG overfiH sequences.

l Question: What is the mission time for atmospheric relief valves and the condenser steam dump valves?

l

~

WP1145:1Dl030992 SGTR-S15 1

h A

Answer:

The mission time for the atmospheric relief valves and the steam dump valves is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

f Discussion:

f i

Following identification of a SGTR event, and subsequentisolation of the ruptured SG, the EOPs instruct the operators to initiate a RCS cooldown. The' purpose of this initial

]

RCS cooldown is to establish or maintain a temperature difference between the RCS and the intact SGs for decay heat removal, plus increase the subcooling in the RCS so that subcooling is maintained following the subsequent RCS depressurization.' The amount of this initial RCS cooldown is dependent on the ruptured SG pressure; typically, following isolation of the ruptured SG, the pressura in this SG will be maintained at or near the ARV setpoint (1050 psia). To achieve the amount of RCS P

subcooling margin as directed in E-3 at this pressura requires a RCS cooldown of less -

than 40 F. Analyses from Reference 1 (Cases 9 and 10) show that this degree of RCS cooldown can be achieved with 1 ARV; however, SG overfill will occur before the' RCS cooldown target temperature is attained. Since the RCS cooldown can successfully be accomplished prior to SG overfill with 2 ARVs, the requirement fer steam relief as directed in E-3 is either 2 ARVs (steam relief to atmosphere) on intact SGs or 2 steam dump valves (steam relief to condenser). Note that AFW must be provided to the SGs used for the RCS cooldown (Section 2.3).

RCS cooldown is also considered for SG overfill sequences as a necessary precursor to ECCS reduction (Section 2.12). These scenariosinclude failure to isolate feed flow to the ruptured SG (per E-3), failure to isolate steam flow from the ruptured SG (per ECA 3.1), and cases in which the charging pumps are not available (per E-3). In these instances, the RCS cooldown capability required is not as constrictive as discussed above since these sequences, by definition, result in SG overfill. In fact, the 1 ARV or 1 steam dump valve steam relief capability for a 100'F/hr RCS cooldown -

WP1145:1D/030992 SGTR-S16

u, i

i (Reference 7) would be sufficient. However, the success criteria for this action will 1

remain '2 out of 3 ARVs or 2 out of 3 steam dump valves' needed to perform this RCS cooldown. No change was made to the success criteria defined previously for several reasons: to avoid complicating the tree (a second RCS cooldown node would have been needed), a minimal benefit would b'e realized on the calculation of the failure probability of RCS cooldown equipment for a revised success criteria, and to' l

maintain a bounding success criteria definition of RCS cooldown for all SG overfill cases. Therefore, the RCS cooldown success criteria for SG overfill cases remains 2 5

out of 3 ARVs on the intact SGs or 2 out of 3 condenser steam dump valves.

l t

The mission time for the steam relief equipment (ARVs and steam dump valves) is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; this time is consistent with the mission time for AFW.

2.9 Operator Action for RCS Cooldown Question: What is the maximurn time available for operator action to initiate RCS cooldown and still terminate primary to secondary breakflow prior to steam generator overfill via Zion procedure E-37 Answer:

The operators must begin to implement initial RCS cooldown by 25 minutes following initiation of the SGTR event.

i Question: What is the maximum time available for operator action to initiate RCS cooldown for SG overfillsequences?

Answer:

The latest time at which the operator can initiate RCS cooldown for SG I

overfill sequences is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

i i

WP1145:1Dl030992 SGTR-S17

)

=

L i

Discussion:

The operato; action to perform an RCS cooldown is the next major action following l

isolation of the ruptured SG. The timing for the initiation of this RCS cooldown is dependent on the time of ruptured SG isolation and the steam relief capacity available.

To wit, the timing for the initial RCS'cooldown can be delayed proportionately for early isolation of the ruptured SG and maximum steam relief capability. However, to avoid a complex matrix of operator action times to initiate RCS cooldown as a function of isolation time and steam relief capability, a time was chosen which will i

encompass all scenarios leading to termination of the primary to secondary break flow prior to SG overfill. Specificaliy, for the case with the latest ' successful' ruptured SG isolation (i.e., 20 minutes) and with the minimum successful steam relief capability (i.e., 2 ARVs), the primary to secondary break flow can be terminated prior to SG overfillIF the RCS cooldown is initiated by 25 minutes (Reference 1, Cases 9 and 10).

Thus the operator has 5 minutes after isolating the ruptured SG to initiate the RCS' cooidown.

It is also noted RCS cooldown is considered for SG overfill sequences as a necessary precursor to ECCS reduction (Section 2.12). These scenarios include failure to isolate feed flow to the ruptured SG (per E-3), failure to isolate steam flow from the ruptured SG (per EC A-3.1), and cases in which the charging pumps are not available (per E-3).

In these instances, the operator action time for RCS cooldown is not as constrictive as discussed above since these sequence i by definition, result in SG overfill.

Analyses from Neference 1 indicate that the operator would have several hours to.

perform the RCS cooldown step. However, the success criteria for this action is defined as less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to perform this RCS cooldown. No change which requires.

recalculation of probability was made to the success criteria defined previously for.

several reasons: to avoid complicating the tree (a second RCS cooldown operator -

action node would have been needed), a minimal benefit would be realized on the WP1145:1D/030992 SGTR-S18

i calculation of the' failure probability of the operator action to. perform the RCS cooldown for a longer than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months success criteria time, and maintain a bounding success criteria definition of the operator action to perform the RCS cooldown for all

- SG overfill case. Therefore, the RCS cooldown operator action success criteria for SG overfill cases will be defined as less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

2.10 RCS Depressurization Question: What RCS depressurization mechanism (s) are required, per Step 18 of Zion procedure E-3, in order to successfully terminate the primary to secondary break flow prior to SG overfill?

Answer:

The primary to secondary break flow can be terminatedprior to SG overfill with no initial RCS depressurization; thus no RCS depressurization mechanism (s) are necessary in this instance.

However, RCS depressurization may be performed with either normalpressurizer spray, one pressurizer PORV or auxiliary pressurizer spray.

Question: What is the mission time for normalpre3surizer spray, one pressurizer' PORV or auxiliary spray?

Answer:

The mission time for normal pressurizer spray, or auxiliary spray is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; the mission time for the pressurizer PORVis 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

1 Discussion:

The purpose of the RCS depressurization in the EOPs is primarily to reestablish level in the pressurizer for subsequent ease in RCS inventory control. RCS depressurization also serves to reduce or terminate the primary to secondary break flow as the RCS b

WP1145:1D/030992 SGTR-S19

sr t

(

pressure approaches the pressure in the ruptured SG; however, the ECCS flow must ultimately be stopped to permanently terminate this break flow.

Reference' _1 (Case 10) indicates that the primary to secondary break flow can be terminated prior to SG overfill without this RCS depressurization step.

Specifically, if RCS depressurization cannot be performed, the operators will transfer to ECA-3.3 at which time the operators will be instructed to stop all ECCS flow if the ruptured SG narrow range levelis greater than 70%. Successful termination of ECCS flow (Section 2.12)

.will result in RCS depressurization to the ruptured SG pressure and consequently k

termination of the primary to secondary break flow. Thus the Reference 1 analysis shows that the primary to secondary break flow can be stopped prior to SG overfill j>

without this initial RCS depressurization via operator transfer to ECA-3.3.

The RCS depressurization step is included in the Plant Response Tree, however, since this is the natural progression through the EOPs. The equipment necessary for success of this RCS depressurization step is that equipment associated with normal

^

pressurizer spray (including RCP operation and the valves in the piping between the cold leg and pressurizer steam space), or one pressurizer PORV and its associated block valve opening and remaining open upen demand, or that equipment associated with auxiliary spray (including operation of one centrifugal charging pump and the valves in the piping between the CVCS and the pressurizer steam space).

The mission time for normal pressurizer spray or auxiliary spray is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months since the actions to terminate primary to-secondary break flow should be completed within this time.

The mission time for the pressurizer PORVs is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months based on logic discussed in Section 2.14.

WP1145:1D/030992 SGTR S20

~

2.11 Operator Action to Depressurize the RCS Question: What is the maximum time available for operator actt'n to initiate initial RCS depressurization, per Step '14 of Zion procedure E-3, and'still terminate primary to secondary breakflow prior to steam generator overfill?

Answer:

As noted previously, initial RCS depressurization is not a necessary step in order to terminate the primary to secondary break flow prior to SG overfill. However, if the initial RCS depressurization is to be performed, the operators must begin this initial RCS depressurization by 40 minutes following initiation of the SGTR event.

7 Discussion:

As noted previously, the initial RCS depressurization is performed primarily to recover pressurizer level for easier inventory control in subsequent actions. Termination of primary to secondary break flow prior to SG overfill can still occur via transfer to ECA-3.3 if this RCS depressurization is not performed. However, if the initial RCS depressurization is to be performed, and considering the timing for the subsequent step to stop all ECCS pumps (Section 2.12), the operators must begin this initial RCS depressurization by 40 minutes following initiation of the SGTR event.

Similar to the timing for the initial RCS coofdown, the timing for the initial RCS depressurization is dependent on the time of ruptured SG isolation, the time' of initiation of the RCS cooldown, and the steam relief capability of the secondary _

system. However, to avoid a complex matrix of operator action times to initiate RCS depressurization as a function of isolation time, etc., a time was chosen which will encompass all scenariosleading to termination of the primary to secondary break flow WP1145:1D1030992 SGTR-S21

~.a B

A prior to SG overfill. Specifically, for the case with the latest ' successful' ruptured SG isolation time (i.e.,20 minutes), the minimum successful steam relief capability (i.e.,

2 ARVs) and the latest ' successful' time to initiate RCS cooldown (i.e.,25 minutes),

the primary in secondary break flow can be terminated prior to SG overfill IF the RCS depressurization is initiated by 40 minutes (Reference 1, Cases 9 and 10). Thus the operator has 3 minutes after completion of the RCS cooldown to initiate the RCS-depressurization.

2.12 Operator Action to Reduce ECCS Injection Question: What is the maximum time available for operator action to reduce ECCS injection and still terminate primary to secondary break flow prior to SG overfill?

Answer:

The latest time at which the operator can reduce ECCS injection and still-terminate primary to secondary break flow prior to SG JVerfiliis:

52 minutes following initiation of a SGTR for the case in which a.

RCS depressurization is successful,~

b.

45 minutes following initiation of a SGTR for the case in which RCS depressurization is not successful.

Question: What is the maximum time available for operator action to reduce ECCS injection in order to prevent core damage for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the event?

Answer:

The latest time at which the operator can reduce ECCSinjection in order to prevent core damage for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the event is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

WP1145:1D/030992 SGTR-S22

l' 4

i

(

Discussion:

There are two scenarios in which ECCS reduction is examined: 1) ECCS reduction as a precursor to establishing RCS inventory control and eventual termination of primary to secondary break flow PRIOR to SG overfill and 2) ECCS reduction for SG overfill cases in order to extend the availability of RWST water'for ECCS injection.

