ML20098D921
| ML20098D921 | |
| Person / Time | |
|---|---|
| Site: | Seabrook  |
| Issue date: | 03/16/1984 |
| From: | YANKEE ATOMIC ELECTRIC CO. |
| To: | |
| Shared Package | |
| ML20098D906 | List: |
| References | |
| PROC-840316, NUDOCS 8409280038 | |
| Download: ML20098D921 (285) | |
Text
{{#Wiki_filter:( EMERGENCY RESPONSE PROCEDURES (FOR INFORMATION ONLY)* This material was cooperatively developed for license operator training by the Seabrook Training Center staff, Westinghouse, and the Operations Department. The text materials and figures were developed for the purpose of instruction I and should not be used in plant maintenance or operation. I REVIEW t
- % P. ( ex::r 3 O_.'t- -
Date Si 8Si 84 L
& ms Date A lfo C$
/
T emer ManagenAsss: ant 8409280038 840918 PDR ADOCK 05000443 { F PDR
- Controlled Emergency Response Procedures Handouts will be issued at a later date.
f
,- - .~~-,2 . . , , , - , , _,n, , - - - - - - , ., . . - ,---,--,--,me-,,.,._,n,, -,,-,,,,,,-,--,,,.._,.,.,v. . --
1 INTRODUCTION TO EMERGENCY RESPONSE PROCEDURES
- CONSTRUCTION AND USE -
O 6 1 I ( l
- o + --
! 3 SITUATIONS THAT REQUIRE CORRECTIVE ACTION c j ( NO REACTOR TRIP OR Si REQUIRED)
~
i i
- l. _,
9 , y 7 MPEs and ops 3 7 l , NORMAL SAFE PLANT
"' '^
OPERATIONS l 8 3 j ir i OPTIMAL RECOVERY l PROCEDURES I and ECAs b 1r
- CRITICAL SAFETY FUNCTION RESTORATION PROCEDURES i
1 l m SITUATIONS WHICH HAVE REQUIRED m i REACTOR TRIP OR SI ACTUATION ) l i OPERATIONAL PROCEDURE PHILOSOPHY l FIGURE OP(TC Rev 0 3/84) 1
- I
. 0BJECTIVES
- EMERGENCY PROCEDURE SET .
4 MUST PROVIDE PROCEDURAL RESPONSES FOR ALL CONCEIVABLE EVENTS W10SE l PROBABILITY OF OCCURENCE EXCEEDS 10-8 8 MUST E RESPONSIVE TO EVENTS AM SYMPT 0MS i 0 MUST E BASED ON SOLID ANALYSIS TO ETERMINE MOST APPROPRIATE REC 0VERY l I METHOD i 8 MUST E VALIDATED AND VERIFIED TO E CORRECT i 1 i 4
EER6ENCY RESPONSE PROCEDURES (ERPs) COMPONENTS i 8 OPTIMAL RECOVERY PROCEDURES (0RPs) 1 1 i 0 EERGENCY CONTINGENCY ACTIONS TCAs) e CRITICAL SAFETY FUNCTION (CSF) STATUS TREES
. .y l 0 FUNCTION RESTORATION PWir&?: 'TRfs)
) u i i l ci
t i 1 i ? OPTIMAL RECOVERY PROCEDURES ! (ORPs) 1 i I 1 i______-_______________________________ _-- __ _ ____
e , OPTIMAL REC 0VERY PROCEDURES 0 EVENT-SPECIFIC 8 EVENT DIAGNOSTICS i I e OPERATOR GUIDANCE FOR PLANT REC 0VERY FROM KNOWN EVENT / CONDITION STATE i i ! 4 MAINTENANCE OF CSFs INHERENT IN PROCEDURES j e EQUIPMENT FAILURE CONTINGENCIES AND TRANSITIONS TO FRPs 1 l I I
,% .m. - M
'l e 9 4 i ] 1 l .. Ia e 4 i 4 . l EMERGENCY CONTINGENCY i ACTIONS l (ECAs) I i 1 i ) I 1 t i , ,i . I I i i______________ _ . _ _ _ _ _ _ _ - _ _ _ _ _ - -
4 a EMERGENCY CONTINGENCY ACTIONS 4 j 8 EVENT-SPECIFIC 0 POSSIBLE BUT HIGHLY UNLIKELY EVENTS i 8 OPERATOR GUIDANCE FOR PLANT REC 0VERY 1 0 TRANSITIONS BACK TO ORGs 1 8 MAINTENANCE OF CSFs APPLICABLE j 1 ! 8 TRANSITIONS TO FRPs WHEN DIRECTED 4 i k
M. N \ CRITICAL SAFETY l FUNCTIONS l I 1 l
i E i CRITICAL SAFETY
- FUNCTION ,
i AN ACTIVITY WHICH ASSURES THE INTEGRITY OF THE PHYSICAL BARRIERS AGAINST i
). RADIATION RELEASE ,
i
~
l l l O e h
i i CRITICAL SAFETY FUNCTION SELECTION i 0 COMPLETE SET a l * ? ) e LIMITED NUMBER 1 i e COMPATIBLE WITil ERP STRUCTURE ! O PREVENT BARRIER FAILURE i j i i 1e u8
" DEFENSE IN DEPTH" (MULTIPLE BARRIERS) 4 FUEL MATRIX, FUEL CLAD 4 REACTOR COOLANT SYSTEM e CONTAINMENT -
0 DISTANCE
- . n CRITICAL SAFETY FUNCTIQill PRIORITY FUNCTION SYMBOL i
- 1) SUBCRITICALITY (S) l
- 2) CORE COOLING (C) i
- 3) EAT SINK (H)
~
j 4) INTEGRITY (P) 1 5) CONTAINMENT (Z) 4 ! 6) INVENTORY (I) - 3 4 t . 9 J t j
+
CRITICAL SAFETY FUNCTION SET ! 4 MAINTENANCE OF SUBCRITICALITY i i
- 4 MAINTENANCE OF CORE COOLING i
i ! 8 MAINTENANCE OF A HEAT SINK , 8 MAINTENANCE OF REACIOR COOLANT SYSTEM INTEGRITY i 0 MAINTENANCE OF CONTAINMENT INTEGRITY l ! O CONTROL 0F REACTOR COOLANT SYSTEM INVENTORY l ) i l }
A A. O SAFETY FUNCTION RELATIONS TO BARRIERS BARRIERS NfTYFUNCTIONS . 4 FUEL MATRIX SUBCRITICALITY t FUEL CLAD CORE C0OLING INVENTORY t REACTOR COOLANT EAT SINK SYSTEM BOUNDARY INTEGRITf INVENTORY t CONTAINENT CONTAINENT
\
=
4 0
\
Z O_ O Zm DD
- u. W CC Nb
\ u LL m F M< D l b<
<D O
p-O . 9 e
STATUS TREE e MONITORING PLANT SAFETY STATUS TOTALLY INDEPENDENT OF ORPs e CHALLENGES TO CSFs SYSTEMATICALLY AND EXPLICITLY DIAGNOSED 6 APPROPRIATE FRP PRIORITIZED BY STATUS TREES O e 9
n e t STATUS TREE CONSTRUCTION'
/: 0 EACH TREE REPRESENTS ONE CSF tH I, .- #
4 -} (, , . , - J j 0 '~ EACH BRANCH EFINES A CSF STATUS WITH A UNIQUE COMBINATION OF CONDITIONS- , {:' '
~'
l' j OPERATOR RESPONSE PRIORITIZED BY: i ,l . STATUS TREES MONITOR ORDER i UNIQUE PATH COLOR i UNIQUE PATH INSTRUCTIONS i d 4 f i i
,W Ji l
CSF STATUS COLOR-CODING i COLOR 11BiFICANCE l GREEN 0 CSF SATISFIED 0 NO ACTION REQUIRED 1 YELLOW 4 CSF NOT FULLY SATISFIED 0 ACTION MAY BE EEDED ! ORANGE 4 CSF UNDER SEVERE CHALLENGE i i e PROMPT ACTION EEDED i 1 ), RED 0 CSF IN 10PARDY t 0 IMEDIATE ACTION REQUIRED j . l i
q i (RED) . GO To FR-S.1
; ( ORANGE) Go To f""""" FR-S.1 NEUTRON N I ENTER h hk -
y l (YELLOW)
** Go To
( RTP) g FR S.2 i E l . .. INTER-l lNTER. MEDIATE N l MEDIATE N RANGE SUR _._ " MORE NEG IMNGE SUR y l TIMN ZE80 OR i NEGATIVE y - 02 DN , i i . CSF l SAT ( GREEN.) , SOURCE N j - RANGE - ! ENERGlZED i Y (YELLOW) GO To e FR-S.2 o SOURCE RANGE N
! SUR ZERO -
i' SUBCRITICALITY 2"GAUVEY . STATUS TREE -
- FIGURE OP 0.1 (TC Rev 0 3/84) CSF i SAT
( GREEN ) i .
i i l (RED) GO TO I FR-C.1 j (HED) GO TO l FR C.1 i CORE N N ENTER h l EXITTC5 -
< 1200* F y { >RVUS 40% -
I CORE N GO TO (ORANGE)= !. EXITTCs FR-C.2
*I
} Y GO TO ! ( ORANGE )= FR-C.2 i AT LEAST N l ONERCP - N ! HUNNING RVLIS - _ Y 4
> 40%
! Y I l ( YELLOW)
- GO TO
! RCs sua. N FR-C.3 j0g),NGp ( ORANGE) GO TO CORE = FR-C2 COOLING - Rvus. DYNAMIC - N i STATUS - HEAD > 44% 4 RCPs Y i TREE 30% 3 RCPs 20% 2 RCPs T GO TO FIGURE OP 0.2 13% 1 RCP FR-C.3 (TC Rev 0 3/84) ( YELLOW) l ~ ( GREEN ) i j .]b CSF SAT j i
l
~
1 ( RED) I R-H 1 TOTAL N I*Ss"*
> 470 GPM y ( YELLOW)
- ..........(3;g;g SG LEVEL N PRESSUBE N ENTERh E I -
$k -
y
- $NE SG y 1255 PSIG tt I
- .(. YELLOW)......(3;g;g l '
l NARROW RANGE N NON- tEVEL IN - ADVERSE ADVERSE ALL SGs SETPOINI SETPOINT 28% NR < 84 5% Y 65% WR (YELLOW)
...... GO TO i FR-H.4 PRESSURE N
! CONT N - IN All _ BullDING _ SGs < PRESSURE 1185 PSIG Y
> 4 3 PSiG y ( YEtt0W GO TO i ...... FR H.5 e
NARROW RANGE N lEVELIN - I HEAT SINK STATUS TREE MA"' Y FIGURE OP 0.3 (TC Rev 0 3/84) CSF P , ( GREEN ) SAT i
.m % -
f i l 1 i ( RED) ( ATTAbelMENT A) O TO l i I!" [ Q une N y
== Q f[.p, COID LiG ILMP ~ HIGill DF Y ut acs .. ( YELLOW GO TO INIT A Cm 0 LEG N 88
'. L IEMPER _ e FR-P.2 AIURES e
- > 2WF (T g) y ut acs N
Ehc4Ef! N L ENI -3 At t COLD AIDAES ENTER h tEcs -
> 2WF (i) Y s## "
y ( GREEN) CSF SAT ( ORANGE )y GO TO FR-P.1 utacs N l INTEGRITY imacnueni o > ,_ a#1" AluPIS ! STATUS acs N " 'h' Y I TREE 5 $!E"' ,yetth)@ ?#.J. FIGURE OP 0.4 ncs N (TC Rev 0 3/84)
'!%?'.""'
l ( GREEN ) p
^
( GREEN ) $ i 4 l' , CSF SAT
- ARMING BISTABLE SETPOINT
h R-Z. 4 ENTER h hhSURE
< 52 PSIG y ( ORANGE) GO TO F " " " " "" " FR-Z.1 l l 5 l .
l CONI. N - ] PRESSURE _
< ill- 3 ( ORANGE) i 18 PSIG Y g aus amm gas GO TO j
g FR-Z.2 CONT. N ,
- BUILDING ___
{ LEVEL j < S' 8" y ( YELLOW) GO TO
*** FR-Z.3 I .
. CONT. y i RADIATION i LESS THAN - CONTAINMENT STATUS TREE EENo Y FIGURE OP O.5 (TC Rev 0 3/84) . s! ( GREEN) O
n i + ( YELLOW
... GO TO
. FR-1.3 RVLIS 4
INVENTORY STATUS TREE m mcATES N FIGURE OP 0.6 (TC Rev 0 3/84) $VE
>m Y i
- I..
i
, (YELLOW)} FR-l.1 GOTO PRza ENTER h LEVEL
<m y
( YELLOW)
. . . . . . . . . . . .(3 pg7; I
\ PRlR N LEVEL - v (YELLOW)(3
- - ?R7f
- ,m .
! mS i l INDICATES N i ' NON- VESSEL - ADVERSE ADVERSE LEVEL I SETPOINT SEIP0lNT M
>m Y
! IPE I N j CONT BUILDING __ ( GREEN ) ((
- PRESSURE j > 4 3 PSIG y i
CRITICAL-SAFETY FUNCTIONS (STATUS TREES AND FRPs)' ADYMIA6ES 8 INEPENDENT OF INITIATING EVENT 4 GUIDANCE EYOND ESIGN BASIS . LIMITATIONS - 8 EEERALLY NOT. ADEQUATE FOR PLANT REC 0VERY i 4 SUPPLEENTED BY EVENT-SPECIFIC REC 0VERY PROCEDURES (ORPs) l t
1 4 t i l i i i FUNCTION RESTORATION PROCEDURES T i e i f i i i 9 1 1
i 1 i FUNCTION RESTORATION PROCEDURES 4 1 J 8 NON-EVENT-SPECIFIC i , 1 i 8 STATUS TREES' YELLOW, ORANE, OR RED TERMINUS COVERED BY PROCEDURES 8 DIRECT RESPONSE TO CSFs CHALLENES 0 TRANSITIONS TO ORPs AFTER SAFETY FUNCTION CHALLENE REMOVED i I, e C0ffREHENSIVE COVERAE i } e ALL CONCEIVABLE CHALLENES TO CSFs ADDRESSED l i i 1 i ,.
r- ,
-(
SEABROOK STATION WRITERS GUIDE FOR EMERGENCY RESPONSE PROCEDURES Based in part on the Westinghouse Owner's Group Generic Emergency Response Guidelines Post Validation Program Revision January 13, 1984 J l
v ERP WRITERS GUIDE TABLE OF CONTENTS t . zue.
- 1. Purpose and Scope . . . . . . . . . . . . . . . . . . . . . . . . 1
- 2. ERP Designation and Numbering . . . . . . . . . . . . . . . . . . 1 2.1 Procedure Title . .'. .. . . . . . . . . . . . . . . . . . 1 2.2 Procedure Numbering . .... . . . . . . . . . . . . . . . 1 2.3 Revision Numbering . . . . . . . . . . . . . . . . . . . . . 3 2.4 Page Numbering and Identification . . . . . . . . . . . . . 3
- 3. Format . .. . . . .. . . . . . . . . . . . . . . . . . . . . . 3 3
3.1 Procedure Organization . . . . . . . . . . . . . . . . . . . 3 3.2 Page Formats . . . . . . . . . . . . . . . . . . . . . . . . 3 3.3 Instructional Stap Numbering . . . . . . . . . . . . . . . . 4 3.3.1 Lamediate Actions . . . . . . . . . . . . . . . . . . 4 3.3.2 Continuous Steps. . . . . . . . . . . . . . . . . . . 4
- 4. Writing the Procedure . . . . . . . . . . . . . . . . . . . . . . 4 4.1 Cover Sheet. . ... . . . . . . . . . . . . . . . . . . . . 4 4.2 Operator Actions . . . . . . . . . . . . . . . . . . . . . . 5 4.2.1 Instruction Steps, Left-Eand Column . . . . . . . . . 5 4.2.2 Instructions Steps, Right-Hand Colume . . . . . . . . 6 4.2.3 Use of Logic Terms. . . . . . . . . . . . . .. . . . . 7 4.2.4 Notes and Cautions. . . . . . . . . . . . . . . . . . 7 4.2.5 Transitions to Other Procedures or Steps. . . . . . . 8 4.2.6 Component Identification. . . . . . . . . . . . . . . 9 4.2.7 Level of Detail . . . . . . . . . . . . . . . . . . . 9 4.2.8 Figures . . . . . . . . . . . . . . . . . . . . . . . 9 4.2.9 Tables. . . . . . . . . . . . . . . . . . . . . . . . 10 r 4.2.10 Attachments . . . . . . . . . . . . . . . . . . . . . 11 4.3 Se tpoint and Value Study . . . . . . . . . . . . . . . . . . 11 4.4 Operator Action Summary. . . . . . . . . . . . . . . . . . . 11
- 5. Status Tree Format. .. . . . . . . . . . . . . . . . . . . . . . 11
- 6. Mechanics of Style. .. . . . . . . . . . . . . . . . . . . . . . 12 6.1 Spelling . . . ... . . . . . . . . . . . . . . . . . . . . '12 6.2 Puctuation . . .. . . . . . . . . . . . . . . . . . . . . . 12 6.3 Capitalization . . . . . . . . . . . . . . . . . . . . . . . 12
.6 . 4 Vocabulary . . . . . . . . . . . . . - . . . . . . . . . . . . 13 6.5 Numerical Values . . . . . . . . . . . . . . . . . . . . . . 13 6.6 Abbreviations and Acronyms . . . . . . . . . . . . . . . . . 14
- 7. Printed Format. . . . . . . . . . . . . . . . . . . . . . . . . . 14
(
- 8. Reproduction. . . . . . . . . . . . . . . . . . . . . . . . . . . 14
,c - _ _ . - . , _ , . , _ _ _ ,.-_.r. .__- _ , -y.__..- - --_ _ . , , , , _ . - . _ ,. _ _ _-,,,.,..,_u_ , , , _ . - _
LIST OF TABLES
.(
Tab 1e Title 1 Procedure Index With WOG Cross Reference 2 Abbreviations Used in Procedures 3 Action Verbs 4 status Tree Color Legend e 5 4 0 0 t I
LIST OF FIGURES 1 k Figure Title 1 Pre printed Page Format 2 Pre printed Page (2-column) Format 3 Step Numbering Example 4 Cover Sheet (s) Example for E-O 5 Cover Sheet (s) Example for FR-H.4 6- Example Instruction Steps 7 Example Graph 15 Example Table 9 Example ATTACHMENT 10 Example Operator Action Sammary 11 Block Status Trees 4 0 e 4
\
- 1. Purpose and Scope
~
The purpose of this document is to provide administrative and technical guidance on the preparation of Emergency Response Procedures. This guide '{' applies to both Optimal Recovery Procedures, Function Restoration Procedures, and Critical Safety Function Status Trees.
- 2. ERP Designation and Numbering ERPs specify operator actions to be taken during plant emetgency situations to return the plant to a safe stable condition. Each procedure shall be uniquely identified to facilitate preparation, review, use, and subsequent revision.
2.1 Procedure Title Every separate procedure shall have its own descriptive name which summarizes the scope of that procedure, or states the event (s) which it is intended to mitigate. 2.2 Procedure Numbering Each separate procedure shall be identified in two ways , i.e.; an alpha-numeric code which is identical to the Wes tinghouse Owners Group (WOG) numbering method and the plant procedure number. In order to comply with station manual procedure AQL.002 and still retain the Human Factors Engineered Systems developed by the { Westinghouse Owners Group (WOG), the emergency procedures will be numbered in two ways. The procedure number must be in accordance with AQL.002 and will appear in the upper right-hand box of each page. (The WOG iden-tifier will be called the procedure code and will appear in the
. upper lef t-hand box of each page.) WOG numbers must contain the same general form that appears in all WOG Procedures including proper positioning of dots and dashes. For examp le , E-0, ES-0.1, FR-H.l. Operators will learn and use the WOG codes for procedure use. The plant specific procedure numbers will be used exclusively for document control.
Each emergency procedure number will follow AQl.002 with the first four positions in each of the emergency procedures being the same, that is OS13. e The fif th position will correspond to the main procedures. OS13 [jL} E-0 Procedures OS13L14 E-l Procedures
-t-
OS13 % E-2 Procedures
] OS13 % E-3 Procedures .
0S13 % ECA Procedures OS13 % FR Procedures and Status Trees e The sixth position will correspond to the sub-procedures. OS131 % ES-1.1 OS134 % ECA-2.1 Procedure i This applies to all procedures except the FR Procedures. e Af ter the decimal in the other procedures the number will correspond to alternate sub-procedures. OS1340. W Loss of All AC Power Rec aery Without SI Required, ECA-0.1 o In the FR Procedures, the sixth position will correspond to the FR category. Status Trees 0S135 % { OS135 % . Sub-Criticality Procedures OS135 @ Core Cooling Procedures OS135 W Heat Sink Procedures OS135 W Reactor Coolant System Integrity Procedures 0S135 % Containment Integrity Procedures OS135 W Reactor Coolaat Inven*.ory Procedures e Af ter the decimal in the FR procedures the number will corre-spond to individual procedure in the appropriate categories. OS1351. W Response to Nuclear Power Genera-tion /ATWS OS1352. W Response to Legraded Core Cooling ( - 2-
+
6
-,.-.,w , , .- .-,,,,-v,-- -n,-- -m,., -a., .
,,n,-,- - , , , .,.,.wam.--,.4n.,,,_ w--,----w-ev.- ----,-en-- --
2.3 Revision Numberina Revision numbering for the WOG code shall be handled as 'specified ( in the generic EEG set. A change in the current revision number of WOG ERG does not mandate that the code revision number also change. - Each new revision of the WOG ERGS will be evaluated on a case-by-case basis. If the new ERG revision has sufficient serit to warrant a plant procedure revision, the ERG revision number used as a basis for the plant procedure will be updated in the code block. Revision numbering for ERPs will be handled in accordance with plant administrative procedures. 2.4 Page Numbering and Identification Each page of a proc = dure will be identified by the procedure title, alpha-numeric designatar, "Rev." designator, and date in title blocks at the top of the page. Ecch page number will be specified as " of " centered on the bottom of the page. The last page of 1EtruccTos,s c will have the word "END" following the last instruction step.
- 3. Format The following format- is to be applied censistently to all Emergency Response Procedurt.a:
3.1 Procedure Organization - All Optimal Recovery Procedures (ORPs) will have three (3) sec-tions. The Cover Sheet will summarize procedure intent and state either entry symptoms or means of entry. The Operator Actions will comprise the bulk of each procedure and present the actual stepwise guidance. The Operator Action Summary appears on the back side of each page as applicable and provides information which could direct further operator action at any point in the procedure. 3.2 Page Formats
- All pages of the Emergency Response Procedures (ERPs) will use the same page structure. This page structure employs a pre printed
. border to ensure all margins are correctly maintained, and pre-printed designator boxes and page cues to assure completeness and
' consistency. '(See Figure 1).
l The pages for presentation of operator action steps will use a two-column format within the pre printed border. The left-hand column is' designated for operator action, and the right-hand column is designated for contingency actions when the expected response is not obtained. These pages will use pre printed title blocks above the separate columns (including the " step" column) for uniformity (See Figure 2). Sh
3.3 Instructional Step Numbering
- Procedural steps will be numbered as follows:
.l. High-level step
- a. Substep
- 1) Detailed instructions (if necessary)
Substeps are lettered sequentially according to expected order of performance. If the order of substep performance is not importan., the substeps are designated by bullets (e). If the logical OR, is used, both choices may be designated by bullets. This same num-bering scheme is to be used in both the right and lef t columns of the guidelines. (See Figure 3). 3.3.1 Immediate Action Steps For those procedures which can be entered directly based on symptoms, certain initial steps may be designated "immediate actions". This designation implies that those s teps may be performed by the operator, based on his . memory, without reference to the written procedure. These steps should be limited to verifications, if possible. Immediate action steps are identified by a NOTE (see Section 4.2.4) prior to the first action step. ( Example . NOTE: Steps 1 through 14 are IMMEDIATE ACTION steps. 3.3.2 Continuous Steps Many of the operator actions provided in a procedure imply continuous performance throughou t the remainder of the procedure. This intent is best conveyed by the usa of appropriate action verbs such as monitor, maintain, or control.
- 4. Writing the Procedure The following format is to. be applied consistently when writing Emergency Response Procedures (ERPs):
4.1 Cover Sheet Each cover sheet will contain two explanatory sections in addition to procedure and page designators. The first will be titled
" PURPOSE" and will briefly describe what the procedure is intended to do for the operator. The second section is a summary of those conditions which require entry into the procedure. This section
( , :
. l
will-be titled " SYMPTOMS OR ENTRY CONDITIONS". Certain procedures such as E-0 and ECA-0.0 can be entered purely based on symptoms; for these procedures, a symptom summary is sufficient (see Figure 4). I i For other procedures which can only be entered by transition from i previous procedures, a summary of the entry conditions (and ) procedure / step) should be pr.ovided. (See Figure 5). ; 4.2. Operator Actions Steps directing operator action should be written in short and pre-cise language. The statement should present exactly the task which the operator is to perform. The equipment to be operated should be specifically identified, and only those plant parameters should be specified which are presented by instrumentation available in the control room. (If possible, use of qualified instruments is desired.) It is not necessary to state expected results of routine tasks or specify instrument usage if qualified instruments are already identified in the main control room. All steps are assumed to be performed in sequence unless stated otherwise in a preceding NOTE (see Section 4.2.4). To keep the individual steps limited to'a single action, or a small number of related actions, any complex evolution should be broken down into composite parts. Actions required in a particular step should not be expected to be complete before the next step is begun. If assigned tasks are { short, then the expected action will probably be completed prior to continuing. Ecwever, if an assigned task is very lengthy, addi-tional steps may be performed prior to completion. If a particular task must be completed prior to continuation, this condition must be stated clearly in that step or substep. Refer to Figure 6 as an example of the format for presenting opera-tor actions in the following sections. 4.2.1 Instruction Steps, Left-Hand Column The lef t-hand column of the two-column format will be used for operator instruction steps and' expected responses. The following rules of construction apply: e High Level Action steps should begin with an appropriate verb, or verb with modifier. e Expected responses to operator actions are shown in ALL CAPITAL LETTERS. e, If a step requires multiple substeps, then each substep will have its own expected response if applicable. ( .
,,_.,.._.,,,,,-------,--,-,..~.,w -mw--ww-
e If only a single task is required by the step, the high level step contains its own EXPECTED RESPONSE. e Lef t-hand column tasks should be specified in sequence ~ l: as if they could be performed in that manner. The user would normally move down that left-hand column when the- : expected response to a particular step is obtained. e When the expected response is not obtained, the user is expected to move to the right-hand column for con-tingency instructions. e All procedures should and with a transition to either another guideline or to some normal plant procedure. 4.2.2 Instruction Steps, Right-Hand Column The right-hand column is used to present contingency actions which are to be taken in the event that a stated condition.. event, or task in the lef t-hand column does not . represent or achieve the expected result. Contingency actions will be spe.cified for steps or substeps for which useful alternatives are available. The following rules apply to the right-hand column: e Contingency actions should identify directions to override automatic controls and to initiate manually what is normally initiated automatically. i . e Contingency actions should be numbered consistently with the expected response / action for substeps only. A contingency for a single-cask high-level step will not be separately numbered but will appear on the same line as 1.ts related step. e If the right-hand column contains multiple contingency actions for a single high-level action in the left-hand column, the phrase " Perform ' the following:" should be used as the introductory high-level statement. e The user is expected to proceed to the next numbered step or substep in the lef t-hand column af ter taking
. contingency action in the right-hand column.
e As a general rule, all contingent transitions to other procedures take place out of the right-hand column. (Pre planned transitions may be made from the left-hand column.) e If a contingency action cannot be completed, the user is expected to proceed to the next step or substep in the left-hand column unless specifically instructed otherwise. When writing the procedure, this rule of
-f usage should be considered in wording subsequent left-hand column instructions.
e if a contingency action auct be completed prior to con-tinuing, that instruction must appear explicitly in the right-hand column substep. , 4.2.3 Use of Logic Terms The logic-terms AND, OR NOT, IF NOT, WHEN, can NOT, and THEN, are to be used R,descrine preciseJ,y a set or con-dicions or a sequence of' actions. Logic terna will be highlighted for emphasis by capitalizing and underlining. (See Figure 6.) - The two-column format equates to the following logic: "IF NOT the expected response in the lef t-hand column, THEN perform the contingency action in the right-hand column." The' logic terms should not be repeated in the right-hand column contingency. However. the logic terms may be used to introduce a segondary contingency in the rightsrand column. When action steps are contingent upon certain conditions, the step shall begin with the words IF or WHEN followed by a description of those conditions, a Tomma, the word THEN, and the action to be taken. IF is used for an unexpected, but possible condition. WEEN is used for ,an expected condition.
. AND calls attention to combinations of conditions and
- shall be placed between each condition. If more than two conditions are to be combined, a list fo rmat is preferred.
OR implies alternative combinations or conditions. OR means either one, or the other, or both (inclusive).-- IF...NOT or IF...can NOT should be used when an operator EETFTETpond To the s3Mnd of two possible conditions. IF should always be used to specify the first condition. (The right-hand column of the two-column format contains an implicit IF NOT.)
' 4.2.4 Notes and Cautions Because the present action-step wording is reduced to the minimum essential, certain additional information is some-times desired, or necessary, and cannot be merely included in a background document. This non-action information is
, presented as either a NOTE or a CAUTION. (See Figure 6.)
