ML20114D641
| ML20114D641 | |
| Person / Time | |
|---|---|
| Site: | 05200001 |
| Issue date: | 08/26/1992 |
| From: | Quirk J GENERAL ELECTRIC CO. |
| To: | Crutchfield D Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 9209090221 | |
| Download: ML20114D641 (48) | |
Text
- _ _ _ _ - _ _ - - .
i
~
GE Nuclear Enecyy August 26,1992 Mr. D. M. Crutchfield Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555
Dear Mr. Crutchfield:
Subject:
GE Evaluanon of Commen Mode Failure of Diaital InstrimtgBLgRon & Q1ntmL Dated 4. tag 6,1922 ,
Attached to this letter is GE's evaluation of the sublect coLunon mode failure
~
analysis that was previously provided to you on June 8,1992. This evaluation idenufles the set of safety-grade control room displays and controls, independent of the computer systems, which could satisfy the staff's proposed position.
By providing this analysis, GE has not changed its position that the proposed staff policy recommendation is unnecessary. The ABWR I&C design represents a substantial improvement over present operating plants, both in redundancy and diversity and, we believe, adequately addresses the staff's expressed concerns.
Sincerely y urs, k 'l J. F. Quirk Program Manager ABWR Certification Programs Attachment JFQ/J
- )
/ le Y up, resw]
- g*;8paa3%jjg g22
'p .
- I l :i , .I j i .
.s m .
m YM TO E
F O n A
SL R i l
a .
n ita D O R o i E T i
t a il n
R IN i t
i a WO i n u n
DC l a a RN u m n e AI .
HA a v .
YM ml a s
'e v u LN L I l v n a o t
t a
s )
A NLS _
)g n
v it n la m r v s e
o o m OO i a r s l m
t s
i t s l a u a v r TRT I
i x a i a l a
t a n >
o e l
N )g (e n )3 t o u E N n s i l )h s _
i l e g e i e VO i t
s l
o e m v i v t
a t NC OD i
x t
r n
o i
l n
t a
e e
(l e (h
e l
a v
l o s s w _
(e i _
U s l e
l r r n
- CN mV c C C v e v u s
u s o e r n
t a
i l m D
TY 3 r c
s S
M R R l
r e
l r
e e
r p
e r
p l
o ms a 1_
)d )d t t s eV 1
E SLA l
a u
i s ar u o o r
a a
wwe a l l
l l
e i
U t
s 1
EP h n b b V V wwC C S1 _
a a n n y y WC I _
y TS I P P r r R RM m m (i (i R R d d _
A D D l y _
o r
a .
2 S IE t 1 3 4 l p
1 2 3 4 5 ?.
DD n s 1_
o NA i _
C D _
AR 1
CG
?
- i
= , ,
i
DRAFT 5/21/92 EVENT: 15.1.2.2.1.2 RUNOUT OF TWO FEEDWATER PUMPS This event is postula*ed to occur coincident with a undiscovered common mode f ailure of the Essential Multiplex System (EMUX) iri such a manner that all valid and correct EMUX control and monitoring data transmissions are lost.
AUTOMATIC AOTIONS Refer to Table 15.1-5 for a description of the sequence of events. After runout of the two feedwater pumps,7P'! water level reaches Level 8 and wiil result in tripping (signals independent of EMUX) of the main turbine and the fecdwater pumps. Reactor scram and tnp of 4 RIPS are actuated by turt*ie stop valve closure position hardwired signals to the RPS. The pressure control system automaticas, controls reactor pressure by modulating of the turbine bypass valves. Several SRVs will open rnomerlarily on spring pressure.
EOP ENTRY CO.*1DITIONS:
According to Table 15.1-5. RPV water level drops to Level 2 in approximately 40 seconds after initiation of the feedpump runout. The following alarm is provioed by equipment independent of the EMUX. This alam1 (RPV water level low is at Level 3) is an entry condition for emergency operating orocedures.
SAR Appendix 18F Reference
i OPERATOR ACTIONS PER EOPS For this event scenario, the pressure control system automatically controls reactor pressure by controlling the turbine bypass valves.
1 Enter EOPs developed f rom the RPV Control Guideline, upon receiving the RPV Water Level 1 ow alarm.
- 2. Rostore and maintain water level (water level signal is hardwired) above Level 3 using the standby feedpump or restarting the feedpumps that had been tripped.
31 Operate the pressure control system and turbine bypass valves to initiate cootdown of the plant at a maximum rate of 100 'F/ hour.
- i. CONTAINMENT RESPONSE
' Since the reactor decay heat is being rejected to the main condenser, containment heat decay heat removal will not be required. Because ttie amount of steam discharged to tiie suppression is small, inhiation of suppression pool cooling using RHR will not be required for the first hour of this postulated scenario in which all operator actions are limited to those performed in the main control rcom. The RHR suppression pool cooling function is assumed to be not available because of the EMUX comtron rncde f ailure. Subsequent operator actions at the Remote Shutdown System willinclude initiation of the RHR suppression pool cooling function.
i l
l l
o
- .. -- ~ _ ..
i i .
)
I COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 assumeo automatic initiation of RCIC at Level 2. Sinco it is postulated that control of RCIC is not available because of the assumed common mode f ailure, manualinitiation of of the i standby feedpump by the operator would compensate for this failure. The Chapter 15 analysis did not take credit for the normal operation of CR0 which continuously inject water into the RPV through purging of the control rod drives.
SUMMARY
For the postulated tv3nt of runout of both feedwater pumps coincidant with an EMUX common mode f ailure, sutticient automatic control functens, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main control room for the first hour. Sutlicient water inventory is available for decay heat removal during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovey operations can be initiated using the Remote Shutdown System.
i l
J
1 DRAFT st21 m l
EVENT: 15.1.3.1.2.1 FAILURE OF TUREINE BYPASS AND CONTROL VALVES OPEN 1
l This event is postulded to occur coincident with a urx*iscovered common rr cde f allure of the Essential Multiplex System (EMUX) in scch a manner that all valid and correct EMUX control and monttoring data transmissions are lost AUTOMATIC ACTIONS Refer to Table 15.1-5 for a description of the sequence of events analyzed for the SAR. After a postulaMd failure of the prcssure control system to cause all control and bypass valves to open, the water level swell results in tripping of the main turbine and feec%ater pumps at Level 8 (signals independent of EMUX). The turbine trip results in scram signals (ha.dwired) from stop valve position sensors. Becauso feedwater is available, RPV water level will be maintained above Level 2 avoiding the need to
- automatically initiate RCIC. The MSIVs will not automatically close on low turbina intel pressure because this pressure signalis normally multiplexed via EMUX and is postulated to be updating with normal (but incorrect) process values as the common mode failure.
EOP ENiRY CONDITIONS:
The following alarm is providad by 9quipment independent of the EMUX. This alarm conditon is an entry condition for emergency opernting procedures.
SAR Appendix 18F Reference
OPEF:ATOR ACTIONS PER EOPS For this event scenario, the f eedwater control system automatically controls reactor water level Ly operation of the feedwater ard condensate system. It is assumed that because of tho failure of bypass valves in the open position, the bypass valves will remain open thus depressurizing tne RPV and removing decay heat to the main condenser. The turbine control valves are tripped close by action of the turbine trip.