For the scenarios in which isolation of the ruptured SG and cooldown of the RCS has succeeded per instructions in E-3, the next operator action to be performed is depressurization of the RCS (Sections 2.10 and 2.11). Regardless of whether RCS depressurization is successful, the operator must subsequently reduce ECCS flow to that from only 1 charging pump as a necessary precursor to establishing RCS inventory control and eventually terminating the primary to secondary break flow prior to SG overfill. The instructions to reduce ECCS to the flow from 1 charging pump are in E-3 if RCS depressurization is successful, and in ECA-3.3 if no pressurizer pressure control is available. The success / failure of RCS depressurization impacts the time available to perform the ECCS reduction, as discussed henceforth.

As with the other operator actions discussed previously, the opera'.or action time to to reduce ECCS flow to that from 1 charging pump 'is dependent upon the combination of previous operator action times and the steam relief capability for the PCS cooldown step. Similarly, the time to accomplish ECCS' reduction was chosen in order to encompass all scenarios leading to termination of the primary to secondary break flow prior to SG overfill. Specifically, for the case with the latest ' successful' ruptured SG isolation time (i.e., 20 minutes), the minimum successful steam relief capability (i.e., 2 ARVs), the latest ' successful' time to initiate RCS cooldown (i.e.,

25 minutes) and the latest ' successful' time to initiate RCS depressurization (i.e.,40 minutes), the primary to secondary break flow can be terminated prior to SG overfill WP1145:1D/030992 SGTR-S23

IF ECCS reduction is completed by 52 minutes. Thus, the operator has 3 minutes i

t after completion of the RCS depressurization to reduce ECCS flow.

For the case with latest ' successful' ruptured SG isolation time (i.e.,20 minutes), the minimum successful steam relief capability (i.e., 2 ARVs), the latest ' successful' time to initiate RCS cooldown (i.e.,25 minutes), and no RCS depressurization, the primary to secondary break flow can be terminated prior to S3 overfill IF ECCS reduction is completed by 45 minutes. For tlis m we, the operator has 8 minutes'following completion of the RCS cooldown to reduce ECCS flow.

ECCS reduction is also considered for SG overfill cases; reducing the ECCS flow to 1 charging pump or 1 Si pump will extend the availability of the RWST water for

' ECCS injection thereby preventing any core damage for the initial 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the-These SG overfill scenarios in which ECCS reduction is considered include event.

failure to isolate feed flow to the ruptured SG (per E-3), failure to isolate steam flow from the ruptured SG (per ECA-3.1), and cases in which the charging pumps are not available (per E-3). In all cases, success of RCS cooldown is _necessary in order to meet the ECCS reduction criteria (Section 2.8),

i For these scenarios, the time available for the operator to reduce ECCS flow is not as constrictive as the success criteria discussed 'above since these sequences, by definition, result in SG overfill. Analyses from Reference 1 indicate that the operator would have several hours to perform the ECCS reduction step. However, the success criteria for this action will remain 'less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ' to perform the ECCS reduction step. No change which requires recalculation of probability was made to the success -

criteria defined previously for several reasons: to avoid complicating the tree (a second ECCS reduction node would have been needed), a minimal benefit would be realized on the calculation of the failure probability of a ECCS reduction operator action for a longer success criteria time, and maintain a bounding success criteria t

WP1145:1D/030992 SGTR-S24

q i

i

' definition of ECCS reduction for all SG overfill cases. Therefore, the success criteria -

' for ECCS reduction for these scenarios may be defined such that the operator has a maximum time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to reduce ECCS.

2.13 Operator Action to Establish Normal Charging i

Question: What is the maximum time available for operator action to-establish' normal charging flow and still terminate primary to secondary break flow prior to SG overfi/I?

Answer:

The latest time at which the operator can establish normal charging flow and still terminate primary to secondary break'ilow prior to SG overfillis:

.i 52 minutes following initiation of a SGTR for the case in which a.

RCS depressurization is successful, b.

45 minutes following initiation of a SGTR for the case in which RCS depressurization is' not successful.

Discussion:

The operator action to establish normal charging flow is considered for those cases l

in which ruptured SG isolation, RCS cooldown and ECCS reduction are' successful.

Since ECCS reduction and establishing normal charging flow are coupled together as necessary steps to establishing RCS inventory control (and terminating the primary to

'i secondary break flow prior to SG overfili), the identical success criteria is used for establishing normal charging as was used for ECCS reduction. It is noted that a SAM t

end state is still possible if the operator action to establish normal charging fails,-

provided that ECCS reduction is successful.

f WP1145:1D/030992 '

SGTR-S25

q 2.14 Normal Charging Question: What equipment is necessary to establish normalcharging?

Answer:

Establishing normal charging includes the operation of one centrifugal charging pump plus the associated hardware for alignment of flow from i

the VCT to the cold leg.

t Question: What is the mission time for the normalcharging equipment?

Answer:

The mission time for normal charging equipment is 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

Discussion:

- As noted previously, for all cases RCS inventory control must be established by terminating ECCS flow to the RCS and initiating normal charging flow. Normal charging is addressed for those sequences in which ruptured SG isolation, RCS Cooldown, ECCS reduction and operator action to establish normal charging are.

successful. It is noted that a SAM end state is still possible if normal charging fails, provided that ECCS reduction is successful.

Normal charging flow includes the operation of at least one of the centrifugal charging pumps taking suction from the VCT. The inventory in the VCT is replenished from the reactor makeup water storage tank. The valves in this configuration must also be realigned to provide flow via this path. These valves include opening MOV-VC8110, MOV-VC8111, MOV-VC8105, MOV-VC8106, AOV-VC8147 and MOV-VC8100 plus.

closing valves MOV-S18803A (Unit.1 only), MOV-Sl8803B (Unit 1 only),

MOV-Sl8801 A and MOV-Sl88018.

WP1145:1D/030992 SGTR-S26

.g

_i O

t

'I

+

+-

(g 3

O IMAGE EVALUATION

' f:' %

</

/

TEST TARGET (MT-3) mS,f &;-

N~////

s' 4

ff, 4

\\/x fjg '*

F s

1.0 nn

,1 C20 l,l o =

lllll 1.8 ka i 1.25 g I.4 lj! 1.6 l--

ii==

b 150mm 4

l 4..

6" i

l

'? g

fs a/4N*

x e s % g' A<

v N

ve'-

jp//k \\

4f' N

Y n ;;

/;,

v y

6 tw 44 s

0j /

Q

.:;s'e

/

c.

ys:

~?

- c -

s.as

)-

lg e

' l0

eg7_,

' f IMAGE EVALUATION O

g h

////

TEST TARGET (MT-3)

'Y

//g<

s,j? ' 4[

9 g,

s Vo egi' Qf l

1.0

~

lh!l 2_0 l,l a _+

l Il!! l.8 l

lin=4u l

l 1.4 lg I.6 1.25 m

4 _

_ _ _ _ _ _..__ _._._ _ _..._._ _. -- 1 5 0 m m l

l 4 --. _

6" l

4 9)>

e $ ffs\\'\\

?

&, j,g,

et b 4 v::

a

.V f.],3

'* f y

i Oy

p q a di jf,4

+_+

8% ' l06

/'O e

Q& '1 t ([ "99

r.,

/j/j f'g%g,p IMAGE EVAL.UATION O

\\

%)hi*

TEST TARGET (MT-3)

/

,,'$k?

x J//f

/

g 9hf'

/@

4 '*

4

'\\'x

't>W

'4 4

/4 1.0 ltA EM m a!W3h s 2.2 u

k i,- g t t.;

=]2.0 l.I t

1.8 mus 1.25 I l.4 1.6

!_=

%=2 4

150mm 4

6" 3> %

s v ?m:a g#9,e 4 ?s,A* N A

N/

,7

.e a ////4

+

o+#

g y g, e

o 7

v a

4 c.

q

w

'm

~

i

'Is k'

fO

.,Rhb c l 4!<,

Q*t,'@

V, IMAGE EVALUATION

/

gn%

\\ //o/p >

'(}',

t:;}$P TEST TARGET (MT-3)

/

j f ; V 4;;,

z Yo/ %QW pg JQgj 4

c,,p h

4%

l,O

= f 2.5_

ti L28 b

h

[g hlm 2d J R; l,l l

1 1

l m.8 se 1.25

! l.4 l

W_i.6 i

4 ---

150mm 6"

?

l pS "$*j77o\\\\

.D ^Ip$p e'

7 44 Y,

~

,k

// < g"

'/

~

a e

>,1,.

ll k

~,

u___

m 7,.

-=

?

P The mission' time for the charging equipment is assumed to be 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months . Following termination of ECCS flow, normal charging will be necessary for RCS inventory control. Thus the mission time for ECCS injection and normal charging encompass the p

24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period considered.

r 2.15 Bleed and Feed 3

h Ouestion: What pressure relief capability (from the pressurizer) is required for RCS depressurization in order for bleed and feed cooling to be successful?

- Answer:

1 out of 2 pressurizer PORVs provides *.sfficient relief capacity to remove decay heat and maintain RCS pressure below the shutoff head of tne high l

pressure injection ECCS pumps.

I Question: What is the mission time for the pressurizer relief valves (PORVs)?

Answer:

The mission time for the PORVs is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

.i E

Ciccussion:

n.

E

~

For the SGTR event' scenario in which blead and feed cooling is required, Reference 7 analyses for small LOCA show that the relief capacity of one pressurizer PORV is

. sufficient to remove decay.. eat and maintain the RCS pressure below the shutoff t

head of the high pressure i;tjection ECCS pumps. This success criteria is carried over to SGTR event.

The mission time for the PORVs is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . To maintain ECCS recirculation, I'

continued flow through the PORV(s) to the contali..nent recirculation sump is necessary for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months considered.

i i

WP1145:1DiO30992 SGTR-S27

,,.~

c ii s

I

, I.-

2.16 Operator Action for Blood and Feed ys Question: What is the maximum time available for operator action to implement bleed and feed cooling using the pressurizer PORVs?

.[

Answer:

For those SGTR cases with no AFW, bleed and feed cooling must begin by 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months .

7 Discussion:

f T

i

't For SGTR scenarios with loss of AFW, the indication to initiate bleed and feed cooling

}

is low level in 3 out of 4 SGs. This low SG level is predicted to be attained at approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (Reference 1, Case 8). However, analysis from Reference 1 (Cases 3 and 4) show that the ECCS flow will maintain adequate core cooling for this scenario until the RWST empties; bleed and feed must be initiated prior to this time

[

to allow the accumulation of inventory in the containment sump to be used for ECCS recirculation. Since the RWST has been determined to empty at 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months for this scenario (Reference 1, Case 13) it is assumed that bleed and feed must be initiated by 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months in order for sufficient accumulation of RWST water in the containment i

sump.

2.17 RCFC Operation f

Question: What is the minimum number of RCFC units which wi!! prevent automatic containment spray actuation?

Answer:

The only SGTR scenario in which containment spray may be actuatedis i

the scenario where the pressurizer PORVs are opened for ' bleed and feed' i

WP1145:1D/030992 SGTR S28 t

t

.{

cooling. ' For this instance, 2 RCFC must be in operation to prevent containment spray operation.

i

' Question: What is the minimum number of RCFC units operating which can l

substitute for the RHR heat exchanger during ECC recirculation?

l Answer:

With 1 out of 5 RCFCs operating in low speed, no RHR heat exchangeris ~

i required.

Question: What is the minimum number of RCFC units operating which willprevent containment failure due to overpressurization following core damage?

Answer:

With 1 out of 5 RCFCc operatingin low speed, no containment failure will occur.