9
To distinguish this information from action steps, it will extend across the entire page and will immediately precede the step to which it applies. Each category (NOTE or I CAUTION) will be preceded by its descriptor in large, bold, letters. Multiple statements included under a
~
single heading shall be separately identified by noting them with bullets (e). CAUTION denotes some potential . hazard to personnel or equipment associated with the following instructional step. A CAUTION may also be used to provide contingent transition based on unfavorable changes in plant con-ditions. NOTE is used to present advisory or administra-tive information necessary to support the following action instruction. As a general rule, neither a CAUTION or NOTE will contain an instruction / operator action step; however, reference may be made to expected actions in progress. 4.2.5 Transitions to Other Procedures or Steps Certain conditions require the une of a dif ferent proce-dures or step seguence. Transitions are specified by using the words go to" followed by the procedure designa-tor, title (in CAPITAL LETTERS) and step number. ( Transitions shall NOT contain a " return" feature (i.e., perform steps X through Y in some other procedure and then return). Example: Go to ES-0.1, REACTOR TRIP RESPONSE, Step 1. Transitions to a:different step later in the same proce-dure are specified in a similar manner. Example: Go to Step 20. Transitions to an earlier step in a procedure are spe-
,cified by using the words " return to".
Example: Return to Step 2. . Transitions to a step which is preceded by a CAUTION or NOTE shall include special wording to assure that the CAUTION or NOTE is observed. Example: If conditions are NOT satisfied, THEN go to Step
- 22. OBSERVE CAUTION PRIOR TO STEN.
w.-- - - ~ . - . - - , . - - , . - - v. - - --,
---n.n,,,,,- ,,,..-,---w., ~ ~ - . , . , , - . - - , , ,
E
)
4.2.6 Component Identification l
\
Equipment, controls and displays will be identified in j " operator language" terms. Standard abbreviations which may be used throughout the guidelines are listed alphabe-tically in Table 2. Since similar components are used in both primary and secondary systems, it is always necessary to clarify the. location, even if the wording appears redundant. Example: PCCW vs. SCCW identifies primary component cooling water as distinct from the secondary component cooling water. 4.2.7 , Level of Detail , To allow an operator to ef ficiently execute the action steps in a procedure, all unnecessary detail must be removed. Any information which an operator is expected to know (based on his training and experience) should not be included. Nauy actuation devices (switches) in the control room are similar, even though the remotely per-formed functions are not, so certain action verbs listed here are recommended. e Use " start /stop" for power-driven rotating equipment. e Use "open/close/ throttle" for valves. e Use " control" to describe a manually maintained process variable (flow, level, temperature, pressure). e Use " trip /close" for electrical breakers. (PULL-TO-LOCK for breaker switches with a pull-to-lock feature). e Use " place in standby" to refer to equipment when actuation is to be controlled by automatic logic circuitry. 4.2.8 Figures If needed to clarify operator action instructions, figures shall be added to a procedure. Any figure used will be constructed to fit within the pre printed page format (see Figure 1). Certain rules of construction will apply: e All wording on the figure shall be at lege.c as legible (type size and spacing) as the instruction steps in the j guidelines. , l 1 1
)
1 i e Each figure will occupy a complete page and will be uniquely identified by a figure number add title. The figure number will consist of the procedure designator, I- without punctuation, followed by a hyphen sad an integer.
. gxample: Figure E-3-1 e Figure titles will explain the intent or content of the figure.
e The figure number and title will be placed at the top of the page just inside the printed border. e If the figure is a graph, all the numbers and wording will be horizontal if possible. By convention, the independent va'riable is plotted on the horizontal (X) axis. Grid line density should be consistent with the resolution expected from the graph. Any labeling required on the graph will have a white (not graph) background. Figure 7 is an example figure showing pre-sentation of a graph. e All figures for a procedure are numbered sequentially and appear at the end of the procedure. Figure pages are numbered as pages of that procedure. Any figures required for an ATTACHMElff are numbered in sequence { with the procedure figures, but have page numbers corresponding to placement in the attachment. 4.2.9 Tables Tables may be used within the text of a procedure to clearly present a large number of separate options. A table will immediately follow the step or substep which makes use of it. Therefore, it does not require a unique number and title. Any table will be completely enclosed by a distinct outline; if necessary, it may extend into the adjacent column because of this delineation. All information presented in a table shall be at least as legible (type size and spacing).as the instruction steps g in the guideline. All columns and rows of information in a table will be defined by solid lines. All column and row headings shall be presented in upper case type. Absence of a table element will be indicated by a dash. I Figure 8 presents a typical table. es
4.2.10 Attachments Supplementary information or detailed instructions which j' would unnecessarily complicate the flow of a procedure may be placed in an attachment to that procedure. Attachments are identified by the title "ATIACHMENT" followed by a single letter designator. This title is centered at the top of a standard format page. The pre-printed title blocks will be the same as for the proce-dure. - Physically, ATTACHMENTS will be located after any Figures belonging to procedure. Attachments will use a single-column, full page-width format. Figure 9 is an example ATTACHMENT page. 4.3 Seepoint and Value Study The "SETPOINT AND VALUE STUDY" is a listing of the setpoints and values used in the ERPs and are plant specific to Seabrook Station. This document provides all applicable setpoints, values, curves and other parameters needed' for the ERPs. The "SETFOINT AND VALUE STUDY" also includes references, assusp-tions and actual calculations used to derive setpoints and vslues
. and will be maintained as a plant controlled safety related docu-ment for the life of the plant. This document is updated as necessary with appropriate changes made to ERPs.
4.4 Operator Action Summary The operator action sammary appears on the back of applicable pro-cedure pages and is titled "0PERATOR ACTION
SUMMARY
FOR E-X SERIES PROCEDURES". It will use a plain page format for distinction. Each set of operator information will be numbered sequentially and have an explanatory title. The title will be capitalized and underlined for emphasis. This page contains those important actions which can be performed at ang step in the procedures. Refer to Figure'10.
- 5. St'atus Tree Format critical Safety Function Status Trees are presented in the " block" version and all trees in the set use the same format. Similarly, the trees may be '
oriented either vertically or horizontally on a page, so long as the orien-tation is consistent over the set. Refer to Figure 11. Color-coding and/or line pattern coding shall be used from each last branch ! point to its terminus. l ( . e e
All text on 'the Status Trees shall be at least as legible (type size and
- spacing) as the instruction steps in 'the procedures. Refer to Table 4 for ;
the color usage legend. , Each status tree shall have at the top of the page, a designator block l identical to that used in the standard procedure format, and containing the ! same information. ' Statements shall be worded so that the favorable response is downward. Termini shall be ordered so that REDS are uniformly at the top and GREENS at the bottom. Termini order should be RED - ORANCE - YELLOW - GREEN if possible. CRT presentation of status trees should conform to this format for consistency.
- 6. Mechanics of Style 6.1 Spelling All spelling should be consistent with modern usage as specified in the Oxford Dictionary of the English Language, unabridged version.
6.2 Punctuation . Punctuation should be used only as necessary to aid reading and prevent misunderstanding. Word order should be selected to require a minimum of punctuation. . The following rules applyt e Use a colon to indicate that a list of items is to follow.
" Example: Stop the following equipments e Use a comma af ter conditional phrases for ease of reading.
Example: IF, level exceeds 50%, THEN . .. e :Use gareiichesis to indicate alternative items in a guideline. e Use a period to indicate the and of complete sentences and for indicating the decimal place in numbers. e Use a dash to separate a required action and its expected response and also to indicate a null table element. E Aarapie s.- Verify SI Pump - RUNNING 6.3 ,C apitalization Capitalization shall be used in the procedures for emphasis in the following cases: ( e Logic terms will be capitalized and underlined.
e Expected responses (lef t-hand column of instructions) are capi-talised. l k e Titles of procedures will be completely capitalized whenever referenced within any guideline. e Operator action steps may be capitalized FOR EdPEASIS. e Abbreviations (TABLE 2) are commonly capitalized. e Section headings on operator action summary pages are ca. pica-11aed and underlined. 6.4 Vocabulary Words used in the procedures should convey precise meaning to the trained operator. Simple words having few syllables are preferred. These are typical of words in common usage. Verbs with specific meaning should be used. The verb should exactly define the task expected to be performed by the operator. A list of frequently used verbs is included as Table 3. Some words have unique meanings as listed belows manual (manually) - an action performed by the operator in the control room. (The word is used in contrast to an automatic action, which takes place without operator intervention.) , local (locally) - an action performed by an operator outside the control room. Example: " Locally close valve" means directly turning a handwh, eel to close a valve. Inequalities are to be expressed in words rather than symbols: 1.e., " greater than, less than". These words are always appropriate for comparing pressures, temperatures, levels and flowraces. 6.5 hearicalValues All numerical values presented in the procedures should be con-sistent with what can be read on instruments in the control room (i.e., consistent with instrument scale and range) . The number of significant digits presented should be equal to the reading precision of the operator. ( 5 m.
v '
.9 A
's ,
- s. 4 ,,
Acceptance values should be stated in such a way that any addition i and subtraction operations;are avoidad, if possible. This is done by stating acceptance values' as limits. Examples: 2500 psig maxi-( mum, 350*F minim:sa, between 450*F and .500*F. Tolerances can be expressed by stating the normal value- followed by the acceptable ranse.in parenthesis. e a r . Examp'le: 550*F.(540*F,to 560*F) Avoid: 550*F + 10*F if possible - Engineering units should always be specified when presenting
, numerical values for process parameters. They should be the same as those used on the ' control room displays.
6.6 Abbreviations and Acronyms Abbreviations anh acronyms should be limited to those commonly used by operators. Table 2 lists the most common ones necessary for
,J' these procedures. , Abbreviations and acronyms should be used when-ever -possible to simplify the procedures.
' Abbreviations and acronyms from Table 2 will be uniformly capita-lized whenever they are used.
- 7. Printed Format
- The final printed format of the' procedures will be clear and legible.
Final approved versions may be commercially printed at the option of sta-tion management. '
- 8. Reproduction Procedure reproduction will be done on a standard copier, without signifi-cant loss of legibility. Uncontrolled copies shall be marked "FOR INFORMATION ONLY" or " UNTESTED" for those procedures which have not been validated and verified on the plant simulator or in actual practice.
-s
)
' ~
14 - e
TA8LE 1
= SEASR00K STAT 10N -
o- EM51.*4NCT RESPONSE PROCEDURE INDEX PROCEDURE woG NUMS ER TITLE CODE OS1300 Reactor Trip or Saf ety lajection E-0 081300.1 Rediagnosis ES-0.0 051301 Reactor Trip Response ES-0.1 081302. Estural Circulation Cooldown ES-0. 2 081303 Katural Circulation Cooldova With Steam void in vessel ES-0. 3 (With RVLIS)
, 081306 Eatural Circulation Coeldown With Staan Void in Vessel ES-0.4 (Without RVLis) 081310 Less of Reactor or Secondary Coolant E-1
, 081310.1 SI Termination ES-1.1 0$1311 . Post-LOCA Cooldova and Depressurisation ES- 1. 2 081312 Transfer to Cold Le8 Recirculation ES- 1.3 0$1313 Treasfer to Not Les Recirculation ES-1.4 081320 Faulted Steam Generator IseLation E-2 081330 Staan Generator Tube Rupture E- 3 051331 Post-$GTR Cooldown Using backfill ES- 3.1 081332 Post-SGTR Cooldova Ustag Slowdova ES-3.2 051333 Post-SCTR Cooldova Usina Eteam Dumo ES- 3. 3 0$1340 Loss of All AC Power ECA-0.0 0S1340.1 Loss of All AC Power Recovery Without $1 Required ECA* 0.1 051340.2 Loss of All AC Power Recovery With SI Required ECA-0.2 051341.1 Loss of Emergency Coolant Recirculation ECA- 1.1
, 081341.2 LOCA outside Containment E CA- 1. 2 081342.1 Uacostrolled Depressurisation of All Steam Generators ' ECA- 2.1 a
081343.1 SCTE With Loss of Reactor Coo Laat - Subcooled Recove ry ECA-3.1 Desired . OS1343.2 SGTR With Loss of Reactor Coolant - Saturated Recovery ECA-3.2 Desired OS1343.3 SOTR Without Pressuriser Pressure Control E CA- 3. 3 051350.1 Suberiticality (Critical Safety Fasction Status Tree) F-0.1 051350.2 Core Cooling (Critical Safety Function Status Tree) F-0.2 051350.3 Heat Stak (Critical Saf e ty. Function Status Tree) F-0.3 081350.4 Lategrity (Critical Saf ety Function Status Tree) F=0.4 081350.5 Containment (Critical Saf ety Function S tatus Tree) F-0.5 [ 051350.6 lavestory (Critical Saf ety Function Status Tree) F-0.6 0S1351.1 Response to Nuclear Power Generation /ATWS FR-S .1 051351.2 Response to Loss of Core Shutdova FR-S.2 051332.1- Response to Inadequate Core Cooling FR-C.1 051332.2 Response to Degraded Core Cooling , FR-C. 2 0$1352.3 Response to Saturated Core Coolist Condition FR C.3 051353.1 Response to Loss of Secondary Heat Sinn FR-H.1 OS1333.2 Response to Steam Generator overpressure FR-H.2 VS1333.3 Response to Steae Generator High Level FR -H. 3 051333.4 Response to Loss of Steam Dump Capabilities FR H.4 051353.5 Response to Steam Generator Low Level FR-H . 5 081354.1 Response to laminent Pressurized Thermal Shock FR-P.1 Conditions 031354.2 Response to Anticipated Pressurised Thermal Shock FR-P.2 Conditions 051355.1 Response to High Containment Pressure FR - Z .1 051355.2 Response to Contatnnent Flooding Fk-2.2 JS1355.3 Response to Hitr Certainment Radia tion Level FR-2.3 051356.1 Response to High Pressuriser Level FR-1.1 051356.2 Re.ponse to Low Pressuriser Level FR-1.2 OS1356.3 Respocae to voids in Reactor Vessel FR-1.3
- 15 -
-- ,. - - , . . . . , -y,- .p.. - . . .r--., w w -ry .-.evy,-,y,,m,we y-m- ,m,w,--~wwy,v ,p, %~
1 COMMON ABBREVIATIONS USED IN PROCEDURES l
\
l ac - alternating current (electrical) {
.. EFW - emergency feedwater )
ASDV - atmospheric steam dump valve ' ATWS - anticipated transient without scram (- BA - boric acid BAT - boric acid (storage) tank BIT - boron injection tank BTRS - boron thermal regeneration system CCP - centrifugal charging pump CCW - component _ cooling water (preceded by an S or P) CRDN - control rod. drive mechanism CST - condensate storage tank CVCS - chemical and volume control system
' CVCT -
chemical volume control tank dc - direct current (electrical power and signals) DG - diesel generator DWST - domineralized water storage tank EPS - emergency power sequencer ECCS - energency core cooling system HP - high pressure EX - heat exchanger LOCA - loss of coolant accident LOP - loss of power LP - low pressure MCC - motor control center MD - motor driven (in reference to pumps) MSIV - main steamline isolation valve NIS - nuclear instrumentation system NR - narrow range (level indication) P0F.V - power operated relief valve (pressurizer only) PDP - positive displacement pump PRT - pressurizer-relief tank PR2R - pressurizer RAT - reserve auxiliary transformer RC7 - reactor coolant pump RCS - reactor coolant system RHR - residual heat removal LMO - remote manual operation (relay designation) RPV - reactor pressure vessel
- RWST -
refueling water storage tank RVLIS - reactor vessel liquid inventory system SI - safety injection. SG - steam generator SGTR - steam generator tube rupture 4
.SUR startup rate SW -
service water TA - tower actuation TC - thermocouple TD - turbine driven (in reference to pumps) ' TSC - technical support center UAT - unit auxiliary transformer WPB - waste processing building WR - wide range l{
,.,u, -. - ,, , s, -, - , _ , , , , , , . , . , , - - , , - , , , , , ,, , , _ , , . . . ,,m.,__m-... _ . , ,. a .-..------n., - - - ,
. I TME 3 l ACTION VERBS i i'
k Actuate To put into action or motion; commonly used to refer to automated, multi-faceted operistions. Examples: Actuate S.I., Actuate Phase A,
. Actuate Containment Spray Align To arrange components into a desired configuration.
Examples: Align the system for normal l charging. Align valves as appropriate. Block To inhibit an automatic actuation. Example: Block SI actuation. 1 Check. To note a condition and compare with some guideline requirement. Example: Check PRZR level - GREATER THAN 20%. Close To change the physical position of a
" mechanical device. Closing a valve pre-vents fluid flow. Clostag a breaker allows electrical current flow.
I Complete To accomplish specified procedure re'quirements. Continue To go on with a particular process. Example: Continue with this procedure. 1 Control To manually operate equipment as l necessary to satisfy. procedure require-ments on process parameters pressure, 1 temperature, level, flow. Example: Control pressurizer level. Determine To calculate or evaluate using formola or graphs. Example: Determine maximum venting time. 1
- j
. . - _ _ . ~ _ _ . _ _ _ _ . _ . __ __ _ _ - ~ _ . _ - _ . _ . _ _._ _.
ACTION VERBS (CONTINUED) Encrgizi Ta supply olcctrical cusrgy to ! (s:mething). Commonly uccd to dcscriba l an electrical bus or other dedicated )
- electrical path.
k Examples: Energize AC emergency buses. Energize PRZR heaters. Enter To insert into or add to. Establish To make arrangements for a stated con-dition. Example: Establish normal pressurizer pressure and level control. Evaluate - To examine and decide; commonly used in reference to plant conditions and opera-tions. Example: Evaluate plant conditions. Initiate To begin a process. Example: Initiate flow eq all SGs. Load To connect an electrical component or unit to a source of electrical energy. May involve a " start" in certain cases.
' Example: Load the following equipment on AC equipment buses:
Maintain To control a given plant parameter to some procedure requirement continuously. Example: Maintain SG 1evel in the narrow range. Monitor Similar to " check", except implies a con- , tinuous function. Open To change the physical position of a mechanical, device to the unobstructed position. Opening a valve permits fluid flow. Opening an electrical breaker pre-vents current flow. Place-in-standby To return a piece of equipment to an inactive status but ready for start on demand; commonly used to refer to a mid-position on a switch labeled "AUT0". Example: 5 top the pumps and place in ( standby.
)
ACTION VERBS (CONTINUED) R0ost To remova cn cctiva cutput signal from a retentive logical device even with the input signal still present; commonly used
, in reference'to protection / safeguards l logics in which the actuating signal is
" locked-in". The RESET allows equipment energized by the initial signal to be de -
energized. Examples: Reset SI, Reset Phase A. Record To document specified characteristics. Example: Record RCS average temperature.
~ Sample To take a representative portion for the purpose of examination; commonly used to refersto chemical or radiological exami-nation.
J Examples: Sample for RCS boron concen-tration. Samples for side activity. Start To originate motion of an electrical or mechanical device, either directly or by - remote control. Example: Start one RCP. Stop ' To terminate motion of an electrical or mechanical device. Example: Stop both diesels. Throttle To operate _ a valve in an intermediate position to obtain a certain flow race. Example: Throttle flow control valve to establish desired flow. Trip To manually act.?vate a semi-automatic feature. Commonly; " trip" is used to refer to component de-activation. Examples: Trip the reactor; trip the turbine. Trip a breaker. Verify To observe that expe:ted characteristic or condition exists. Typically the expectation comes from some previous automatic or operator action. Examples: Verify Reactor Trip, Verify SI
] Pumps - RUNNING.
l TABLE 4 STATUS TREE COLOR LEGEND 4 l 1. COLOR CODE Definition Green The critical safety function is satisfied - no operator action is called for. Yellow The critical safety function is not fully satisfied - operator action may eventually be needed. Orange The critical safety function is under severe
, challenge prompt operator action is necessary.
Re'd The critical safety function is in jeopardy - immediate operator action is required. 3 P e a 4 20 -
. _ . . - - _ . . - . - . . . . . . _.. , _ . _ . _ ~ . . . . . . - _ _ . _ . _ _ _ - . . - . . . , - . . . . . - . . - . . . , . -
GoG2* Symptom /Titis: Procscure No. Revision Ns./Date: l l
\
FIGURE 1 l Pre-Printed Page Fo Q t I e i 4
\ \
9
- -- , -, . , , - , - , . , , - , , , - - ~,y.,..,,,,.,pr,,v,,.nma ,w.mm., , ,,.,_e-,,wymn..~,. , ,-...,, w --m m,,
3 I. Symptom /
Title:
Codas Procsdura No. l Revision Ns./Date: 1 I
)
f ISTEPl l ACTION / EXPECTED RESPONSE l } RESPONSE NOT OBTAINEDl s FIGURE 2 Pre-Printed Page (2-Column) Formac l l 1
. _ i J
l 1 l
.- _ .~. .. .- - . _ - . . - . . . - . . - . _ . . - -
Csdas Symp tca/
Title:
Proccdure No. l Rsvision No./Dato: E-3 STEAM GENERATOR TUBE RUPTURE OS1330 Rev. 1 (EXAMPLE ONLY) 0 / 01/12/84 l l ( l STEP l ~l ACTION / EXPECTED RESPONSE l l RESPONSE NOT OBTAINED l l FIGURE 3 l l , 17 Depressurize RCS To Minimize Break Flow And Refill PRZR:
- a. Normal PRZR spray - AVAILABLE a. Go to Step 13. OBSERVE CAUTION PRIOR TO STEP 18.
- b. Spray PRZR with maximum available spray until ANY of the following conditions satisfied:
e BOTH of the following:
- 1) RCS pressure - LESS THAN RUPTURED SG PRESSURE ,
- 2) PRZR level - GREATER THAN 5% [30% FOR ADVERSE CONTAINMENT]
- OR -
l e PRZR level - GREATER THAN 80% l
- OR -
e RCS subcooling based on core exit TCs - LESS THAN 30*F
- c. Close spray valve (s)
- 1) Normal spray valves 1) Stop RCP(s) supplying failed spray valve.
e RC-PCV-455A RCP-lC e RC-PCV-455B RCP-1A
- d. Go to Step 20. OBSERVE CAUTION PRIOR TO STEP 20 j
( l
.- .. . . , ~ . _ . , - . . _ . . - . , . , , , , , , _ , _ _ . , , . , - _ , , . _ , . _ . , , , - _ , . . . _ . , . , - , ,,-_-.u.. ,
----. symy-w-,...... rivueuuse .v.
Revision No./Date: E-0 REACTOR TRIP OR SAFETY INJECTION 0S1300 Rev. 1 (EKAMPLE ONLY) 0 / 10/26/83
~
l l l_ FIGURE 4l l 1 A. PURPOSE-l This procedure provides actions to verify proper response of the automatic , protection systems following manual or automatic actuation of a reactor ' trip or safety injection, to assess' plant conditions, and to identify the appropriate recovery procedure. B. SYMPTOMS OR ENTRY CONDITIONS
- 1. Any symptoe that requires a manual reactor trip listed in ATTACRMENT A, if one has not occurred.
- 2. The following are symptoms of a reactor trip:
- a. Any reactor trip annunciator lit.
- b. Rapid decrease in neutron level indicated by nuclear instrumentarion.
- c. All shutdown and control rods are fully inserted. Rod bottom lights are lit. .
- 3. Any symptom that requires a manual reactor trip and safety injection listed in ATTACHMENT B, if one has not occurred.
- 4. The following are symptoms of a reactor trip and safety injection.
- a. Any SI annunciator or status lamp lit.
- b. ECCS pumps in service.
A rw 1
~
Coda. Symptes/
Title:
Procedura No. Revision No./Date: FR-il.4 RESPONSE TO LOSS OF NORMAL STEAM DUMP OS1353.4 Rev. 1 CAPABILITIES (EXAMPLE ONL*2) 0 / 10/11/83 l FIGUPI 5l A. PURPOSE This procedure provides actions to respond to a failure of the steam generator atmospheric steam dump valves (ASDVs) and con-denser steam dump valves. B. SYMPTOMS OR ENTRY CONDITIONS This procedure is entered from F-0.3, HEAT SINK Critical Safety Function Status Tree on a YELLOW condition. F I [ $ 25 -
--we'm--- v'-'w' ' ' = - " *-' - ' - - ' - - " ' ' ' * - ~ - 4 -- -*-
--. = ,.e-.m,.-e-- +,m r- ' - ' * - 's"w - ' ' -w = w-
Coca: Syupcom/
Title:
Procedure No. Revision No./Date: E-0 REACTOR TRIP OR SAFETY INJECTION OS1300 Rev. 1 (EXAMPLE ONLY) 0 / 10/26/83 l MTEP l FACTION,' EXPECTED RESPONSE l l RESPONSE NOT OBTAINED l { l FIGURE 6 l l 25 Check lf ECCS Flow Should Be Reduced:
- a. RCS subcooling based on a. DO NOT STOP ECCS PUMPS. Go core exit TCs - GREATER to Step 27.
THAN 30*F
- b. Secondary heat sink: b. IF neither condition satis-fied, THEN DO NOT STOP CENTRIFUGAL CHARGING PUMPS s e Total EFW flow to intact OR SI PUMPS. Go to Step 27.
SGs - GREATER THAN 470 GPM TOTAL COMBINED FLOW CAPA-BILITY.
- OR -
e WR level in at least one intact SG - GREATER THAN 65%
- c. RCS pressure - STABLE OR c. DO NOT STOP ECCS PUMPS. Go INCREASING to Step 27.
- d. PRZR level - GREATER THAN d. DO NOT STOP ECCS PUMPS. Try 5% to stabili::e RCS pressur.e with normal spray. Return to Step 25a.
26 Go To ES-1.1, SI TERMINATION, Step 1 27 Initiate Monitoring of Critical Safety Function Status Trees CAUTION CST makeup should commence as early as possible to avoid low inventory problems. (
-_,_r. . , _ _ , _ ~ - - _ _ , , _ - . _ _ _ - . _ . - - . . - _ . _ _ , _ . , - __y . , . .
woue. ayapuvasituAe. cruceuure av. Revision No./Date: FR-H.1 RESPONSE TO LOSS OF SECONDARY HEAT SINK OS1353.1 (EXAMPLE ONLY) 0 / 01/12/84
~
l STEP l
.( .l ACTION / EXPECTED RESPONSE l l RESPONSE NOT OBTAINED l
[ FIGURE 7 l FIGURE FR-H.1-1 ! REQUIRED ECCS FLOW for CORE BLEED AND FEED COOLING i i i i i ii. i e i , i i ii i e i,iii . i i i .. ! E~~~ \ 8 3 soc 1 l i ll l lIlll l I IIllll 3
- u. 4co Is\ ll l l'llll1 Illlllll l I l l. I III lllllIb
$~ x ! !llll1
( 8
.J 20C l Njl11 II!Il!Il lIIHlli f Il l !!!!! l lll !b
~
ll l ll Illl l I liliii'; W!!I
- a. e .a a ao TIME AFTER SHUTDOWN .
I . vs.---,,,-v,-,-, ,,,,w,-,,,m~n--,,~---- --r-,, e-,.,,-,_, .c.,,-- .-,,.,--,_,-,,.,,,,~,-..-,m--,,-,,- -
--m n,-
vuuem ajapuus,..-... esseeeere .ue. Revision No./Date: FR-H.1 RESPONSE TO LOSS OF SECONDARY REAT SINK OS1353.1 i Rev- 1 (EXAMPLE ONLY) 0 / 11/03/83 l _ I lSTEPl l ACTION / EXPECTED RESPONSE l l RESFONSE NOT OBTAINED l ( LFIGURE 8 l NOTE e After stopping any ECCS pump, RCS pressure should be l
, allowed to stabilize before stopping another ECCS pump.
e The charging pumps and SI pumps should be stopped on ' alternate ECCS trains when possible. 20 Check If One CCP Should Be Stopped:
- a. Two CCPs - RUNNING a. Go to Step 21.
- b. Determine required RCS subcooling.from table:
1 RCS SUBC00 LING (*F)
, SI PUMP STATUS NORMAL ADVERSE CONTAINMENT CONTAINMENT NONE RUNNING 91* 91*
ONE RUNNING 57' 57' a-TWO RUNNING 50* 50*
- c. RCS subcooling based on c. DO NOT STOP CCP. Go to Step 23.
core exit TCs - GREATER THAN REQUIRED SUBC00 LING
- d. PRZR level - GREATER THAN d. DO NOT STOP CCP. Go to 5% [30% FOR ALVERSE Step 23.
CONTAINMENT]
- e. Stop one CCP l i
f I (
., r.._,.---.. . . . . . . . .
Revision No./Date: ES-1 2 POST LOCA C00LDOWN AND DEPRESSURIZATION 0S1311 Rev. 1 '(EXAMPLE ONLY) 0 / 10/26/83 l STEP l l ACTION / EXPECTED RESPONSE l l RESPONSE NOT OBTAINEDl
-(
l FIGURE 9 l ATTACHMENT A The following conditions support or indicate natural circulation flow: e RCS subec eling based on core exit TCs - GREATER THAN 30*F e SG pressurcs - STABLE OR DECREA3ING e RCS hot leg temperatures - STABLE OR DECREASING e Core exit TCs - STABLE OR DECREASING e RCS cold leg temperatures - AT SATURATION TEMPERATURE FOR SG PRESSURE e Loop aT - INDICATED 't
)
.l l
(, I
(EXAMPLE ONLY)
.l FIGURE ,lg ' -
OPERATOR ACTION
SUMMARY
FCR E-3 SERIES PROCEDURES (
- 1. ,
SI REINITIATION CRITERIA Manually operate SI pumps as necessary and go to ECA-3.1, SGTR WITH IDSS OF REACTOR COOLANT - SUBC00 LED RECOVERY DESIRED, Step 1, if EITHER condition listed below occurs: e RCS subcooling based on core exit TCs - LESS THAN 30*F e PRZR level - CANNOT BE MAINTAINED GREATER THAN 5% (30% FOR ADVERSE CONTAINMENT]
- 2. SECONDARY INTEGRITY CEITERIA Go to E-2, FAULTED STEAM GENERATOR ISOLATION, Step 1, if any SG pressure is decreasing in an uncontrolled manner or has completely depressurized, and has not been isolated, unless needed for RCS cooldown.