- 1. Enter EOPs developed from the RPV Control Guiceline, upon receiving the RPV Water Level Low rearm.-
2, Restore and maintain wate. .avel (water level signalis hardwired) above Level 3 using the feedwater and condensate pu*nps. Since the bypass valves are open, the RPV is bcing depressurized and water inventory in the condenser hotwell is assured by condensation ut steam through the bypass valves while RPV inventory is maintained by the feedwater and condensate system. Thus, there is no need to go to the Remote Shutdown System until it is desired to cooldown the plant CONTAINMENT RESPONSE Since no steam is discharged to the containment, the containment parameters will remain within their normal operating values.
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 assumed the feedwater nnd condensate system is not avaihble at the outset of thi*, transient and hence automatic initiation of RClO at Level 2. Since it is assumed in this scenario that the feedwater and condensate system is available, RPV Level 2 is not reached.
SUMMARY
For the postuuted event of the turbine control and bypass valves hiling in the open position coincident with a.) EMUX common mode failure, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigcte the event, assuming that all operator actions will be limited to the main control rcom for the first hour, Sufu. ant water irwentory is available for decay heat removal during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery operations can be initiated using the Rertr;te Shutdown System.
4
a DRAFT s/2us2 1
EVENT; 15.1.6 INADVERTENT RHR SHUTDOWNING COOLINO OPERATION This event is postulated to occur coincident y r a undiscovered common mode failure of the Essential 1 Multiplex System (EMUX) in such a rnanner l' e all valid and correct EMUX control and rnonitoring data l transmissions are bst.-
AUTOMATIC ACTIONS Rcter to subsection 15.1.6 of the SAR for a detailed description of this event. The conclusion from SAR analysis is that if this event occurs during a reactor startup or cooldown with the reactor critical or near criticality, a slow power increase result from cooler moderator will result in a reactor scram (Neutron Monitoring instruments, scram signai to RPS independent of EMUX) if the operator does not take action to terminate the slow power increase.
SUMMARY
i For the postulated event of inadvertent cooling of the reactor coincident wr4,S f!CUX common mode l f ailure, sufficient automatic control f unctions, information, and controls that s Independent cf EMUX are available in the main control room to mitigate the event, assuming that all opc or actions w?1 tv IwTfed to 'he main control room for the first hour. For this postulated event, the normai HHR shutdown cooling h in operation and continues to be in operation for this commom mode f ailure.
i DRAFT 5/2&92 EVENT: 15.2.1.1.2.2 PRESSURE REOULATOR DOWNSCALE FAILURE This event is postulated to occur coincident with a undiscovered common mode f allure of the Essential Mutiplex System (EMUX) in such a mannor that all valid and correct EMUX control and monitoring data transmissions are lost.
AUTOMATIC ACTIONS A pressure regulator failure downscale will result in closure of the turbine control valves whose rate is limited by the stroke rate of the valves. Neutron flux increases rapidly and results in a reactor scram.
The neutron flux scram signals to RPS are independent of EMUX. Because the main condenser heat sink is isolated from the mactor, reactor decay heat is removed through SRV discharge to the suppression pool The SRVs open on spring setpoint since it is assumed that the SRVs cannot be open n,22 mrmal relief rrode due to the postulated common mode f ailure. RPV makeup is performed automatcany of M Isadwater centrol system.
EOP ENTRY CONDITIONS:
The following alarm condition is provided by equipment independent of the EMUX and is an entry condition to the emergency operating procedures.
SAR Appendix 18F Reference
OPERATOR ACTIONS l' For this event scenario, the feedwater 0.ontrol system automatically controls reactor water level by operation of the feedwater and condensate system. It is assumed that because of the tailure of the pressure regulator, the bypass valves can not be open for decay heat removal.
- 1. Enter EOPs developed from the RPV Control Guideline, upon receiving the RPV Water Level Low alarm.
- 2. Restore and maintain water level (water level signalis hardwired) above Level 3 using the feedwater and condensate pumps.
CONTAINMENT RESPONSE Since steam is discharged to the suppression pool, suporession pool temperature will increase. As
~ calculated for the Steam Line Break Outside Containment event, the suppression pool temperature rise due to the integrated decay heat for one hour was estimated to be approximately 40 'F. For one hour, condenser hotwell inventory needed for decay heat removal is consarvatively calculated to be approximately 23% of the totalinv6ntory in the hotwell. It is concluded that initiation of suppression poci cooling using RHR will not be required for the first hour of this postulated scenario in which all operator actions are limited to those performed in the main control scom. The RHR suppassion pool cooling function is assumed to be not available because of the EMUX common mode failure. Subsequent cperator actions at the Remote Shutdopwn System wil' inc:ude initiation of the RHR suppression pool cooling function.
I
^
COMP,ARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 only simulated the first six seconds of the pressure regulator downscale f atture event. The primary purpose is to analyze the effect on fuel thermat margins.
SUMMARY
for the postulated event of pressure regulator downscale f ailure causing all turbine control valves to close coincident with an EMUX common mode failure, sufficient automano control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main control room for the first hour. Sufficient water inventory is ava"able for decay heat removal during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery operations can be initiated using the Remote Shutdown System.
DRAFT 5/26/92 EVENT: 15.2.2.2.1.3 GENERATOR LOAD REJECTION WITH FAILURE OF ALL BYPASS VALVES, i 15.2.3.2.1.3 TURBINE TRIP WITH FAILURE OF ALL DYPASS VALVES )
l i
These events are postulated to occur coincident with a undiscovered common mod 9 failure of the Essential Multiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transtnissions are lost. The reactor response to these two events are similar.
AUTOMATIC ACTIONS Upon a turbine / generator trip, the reactor scrams immediately. The scram signals generated by turbine
- stop valve or control valve instruments are hardwired to RPS. The SRVs open on spring setpoint since it is assumed that the SRVs cannot be open by l's normal relief inode due to the postulated common mode f ailure. RPV makeup is performad automatically by the f eedwater control system.
l EOP ENTRY CONDITIONS:
l The following alarm condition is provided by equipment independent of the EMUX and is an entry condition to the emergehcy operating procedures:
SAR Appendix 18F Reference
OPERATOR ACTIONS For this event scenario, the feedwater control system automatically controls reactor water level by operation of the feedwater and condensate system. It is assumed that because of the f ailure of the bypass valves, the bypass valves can not be reopen for decay heat removal.
- 1. Enter EOPs developed from the RPV Control Guideline, upon receiving the RPV Water Level Low alarm. ,
- 2. Restore and maintain water level (water kvel signalis hardwired) above Level 3 using the feodwater and condensate pumps.