Discussion:

Three unique success criteria have been established for the operation of the Reactor Containment Fan Coolers: 1) prevention of automatic containment spray actuation,

2) long term' containment heat removal, and 3) substitution for the RHR heat exchangers for long term heat removal.

{

With respect to automatic containment spray actuation, analyses in Reference 15 show that the SGTR case in which the pressurizer PORVs are opened to facilitate bleed and feed following loss of heat sink conditions, operation of 2 out of 5 RCFC

{

units will prevent automatic actuation of containment sprays.

t a

t i

j i

~i

)

WP1145:1D/030992 SGTR-S29

i L

i

I With respect to long term heat removal, analyses in Reference 15 indicate that for a i

large LOCA, operation -of 1 out of 5 RCFC is adequate -to remove long term containment heat. This success criteria is applicable to the SGTR event.

Finally, with respect to substitution of the RCFCs for the RHR heat exchangers, analyses in Reference 15 show that 1 out of 5 RCFCs are capable of substituting for l

the RHR heat exchangers in preventing core damage during ECC recirculation; thus, with 1 out of 5 RCFCs operating during successful ECC recirculation, no RHR heat

[

t exchangers are needed.

l l

The success criteria are based on the following assumptions:

i 1.

The RCFC setpoint is the Safety injection Signal, which activates the RCFC

(

t units in the LOW speed mode.

2.

The RCFC units are supplied with service water at a temperature of less than

.j 100 degrees Fahrenheit (Reference 9).

i 2.18 Containment Spray Actuation and Operation j

Question: What is the minimum number of containment spray pumps required to i

operate to prevent containment failure?

t Answer:

Containment spray pumps cannot prevent containment failure.

r Question: What is the minimum number of containment spray pump required to t

scrub fission products from the containment atmosphere?

l t

WP1145:1D/030992 SGTR-S30 i

i t

Answer:

Scrubbing af containment fission products requires 1 out af 3 containment a

spraypumps operating at the time of core damage.

i Discussion:

h The containment spray actuation does not impact either the core damage success or the containment integrity success from the standpoint of containment heat removal.

Only in the event of a failure of all feedwater to the steam generators, the subsequent

.i

' bleed and feed' cooling plus a total loss of all RCFCs does the automatic actuation

{

of the containment sprays impact the accident progression and consequences. In this case, the actuation and operation of the containment sprays providas for draining of the RWST water into the containment, thereby preventing core concrete interactions and the attendant additional fission product releases associated with this phenomena.

For the case of draining the RWST, one spray pump alone (2600 gpm) would take 144 minutes to completely drain the RWST: three spray pumps would take 48 minutes. This time difference is not significant in terms of preventing core concrete j

interactions after reactor vessel failure.

t in terms of fission product removal from the containment atmosphere, the most 1

efficient removal occurs during the first 10 to 30 minutes of spray; this is the time frame in which the larger, heavier fission product aerosols are removed.

The Y

difference in fission product removal at the end of 30 minutes is very nearly identical for the case of one spray pump or three spray pumps [ unpublished analyses for t

Westinghouse AP600 Design conceptl.

i Thus, the success criteria for containment sprays taking suction from the RWST is 1 out of 3 trains operating. The success of containment sprays for fission product removal also requires that the sprays be operating for at least 10 minutes following i

WP1145:1D/030992 SGTR-S31 i

o-a the introduction of fission products into the containment following core damage. If 1

containment sprays are actuated early in an accident and deplete the RWST water prior to core damage, they would not be available for fission product depletion, l

As derived previously, the longest time to empty the RWST with only one spray pump operating is 144 minutes. Therefore, the mission time for the containment spray system is taken to be 2.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

These success criteria are based on the following assumptions:

1.

The containment spray setpoint is the coincident safety injection and containment Hi-Hi pressure setpoint (23 psig), which activates all three trains of containment spray, taking suction from the RWST.

2.

The emergency a.c. power buses are energized at, or before, the time the containment Hi-Hi pressure signal is received.

l 2.19 RHR Heat Exchanger Cooling I

Question: What is the minimum RHR heat exchanger requirements to prevent core damage during ECCS recirculation?

Answer:

The minimum RHR heat exchanger requirements to prevent core damage while on ECCS recirculation is:

a) with at least 1 out of 5 RCFCs operational, no RHR heat exchangers are required to be functional to prevent core damage, e

b) with 0 out of 5 RCFCs operational, O out of 2 RHR heat exchangers are required to be functional to prevent core damage in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the accident initiation; however,1 out of 2 RHR heat exchangers is required for long term heat removal.

t WP1145:1D/030992 SGTR-S32

I L

1

4..

Discussion:

7 1

The success criteria for the RHR heat exchangers are carried over from the large LOCA success criteria (Reference 8). These results indicate that ECC recirculation with'at least 1 RCFC is sufficient to prevent core damage.

Additionally, successful

{

recirculation with 0 RCFCs and O RHR heat exchangers will prevent core damage for the initial 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the initiation of the accident; however, success of at least 1 out of 2 RHR heat exchangers is required for long term heat removal.

[

i-2.20 Operator to Establish RHR Heat Exchanger Cooling i

Question: What is the maximum time for the operators to establish CCWto the RHR heat exchanger, during ECCS recirculation, to prevent core damage?-

- i i

Answer:

The maximum time for the operators to align the CCW flow to the RHR i

heat exchanger to prevent core damage is 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , if 0 RCFCs units are i

operating.

l Discussion:

l Based on analyses performed for the large LOCA-(Reference 15),1 out of 5 RCFC units can replace the RHR heat exchanger as a means of removing core decay heat during the ECC recirculation phase. Thus, for these cases, there is no requirement for I

operator action success in aligning the component cooling water to the RHR heat exchanger. For sequences in which 0 RCFCs are available, the operator must align the component cooling water to the RHR heat exchanger in order to remove decay heat. The time at which this alignment must be performedis approximately 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months .

For the SGTR bleed and feed scenario, the earliest time to drain the RWST and initiate ECCS recirculation is approximately 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (Reference 1, Case 15). Although there

]

WP1145:1D/030992 SGTR-S33

9

(

is approximately a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months difference between times to ECCS recirculation for SGTR vs. large LOCA, it is assumed that this time will not significantly affect the probability l

of establishing CCW to the RHR heat exchanger (s). Therefore, tne success criteria from the large LOCA are applicable to the SGTR event.

Also, it is noted that there is no requirement to provide CCW water to the RHR heat exchanger to protect the RHR pumps in the recirculation mode since the maximum water temperature, as established in Reference 8, will be less than the temperature of the RCS during normal RHR heat removal operation.

2.21 ECCS Recirculation Question: What is the minimum ECCS capability required during recirculation?

Answer:

The minimum ECC capability during recirculation is 1 RHR pump aligned to either 1 charging pump or i Sipump and delivering flow to 2 of the 4 cold legs.

Discussion:

For the SGTR, the only scenario in which ECCS recirculation will be used for long term core cooling is the case in which ' bleed and feed' cooling has been initiated due to the lack of feedwater to the steam generators. For this case, the RCS pressure remains above the shutoff head of the low pressure injection pumps, thus high pressure recirculation is required.

Following the successful realignment of the RHR pumps to recirculation from the containment sump, the RHR pumps must restart and operate for the mission time of ECCS recirculation. During recirculation,1 RHR pump aligned to either 1 charging WP1145:1D/030992 SGTR-S34

(-

pump or 1 Si pump is sufficient to provide long term core cooling. This success criteria is derived from the core cooling injection phase analyses in Reference 8, wherein either 1 RHR pump alone,1 charging pump alone, or 1 Si pump alone (delivering flow to 2 out of 4 cold legs) was sufficient to maintain core cooling during 1.la injection phase. Since the decay heat levels are lower during the recirculation phase, the same pump requirements can be justified.

In the high pressure recirculating phase, there is no possibility of using the Si or charging pumps in the i

recirculation mode without the operation of the RHR pumps; the RHR pumps act as I

booster pumps for the Si andior charging pumps.

This success criteria is based on the following assumptions:

1.

RHR pumps take suction from the containment sump which contains at least 111 inches of water per ES-1.3/ Step 3. This provides a water depth which ensures the RHR pump NPSH requirements are met.

2.

The Si pumps and charging pumps cannot take suction directly from the 1

1 containment sump, based on NPSH requirements and piping 3

arrangements.

2.22 Operator Action to Establish ECCS Recirculation Question: What is the maximum time for the operators to accomplish the ECCS switchover to recirculation in order to prevent core damage?

Answer:

The maximum "e for the operators to accomplish the switchover_

proc. *:, e to pmvera core damage is:

WP1145:1D/030992 SGTR-S35

l l

a)

With containment spray in operation, the time for successful switchover to recirculation is 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

b)

With containment sprayinoperable ornot automatically actuatect, the time for successfulswitchover to recirculation is 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months .

y

.i Discussion:

v The time for the operators to establish ECCS recirculation is specified as two distinct parameters; the time at whien the switchover to recirculation is to be initiated and the time period within which the switchover operations must be completed.

Based on the structure of the SGTR plant response tree, the operator action time for ECCS recirculation must be established for the cases with and without operation of the containment spray system. For simplicity, the operator action time will be established for the cases in which maximum ECCS and maximum containment spray pumps are available. This gives the minimum operator action time for all SGTR scenarios.

i The maximum time available for the operator to establish ECCS recirculation can be derived from the time at which the switchover to recirculation begins,' using the following methodology developed in the large LOCA Success Criteria Notebook (Reference 8).

The time required to physically accomplish switchover to low pressure cold leg recirculation, following the steps in Zion procedure ES-1.3,is about 5 minutes. Based on the extra steps to implement high pressure recirculation, the time required to physically accomplish switchover to high pressure recirculation is' estimated to be

~

approximately 10 minutes. If switchover to recirculaticn cannot be accomplished, the WP1145:1D/030992 SGTR-S36 p

3o operator would recognize the loss of recirculation capability at about 15 minutes after

^

the initiation of the ES-1,3 procedure in the case of high pressure recirculation.

The maximum operator action times to accomplish switchover to ECCS recirculation for the two cases developed below will be applied to all ECCS switchover actions.

f The operator action times for other scenarios may be longer than that calculated; however these times, as determined for the limiting cases, should be sufficiently long as to guarantee a high probability of success for these operator actions.

Maximum ECCS and Sorav For the SGTR scenario with maximum ECCS and containment spray actuation (i.e.,

no RCFCs), the RWST low level alarm is attained in approximately 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , while the RWST is completely drained at approximately 2.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (Reference 1, Case 15).

l At this point, there is no further addition of ECCS water to the RCS. The time to core damage for such a scenario has been determined to be approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months following loss of all ECCS injection. Thus, including the time for the operator actions to physically accomplish the switchover, the total time available to the operators to accomplish ECCS switchover may be estimated to be 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months beginning at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after event initiation.

Maximum ECCS and No Sorav For the SGTR scenario with maximum ECCS but no containment spray, the RWST low level alarm setpoint is attained in approximately 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , while the RWST is completely drained at approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (Reference 1, Case 16). At this point, there is no further addition of ECCS water to the RCS. The time to core damage for such a scenario has been determined to be approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months following foss of all ECCS injection. Thus, including the time for the operator actions to physically WP1145:1D/030992 SGTR-S37

)

1

i

(

accomplish the switchover, the total time available to the operators to accomplish ECCS switchover may be estimated to be 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months beginning at 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after event initiation.