- 3. COLD LEC RECIRCULATION SWITCHOVER CRITERION
.Go to ES-1.3, TRANSFER TO COLD LEG RECIRCULATION, Step 1 if RWST level decreases to less than 23.5%.
l
- 4. EFW SUPPLY Commence CST makeup as soon as possible to avoid low inventory problems.
- 5. RED PATH
SUMMARY
- ATTACHMENT A
- 6. KEY CAUTIONS e Maintain RCS pressure less than ruptured SG(s) ASDV setpoint. I l
e If a MD EFW pump is running, shut dcwn steam driven EFW pump. (
. , , . , - ~ , - -, - , - - - - - . . , - . - , - -.- .---- -
. Ravision No./Date:
F-0.2 CORE COOLING STATUS TREE OS1350.2 1 (EXAMPLE ONLY) 0 / 01/12/84 l iSTEP\ l ACTION / EXPECTED RESPONSE l l RESPONSE NOT OBTAINED l k l FIGURE 11{ GO TO
' FR C.1 GO TO FR-C.1 CCRE DIT *
'WS-
- ENTER.% mrCstzss -
AN 1200** ves p $,EATE CCRE DIT "O " GO TO TC3LESS - FR-C.2 NAN 700*8 yrs GO TO g,,, ,o FR C.2 0*f.ACP - ggg, g AL'NNING vES _ gp y g _
'hAN 40 % vt1 I
- GO TO es susCCouMG No FR C.3 GAUTER -
SAN 20** vt GO TO
= FR-C2 wus.
OYNAMIC NC
*D0 ,
h, vesl 44 v aCPs 30 52nCPs GO TO 20 %2RCPs pg,q,3 113 %tRCPs CSF . SAT 4 ( - - _ _ . . .-.
r, 1 c SEABROOK STATION USERS GUIDE FOR EMERGENCY RESPONSE PROCEDURES BASED ON THE WESTINGHOUSE OWNERS GROUP USERS GUIDE FOR EMERGENCY RESPONSE sdIDELINES POST VALIDATION PROGRAM REVISIGN JANUARY 16, 1984 b
User's Guide for Emergency Re,sponse Procedures at Seabrook Station k' . TABLE OF CONTENTS
-Section Page
- 1. Introduction 2
- 2. Control Room Usage of the Procedures 2
- 3. Example of Procedure Usage 5
- 4. Control Room Usage of Status Trees 7
- 5. Example of Status Tree Usage 9
- 6. Control Room Usage of the ERG Network 11
- 7. _ Modes of Applicability of the ERGS 13 e
(- o
._ . _ ~ . ._- - - ..-_. - . -
l.. INTRODUCTION The Emergency Response Guidelines (ERGS) developed by the Westinghouse Owners Group (POG) combined with plant-specific knowledge provided by the b- Seabrook Station staff, has resulted.in a complete set of Emergency Response Procedures (ERPs) for Seabrook Station. The two-column format used to present the ERPs contains implicit rules of usage which supplement the technical instructions. The Critical Safety Function Status Trees have their own format and rules of usage. Priorities have been established bet-ween the Optimal Recovery Procedures (ORPs) and Function Restoration Procedures (FRPs) which are intended to direct operator action to the most urgent operational or safety conditions. Each of these aspects of using the Emergency Response Procedures is pre-seated in detail in the following sections.
- 2. CONTROL ROOM USAGE OF ERPs Entry into an individual procedure begins at the cover sheet. The title block presents the unique identifiers for each proced.2re, and the purpose and entry conditions are described in separate paragraphs.
Individual operator action steps are presented in the two-column format beginning on the following page. Certain special information is also pre-seated, .which is emphasized by not following the standard two-column for-ma t. This information is of two types: e NOTES contain administrative or " advisory information which supports f operator action. < 1' e CAUTIONS contain information about potential hazards to personnel or equipment. They also advise on actions or transitions which may become
~
recessary' depending on changes in plant conditions. Both NOTES and CAUTIONS are introduced by their descriptor, in bold let-ters, followed by the text extending across the entire page. If multiple items are included af ter a descriptor, each item is distinguished by a pre-F ceding bullet (e). In general, NOTES and CAUTIONS apply to the step which they precede. A 4 NOTE or CAUTION.which precedes the first operator action step may also
, apply to the entire procedure. One type of. NOTE in this category is described below:
- 1. Several procedures contain steps which are designated as "IMMEDIATE ACTIONS". These steps are intended to be performed, if necessary, .
without the written procedure being available. These procedures con-tain a NOTE advising which steps are "immediate action" steps. Af ter observing any initial NOTES and/or CAUTIONS, the operator proceeds to the. first action step. In the two-column f orma t, each step in the lef t- l hand column contains a highlighted high-level statement which describes the
- task to be performed.
( .I. t 9
.-.yr, 3,.- , y.-.-- , - - - .,-,c.,., . + , ,-.,,wyw-n._,-c-.o ,,--,w.w.,-, wry,-- - =
r If the high level task requires multiple actions, then subtasks are spe-cified. Following each task or subtask, the expected response or result is
+
given in CAPITAL LETTERS, separated from the task by a dash. Example: Check Pressurizer Level - INCREASING. Example: Check if Pressure Boundary is Intact:
- a. Check response in all SGs -
e NO SG PRESSURE DECREASING IN AN UNCONTROLLED MANNER-
- OR -
e NO SG RAS COMPLETELY DEPRES- - SURIZED Expe'cted responses are not supplied for simple control manipulations or actions. Example: Stop All RCPs. i If sequence of performance is important, then the subtasks are designated by letters (or numbers if finer detail is provided). If sequence of per-formance is not important, the subtasks are designated by bullets (e). Only _a limited set of action verbs is used in the action steps. These verbs have specific meanings in the context of their usage in the ERPs. (Refer to the verb list in the ERP~ Writers Guide.) p Action steps are written so that the operator can proceed directly down the lef t-hand column only. This column contains all the expected conditions, actions, and checks required to accomplish the stated purpose of the procedure.
- . If however, the expected result or response is not obtained or the action
. cannot be performed, the operator should move to the right-hand column for contingency instructions. This column is appropriately titled " RESPONSE NOT OBTAINED". Almost all action steps contain some contingency action s ta tement. If one contingency action is appropriate for any of a series of lef t-hand column subtasks, it is simply stated once as a high level con-tingency. If a contingency is not provided, then the operator should proceed to the next step or substep in the lef t-hand column.
j 3
Examples Check CVCT Makeup Control Systems Adjust controls as necessary. k a. Makeup set for GREATER THAN ; RCS BORON CONCENTRATION j
. 1
- b. Makeup set for AUTOMATIC l l
The ,two, column format thus equates to logical terms which would otherwise be specifically stated: JJ, the conditions required in the lef t-hand column ; are not achieved, THEN go to the right-hand column for contingency instruc- 1 tions. .For - this reason, the first contingency action does not contain the highlighted logic. terms I[ and THEN. Subsequent contingency actions are al.says expressed using the logical construction. Example Verify PRZR Level - GREATER Control charging flow to maintain THAN 17% PRZR level. IF, PRZR level can NOT be maintained, THEN manually ope-ra te ECCS pumps as necessary. Af ter taking the contingency action in the right-hand column, the operator should proceed to the next step or substep in the lef t-hand column. If the contingency action cannot be performed or is not successful, and further contingency instruction is not provided, the operator should again return to the next step - or substep in the lef t-hand column. Unless otherwise specified, a required task need not be fully completed before proceeding to the' next instruction; it is sufficient to begin a task and have assurance that it is progtessing satisf actorily. This assures efficient implementation where steps are very time consuming. In certain cases, where local operator actions are required (outside the control room)
'a special NOTE may be added to reinforce this rule of procedure usage.
If a particular task must bjt complete prior to proceeding, the step con-taining the task will explicitly state that requirement. Transitions to other procedures or to dif ferene steps in the same proc'edure may be made from either column. Such transitions should be made realizing that preceding NOTES or CAUTIONS .are applicable. Any tasks still in progress need not be completed prior to making a transition; however, the requirement to complete the tasks is still present and must not be neglected. Each prccedure ends with either a specific transition to another procedure, if further operator guidance is required, or with the plant being main-tained in a steady-state condition. Often in ERPs, the final transition is to " procedure and step in effect". This wording results from the symp tom-dependent transitions performed in accordance with rules of usage and not located at a specific procedure and step. "S tep in ef f ect" refers to whichever step was being performed when transition was made into the pre-sent procedure. [
- 4-e
,-----,,---,e,,.,,,.y,- 3,- . - ,-g,---,,,._ywwa,.--,..,.--ne--w._w-.,y ,,,.y-+--%,,#g---,y-.-,w,-.,---.g- 2-r%9..
~ -
As an example, assume an operator is performing procedure A, when symptoms i appear requiring transition to procedure B. While performing procedure B, in accordance with a CAUTION, he finds it necessary to go to procedure C. ( Af ter completing the actions in C, he returns to the procedure and step from which he entered C, that is, back to procedure B. And after complet-ing procudure B, the operator would return to the procedure and step from which he_ entered B, in this case, procedure A. (This example assumes that procedures A, B, and C all end with the transition words " Return to Procedure and Step in Effect".) Several series of procedures have been provided with an OPERATOR ACTION
SUMMARY
page. This page is located on the back side of the previous pro- 1 cedure page and is always visible to the operator regardless of the proce- ) dure step in effect. The' 0PERATOR ACTION
SUMMARY
contains several pieces I of information or actions,which are applicable jgi any step in the proce- l dure. The most important.of these actions are procedure transitions which allow immediate response to new symptoms as they appear. The placement of these transitions on the OPERATOR ACTION
SUMMARY
page removes any sen-sitivity to timing from the appearance of subsequent symptoms.
- 3. EXAMPLE OF PROCEDURE USAGE The actual process of working through a procedure will be illustrated by using E-2, FAULTED STEAM GENERATOR ISOLATION. It is assumed that the user was directed to Step 1 of this procedure by an instruction in some other procedure.
The user first verifies the designator and title on the cover sheet to assure himself that he is in the proper procedure. The PURPOSE tells him that this procedure will- identify and isolate a f aulted steam generator. Examination of the SYMPTOMS OR ENTRY CONDITIONS list should produce the procedure from ~which the transition to E-2 was made in chis case. The first action step of this procedure is preceded by two CAUTIONS. Each separate concern is identified by a bullet (*), and the CAUTION identifier is used only once. The'first CAUTION tells the operator that at least one SG sust be main-tained available for RCS cooldown. The second CAUTION tells the operator that any faulted SG or secondary break should remain isolated during subsequent recovery actions unless needed for RCS cooldown. Both CAUTIONS refer to the SG isolation which will take place in the next step (s). The operator is expected to know that
" faulted" refers to failure of the secondary pressure boundary, and
" isolated" refers co closure of'the stem and/or feed flow paths. The CAUTIONS have provided a specific criteria (needed for RCS cooldown) for not isolating, 'or un-isolating a faulted SG.
- The first action in Step 1 is a check of the main steamline isolation and bypass valves on the' affected SGs7~~The expected condition is that the valves are CLOSED. If , in f ac t , the operator finds the valves closed by whatever'means his training requires, he then proceeds to Step 2. If the
{'
=_ _ _ _ _ _ _ ._ ._ _ . _ - _ . _ _ _ _ _ ____._ _
valves are not closed, or not closed on all the affected SGs, the operator moves to the right-hand column where a contingency instruction tells him to f(; " Manually Close Valves". Af ter performing this action, the operator would return to the next task in the lef t-hand column, in this case, Step 2. The Step 2 high-level action is to " Check if SG Pressure Boundary Is
, Intact" with. a more detailed subtask describing how this is to be done:
the operator is to " Check Pressures in All SGs". The expected response is "ANY (SG Pressure) STABLE OR INCREASING. If anJ pressure is stable or increasing, the operator proceeds to the Step 3. If none of the steam generators exhibits a stable or_ increasing pressure, the oparator moves to the'right-hand column for contingency instructions. He is told, "IF, all SG THEN go to ECA-2.1,
. UNCONTROLLED pressures decreasing in an uncontrolled DEPRESSURIZATION manner,'AlWS, OF ALL STEAM GENER
~
Step 1". In order to perform this step, he has to decide if the depressurization is controlled, or not. If it is not controlled, he will leave E-2 and make the required transition to ECA-2.1. If however, the pressure decrease is under his control, in at least one steam generator, he proceeds to the next lef t-hand column task, Step 3. Step 3 requires the operator to " Identify Faulted SG(s)" and the more detailed process is described in a substep " Check Pressures in All SGs". Two possible pressure responses are given= which will satisfactorily iden-tify a faulted SG: ANY SG PRESSURE (is) DECR'J.A",ING IN AN UNCONTROLLED MANNER, or ANJ SG (is) COMPLETELY DEPRESSURI.*hD. If either condition is observed, then the intent of the step is satisfied and the faulted SG(s) is (are) identified. The operator moves on to Step 4. If neither condition is observed on any SG, the operator moves to the right-hand column where he i is instructed to search for the initiating break (which may have been iso-laced by MSIV closure) and then touso to Step 5, i.e., skip over Step 4 since no steam generator is required to be isolated. Step 4 tells the operator to " Isolate Faulted SG(s)" and lists several j separate paths which should be isola'ted. The bullet (*) designator on the
- separate items implies that isolations can be done in any order. If the isolations are propurly performed, the operator proceeds to Step 5. If j some. aspect _of isolation cannot be completed, he moves to the right-htnd column where he is instructed to annually close the' valves (from the i control room), and if that is not successful, to dispatch a (local) opera-L tor to close the desired valve (s) or appropriate block valve (s). With the contingency performed or local action initiated, the operatoc proceeds to
- Step 5.
I-The CAUTION prior to Step 5 alerts the operator that EFW system operation will eventually deplete the CST and that makeup will be required. The sooner the better in this case. ! Step 5 simply has the operator Check the present level in the condensate ! storage tank. It is expected to be - GREATER THAN 23 FEET. If level is as expected, the operator proceeds to Step 6. However, if level is less than , expected, he moves to the right-hand column where he is instructed to establish CST askeup at the maximum rate. From his training, he will per- [{ l form this task and then proceed to the left-hand column of Step 6. s-l l I
1 Step '6 is a Check for secondary radiation. Detailed performance of the task is presented in sequential subtasks. First, the operator is to
'" Request Periodic Activity l Samples of All SG(s)". . This-will involve a call
_k L 'out to a local operator, with attendant time delays for _ sampling and analy-sis. By rules of usage, the operator can proceed to the next subtask
" Check Un-isolated Secondary Radiation Monitors", which he should be able to do from the control room. The third subtask is the conclusion on the
" Check" process, " Secondary Radiation - NORMAL". If no abnormal radioac-tivity is known or detected at that time, the expected response is obtained and 'the operator proceeds to Step 7. If abnormal radiation is detected on
. ' the secondary side of any steam generator, then, by, rules of usage, the operator moves to the right-hand column and is instructed to "Go to E-3, etc." and so leaves the E-2 procedure.
Step 7 tells the operator to "Go te E-1, etc." and thus ends the procedure with a transition to some other appropriate procedure. The highlighted END centered on the page emphasizes that the listing of action steps for E-2 is complete. In many cases, FIGURES and ATTACHMENTS are included in the procedures to aid the operator and to remove lengthy instructions such as valve align-ments from the procedure text. For example, FIGURE E-3-1 in procedure E-3 provides a curve showing the programmed LIOP setpoint for the pressurizer PORVs. ATTACEMENT A in procedure E-3 lists conditions that show positive evidence of natural circulation flow in the RCS. 4 CONTROL ROOM USAGE OF STATUS TREES Status Trees are a convenient device used to evaluate the current state of predefined CRITICAL SAFETY FUNCTIONS. When the Functions are shown to be satisfied, the plant is safe . Trees ask a series of questions about plant conditions, and in general, each question asked depends on the answer to the previous question. This dependancy results in a branching pattern, which is referred to as a " tree". There are six different trees, each one evaluating a separate safety aspect of the plant'. (Critical Safety Function.) At any given time, a Critical Safety Function status is represented by a single path through its tree. Since each path is unique, it is uniquely labeled at its and point, or ter-minus. This labeling consists of color and/or line pattern coding of the terminus and last branch line, plus a transition to an appropriate proce-dure if required by that safety status. If the status is normal for a par-
~
ticular Critical _ Safety Function, no transition is specified, and the condition is clarified by the words CSF SATISFIED. Color coding can be either Red, Orange, Yellow, or Green, with Green repre-senting a " Satisfied" safety status. Each non green color represents an action priority as discussed below. ( 7- -
= - - - ,,.- ~.-v. . , - .-%-,,w.-,,,--~r.ow-- - . - w e . -- .m w wmyw m m p ,. - .,-e,e--,ve-y -r- ,--w , wv-w., m .w--e----..., ,w -
r The six Status Trees are ALWAYS evaluated in the sequence: k PRIORITV ^ STATUS TREE CODE
~1 Suberiticality (S)
.2 Core Cooling (C) 3 Esat Sink' (H) 4 , Integrity- (P) 5 Containment (Z) 6 Inventory (I)
If identical color priorities are found on different trees during moni-toring, the required action priority is determined by this sequence. The user begins monitoring with the Subcriticality tree. Entry is at the arrow at the left side of the tree. Questions are answered based on plant con-dicions at the time, and the appropriate branch line followed to the next question. ' An individual status tree valuation is complete when the user arrives at a color - (or :line pattern) - coded terminus. With the exceptions noted
'below, the color and instructions of the terminus are noted (logged) and the user continues to. the next tree in sequence, again entering at the left-hand side arrow..
If any RED terminus is encountered, the operator is required to Lamediately stop any Optimal Recovery Procedure (ORP) in progress, and to perform the Function Restoration Procedure (FRP) required by the terminus. If during the performance of any RED - condition FRP, a RED condition of higher priority arises, then the higher priority condition should be addressed first, and the lo'rer priority RED-FRP suspended. If any ORANGE terminus is ine auntered, the operator is expected to monitor all of the remaining trees, tce then, if no ED is encountered, suspend any ORP in progress and perform the FRP required by the ORANGE terminus. If, during the performance of an ORANGE - coded FRP, any RED condition or higher priority ORANGE condi?. ion arises, then the RED or higher priority ORANGE condition is to be addressed first, and the original ORANGE FRP s us pended.' . , Once a FRP is entered due to a RED or ORANGE condition, that FRP is per-formed to . completion, unless pre-empted by some higher priority condition. It is expected that the actions in the FRP will clear the RED or ORANGE condition before all the operator actions are complete. However, these procedures should be completely performed to the point of the normal tran-sition. back to " Procedure and Step in Ef fect". Tree monitoring should be continuous if any status coded ORANGE or RED is found to exist. If no condition more serious than YELLOW rs encountered, monitoring frequency may be reduced to 10-20 minutes, UNLESS some signifi-cant change in plant status occurs. (-
. . .. - -. - . - - . .= ._ - _ - - - - ~ .. .. -. ._
v Mrnitering may be terminated citer the Reactor Protection System and Engi-tsered Safeguards System are both restored to operable status (SI reset and trip-breakers _ closed). At this point, the operator should no longer be
!{ using the ERPs.
A YELLOW . terminus does not' require immediate operator attention. Frequently it is indicative of, an off' normal and/or temporary condition which will be restored to normal status by actio?s already in progress. In other cases where RED or ORANGE termini are possible, the YELLOW status might provide _ an early indication of a problem developing. Following FRP , implementation, a YELLOW might indicate a residual off-normal condition. l The operator is allowed to decide whether or not to implement any YELLOW condition FRP. ~ Tree monitoring can be done automatically by computer; .however, the opera-tor should verify proper automatic status monitoring at least once and as i early as possible. This is accomplished by comparing status tree indica-tions with hard wired MCB indicators for appropriate parameters. ] 5. EXAMPLE OF STATUS TREE USAGE
~
The actual process of working through the tress will be illustrated by exa-mining the first (Subcriticality) status tree. The user enters the tree at the lef t-hand arrow and is asked 'if neutron flux (NIS channels) indication is less than 5%. The possible answers are either "yes" or "no". If indi-
- cated power is greater than 5%, then the appropriate answer is "no", so the user would follow the "no" path directly to the terminus and determine tha t
e the response priority is RED (immediate response required) e the appropriate ~ Function Restoration Procedure is FR-S . I. According to the Rules of Priority, the operator should suspend whichever ORP is being performed ' and. immediately- initiate the actions in procedure FR-S.I. Monitoring of the Status Trees may continue for information pur-poses, but by Rules of Priority, no other higher priority condition can ; exist. When the actions required by FR-S.1 are complete, the operator is ! directed to " Return to Procedure and Step in Effect". This allows recovery actions to continue exactly where they were suspended when the RED priority i was recognized. This also signals continued monitoring of status trees. I , In this case, the user and/or operator would know, because of the FR-S.1 i actions and checks, tha t the subcriticality tree would have no status more severe than YELLOW. If indicated power is less than 5%, then the first question block is answered with a "yes" and the user would follow the "yes" path to the next 4 question block. In this second block, the user is asked whether the Intermediate Range Startup Rate is zero or negative. 'If the indicated rate is positive, then . the user-would follow the "no" response path directly to a terminus and determine thats i ( !~ 9 1
-,, ,.--,,,,_ n ,nn ,~..,_ ,, _ ,_ .-,..,,_.,,~ n _ , _ ,.-,wn,,,---_,nn.-n-,-4-n,,, r-,-., - .
~
'w i
.e ' the response priority is ORANGE (prompt response required) -
e the appropriate Function Restoration Procedure is FR-S.I. J l According to the rules of usage, the remainder of the status trees should be monitored to determine if any RED conditions are present. If no RED status is encountered, then any ORANGE conditions would be reviewed for priority. Since subcriticalit.y is the first status tree, the present ORANGE would be addressed first by rules of priority. Again the operator would suspend whichever ORP was being performed and initiate the, actions in f- -procedure FR-S.I. Monitoring of the status trees should continue in order to promptly identify any RED conditions which might arise and take l priority. When procedure FR-S.I. is completed,- the operator can again ,
-return to his normal recovery action at the point where it was suspended -
unless other ORANGE conditions require attention first._ Again, order of
- tree sequence would determine ORANGE priority.
If the answer to the second block ques tion were "yes", the user would follow the "yes" path to a third question block. This time the question is whether the source range is energized. This can easily be answered by checking the detector high voltage indication, or by noting the Source Range beeper. If the Source Range is determined to be not energized, the user follows the "no" path upward to another question block. Now he is asked if the Intermediate Range startup rate is more negative than .2 DPM. If the indicated startup rate is between zero and
- .2 DPM, then the user would follow the "no" path directly to a terminus and find that:
4 o- the response priority is YELLOW- (action not required immediately) ; e the appropriate Function Restoration Procedure is FR-S.2. l Sinee the status priority _ is YELLOW, the user would continue to monitor the
-remaining trees and deal with any RED or ORANGE prioriti.es which might- be i encountered. If no other condition coded higher than YELLOW were present,
. then the operator would decide if the FRP should be performed or delayed. ) ,_ Of ten, 'a YELLOW is indicative of an off-normal condition which may be i restored to normal status by actions already in progress. At other times, i the YELLOW status may be indicative of an abnornality in a single RCS ' loop )
- a single SG, for example and may be considered acceptable for the par- l ticular accident in progress. Whatever the case, the operator makas the decision about responding to the YELLOW condition.
If the Intermediate Range startup rate is more negative than .2 DPM, then the user would follow the "yes" path downward to a terminus and find the condition coded GREEN, the annotated "CSF SAT;" the Critical Safety Function - SUBCRITICALITY, is considered satisfied, so the user proceeds to evaluate the next status tree in the sequence. If the Source Range was found to be energized, in response to the third ques tion block, the user would follow the "yes" path downward to another question block. This time he is a,sked if the Source Range startup rate is
- 10 -
l l l l
- negative or zero. Since the source range signal is normally erratic, it will be nacassary for - the user to look at a recorder trend of count ra te to properly . evaluate the startup rate. If positive, the user would follow the "no" path- upward to a terminus and find:
e the response priority is YELLOW b o the appropriate Function Restoration Procedure is FR-S.2 The operator would again use his judgement regarding implementation of FR-S.2 while continuing recovery cperations and osserving the rules of usage for the other status trees. If the Source Range startup is observed to be negative, the user follows the "yes" path downward out of the question box and finds the condition coded GREEN, the safety function is satisfied. The user would move
- directly to the next tree in the sequence.
- 6. CONTROL ROOM USAGE OF THE ERP NETWORK While the previous sections discussed the separate usage of an individual procedure and evaluation of status trees, this section presents the intended overall usage of this entire ERP network.
Direct entry into the Emergency Response Procedures is limited to TWO SPECIFIC CONDITIONS: o If at sny time a reactor trip or safety injection occurs OR IS REQUIRED, {s the operator _ will enter procedure E-0, REACTOR TRIP OR SAFETY INJECTION. e If at any time a complete loss of power on' the AC emergency busses takes p lace , the operator will enter ECA-0.0, LOSS OF ALL AC POWER. This includes any time during the performance of ANY other ERP. The entry into E-0 is expected to be the one more frequently used, so is described first: The operator proceeds through E-0, following the rules of procedure usage-as described above, with two possible outcomes:
- o He remains in E-0 and is directed by an action step to begin monitoring the - status tree'.s
- OR -
e He transitions to some other procedure, at which point he begins to monitor the status trees. Monitoring of the status trees takes place in accordance with its own rules of usage, in parallel with the recovery actions being performed by the operator. . The monitoring may be done directly by one of the operators in the control room, by some other member of the shif t assigned to the control room, or by a dedicated computer routine. The only requirement of the
. 11 9 'e*- - ---
v.--, -.-y-,.--, - - . -,y,---- --s-=r=.www--,- -'-ey-,ym.m,--- v,m+,-c.,,,+wz-rww .emr,-r-w,nr-,-.-c ,9.- --e--iv-i-,---,
monitoring function is that the operator in charge' of recovery actions be immediately-informed of RED or ORANGE priority status conditions, and regu-
=* larly advised of YELLOW and GREEN conditions.
I-The ORP actions in progress are suspended if either a RED or ORANGE con-dition is detected on a status tree. jijt ORP actions are to be performed while a critical safety function is being restored from a RED or ORANGE condition, unless directed by the FRP in effect.
, Af ter restoration of any Critical Safety Function from a RED or ORANGE con-dition, recovery actions may c'outinue when the FRP is complete. Most often, the FRP will return the operstor to the suspended ORP. However, at times a FRP dill require a transition to a different ORP because of con-ditions created within the FRP. ,
Upon continuation of recovery actions, some judgement is required by the operator to avoid inadvertent reinstatement of a RED or ORANGE condition by undoing.some critical step in a Function Restoration-Procedure. The plant recovery procedures are optimal assuming that equipment is available as required for safety. The appearance of a RED or ORANGE condition implies that some equipment or function required for safety is not available, and by Laplication, some adjustment may be required in the recovery procedures. An example might be the establishing of an alternate ' feed path to the steam generators as required by FR-H.l. With feed flow from either the main feed or condensate system, the operator would NOT want to isolate the main feed line as required by ES-0.1. Direct entry into ECA-0.0, due to. loss of AC power on both (4 KV) safe-guards busses is expected to be a rare occurrence. However, once in ECA-0.0, special considerations come into effect. Because none of the electrically powered safeguards equipment used to restore Critical Safety Functions is operable, none of the FRPs can be implemented. A NOTE at the beginning of procedure ECA-0.0 states "CSF Status Trees should be monitored , for information only. . FRPs should not be implemented" . Once in ECA-0.0, the operator perf~o rms the required actions, and is not allowed to tran-sition to any other procedure until some form of power is restored to the (4 KV) Safeguards busses. Even then, permission is not granted to imple-ment FRPs until some initial status checks are performed by the oper,ator.
- Certain energency contingency actions (ECA) take precedence over FRPs because of their treatment of specific initiating events. In all such cases, this precedence is identified in a NOTE at the beginning of the ECA procedure.
For example: ECA-2.1 deals with depressurization, loss of level, and resultant feed flow reduction to ALL steam generators. While this con-dicion results in a RED priority on the. Heat Sink. Status Tree, the referen-ced procedure, FR-H.1, returns the operator to ECA-2.1 for the preferred treatment of the event. ECA-2.1 contains an introductory CAUTION stating the specific conditions under which FR-H.1 should be implemented. k 12 - e-
o A more dramatic example is ECA-0.0 which provides the best strategy for maintaining Critical Safety Functious satisfied and protecting barriers until (4 KV) saf eguards AC power is res tored. One unique procedure in the ERP set has no transitions or direct entry con-ditions. It is used purely as an operator aid and is entered based purely on operator judgement. The procedure is ES-0.0, REDIAGNOSIS. It is intended to be used af ter departure from E-0, ' only if SI has been actuated. It provides reassurance to the operator that he is in the correct proce-dure, or provides the necessary transition instruction to get to the correct procedure for the exis ting symptoms. Operator need, for this rediagnosis procedure is limited in the Rev. 1 ERPs, because many of the transitions needed to respond to new symptoms are included in the OPERATOR ACTION
SUMMARY
. However, its presence can be reassuring to an operator af ter making .sevaral consecutive transitions due to rapidly changing condi tions. ERP usage always ends in one of the following ways: ~ o Transition to a normal (not an ERP) plant operating procedure. (stable). e Transition to some " appropriate" procedure while on RHR at cold -shutdown conditions (s table) . o On cold leg recirculation or hot leg recirculation with longer term recovery actions being determined by the individual utility (stable).