CONTAINMENT RESPONSE Since steam is discharged to the suppression pool, suppression pool temperature will increase. As calculated for the Steam Line Break Outside Containment event, the suppression pool temperature rise
- due to the integratsu decay heat for one hour was estimated to be approximately 40 'F. For one hour,
- condenser hotwellinventory needed for decay iioat removal is conservatively calculated to be L approximately 23% of the totalinventory in the hotwell it is concluded that initiation of suppression poo!
cooling using RHR will not be required for the first hour of this postulated scenario in which all operator actions are limited to those performed in the main control room. The RHR suppression pool cooling function is assumed to be not available because of the EMUX common mode failure. Sa'bsequent operator actions at the Remote Shutdopwn System willinclude initiation of the RHR suppression pool cooling function.
l l
l
l COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 only simulated the first five seconds of the turbine / generator trip with bypass fallute event. The primary purpose is to analyze the effect on fuel thermal margins.
~
SUMMARY
For the postulated event of turbine trip or generator trip with total tailure of the bypass valves coincident with an EMUX con %wn mode failure, sufficient rutomatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main controi room for the first hour. Sufficient water inventory is available for decay heat removal during that one hour period, Subsequently, reactor cold shutdown conditions and post accident recovery opereticas can be inrtiated using the Remote Shutdown System.
]
l t . .
DRAFT seas 92 EVENT:15.3.1.1.2.2 TRIP OF ALL INTERN AL REdlRCULATION PUMPS (RIPS)
This event is poshlated to occur coincident with a undiscovered common mode 1ailure of the Essential Multiplex System (J"' y in sucn a manner that all valid and correct EMUX control ard monitoring data transmissions are lost.
AUTOMATIC ACTIONS Upon tripping of all RIPS, the reactor is automatically scrammed on a high rate of change of core flow.
The scram signals generated by high rate of change of core flow instruments are hardwired to RPS.
Because of the RPV water level swell, RPV water level reaches Level 8 and trips the main tuttine and the feedwater pumps. The turbine bypass valves open after the turbine trip and certain SRVs open on spring -
setpoint since it is assumed that the SRVs cannot be open by its normal relief mode due to the postulated comnon mode f ailure.
EOP ENTRY CONDITIONS:
The following alarm condition is provided by equipment independent of the EMUX and is an entry condition to the emergency operating procedures:
SAR Appendix 18F Reference
- 1. RPV WATER LEVEL LOW (FIXED POSITION), column 8.1BF-14 OPERATOR ACTIONS The principal operator actions are:
- 1. Enter EOPs developed f rom the RPV Control Guideline, upon receiving the RPV Water Level Low alarm.
- 2. Restart one feedpump and restore and maintain water level (water level signal is hardwired) above Level 3.
CONTAINMENT RESPONSE Since the reactor decay heat is being rejected to the main condenser, containment heat decay heat removal will not be required. Because the amount of steam discharged to the suppression is small, initiation of suppression pool cooling using RHR will not be required for the first hour of this postulated scenario in which all operator actions are limited to those performed in the main control room. The RHR suppression pool cooling function is assumed to be not available because of the EMUX common mode f ailure. Subsequent operator actions at the Retrote Shutdown System willinclude initiation of the RHR suppression pool cooling function.
1
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 assumed operability of the SRVs in the normal relief mode. For the purposes of thir analysis to examine the control and monitoring capability after a common rnode EMUX failure, the SRVs are assumed to open when their spring setpoints are exceeded.
SUMMARY
l For the postulated event of tripping of all RIPS coincident with an EMUX common mode feiture, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main control room for the first hour. Sufficient water inventory is available for decay heat removal during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery oparations can be initiated using the Remote Shutdown System.
l 5
)
DRAFT sissa EVENT:15.4.5.1.2.2 FAST RUNOUT OF ALL INTERNAL RECIRCULATION PUMPS (RIPS)
This event is postulated to occur coincident with a undiscovered common mode f ailure of the Essential Multiplex Systcm (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transmissions are lost.
AUTOMATIC ACTIONS Upon fast runout of all RIPS, the reactor is automatically scrammed on high APRM. The scram signals generated by APRM instruments are hardwired to RPS. The pressure and feedwater control systems continue to operate to control reactor pressure and RPV water level. The pressure control system will close the turbine control valves after the scram, and later reopen the turbine bypass valves when pressure exceeds the setpoint of the pressure regulator for decay heat removal.
EOP ENTRY CONDITIONS:
The following alarm condition is provided by equipment independent of the EMUX and is an entry condition to the emergency operating procedurcs:
SAR Appendix 18F Reference
OPERATOR ACTIONS For this event scen.1rio, the pressure control and feedwater control systems coritinue to operate.
Theoretically, no operator actions will be required as decay heat removalis through the turbine bypass valves to the main condenser and RPV water level is controlled by the feedwater control system. The principal operator actions are:
- 1. Enter EOPs developedirom the RPV Control Guideline, upon receiving the RPV Water Level Low alarm.
- 2. - Restore and maintain water level (water level signalis hardwired) above Level 3 using the feedwater control system.
- 3. Cooldown the RPV using the turbine bypass valves.
CONTAINMENT RESPONSE Since no steam is discharged to the containment, containment parameters are expected to remain within their normal values.
l 1
COMPARISON TO CHAPTER 15 ANALYSIS This analysis is consistent with the assumptions of the Chapter 15 analysis for this event. Water inventory is not an issue because of the closed loop condensate recirculation.
SUMMARY
For the postulated event of f ast runout of all RIPS coincident with an EMUX common mode failure, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main coritrol room for the first hour. Sufficient water inventory is available for decay neat removal durin0 that one hour ,alod. Subsequently, reactor cold shutdown conditions arni post accident recovery operations can be initiated using the Remote Shutdown System.
l l
l i
I l . _ ,
i DRAFT 5/21/92 EVENT: STEAM LINE BREAK OUTSIDE CONTAINMENT This event is postulated to occur coincident with a undiscovered common mode f ailure of the Essential Multiplex System (EMUX) in such a manner that a!' valid and correct EMUX control and rnonitoring data transmissions are lost.
AUTOMATIC ACTIONS After a steam line break outside containment, the pressure regulator will close the turbine control valves due to the rapid decrease . After turbine control valve closure, a generator trip is initiated by a main generator reverse power protection device, resulting in a reactor scram via hardwired signals to the RPS from the turbine control system. It is postulated that because of EMUX common nnde failure, the automatic isolation of the MSIVs is assumed to f ail.
EOP ENTRY CONDITIONS:
The following alarms aos provided by equipment independent ot the EMUX. These are the entry conditions for emergency operating procedures expected for steam line break outside the primary aontainment.
SAR Appendix 18F Reference
- 1. AREA TEMP HIGH [ FIXED POSITION], Column 8.18F-198
- 2. AREA RADIATION LEVEL HIGH [ FIXED POsmON], column 8,18F-206
- 3. AREA COOLER AT HIGH[ FIXED POslTION). column 8.18F-201
- 4. SECONDARY CONTAINMENT FLOOR DRAIN SUMP LEVEL Hi-Hi[ FIXED POSITION], Column 8,18F-209
OPERATOR ACTIONS PER EOPS For this event scenario, the normal feedwater and condensate system continues to operate to automatically control RPV water level. The feedwater level control system is a triplicated-channel control system independent of EMUX, The feedpumps and condensate pump equipment controls are also independent of EMUX. The expected principal operator actions are given herein. All control functions and process parameters are provided by equipment independent of EMUX.