2.23 RWST Refill Question: What is the rate at which the RWST must be refilled in order to match ECCS injection flow?

Answer:

The RWST refill rate must be:

1) 500 gpm for those scenarios witn no ' bleed and feed',

2) 400 gpm for those scenarios with ' bleed and feed'.

Discussion:

4 For the SGTR event, there are two distinct scenarios in which RWST refillis necessary to maintain core cooling. The first scenarioincludes those cases in which ECCS flow l

is maintaining core cooling, such as following SG overfill and the consequential failure of a relief valve causing continued primary to secondary break flow. The first scenario also includes the case in which AFW is not available and ' bleed and feed' cooling should be initiated per FR-H.1 but cannot due to the failure of the pressurizer PORVs.

For these cases, the. WST drain is controlled by the equilibrium pressure in the RCS; R

that is the pressure at which the ECCS flow and the breakflow are approximately equal. The second scenario includes the case in which ' bleed and feed' cooling is initiated via the opening of the pressurizer PORVs, and the RWST drain is controlled -

by the equilibrium between the flow through the open PORVs and the incoming ECCS flow.

WP1145:1Dl030992 SGTR-S38 I

4 1

i For the first scenario, since the number of pumps will control the equilibrium pressure in the RCS the actual ECCS flow is a function of the number of operating ECCS pumps. A successful RWST refill rate will match the ECCS injection flow rate. -To encompass all scenarios, the case with all ECCS pumps operating will be considered.

For this instance, the equilibrium ECCS flow is approximately 65 lb/sec, or 500 gpm.

Therefore, the RWST refill rate should be 500 gpm. Note that if RWST refillis started right away, a constant refill rate of 325 gpm would successfully maintain RWST inventory for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

i For the ' bleed and feed' scenario, the operation of both pressurizer PORVs will be considered. In this instance, the equilibrium ECCS flow is approximately 140 lb/sec, or 1100 gpm. Therefore, the RWST refill rate should be 1100 gpm. However, for this case, RWST refill is initiated via ECA-1.1. This procedure includes a graph of.

' minimum ECCS flow rate' vs. time after trip. Should the operator utilize this graph, the necessary RWST refill rate can be reduced substantially based on the time after reactor trip. Specifically, for the case with ' bleed and feed' cooling, the latest j

possible time to initiate ECCS recirculation (or RWST refill) has been determined to be 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months after reactor trip with no containment sprays and 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after reactor trip with containment sprays operable. Therefore, the RWST refill rate for these instances based on Figure 1 of ECA-1.1 would be 150 gpm and 175 gpm, respectively.

Realistically, since the flow from the ECCS pumps cannot be throttled, the operator would be expected to minimize ECCS flow by terminating the ECCS pumps. One

, 7 charging pump delivering flow to the RCS at a pressure of approximately 1000 psia results in a total flow of approximately 400 gpm. Thus if the operators use Figure 1.

of ECA-1,1, a successful RWST refill rate would be 400 gpm.

WP1145:1D/030992 SGTR S39

I l.

2.24 Operator Action to Establish RWST Refill Ouestion: What is the maximum time for the operators to initiate RWSTrefillin order to prevent core damage?

Answer:

The maximum time for the operators to initiate RWSTrefillto prevent core damage is:

1)

With no 'bieed and feed', the maximum time for the operators to a

initiate RWST refillis 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months ,

?

2)

With ' bleed and feed', the maximum time for the operators to initiate RWST refillis 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months if containment sprays are operating and 7 l

hours if containment sprays are inoperable or not actuated.

Discussion:

For the ' bleed and feed' case, the time for the operators to initiate RWST refill to prevent core damage can be obtained from an evaluation of the operator action time to initiate ECCS recirculation. Based on an evaluation presented in the Large Break LOCA Success Criteria Notebook (Reference 8), it is concluded that the operators would be likely to conclude that the plant was experiencing a loss of ECCS recirculation capability at about 10 minutes after initiation of 'switchover to recirculation is first attempted. In other words, the operators would transfer to Zion EOP ECA-1.1 (Loss of Emergency Coolant Recirculation) at about 10 minutes after they first enter the ES 1.3 procedure (Transfer to Cold Leg Recirculation).

Upon entry into the ECA-1.1 procedure 10 minutes following the RWST low level alarm, the operators are instructed to begin refill of the RWST. Therefore, it is i

WP1145:1D/030992 SGTR-S40

I assumed that RWST refill operations are started at this time. As noted in Section L.

2.22, two cases will be examined - containment sprays operating and no containment sprays. For the case with containment sprays operating, the RWST low level alarm is attained at approximately 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months with the RWST emptied at 2.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (Reference 1, Case 15). At this point, there is no further addition of ECCS water to the RCS. The time to core damage for such a scenario has been determined to be approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months following loss of all ECCS injection. Thus, including the time for the operator actions to identify the lack of ECCS recirculation and transfer to ECA-1.1, the total time available to the operators to accomplish RWST refill may be estimated to be 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months beginning at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after event initiation.

For the case with no containment sprays, the RWST low level alarm setpoint is attained in approximately 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , while the RWST is completely drained at r

approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (Reference 1, Case 14). At this point, there is no further addition of ECCS water to the RCS. The time to core damage for such a scenario has been determined to be approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months following loss of all ECCS injection.

Thus, including the time for the operator actions to identify the lack of ECCS

~

recirculation and transfer to ECA-1.1, the total time available to the operators to accomplish RWST refill may be estimated to be 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months beginning at 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after l

event initiation.

In the case of RWST refill which is initiated via ECA 3.2 due to low RWST level in conjunction with low containment level, RWST refill is initiated fairly early, when the RWST level is at 19.5 feet.

With respect to timing, this level is attained at approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (recall no containment pressurization so no containment sprays), with the RWST emptied at approximately 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Core damage is not predicted to occur _until approximately 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months . Therefore, the total time available to the operators to accomplish RWST refill may be estimated to be 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months beginning at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after event initiation.

WP1145:1D/030992 SGTR-S41

1 I

O 3.0

SUMMARY

i All of the possible success' states have been determined for the SGTR plant response.

l tree. These success states, arranged by system, are listed in Table 1. The mission -

time associated with each of the system success criteria are also summarized in '

Table 1.

The success criteria is listed for each of these nodes as determined in Sections 2.1 through 2.24 of this Notebook. The success criteria for prevention of j

core damage as well as the success criteria for prevention of large releases of -

radioactivity are included on this table.

\\

The identifiers for each column are:

AFW Auxiliary Feedwater i

TK Refueling Water Storage Tank CCP ECCS Injection Using the Centrifugal Charging Pumpts)

SIP ECCS Injection Using the Safety injection Pump (s)

ORF Operator Action to Establish Alternate Feedwater ALT Alternate Feedwater to Steam Generators OBL Operator Action to initiate Bleed and Feed BL RCS Bleed via Two Pressurizer PORVs OAl Operator Action to isolate the Ruptured SG MSI Closure of Ruptured SG MSIV (and associated steam paths) OR Closure of Intact SGs MSIVs (and associated steam paths)

OAF Operator Action to isolate Feedwater Flow to Ruptured SG AFI Closure or Throttling of Feedwater Pump (s) Discharge Valve (s)

ODS Operator Action to initiate RCS Cooldown via intact SGs j

DS RCS Cooldown via Steam Dump from Intact SGs (to condenser or atmosphere)

ODP Operator Action to Depressurize the RCS t

WP1145:1D/030992 SGTR-S42

.. ~

I P

l DP RCS Depressurization via Normal Pressurizer Spray OR

~

Pressurizer PORV OR Auxiliary Pressurizer Spray OIR Operator Action to Reduce ECCS Injection ONC Operator Action to Establish Normal Charging NC Realigr. Centrifugal Charging Pumps to VCT for Normal Charging.

FC Reactor Containment Fan Coolers CSI Containment Spray injection OHX Operator Action to Establish RHR Heat Exchanger Cooling j

RHX-RHR Heat Exchanger l

ORC Operator Action to Establish ECCS Recirculation HPR High Pressure Recirculation ORT Operator Action to Refill the RWST l

RTK RWST Refill Cl Containment Isolation i

.i l

.I

.i

.I WP1145:1D/030992 SGTR-S43 i

.2".

~

Table 1 (Page 1 of 61 SGTR Success Criteria System Conditional Note-Functional or Success Status of Mission book Requirement Action Criteria Other Systems time Conswnt s Sect.

Steam Generator AFW

> 1/2 MD ArW Punps ATW Throttle 6.0 Hours Mission time based on 2.3 Inventory; or 1/1 TD AFW Pump Vgive -

expected max time to initial Heat Sink to 4/4 SGs Restricted conplete op acts.

or

> 1/2 MD AFW Pteps AFW Throttle 6.0 Hours 2.3 to 1 3/4 SGs Valve - Open or 1/1 TD AFW Ptep AfW Throttle 6.0 Hours 2.3 4

to 1 3/4 SGs Valve - Open

-i SI ORF

< 25 minutes AFW Failure N/A Op Act time based on.

2.4 3 5 minutes Ai1 ECCS SG overfill prevention 2.5

< 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AFW Failure Op Act time based on 2.4 a 5 minutes' No ECCS N/A SG overfIt1 prevention 2.5

'80d ALT 1/3 Main Feed Pteps Condensate 6.0 Hours Mission time based on 2.4 to 1 1/4 SGs Booster Peps OK expected man time to 2.5 complete op acts 01 ORF

< 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AFW Failure N/A Op Act time based on 2.4-a 5 minutes Att ECCS bleed & feed time 2.5.

< 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

AFW Falture N/A Op Act time based on 2.4 3 5 minutes Only 1 CCP bleed & feed time 2.5 i

and ALT 1/3 Main Feed Ptsps Condensate 6.0 Hours Mission time based on 2.4 to 1 1/4 SGs Booster Pmps OK expected man time to 2.5 -

conplete op acts WP1145:1D/030992 SGTR-S44

. ~

4.-

&^

inble 1 (Page 2 of 61 SGTR Success Criteria System Conditional Note-Functional or Success Status of Mission book Requirement Action Criteria Other Systems Time Coninent s Sect.

Water Source for TK

> 224,890 get and None 24.0 Mours Basis provided in Ref.

Core and

> 1700 nwn boron

'Overalt Criteria and 16 Containment Cooling Specist Systems' SC l

Injection Phase CCP

> 1/2 Charging Pirps IK Success 6.0 Hours High Press Inject only 2.1 Core Cooling to > 2/4 Cold Legs reg; ired if AFW faits or

~

SIP

> 1/2 St Ptsnps TK Success 6.0 Hours only required if 2.1 to >2/4 Cold Legs CCP faits Feed ard Bleed OBL

< 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months AFW, ORF and N/A Begin Bleed & Feed 2.15 Core Cooling a 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ALT Fait before RWST enpty a_nd 2.16 BL 1/2 Przr PORVs CCP or SIP 24.0 Hours Need water thru PORVs Success for ECCS Recirc Steam Generator OAl

< 29 Minutes None N/A SGTR diagnosed; rtet.

2.6 Isotation a t*O SG Identified

_and 2.7 Mst 1/1 Msiv on None 24.0 Hours Mission time based on rtptured SG duration of SG Iso.