- 7. MODES OF APPLICABILITY OF THE ERPs The ERP network was originally written to accommodate transients occurring at a " hot" or "at power" condition. The transients envisioned would ' result in either Reactor Protection System or Saf eguards Systems actuation, with some corresponding, or subsequent, operator action needed. The guidance for operator action is based upon having the safety-related equipment required by Tech Specs for MODE 1 or. MODE 2 operation available for his use. For transients initiating during other MODES of operation, the same complement of equipment cannot be assumed available, so that the detailed instructions within the ERPs may not be applicable. - Just as earlier steps in the ERPs generally involve response to the transien t, la ter steps generally relate to getting the plant to a cold shutdcan condition. If the plant is already substantially cooled and depressurized, some detailed instructions may not lyt applicable.
Critical Saf ety Function monitoring using the Status Trees also assumes a MODE 1 or MODE 2 initial condition, followed by some Protection Sys tem actuation, to result in a subcritical reactor. Use of the trees can be extended beyond this original intent, but with an understanding of the intent of each tree. For example, the Heat Sink Tree assumes the steam generators are available for heat removal by steaming. If all reactor
~
decay heat is being removed by the RHR system, the steam generators are not required in their normal capacity. So, SG availability is really not required to be satisfied. Yet the tree would indicate a SG in wet layup to be OK, while one in dry layup would be abnormal.
- To clarify tha ucebility of tha ERPs for transiants originating during
- other than the assumed initial operating MODES, a detailed review of the entire network has been performed. - The results are presented in the following table. In some cases, slight modifications are needed to extend
.{ the . applicable range of a procedure beyond its original intent.
Procedure Designator Applicable Modes Comments E-0 1, 2, 3 , RHR not in eervice and > SI operable ES-0.0 1, 2, 3, 4 (Assumes trip from power) ED-0.1 1, 2 ES-0.2 Hot (near no load), ES-0.3 slight modification
-ES-0.4 required if already in cooldown E-l -
1, 2, 3 RHR not in service ES-1.1 c- . ES-1.2 RHR no t in service, entry is limited by stated con- [ ditions _m- . E-2 1, 2, 3, 4 Temp > 212*F v. E-3 1, 2, 3, 4 RHR not in service ES-3.1 ES-3.2 ES-3.3 ECA-0.0 1, 2, 3, 4 Partly hot and pressu-ECA-0.1 rized ECA-0.2 ECA-1.1 Specific entry conditions ' , ECA-1.2 Provided ECA-2.1 1, 2, 3, 4 RHR not in service, ho t
-{ 14
. . . _ .._-,..._.,m- . . - . . , . - _ _ . , _ , , , _ , ~ . ~ . , . . . . _.,m-,, . _--~,..,.- -, ,r,_ y._ ,-- y- r..,v, .,,.--..__,.m,.,,w,-
Procedure Designator Applicable Modes Comments ECA-3.1 1, 2, 3, 4 RHR not in service
.ECA-3.2
+ k; ECA-3.3
- *l
, F-0.1, Subcriticality 1-4 F-0.2 Core Cooling 1-4 F-0.3, Heat Sink 1-4 Unless RHR in service i F-0.4, Integrity 1-4 Slight problem with cool-down rate in MODE 4 F-0.5, Centainment 1-4 F-0.6, Inventory 1-4 ; 1 FR-S.i _ l-4 (AFW not required if on-RHR) j FR-S.2 1-4 FR-C.1 1, 2, 3 Partial MODE 4 on SI FR-C.2 equipment availability, ) secondary lineup FR-C.3 1-4 4 FR-H.1 1-4 Bleed and feed may be too i soon for MODE 4 1 FR-H.2 1-4 l l l
) FR-H.3 1-4 Except wet layup l FR-H.4 1-4 FR-H.5 1-4 Except dry layup I
i l Proc
- durn D7signatsr Applies. bin Mndin Ccam*.nta FR-P.1 1-4 Entry may not be neces-sary if initial *empera-('- ture was low
- FR-P.2 1-4 )
FR-Z.1 1-4 ' FR-Z.2 1-4 FR-Z.3 1-4 FR-I.1 1-4 Some exceptions if RHR
- in service FR-I.2 1-4 Possible exception of SI initiation FR-I.3 1-4 Operating MODES as used here has the same definition as the Seabrook Technical Specifications
THERMAL POWER REACTIVITY (% RATED, EXCLUDING AVERAGE MODE (Keff) DECAY HEAT) COOLANT TEMPERATURE ( -
- 1. . Power Operation > 0.99 , >5 > 350*F
- 2. S tartup > 0.99 <5 > 350*F
- 3. Hot Standby < 0.99 0 1 350*F
- 4. Hot Shutdown < 0.99 0 350'F>Tavg>200*F 5.. Cold Shutdown < 0.99 0 < 200*F (Mode 6, Refueling, is not considered in the context of ERP applicability ) .
e
- 16 -
( e----97-yv t - --+'r-- y-~1 --t-,t --i- gr -
-w- T- g t tr -p y + tr g a- - , - -__,%-,43 y,,-ge--y-y-w w7msa m 9-vme-my -- y
( l l I EXAffLE ERP E-2 FAULTED STEAM GENERATOR ISOLATION ( . 9 e
A, a 1 i 5 i 1 l i i i i OPERATOR IMMEDIATE ACTIONS i ( Must commit to permanent memory) i i I f I
' CODE. SYMPTOM / TITLk5 PROCEDURE NO.
REVISION NO. / VAT. [EO.1 .SUBCRITICALITY STATUS TREE os-1350.1 L 00/10/2/83 k . . GO TO FR-S.1 r------Q?N.
"O i NEUTRON FLUX ENTER h LESS THAN 5% YES GO TO (RTP) ee l e FR-S.2 s
INTERMEDIATE 3g INTERMEDIATE no OR NEGATIVE YEs RO'OR YES 1HAN 02 DN l NEGATIVE CSF SAT "O SOURCE
=
RANGE ENERGlZED YEs l l GO TO e FR-S.2 l e \ . SOURCE No RANGE SUR ZERO OR YE~e NEGATIVE 1 CSF SAT i l k
,-l M- _
T +
)
)
I e EXAMPLE STATUS TREE (
unca:' syrpcca/Aicio: frccoduro No./_- R3vinica Ns./ Data l E-2 FAULTED STEAM GENERATOR ISOLATION OS-1320 Rev. 1 0 / t . . l A. PURPOSE This procedure provides actions to identify and isolate a faulted steam generator. B. SYMPTOMS OR ENTRY CONDITIONS: This procedure is entered from:
- 1) .E-0, REACTOR TRIP OR SAFETY INJECTION, Step 22 and E-1, LOSS OF REACTOR OR SECONDARY COOLANT, Step 2 with the following symp toms:
- a. Any SG pressure decreasing in an uncontrolled manner
- b. Any SC completely depressurized
- 2) E-3, STEAM GENERATOR TUBE RUPTURE, Step 6, ECA-3.1, SGTR WITH LOSS OF REACTOR COOLANT - SUBC00 LED RECOVERY DESIRED, S tep 8,
.and ECA-3.2, SGTR WITH LOSS OF REACTOR COOLANT - SATURATED RECOVERY DESIRED, Step 3 when faulted SG l' solation is not verified.
- 3) FR-H.5, RESPONSE TO STEAP. GENERATOR LOW LEVEL, Step 3 when the affected SG is diagnosed as faulted.
- 4) Other procedures whensver a faulted SG is identified.
l l 1 l 1 1 l ( l of 5
-,.---,,-w - - - - - - , . , - - - - - . - - - - - - ,,-,.,..--w,-, ..e - , .,.- r.yy, ,..,.--,,-.y_.,y.,, -,,cw .w -,-w., g-w-_,,-_,,.e. v.-.----- , y. - , v.----..
~~~
C das S3 ,p od/.Titlos Prcendura No./ Revision No./ Data: E-2 FAULTED STEAM GENERATOR ISOLATION OS-1320 Rev. 1 0 / ( l STEP l l ACTION / EXPECTED RESPONSE i - l RESPONSE NOT OBTAINED l CAUTION e At least one SG aust be' maintained available for RCS cooldown. e Any faulted SG or secondsry break should remain isolated during subsequent recovery actions, unless needed for RCS cooldown. 1 Check Main Steamline Isolation Manually close valves. And Bypass Valves Of Affected SG(s) - CLCSED 2 Check If SG Pressure Boundary Is In tact:
- a. Check pressures in all SGs - a. IF all SG pressures de-ANY STABLE OR INCREASING creasing in an uncontrolled manner, THEN go to ECA-2.1,
{
- UNCONTROLLED DEPRESSURIZA-TION OF ALL STEAM GENERATORS ,
S tep L. 3 Identify Faulted SG(s):
- a. Check pressures in all SGs - a. Search for initiating , break:
e Main steamlines e ANY SG PRESSURE e Main feedlines DECREASING IN AN e EFV lines
- UNCONTROLLED MANNER e Steam to EFV turbine e ASDVs
- OR - e Blowdown e ANY SG COMPLETELY Go to Step 5.
DEPRESSURIZED .I 2 of 5
-_,-.a-,---------e--,n --. ,,,,..,_,_,-,_..,-.,.,..,-,-,-------.,,,,wr- , ,,--_--.-~----.--,.r--.--
C:das Sycptm/Titlos Procedura No./ Rovisica No./Date: E-2 FAULTED STEAM GENERATOR ISOLATION OS-1320 . Rev. 1 0 / I ( l STEP l l ACTION / EXPECTED RESPONSE l l RESPONSE NOT OBTAINED l 4 Check Faulted SG(s) Isolated: Manually close valves. E valves can NOT be closed, THEN l
- a. Main feedline - ISOLATED dispatch operator to locally l close valves or block valves
- b. EFW flow - ISOLATED which are accessible to isolate leak.
- c. Steam supply to turbine-driven EFW pump - ISOLATED e SG-A MS-V127 e SG-B MS-V128
- d. SG ASDV - CLOSED
- e. Main steam drains -
GROUP A CLOSED
- f. SG blowdo*wn - ISOLATED SG VALVE A SB-V9 B SB-V10 C SB-Vil D SB-V12 CAUTION CST ankaup should coerence as early as possible to avoid low inventory problems.
5 Check CST Level - GREATER Establish makeup to CST at THAN 23 FEET maximum rate. 3 of 5 t _ . - _ _ . - - , __ _ _ _ - . - . - , , _ _ . . _ _ - _ _ _ _ _ _ - - . ~ _ _ _ _ . , _ _ _ _ _ _ ~ , , - - _ _ - - _ . . . _ . - . , - - ~ _ _ _ . _ - - _ - , . . - , - - . _ _ _
Coda Sytp tsr/Titics Precaduro No./ R0visica No./Dats: E-2 FAULTED STEAM GENERATOR ISOLATION OS-1320 Rev. 1 0 / l STEP l l ACTION / EXPECTED RESPONSEl l RESPONSE NOT OBTAINED l 6 Check Secondary Radiation:
- a. Request periodic liquid a. IF, SG blowdown can NOT activity samples of all be reestablished, go to SGs Step 6b.
- 1) Roset SI
- 2) Reset Phase A isolation .
- 3) Reestablish SG blowdown for sampling only
- a. Locally isolate throttle valves to blowdown tank first, THEN reopen blow-down containment isola-tion valves
- b. Check unisolated secondary radiation monitors using RDMS
( o Main S tesaline monitors'
- c. Secondary radiation - NORMAL c. Go to E-3, STEAM GENERATOR TUBE RUPTURE, Step 1.
7 Go To E-1, LOSS OF REACTOR OR SECONDARY COOLANT, S tep 1 , , l
- END - !
9 4 of 5 1
CIds: Symptt2/Titis: Precadurs Ns./ R visica No./Dats: E FAULTED STEAM GENERATOR ISOLATION OS-1320 Rev. 1 0 /
-(
ATTACHMENT A RED PATH
SUMMARY
SUBCRITICALITY - NEUTRON FLUX GREATER THAN 5% RTP CORE COOLING - CORE EXIT TCs GREATER THAN 1200*F
. og .
CORE EXIT TCs GREATER THAN 700*F AND RVLIS LESS THAN 40% WITH NO RCPs RUNNING HEAT SINK - SG INVENTORY LESS THAN REQUIRED IN TABLE AND EFW FLOW CAPABILITY LESS THAN 470 GPM TOTAL COMBINED FLOW NORMAL ADVERSE CONTAINMENT CONTAINMENT e ( 65% WR" 28% NR INTF"ITY - COLD LEG TEMPERATURE DECREASE GREATER THAN 100'F IN LAST 60 MINUTES AND RCS COLD LEG TEMPERATURE LESS THAN 250*F CONTAINMENT - CONTAINMENT PRESSURE GREATER THAN 52.0 PSIG o G ( 5 of 5 _._..._._._r
T IMMEDIATE ACTIONS REACTOR TRIP OR SAFETY INJECTION E-O STEP SEQUENCE
- 1. Verify Reaccor Trip 1 - -
- 2. Verify Turbine Trip 2
- 3. ~ Verify Power To AC 3 Emergency Busses
- 4. Check If SI Is Actuated 4 (OUT)
- 5. Verify FW Isolation
- 6. Verify Containment Isolation Phase A
- 7. Verify EFW Pumps - RUNNING
- 8. Verify ECCS Pumps - RUNNING
- 9. Verify PCCW Pumps - RUNNING
- 10. Verify Ultimate Heat Sink Operation
- 11. Verify SW Cooling To DC's
- 12. Verify Containment Ventilation Isolation
- 13. Check If Main Steamlines Should Be Isolated
- 14. Check Containment Pressure -
HAS REMAINED LESS THAN HI-3 (18 PSIG) BY PRESSURE RECORDING e
IMMEDIATE ACTIONS l f LOSS OF ALL AC POWER , , ECA-0.0 P STEP SEQUENCE l
- 1. Verify Reactor Trip 1
- 2. Verify Turbine Trip 1
- 3. Check If RCS Is Isolated 1
- 4. Verify EFW Flow - GREATER 1 THAN 470 GPM TOTAL COMBINED FLOW G
e N o I
DOEDIATE ACTIONS l RESPONSE TO NUCLEAR POWER GENERATION ATWS Function Restoration Procedure FR-S.1 STEP SEQUENCE
- 1. Verify Reactor Trip i
- 2. Verify Tyrbine Trip 2
- 3. Check EFW Pumps Running 3
- 4. Initiate Emergency Boration 4 O
( - 9 ( _w.---. ycr--- -.,y,y ,.n, ,,.w, - , , ---e,-... e.,,.-,.c. 9%e g .m-c.--w-we---we-,,,,,-ymnw3 -,-wm q-- ,eggw-g--,cm-.,-mw.=wpg..y y ?y-,meww-3-ye-r-
.(
p SELECTED EMERGENCY RESPONSE PROCEDURES for Discussion N . I l i
a Our training thus far-has already provided adequate " overview ( level" discussions for many events and plant symptoms such as LOCA, LOAC, Stesaline/ Feedline breaks, ATWS, Inadequate Core Cooling (ICC) and Loss of Heat Sink. Most of this was presented in ECCS and MCD. However, more time should be spent in other events and symptoms not yet discussed in sufficient detail. This will include Response to Reactor Trip or Safety Injection, more on Natural Circulation Cooldown and SG Tube Rupture Recovery Techniques. O e 9 i i l I l l J
E-0 ( REACTOR TRIP OR SAFETY INJECTION INTRODUCTION Procedure E-0, REACTOR TRIP OR SAFETY INJECTION, provides actions to verify proper response of the automatic protection systems following manual or automatic actuation of a reactor trip or safety injection, to assess plant conditions, and to identify the appropriate Optimal Recovery P rocedure. Procedure E-0 is to be entercJ when any of the following occur:
- 1) A reactor trip is required as det emined by plant specific set-points or requirements being enceeded.
( 2) A reactor trip has occur, red as determined by the plant annun-ciators, neutron flux instrumentation, and control rod position indicators.
- 3) A safety injection is required as determined by plant specific setpoints or requirements being exceeded.
- 4) A safety injection has occurred as determined by the plant annun-ciators, SI pump status, or other plant specific seans.
Once E-0 is entered, it is not exited until there is a direct transition to an Optimal Recovery Procedure (ORP) as directed by the sysptoms being monitored in E-0 or to a Function Restoration Procedure (FRP) as directed by the Critical Safety Function Status Trees or symptoms being monitored in E-0. D 0 9
'l 1- DESCRIPTION
( - . Procedure E-0, REACTOR TRIP OR SAFETY INJECTION, provides the operator with the necessary guidance to verify that all automatic actions have occurred as designed and presents the diagnostic sequence to be followed in the identification of the appropriate Optimal Recovery Procedure. These include:
- 1. ECA-0.0, LOSS OF ALL AC POWER
- 2. ES-0.1,. REACTOR TRIP RESPONSE
- 3. E-1, LOSS OF REACTOR OR SECONDARY COOLA!TI
- 4. E-2, FAULTED STEAM GENERATOR ISOLATION
- 5. E-3, STEAM GENERATOR TUBE RUPTURE
- 6. ES-1.1, SI TERMINATION I 7. ECA-1.2, LOCA OUTSIDE CONTAINMENT It is expected that the operator will attempt to take manual actions to correct for anomalous conditions during power operation. Such actions would include taking manual contro1~of the automatic control systems, turning on additional charging pumps, reducing power level, etc. If these types of actions do not alleviate the trend toward a reactor trip or, sa,fety injection, the operator is permitted to trip the reactor and,. if necessary, actuate safety injection.
The reactor protection equipment is designed to safely shut down the reac-
, tor in the event that the anomalous condition cannot be corrected. The safety injection system is designed to provide emergency core cooling water and boration to maintain a safe reactor shutdown condition. The plant safeguards systems operate with of fsite electrical power or from
-- . . .. - ~_-
onsite emergency diesel-electric power, should offsite power not be avail-( . able. The operator will enter E-0 on a reactor trip or safety injection, whether the signal was autsmatic or a result of manual actuatiou. Through symptom-based diagnosis, the operator is directed to the proper Optimal Recovery Procedure to facilitate optimal recovery.
. Many parameters behave in a similar manner for loss of reactor coolant, secondary coolant and steam generator tube ruptures. For example, RCS pressure drops for all three cases. The symptoms used to diagnose the t
three major event categories are those most representative of the fault. A break in the secondary is diagnosed by secondary pressure decreasing in an uncontrolled manner or any steam generator completely. depressurized. A primary to. secondary break is diagnosed by abnormal secondary radiation. A loss of primary coolant into containment is diagnosed by abnormal con-tainment pressure, sump level, or' radiation. Abnormalities in both con-tainment pressure and sump level can 'als'o occur for a secondary break in containment. For that reason the secondary pressure is checked before the containment conditions in the diagnostic steps to eliminate a secondary break as being the cause of the containment conditions. The radiagnostic capabilities of the subsequent procedures, such as in E-1, LOSS OF REACTOR OR SECONDARY COOLANT, allow for any misdiagnosis to be corrected and the operator to proceed to the proper procedures in the Emergency Response Procedure (ERP) network. If an event is not diagnosed by the primary symptoms, then other symptoms are checked in 6-0. If no fault is ini-tially found, the operator will cycle through the diagnostic steps until either a fault is observed or SI termination criteria are met. ( O e
- , , , , - _ , . . --. .--*-ev . , - . . _ , , . . - . - , - - . , - . .-.-.,...,._,,.-c-. --+,...e- , . - , -
I
. l e -
l
/' E-0 j- REACTOR TRIP OR SAFETY INJECTION l MAJOR ACTION CATEGORIES IN E-0 e Verify Automatic Actions as Initiated by the Protection 'and Safeguards .
S ystent (IMMEDIATE ACTIONS - STEPS 1-14) - Immediate actions s e those actions which the operator should be able to perform before opening and reading his emergency procedures. In general, immediate ections are limited to the verification of automatic protection festures of the plant. Although the immediate actions should be memorized by the operator, they need not be memorized verbatim. The operator should know them well enough to complete the intent of each step, which is to verify that the automatic actions have occurred. The order in which they should be performed should also be consistent with the step sequence requirements, i.e., the order of the first four steps is important and the rest may be interchanged. i e Identify Appropriate Optimal Recovery Procedure e Shut Down Unnecessary Equipment and Continue Trying to Identify Appropriate Optimel Recovery Procedure o Initiate Monitoring of Critical Safety Function Status Trees AT STEP 27 OR WHEN EXITING E-0. , i t 4
The following are questions which have been frequently asked about E-0, REACTOR TRIP OR SAFETY INJECTION: { Q. When -is E-0 normally entered? A. E-0 is normally entered whenever a reactor trip or safety injection occurs or is required as determined by plant observables. i Q. Can safeguards signals be reset before the procedure step instructs me to reset them? A. Safeguards signals should only be reset when necessary to manually 4 operate equipment. In the procedures, those steps are generally located before the first step that either stops an ECCS pump or expli-citly repositions a valve that receives a safeguards signal. The I general philosophy to follow is to only reset safeguards signals when
-(' .
the reset is necessary for manual operation of components. Q. If the fault is readily apparent, does E-0 have to be performed rather than going directly to the appropriate Optimal Recovery Procedure? A. Yes, E-0 should be performed. The verification of automatic actions and diagnostics should be performed to ensure the proper checks have been completed prior to the first deep of any subsequent procedure. The ERPs are a procedural network organized in a lbgical order with any one procedure tuing a sub-part of the whole. To properly execute th ERPs, it is important to start at the beginning and let the tran-i sitions direct you through the network. (
- - - ~ ~ + =--,---.#-.w. yr--,-ww- - - ,m_,.,y,m,.,w._ _,4---y,w.--.-%+---,%,%u --,.mwmerr-,-,,-,,-.--c-,w- m
i 1 i i - 3 i j . ES - 0.0 REDIAGNOSIS 1 i PURPOSE OF PROCEDURE ! Method For Determining Or Confirming The . Most Appropriate Post Accident Recovery Procedure . i ENTRY INTO PROCEDURE l Operator Judgement When Si is Actuated Or Required i I i i i
ES-0.1 { REACTOR TRIP RESPONSE INTRODUCTION Procedure ES-0.1, REACTOR TRIP RESPONSE, provides the necessary instruc-tions to stabilize and control the plant following a reactor trip without a safety injection. It is entered only from E-0, REACTOR TRIP OR SAFETY INJECTION, Step 4 when an SI is neither actuated nor required. Following the stabilization of the plant, ES-0.1 is exited to either a normal plant procedure for startup or cooldown, or to ES-0.2, NATURAL CIRCULATION C00LDOWN, if a natural circulation cooldown is required. ( O E e f
l i
)
4 DESCRIPTION k A reactor trip is a command to shut down a reactor which is either criti-cal or undergoing startup operation. The command is generated by either an automatic protective action initiated when cer'tain setpoints for plant operating parameters are exceeded or by manual initiation by the operator. The generation of a protection demand is appropriately indicated at the annunciator panel. Several automatic actions aimed at ensuring that the core is shutdown and that there is effective decay heat removal follow the occurrence of a reactor trip. Following a reactor trip from full power, the reactor coolant temperature
.is reduced from full power temperature to no-load temperature by automatic operation of the condenser steam dump system. If for any reason condenser s team dump capability cannot be obtained, the steam generator atmospheric I
steam dump valves will automatiica'lly modulate. If these do not open, the steam generator code safety valves open to protect the secondary system and by that means remove heat from the primary system. The cooldown to no-load shrinks the water in the RCS and pressurizer level should stabi-lize automatically at the no-load programmed level. The drop in level results in a reduction in RCS pressure from the nominal 2235 psig. XCS pressure can be expected to drop to about 2000 psig before starting to 1 increase as a resui; if operation of the pressurizer heaters. For most reactor trips steam generator water level will remain above the top of the U-tubes although it may shrink out of the narrow range indication. Emergency feedwater pumps will start on low-low narrow range SG level to restore SG level into the narrow range. Extensive subcooling of the reac- [
s' tor coolant at the core exit should exist. Forced flow in the RCS will be maintained unless for some reason the reactor coolant pumps have tripped, [ in which case flow will be by natural circulation. The station electrical busses would normally be energized by offsite power. If for some reason s station " blackout'" (loss of offsite power) occurs, the diesel generators would automatically start and supply power to the blackout loads to stabilize and control the plant. All critical surveillance', control, and safeguards actuation systems are continuously powered from the plant's redundant batteries. All operating elements of~ the safety grade systems (ECCS pumps, for example) would have power available from the diesel generators. A number of operating elements for "non-safety grade" systems and components may not be automatically powered by the diesel generators. These "non-safety-grade" components include some pressurizer heaters, the Startup Feed Pump and the plant air compressors, and should be intentionally repowered as soon as possible since the availability of these components facilitate plant control. Procedure ES40.1 deals with the specific actions necessary to stabilize and control the plant following a reactor trip. It also handles reactor trips combined with either a station blackout or a total loss of forced reactor coolant flow. k l
O t k MAJOR ACTION CATEGORIES IN ES-0.1 e Ensure the Primary System Stabilizes at No-load Conditions e Ensure the Secondary System S tabilizes at No-load Conditions o Ensure Necessary Components Have Power Available e Maintain / Establish Forced Circulation of the RCS I e Maintain Plant in a Stable Condition e a l ( l l J
KEY UTILITY DECISION POINTS f After the plant is stabilized following a reactor trip, the operating crew would have to determine the next course of action. Generally, if no com-ponents necessary for power operation are out of service, the limiting conditions for operation in the Technical Specifications are satisfied, and if the cause of the trip is identified and corrected, then a plant startup would be commenced. If a Technical Specification limiting con-dition for operation is violated and its action statement requires a cooldown, or a cooldown is necessary to repair non-safety grade components needed for operation, then a plant cooldown is commenced. If a cooldown is required, forced circulation of the RCS is always preferred over a natural circulation cooldown in order to eliminate any concerns about drawing voids in the system and/or incomplete boron mixing. Therefore, j attempts should be made to start.at least one reactor coolant pump prior to the cooldown, if one is not already running. A natural circulation cooldown should only be performed if absolutely necessary. f
., . - , _ . . _ , ~ , , . . _ , , _ , , , . , . . , ,., .,
- , , . , m__ , 6. .. ...r,, , . .- _ , ,c
A-ES-0.2 ( NATURAL CIRCULATION COOLDOWN INTRODUCTION Upon entry to ES-0.2, NATURAL CIRCULATION C00LDOWN, natural circulation of the RCS has been verified and stable plant conditions are being main-tained. The purpose of ES-0.2 is to cool down and depressurize the plant to cold shutdown under natural circulation conditions by dumping steam and subsequent RHR system operation. There should be no accident in progress and cooldown conditions are specified to preclude any upper head void for-mation. This procedure is entered from ES-0.1, REACTOR TRIP RESPONSE, Step 13 or ECA-0.1, LOSS OF ALL AC POWER RECOVERY WITHOUT SI REQUIRED, Step 21 when f it has been determined that a nat, ural circulation cooldown is required. There are three possible transitions out of this procedure. If SI actuation occurs, a transition to E-0, REACTOR TRIP OR SAFETY INJECTION, should be made. Since it is always desirable to have forced convection heat transfer from the core, the first step of the procedure attempts to s tart an RCP. If this attempt is successful, a transition to appropr,iate plant procedures is in order. The third transition occurs if the plant l s taff determines that a natural circulation cooldown and depressurization must be performed at a rate that may form a steam void in the vessel. At that time a transition to ES-0.3, NATURAL CIRCULATION C00LD0'4 WITH STEAM VOID IN VESSEL (WITH RVLIS) or ES-0.4, NATURAL CIRCULATION C00LDOWN WITH i STEAM VOID IN VESSEL (WITHOUT RVLIS), should be mde. 6
l I I
# DESCRIPTION l The objective of ES-0.2, NATURAL CIRCULATION COOLDOWN, is to permit cooldown and depressurization of the RCS without forming voids in the higher-temper.ature/ low-flow portions of the system (e.g. , upper head ;
region and steam generator U-tubes). Based on the cooldown/depressuriza-tion analysis performed for Westinghouse plants as a result of the St. Lucie Unit 1 plant cooldown using natural circulation (June 11, 1980), certain limitations were determined concerning the maximum cooldown rate and minimum subcooling requirements necessary to prevent void formation. During the St. Lucie event, ,it was evident from pressurizer level and pri-mary system pressure response that ~ void formation occurred in the upper head region. Even though told leg temperatures at the time of voiding were highly subcooled, fluid in the upper head was auch hotter, relatively stagnant and in poor communicatio'n with the rest of the primary system. It has been postulated that the steam bubble in the . upper head area was produced when the system. pressure dropped below the saturation pressure corresponding to the temperature of the fluid in the upper head. There are several parameters which can have a significant effect on the
-formation of voids in the upper head region during natural circulation 1
cooldown/depressurization transients. One such parameter is the magnitude of the flow between the upper downcomer and the upper head. This flow is at a temperature equivalent to that of the cold leg fluid. Hence, this flow directly affects the upper head fluid temperature, which is a second ' I f actor that has an effect on the formation of voids in the upper head ' I region. Most currently operating Westinghouse plants under forced flow
. l
conditions have an amount of flow into the upper head region which results in an upper head fluid temperature between the cold leg temperature { (TCOLD) and the hot leg temperature (THOT). For the natural circulation cooldown analysis the initial upper head temperature for these plants was conservatively chosen as THOT. Other Westinghouse plants operate with sufficient flow from the upper downconer to the upper head region to make i the upper head fluid temperature equal to the cold leg fluid temperature (TCOLD). Both types of plants were analyzed. Seabrook is a TCOLD Pl ant. Another parameter which affects void formation in the upper head region is the cooldown rate of the primary system. Natural circulation cooldown rates of 25'F/hr and 50*F/hr were analyzed for THOT and TCOLD Plants,
~
respectively. A. final parameter important in the formation of voids in the upper head is the heat removal rate from the up'per head. The two primary means of heat
-loss are ambient heat losses and heat removal by the control rod drive mechanism (CRDM) fans. The effect of ambient heat losses through the reactor vessel on upper head temperature is small compared to the effect of the CRDM fans. The cooloff rate of the upper head due to ambient heat losses is less than l'F/hr and was neglected in the analysis. Howeve'r, metal heat addition to the upper head area from the reactor vessel and upper internals was taken into_ account.