1, Enter EOPs developed from Secondary Containment Contro! Guideline on either of the Entry Conditions.
- 2. Operate non-essential area coolers.
- 3. Operate non-essential secondary containment HVAC.
.4. Isolate the system discharging to the area (main steam system isolation controls are independent of EMUX ) when area temperature, or radiation level, or water level exceeds its maximum normal operating value. When the MStVs close, automatic reactor scram signals are generated from position switches at the MSIVs. The MSIV closure scram signals are hardwired signals to the RPS.
Concurrently with execution of the above actions, enter EOPs developed from the RPV Control Guideline on RPV Water Level Low as an entry condition. The following actions are executed concurrently with the above actions:
- 1. Initiate a manual scram if a scram has not been initiated automatically,
- 2. Cantrol RPV water level (water level signal is hardwired) with the feedwater and condensate system.
(Feedwater and ccndensate pumps are motor-driven and continue to operate after reactor isolation).
I l-i
CONTAINMENT RESPONSE Because the initial SRV opening on spring pressure after reactor ischtion, and the subsequent discharge of steam through a SRV to the suppression pool, suppression pool temperature increases. The increase in suppression pool temperature is calculated to be approximately 40 'F over a time period of one hour.
From this calculation, it is concluded that initiation of suppression pool cooling using RHR will not be required for the first hour of this postulated scenario in which all operator at tions are limited to those performed in the main control room. The RHR suppression pool ecoling runction is assumed to be not avalfable because of the EMUX common mode f ailure. Subsequent operator actions at the Remote Shutdown System willinclude initiation of the RHR suppression pool cooling function.
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 assumed automatic reactor isolation, automatic reactor scram, SRV operation to maintain pressure at appronately 1100 psig, and automatic initiation of RCIC and one loop of HPCF.
Since the feedwater flow capacity is much greater than the makeup capability of both RCIC and HPCF,in this scenario operators are able to restore and maintain RPV water level using the f eedwater control system with ample rnargin. The total amount of water required to remove decay heat for a period of one hour after a reactor scram is estimated to equal approximately 23% of the available water inventory in the main condenser hotwell.
SUMMARY
For the postulated event of main steam line break outside containment coincident with an EMUX common mode failure, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main coc. trol room to mitigate the event, assuming that all ope-a*or actions will be limited to the main control room for the first hour. Sufficient water inventory is availabis for decay heat scmoval during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery 0perations can be initiated using the Remote Shutdown System.
I
DRAFT s/23/92 EVENT: LOCA INSIDE CONTAINMENT This event is postulated to be a break of HPCF(C) line coincident with a undiscovered common mode f ailure of the Essential Multiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transmissions are lost.
AUTOMATIC ACTIONS A!!er a HPCF(C) line break inside containment, the reactor would expected to automatically scram on High Drywell Pressure. Because of the assumed EMUX common mode f ailure, this scram is postu!ated to f ail. In addition, all ECCS systems are assumed not be available because of the postulated commy-mode failure and the break postulated in HPCF(C). Systems such as the feedwater and condensate system, and the pressure control system are assurned to be operable. For the postulated line break, tile RPV pressure will drop rapidly, resulting in closure of the turbine control valves by the pressure regulator and automatic scram signals (hardwired) from the subsequent turbine trip. When RPV pressure increases above the setpoint of the pressure regulator, the bypass valves open to control reactor pressure. Refer to Figures 1 through 5 for the reactor response to the break .
EOP ENTRY CONDITIONS:
The following alarms are provided by equipment independent of the EMUX. These are the entr/
conditions for emergency operating procedures expected for a LOCA inside the primary containment from instruments that are hardwired.
SAR Appendix 18F Reference
- 1. DRYWELL PRESSURE HIGH [ FIXED POSITION]. Column 8.18F-121 i
OPERATOR ACTIONS PER EOPS The expected princ d operator actions are given herein. All control functions and process parameters i
are provided by equipment independent of EMUX.
Upon entering the EOPs developed from the RPV Control Guideline on High Dryweli Pressureas an entry condition, and concurrently enter EOPs developed from the Primary Containment Control Guideline on Dr:well Pressure High alarm as an entry condition, the following sets of actions are executed concurrently:
I, RPV Control I- 1. Initiate a manual scram if a scram has not been initiated ,
- 2. Restore and maintain RPV water level (water level signal is hardwired) above Level 3 using the feedwater condensate system. Since the postulated break is located at the HPCF(C) injection line which is below Level 1 but above top of the active fuel, water will spill out the break and into the drywell.
3, if Ri - water level cannot be maintained above Level 3, maintain RPV water level above top of the active fuel.
- 1
OPERATOR ACTIONS PER EOPS (c "alnued)
II. Pomary Containment Control:
- 1. Initiate wetwell sprays using the fire protection system and the firewater addition mode of RHR(C) for primary containment pressure control.
2 11 necessary, inftiate drywell spray using the fire protection system and the firewater addnion mode of RHR(C ) for pnmary containment pressure control (drywell pressure signalis hardwired).
CONTAINMENT RESPONSE As calculated for the Main Stearn Line Picak Outs #de Containment event, the suppression poot temperature rise due to decay heat over a penod of one hour was less than 40 #F. For this event, the suppression pool temperature rise is expected to be less than 40:F due to the wetwall and!of qwell sprays initiated by the operator.
LOCA ANALYSIS -
The complete circumferential break of the HPCI.m injection line was analyzed. For this case only the feedwater and control rod drive makeup systerr" %re assumed to be available for RPV makeup. The feedwater takes suction frem the hotwo" Mch , utds enough water to provide 4 minutes of rated feedwatt;r flow. It was assumed that the operator took action to scram the reactor within 30 seconds following the break. This leaves the water volume in the hotwell equal to 3.5 minutes of rated feedwater flow. T he ChD injection flow to the RPV was rnaximimized.
After scram the feedwater and CRD maintain the level in the reactor at norma! water level (see Figure 1).
Since no credit is taken for any makeup to the hotwell from the CST. at about 2150 seconds the water in the hotwellis depleted and feedwater injection ceases. The CRD continues to inject water into the vessel but it is not enough to overcome the break flow. The water level continues to drop. When the break uncovers at about 2450 seconds vessel depressurization begins (see Figure 2). Core uncovery occurs at about 3250 socorids (see Figures 3 and 4) and core heatup begins (see Figure 5). At 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> from the start 01 the event the peak cladding temperature is only about 14')0 *F which is well below the 2200 *F limit.
SUMMARY
For the postula*ed event of HPCF(C) line break insim the containment, sufficient automatic control .
functions, information, and controls that are independent of EMUX are available in the main control rem to mitigato the event and maintain the fuel clad temperature below its limit, assuming ' Pat all operator actions will be limited to the main control room for the first hour. Sufficient water inventory is available for decay heat removal during that one hour period. Subss cently, reactor cold shutdown conditions and post accident recovery operations can be initiated using the Remote Shutdown System.
3 J
1
)
i ,;! ;!!I ry:!}i { -
'0 1
i 8
2 D
I t L 3 0
K E N U S F E
D E I
S T i V .