E 3/3 Mstys on Rupt SG MSiv 24.0 Hours Att other steam paths intact SGs failure should be isolated and DAF

< 20 minutes AFW or ORF/ ALT N/A SGTR diagnosed; rtet.

a t=0 Success SG Identified

!!G!

AFI 1/1 MD AFW flow AFW Success 24.0 Hours Mission time based on regulating valve duration of SG iso and 1/1 TD AFW flow regulating valve, to rtptured SG WP1145:1D/030992 SGTR-S45

. p.

t

-f :.

Table 1 (Page 3 of 61 SGTR Success Criteria System Conditional Note-Functional or Success Status of Mission book Requirement Action Criteria Other Systems ilme Conenents Sect.

Steam Generator o._r Isotation lcont)

AFI 1/1 MFW flow AFW Falture; 24.0 Hours Mission time based on (cont) reg valve and 1/1 ORF/ ALT Success duration of SG iso MFW flow bypass reg valve, to rupt SG Initial RCS 005

< 5 minutes CAI/MSI Success N/A Prevent SG overfitt 2.8 Cooldown a 20 minutes 2.9 a_n_d DS 2/3 steam dip Condenser 6.0 nevrs Mission time based on valves Available expected man time to 2C comtete op acts.

2/3 intact SG ARVs Condenser Not Avaltable or 005 1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OA!/MSI Failure N/A 1000F/hr cooldown to OAF /AFI Failure Reduce ECCS, extend agj or RWST Availability CCP Failure SIP Success DS 2/3 steam dtmp Condenser 6 Hours Mission time valves Available consistent with that or Condenser Not above 2/3 intact SG ARVs Available RCS ODP t.$ minutes ODS/DS Success N/A No RCS Depress until 2.10 Depressurization a 35 minutes RCS Cooldown Conplete

_an_d 2.11 DP Prar Normal Spray RCPs Not Irlpped 24.0 Nours Success End State can be attained without of 1/2 Prtr PORVs Prtr Normal 24.0 Hours RCS Depressurization Spray Unavail 0.L Przr Aux Spray Prtr Norm Spray 24.0 Nours Mission times based on

& PORY Unavait bleed and feed WP1145:1D/030992 SGTR-S46 cr

-- ww

'-eg

-e 4'ms' a

w-eTag=rei-3*'

s b%,-

r i M d

..6:

Table 1 (Page 4 of 6)

SGTR Success criteria System Conditional hote-Ftsictional or Success Status of mission book Requirement Action Criteria Other Systems Time Coments Sect.

RCS Inventory otR 5 5 minutes ODP/DP Success N/A Prevent SG overfitt 2.12 control a 47 minutes 5 10 minutes ODP/DP Failure N/A a 35 minutes

_and ONC 5 5 minutes (DP/DP Success N/A 2.13 a 47 minutes CIR Success 5 10 minutes ODP/DP Falture N/A' a 35 minutes CIR Success 1/2 Charging Pw p OIR Success 18 Hours Mission time based on 2.14 in Normal Charging ONC Success 6 hrs of initial Mode.

injection 0J OIR 5 1 Hour OAI/MSI Failure N/A Extend RUST 2.12 or Availability OAF /AFI Falture or CCP Failure SIP Success and ODS/DS Success, I

Recirculation ORC

< 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months CSI Success N/A Recirc only if AFW 2.22 Core Cooling a 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Att ECCS Falture and 8 teed &

Feed initiated 2.21

< 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months CSI Falture N/A a 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months All ECCS

_agd HPR

> 1/4 High Pressure R.HR aligned to 18.0 Hours Mission time besed on pwps (CCP or SIP) recirc sump; 6 hr inittat injection to > 2/4 Cold Legs ORC Success WP1145:1D/030992 SGTR-S47

r p

Table 1 IPage 5 of 61 SGTR Sweess Criteria System Conditional Note-Functional or Success Status of Mission book Requirecient Action Criteria Other Systems Time Cormnents Sect.

RWST Refitt ORT

< 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months No Steed & Feed N/A Prevents Core Damage 2.6 a 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months if ECCS Recire is.

i and unaval1abte 2.24

> 500 gpa refit L 18 hours RfC or ORT

<3 hours Bleed & Feed N/A Mission time based on a 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months initiated; 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months initial CSI Success injection

< 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months Bleed & Feed N/A a 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months initiated CSI Failure

_and RTK

> 400 gpa refiti 18 Hours Long Tera Heat FC

> 1/5 RCFC None 24.0 Hours Prevents Contairment 2.17

^

Removal Failure for Core Damage Sequences 2.19

+-

or FC

= 0/5 RCFC 24.0 Hours Success, but requires 2.20

_and Accident Management ORC

< 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months CSI Success N/A 2.21 4 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Att ECCS 2.22

< 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months CSI Falture a 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Ati ECCS agd HPR

> 1/4 high pressure Rmt aligned to 18.0 Hours AFW, ORF/ ALT Fait; ptmps (CCP or SIP) recirc step; init. bleed & feed in to >2/4 cold legs-ORC Success order for ECCS recire ot i

?

0 WP1145:10/030992 SGTR-S48 1

't e

s e,-n w,-

..w-,

.c e...-=wr-

--v.,

- - +, *

~.,..,e u

,,-~

,.<r w

r

,..m.

ew.

,w r,i

.m Table 1 (Page 6 of 61 SGTR Success Criteria Systers Cceviitional Note-Functional or Success Status of Mission book Requirment Action Criteria Other Syst ms time Coments Sect.

0/5 RCFC wone 24.0 Hours Prevents Contairunent FC

=

d Falture for Core OMX

< 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months N/A Damage Sequences 1/2 RHR Hn OMX Success 24.0 Hours d

HPR

> 1/4 high pressure RHR aligned to 18.0 Hours AFni, ORF/ ALT Fait; p.rps (CCP or SIP) rectre suy:

init. bleed & feed in to >2/4 cold legs ORC Success order f or ECCS recirc Accident Management Short Term CTMt CSI

> 1/3 Spray Pteps IK Success 2.4 Hours Not Required for 2.18 Heat Removal /

Pressure Reduction Fission Product Scrubbing Containment Ct Att lines > 2" Dia.

None 24.0 Hours 1.17 Isolation

" Isolated" WP1145:1D/030992 SGTR-S49

~

_vg-m,3%se e

t=>

Sr

+**=e?

g

-ev=

m-3w-*-

t e-e

'm-w se w

y we---

~-

w a

m 13--7

4.0 ACCIDENT MANAGEMENT /IPE INSIGHTS

(

1 The IPE and accident management insights identified during the development of the SGTR success criteria are documented in this section.

RCP Trio In Step 15 of ECA-3.1 and Step 10 of ECA-3.2, the operators are instructed to stop 2 of 4 RCPs. A note in the procedure instructs the operators to trip RCPs A and C, since normal pressurizer spray is supplied via loops B and D. However, analyses from Reference 1 show that reverse heat transfer may occur in the loop with the ruptured steam generator tube. This energy transfer to the RCS from the secondary is a competing effect to the RCS cooldown which should be in progress in ECA-3.1 or ECA-3.2. The same analyses show that RCP trip in the ruptured loop results in a reduction in this negative heat transfer, thus improving the RCS cooldown rate. Since the RCS cooldown rate may be important once the operators are completing actions 1

via ECA-3.1 or ECA-3.2, it is suggested that these procedural steps include a note regarding reverse heat transfer and the tripping of the RCP in the loop with the ruptured steam generator tube.

RCS Cooldown and SG Level l

One of the important operator actions following a SGTR event is the RCS cooldown.

Step 14 of E-3 instructs the operators to cooldown the RCS at " maximum" rate until the target temperature is reached and then maintain a 100*F/hr cooldown rate. Step 8 of ECA-3.1 and step 4 of ECA-3.2 instructs the operators to cooldown the RCS at 100*F/hr until the RHR system can be placed in service. Now consider the AFW flow rate. Depending on the operability of the AFW pumps, the AFW flow to each SG will range from approximately 100-200 gpm. Analyses from Reference 1 show that WP1145:1D/030992 SGTR-S50 i

8

~~

this AFW flow is not sufficient to maintain levelin the SGs during the initial phase of t

the RCS cooldown. Calculations indicate that with all AFW pumps injecting, and with maximum cooldown rate, the SG level will not stabilize until approximately 100*F of cooling has been achieved. Therefore, it is suggested that a note or caution be included in the Zion EOPs to inform the operators of the expected SG level decrease during the RCS cooldown.

SG Overfill in all Steamlines it is noted that for the scenario in which the ruptured SG cannot be isolated, there is a high probability that SG overfill will occur. Without isolation of the ruptured SG, the i

secondary water will spill into the steam lines of all steam generators. Although References 13 and 14 indicate that no failure of the steam lines will occur, this is still a highly undesirable situation. Therefore, the importance of closing the MSIV in the ruptured SG steamline should be highly stressed during operator training.

Bleed and Feed Analyses from Reference 7 indicate that only 1 pressurizer PORV is needed for success of the ' bleed' portion of bleed and feed cooling, although the EOP instruct the operators to open both pressurizer PORVs. Perhaps the FR-H.1, Step 17 RNO column should be modified such that the operators continue with FR-H.1 procedure if only 1 PORV can be opened instead of being directed to open all head vent valves,-

depressurize a SG to atmospheric & align service water.

l

5.0 REFERENCES

1.

Letter DFH-91-015 of March 6,1992 from Doug Holderbaum (Westinghouse at CECO) to File,

Subject:

SGTR success criteria.

WP1145:1D/030992 SGTR-S51

2.

System Notebook for Electrical Power Distribution System, Zion Station Units I

1 and 2, prepared by IPEP, Revision 0, April 1992.

3.

CECO Letter of June 11,1990 from George Klopp (CECO) to M. J. Loftus (Westinghouse).

4.

Westinghouse letter of July 15,1991 from Bob Lutz (Westinghouse) to Xavier Polanski iCECo),

Subject:

AFW system design.

5.

" Background Document for FR H.1:

Response to Loss of Heat Sink, Westinghouse Owners Group Emergency Response Guidelines, Rev.1 A, September,1989.

6.

Letter DFH-91-001 of January 2,1991 from Doug Holderbaum (Westinghouse at CECO) to Bob Lutz (Westinghouse),

Subject:

Zion Small LOCA MAAP Analyses 1

7.

Small LOCA Success Criteria Notebook, Zion Station Units 1 and 2, prepared by IPEP, Revision 0, March 1992.

8.

Large LOCA Success Criteria Notebook, Zion Station Units 1 and 2, prepared by IPEP, February 1992.

9.

Letter from X. Polanski (CECO) to Bob Lutz dated June 7,1990 regarding Zion MAAP parameter file.

10.

Letter from X. Polanski (CECO) to M. Loftus (Westinghouse) dated February 5, 1991 regarding RHR pump operability.

11.

Letter from George Klopp (CECO) to M. Loftus (Westinghouse) dated June 11, 1990.

12.

Steam Generator Tube Rupture Plant Response Tree Notebook, Zion Station Units 1 and 2, prepared by IPEP, March 1992.

13.

NUREG-0844, "NRC Integrated Program for the Resolution of Unresolved Safety issues A-3, A-4 and A-5 Regarding Steam Generator Tube Integrity,"

Final Report, September 1988 (Division of Engineering and System Technology, Office of Nuclear Reactor Regulation, USNRC).