The CRDM cooling system consists of fans which maintain a suitable atmosphere within the CRDM shroud to protect and prolong the life of the i CRDM motors. The system induces cooler containment air into the CRDM shroud and exhausts warmed air through the fans. The CRDM fans remove
~= , - - ..-,,-.,r-e--.m ---%--,. r-----,we--.,-.----wr,,w ,,-=.~~,,,,-er--, ,,,-,-,utr--~w--,,---,,,--
(~ 8 kw/ drive train at full power. For a 4-loop plant with 57 full-length rods, the CRDM fans remove 8 kw x (57) = 456 kw. Based on the heat transfer area of the CRDMs and the volume of coolant under the reactor vessel head, the calculated head cooldown rates with CRDM fans running is 18'.5'F/hr 9 600*F and 10*F/hr 9 350*F. ,
)
0 1 1 l l
4 .- - i I UPPER HEAD FLUID TEMPERATURE TCOLD- 50 /hr COOLDOWN FIGURE OP 1 (TC Rev 0 3/84)
~
i i 700 l 500 - , oc , E 300- - ! 2 ! m j l- _ _ f 100 - - l !- 0- l l 0 100 200 TIME (minutes) } FIGURE 1
l l l l In the analysis, natural' circulation cooldown was assumed to be initiated I
~
( at 12 minutes af ter the RCP trip. With the exception of the pressurizer, the primary system was subcooled when the natural circulation cooldown was
' initiated. At 12 minutes the difference between the hot and cold leg tem-paratures was approximately 30*F, the primary system loop flow was
-approximately-500 lb/sec. and the reactor power (due to decay heat) was i-2.3 percent of full power (nominal). The loop flow rate of 500 lb/see, 4 was approximately 5 percent of full power loop flow. Natural circulation flow has -been observed to be between 4.5 percent and 5.0 percent of full power flow at' 2.3 percent of nominal power for a Westinghouse 4-loop plant
- based on- calculations and tests.
With forced flow (i.e., with the reactor coolant pumps running) t'he flow goes from the upper downcomer through the upper head spray nozzles into f: the upper head' region. From the upper head region the flow goes down through the guide tubes into the upper plenum / core region. With the reac-
- tor coolant pumps running the vessel pressure distribution is such that -
flow is forced up the upper. head spray nozzles. Within 2 to 4 minutes after the reactor coolant pumps are tripped this flow reverses and goes up
- the guide tubes'into the upper head region and down through the upper head spray nozzles into the upper downcomer. This flow reversal occurs.due to.
d the downcomer fluid density being greater than the upper plenum / core fluid density, and the upper plenum / core fluid density being greater than the
, upper head density. This density variation forces flow up the guide tubes. Because~of this flow reversal, upper head temperature rises early in the transient (see Figure 1). The upper head temperature is initially equivalent to the cold leg temperature for TCOLD plants. When the spray 1:
J{ nozzle / guide tube flow reversal occurs, hotter water from the core is s
~ = , , . . .,,--,+....,,,,,-www., ,,,,,,or, ,m, 4, ,r,,,,, , .w.,--.-.e-,,, ..m,r,_,,.,,,,,.%-y.-_., _,m,,,- ,_,,_r.,,_,,_,...--__,_,_..
introduced into the upper head 4rea and causes the upper head temperature I rise. After'this early increase, the upper head temperature steadily decreases. . CONCLUSIONS FOR TOLD_ PLANTS The average cooldown race of the upper head fluid due to a 50*F/hr natural circulation cooldown rate is about 34*F/hr for a TCOLD Plant. The total upper head cooldown rate due to both natural circulation cooldown and CRDM f ans varies from a maximum of 52.5'F/hr to around 44*F/hr when the upper head temperature is cooled to 350*F. Thus, with the CRDM fans operating during the cooldown, a TCOLD lP ant could be cooled and depressurized at a natural circulation cooldown rate of 50*F/hr to the point where the RHR System could be employed for further cooldown, with no void formation occurring in the upper head area. The operator should maintain a minimum of 50*F subcooling during the depressurization (stated in the procedure). Adding the cooldown rate due to the CRDM fans to that from the natural circulation cooldown is conservative since the additional cooling due to the fans will enhance the density difference between the downcomer and. ; I upper head, which in turn increases the guide tube / spray nozzle flow rate. With the CRDM fans not available, aT COLD P l ant can be cooled down and depressurized to RHR System conditions at a natural circulation cooldown ; rate of 50*F/hr with no void formation in the upper head area if the operator maintains a minimum of 100*F subcooling during the depressuriza-
. tion (see Figure 2).
( l
4 I i l SUBCOOLING MARGIN Tcoto- 50 F/hr i COOLDOWN WITHOUT CRDM FANS l i FIGURE OP 2 (TC Rev 0 3/84) , 2400
~
l 2000 - 100 F Subcooling w i 6 . ! u) } 9:. 1600- - ! E - - t 3 1200- - Upper Head Psat l $ W - - tc
' 800- -
[ 400 Saturation Curve . RHRS l . . . , , , , , ! I I I I i i i i i l 200 300 400 500 600 700 HOT LGG TEMPERATURE ( F) i
MAJOR ACTION CATEGORIES IN ES-0.2 j '. e Try to Start an RCP e Cool Down and Depressurize RCS With No Upper Head Void Growth e Lock Out SI System e Place RHR System in Service o Cool Down to Cold Shutdown 9 e ( 4
- , KEY UTILITY DECISION POINTS ;
k There are four. decision points in this procedure when a choice must be made between two or more courses of action. The first decision occurs in the first step as the operator attempts to start an RCP. _ If he is ! I successful,' a decision as to which appropriate plant procedure should I be entered is required. A similar situation exists at the end of the l procedure. Here cold shutdown hos been accomplished and the utility must decide on an appropriate normal or abnormal plant procedure. The other two dacision points involve continuing a fast-paced cooldown and allowing a void to form in the 4pper head. In the note following step 11 the possibility for transition to either ES-0.3, NATURAL CIRCULATION COOLDOWN WITH STEAM VOID IN VESSEL (WITH RVLIS), or i ES-0.4, NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN VESSEL ^ (WITHOUT RVLIS), exists. This same opportunity to transfer to either of these procedures appears in Step 14. The preferred method for cooldown under natural circulation conditions is provided in this procedure, ES-0.2, where no upper head void is created. Any decision to continue an expedited cooldown (e.g. , due to condensate storage limitations) should be carefully considered before a transition to either ES-0.3 or ES-0.4 is made. 1
. f- RECOVERY PROCEDURE
SUMMARY
} ES-0.2: Initial plant setup for a natural circulation cooldown followed by RCS cooldown and depressurization undar require-monts that avoid any upper head void formation.
ES-0.3: RCS cooldown and depressurization under requirements that 4 allow the potential for upper head void formation, with RVLIS to monitor void growth (initial plant setup for natural cir-culation cooldown provided by ES-0.2). ES-0.4: RCS cooldown and depressurization under requirements that allow the potential for upper head void formation, without RVLIS to monitor void growth (initial plant setup for a
, natural circulation cooldown provided by ES-0.2).
k . e { l
---,--v- n- a w a ,s,n~ ,----,-----------e --------e vm-----, r,,,--wwc s---ww,,ww,.-rwm--w.-er---,.-e--vw~ v,- ee-,----- -r-wno,ww. . , - , -
. . . ~
l - ES-0.3 I NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN VESSEL
.(
INTRODUCTION,, Upon entry to ES-0.3, NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN VESSEL (WITH RVLIS), natural circulation of the RCS has been verified and a cooldown/depressurization has been initiated (see procedure. ES-0.2, NATURAL CIRCULATION C00LDOWN). The purpose of this procedure is to continue plant cooldown and depressurization to cold shutdown under conditions that allow for the potential formatica of a void in the upper head region. There should be no_ accident in progress and a reactor vessel level ~ system (RVLIS) is available to monitor the size I of any vessel void. This procedure is entered from ES-0.2, NATURAL CIRCULATION C00LDOWN, when it has been determined that a cooldown/depressurization must be performed at' a rate that may form ( steam void in the vessel. In 'any . case, the first eleven steps of ES-0.2 must be completed prior to entering this procedure. I l There are two transitions out of this procedure. The first occurs if l I SI is actuated. In this ins tance a transition to E-0 , REACTOR TRIP - OR SAFETY INJECTION, should be made. The second transition occurs if l forced convection heat transfer can be es tablished. The first step of 1 the procedure attempts to start an RCP. If this attempt is successful l I a transition to appropriate plant procedures is performed.
.(.
e e r-m w -
+ -,m- -- w-.-ar,- w v- ~ - , - we en, .
{: . E2SCRIPTION
-{' The objective of ES-0.3, NATURAL CIRCULATION COOLDOWN WITH STEAM VOID
- IN VESSEL (WITH RVLIS), is to permit a natural circulation cooldown and depressurisation of the RCS while allowing, controlling, and moni-
' toring the formation of voids in the vessel.
During the St. Lucie Uc.it 1 plant cooldown under natural circulation conditions (June 11, 1980), it was evident that void formation l occurred in the upper head region. Using the information obtained - from this event and the subsequent analyses performed for Westinghouse p lants , the procedurra ES-0.3 was developed to enable the operator to perform a natural circulation cooldown/depressurization that permitted upper head void growth, which would be monitored with KVLIS. , I If it is necessary to cool down and depressurize the RCS quickly under natural circulation conditions (e.g. , due to limited condensate s torage), procedure ES-0.3 is the appropriate alternative to ES-0.2 if there is a RVLIS available to monitor void growth. If a rapid RCS cooldown/depressurization is desired in the absence of RVLIS instru-mentation, ES-0.4, NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN 4 VESSEL (WITHOUT RVLIS) is to be used. , Though there is no analysis to support the technique employed in 6 ES-0.3, specific symp toms are relied upon to indicate that void growth' is restricted to the upper head / upper plenum region, above the top of the hot legs, so as not to disrupt the natural circulation flow. By maintaining RCS subcooling, controlling pressurizer level, and moni- 'I toring RVLIS indications, a maximum cooldown rate of 100'F/HR and a l l
.- continued RCS depressurization are permitted under natural circulation condit, ions. If, during the course of the cooldown/depressurization, the EdLIS indicates that void grosth is approaching the hot legs , RCS depressurization is stopped and 'the operator is instructed to repic qq' rise. . ..q, the RCS' to collapse - -
dift void. At no tim is it appropriate to make a transition to FR-I.3, RZSPONSE TO VOIDS IN REACTOR VESSEL, and perform a head venting operation. This is contrary to the intent of procedure ES-0.3 where a vessel void is allowed to exist under controlled conditions while the plant is cooled down and depressurized to cold shutdown. If procedure FR-I.3 was used to vent the vessel head at this time , the steam void would not be eliminated. As pressure decreases (from venting), more water will flash to steam in the head region, replacing the steam that was vented. The void size will remain essentially constant and the net , result will be a loss of system inventory. Therefore, procedure 4 FR-I.3 should not be used when cooling down and depressurizing the system with procedure ES-0.3. It 'should be noted that although procedure ES-0.3 is the approved guidance for natural circulation cooldown/depressurization with a vessel void, procedure ES-0.2 presents the preferred mode of operation (i.e., no void formation) and should be used whenever possible. , O
- g e ,e,-r,-,w-- ,,- n,.. - - , ~ . - ~ - , , , , , , ,,--v..e-~---- , - - ,---v,,,v,,,-,-_,w, y-.--,n---.--mmew -,,,w.-y--.,,m-.~,,, v,-_- e-,.,,--v . + - w ~--
- m. - -
3 MAJOR ACTION CATEGORIES IN ES-0.3 b - e 'Iry to Start an RCP e Cool Down and Depressuriza RCS While Monitoring Void Growth Before cooling down and depressurizing the RCS, a pressurizer level is i' established to accommodate void growth. During the cooldown/depres-surization phase, a cooldown rate of less than 100*F/HR is maintained, together with a minimum RCS subcooling. RCS temperature and pressure
- should also be maintained within Technical Specification cooldown ;
limits. To monitor void growth and maintain pressure control, RVLIS l and pressurizer 1svel instrumentation are checked for proper values. e Lock Out 5I System e Placa RHR
- System in Service o Cool Down to Cold Shutdown
, ,~-.-.--.-,.,.,--.,,_,,-.,.__-..v..,-_,.,__ -
,._.--..-.-,,_,...~.-_,,_,__.,...__,.~.....,m.._ . . . , , - , _ . . - - _ _ - ~
I KEY UTILITY DECISION POINT k l. In the RNO (Response Not
. The key decision point occurs in Step 4.
Obtained) column a choice must be made between two methods of reducing l PRZR level. The first method involves adjusting charging and letdown l to reduce system inventory. The second uses'the natural phenomenom of inventory shrink during cooldown to lower the PRZR level. Though the use of charging and letdown should be the preferred method, the opera-tors should determine which method is more appropriate considering the circumstances and/or plant equipment available. l o m y w----p- ,,%- 4.9 ..,y- , w--y-- p----g-e4-- . _wp-...,- -p-y c.r.9,,-- . - , , , , _ .ya-e. .y ,w ww-m..-m,,- =+%_g
l' ES-0.4 j NATURAL CIRCULATION COOLDOWN WITH STEAM VOID IN VESSEL (WITHOUT RVLIS) INTRODUCTION - Upon entry to ES-0.4, NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN VESSEL (WITHOUT RVLIS), natural circulation of the RCS has been verified and a cooldown/depressurization has been initiated (see pro-cedure ES-0.2, NATURAL CIRCULATION C00LDOWN). The purpose of this procedure is to continue plant cooldown and depressurization to cold shutdown under conditions that allow for the potential formation of a
- void in the upper head region.- There should be no accident in progress and no reactor vessel level system .available to monitor the size of any vessel void.
( This procedure is entered from ES-0.2, NATURAL CIRCULATION C00LDOWN, when it has been determined that a cooldown/depressurization. must be performed at a rate that may form a steam void in the vessel. In any case, the first eleven steps of ES-0.2 must be completed prior to entering this procedure. There are two transitions out of this procedure. The first occurs if SI is actuated. In this instance a transition to E-0, REACTOR TRIP OR SAFETY INJECTION, should be made. The second transition occurs if an RCP can be started. The first step of the procedure attempts to start an RCP. _ If this attempt is successful a transition to appropriate plant procedures is performed. -
-e-t - w y , - , , - , , ,,%. -,3 - - - , - . - , . , , , , . , .
..y -, ---..,,,-,m- ...,-.....,,-,,v , , , - . - < , , , . - , . . - - - - . . , , - , , - - , , , v .---v-----,--. . , -
, b DESCRIPTION The objective of ES-0.4~, NATURAL CIRCULATION COOLDOWN WITH STEAM VOID IN VESSEL.(WITHOUT RVLIS), is to permit a natural circulation cooldown and depressurization of the RCS while allowing and controlling the formation of voids in the vessel.
During the St. Lucie Unit 1 plant cooldown under natural circulation conditions (June 11, 1980), it was evident that void formation . occurred in the upper head region. Using the information obtained f rom this event and the subsequent analyses performed for Westinghouse plants, the procedure ES-0.4 was developed to enable the operator to l perform a natural circulation cooldown/depressurization with upper head . void growth. I t {. If it is necessary to cool down a,nd depressurize the RCS quickly under natural circulation conditions (e.g., due to limited condensate storage), procedure ES-0.4 is the appropriate alternative to ES-0.2 if there is no RVLIS available to monitor void growth. If a rapid RCS cooldown/depressurization is desired and RVLIS instrumentation is available, ES-0.3, NATURAL CIRCULATION C00LDOWN WITH STEAM VOID IN VESSEL (WITH RVLIS) is to be used.. Though there is no analysis to support the technique employed in ! ES-0.4, specific symptoms are relied upon to indicate that void growth r is restricted to the upper head / upper plenum region, above the top of i the hot legs, so as not to disrupt the natural circulation flow. The growth of the vessel void is inferred from PRZR level indications.
-( Initially a low PRZR level is established to accommodate void growth.
<- PRZR level changes from inventory shrinkage and void growth are accounted for separately with a step-by-step cooldown/depressurization technique.
This technique is based ,on the concept of meeting Technical Specification cooldown requirements and not creating a saturated primary, system (as l measured at the hot legs). The goal is to reach RHR operating conditions j i' . l in as f3w steps as possible but with no challenges to the LTOP or satura-tion curve requirements. At no time is it appropriate to make a transition to FR-I.3, RESPONSE TO VOIDS IN REACTOR VESSEL, and perform a head venting operation. This is contrary to .the intent of procedure ES-0.4 where a vessel void is allowed to exist under controlled conditions while the plant is cooled down and depressurized to' cold shutdown. If procedure FR-I.3 was used to vent the vessel head at this time , the steam void would i not be eliminated. As pressure decreases (from venting), more water I will flash to . steam in the head region, replacing the steam that was vented. The void size will remain essentially cons tant and the net result will be a loss of system inventory. Therefore, procedure FR-I.3 should not be used when cooling down and depressurizing the system with procedure ES-0.4 It should be noted that although procedure ES-0.4 is the approved guidance for natural circulation coo'idown/depressurization with a vessel void, procedure ES-0.2 presents the pref erred mode of operation . (i.e., no void formation) an'd should be used whenever possible. I J 9
. - , ., . ,--, - ... , ,__ __. ,~ -
. - - - . .~ . - . -
~
MAJOR ACTION CATEGORIES IN ES-0.4-f
-e Try, to Start an RCP e Cool Down and Depressurize RCS While Controlling Void Growth .
~
Before cooling down.and depressurizing the RCS, a pressurizer level is established to accommodate void growth. During the cooldown/depres-surization phase, a step-by-step cooldown and depressurization is per-formed in order not to violate the Technical Specification (LTOP) cooldown f curve' or the saturation curve limitations. To monitor void growth and maintain pressure control, pressurizer level is maintained below 90%. During' RCS _ depressurization the required RCP seal injection flow is main-tained, and charging and letdown' flows are balanced for strict control of primary inventory. e Lock Out' SI Systed e Place RHR System in Service i e . Cool Down to Cold Shutdown
-m_--,--._,.-.y,-.-,-c- - - ., , - , w+- -. -me. - , - - +w., , . , . -w-,, --,- ,,, , - - - - - ,,,r --
< E-3 STEAM GENERATOR TUBE-RUPTURE
[- INTRODUCTION Of all classic accidents, steam generator tube f ailures have occurred the most frequently. In fact, if previous trends continued, every
- Westinghouse PWR could expect to experience at least one steam generator tube failure during the lifetime of the plant. Of course, the nuclear
; industry has implemented many programs to reduce the incidents of tube
' f ailures, such as secondary side inspections, improved steam generator
, designs and water chemistry control, and more reliable eddy current tube inspection techniques. - Nevertheless, a steam generator tube failure pro-
. bably will remain one of the more likely accidents. A steam generator tube failure provides a direct release path for contaminated primary
[- coolant to the environment via the secondary side relief valves.
- Accumulation of water in the secondary side can also lead to an overfill condition which can severely aggravate the radiological consequences and increase the likelihood of complicating f ailures. Timely operator inter-vention is necessary to limit the radiological releases and prevent steam generator overfill. So, to provide the . operator with the best possible tools for dealing with these accidents, a series of Optimal Recovery
' Procedures (ORPs) were developed to address steam generator tube f ailures (E-3 series). . These procedures contain instructions for limiting primary-to-secondary leakage and minimizing radiological releases following tube failures in one or more steam generators.
l( O e 4
-,--..w--,-w,, -
,,..-.-__.-,.,..w - , - , - ,-----,y,..-, .y-- ,--,.--r,,-.,-----ww,,..,,ww....-,er.--,.,-
~ , , , - n-- -, ,,-,..--,-w-,
l 4 I
. l l
l
'- .Unlike other loss of coolant accidents (LOCA), a steam generator tube 1 l
f ailure demands substantial operator involvement early in the event. In order to expedite recovery, the ORP hierarchy directs the operator to the E-3 series procedures whenever symptoms of a tube failure exist, such as high secondary side activity or an uncontrollably increasing steam genera- 1 tor water level. In this respect, it is similar to the E-2, " FAULTED STEAM GENERATOR ISOLATION" procedure. However, unlike E-2, the optimal recovery scheme following tube failure strongly depends on coincident failures. Consequently, the E-3 series procedures must be general enough to address a wide variety of multiple failures, such as tube failures in combination with other LOCAs or secondary side breaks. Yet, the procedures must also be sufficiently specific to ensure prompt operator response. { i This ' apparent conflict was resolved by structuring the E-3 series into procedures which address two major categories of events: 1) those events f or which leakage from the RCS can be secpped prior to cold shutdown, and
- 2) those events'for which leakage from the RCS will continue. Events such as tube failures in one or more steam generators, or tube failures in com-bination with secondary faults in non-ruptured steam generators would' j belong to this first group. Instructions for responding to this event-type are provided in E-3, " STEAM GENERATOR TUBE RUPTURE", and ECA-3.3, "SGTR WITHOUT PRZR PRESSURE CONTROL". The second group is characterized I by multiple events such as tube failures in combination with other LOCAs ,
- l or a. secondary break in a steam generator with failed tubes. The con- l l
tingency guidelines ECA-3.1, "SGTR WITH LOSS OF REACTOR COOLANT-SUBCOOLED l RECOVERY DESIRED", provide guidance for stopping leakage of reactor
-(
coolant for this event group. The principle difference between the reco-4
--.--y 7--,.,a ,--e r . --- ,, _m,.,. -- ,--w-- , . , - - .---,.-..,-..v.-, -,-w._w.r.,m..,-.-.._..y---.... .-,,,c., ,.m- ,
1 very methods for. the two event categories involves termination of SI. For the E-3 recovery, the SI pumps are all stopped concurrently to minimize primary-to-secondary leakage and avoid steam generator overfill. Since for this. event type leakage from the RCS is also terminated, there is no concern of depleting RCS inventory. For the second event group, ECCS pumps are stopped sequentially (ECA-3.3 and ECA-3.2) when conditions indi-cate that the reduced ECCS flow will be sufficient to maintain adequate coolant inventory. The E-3 series procedures have been simplified further by incorporating
~
common recovery actions into .the E-3 procedure. In general, these actions are limited to identification and isolation, if possible, of the ruptured s team generators. Although other common actions exist it is not certain i that they would be completed prior to transitioning from the E-3 proce-
~
dure. Consequently, some redundancy does exist. With this structure, the E-3 procedure becomes the f'o cal point for the E-3 series. Similarly, entries to the E-3 contingency actions occur only af ter entry into the E-3 procedure. The symptoms which govern these transitions are based on the expected system response to a steam generator tube rupture and subsequent recovery actions. The E-3 procedure contains instructions to minimize releases and to ter-I minate primary-to-secondary leakage following tube failures in one or more s team generators. The following sections describe the plant response to a steam generator tube failure and the basis for subsequent recovery actions, and identifies any special knowledge requirements. The causes of tube failures will not be discussed since the mechanism of tube failure I ( once it has occurred does not influence recovery actions. I
DgSCRIPTION l i -( A steam generator tube ' rupture avant begins as a breach of the primary coolant barrier between the reactor coolant system and the seconduy side of the staan generator, i.e. . the steam generator tube. Although this relatively thin barrier is designed with substantial safety margin to preclude bursting even when subjected to full primary system' pressure, the ha'rsh secondary side environment any attack the steam generator tubes resulting in excessive tube wall thinning or cracking over time. Although improved secondary side chemistry has greatly recactd the frequency. of tube failures attributed to chemical corrosion, foreign objects in the 4 steam generator secondary have resulted in relatively rapid tube degrada-tion and eventually tube failure in the previous two events [ Prairie Island (1979) and Ginna (1982)}. ( Since the primary system pressure -(nominally 2235 psig) is initially much greater than the steam generator pressures (nominally 1000 psig) reactor coolant flows from the primary into the secondary side of the affected s team generator. In response to this loss of reactor coolant, pressurizer level decreases at a rate which is dependent upon the size and number of failed tubes. RCS pressure also decreases as the steam bubble in the . 'l pressuriser expands. For normal operation, charging flow will automati-cally increase and pressurizer heaters will energize in an effort to s ta-bilize pressure and level. However, if leakage exceeds the capacity of the Chemical and Volume Control System, reactor coolant inventory will continue to decrease and eventually lead to an automatic reactor trip signal on low pressurizer pressure or, possibly, overtemperature - AT. Prior to this, normal letdown flow would isolate, and pressurizer heaters l. would turn off on low pressurizer level.
\ _ _,_._ - e d On the secondary side, leakage of contaminated primary coolant will increase the activity of the secondary coolant resulting in high radiation indications-- from the air evacuation radiation monitor and steam line radiation monitors. Although these alarms may lag indications of a loss of reactor coolant, depending on the' transport time to the radiation moni-tors, they have sounded nearly simultaneously during past tube f ailure events and generally provide the earliest diagnosis of a steam generator tube rupture. As primary coolant accumulates in the affected steam generator, normal feedwater flow is automatically reduced to compensate f or high steam generator level. Consequ9ntly, a mismatch between steam flow from and feedwater flow Jo the affected steam generator may be o bserved. This potentially provides early confirmation of a tube failure event and also identifies the affected steam generators. However, such a
' mismatch may not be noticeable for smaller tube failures because of the f '
relatively large normal feedwater/ steam flow rates. The water level in the affected steam 39.nerators may not be significantly greater than that of the intact steam generators and may be somewhat erratic prior to reac-tor trip as the normal feedwater control system automatically compensates f or changes in steam flow rate and steam generator level due to primary-to-secondary leakage. The time between initial tube failure and reac 4 - trip also depends on the
' leak ra6e. In most cases sufficient tie. e. . --
available (greater than 3 minutes) for the operator to perform a limites ogsber of actions to
'either prevent- or prepare for reactor trip. Such actions are likely to include starting additional charging pumps, energizing pressurizer heaters if not done automatically, reducing the load on the turbine, and pcesibly
( manual reactor trip. These actions, with the exception of manual reactor
I trip, will tend to delay an automatic trip signal. In addition, these actions can have a significant effect on the system response following , reactor trip which may impact the longer term recovery. For example, as f turbine load reduction proceeds, the , mismatch between core power and tur-
' bine load causes the average coolant ' temperature (Tavg) to increase until the rod control and steam dump systems actuate to restore programmed Tavg.
Although the reference Tavg decreases with turbine load, a period of time may exist when Tavg is greater than nominal full power conditions. If reactor trip occurs during this time, the cooldown of the primary system, when the steam dump system actuates te establish no-load conditions, is enhanced. This may result in a significantly lower minimum RCS pressure following reactor trip which may satisfy the criteria for tripping the R cps . In addition, the combination of delayed reactor trip and reduced e' s team flow due to turbine load runback may result in a greater steam generator inventory when recovery" actions are .ciated. This would
. reduce the time available to steam generator overfill.
Following reactor trip, core power rapidly dc:reases to decay heat levels, steam flow to the turbine is terminated, and the steam dump system actuates to establish no-load coolant temperatures in the primary sys, tem. Shortly. thereaf ter, the normal feedwater control system throttles feed-water flow in response to reduced steam flow. The RCS pressure decreases more rapidly as sensible energy transfer to the secondary shrinks the reactor coolant and tube rupture flow continues to deplete primary inven-tory. This decrease in RCS pressure results in a low-low pressurizer pressure SI signal soon af ter reactor trip. Normal feedwater flow is automatically isolated on the SI signal which also actuates the Emergency
8 Feedwater. System to deliver flow to all steam generators. Eventually,
,( annual action is required to adjust EFW flow to maintain the steam genera- .\.
tor water level on the narrow range span. Secondary side pressure will increase rapidly after reactor trip as auto-antic isolation of the turbine momentarily stops steam flow from the steam generators. Normally, automatic steam dump to the condenser would actuate to dissipate energy transferred from the primary, thereby limiting the secondary pressure increase. Since the intact and ruptured steam genera-tors communicate via the main steam header, no significant difference in pressures will be evident at this time. Initially SI flow and EFW flow will absorb decay heat and decrease the reactor coolant temperature below no-load until EFW flow is manually throttled to maintained steam generator f level in the narrow range.- This will also terminate steam flow and may
- .cause the steam generator pressures to slowly decrease as the cold EFW
{ condenses steam. At low decay heat levels or for multiple tube failures
.the reactor coolant temperature may continue to decrease even after EFW flow is throttled due to SI flow.
-Pressurizer level decreases more rapidly following reactor trip as the reactor coolant shrinks during the post-trip cooldown and primary-to-secondary leakage continues to deplete coolant inventory. Although the j minimum pressurizer level is dependent upon a number of parameters, including initial pressurizer level, initial powe'r level, the size of the tube failure, operation of pressurizer heaters, and pre-trip operator actions, it is likely that level will be offscale low when SI is actuated.
With SI actuated, the primary system will tend toward a equilibrium con-( dition where break flow and coolant shrinkage are matched by SI flow. If l l
. l l
break flow and shrinkage are . initially greater than SI flow, pressurizer
; level and pressure will continue to decrease until quasi-equilibrium con-ditions are reached. . In some cases, such as multiple tube failures or reduced SI capacity, RCS pressure may momentarily decrease to saturation until SI flow and EW flu cool the primary system belcw the saturation t emperature of the steam generators. Conversely, if SI flow exceeds
~
. primary-to-secondary leakage and coolant shrinkage, the pressurizer leve1 and pressure will increase until equilibrium is achieved. The equilibrium RCS pressure depends on the size of the tube failures, capacity of the SI I
system, and cooldown -rate' of the primary. However, since leakage from the RCS is a function of both pressure and temperature, no true equilibrium pressure exists unless the reactor coolant temperature also remains constant. Consequently, RCS pressure may continue to slowly decrease
' until reactor coolant temperatures are stabilized.