'2 6 U f ^
O C -
L E
A 3 V F E
L O -
R E
T P A O k' T 2
E D L 2 3 UKB )
OAA REL HRI 3
D.
SBA V .N.
EEA DN I ID ' 4 O
SLR T
UN OOD L
EC I
C I
T 'A 2
\ C E
S VER 3
(
EJE LNT IA R W EFD TCE APE 4HF 2 E
~
M.
I 1_ .
2
.T e -
r 3 ' .
u' g : '
i F '
l iV3
, 2 .
0 0 0 0 0 6 4 2 mlIJv J_W>La J_ O'LF<
U C3 .
!l!;<
s
- . ~
W
!- Figure 2- VESSEL PRESSVRE
!= IIPCF INJECTION LINE BREA8C '
F FEEDWATER AND CRD AVAILABLE' p g2
! . x 10'
- VESSEL PR. ESSURE i
't 1-e i
3' 1
- 0. 8 I'
- i. 'O 4
Q_ . N ,
4 v N f
l'
[
1 g
3 O. 4 w
~
l -
p g ,
- y -
x E [
Q_ _
i
- g; i- t i i l1 ti i
! 4. 6.
0'. 2. 8. = 10' l- TIME (SECOND).
j , . r : ,l! . !! : f. ' ,i ! !l! ;l,i!!lll, YIl!!! ;
'0 1
a 5,! il 8
i z
M M _
U U .
N lS 6 E EtE L L B i P PUT 4 .
S R S R E. 2 DKB UAA E
L EAE PPWI D.
PYOU UBLG m .
\
OEL i2 3
- RRI H3A i
)
S EA V
4 D
EN 2 N-DI D .
ILR 4 S
NN C O I OD I N C.
2 4 S.
(
R W EFD TCE APE .
UHF E
3 i M
I e
r u' 2 T.
g i 2 a '
- F i
I 1
[ 2 a
. ~ __ .
l
. . - 0 .
0~ 0 0 .
O 6 4 2 1
o LJ' rJ CR CLlt <
AWav
. ?3li : j !4 li)]yi l1! j{ !Iii .'
).. .,
a r
7 Figure 4' WATER LEVEL IN' FUEL CHANNELS HPCF INJECTION LINE BREAlt j FEEIKEAT67 AND CRD AVAILOLE .
t.
k i . 60.
j i HOT CHAN'NEL-L 2 AVERAGE CFANNEL i s TOP : OF ACINE FUEL L
i i.
4 s
40.
i l n
!. F-g j- 2 -2 2 ,a .1
- v ' ' '
x --
j 1 7
! ; j p i N !
~,
' )
I J
\ .2l [
i { f; t- ( l J
^
U i
- >W f(_ l I
_J 20-i O' _
Lij _
F-4 3 ~
- 0. _ ' ' b ' ' ' '
~
l.
- 0. 2. 4. 6. 8. = 10' TIME ..
(SECOND)
I. qm..
j- .
c ,
j- Figure 5 PEAK CLADDING TEMPERATURE l' '
' HPCF INJECTION LINE BREAK FEEIT. TATER AND-CRD AVAILABLE F
- 2. 4 x10' i . PEAK CLAD TEMPERATURE
- 5. A
- Lt_
- 1. 6
- .O ,
g
- O i .
e 4 v e i:
1 i' LJ ,
i- Cr
- .. .--)
i- I- Og
<C ._ /
' O' ._
, /
LU '
l O_ _
-A
{ 2 --
LtJ i _
l l-- _
i -. _
l O. - ' ' I ' ' ' '
,. 1 O. 2. 4. 6. 8. > 10' TIMF (SECOND) . .-. . . . _ . _ - . _- _ _ _ _ -- _ - _ _
DRAFT 5/21/92 EVENT: FEEDWATER LINE DREAK OUTSIDE CONTAINMENT This event is postulated to occur coincident with a undiscovered cornmon mode f ailure of the Essential Multiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transmissions are lost, AUTOMATIC ACTIONS After a feodwater line break outside containmeat, the feedwater line check valves isolate :he ret: tor from the break. The reactor would expected to automatically scram on RPV Water Level 3. Because of the ,
assumed EMUX mmmon modo failure, this Lovel 3 scram is postulated not to scram the reactor ,
autornatically. If a reactor teram is not init!ated by the ope ator, the ATWS logic is activated when RPV water level drops to Level 2 and the neutron flux is not downscale. ATWS will automatically initiate ARI and FMCRD Run-In and trip spectied number of RIPS. The ATWS logicis independent of EMUX. In addition, RCIC and HPU are assumed not be functional because of the postulated common mode failure and the feodwater line break. (Refer to Table 15 G-15 for a description of the sequence of events analyzed for the SAR )
EOP ENTRY CONDITIONS:
The following alarms are provided by equipment independent of the EMUX. These are the entry conditions for emergency operating procedures expected for steam line break cuiside the primary containmenti SAR Appendix 18F Reference
- 1. SECONDARY CONTAINMENT FLOOR DRAIN SUMP LEVEL M4MFIXED POSITION), column 8.18F-209
- 2. HPV WATER LEVEL LOW [ FIXED PoslTION), Column 8.18F-14 OPERATOR ACTIONS PER EOPS The expected principal operator actions are given herein. Allcontrol functions and process parameters are provided by equipment independent of EMUX.
- Upon entering the EOPs developed f rom the RPV Control Guideline on RPV Water Level Low as an entry condition, and concurrently entering the EOPs developed from the Secondary Containment Guideline, the following sets of actions are executed concurrently:
- 1. RPV Control
- 1. Initiate a manual scram 11 a scram has not been initiated .
- 2. Restore and maintain RPV water level (water level signal is hardwired) above RPV Water Level 3 using the CRD system (both pumps).
- 3. ' The triplicated channel pressure control system automatically control RPV pressure by modulating the turbine bypass valves to control reactor pressure at its setpoint value.
4; When RPV water level cannot be restored and maintained above top of the active fuel, depressurize the reactor using the turbine bypass valves The CRD normally is aligned to take suction from the condensate system. It can also take suction from the CST. Ample water inventory is available f rom the CST and the hotwell since the steam through the turbine bypass valves cender:ses in the hotwell and the hotwel rejects water to the CST.
OPERATOR ACTIONS PER EOPS(continued)
- 11. Secondary Containment Cont ol.
1 Operate ron-essential area coolers.
2 Operate non-essential secondary containment HVAC.
3 It.otate systems discharging to the area 'feedwater system isolation controls are independent of EMUX ) when area ternperature, or radiation level, or water level exceeds ita maximum normal operating value in the steam tunnel area CONTAINMENT RESPONSE Since the turbine bypass valves open to control reactor pressure, all containment parameters are expected to remain within their normal operating values.