14.

Letter dated October 20, 1982 from L.C. Shiek (Lawrence Livermore Laboratory) to K.R. Wichman (NRC);

Subject:

Maximum Stresses in Zion Unit 1 Main Steam Piping.

l l

WP1145:1D/030992 SGTR-052 l

\\

I--

' 15.

Letter from X. Polanski (C5G) to M. Loftus (Westinghouse) dated February 18, 1992 regarding Zion Success Criteria.

16.

^>erall Criteria and Special Systems Success Criteria Notebook, Zion Station Units 1 and 2, prepared by IPEP, April 1992.

l 17.

Cnntainment Isolation Notebook Zion Station Units 1 and 2, prepared by IPEP, February 1992.

+

18.

Westinghouse Celculation Note CN-COA-92-106, SGTR Success Criteria Regarding ECCS Reduction.

F

(

i i

WP1145:1D/030992 SGTR-S53

],,

'NRC Information Request - Zion'IPE

- HRA Phase il Validation Checklists The checklists are included as Appendix A and B in the Phase Il HRA Notebook, and-are attached.

e a

1 4

9 0

I e

e f

I 5

e r

i 3

Appendix A:

Checklist for identifying the Performance Shaping Factors that Apply to Each Operator Action i

i 4

i i

e l

i 5

h f

i i

1 1

i WP1183:1D/032792 A-1

Performance Shaping Factor Checklist Operator Action Plant Date Initiating Event / Special Conditions 1

Diaanosis/ Situation Assessment PSFs Does operator understand nature of event?

What is likelihood operators will misinterpret event?

Help: symptoms / indications strongly indicate initiating event initiating event symptoms / indications are very clear and lead to single conclusion primary indication is alarmed primary indication is carefully monitored or routinely scanned initiating event symptoms / indications are frequently practiced in the simulator within the context of this event event is perceived by operators to be a high-likelihood event operator workload is low when indications occur other indicators are quiet (no other alarms) when indications occur the procedure supports interpretation of initiating event well the procedure has " catch" steps to detect errors in interpretation other factors -

Hinder: symptoms / indications mask or obscure initiating event there is no single initicting event initiating event symptoms / indications are difficult to perceive (i.e., not salient) operator workload is very high.vhen indications occur other malfunctions occur to oWure or mask primary event other manual or Ettomatic ne action occurs to obscure or mask primary indications (e 1. shrink 'id w sil) initiating event syr ptoms/li E.ans are perceived but not easily interpreted indications are misleading indications are likely to be interpreted as something else (more familiar).

initiating event symptomshndications are perceived but not given weight indications are likely to be explained away as " noise" indications are interpreted as false alarm some critical indicator is available only to a single RC and is unlikely to be picked up by other control room personnel event is perceived by operators to be a very low-likelibood event other factors -

f WP1183:1D/032792 '

A2

f-

2. Procedure Selection PSFs What is likelihood operator will identify and transfer to correct procedure? -

Help: indications and procedure criteria are clear for transition to correct procedure criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure criterion for transition to correct procedure reouires simple reading of indications and requires no judgment or interpretation other factors -

Hinder indications may not be clear or criteria for transition may be ambiguous criterion for transition to correct procedure is not explicit in current procedure criterion for transition to correct procedure requires judgment or interpretation criterion for transition to correct procedure requires sustained monitoring to judge (e.g., trends over time) primary indications for transition may not be manifest when transition step is reached-primary indications for transition may dissipate or disappear before transition step is reached other indications may result in transition to a different procedure before " desired" transition step is reached there are strong indications to transfer to a different procedure other factors -

f

3. Intention to Act PSFs - Specific Cues to Action i

What is likelihood operator will perceive cues to action?

Help: indications for action are salient and unambiguous j

cues are identified in procedure in unambiguous way (i.e., objective, clear) cues are highly salient (i.e., position, discriminability) there is high redundancy in cues low operator workload when cues occur other factors -

F 1

WP1183:1D/032792 A-3 i

Hinder indications are obscured cues are not reliable (given event) cues are obscured by other indications cues are not located near likely operator positions (hard to fjnd) cues require mental effort comparison of severalindications calculation, determination of rate knowledge of special context (e.g., setpoint shift) high operator workload when cues occur there are more familiar or frequent interpretations of cue there is likely to be change in personnel (e.g., shift change) between initial event and time of action other factors -

4. Intention to Act PSFs - Likelihood for Intentional Violation What is likelihood operator will intentionally NOT take action or will delay action?

Help: Action is compatible with all goals the action's effect is clearly understood and fits well with the goals of the current procedure the operators are well trained on the goals of the action and of the larger procedure training, procedures, and organizational climate (i.e., safety culture) instill and reinforce appropriate goal prioritization other factors -

Hinder other goals conflict with action or severe economic consequences will result and operator significantly delays or totally avoids action taking action may violate standard operating practice (e.g.,'take operator out of optimal operating band but not into unsafe condition) taking action may lead to reduced availability of safety systems, equipment, or instruments (may violate tech specs or design basis availability) taking action may have a negative effect on some safety function (goal conflict) there is a significant uncertainty or unknown risk associated with taking the action (e.g., PORV after being opened may stick open) taking the action will adversely affect areas within plant and further burden recovery (e.g., contaminate aux building which will increase effort needed to' do maintenance)

WP1183:1D/032792 A-4

taking the action will have severe consequences associated with cost (e.g., plant will be shut down for major cleanup after bleed and feed) taking the action will release radiation to environment j

other factors -

5. Intention to Act PSFs - Schedulino/Prioritizino the Action-What is likelihood operator will not take action due to competition from other activities?

Help: The action takes precedence over other actions and can be executed immediately the action is very high in priority the action can be executed immediately; it does not rely on other actions the action is needed to allow other operators to continue working other factors -

Hindec Other actions compete for resources or there is delay before action can occur there are other actions of greater importance or greater urgency the procedure is written to allow significant fleribility for sequencing of actions (e.g.,

words such as "as time permits...")

the action may not be executed immediately because there is a need for another criterion to be satisfied first (e.g., wait till a parameter reaches value x) the action may not be executed immediately because operators are trying to achieve the goal through another (more preferred) action the action requires several operators to coordinate activities other factors -

6. Execution PSFs - Omission and Commission Errors What is the likelihood operator will omit step or execute it incorrectly?

Help: Context, procedures, etc. lead to specific actions procedure is highly practiced and/or memorized action is logically required to proceed in procedure (e.g., interlock or permissive) controls are labelled or grouped to make them easily identified execution uses controls with only two settings; controls are clearly marked other factors -

Hinder Specific actions are somehow incompatible with other aspects execution requires a difficult coordination between operators execution requires a control action to be taken outside of control room execution requires following procedures with an unusual or difficult logic

. WP1183:1D/032792 A-5

execution requires information found in a caution or note (not in procedural step) specific information (e.g., valve control number) is not specified in procedure actions required for procedure are severely underspecified execution requires the use of more than one operating procedure execution requires a long list of substeps a major component of set of actions is strongly associated wit,h another context and may, therefore, lead to inappropriate actions (capture-type slip) execution is likely to be done in order different from procedure's order controls are not placed near important indicators that determine execution controls are likely to be confused with other similar controls controls go against standard operational stereotype (e.g., flip a toggle up to turn off) control can have many different settings, each of which has different meaning execution requires some type of continuous control (e.g., tuning) where feedback is difficult to judge (e.g., delayed in time) execution requires maintaining a parameter within a tight operating band (e.g., to avoid inadvertent trip or safety system activation) other factors -

7. Execution PSFs - Detection of Errors What is the likelihood operators will recognize error has been made?

Help: Formal checks to identify errors procedure has explicit catch steps or verifications

]

other operators are likely to do careful checking of performance there is a very salient indication when error is made or when action was successful L

(e.g., alarm, interlock) other factors -

l Hinder Little or no feedback / indication error was made other operators are all occupied in some other activity and will not check performance there is very poor feedback on effect of control action no direct indicction indication is not close to control other factors -

I WP1183:1D/032792 A-6

8. Execution PSFs - Recovery from Error What is likelihood operator can recovery from error?

Help: Forrnal procedure to recover there is procedure written for recovery from error other factors -

Hinder: Little or no indication of how error has changed situation; recovery actions unclear incorrect execution cannot be recovered due to damage done recovery requires a set of actions different from the set of actions done incorrectly there is severe time constraints for executing recovery actions other factors -

9. Local Stress Factor Combine the following to determine stress on operator taking actions:

- workload

- time available vs time required

- potential severe consequences of actions being taken WP1683:1D/032792

\\-7 et,

t.t 7

Appendix B Summary of Each Operator Action and its Relevant PSFs t

e p

i WP1183:1D/032792 B-1

i Establish ECC Recirculation Operator Action: ORC 1 and ORC 2 initiating Event: SB LOCA and in LB LOCA Action:

During LOCA events, the operator is required to begin switchover to sump recirculation when the RWST low-level alarm is actuated. This switchover requires aligning the ECCS for recirculation and starting and stopping the ECCS pumps. ORC 1 accounts for low-pressure recirculation and ORC 2 is high-pressure recir:ulation.

Set of actions:

ORC 1

- perceive RWST low-level alarm (1 out of 1 new)

- depress Si reset button (1/1)

- stop all but one containment spray pumps (2/3)

- stop RHR pump B (1/1)

- close RHR pump B suction isolation valve (1/1)

- simultaneously open recirc sump isol. valve (1/1)

AND close RHR cross-over valves (2/2)

- start RHR pump B (1/1)

ORC 2

- open CHG pump inlet valve (1/1)

- close makeup from RWST valves (2/2)

- close SI pump to RWST recire (2/2)

- verify valve is closed (1/1)

- open cross-over valves (2/2)

PSF Summary:

1. Diaonosis/ Situation Assessment PSFs in general, operators should be well aware that they have a LOCA situation; especially in the case of the LB LOCA. The following factors apply:

Help:

initiating event symptoms / indications are very clear and lead to single conclusion a.

b.

initiating event symptoms / indications are frequently practiced in the simulator within the context of this event event is perceived by operators to be a high-likelihood event c.

d.

operator workload is low when indications occur (except for SB LOCA with loss of feedwater) e.

other indicators are quiet (no other alarms) when indications occur WP1183:1D/032792 B-2

2. Procedure Selection PSFs There should be no difficulties in making transition to correct procedure. The following factors apply:

Help:

a.

criterion for transition to correct procedure is explicit step ih current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation

3. Intention to Act PSFs - Specific Cues to Action Cues to action are clear and salient. The following factors apply:

Help:

a.

cues are identified in procedure in unarnbiguous way (i.e., objective, clear) b.

cues are highly salient (i.e., position, discriminability) c.

Iow operator workload when cues occur

4. Intention to Act PSFs - Likelihood for Intentional Violation There seems to be no threat of this occurring (except in case where cooldown is successful but RHR cannot be initiated due to mechanical problems. In this case, operator may delay ORC action in attempting to correct mechanical problems.)

Help:

a.

the action's effect is clearly understood and fits well with the goals of the current procedure b.

the operators are well trained on the goals' of the action and of the larger procedure S. Intention to Act PSFs - Schedulino/Prioritizino the Action There seem to be no concerns here Help:

a.

the action is very high in priority b.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors No major problems have been identified is this area. All control room actions are executed with buttons or controls that only have twc..sitions, and all controls are well l

marked and segregated.