The pressurizer may refill to a relatively high level prior to operator intervention if the tube failure is small. However, in the more likely case, pressurizer level will return 'on span but will equilibrate at a value significantly below nominal level. A point of confusion often noted occurs during simulation of a steam generator tube failure event wher,e pressurizer level continues to increase toward an overfill condition following actuation of the SI system. While admittedly such behavior could occur for saa'11 tube failures in high-pressure plants, in some cases this response has been attributed to modelling limitations of the pressurizer. The operator should be aware that although filling of the pressurizer is possible, it is not generally expected. It should also be clear that the reactor coolant temperature trend and operator actions such ( as throttling EFW flow, will effect the pressurizer level.
, . . . . - . . . . . . - - . - - - - _ . . . . - . - - . . ~ ,
. - . ~ - - -.
4- 1As previously mentioned, the steam generator level may drop out of the na'rrow range following reactor trip. EFW flow, which is s.uhomatically
.[
actuated on an SI signal or' low-low SG 1evel, will begin to refill the steen generators, distributing approximately equal flow to. all steam l generators. i i 1 Since primary-to-secondary leakage adds additional inventory which accumu-lates in the ruptured steam generators, level should return to the narrow range in those steam generators significantly earlier and will continue to increase more rapidly. This response provides confirmation of a steam generator tube rupture event and also identifies the affected steam - 4 generators. Although these symptoms will be evident very soon after reac-tor trip for larger tube failures, for smaller tube failures in one or more steam generators the steam generator level response may not be a noticeably different or may be masked by non-uniform EFW flows. In that. < case, high radiation indications may be necessary for positive identifi-cation of the ruptured steam generator. In such instances, the break flow
-would be less and, consequently, more time would be available for recovery prior-to filling the affected steam generators with water.
\
SGTR TRANSIENT: OFFSITE POWER UNAVAILABLE The principle systems / components affected by a coincident station blackout - + are the steam dump system, Reactor Coolant Pumps (RCPs), and RCS pressure control. The effect of each of these on the system response and recovery is discussed. The. steam dump system is designed to actuate following loss of load or reactor trip to limit the increase in secondary side pressure. Without { offsite power available, the steam dump valves, which bypass the turbine e
- es g----w- e.,,-<+i.ve.yw.-,w-M--e ^
e - pemy-----a,--- e3 - T-vr-e*--*-Ws--'-s-ew+--**ewN--Twis--==r--w- N-*wFeg---c-w c, _ sw..-.wwn9-1.-,e-+me-m--me--
'. to.the condenser, will remain closed. Hence, energy tr'ansferred from the
(} primary will rapidly increase steam generator pressures after reactor trip until the atmospheric relief valves lift to dissipate this energy. Since. the secondary side temperature increase is greater, sensible energy transfer from the primary side following reactor trip is reduced. , Consequently, RCS pressure decreases more slowly, so that SI actuation and most attendant automatic actions are delayed. RCPs trip on a loss of offsite power and a gradual transition to natural circulation flow' ensues. The cold leg temperature trends toward the steam generator temperature as_the fluid residence time in the tube region increases. Initially, the core temperature rise decreases as core power decays following reactor trip and subsequently increases as RC Loop flow transitions to stable natural circulation. Without RCPs running the. upper [' ( ' head region becomes inactive and .the fluid temperature in that region will significantly lag that in the active RCS regions. In addition, subsequent actions to isolate the affected steam generators and cool down the intact RCS loops may stagnate the loop. Consequently, the hot leg fluid in that. loop may remain significantly warmer than in the unaffected loops. I Similarly, SI flow into the stagnant loop cold leg may rapidly decrease the fluid temperature in adjacent regions significantly below the rest of the RCS, as observed during the tube failure event at R. E. Ginna. 1 l I (
l 8~
. RECOVERY / RESTORATION TECHNIQUE k The automatic protection systems are more than sufficient to maintain ade-quate core cooling even' for multiple tube failures. However, extensive l l
operator actions are required to stop primary-to-secondary leakage which,
. 1 if not terminated expeditiously, could lead to a steam generator overfill condition. The system response to a steam generator tube failure before and immediately af ter reactor trip has been described. From this descrip-tion, the symptoms which identify both the tube failure event and the affected steam generators should be evident, including high or increasing secondary side radiation, and steam generator level response. These symp-tons provide the' basis for diagnostics in the ERPs which are used to direct the operator to the E-3 procedure.
The objectives of the recovery restoration technique incorporated into procedure E-3 are to limit the re' lease of radioactive affluents f rom the ruptured steam generators, stop primary-to-secondary leakage to prevent steam generator overfill, and restore reactor coolant inventory to ensure adequate core cooling and plant control. Although many other techniques may achieve any one of these goals equally well, the guidance in E-3 pre-sents the best approach for balancing all of these objectives for a wide variety of events. Inherent safety features, such as unambiguous SI ter-mination and reinitiation criteria, guarantee effective recovery actions for credible multiple failure events and proper remedial actions for mis-diagnosis or error. I f- w- g-- - --- - ,- ,,y,- . . _ , , _ _g ,-y - ,,m .y,--- . , - - .-- . ,.,..--,.,,,w,,. -.-c,,,--._,,,-.w,, .-r-,,.-.-
. . - , , . , ec.,.-_w..- .yy
MAJOR ACTION CATEGORIES IN E-3
'{
e Identify and Isolate Ruptured SG(s) e Establi,sh RCS Subcooling Margin e Depressurize RCS to Restore Inventory e Terruinate SI to Stop Primary-to-Secondary Leakage o Prepare for Long Term Cooldown f P e d 9
-. -. . , . _ _ - . . . . _ , _ . - . . , _ _ _ . _ _ _ _ _ . . . , _ _ . . . _ _ . _ _ _ . _ _ _ _ _ . . - _ . . . _ _ . . , , . _ . _ _ _ . _ . . .. . _ . . _ , - , ~ . _ _ _
t > i~ e -Identify and Isolate Ruptured SG(s) Once a tube failura has been identified, recovery actions begin by iso-r lating steam flow from and stopping feedwater flow to the affected steam generators. In addition to minimizing radiological releases, this also-reduces the possibility of filling the affected steam generator with water by 1) - minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and
' intact steam generators as a necessary step toward terminating primary-to- ;
secondary leakage. With steam flow and feedwater flow terminated, the affected steam generator pressure will slowly increase thereaf ter as priinary-to-secondary leakage compresses the steam bubble in the steam generator.' Although this response is not demonstrated in the available
- -- analysis results, actual plant experience exhibits this behavior.
j Eventually a steam generator atmospheric steam dump valve would lif t unless actions to stop leakage into the affected steam generator are
- completed.
e Establish RCS Subcooling Margin After isolation of. the. ruptured steam generators, the RCS is cooled to i less than saturation at the ruptured steam generator pressure by dumping
- steam from only the intact steam generatges. This ensures adequate sub-cooling in t'he RCS af ter depressurization to the ruptured steam generator pressure in subsequent actions. With offsite power available, the normal steam dump system to' the condenser provides suf ficient capacity to perform this cooldown rapidly. RCS pressure will decrease during this cooldown as shrinkage of the reactor coolant expands the steam bubble in the pressurizer. For sultiple tube failures, RCS pressure may decrease to
O 1ess ' than the ruptured steam generator pressure as steam voids, which were ( generated in the RCS.during the initial depressurization, condense. l Reverse flow, i.e. secondary-to primary leakage, during this time would reduce the inventory in the ruptured steam generators and delay steam _ generator overfill.
- Depressurize RCS to Restore Inventory When the cooldown is completed, SI flow again increases RCS press'ure toward an equilibrium value where break flow matches SI flow.
Consequently, SI flow must be terminated to stop primary-to-secondary leakage. However, the operator must first ensure adequate coolant inven-tory. This includes both sufficient reactor coolant subcooling and i pressuriser inventory to maintain a reliable pressurizer level indication f a f ter SI flow is stopped. Since leakage from the primary side will con-tinue until RCS and ruptured' steam generator pressures equalize an
" excess" amount of inventory, which depends on RCS pressure, is required before stopping SI flow. To establish sufficient invsntory, RCS pressure I
is' decreased by condensing steam in the pressurizer using normal spray. This increases SI flow and reduces break flow which refills the pressurizer. For multiple tube failures, RCS pressure may decrease below the ruptured steam generator pressure before pressurizer level returns on span. In that case, reverse" flow through the failed tubes will supplement SI flow in refilling the pressurizer. Conversely, for smaller tube failures, pressurizer inventory may be sufficient for SI termination prior to depressurizing the RCS so that actions to restore inventory would not be necessary.
e Terminate SI to Stop Primary-to-Secondary Leakage 'I Previous actions were designed to establish adequate RCS subcooling, secondary side heat sink, and reactor coolant inventory to ensure SI flow is no longer required. When these actions have been completed, SI flow must be stopped to prevent repressurization of the RCS and to terminate O primary-to-secondary leakage. With SI flow stopped, residual break flow will reduce RCS pressure to equilibrium with the ruptured steam generator. RCS temperature, pressurizer level, and affected steam generator levels will stabilize. e Prepare for Long Term Cooldown to Cold Shutdown
- Following SI termination, the plant will stabilize near hot shutdown con-ditions and all immediate safety concerns will have been addressed. At f
this time a series of operator ac.tions must be performed to prepare the plant for cooldown to cold shutdown conditions. These actions include restoring normal CVCS operation, minimizing the spread of contamination throughout the secondary side, and starting an RCP if necessary to ensure uniform cooldown and boron concentration. The operator must also select the best post-SGTR cooldown method based on an evaluation of the plan,t status. Considerations for selecting either ES-3.1, POST-SGTR COOLDOWN USING BACKFILL", ES-3 2, " POST-SGTR C00LDOWN USING BLOWDOWN", or ES-3.3,
" POST-SGTR COOLDOWN USING STEAM DUMP" are discussed next.
1 1 l
E-3 STEAM GENERATOR TUBE RUPTURE
-[ ETHOD OF REC 0VERY -
0 SHOULD RCPs BE STOPPED 8 IDENTIFY RUPTURED SG(s) e ISOLATE RUPTURED SG S PRZR PORVs AND BLOCK VALVES PROPERLY POSITIONED 8 ANY SGs FAULTED e RESET SI AND ESTABLISH CTMT, AIR 8 ALL AC BUSSES POWERED FROM 0FFSITE 8 SECURE RHR PUMPS IF NOT EEDED . 4 CHECK RUPTURED SG(s) PRESSURE 8 C00LD0WN RCS AT MAXIMUM RATE e RUPTURED SG PRESSURE STABLE OR INCREASING ( 0 RCS SUBC00 LING ADEQUATE 0 DEPRESSURIZE RCS S SI TERMINATION CRITERIA MET 8 CHARGING / LETDOWN ESTABLISHED 0 SI FLOW REQUIRED 4 MINIMIZE RCS-TO-SECONDARY LEAKAGE - 0 SHUTDOWN UNNECESSARY PLANT EQUIPMENT (CONDENSATE, HEATER DRAIN) 9 GO TO APPROPRIATE POST-SGTR C00LDOWN METHOD l ( l
4 , I ES-3 1 POST-S6TR C00LDOW USING BACKFILL.
?
- PURPOSE OF PROCEDURE .
; e FOLLOWING.M S6TR
- C00LDOW PLMT TO COLD SHUTDOW CONDITIONS
- DEPRESSURIZE THE PLMT
! 8 DEPRESSRIZE RUPTURED SG BY BACKFILL FROM RUPTURED SG TO RCS l
! ENTRY INTO PROCEDURE i
! O PLANT STAFF SELECTS BACKFILL ETHOD , i
- E-3, STEP 38.
l,
! e BLOWDOW NOT AVAILABLE MD PLMT STAFF SELECTS BACKFILL ETHOD
- ES-3 2, STEP 9 1
1 l
]
i l I
~ , n ES-3 1 POST-SGTR C00LDOW USING BACKFILL ETHOD OF KC0VERY t K 6AIN PRZR PRESSURE CONTROL 4 ISOLATE ACCWULATORS IF NOT EEED 0 RCS SDM ADEQUATE e INTACT SG LEVELS IN R 0 C00LDOW RCS TO COLD SHUIDOW 4 DEPRESSURIZE RCS TO BACXFILL FROM RUPTURED S6-0 PLACE RHR SYSTEM IN SERVICE e STOP RCPs WEN EQUIRED 8 EVALUATE LONG TERM PLANT STATUS t
4 ES-3 2 POST-SGTR C00LDOW USING BLOWDOW l PURPOSE OF PROCEDURE i j 8 FOLLOWING M S6TR l - C00LDOW PLANT TO COLD SHUTDOW CONDITIONS
- EPRESSRIZE THE PLANT
! ~ l 8 DEPRESSRIZE RUPTURED SG BY IRAlNING WITH K080W I
- ENTRY INTO PROCEDURE l
j PLANT STAFF SELECTS BLOWDOWN ETHOD j - E-3, STEP 38 I
\
d n
\
~
i i l
A. A ^ ES-3 2 POST SGTR C00LDOWN USING ILOWDOWN 8 ETHOD OF REC 0VERY , O REGAIN PRZR PRESSURE CONTROL e ISOLATE ACCUMULATORS IF NOT EEDED e RCS SDM ADEQUATE . 8 INTACT SG LEVELS IN Mt t INITIATE RCS C00LDOWN 4 MINIMIZERCS-TO-SECONDARYLEAKkGE(RCSPRESSUREANDMAKEUPCONTROL) e ESTABLISH RUPTURED SG BLOWDOWN 8 DEPRESSURIZE RCS (MINIMlZE RCS-T0-SECONDARY LEAKAGE) 8 STOP RCPs WilEN REQUIRED 8 PLACE RHR SYSTEM IN SERVICE 8 CONTINUE RCS C00LDOWN TO COLD SHUIDOWN 8 EVALUATE LONG TERM PLANT STATUS i
f , ES-3 3 POSI-S6TR C00LDOW USING STEM Dur i PURPOSE OF PROCEDURE l 0 FOLLOWING M S6TR
~
C00LDOW PLANT TO COLD SHUIDOW CONDITIONS
~ ~
DEPRESSURIZE THE PLMT ! 8 DEPRESSURIZE RUPTURED SG BY DUWING STEM i ENTRY INTO PROCEDURE - i I 4 PLANT STAFF SELECTS STEM DUW ETHOD ! - E-3, STEP 38 j 8 BLOWDOWN NOT AVAILABLE AND PLANT STAFF SELECTS STEM Dur ETHOD
- ES-3 2, STEP 9
] 4 i t i b __
x .- ES-3 3 POST-SGTR C00LDOWN USING STEAM DOW
! ETHOD OF REC 0VERY 8 REGAIN PRZR PRESSURE CONTROL 8 ISOLATE ACCUMULATORS IF NOT EEDED 4 RCS SDM ADEQUATE i 8 INTACT SG LEVELS IN IR i
e INITIATE RCS C00LDOWN j 0 MINIMIZE RCS-T0-SECONDARY LEAKAGE (RCS PRESSURE AND MAKEUP CONTROL) l 0 DOW STEAM FROM RUPTURED SG ., 8 DEPRESSURIZE RCS (MINIMlZE RCS-TO-SECONDARY LEAKAGE) e STOP RCPs WHEN REQUIRED ! 8 PLACE RHR SYSTEM IN SERVICE
- 8 CONTINUE RCS C00LDOWN TO COLD SHUTDOWN i 8 EVALUATE LONG TERM PLANT STATUS J
l i , l
SPECIAL TOPICS 4 l
'( This - section of ERP training discusses - various topics concerning plant emergency responses that the operator is confronted tith in the ORGs, ECAs.
and FRPs. For thu most part, the trained operator is exp(eten to know the capabilities and limitations of plant aquipment and what alternatives exist should that equipment be inoperable or ineffective. He is also expected to understand the integrated plant limitations resulting for accident induced transients. j .In many cases, a dozen or more variables combine to create potentially dangerous situations for the plant and its equipment. The ERPs are designed to handle these situations in conjunction with the operator. The operator's role consists of observing, monitoring, controlling and deciding (when options are given to accomplish a task). This operator decision responsibility is predicated on the assumption that the operator has the knowledge to select the most appropriate option. In other cases, the deciding function of the operator is less important. An example of this is ' the CRITICAL SAFETY FUNCTIONS. When a CSF is challenged, the operator is instructed in detail on a pre-analyzed action to be taken. However, the operator must still be well informed and understand ghe bases for these mandatory actions and the consequences if promp t actions are not taken. Special Topics for further discussion include the followings e SI Termination and Reinitiation Criteria ( e RCP Trip Criteria
l e RCP Restart Requirements / Interlocks l
.( e RCS Pressure Reduction Methods - Limitations, Advantages / Disadvantages l l
- 1. Normal Spray l
- 2. PORVs
- 3. Auxiliary Spray 4
e RCS Pressure - Temperature Limitations e Pressurised Thermal Shock (PTS) e Hydrogen Venting from RCS e Loss of Emergency Coolant Recirculation f s 0 4
+
. -- ,- ~-,,,---r.- - ,,, ., ,,-_ ----, r ---my -w-,c--- ,-- , - v m. w_ -, m.---.w,e--w -, , ,
o k Background Information for SI TERMINATION AND REINITIATION CRITERIA ~ O e
INTRODUCTION k For the ao;st *part, .SI (ECCS) Termination and Actuation Criteria is specia fically stated in the applicable ERPs in at least one place. However, the operator should know that the criteria can vary depending on the plant s ta tus. I DISCUSSION SI termination conditions, if applicable for a particular ERP, are given l in the procedure text at the appropriate step. In cases when automatic SI actuation has occurred from the SSPS, and the RCS proves to be intact, a detailed SI TERMINATION procedure is provided. IN GENERAL, SI termination can only be done if RCS subcooling is restored l l and if pressuriser level and pressure control is restored. l SI reinitiation conditions, if applicable for a particular ERP, are given in at least two places in the procedure. One place includes the OPERATOR I ACTION
SUMMARY
which appears on the back side of certain applicable proce-dure pages. Therefore, it will always be visible to the operator at any f s tep in the procedure. , IN GENERAL, the operator must reinitiate SI if RCS Subcooling decreases to LESS THAN 30'T OR if Pressuriser Level CANNOT BE MAINTAINED IN RANCE. An example OPERAT R ACTION
SUMMARY
is provided for reference on the
-following page.
( e
~ . - . _ _ .
OPERATOR ACTION
SUMMARY
FOR E-0 S'ERIES PROCEDURES (' i
- 1. RCP TRIP CRITERIA I Trip all RCPs if any conditions listed below occur:
o CCPs or SI pumps - AT LEAST ONE RUNNING
- AND -
4 RCS Subcooling - LESS THAN 30*F e Phalse B containment isolation (loss of PCCW) e RCP seal AP - LESS THAN 220 PSID e RCP #1 seal leakoff flows - LESS THAN 0.2 GPM
- 2. SI ACTUATION CRITERIA Actuate SI and go to E-0, REACTOR TRIP OR SAFETY INJECTION, Step 1, if EITHER condition listed belov occurs
) e RCS Subcooling - LESS THAN 30*F
- OR -
e Pressuriser level - CANNOT BE MAINTAINED GREATER THAN 5% [30% FOR ADVERSE CONTAINMENT] E
- 3. EFW SUPPLY Coma.suce CST makeup as soon as possible to avoid low inventory ,
problems.
- 4. RED PATH
SUMMARY
- ATTACHMENT B
- 5. KEY CAUTIONS e If SI actuation occurs during this procedure, E-0, REACTOR TRIP OR SAFETY INJECTION, should be performed, o Do not acoldown plant by overfeeding SGs.
- e. On nt tural circulation, RTD bypass temperatures and associated interlocks will be inaccurate.
4
, - , , . , , , _ , - , , . - , - . - -,,m__.--_ , .._. . . . - , , _ _ - - , _ , . . - , - ~ , . . - , _ . ~ _ , , _ . . - - , _ , - . _ , - _ , , , , . - . , _ -
I . Background Information for REACTOR COOLANT PUMP TRIP CRITERIA
/
e
, INTRODUCTION l' An issue that arose subsequent to the Three Mile Island incident concerned the effect of prolonged operation of the reactor coolant pumps (RCPs) during a small break loss of coolant accident (LOCA). . Extensive analyses have been performed for Westinghouse designed PWRs to evaluate the effect of delayed RCP trip during small break LOCAs. These analyses were per-formed utilising the Westinghouse Small Break Evaluation Model. In the s tudy, a range of break sizes and locations assuming various RCP trip
' times was considered.
4 Evaluation of the cases indicate two distinct characteristic behavior modes depending on RCP trip time. This trend is made evident by Figure 1 which presents integrated break discharge mass versus time. The change of
-/' slope of each curve of Figure 1 represents a shif t in break flow steam f quality from nearly zero to one, as the reactor coolant system (RCS) drains to the break elevation. Case A is the FS AR 3 inch break cal'cula-tion for a 3-loop plant design, which assumes RCP trip at the time of reactor trip. Cases B and C represent analyses in which RCP trip still occurs prior to the time of RCS drain to the break elevation in the FSAR calculation. -Figure 1 illustrates that the differences in the integrated break discharge characteristics are insignificant for these cases.
Therefore, the liquid mass inventory remaining in the RCS is also com-4 parable, yielding PCTs similar to FSAR Case results, well below the regu-latory limit of 2200*F. Cases D through G represent transients in which the RCPs remain opera-tional beyond the time of RCS dra'in to the break elevation for Case A and I demonstrate significant diff erences in the integrated break discharge O
-_,.-.-,--,-.-.___c_..,,_,. r_, , ...- , ,,,,. ,____ _ _.,-n
+ ,
- 1.8 i
~ c 1.6 - S E e 1.4 - i $ l l 3 i 9 u 1.2 - N m 1.0 - TOTAL MASS LOSS S J RCP TRIP AT SCRAM TIME - 22 SEC - Case A G RCP TRIP AT 74 SECONDS- Case 8
- VS. TlME e r O RCP TRIP AT 500 SECONOS - Case C
.a -
l (3 loop design ! E RCP TRIP AT 575 SECONDS - Case D ! 3 inch diameter, A RCP TRIP AT 650 SECONDS - Case E 1 A RCP TRIP AT 700 SECONOS - Case F ,! Cold ieo break) o.e - y oc , ,,,, ,, ,,,seco ,os . c ,,,o FIGURE OP (TC Rev 0 3/84) Y NO RCP TRIP DURING TRANSIENT- Cast H l 0.4 I I I I I j 4 6 8 10 12 14 TIMES (hundreds of Seconds) I l i _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
,- ~ transient.
Forced loop flowrates induced by RCP operation asintain the (_ inner vessel mixture level above the hot les nossie elevation. This allows for continued circulation of liquid around the loops, providing a source of liquid to the break region. Therefore, as the RCS drains, con-tinued RCP operation prolongs the period of liquid break discharge. The
-difference in time of the slope change for the delayed RCP trip cases is additional time of' liquid break' discharge, The prolonging of the liquid break discharge further depletes the liquid mass inventory remaining in the RCS. Immediately following RCP trip for these cases, loop flowrate decreases and phase separation occurs. A rapid reduction in RCS aixture level results, which may partially uncover the fuel. Prolonged RCP opera- l tion and 'the resultant additional liquid mass depletion can greatly affect the core uncovery characteristics. Depending on plant type and break
( sise, an interval of RCP trip times may yield PCTs greater than the FSAR case result. The effect of RCP tr'ip time on calculated PCTs is ; illustrated in Figure 2.
, , :sf RCPs 'rermin operational throughout the transient (Case H of Figure 1) depletion of primary liquid mass LA Maximized.. Nevertheless, PCTs remain well bhlow FSAR Case results due to enhanced core cooling caused by the high core steam flowrates indicative of RCP operation. However, operation of the RCPs continuously post-LOCA cannot be guaranteed and failure of the l
RCPs may be postulated to occur at any time. The purpose of tripping the RCFs during accident conditions is to prevent unnecessary depletion of RCS water inventory through a small break in the RCS which could lead to severe core uncovery if the RCPs were tripped for some reason later in the accident. The RCPs should be tripped before the RCS inventory is depleted ( l
- 's v.:: - .
1
- EFFECT OF PUMP TIME ON PEAK CLADDING TEMPERATURE FOR A THREE LOOP PLANT
! FIGURE OP(TC Rev 0 3/84) i
- 2200 -
10CFR50.46 LIMIT - SL o -
}.
in 2000 - l x . t
\
U \ l I j h1800 3" CL I r in u -
-- : f n.
N' l l 1600 - 4" CL - 3 . l-
\
\
l 1400 - s / ! o 1200 - l S 2" CL_ / Y . ! @ 1000 -
- n. -
N s I I I I I I I ! 800 j 101 2 5 102 2 5 103 2 l j TIME OF RCP TRIP, SEC -+ . 1 } 5.
.. _. - -_ . - - . . -- - - ._ -- . - --__ _~ .
to the point where tripping of the pumps causes the break to immediately uncover by allowing the RCS liquid inventory to settle in the low places k of the RCS below the break elevation. It is possible to utilize a conservative criterion to assure that the RCPs are tripped early in a small break LOCA transient. However, the use of this conservative criterion would also result in RCP trip for a steam generator tube rupture (SGTR) and other non-LOCAs for which it is desirable to keep the pumps running. It is desirable to keep the RCPs running during these transients to maintain normal pressure control using pressurizer spray and avoid opening of the pressurizer PORVs for this pur-pose, to prevent the formation of a stagnant water volume in the upper head region w'hich may flash and form a steam bubble during subsequent cooldown and depressurization, to minimize pottatial. pressurized thermal shock challenges, and to minimize operator actions such as tripping the RCPs and then restarting them later. Thus, it would be beneficial to ! develop a RCP trip criterion which would ensure pu2p trip for the range of small break LOCAs where pump trip is. required, but would not lead to pump trip for most SGTRs and non-LOCAs. However, it would not be a saf aty 1 problem if RCP trip should occur for a SGTR or non-LOCA event, since the plant safety . systems design and FSAR analysis for these accidents -are based on concurrent loss of offsite power, and therefore on RCP trip. t I [~ In NRC Generic Letters, the NRC addressed the question of developing RCP trip setpoints which would not require RCP trip for those transients and accidents where forced circulation and pressurizer pressure control is a , major aid to the operator, yet would alert the operators to trip the RCPs c for those small LOCAs where continued operation or delayed trip might _{ l-l'
- f. result in core damage. The NRC concluded that the need for RCP trip following a transient or accident should be determined by each plant, cos-
.{
sidering the Owners Group input, and provided guidance for the development of satisfactory RCP trip setpoints. This guidance indicated that the set-points should be designed to assure that the RCPs will be tripped for all LOCAs in which RCP trip. is considered necessary, but should also ensure continued forced RCS flow during SGTRs up to and including the desig ' basis tube rupture. The associated evaluation should be capable of demonstrating and justifying that the proposed RCP trip setpoints are ade-quate for small LOCAs, but will not result in RCP trip for other non-LOCA transients and accidents (e.g. , SGTRs). Thus, it is necessary to establish an RCP trip criterion which can be used to provida an indication for the operator to trip the RCPs following an [ accident. The criterion aust be capable of providing an indication of the need for RCP trip for small break LOCAs, but the criterion should not indicate the need for RCP trip for most SGTR and non-LOCA events i
..A O
f ..
-d ALTERNATE RCP TRIP CRITERIA e
For a small break LOCA, the RCP trip criterion aust provide for pump trip before the RCS coolant inventory decreases to the point where the break would be uncovered when the pumps are tripped. Thus, parameters which are indicative of the RCS coolant inventory should be suitable for use as potential RCP trip criteria. The evaluation of alternate RCP trip cri-teria was limited to the potential criteria which can generally be imple-mented using existing qualified instrumentation. The alternate RCP trip criteria which were evaluated include RCS pressure, reactor coolant sub-cooling, and secondary pressure dependent RCS pressure. In establishing the RCP trip setpoint for any of the potential criteria, the uncertainty in the instruteentation readings must be considered. One of the factors which can affect tha instrument uncertainty is environmen-tal conditions. 'Ihe environmental conditions inside the containment following an accident can vary from normal conditions to the worst case
. post-accident conditions depending upon the type and severity of the acci-dont. For the purpose of evaluating instrumentation uncertainties, adverse containment conditions have been defined as a pressure of approxi-mately 5 psig or a radiation level of approximately 10 4 R/hr. Based upon instrumentation qualification studies, it has been determined that the normal instrument uncertainties can be used for containment conditions below these limits, but that the uncertainties associated with post-accident containment conditions should be used for pressures or radiation levels above these limits.
(; b.
I l 4 Although a major LOCA or secondary break inside containment m: y result 'in l adverse containment conditions, there are cany other nou-LOCAs which are not expected to result in adverse containment conditions. In addition, a SGTR is not expected to result in adverse containment conditions. If l adverse containment conditions exist, then the instrument uncertainties associated with post-accident containment conditions can be utilized in establishing the RCP trip setpoint, whereas normal instrument uncertain-ties can be used if adverse containment conditions do not exist. This requires the maintenance of two RCP trip setpoints, with the appropriate. i- one being selected based on an indication of containment conditions.