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 assumed automatic reactor scram at Level 3 automatic initiation of one of the two HPCF systems, SRV operation to maintain pressure at approximately 1100 psig.(taking no credit for pressure control system operation to control pressure), Assuming normal operation of the pressure control system SRV opening will not be required. In this analysis, a reactor scram will be initiated automatically on RPV water Level 2 it the operator his not manually initiated a scram. The CRD flow to the RPV is maximized in an attempt to restore and maintain water level above Level 3. Decay heat removalis via the turbine bypass valves since the MSIVs are postulated to remain open 11 water level drops below its isolation setpoint because of the EMUX common mode f ailure, No credit was taken for RPV injection using the firewater protections systern and the firewater additon mode of RHR(C), The CRD pumps alone cannot ma ntain RPV water level dbove the top of the active fuel The peak fuel clad temperature for this postulated event is bounded by the analysis performed for Feadwater Line Break inside Containment which was approximately 1857 'F. This is well below the limit of 2200 'F.
SUMMARY
For the postulated event of main f eedwater line break outside containment coincident with an EMUX ccmmon mode f ai!ure, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main control room for the first hour. Sufficient water inventory is available for decay heat removaldunng that one hour period. Subsequently, reactor cold shutdown conditons and post accident recovery operations can be initiated using the Remote Shutdown System.
1
DRAFT saaw EVENT:15.2.1.1.2.1 INADVERTENT CLOSURE OF ONE TURBINE CONTROL VALVE This event is posti,tated to occur coincident with a undiscovered comnun mode f ailure of the Essent!al Muh' plex System (EMUX) in such a manner that all vahd and correct EMUX control and rnoni'enng data transmissions are lost.
AUTOMATIC ACTIONS Upon inadvertent clot.ute of one turbine control valve, the reactor is automatically scrammed on high APRM. The scram signats generated by APRM instruments are hardwired to RPS. After the reactor sc am, the pressure regulator closes the turbine control valves and bypass valves. When pressure increases above the pressure regulator solpoint due to decay herit, the turbine bypass valves open to control pressure. The feedwater control systems continues to operate to control RPV water level.
EOP ENTRY CONDITIONS:
The following alarm condition is pn ded by equipment independent of the EMUX and is an entry condition to the emergency operating procedures:
SAR Appendix 18F Ref erence 1, RPV WATER LEVEL LOW [FlXED PostT10N), Column 8.18F-It OPERATOR ACTIONS For this event : c enano, the pressure control and feedwater control systems continue to operate.
Theoretically, no operator actions will be required as decay heat removalis through the turbine bypass valves to the main condenser and RPV water levet is controlled by the feedwater control system. The operator may enter the EOPs:
- 2. Restore and maintain water level (water level signalls hardwired) above Level 3 using the feedwater control system. ,
- 3. Cooldown the RPV using the turbine bypass valves.
CONTAINMENT RESPONSE Since no steam is discharged to the containment, containment parameters are expected to remain within their normal values l
l l
l
COMPARISON TO CHAPTER 15 ANAL.YSIS This analysis is consident with the assumptions of the Chapter 15 analysis for this event. Water 4 inventory is not an a ce because of the closed loop condensate tecirculatb9.
SUMMARY
For the postulated event of f ailure of one turbine control valve coinciderit with an EMUX common mode f ailure, sutticient automatic control functions, informatsn, and controls that are independent of EMUX are available in the mairt control room to mitigate the event, assuming that ail operator actions will be limited to the rnain control room for the first hour. Sufficient water inventory is available for decay heat ternoval dt:::ng th&, one hour period. Subsequently, reactor cold shutdown condaions and post accident recovery operations can be initiated usirg the Remote Shutdown System.
M
_ _ _ _ _ _ ________.____._._..m_________.____.-__m_ _-_ _ _-. _ ___________ -.___._..___m_____. _ _ _ _ ______ _ _ - _ -_ _ _ _ _ _ ___ - - _ _ __ _ _ _ _ _ _ _ _ _ . _ _ __..- _ _ _ _ _____ _ _ _ _
DRAFT s/2c/92 EVENT: 15.2.2.2.2.1 GENERATOR LOAD REJECTION WITH NORMAL BYPASS, 15.2.3.2.1.1 TURBINE TRIP WITH NORMAL BYPASS These events are postulated to occur coincident with a undiscovered comrron mode f ailure of the Essential Muttiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transmissions are lost. The reactor respon6e to these two events are similar.
AUTOMATIC ACTIONS 6
Upon a turbine / generator inp, the reactor scrams immediately. The cram signals generated by turbine stop valve or control valve lictruments are hardwired to RPS. Upon turbin3/ generator trip, the bypass valves automatically open to control reactor prescure. The SRVs open on spring setpoint since it is assumed that the SRVs cannot be open by 45 normal re.ief mode due to the postulated common mode failure. RPV mak;up is perforrned automatcally by the feedwater control system.
EOP ENTRY CONDITIONS:
l The following alarm conditon is provided by equipment independent of the EMUX and is an entry
, condition for the emergency operating procedures:
SAR Appendix 18F Re,terence ,
1, RPV WATER LEVEL LOW [riXED PoslTION), Cdumo 8,16F-14 l OPERATOR ACTIONS l
For this event scenario, the feedwater co trol system controls reactor water level by operation of the feedwater and condensate system Automatic pressure controlis performed by the pressure control system by manipulating the tuitine b)rass valves. Theoretically, no operator actions will be required during the first hour after the scram. The operators enter the EOPs:
. 1. Enter EOPs developed from the RPV Control Guideline, upon receiving the RPV Water Level Low L alarm.
[
2, Restore and maintain water level (water level signalis hardwir9d) above Level 3 using the feedwater l and condensate pumps.
- 3. Cooldown the RPV using the turbine bypass valves at a maximum rate of 100 *F/ hour, if desired.
1 CONTAINMENT RESPONSE Immediately after a turbine!genertor trip, the bypass valves automatically open. Becme the capacity of the bypass system is only 30% steam is discharged throue me SRVs for a short time. The suppression pool temperature rise is expected to be small. It is concluded that initiatbn of suppression pool cooling us.1l1 RHR VMI not be required for the first hour of this postulated scenario in which all operator actions are umited to those perforrned in the main controi room. The RHR suppression pool cooling function is l assumea to be not available because of the EMUX common node f ailure. Subsequent operator actions I
at the Remote Shutdopwn System will include initiation of the RHR suppression pool cooling function.
l' COMPARISON TO CHAPTER 15 ANALYSIS The analysis iri Chapter 15 only sitnulatod the first five seconds of the turbine!g?nerator trip with bypasa !
event. T he SRVs are assumed to automatically open in the re:i f mode. The pnmary purpose is to I analyze the effect on suel thermal margins. Water inventory for decay heat removalis not an issue l' because of the closed loop condensate recirctulaton to and from the main condenser hntwell.
SUMMAR't i For the postulated event of turbine trip or generator trip with operation of all bypass valves coincident with l an EMUX common mode Iaibre suthcient automatic controlfunctions, infom1ation, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be limited to the main control room for the fit st hour. Suthcient water inventory is avai!able for docay heat removal during that one hour penod Subsequenuy, reactor cold shutdown conditions and post accident reccvery operations can be initiated using the Remote Shutdown System.
l o
i I.
DRAFT sets /92 EVENT: 15.2.4.1.2.1 INADVERTENT CLOSURE OF ALL MSIVS These event is postulateo to occur coincident with a urdiscovered common m0de f ailure of the Essential Multiplex System (EMUX) in such a manner that at valid acd correci EMUX control and tranitonng data transmissuns are lost.