Help:

a.

execution uses controls with only two settings; controls are clearly marked

7. Execution PSFs - Detection of Errors -

Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications WP1183:1D/032792 B-3

8. Execution PSFs - Recovery from Error There is a concern here that unrecoverable damage can be done (actions in ORC 1 are "Stop RHR pump B" and "Open sump valve")

Hinder:

incorrect execution cannot be recovered due to damage done a.

(note: this applies to only two actions and a minute or two are available for recovery)

9. Local Stress Factor Workload workload on key operator is probably low. Nothing urgent is occupying his time and it is likely there will be no other alarms at time of key alarm.

Time available vs time required no significant time pressure. There is probably 20-30 minutes for recovery after action in the case of the LB LOCA and 60-90 minutes for the SB LOCA.

Potential severe consequences of actions being taken

~

failure to establish recirculation has serious consequences for core damage. If recirculation cannot be established, the RWST must be used (see ORT)

E I

t WP1183:1D/032792 B-4

Refill the RWST Operator Action:

ORT Initiating Events: SB LOCA and LB LOCA Special Conditions:

reached from procedure (ORT-p) reached from diagnosis of failure in ORC (ORT-d)

Action:

Entry to RWST refill is based on a diagnosis of the loss of RHR pump capability. This loss can occur under one of two conditions: 1) if RHR pumps are damaged early, or 2) if ECC recirculation cannot be aligned. Under one of these conditions, the operator is required to initiate makeup water to the RWST using all possible methods.

Note, the success of this action is especially critical when the switchover to sump recirculation action (ORC) is not carried out in response to the RWST low-level alarm (that is, ORC fails - the RHR pumps are not working). In this case the operator must transfer to the Loss of Emergency Coolant Recirculation procedure (ECA-1.1). Here, the

~

operator is instructed to initiate makeup water to the RWST using whatever means available.

Set of actions:

-perceive RWST fow-level alarm Blender makeup

- close VCT isolation valve (1/2)

- close makeup injection valve (1/2)

- open blender to RWST (outside CR) (1/1)

- open blender isolation (outside CR) (1/1)

- adjust makeup controls for H2O and boric acid (outside CR)

- start PW pump

- change pump speed Gravity refill of RWST from other unit's RWST

- open four pump suction valves (outside CR)

Refill RWST from spent fuel pit

- open valve (1/1)

- close either valve

- close valve (1/1)

WP1183:1D/032792 B-5

Maximize makeup to VCT

- close valves (2/2)

- open valves (2/2)

- adjust makeup controls for max flow

- perceive RWST low-low level alarm (level < 5 ft)-

- stop RHR, SI, charging, and entmnt spray pumps (8/8)

Establish normal charging flow

- close BIT outlet valves (2/2)

- open chg header isol. valves (2/2)

- open VCT valves (2/2)

- close emergency makeup va!ves (2/2)

- start chg pump (1/1)

PSF Summary:

1. Diaonosis/ Situation Assessment PSFs in general, operators should be well aware that they have a LOCA, especially in the case of a LB LOCA. However, the failure of the RHR pumps and' ensuing need for RWST refill (ORT-d) is probably a low likelihood event.

Help:

a.

initiating event symptoms / indications are very clear and lead to single conclusion b.

operator workload is low when indications occur (ORT-p)

Hinder:

event is perceived by operators to be a very low-likelihood event (ORT-d) a.

b.

operator workload is very high when indications occur (ORT-d)

2. Procedure Selection PSFs The procedures may not help in the ORT-d case.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure (ORT-p) b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation (ORT-p)

Hinden criterion for transition to correct procedure is not explicit in current procedure a.

(ORT-d) b.

criterion for transition to correct procedure requires judgment or interpretation (ORT-d)

J WP1183:1D/032792 B-6

3. Intention to Act PSFs - Specific Cues to Action There may be high workload in the ORT-d case due to repeated attempts to get RHR pumps going.

Help:

a.

cues are identified in procedure in unambiguous way (i.e., objective, clear) (ORT-p) b, cues are highly salient (i.e., position, discriminability) (ORT-p)

Hinden a.

high operator workload when cues occur (ORT-d) 4.

Intention to Act PSFs - Likelihood for Intentional Violation Operators may be aware of some risks associated with extended use of the RWST.

Hindec a.

taking action may lead to reduced availability of safety systems, equipment, or instruments (may violate tech specs or design basis availability) (ORT-d and p)

5. Intention to Act PSFs - Schedulino/Prioritizino the Action There may be difficulty in ORT-d with giving up on attempts to regain RHR pumps. There may also be difficulty associated with selecting and prioritizing sources of water (p + d)

Help:

a.

the action can be executed immediately; it does not rely on other actions (ORT-p)

Hinden a.

the action may not be executed immediately because operators are trying to achieve the goal through another (more preferred) action (ORT-d) b.

the procedure is written to allow significant flexibility for sequencing of actions (operator must select subset of methods and prioritize)

6. Execution PSFs - Omission and Commission Errors There are several potential difficulties here.

Help:

a.

procedure (for blender makeup only) is highly practiced or memorized Hinden a.

execution requires a control action to be taken outside of control room b.

specific information for some actions (e.g., valve control number) is not specified in procedure c.

actions required for procedure are severely underspecified d.

execution requires a long list of substeps

7. Execution PSFs - Detection of Errors There are no significant problems here 1

8. Execution PSFs - Recovery from Error There are no problems here WP1183:1D/032792 B-7

s

9. Local Stress Factor Workload ORT-p: workload is moderate ORT d: workload may be high because the operator may be trying to restore the RHR pumps before going to RWST refill.

Time available vs time required time factors are somewhat unknown, so the operator may be concerned Potential severe consequences of actions being taken failure to establish another source of water when recirculation is not possible has serious potential consequences l

WP1183:1D/032792 B-8

Establish Normal Charging Operator Action: ONC Initiating Events: SGTR and SB LOCA Action:

This is done subsequent to minimizing the ECCS flow (an extension of OIR). For an SGTR event, the operators are required to establish RCS inventory control via normal charging flow.

This may occur subsequent to RCS depressurization, but depressurization may not be needed.

Set of Actions:

- verify chg pump miniflow valves open (2/2)

- close BIT inlet valves (2/2)

- close BIT outlet valves (2/2)

- open chg header isol valves (2/2)

- verify chg line stop valve open (1/1)

- open RCP seal return valve (1/1)

- check RCP LBRTH deltaP 20-60 inches (1/1)

- control chg flow to maintain level between 20 and 80%

PSF Summary:

1. Diaonosis/ Situation Assessment PSFs in general, operators should be well aware that they have an SGTR or a LOCA situation.

Help:

a.

initiating event symptoms / indications are very clear and lead to single conclusion b.

initiating event symptoms / indications are frequently practiced in the simulator within the context of this event c.

event is perceived by operators to be a high-likelihood event d.

operator workload is low when indications occur e.

other indicators are quiet (no other alarms) when indications occur

2. Procedure Selection PSFt There should be no difficultie! I making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or -

part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation s

WP1183:1D/032792 B-9

c

.t

}

i

3. Intention to Act PSFs - Spec;fic Cues to Action Cues to action are clear and saliant.

j Help:

cues are identified in procedure in unambiguous way (i.e., objective, clear) a.

b, cues are highly salient (i.e., position, discriminability)-

i

?

c.

low operator workload when cues occur

-i

4. Intention to Act PSFs - Likelihood for Intentional Violation There seems to be no threat of this occurring Help:

a.

the action's effect is clearly understood and fits well with the goals of the current procedure b.

the operators are well trained on the goals of the action and of the larger procedure

5. Intention to Act PSPs - Schedulino/Prioritizina the Action There seem to be no concerns here Help:

a.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors No major problems have been. identified is this area. All control room actions are-executed with buttons or controls that only have two positions, and all controls are well marked and segregated.

Help:

a.

execution uses controls with only two settings; controls are clearly marked

7. Execution PSFs - Detection of Errors i

Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

i 3

t WP1183:1D/032792 B 10

- i.

e

(

l

9. Local Stress Factor Workload workload on key operator is probably low.

Time available vs time required no significant time pressure. The action is expected to be completed within 52 minutes when RCS depressurization is used ands. 45 minutes when.

depressurization is not required Potential severe consequences of actions being taken no severe consequences of failure 7

7 WP1183:1D/032792 B-11

Steam Generator Depressurization for Primary Cooling r

Operator Action: ODS2 initiating Event: SGTR

' Action:

For an SGTR event, the operators are required to initiate an RCS cooldown by dumping steam from the intact steam generators to attain subcooling in the RCS. The operator is expected to dump steam from the intact steam generators via the condenser cooldown valves (CCVs) or atmospheric relief valves (ARVs) at the maximum rate prior to the subsequent RCS depressurization step.

Set of Actions:

- turn off PRZR heaters (2/2)

- open 3 SG ARVs or 3 CCVs (3/3)

- verify RCS temp < 540 deg place switches in bypass interlock position momentarily (2/2)

PSF Summary-

1. Diaonosis/ Situation Assessment PSFs in general, operators should be well aware that they have an SGTR situation.

Help:

a.

initiating event symptoms / indications are very clear and lead to single conclusion b.

initiating event symptoms / indications are frequently practiced in the simulator within the context of this event c.

event is perceived by operators to be a high-likelihood event t

e.

Other indicators are quiet (no other alarms) when indications occur i

2. P.ocedure Selection PSFs There should be no difficulties in making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation

3. Interition to Act PSFs - Specific Cues to Action Cues to action are clear and salient.

Help:

a.

cues are identified in procedure in unambiguous way (i.e., objective, clear) b.

cues are highly salient (i.e., position, discriminability) i 1

1 WP1183:1D/032792 B-12

i s

4. Intention to Act PSFs - Okelihood for Intentional Vk)!ation There seems to be no threat of this occurring Help:

a.

the action's effect is clearly understood and fits well with the goals of the current procedure

5. Intention to Act PSFs - Schedulino/Prioritizino the Action There seem to be no concerns here.

Help:

a.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors Although control room actions are executed with buttons or controls that only have two positions, and all controls are well marked and segregated, there may be some difficulties in execution.

Help:

a.

execution uses controls with only two settings; controls are clearly marred l

Hinder:

a.

execution requires a difficult coordination between operators b.

execution requires following procedures with an unusual or difficult logic

7. Execution PSFs - Detection of Errors Procedures and indications support detection of errors e

Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

9. Local Stress Factor Workload workload on key operator is probably moderate.

Time available vs time required some time pressure. The action is expected to be completed within 20 minutes Potential severe consequences of actions being taken failure leads to overfill of Steam Generators and possibility of an RCS rupture, which will lead to a LOCA 3

WP1183:1D/032792 B-13.

Reduce ECCS Injection Operator Action: OIR Initiating Event: SGTR Action:

For an SGTR event, the operators are required to stop or mininiize ECCS flow to the RCS by stopping all but one charging pump and then aligning the remaining charging pump for normal charging. This means that two RHR pumps, two Si pumps, and one charging pump must be stopped. Note that for the case in which charging pumps are not available, this represents the operator action to stop two RHR pumps and one Si pump.