~
S'ince most SGTR and non-LOCA events are not expected to result in adverse containment conditions, the lower setpoint based on normal instrument uncertainties will reduce the likelihood of tripping the RCPs for these events. The thraa potential RCP trip criteria which have been considered are discussed below. e RCS PRESSURE CRITERION The purpose of tripping the RCPs during accident conditions is to prevent , unnecessary depletion of RCS water inventory through a small break in the RCS which could lead to severe core uncovery if the RCPs were tripped f or sous reason later in the accident. RCP operation does not lead to pro-longed RCS liquid inventory loss to the break until the time is' reached where tripping the RCP causes the break to immediately uncovery by allowing the RCS liquid inventory to settle in the low places of the RCS below the break elevation. The break cannot be uncovered until the steam {
, - - - , , , _ , _ _ . . . ..._.--,m.,.~.. .. -- ,,~.m,nr_...,,,,-y_,,.w_. , ,_s_,-. , ~ , . , - - . , . , , , - - . . ,y,,% .. _ , , ,, ,_., ,,
l
# generator tubec have begun to drain. Also, the steam generator tubes can- I l
( not'begin draining until saturation pressure is reached at the top of the steam generator tubes. Only then is steam able to reside in the top of the steam generator tubes to volumetrically compensate for the falling liquid level'. , Thus, the objective is to trip th'e RCPs at the time that saturation pressure is reached at the top of the steam generator tubes. The deter-aination of this saturation pressure depends on the conditions in the pri-mary system, the conditions in the steam generator secondary side, and the location and accuracy of the instrumentation used to make the deter-aination. A bounding decay heat level at 2 minutes af ter reactor trip will be 'used
' as one boundary condition to determine the primary system conditions. The
{ value of decay heat at the time is about 3.5 percent. The RCP heat input to the primary system should also be included. With the RCPs operating, the primary system is able to transfer the 3.5 percent decay heat and RCP heat with a very small AT. However, the actual te'aperatures of the RCS will depend on the conditions in the steam generator secondary side. The pressure in the-steam generator secondary side will depend on the availability of the condenser for steam dump operation and the operability of the secondary ASDVs. The highest operating pressure of the steam generator secondary side will occur if the condenser is not available and the secondary ASDVs are not operable (e.g. , loss of air supply) and the steam generator secondary side pressure is established by the safety valves._ This is the steam generator secondary side condition that is cho-
+g+ -
,,w .- - - --,r -,---%-- y e.2-.- -- - - - - - - - - , - - , , , - - - - , - - - - , ~ . , . - - - , - -,, .,v, w,- .v,w.2-# w-
, sen because with a concurrent small LOCA it will protect for the highest
( - possible saturation pressure. Therefore,. the secondary pressure is
- related to the steam generator safety valve set pressure.
g The RCS indicated pressure that will be compared to the secondary pressure must be considered. The RCS wide range pressure which would be used for this purpose is normally measured in the hot leg (e.g. , the RHR suction line). There is a pressure drop between the RCS pressure measurement location and the top of the steam generator tubes (where the occurrence of saturation is key), there is a pressure gradient across ,the steam genera-tor tubes required for heat transfer, and there is a pressure drop from the steam generator to the secondary safety valves. Thus, the RCS pres-sure for RCP trip should be the secondary pressure established by the steam generator safety valves plus the calculated pressure differential from the secondary safety valves to the RCS pressure measurement loca tion. The appropriate instrument uncertainties should be added to the RCS pressure value established by the above procedure. For normal containment conditions, the normal instrument uncertainties should be used, whereas with adverse containment conditions, the instrument uncertainties asso-ciated with post-accident containment conditions should be used. The' resulting pressure is the indicated RCS pressure at which the operator should trip the reactor coolant -pumps, depending upon the containment con-l ditions. e RCS SUBC00 LING CRITERION i As discussed previously, RCP operation following a small break LOCA does ( not lead to prolonged RCS liquid inventory loss to the break until the
~
time is_ reached where tripping the RCPs causes the break to immediately 9
. ~-.,,in---m.,..-.,-e,,.~,,wm-,~,w,w,.w.e,w.-,awey,-y,3-w.e.,,,% ,-..---w, ., ,,.-n --e.,,- ---,-...--,-c.-.-- - - . . . , - . ~ , , , - . , - , , ,
4 'I~ uncover. The break cannot be uncovered until a significant amount of i-b voiding' has occurred in the RCS. Since it is expected that voiding will
- occur first at the reactor outlet, it would not be required to trip the RCPs as long as subcooling is maintained in the RCS hot legs. The ,sub-cooling indication based on either the hot leg RTDs or the core exit ther-nocouples can be used for this purpose. To assure that pump trip indica-tion is available before subcooling is actually lost, the instrument uncertainty for the plant subcooling monitor must also be considered.
< Thus, the RCP trip setpoint using a subcooling monitor would be zero i degrees subcooling plus the instrument uncertainty. 1 The normal instrument uncertainties should be used to determine the RCP trip setpoint for normal containment conditions, and the instrument uncer-g, _ tainties based on post-accident containment conditions should be used to
- determine the setpoint for adverse containment conditions.
o SECONDARY PRESSURE DEPENDENT RCS PRESSURE CRITERION In previous sections, an RCS pressure criterion was described to provide for tripping'the RCPs at the time when saturation pressure is reached at the top of the steam generator tubes. The method of -determining the RCS pressure setpoint is based on the conservative assumption that the secon-dary pressure is at the steam generator safety valve set pressure. I However, the secondary pressure may actually be less than this value, I depending upon the' availability of the steam dump system and the-secondary
- ASDVs. -With this method, the RCS pressure setpoint will be determined
- based on the actual steam gener- or pressure.
'(
-- we < , , , , - . ~ - . - ,n..,--,n- , - - , ,,cn,---,,,_, .,.,,,,,-,,-e,v.,.,,,.,-.,,-,-c_,,,~,,-.v-.
,---.wn., ,n--- , , - , , n . . , -,
G o
., - EVALUATION OF ALTERhATE RCP TRIP CRITERIA
(. The results of the small break LOCA analysis demonstrate that the three i alternate RCP trip criteria (RCS pressure, ,RCS subcooling and i RCS/ secondary AP) are essentially equivalent in providing an indication for the operator to trip the pumps during a small break LOCA transient. 1 The results also show that each of the criteria vill provide the indica-tion for RCP trip sufficiently early euch that more than 2 minutes are available af ter the RCP trip setpoint is reached for operator action before the time when trip is required. This was demonstrated for each of the RCP trip criteria without considering the effect of instrument uncer-tainty in determining the RCP trip setpoints. Thus, each of the alternate I RCP trip criteria will satisfactorily indicate the need for RCP trip for a small break LOCA for either normal or adverse containment conditions. t Because each of the alternate RCP trip criteria are adequate to quickly 4
- provide an indication of the need for trip during a small break LOCA, the choice of which criterion to implement at a given plant may therefore be
- based upon the discrimination capability for SGTRs and non-LOCAs and other plant specific instrumentation considerations.
SELECTION OF RCP TRIP CRITERION Since it was determined that the three alternate RCP trip criteria are essentially equal in eff ectiveness in providing indication of the need for
- pump trip for a small break LOCA, the criteria selection can be based on
. the capabi,lity to prevent a pump trip for SGTRs and non-LOCAs.
.- e- w-. -*...,,....w- w,. v--, y ,,,,-% ,, - - - , - - . - ,w--- - , -w,, - , .--- ---+--,,~-,,,,m.---. - , , ,,,,v.-,e--e---,.rew- - -,-n, , y, --g y--v--
.. l s- EVALUATION OF RCP TRIP CRITERIA DISCRIMINATION CAPABILITY I FOR SEABROOK .
1 I RCP TRIP CRITERIA l RCS/ l RCS RCS Secondary Pressure Subcooling AP Minimum parameter values for 1753 psia 58*F 685 psi SGTR and non-LOCA transients RCP trip setpoint with normal 1390 psia 30*F --
. containment conditions Does criterion meet discrimi- Yes Yes Yes I nation requirement in NRC letters Companion RCP trip setpotat 1390 psia 30*F --
with adverse containment conditions At Seabrook, we can use either RCS Pressure or RCS Subcooling. RCS/Secon-dary AP could be used but AP is not provided as a hard wired instrument. At this time, the ERPs will use RCS Subcooling as the RCP Trip Criterion unless otherwise stated. A
j'
. It is very important to point out that SUBC00 LING provides the BASIS for I, _ TCP trip, 'BUT THIS IS NOT THE WHOLE STORY.
The operator MUST NOT trip the RCPs on loss of SUBC00 LING ALONE. Before actually tripping the RCPs, the operator MUST also ensure that AT LEAST ONE' CCP . OR SI PUMP IS ALSO RUNNING. Remember that the RCPs provide excellent core cooling even if subcooling is zero. In addition, other factors enter into this criteria such as loss of PCCW
- cooling to RCP motors, insufficient seal aP or low seal leakoff flow.
The RCP TRIP CRITERIA appears in just the E-0 series procedures. The RCP TRIP CRITERIA for Seabrook is shown on the following page. t e D 9 e r e
+
v -y _. , - - w.,w -
-,y-,,
1 i i i ! RCP TRIP CRITERIA i il l Trip all RCP's if any of the conditions listed below occur { e CCP's or Si pumps- AT LEAST ONE RUNNING I and 1 i e RCS subcooling- LESS T'H AN 30 F l ! O Phase B Isolation ' i j e RCP Seal AP- LESS THAN 220 PSID e RCP 41 Sealleakoff flow- LESS THAN 0.2 GPM i i i i l
o ( l i Background Information t for REACTOR COOLANT PUMP RESTART t l l i l
i l ., INTRODUCTION l ( Many instances occur in the ERPs when the RCPs are. shut down due to the specified trip criterion (e.g.; usually SUBC00 LING) or loss of supporting l conditions such as 13.8 KV. power and loss of PCCW to motors. 1 Frequently, it may be useful or ~ desired to restart at least one RCP for cooling, plant cooldown, pressurizer spray capability and to mitigate serious . situations such as inadequate core cooling or thermal stress in the reactor vessel.- RCP RESTART CRITERIA RCP restart criteria can be classified in two ways, (e.g.; interlocks and support functions). RCP interlocks are those conditions that HAVE to be
/" fulfilled to permit breaker closure. These consist of; e Electrical lockouts reset '
e RCP Seal aP > 220 PSID
~
e Oil Lif t Pressure > 600 PSIG
~
Other support functions necessary for continuous pump operation are designated support functions and consist of the following; e PCCW pump operating in loop associated with RCP I e PCCW containment isolation val.es open '
- 1) To RCP actor
- 2) To RCP thermal barriers l
e Seal injection flow > 6 GPM i Keep in mind that the RCPs can be started without cooling to the motors or the thermal barriers. Typically the motors can only run about ten (10)
minutes without cooling af ter which the bearings will overheat and cause a 3 -locked rotor condition or at least an overcurrent trip. l 4 + l Also keep in mind that some form of seal cooling is necessary, either seal injection or- thermal barrier cooling or both. Operation without either
. . . 1 will result in seal failure and up to 300 GPM leakage (LOCA) into the con- l l
tainment. In general, it is best to have BOTH seal cooling mechanisms to 1 start .an RCP and at least ONE to continue RCP operation. l The operatcr should KNOW that RCP-1A and RCP-1D are cooled by PCCW Loop A l and RCP-1B and RCP-lC are cooled by PCCW Loop B. The operator should also ! know that Bus l supplies RCP-1A and IB and Bus 2 supplies RCP-lC and '1D. Note that an RCP that drives pressurizar spray is on each 13.8 KV bus. It is also worth notin5 that RCP operation with a saturated or highly voided RCS will result in high vibration (shaf t and motor frame) and that normal motor current will be less than normal. l c : l 1 1 ? 1 T r e-- ----+-=-*-----r7---~--eevw= --e+ v ----w, =ww- *m--- -e --= ~ -w- *m=---- -----++-*--~+w*-=-w
O (_ Background Information for RCS PRESSURE REDUCTION MEASURES l' t
, 3 INTRODUCTION {.. The ERPs contain many steps that require RCS pressure reduction. Mechanisms for RCS pressure reduction include normal pressurizer spray, auxiliary spray and pressurizer PORVs. All three mechanisms have limita-tions that the operator must be aware of. I NORMAL PRESSURIZER SPRAY l Use of normal pressurizer spray is in general the most desirable pressure l reduction mechanism. However, certain RCPs must be running for it to be
)
effective. Single pump operation in the loops with spray connections is the most effective. In addition, running RC-P-lc in loop 3 will yield the. j best results since the pressurizer surge tap is connected to loop 3 hot leg. f Therefore, a heirarchy of preferen'c e for pressurizer spray exists as follows:
- 1. Run RC-P-lO using loop 3 spray valve - BEST l
-2. .Run RC-P-1A using loop 1 spray valve - GOOD l
Running either RC-P-1B or- RC-P-1D will not produce good results becaus'e . l l the reverse flow in loops one and three will not drive much spray flow up l
. to the pressurizer. This is because of system pressure drops and the orientation of loop. one and loop three spray scoops. Recall that the spray scoops add velocity head to the spray lines only if forward loop flow exists.
(. l l l
Although normal pressuriser spray is the best and preferred pressure reduction mechanism, it may be the most difficult to reestablish in some zA - accident scenarios, since it requires possible selected RCP restart which depends on the operability of control grade instrumentation and contain-ment instrument air. A major advantage associated with normal spray is that it CONSERVES reac-tor coolant inventory. PRESSURIZER PORVs If normal spray is not available, use of one PRZR PORV has priority over auxiliary spray. Auxiliary spray is used as a last resort to minimize thermal shock to the spray nozzles.
. Opening one PORY results in a more rapid pressure reduction than normal spray,' however, it is slow enough to allow operator action such as blocking SI actuation at P-ll. '
The PORVs are highly reliable because they are redundant and are operated by safety grade controls without total dependency on air or off-site power. Use of a PORV will initially result in a loss of RCS inventory. However, this is well within the capability of the CCPs in either the charging or ECCS modes. In fact, in the ECCS mode, the reduction in RCS pressure results in higher ECCS flow into the system. The major concerns of the operator when using a PORV should focus on suc-cessful reclosure of the PORV and the integrity of the PRT.
.s
,-------e , w -we , r,r- -t m, n ,, r -yr, 4,,,, .,w-en-,,,- --
,-n-,,w,,w-,- e ve,n,-- w w,, n g ,n-,swe-,,,---g,,ww,-4.--,-ww - .,,,r-n-en-,-mp.,e-,-.
, Since TMI, a. lot of effort has been expended to increase valve reliability and to provide positive valve position ' indication. This, combined with the PORY isolation valve should instill operator confidence. l The PRT is not designed for continuous pressurizer discharge. However, j l analysis shows that most step (short term) discharges, such as those asso-J ciated with a cooldown, can be accommodated without opening the rupture l i disc. The operator can help the situation by ensuring that the PRT l cooling sys tem operates, if available, to cool down the PRT liquid between 1 discharges. Another option involves pumping down the PRT in conjunction with spraying RMW. However, remember that increasing the PRT level will compress the nitrogen atmosphere and may worsen the situation. AEXILIARY SPRAY i Use of auxiliary spray for any other purpose than normal pressurizar s cooldown is laced with potential problems that the operator should be f amiliar with. Firs t, the auxiliary pressurizer spray system supplies water from the CVCS to the pressurizer spray nozzle. If normal letdown (and charging) through the regenerative RX l's NOT in service, the auxiliary spray water will not l be PRE-HEATED prior to discharge through the pressurizer spray nozzle. j l This will cold shock (AT=550*F) the nozzle and may cause nozzle failure. l Failure in this case means that the nozzle breaks off and takes up resi-dance in 'the bottom of the pressurizer. Without the nozzle, even normal spray would become less effective. - (
, e , i.- -- m --w.., - , - - - . - + . , - m,..,,--,e-,,,,,,.--.--.,.,,7.,,,,,,-,-w.g.,, -
yi---, , - , -ee-,,ww,,w,--e,,ww -.--..-y e -w- wye-..
, In Westinghouse NSSSs, the maximum recommended AT for auxiliary spray use z
is 200'F. If it becomes necessary for the operator to use auxiliary spray with'out letdown preheat,. the operator should cut in flow as slowly as possible. In general, the ERP's attempt to restore charging and letdown first before pressure reduction steps that allow use of the auxiliary spray option. , Secondly, the operator must be aware of . flow competition with charging and. BIT. flow, since flow takes the path of least resistance. If normal charging and letdown are in service (no BIT flow), opening the auxiliary spray valve won' t yield much auxiliary spray flow. It may be necessary f or the operator to close the normal charging isolation to loops one or f our to get auxiliary spray flow. Of more significance is the situation
;f _ where ECCS . is .in operation (normal chargf.ng and letdown isolated). In -I this case, the operator would have* to isolate BIT flow to' obtain auxiliary spray flow. THIS COULD BE A DEFINITE NO-N01 In a case like this, the ERPs specify that the operator use one PORV without the option to use auxiliary spray.
l 1
. - - , . -~ .. . . . . . - - - . = - . _ _ . . . - . . . . - _ . . - . . - - _ _ . . _ - . . . . . _ . - ~ - - - , , - - . . - - -
i
\
~
l i .( i l i Background Information for SEABROOK PRESSURE-TEMPERATURE LIMITS
/
, , - - - -~ -----,---a ,-, ,, ~,, - , - - - - - -- -,r -, , , - ------ , ,-- ,
CURVE DESCRIPTION f .. . 1 max! mum TECH SPEC C00UXMN LIMIT a 100*F/HR 2 RCS SATURATION CURVE s 3 maximum PORY SETPOINT (2385 PSIG) 4 LTOP PROGRAM FOR PORYS 5 RCPIFSH 6 RHR OPERATING LIMITS 7 MINIMUM RCS PRESSURE FOR RCP OPERATION [MAY
, REQUIRE HIGHER PRESSURE (~ 350 PSIG) TO PEET
(- MINIMUM SEAL LEAKOFF FLOW (0 2 GPM)3 8 50*F SUBC00 LING LINE 9 100*F SUBcooLING LINE , e -(
--- - .,y-,... - --, ,, , - -,,,-w- --,-,c-.,,--.---+g- --.-.-----,,,4- , . , , - , , , , , , , . , , . ,
, , , . ,e,-,, . - ~ --r--, , , -,,,,- -,--,. ,, -~
k . . - i SEABROOK RCS PRESSURE / TEMPE'RATURE LIMITS FIGURE OP (TC Rev 0 3/84) 2500 p ! :: a - l 2000 -
/5 9
f8 e . . l 5 n. j 1500- - g - ! m 1 5 g - - 4 , 3 i m - - i u) 1000- - tu . . 2 x . . 4 D. . . 4 .
- i 500-f
[6 i
. . f7 s
- 0 '
100 ' ' '260' ' ' ~3 0' ' ' '460' ' ' '560' ' ' '6dd ' ' '700 TEMPERATURE ( F)
- l. .. . _ _ _ _ _ .
SPRAY UMIT 320 F AT NORMAL HEAT-UP and COOLDOWN i HEAT-UP LIMIT 60 Fg PRESSURE -TEMPERATURE CURVE i o FIGURE OP(TC Rev 0 3/84) I C00LDOWN LIMITS % MAX. PORV SETPOINT 2385 PSIG i i 2400-LTOP PRESSURE - -- - - b - - - - -- _ UMIT I l t - \ - f p j MAXIMUM OPERATING 2000- BAND l @ a_
~
/
SPRAY LIMIT g # / f----- l 5 a- .'. 320 F AT
./ / -f ,
j g 1600~ LTOP PRESSURE
\ / .p
{ $ '. " /2 7, - 100 F SUBC00UNG j E - \#f# TARGET OPERATING ~# #
' / #
4 co g 1200-40 pft,
/
BAND f j i f
-RCP REQUIRED NPSH f
60"F/tw / # ] O 100"F/tw # #
/
{ N 800-
/
# / SATURATION UNE
\
/ / /
! a - ' e' / 400
. MINIMUM PRESSURE-
/ / / =
" FOR RCP OPERATION l .
s/ / (ADMIN.) 1 0,
~
, , p .* *#s '/ ,
85 150 250 350 450 550 650 750 RCS AVERAGE LOOP TEMPERATURE ( F)
~'
r 1 Background Information for o PRESSURIZED TilERMAL SHOCK 1 l I t O
..g , - , .. , . - . -_- . - - - - , , . -.
FIGURE 13 I l INTEGRITY STATUS TREE l
. ATTACHMENT A E '
4 J - e
~
f E T, T2 to ten reupen4TuaE GO TO FR-P.1
- PaISSuRENo su um m aus GO TO COLD' LEG FR- P.1 TEMPERATURE a l PolNTS TO YES RIGHT 0F UMlf A AU.RCS No GO TO COLD LIG TEMPERATURE
-
- FRP2 GREATER THAN. YES 250*F ALL ACS
~~
TEMPERATURE COLD LEG NO DECREASE IN ALL COLD No b TEMPER-ATURES
' dNTER }-* !GS tsSS
*HAN 100*F YES GREATER THAN 280*F
;N THE LAST 60 MINUTES --
ggp
, , SAT y GO TO FR-P.1 ALL ACS COLD LEG NO ATTACHMENT B r TEMPER-ATURES ACS PRESSURE YES GREATER THAN LESS THAN NO 250*F r.- Cy GO TO e, ,
pnESSURE YES FR-P.2
" U"'I RCS
- TEMPERATURE -
GREATER THAM YES CSF seO*Fs . SAT l' , CSF SAT l
- ARMING BISTABLE SETPOINT
\
OPERATOR aESPONSE TO IMMINENT PTS CONDITIONS _( The Function Restoration Procedure FR-P.1, " RESPONSE TO IMMINENT PRES-SURIZED THERHAL SHOCK CONDITION," provides guidance in the event of an unexpectedly severe RCS cooldown following a reactor trip or safety injec- , tion actuation (indicated by the RED or ORANGE terminus of the Integrity S tatus Tree). .The operator is provided with instructions to attempt to prevent further cooldown and to minimize the pressure in the RCS in order to respond to a challenge to reactor vessel integrity. Guidance is also 2 provided on any subsequent RCS cooldown restrictions required to saf ely achieve cold shutdown conditions. An event or series of events which leads to a relatively rapid and severe reactor vessel downconer cooldown can result in a thermal shock to the T vessel wall that may lead to the initiation and growth of a small flaw (. that may already exist in the vessel wall into a larger crack. A growth or extension of such a flaw may lead in some cases (where propagation is not stopped within the wall) to a loss of vessel integrity. The objective of the Integrity Status Tree and its associated Function Restoration Procedures is to enable the operator to identify a potential thermal shock t condition and to take action to assure the integrity of the vessel. The l basis is.co prevent the initiation of a flaw, and in the event the limits i set forth are exceeded, specific procedures are given which appropriately restrict operation to prevent further growth of a possible wall crack with l concomitant loss of integrity.
- l l
The FRP is entered from two separate branches of the Integrity Status Tree, one having a RED terminus signifying a potentially damaying thermal i . shock condition independent of RCS pressure, with the second having an l l l
~ -
. 7 i
, ORANGE ~ terminus signifying an imminent approach to the RED condition,
' depending on subsequent increases in pressure or decreases in temperature.
A limited number of acenarios related to single or multiple failures "involving LOCA, secondary breaks or steam generator tube rupture may lead to a severe cooling cf the entire RCS (e.g. , secondary bretka or LOCA) or a - local cooling of the cold leg /downconer area (e.g. , LOCA or steam generator tube rupture). 4 4 i O l e t k I $$
-i N
--- w -- ~ e eg- .e ~,w r-e w, , w, w er-nar moe -w, e--e -. -+---,-~---meww- ,,e ,e ms, am-r- . , ,w-ev-em-mn-ew,---,-ww-w-w -ve---,- re 1-w,-
,. MAJOR ACTION CATEGORIES IN FR-P.1 4
h
- Cold leg temperature has exceeded RED or ORANCE LIMITS e Attempt to Stabilize Temperature o If Excessive Cooldown Caused By ECCS, THEN:
- 1) Terminate ECCS
- OR -
- 2) Start an RCP to mix cold ECCS water with coolant e Depressurize RCS to Minimum Subcooling e Temperature SOAK (ANNEAL TO INCREASE DUCTILITY) i e Cooldown at Less Than.50'F/Hr with Maximum of 200*F Subcooling t
a T e v' (
+
--.,.-+-,--------.m--re. - - , - . , -r, w , , - - - - , - - , . - - - , , - , , . , . , , . - - - , , , or,-, ..-..w_.-ww-~---,- ,,
g- DISCUSSION ( During the fabrication of the vessel or during the sperational lifetime of the plant,. small flaws may be created in the weld or base metal of ,the reactor vessel. These flaws can be propagated or extended into larger
cracks if very high thermal or pressure (membrane) stresses are imposed on them by RCS transients. A severs thermal shock or a pressurized thermal shock can lead to a brittle' fracture of the vessel wall such that a loss of vessel integrity may occur.
, A vessel thermal shock condition exists if a rapid fluid temperature decrease occurs in the downconer region of the reactor vessel. A tem-perature difference will then be established through the vessel wall with the inside of the wall initially rapidly cooled while the outside portion l' remains close to its initial temperature. An example fluid temperature
. transient ic provided in Figure 1 and corresponding wall temperature pro-y, files for various times are provided in Figure 2. As time increases the temperature profile flattens because more of the wall thickness is cooled below the initial system temperature.
'The result cf the through-wall temperature difference is that a tensile stress is placed on the vessel wall acting to pull open any pre-existing small flaws, in welds or base material. Figure 3 is a representation of a l
, flaw at the vessel inner surface and how temperature induced stresses act to extend the flaw into the wall. In addition, when the temperature of the vessel wall decreases, its ability to racist flaw growth also l
1 decreases (decreasing fracture toughness). If these conditions occur to a i severe enough extent, the pre-existing small flaw may propagate into a l- larger crack. e 4 m,,--,,n, ----,n- ,a n., n.,-_.n,-,_ ,,,-,,..,,,,-,,,,,-,,m-~e,-,,-- - . , , , , , ,---,-r
1
, - In addition to the temperature induced strGsses the RCS prsssure could act to assist the growth of a flaw. A thermal shock occurring with pressure in the RCS is called pressurized thermal shock (PTS). Figure 3 shows how Pressure acts on a flaw and Figure 1 presents an example pressure tran-sient for a typical PIS event.
I 1 f l
, C l
( ! 1000 1
- e l REACTOR COOLANT E i PRESSURE & TEMPERATURE 5 650 -
) FOR A REPRESENTATIVE [< 399 _ , i SEVERE THERMAL E i TRANSIENT FIGURE OP 1 (TC Rev 0 3/84) 3 l-( -
~
l ! I 0 0 1000 2000 3000 l TIME (seconds) 1 l 3000 I -
=
- j. y 2250 i -
i a 2000 - l
@m l E FIGURE 1 l
'ooo l 0 iO00 2000 3000 TIME (seconds)
o e VESSEL TEMPERATURE PROFILES FIGURE OP 2 (TC Rev 0 3/84) , 600 200 sec GOO sec g 500 - 1000 sec l v E 1500 sec h 2000 sec g 400 - E 300 . 200 7, , , , , , , FIGURE 2- 0- 1 2 3 4 5 6 7 8 VESSEL WALL THICKNESS (inches) _ _ _ _ _ _ _ _ _ ._ __ L
- .. n e.
L FIGURE 3 $SALL INSIDE W OUTSIDE e LOW TEMPERATURE h FLUID FLOW u PROFILE y V PRESSURE FORCE FLAW IN VESSEL WALL TEMPERATURE PROFILE . FLAW PROPAGATION CONDITIONS IN VESSEL FIGURE OP 3 (TC Rev 0 3/84) l i
r A representation of the ' combined stress from temperature (thermal stress) and pressure (membrane stress) for the example transient in Figure 1 is _{. shown in Figure 4 where stress profiles at various times into the tran-sient are shown at different wall thickness locations. In some cases a thermal stress alone can be suf'ficient to propagate a flaw while in other cases significant membrane stress in addition to thermal stress will be required to initiate flaw growth. In general, whether a small pre-existing flaw will grow is dependent on the rate and amount of RCS cooldown, t.he RCS pressure, the material pro-perties of the metal and the location, size and geometry of the flaw. In deriving the Integrity Status Tree operational limit each factor has been considered; the assumptions used in development of this limit will be discussed in the following section. The intent of the Integrity Critical Safety Function RED limit is to define parameters (symptoms) that indicate a challenge is occurring to the Integrity Critical Safety Function, and that immediate operator action is required to' address this challenge. Using fracture mechanics analysis techniques and an assumed fluid temperature transient , the minimum pressure at a given temperature required to initiate a flaw, called the
- allowable pressure, can be calculated and used as a bas'is for the defini-tion of the RED limit. The' other Integrity priority levels (0RANCE, YELLOW, GREEN) will be based in turn on the definition of the RED limit.
A. typical ALLOWABLE PRESSURE curve is provided as Figure 6. (
a s 64,000 VESSEL 56,000 STRESS PROFILES 48,000 FIGURE OP 4 (TC Rev 0 3/84) 40,000 - PRESSURE 32,000 - AND THERMAL STRESS (PSI) 24,000 - 16,000 -
~
2000 sec r1500 sec
\ C 200 ssc 1000 sec l l l l l l l 600 sec 0 1 2 3 4 5 6 7 8 FIGURE 4 -
VESSEL WALL THICKNESS (inches)
./- SELECTION OF RED CONDITION ACTION LEVEL LEHITS
( ~ The plant process parameters to be used in monitoring the Integrity Critical Saf ety Function are RCS pressure and RCS cold leg temperature. t RCS pressure is an ' indication of the pressure in the vessel downcomer region and cold leg temperature is the best available indication of down-comer fluid - temper
- cure. -
In order to be compatible with the intent of Critical Saf ety Function Status Tree monitoring the integrity action. levels are required to be time independent. Since the severity of a thermal shock is dependent on the rate of RCS cooldown a method is needed to conservatively eliminate rate effects from the symptoms. This is done in calculating the RED limit by assuming a step decrease (or infinite rate drop) in fluid temperature in order to bound all possible cooldown races. { The method used to define the RED limit is to use in an allouable pressure
; calculation a step temperature transient assumed to start at a downcomer wall and fluid temperature of 550*F, with fluid temperature then dropping -
Jto a lower specified constant temperature. Figure 5 provides a represen-tation of some example temperature transients. Figure 6 presents an example allowable pressure calculation result. For each final temperature assumed, a different allowable pressure curve is generated. A series of
, minimum allowable ~ pressures each corresponding to a given final tem-
. perature assumption is then used to generate a curve which is called the
" Step Cooldown Crack Initiation Limit" as shown on Figure 7.