AUTOMATIC ACTIONS Upon closure of the MSIVs the reactor is automatically scrammed. The scram signals generated by MSIV position instruments are hardwired ;o RPS. The SRVs open cn spring setpoint since it is assumed that the SRVs cannot be opeq by its normal reliet modo due to the postulated common mode failure.
RPV makeup is performed automatically by the feedwater control system.
EOP ENTRY CONDITIONS:
The following alarm condition is provided by equipment independent of the EMUX and is an entry condition to the emergency operating procedures:
l' SAR Appendix 18F Reference
OPERATOR ACTIONS For this event scenario, the feedwater control system maintains reactor water level by operation of the feedwater and condensate system. 'he principal operator actions are:
- 1. Enter EOPs developed from the RPV Control Guirieline, upon receiving the RPV Water Level Low alarm.
- 2. Restore and maintain water level (water level signalis hardwired) above Level 3 using the feedwater and condensate pumps.
CONTA!NMENT RESPONSE After the iviSIV closure, the SRVs open to discharge steam to the suppression pool. The suppression pool temperature rise was calculated to be approximately 40 S F (refer to analysis for Steam Line Break OutsidJ Containmont).11 is concluded that initiation of cuppression pool cooling using RHR will not be required for the fir it hour of this postulated scenario in which all operator actions are limited to those performed in the main control rean. The RHR suppression pool cooling function is assumed to be not available because of the EMUX common mode f ailure, Subsequent operator actions at the Renote Shutdopwn System will include initiation of the RHR suppression pool cooling function.
I-
l f
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 did not take credit for operabinty of the feedwater control system thus the calculated RPV water level dropped to Level 2 automatically initiating RCIC. The SRVs are assumed to automatically open he the reliet mode.
SUMMARY
For the postulated event an inadvertent closure of the MSIVs coincident with an EMUX common mode i f ailure, sutlicient automatic control functions, information, and controls that are independent of EMUX are -
available in the main control room to maigate the event, assuming that all operator actions will be timrted i to the main control room for the first hour. Sufficient water inveniory is available for decay heat removal during that one hour period. Subsequently, reactor cold shutdown corsditions and post accKlent recovery operations can be initiated using the Rornote Shu'.down System.
i 1
J I
t
(
r= , ea s e-, e- ~isw--+' =cm .-ww +--%- =,wwsw v-+-t-m -*~ v- ~ vw-9 m o v.v i w vwy-<w-- - - ,'-e.
DRAFT stac'92 EVENT: 112.5 LOSS OF CONDENSER VACUUM This event is postulated to occur coirodent with a undiscovered common nKde f ailure of the Essential Multiplex System (EMUX;in such a manner that all vald ard correct EMUX control and monitonng data transmissions are lost.
AUTOMATIC ACTIONS When condenser pressure increases above the turbine top setpoint, the turbine is tripped and the bypass valves automatcally open, increatine the rate of condenser pressure rise. Upon turbine tr.p, the reactor is scrammed via signals independant ut EidUX. At a specified higher condenser pressure, the turbine bypass valves are closed (the MStV isolaton functiol trom high condenser pressure is assumed to f ail -
since the s;gnals for isolation go through EMUX). The SRVs open on spring setpoint sin:e it is assumed that the SRVs cannet be voen by its normal relief rnodr. due to the postulated common mode wilure.
RPV maheup is periormed automa'ically by the 'eedwater control system.
6 EOP ENTRY CONDITIONS:
The following alarm conition is provided by equipment independent of the EMUX and is an entry condition to the emergency operating procodures:
SAR Appendix 18F Reference
- 1. RPV WATER LEVEL LOW [r!KED PoslTION1, column 8, IBF-14 OPERATOR ACTIONS For this event scenario, the feedwater control system controls reactor water level by operation of the -
feedwater and condensate system. The principaloperator actions are:
- 1. Enter EOPs developed from the RPV Control Guideline, upon receiving the RPV Water Level Low alarm.
- 2. Restore and maintain water level (water level signal is hardwired) above level 3 using the feedwater and condensate pumps.
CONTAINMENT RESPONSE After the MSIV clof,ure, the SRVs open to discharge steam tr '9 suppression pool. The suppression pool temperature i se was calculated to tw approximtely 40 (refer to analysis for Steam Line Break Outside Containment). It is concluded that initiattor.vi suppresson pool cooling using RHR will not be required for the first hour of this postulated scenario in which all cperator actions are liri"tod to those pedormed in the main control room. The RHR suppression pool cooling function is assumed to be not available because of the EMUX cornrion mode f ailur6. Subsequent operator actions at the Remote S5uldown System will include iniuation of the RHR suppresson pool cooling function.
- ~ _ - _ _ _ - _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _
COMPARISOld TO CHAPTER 15 AIJALYSIS The analysis in Chapter 15 did not take creds for operabilit/ of the f eedwater control sys'em thus the 3
calcutated RPV water level drop;ed to l evtl 2 eutomatically initiating RCIC. The SRVs are assumed to J autornatically open in the reiiet mode.
i S'JMMARY
- for the postulated event a loss - ' main CCndeneser vacuum Coincident with an EMUX common mode f ailure, sutitient automatic control f un; bons, information. and controls that are independent of EMUX are j available in the main control room to mitiga!e the event, assurning that all operutor actions will be limded to the matn control room for the hrst hour. Sufficient water inventory is available for ciecay heat removal l
during that one hout penod. Subsequently, reactor cold shutdoe conddsons and po!.t accident recovery operations can b9 initiuted using the Remote Shutdown Cystem f
t f3 u
DRAFT S W 92 EVENT: 15.2.6.1.1.1 LOSS OF AUXILIARY POWER TRANSFORMER This event is postulated to occur coincident with a undiscovered common mode failure of the Essential Multiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitoring data transmissiorn., .
- lost.
AUTOMATIC ACTION Refer to Table 15.2-16 for a detailed list of nequence of events for this transient analyzed in the SAR.
Loss of an auxiliary power transformer results in a generator trip. Upon generator trip, the reactor is scrammed via signals inJependent of EMUX. Power to the f eedwater pumps and condensate purnps is lost. The bypass valves open for a few socords because of the turblne tri - Condenwr pressure increases and closes the bypast valves isolating the reactor from its norm. heat sink. The SRVs open on spring r.etroint since it is assumsd that the SRVs cannot be open by its .1ormal relief mode due to the postulateJ co Timon mode Iallure.
EOP Ff 4TR'/ CONDITIONS:
The followir.g alarm condition is provided by equipment independent of the EMUX and is an entry l condition to the emergency operating procedures:
SAR Appendix 19F Reference
- 1. RPV WATER LEVE1. LOW [ FIXED POSilloN], Column 8.18F-14 OPERATOR ACTIONS The principal operator actions are:
- 1. Enter EOPs develcped from the RPV Control Guideline, upon receiving the RPV Watur Level Low alarm.