Set of Actions:

- verify RCS press stable or increasing (1/1)

- verify PRZR level > 4% (1/1)

- verify RCS subcooling >' 30 deg (1/1)

- verify total AFW flow > 340 GPM (combine 4 readings)

OR verify narrow range SG level > 4% (1/1)

- verify RVLIS > 60% (1/1)

- stop both RHR pumps (2/2)

- close both valves (2/2)

- stop both SI pumps (2/2)

- stop chg pumps (1/2)

PSF Summary:

1.

Diaono.<is/ Situation Assessment PSFs in general, operators should be well aware that they have an SGTR situation.

Help:

a.

initiating event symptoms / indications are very clear and lead to single conclusion b.

initiating event symptoms / indications are frequently practiced in the simulator within the context of this event c.

event is perceived by operators to be a high-likelihood event d.

other indicators are quiet (no other alarms) when indications occur

2. Procedure Selection PSFs There should be no difficulties in making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications j

and requires no judgment or interpretation 1

WP1183:1D/032792 B-14 l

1

3. Intention to Act PSFs - Specific Cues to Action Cues to action are clear and salient.

Help:

cues are identified in procedure in unambiguous way (i.e., objective, c' ear) a.

b.

cues are highly salient (i.e., position, discriminability) c.

Iow operator workioad when cues occur

4. Intention to Act PSFs - Likelihood for intentional Violation There seems to be no threat of this occurring Help:

a.

the action's effect is clearly understocd and fits well with the goals of the current:

procedure

5. Intention to Act PSFs - Schedulino/Prioritizino the Action _

There seem to be no concerns here Help:

a.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors Although control room actions are executed with buttons or controls that only have two positions, and all controls are well marked and segregated, there may be some difficulties in execution.

Help:

execution uses controls with only two settings; controls are clearly marked a.

Hinden a.

execution requires a difficult coordination between operators b.

execution requires following procedures with an unusual or difficult logic

7. Execution PSFs - Detection of Errors Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

WP1183:1D/032792 B-15

9. Local Stress Factor Workload workload on key operator is probably moderate.

Time available vs time required no significant time pressure. The action is expected to be completed within 52 minutes when RCS depressurization is used and' 45 minutes when depressurization is not required Potential severe consequences of actions being taken failure leads to overfill of steam generators and pressurizer and may create a small LOCA inside containment i

i i

t

.i WP1183:1D/032792 B-16

t Establish Normal RHR Cooling Operator Action: ONR Initiating Event: SB LOCA Action:

This operator action, an alternative to low-pressure recirculation, is used t; establish normal RHR cooling. This is used after a LOCA when the leak is stopped < <ninimized such that normal charging keeps up with coolant loss. It is also a component of normal shutdown.

Set of Actions:

- check RCS subcooling > 30 deg (1/1)

- turn PRZR heaters off (1/1)

- depressurize RCS PRZR with spray or with PORV until PRZR level > 20%

- stop chg pump (1/1)

Establish normal charging

- verify chg pump minificw valves open (2/2)

- close BIT inlet valves (2/2)

- close BIT outlet valves (2/2)

- open RCP seal return valve (1/1)

- check RCP LBRTH deltaP 20-60 inches (1/1)

- stop SI pumps (2/2)

- isolate accumulators: close Si acc isol valves (4/4)

Depressurize RCS

- open PRZR spray valves (2/2)

OR open PORV (1/1)

- verify RCS temp < 350 deg

- verify RCS press < 400 psig initiate RHR system cooling

- close RWST to RHR suction valves (2/2)

- open RHR to loop A hot leg suction valves (2/2) close RHR HX bypass valve (1/1) close RHR HX flow control valves (2/2) open RHR to cold leg inject valves (2/2)

- start RHR pump (1/1) open valve (1/1) throttle valve to maintain cooldown rate < 50 deg/hr (1/1)

WP1183:1D/032792 B-17 1

t PSF Summary:

1. Diaonosis/ Situation Assessment PSFs in general, operators should be well aware that they have a LOCA situation.

Help:

initiating event symptoms / indications are very clear and lead to single conclusion a.

b.

event is perceived by operators to be a high-likelihood event c.

operator workload is low when indications occur

d. other indicators are quiet (no other alarms) when indications occur

2. Procedure Selection PSFs There should be no difficulties in making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation

3. Intention to Act PSFs - Specific Cues to Action Cues to action are clear and salient.

Help:

a.

cues are identified in procedure in unambiguous way (i.e., objective, clear) b.

cues are highly salient (i.e., position, discrirninability) c.

Iow operator workload when cues occur Hinden a.-

there is likely to be change in personnel (e.g., shift change)' between initial event and time of action

4. Intention to Act PSFs - Likelihood for Intentional Violation There seems to be no threat of this occurring Help:

a.

the action's effect is clearly understood and fits well with the goals of the current procedure S. Intention to Act PSFs - Schedulina/Prioritizina the Action There seem to be no concerns here Help:

a.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors No major problems have been identified is this area. All control room actions are executed with buttons or controls that only have two positions, and all controls are well marked and segregated.

WP1183:1D/032792 B-18

Help:

a.

execution uses controls with only two settings; controls are clearly marked Hinder; a.

execution requires a long list of substeps

7. Execution PSFs - Detection of Errors Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

9. Local Stress Factor Workload workload on key operator is probably low.

Time available vs time required no significant time pressure. This action is expected to be establisaed within 2 hr:

Potential severe consequences of actions being taken failure has no significant consequences. However, if the RWST level is getting close to low-level alarm, operators may feel pressure to get normal RHR to avoid going to recirculation WP1183:1D/032792 B-19

Bleed and Feed: Initiate Safety injection and Open PORVs Operator Actions:

OSI and ODP Initiating Event: General Plant Transient Action:

Given a general plant transient with no auxiliary feedwater and no restoration of main feedwater, the operator is required to establish and maintain an emergency core coolant source for RCS bleed and feed cooling. Thus, there is a Deed to initiate Si manually.

When the SG 'evel reaches 36% of wide range indication, bleed and feed cooling must be established with the Pressurizer PORVs.

Set of Actions:

OSI

- verify wide range level in any 3 SGs < 24% (4/4)

- verify HPl flow path (1/1) OR

- check chg or Si pump running (1/2) OR

- align at least one chg or one Si pump OR

- turn Si switch to actuate SI (1/1)

-ODP

- verify and open all PRZR PORV block valves (2/2)

- open at least one PRZR PORV (1/2)

PSF Summary:

1. Diaonosis/ Situation Assessment PSFs Operators may not understand why the plant tripped Help:

a.

initiating event symptoms / indications are frequently practiced in the simulator in the-

)

context of this event Hinder:

a.

there is no single initiating event b.

event is perceived by operators to be a very low-likelihood event

2. Procedure Selection PSFs There should be no difficuities in making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation

-l WP1183:1D/032792 B-20 1

i

r k

3. Intention to Act PSFs - Specific Cues to Action Cues to action are clear and salient.

Help:

cues are identified in procedure in unambiguous way (i.e., objective, clear) a.

b.

cues are highly salient (i.e., position, discriminability)

4. Intention to Act PSFs - Likelihood for Intentional Violation Bleed and feed is not an action operators want to take Hinden taking the action will have negative consequences associated with cost (e.g., the a.

plant will be shut down for cleanup) b.

there is a significant uncertainty or unknown risk associated with taking the action (e.g., PORV after being opened may stick open)

5. Intention to Act PSFs - Schedulino/Prioritizina the Action Operators may delay taking the action Hinden

~

the action may not be executed immediately because operators are trying to a,

achieve the goal through another (more preferred) action

6. Execution PSFs - Omission and Commission Errors a

No major problems have been identified is this area. All control room actions are executed with buttons or controls that only have two positions, and all controls are well marked and segregated. The exception to this ule is the PORV control, which is spring-loaded and must be held open.

Help:

execution uses controls with only two settings; controls are clearly marked a.

Hinden a.

controls go against standard operational stereotype (for PORV control)

7. Execution PSFs - Detection of Errors Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

WP1183:1D/032792 B-21

n

9. Local Stress Factor

- Workload workload on key operator is probably high.

Time available vs time required there is time pressure to accomplish this action. This actions to initiate Si are expected to be completed within 5 minutes.

Potential severe corsequences of actions being taken 8

failure has potentially significant consequences.

i I

).

1 i

e i

'I WP1183:1D/032792 B-22

Restore Main Feedwater and/or Condensate Booster Pumps Operator Action: ORF Initiating Event: General Plant Transient 1

Action:

For a general plant transient (after reactor and turbine trip), the, operator is required to establish an alternate feedwater source to the steam generators when auxiliary feedwater fails.

Set of Actions:

- recogrize loss of heat sink and transfer to FR-H.1

- stop all RCP pumps (4/4) l Reset SI l

- verify safeguards breaker targets matched

- depress Si reset pushbuttons (2/2)

- verify Si activated and auto Si blocked (1/1)

~

- locally (outside control room) retet main generator 86 relays (1/1)

- start AFW pump (1/1)

- open FW isolation and regulating by-pass valves (8/8) 1 PSF Summary:

1. Diaonosis/ Situation Assessment PSFs Operators may not understand why the plant tripped Help:

a.

initiating event symptoms /indecations are frequently practiced in the simulator in the context of this event Hinden a.

there is no single initiating event

(

2. Procedure Selection PSFs There should be no difficuities in making transition to correct procedure.

Help:

a.

criterion for transition to correct procedure is explicit step in current procedure or part of standard operating procedure b.

criterion for transition to correct procedure requires simple reading of indications and requires no judgment or interpretation WP1183:1D/032792 B-23

v--

3. Intention to Act PSFs - Specific Cues to Action Cues to action are clear and salient.

Help:

cues are identified in procedure in unambiguous way (i.e., objective, clear) a.

b.

cues are highly salient (i.e., position, discriminability)

4. Intention to Act PSFs - Likelihood for Intentional Violation There seems to be no threat of this occurring Help:

a.

the action's effect is clearly understood and fits well with the goals of the current procedure

5. Intention to Act PSFs - Schedulino/Prioritizino the Action There seem to be no concerns here l

Help:

a.

the action can be executed immediately; it does not rely on other actions

6. Execution PSFs - Omission and Commission Errors One action is outside of control room.

Help:

k a.

execution uses controls with only two settings; controls are clearly marked -

Hinden a.

execution requires a control action to be taken outside of control room b.

execution requires following procedures with an unusual or difficult logic

7. Execution PSFs - Detection of Errors Procedures and indications support detection of errors Help:

a.

procedure has explicit catch steps or verifications

8. Execution PSFs - Recovery from Error There are no problems here.

9. Local Stress Factor l

Workload workload on key operator is probably moderate.

l Time available vs time required no significant time pressure. The action is expected to be completed within approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Potential severe consequences of actions being taken failure leads to a need for bleed and feed cooling.

WP1183:1D/032792 B-24

__

ML20059K919

Contents

Text

1.0 INTRODUCTION

SUMMARY

5.0 REFERENCES

1.0 INTRODUCTION

SUMMARY

5.0 REFERENCES

Subject:

Subject:

Subject:

Subject:

Navigation menu

ML20059K919

Text

1.0 INTRODUCTION

SUMMARY

5.0 REFERENCES

1.0 INTRODUCTION

SUMMARY

5.0 REFERENCES

Subject:

Subject:

Subject:

Subject:

Navigation menu

Search