Also includ-d on Figure 7 is a curve called the " Isothermal Wall Crack Initiation Limit" which is an allowable pressure curve assuming a constant ( steady-state through-wall temperature, rather than the very extreme
n .. n. . I i i ! BASIS FOR DEVELOPMENT OF CRACK INITIATION CURVE i FIGURE OP 5 (TC Rev 0 3/84) 1 i A>B>C 550 - Pressures decrease with i increasing radiation damage to vessel (RTNDTI) (Critical Pressure = A psig) l TEMPERATURE ("F) ~ (Critical Pressure = B psig) . j j 250 - I
- (Critical Pressure = C psig) i 200 -
l TIM E-+ l
- FIGURE 5 i
- - - 4 i .
4 i EXAMPLE: ALLOWABLE PRESSURE CURVE FIGURE OP 6 (TG Rev 0 3/84) l i i i i
. MINIMUM l ALLOWABLE j PRESSURE PRESSURE .
ALLOWABLE PRESSURE 4 ! TIME-FIGURE 6 . 1
d
._ , situation resulting from the step temperature decrease transient which places the maximum thermally.-induced tensile stress on the vessel inner
( wall. 1 1 1 For the steady state through-wall temperature case, temperature stress is ; I
. nearly zero, but material fracture toughness, or its resistance to flaw !
i . . 1 growth 7 at low temperature is sov enough so that excessive pressure alone is calculated to cause flaw initiation. For thick-walled vessels it has been found that this curve is more limiting at high pressure than the
- " Step Cooldown Crack Initiation Limit." Therefore, the RED Integrity l limit has been defined as the lower bound of the " Step Cooldown Crack Initiation Limit" and the " Isothermal Vall Crack Initiation Limit."
- The RED pressure-temperature limit line is then conservatively defined as
; the boundary of a region below which a flaw may initiate and is indepen-I
,.L dent of the time his tory of the transient. If conditions remain to the right of the RED limit, no initiation of a flaw will occur. If conditions are to the lef t of this limit the potential for flaw initiation exists and
-appropriate operator action should be taken to reduce the probability that an existing flaw will propagate through the vessel wall.
The region to the right of the intersection of the " Isothermal Vall Crack Initiation Limit" and the RCS safety valve pressure setpoint plus 3 per- ; cent accumulation (2560 psig) is a full repressurization area. In this area a flaw will not initiate at any pressure up to the safety valve set- ) point and complete operating flexibility with respect to pressure can be allowed. In permitting this flexibility it is assumed that at least one of the installed code safety valves will operate correctly to limit RCS
-. ( pressure, if necessary.
.-- ,- . -. .m..w.--,_w,,.-,_,,,,r., .~,.,%..,..,.,,,w, y%,-e. y,.,.-.e* ren'---M~++Wewe-=-'*---MM-e+ww'v-"m--
The region to the right of the RED limit line and to the lef t of the " Full Repressurization Limit" line (Figure 7) is an area where a flaw will be (- calculated to initiate if pressure increases above the RED limit line even . at a constaat wall temperature. Since pressure can rise in some cases rather quickly, increased operator awareness is warranted in this region. e 4 9
-- - - . -w - - . ,--e-- - - - . n.-n- g --e---- --m.,,, - - - , -, e,,, v.-er--- -r-e ,-, , ---,--mcee me r - y ,,ww,-,m--new--eseee---n-----ms*v --a-
^
e . EXAMPLE CURVE FIGURE OP 7 (TC Rev 0 3/84) SAFETY VALVE SET PRESSURE PLUS ACCUMULATION POTENTIAL " CUSP" NO INITIATION REGION
/ l I INITIATION e
PRESSURE -j ~p
+ FULL
[,
' '
- REPRESSURIZATION
, , ISOTHERMAL WALL CRACK l LIMIT INITIATION LIMIT g [g STEP
^
l
/ COOLDOWN ,
y CRA.CK INITIATION LIMIT 4 TEMPERATURE FIGURE 7
g RTNDT CATEGORIES FOR OPERATIONAL LIMITS
.(
The material properties of a given reactor vessel determine the fracture toughness or resistance to flaw initiation of the vessel. The important characteristics of the material are the initial vessel metal and weld com-position and the neutron irradiation damage sustained during the life of the vessel. 'A asasure of the fracture toughness of a given material in a specific vessel is its RTNDT (Reference Transition Nil-Ductility Temperature) value. The. higher the RTNDT temperature, the lower the frac-ture toughness of the material and the more susceptable it is to flaw ini-tiation. This parameter, RTNDT, has been generally accepted as the mos t useful figure-of-serit for evaluating the susceptibility of a reactor ll pressure vessel to a PTS condition. i The material properties to be assumed are dependent on the plant reactor vessel. Three categories of reactor vessel material have been used to generate generic curves which can be conservatively applied to any Wes tinghouse nuclear plant vessel. The cacegories are definod by RTHDT levels for the limiting vessel sacerial as follows: CATEGORY I RTNDT I 200'F (Seabrook) CATEGORY II 200'F < RTNDT 1250*F CATEGORY III 250*F < RTNDT 1 300*F The limiting location in the vessel for evaluating severe cooldown effects is generally the downconer core midplane (beltline) region (Figure 8). This is true because at one, or more points around the vessel circum-( forence, at its inner wall, the fluence level (integrated neutron flux due
* -^
! ,e.,e#
.: s l CLOSURE ^
HEAD ' l REGION MAJOR l SECTIONS NOZZLE ff OFA l i REACTOR SHELL-
-- PRESSURE
.C O l g VESSEL FIGURE OP 8 (TC Rev 0 3/84).
! BELTLINE ' REGION CRITICAL I ], , LOCATION I LOWER HEAD ' j REGION j[, . FIGURE 8
e' to core leakage) is the highest of any RCS material. The peak axial flux-generally occurs in the core midplane region, and the maximum embrittle-
.I.
ment of vessel materials from neutron bombardment therefore occurs on the l contiguous vessel beltline. In most vessels, the beltline region also i l . containe either circusionential or longitudinal welds that ars tha criti- l cal locations for assuring the integrity of the vessel. In applying the l RED ' limit for any particular vessel the limiting location is taken to be the location in the vessel beltline with the highest RTNDT. This can be , weld material or base metal.. FLAW SIZE AND GEOMETRY In calculating the RED limit curve all flaw sizes up to an including 0.25 times the vessel wall thicknes's (1/4 T) have been evaluated. This means [ that all potential pre-existing flaws in size equal to or less than 1/4.T
'( have been covered by the RED limit' generated. Flaws larger than 1/4 T are not expected to exist due to ' the quality of vessel fabrication and the reliability of in-service inspection techniques.
The geometry of the pre-existing flaw assumed is finite and the analysis technique is consistent with the methods used in standard fracture mecha-nics calculations. SELECTION OF ORANCE CONDITION ACTION LEVEL LIMITS The intent of the ORANGE condition limit of the Integrity Status Tree is to provide a warning area for the operator of an imminent RED condition. In the ORANGE region a flaw is not calculated to initiate, but relatively small and possibly rapid changes in pressure or temperature will result in entry to the RED region where a flaw is calculated to initiate. ( O
~ - - . . , . . , . . , , _ . _ . . , ~ . ,__,.m._. . _ ..-, _ ,, _ . - _ _ . . ,,m - - , , , _ ,_,-._..,..._.___.,__.m
,- For Category I plants the ORANGE limit is defined as the region between j i
the RED region boundary and the " Full Repressurization Limit" line I (- l (Figure 7). LIMITS OF APPLICABILITY This Function Restoration Procedure is intended to respond to a thermal shock or pressurised thermal shock event. If a normal cooldown is occurring and the cooldown rate limit on the Status Tree is not exceeded, but a subsequent RCS pressurization in violation of the Tech Spec pressure
- temperature limits occurs, then it is possible to have an immediate ORANGE or RED indication without an excessive thermal condition. This case is not specifically covered by the procedure, but the actions instructed do address any potential cold overpressure concern by requiring y an RCS depressurization. However, the degree of depressurization neces-sary would be only that needed to return the RCS pressure to within the Tech Spec limits. Also, no soak is required and subsequent RCS cooldown should be within Tech Spec cooldown limits.
Seabrook design includes a Low Temperature Overpressurization Protection (LTOP) system that automatically opens pressurizer PORVs to limit RCS pressure for a given RCS temperature. The programmed LTOP pressure-r temperature setpoint maintains RCS pressure' within Appendix G (Tech Spec) cooldown limits. The operator should expect LTOP to open the pressurizer PORVs automatically if a Large cooldown occurs without a significant decrease in RCS pressure. In addition, a sudden RCS pressure increase ! without a . thermal shock will also result in LTOP operation. See Figure 9. l f I I
-~ _ _
. _ _ _ . -___ _ _ _ , _ _ _ _ . ~ . _ _ _ _ _ _ _ _ . _ _ _ , . _ _ . . . _ _ _ . _ _ _ . _ . _ . _ . . _ _ _ , _ , _ _ _ _ _
~
_ s , SEABROOK LTOP SETPOINT PROGRAM " FIGURE OP 9 (TC Rev 0 3/84) 2385 PSIG . FlXED PORV SETPOINT i I a
- 2500 I I .-. 2385-
. tn l To I
I E i p 2000- l i E I ' i 2 ' l b 1500- l .' (n
> I oc i O !
E 1000- l -
! 190"F l 2 1 4 500 I 2 1 I
' 20e l 100 150 200 .250 300 350 400 RCS TEMPERATURE ("F) l LTOP l ARMING POINT FIGURE 9
~
i- . 350"F i ,
. n , )
l l i SEABROOK STATION - OPERATIONAL LIMITS CURVE l FIGURE OP 11(TC Rev 0 3/84). i . j 2560 psig 250 280 i 2500 - )' 226 F/2050 PSIG % NOTE: 2000 - 28"F ADDED TO ALL i TEMPERATURES FOR j INACCURACIES, f PRESSURE 1500 - (psig) [ l \ . 5 l 1000 - 3 i 500 - i i n I- 0 i i j 0 160 /260 I 460 500 l 360 ! 194 h T2 TEMPERATURE ("F) FIGURE 11 1
~
'~
~
i i
! SEABROOK STATION-OPERATIONAL LIMITS CURVE i WITH SUPERIMPOSED LTOP PROGRAM ! FIGURE 'OP 12 (TC Rev 0 3/84) l 2560 psia 250 280" 2500 -
f 226"F/2050 PSIG -> NOTE: l 28'F ADDED TO ALL 2000 - TEMPERATURES FOR INACCURAClES, l ' l>llE S S U R E / l 1500 - l (Imio) y j
/
.7 /
1000 - 3 / q LT OP
/
/
500 i i ! O j 0 160
~
/ 200 l l 300 400 500 L
. 104 n 12 1
l TEMPERATURE ("F) FIGURE 12 1 i
n a. n y i i l l INTEGRITY CRITICAL SAFETY FUNCTION ! POST- RECOVERY OPERATING RESTRICTIONS I FIGURE OP 14 (TC Rev 0 3/84) l FIGURE 14 i Allowable RCS Safety Limiting Soak ~ Cooldown Pressure and , Function Temperature Time Rate Temperature Status in Transient Req ~uired Restriction Operating Band 1 Hour After Between Minimum 4 Red Crack Stabilizing 50*F/ hour Subcooling Curve ! T < Initiation RCS After Soak and 200 F Limit Tempera.ture Subcooling Curve { _, l l 1 Hour After Between Minimum j Orange Crack Stab.ilizing 50"F/ hour Subcooling Curve initiation < T < 250"F RCS After Soak and 200*F } Limit Temperature Subcooling Curve 1 Between Minimum Yellow 250"F < T < 280"F None 100 F/ hour Subcooling Curve and 275"F Subcooling Curve ) i Between Minimum Green T > 280"F None 100"F/ hour Subcooling Curve & Tech. Specification Cooldown Curve ' l P I
, FREQUENT QUESTIONS
( The following questions have been commonly asked about procedure IR-P.1, RESPONSE TO IMMINENT PRESSURIZER THERMAL SHOCK CONDITION: ; l
. Q. Why .are tho' criteria for SI term $ nation reduced?
~
A. For the conditions existing when this procedure is entered, there is a high likelihood that SI flaw was, at least partly, responsible for the RCS cooldown. It also would act to prevent RCS depressurization, which is a desirable action to reduce pressure stress on the vessel. The criteria assure that adequate core cooling and inventory exist at the present time, and will not be lost in the short term.
- Q.
What if the 'depressurization is prematurely stopped because of high
/
PRZR level? A. Following norsel rules of usage, the operator would proceed in the procedure, establish normal letdown, reduce PRZR level, and then check if minimum subcooling had been established. If not, he would return and depressurize further, since PRZR level had been reduced. This process might be repeated. P G t I 9 j . i
, -n >-m , - . -v., - - - - . , + >-. .-~,--m-,,--r.,--,,.--w.-,,v,- ,-,..,.w - ,, ,a,-,we-,- --o,,~,,-pmw+nwp--emmaw-
l OPERATOR RESPONSE TO ANTICIPATED PTS CONDITIONS l { The Function Restoration Procedure FR-P.2, RESPONSE TO ANTICIPATED PRES-SURIZED THERMAL SHOCK CONDITION," provides guidance in the event of an unexpectedly severe RCS cooldown following a reactor trip or safety injec-tion actuation (indicated by the YELLOW terninus of the Integrity Status Tree). The operator is provided with instructions to attempt to prevent l further cooldown and with guidance on subsequent cooldown restrictions required to safely achieve cold shutdown conditions. This FRP is entered from the YELLOW branch of the Integrity Status Tree. The YELLOW branch conditions are defined by a pressure-temperature region as represented in Figure 11. The lower temperature boundary is defined as the upper temperature limit of the ORANGE region (temperature TL ). The p upper temperature boundary is defined to be 30*F higher than the lower temperature boundary (temperature TL). The minimum size of the YELLOW region temperature difference (30*F) has been chosen to ' allow time for operator action to prevent entering the ORANGE region. As long as the T1 Limit line is not crossed, the plant can be safely cooled down at up to the Tech Spec maximum rate of 100*F/hr with no SOAK. However, lower cooldown rates are Asirable. l . l ( l
,w-,- .-, . . - . - .- - , , , , - . - ,. , , , , , , , _ . , ..._,,,,_.,m.,,,.,, ,_n,n... ,,,,,,,_.,w---,-wyy,.,.,.r,._,;-,,m,-,-n, , . _ _,,.
MAJOR ACTION CATEGORIES IN FR.P-2 I,
- Cold Leg Temperature has NOT exceeded RED or ORANGE LIMITS but has exceeded YELLOW LIMIT ( < 280*F) ;
.o Attempt To Stabilize Temperature e Continus Only If ECCS Can Be Terminated e Maintain RCS Pressure Within Pressure-Temperature Limits Of Tech Specs (LTOP) o Cooldown At Less Then 100*F/Hr With Maximum of 275'F Subcooling
( - O l l I I
~
l
FREQUENT QUESTIONS
- k. The following questians have *; ten commonly ask'ed about procedure FR-P.2, RESPONSE TO ANTICIPATED PRESSURIZED THERMAL SHOCK CONDITION:
Q. Why can' t SI be reduced in this procedure? A. Because FR-P.2 is on'ty reached on YELLOW paths, entry into the proce-dure is, by rules of usage, at operator discretion. This means that SI reduction, if it were placed in the procedure, could not be counted on by the ORPs to be implemented. It is simpler to allow SI reduction to be performed as part of the normal recovery sequence in the ORPs, and then to perform the subsequent pressure reduction, if needed, in this procedure. J 9 t - f
e ( . Background Inf orzation for
.'iYDROGEN VENTING FROM THE RCS l
( - O e O _. - _ . , . - .~., .. _ . . . . . ~._.__ _._,--.___,,._,,,,___,o._._,- . ._,,,_m,-, , , . , . . , _ .,, . , . - , . . _ _, _ - . _ _ _ . , . _ ,- .~
, - INTRODUCTION h FR-1.3, RESPONSE TO VOIDS IN' THE REACTOR VESSEL, is .used when a gas void is detected. in the reactor vessel, and when the operator determines that it should be removed. Any number of transients can result in a' void, whenever saturation conditions exist in the vessel head, or gas is injected into or generated in the RCS. Removal of a void in the reactor vessel should not be attempted until a stable, subcooled RCS exists.
, Entry to.. this function restoration procedure would usually occur through the critical safety function monitoring status trees, specifically from the Reactor Coolant Inventory tree whose branches show pressurizer level at or above normal, and a less than full reactor vessel.
In addition to reactor vessel level, other indirect indications of a void
.I in the RCS (not necessarily in the reactor vessel head) are lis ted. ,
e Variations from the normal pressurizer pressure and level response due to normal charging and spraying operations may be observed if a gaseous void exists in the RCS. The pressurizer level may decrease during a RCS pressurization froa charging due to gaseous void contraction and l level may rise rapidly during a spraying operation due to a gaseous void expansion.
- i e Gases in the reactIor coolant system may result from several types of plant events. An accumulator tank discharge or a core uncovery may L.
result in non-coudensible gases (e.g. nitrogen and hydrogen) being trapped in ths RCS. 4 i l l
, . . , , , . . , , - - . . , . - .-.,-,-----,--~,-..--.,.--.,.-,...w., r. - - - , ,r.-,--,._,,n-,-- -
., e A rapid RCS cooldown may result in the vessel head temperature being
- j greater than the primary saturation temperature and result in a steam bubble being developed.
The operator should sus'pect the presence of gases in the RCS if any of the I above events occur. The configuration of the head vent system includes a single connection to the vessel head with series isolation valves in a common line. The common line includes s' 3/8" orifice which limits the flowrate to within the ' makeup capability of the chemical and volume control system. The line is routed to the PRT. RgCOVgRY DgSCRIPTION
, This function restoration procedure describes steps to remove the void.
( An initial attempt is made to cond'ense the void. This attempt will ulti-mately succeed if the void is steam. If the void is gaseous, a head vent operation must be performed to remove the void. A general description of the procedure is presented below.
- 1) The initial step is to record the RCS pressure when this procedure was entered, for future reference.
- 2) Af ter verifying. the SI is not operating, the operator confirms tha t s table RCS conditions exis t.
- 3) The next set of steps provide guidance to condense a potential steam void. This is done by increasing pressurizer pressure. If this operation is successful, the procedure is complete, and the operator i i 4
e a y* - - = -%w,e --w -
,%----.g.w,-+e.-w.p,-.-o--g*-----.,w-,.,-we----w ,e--g --,-ww, myi-a,ety,.,n--w.y=,-ww--,%-ep. w w, vwm*-9.w-mu- ----rr
~ , returns, to the procedures in effect. If a void remains, '.t mus t be assumed to be a non-condensible gas, and head vent must be initiated.
( -
- 4) Prior to initiating a head vent, certain conditions must be established to minimize system perturbations when the vent path is opened' with a resulting RCS depressurisation. - The letdown path is isolated to [ minimize inventory loss. Pressuriser water level is main-tained above the heaters, anc pressure is adjusted to be at or above the initial RCS pressure. The pressurizer low pressure
- SI signal is blocked.
- 5) RCS subcooling is then checked. Since venting will reduce subcooling; 50*F sergin should be achieved prior to operating the vent.
- 6) The final preparations before venting are then made. Tue containment
[ . isolation and ventilation systems are started. The maximum allowable vent time to preclude an unacceptable hydrogen accumulation is deter-ained, and the other vent te.rmination criteria are reviewed.
- 7) One ' vent path is opened, then closed when the reactor vessel is full or indicated level is stable, or when one of the other vent te r-mination criteria is set. ,
- 8) If tne venting was successful, this procedure is ex(ted, af ter t
insuring stable pressurizer level. If it was not successful, the vent process is repeated. (-
rv I 1 I o_ DETERMINATION OF VENTING TIME l 1 l I The amount of hydrogen released by the head vent is limited such that the l bulk containment atmospheric concentration does not exceed 3% hydrogen by ; volume. Therefore, the concentration must be below 3% before any venting can commence. The lower the initial hydrogen concentration is, the longer the head vent operation can continue. Af ter determining the containment hydrogen concentrationi the operator must calculate the maximum allowed venting time. The formula and curve needed for this are contained in the procedure. The 3% limit provides assurance of a reasonable margin to a potentially explosive bydrogen concentr$ tion inside the containment. The venting time calculation is presently the only " SIT DOWN AND CALCULATE" value in the ERPs, thus it deserves some attention.
,?
e i
-*r -ew , - + - - - - , - - vg- re---~-t- -
INSTRUCTIONS FOR DETERMINING VENTING TIME k
- 1. Detsraine Containment Volume at STP = A (Containment Pressure) 492*F A = (2.704 x 106 FT3 ) x 14.7 psia x (Containment tempera ture)
- 2. Determine Maximum Hydrogen volume that can be vented = B (3.0% - Containment Hydrogen Concentration) x A B= 100%
- 3. Determine Hydrogen flow rate as a function of RCS pressure = C
- a. Check RCS ptessure -
, b. Using Figure FR-I.3-1 read hydrogen flow rate
( -
- 4. Calculate maximum venting time B
Maximum venting time = - = minutes C 9 l i (- e
+
f 6000- - 1 [ T 5000- - 15 m i 4 m
< 4000-i l-l m
! 3: l HYDROGEN FLOW 9 u. 3000 - i RATE VS. RCS z m l PRESSURE 8 2000- - l FIGURE FR-l.3-1(TC Rev 0 3/84) g i O i >- I
- 1000- -
i 0 ! ! ! ! ! O 400 800 1200 1600 2000 i FIGURE FR-I.3-1 - l RCS PRESSURE (PSIG) i i
VENTING TERMINATION CRITERIA t .. . e Reactor Vessel Full (RVLIS > 90%) e Containment Hydrogen Concentration Exceeds 3 v/o e Loss of Subcooling < 30'F e Pressurizer Level Low ( < 20%) e RCS Pressure Decrease > 200 PSI e Venting Time Greater Than Calculated e PRT Rupture Disc Burst Vent again if necessary if non-condensible void still exists. t O
-- ,- - ,,, ,- n--, ,-,--,v-4w,, ,n,. . , - - ,,e, . .- ..,, ,, . ny , , , . , - - ,-- ,,, , , - ,n,.. . , ,.n.e,_-.
~
r .;. t7. . ,e . . >
- - ;. .- <; -,. s . ..
. .- s c g ,:: s.u,.-> . p- . ;, y. : ., - y , . - . - u + .
4..
.1wa.. :. m ...,.gv .r-; . F
_
- i
.w,= - -
'f!
. ., ., s ..
.m ; .-4 -c, *. *g.
- L e n v".
a.-.,..,. v , 4; .- - . e.3 , <
.-;L ., , , . .
.... ,. t. .... t.. .
-a .s.
r
...: + .. , .- .. s,. 4m.- . .g . .
< .5
. . . c. po.
. 5 . .. .
,. ,. , .,,,,..-t.-
..,5.
<.s>.
e -- e.. -
' p ..- - .,.,'.,,cr e.. .:. .. ,
...r- s ?' ..
- ., ,+ + -:- + . , -.- .,,. e ;. . .
c . %g - . ( & , ,.- r .. .?- . ., y ;,- .
+s
,f.s. x -
I'. g- , 7.A,A ? y ., V -E -
. at . p, fb . .. y, .%* *Ef <A
,'.?,.>,, . : e, ,g.*$' ' ' *. . - l Jl,.,' l[ . * ' '. . .
l lb ;? ? $, ,els . 4 , % ,' - ,, *
.s . . .h. w .g. . -s A.y.jp+9..: A1 . s- : a.: .. Y .. . . 4. x. e %.,
p
+- - .
if - mg.- u
,, , y,q:-p ,. y f , {,; .
, , _ , . 4 e* a . . . . - , . - >-
..'n ' .r n,,.
4 ..,, u, w, 4-i
. **._ -j k
p+ *.,"N -
). % ) e
- s~ , ':, .,- ... p da.
>y ,7,y ,+ -, : _; - ..y
. -r.. +
b y- .
,' -*A-
= . .p. g ,,. .: M y , % ;9 -~ ..".'- ,- . - 'l
,g
,, a ,
e e ,
. , , * ' ^4 T
!. - ....g*
I'\ _ -
- ,. . w +.c ,': .4,,, 0 ac*.t. f. + ', 4 -v'k . , . . +
- g ".,y 1 .v . +. f,. +
.4... .
2-
>* ; '.-^ .- gig
. 9... .
. +
I'" . ' e~ .
*}
-p-v ..,s
.M, s: '4
.d b J' ,F, .,
, 4. g .
c 4,' . A "k, :3.. . ' i*
', v' ,p - ., 4 +..r .R :a } ;
Q. . p 4- ...
- r. -
4, *
' Y .' .k W . -.p
$- y'
. t,.* -
y.. - , . .. 1%
.k E 5 . /
- 9. 's+ . .
- .. h -v" .
t* ] .
. s; Y
- 4 2 *
- h .' , .r-m *A . . . . . . . y -
~-
; a . ' .,., o (
' i... ,N ~ d e Y* J 9 f.
,w,'
..,_.g.
(? 4.: m.
. 6, >a_
g " R f. - *
,c... -c
..,v. .g ' ',- _....-. .. , , - - s
.r.
w
+ .'N M di tu,
- 4. " g .
,p,
. .3
$,,g4 ,[ ,
..[
1,- *' . '* .- [ [ .f , \ b ,f - p l R 3.. ._ s.
- q ' ' '
4 % ' ' . '_ s*,.? 9..g.h '*
,...' 3.,.. ..
4 y'.. gs,1 p M. mi y y - - m.e.:
'.y+..:[ n' &'s . s.: (.x
.a , ..
..d
,4 gd . g ..
f4 ~. .. ..-i. ,;. .. ' ' ..g;g,. :
/.f ; <
f, ,.4.
.: ..;- % .; t. ,. n.\ g' q'- ,_
[.9 , .y . "- 'x. ; sp . . , - . y.,,;
,n~.-. <-, *, -. i t; , .:.~,.+
- ., - -. tx r,
-y4 .Mk. s F ',.s.. , . . .-
1, . .: .,
,t ) .
, . ' . , .- , ,< ,- :-, ">:i f,p
, :.e. ,w ,
't*
1 s( ., tt fy-. ."
,t, *.hY*
.Q.,t-g *_= * #
a ,. _,< ...: ,k :n. m. ;g; _b -a . " -
; ..,',.n.. . ,..
.h.
;. . m, : -
... ,- *.+ '#M . ' .
- g. r
- , c. y 7 . : .
.,%..e , .
l*. h f% . ;f_ ' ? ; ','l-l f \ f .. . ' . f. l: f j ' l y,= &.y,.:j ' ?? I
~
v-
- N'sy.. ..,.,' f( ..[ ' f } Q w. . .. Q . .. __ R '* ... }. f., -~ . . ~
l 9 k l
)
Background Information . for LOSS OF DIERGENCY COOLANT RECIRCULATION (
f
, INTRODUCTION h The " Loss of Emergency Coolant Racirculation (ECR) procedure," ECA1.1 has been developed as an Emergency Contingency Action (ECA), and it provides
- ., procedural guidance when emergency coolant recirculation capability is lost. Loss of emergency recirculation capability is defined as the loss
. of the ability to provide the recirculation function following a LOCA:
1.e., the lose <f the ability to inject fluid from the sump to the RCS using an RHR pump. DESCRIPTION The object!ve of the loss of ECR procedure is threefold: (1) to continue attemp ts 'to restore emergency coolant recirculation capability, (2) to delay depletion of the RWST by adding makeup fluid and reducing outflow, and (3) to depressurize the RCS to minimize break flow.
.f The following are symptoms or indications of loss of ECR capability:
e Loss of BOTH Sump Isolation Valves e Loss of BOTH RHR pumps e Inadequate Containment Building Level due to a LOCA Outside Containment ' Loss of ECR is potentially severe and could ultimately result in a Class IX event. . To ' min'. mise the possibility of getting into this situation, the ERPs con-g tain check steps in proceduras that are implemented prior to the need to r ; establish ECR. This is done to give operators time to rectify the situation should equipment be unpowered or if incorrect valve lineups - ( exist.-
. _ . _ _ . - . ~ , _ __ _..____.... ,.._ _.._____ . ,.. _ .,_ _ _ ,_. _ _..._ _ ___. _ .._ ..,___ _ _. _
4
, MAJOR ' ACTION CATEGORIES IN ECA-1.1 I,
e Continue Efforts To Restore ECR e Makeup To RUST From RMUS And Spent Fuel Pool e Reduce ECCS To One Train To Minimize RWST Drawdown e Operate C'ontainment Spray Pumps Only As Necessary To Keep Containment Pressure Within Safe Limits e Add Makeup To RCS From other Sources (Charging from CVCT with RMUS) e Depressurize SGs And Thus RCS To Inject Accumulators And Minimize Break Flow I e Reduce RCS Makeup To Only That Necessary To Match Decay Heat O e t l
*, p ,A%
i 100-LOCA INSIDE CONTAINMENT 1 80-CONTAINMENT LEVEL 8 a v% e2 E 60- VS. 3 RWST LEVEL EXPECTED a 40- REGION n E 1 20- , t 0 2l 1 5 i 5 6 INDICATED CONTAINMENT BUILDING LEVEL IN FEET I MINIMUM MAX l MUM s EXPECTED EXPECTED 2ft-3in Sit-4in
2 N. _ _ _
----- ... ..}}