2, Restore and maintain water level (water level signal is hardwired) above Level 3 using a condensate pump and a feedpump, restoring power to these pumps utihzing the Combustion Turbine.
l CONTAINMENT RESPONSE After the MSIV closure, the SRVs open to discharge steam to the suppression pool. The suppression pool *emperature rise was calculaied to be .pproximately 40 'F (refer to analysis for Steam Line Break Outside Containment), it is concluded that initiation of suppression pool cooling using RHR will not be required for the first hour of this postulated scenario in which all operator actions are hmited to those performed in the main control room. The RHR suppression pool cooling function is assumed to be not available because of the EMUX ccmmon mode f ailure. Subsequent operator actions at the Remote Shutdown System willinclude initiation of the RHR suppression pool cooling function.
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 did not take credit for operability of the feedwater control system thus the calculated RPV water level dropped to Level 2 automatically initiating RCIC The SRVs are assumed to automatically open in the relief mode. Without the operability of RCIC, decay heat removal can be achieved during an hour penod by feeding the RPV with the feedwater and condensate system to maintain water level as steam is discharged to the suppression pool.
SUMMARY
For the postulated event a loss of loss of auxiliary transformer coincident with an EMUX common trode f ailure, sufficient automatic control functions, information, and controls that are indeperdent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will bo limited )'
to the main control room for the first hour. Sufficient water inventory is available for decay heat removal during that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery operatons can be initiated using the Remote Shutdown System.
i t
1
DRAFT 5/21/92 EVENT: 15.2.7 LOSS OF FEEDWATER FLOW This event is postulated to occur coincident with a undiscovered common mode Iailure of the Essential Multiplex System (EMUX) in such a manner that all valid and correct EMUX control and monitonng data transmissions are lost.
AUTOMATIC ACTIONS Loss of feeowater flow is postulated not to result in a reactor scram on RPV Level 3 sinco this signalis processed by the EMUX. If a reactor scram is not initiated by the operator, the ATWS logic is activated when RPV water level drops to Level 2 and the neutro n flux is not downscale ATWS will automatically ,
initiate ARI and FMCRD Run-in and trip specified number of RIPS. The ATWS logic is indeperdent of EMUX. Automatic initiation of RCIC is also postulated not to occur due to the postulated EMUX common mode bilure. The MSIVs are assumed not to isolate on Level 2 because of the postulated EMUX common modo f ailure. Refer to Chapter 15 Appendix E for evaluction of ATWS performance.
EOP ENTRY CONDITIONS:
The following alarm condition is provided by equiomont independent of the EMUX and is an entry condition to the emergency operating procedures:
SAR Appendix 18F Reference
- 1. RPV WATER LEVEL LOW [FlXED POSITION), colun.n 8. IBF- tt OPERATOR ACTIONS The principal operator actions are:
l 1. Enter EOPc developed from the RPV Control Guideline, upon receiving the RPV Water Levellow alarm.
L
- 2. Initiate a manual reactor scram if scram has not been initiated.
- 3. Resto<e and maintain water level (water level signal is hardwired) above Level 3 using the CRD system.
! 4 Control reactor pressure for decay heat removal using the tubine bypass varves.
- 5. When RPV water levelcannot be restored and mair..zined above top of the active fuel, depressurize l the RPV using the turbine bypass valves.
- CONTAINMENT RESPONSE t
[
Since the SRVs were not open, containment parameters are evpected to remain within their normal
! values.
l i
COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 taneti credit for the operability of the Level 3 scram and automate initiation of j RCIC on Level 2. In this analysis, a reactor scram will bo initiated automatically on RPV water Level 2 l' the operator has not manually initiated a scram. The CRD flow 60 the RPV is maximized in an atterrpt to restore and mairaain watet level above Level 3. Decay heat removalis via the turbine bypass valves since the MSIVs are postulated to remain open af water level drops below its isolation setpoint because of the EMUX common modo failure. No credit was taken for addithna' water addition to the RPV using the firewater protection system and the firewater addition mode of RHR(C). The CRD purros alone cannot restore and maintain water level above the top of active fuel during the first hour after 110 postulated cvent. The peak calculated fuel clad temperature for this postulated event is bounded by that calculated for the Feedwater Line Dreak inside Containment which was 1857 'F. This is well below the limit of 2200 'F.
1
SUMMARY
For the postulated event of loss of feedwater flow coincident wdh an EMUX common mode failure, sufficient diversed automatic control functons, information, and controls that are independent of EMUX are available in the main control room to mitigate the event, assuming that all operator actions will be ,
limited to the main control room for the first hour. Sufficient water inventory is available for decay heat removal during that one hour period. Subsequently, RPV makeup and post accident recovery operations can be initiated ue r,g the Remote Shutdown System.
' , * ' ~ v + -- + -e.e . . . ,-. , _ . . . . , , . . . , , , . . . , , ,,,,,,,, , ,,, ,_, , , _ _. _ _
DF1 AFT s/2e92 EVENT: 15.4.1.2 INADVERTENT CONTROL ROD WITHDRAWAL DURING STARTUP This event is postulated to occur coincident with a undiscovered comrnon mode f ailure of the Essential Multiplex System (EMUX) lo such a manner that all valid and correct EMUX control and monitoring data f ranstnissons &re lost.
AUTOMATIC A(3 ONS
- Refer to Table 15.4-2 for the sequence of events analyzed in the SAR. For this postulated event, the neutron flux willincrease rapidly, resulting first in the rod block due to short reactor penod from the SRNM, which is independent of EMUX. Continued rod withdrawal will result in an automatic reactor ,
scram due to short reactor period from the SRNM Period-Based Trip function which is also independent of EMUX.
EOP ENTRY CONDITIONS:
1 None.
OPERATOR ACTIONS No action will be required to scram (N reactor as this postulated event is auiomatically terminated by a reactor scram. The RHR' autc'own cooling operation is terminated prior to control rod withdrawat to achieve criticality. If suffL;ient core decay heat exists, the reactor coolant temperature will rise stowly.
The CRD system continues to inject cold water into the RPV through the purging of the CRDs. This injection alone may be sufficient to limit the coolant temperature rise, if not, the feedwater condensato pumps can be used to inject water into the RPV and the RWCU can be used to reject water to the main condenser hotwell to limit the coolant temperature rise, I e., a feed-and-bleed operation. This condition can be maintained indefinitely and hence there is no urgency to initiate RHR shutdown cooling from the Remote Shutdown System.
CON TAINMENT RESPONSE Since no steam is discharged to the suppression pool, containment parameters are expected to remain within their normal range, COMPARISON TO CHAPTER 15 ANALYSIS The analysis in Chapter 15 only simulated the first thirty seconds of ie event.
SUMMARY
For the pwtulated event of a continuous withdrawalof control rods coincident with an EMUX common mode failure, sufficient autornatic control functions, information, and controls that ara independent of EMUX are available , the main control room to mitigate the event, assurning that all operator actions will be limited to the me antrol room for the first hour. Sufficient water inventory is available for decay heat removal during tha, heur period. Subsequently, reactor cold sh aldown conditions and post accident recovery operations can be initiated using the Remote Shutdown System.
, -- , , . - - - 1 --- . , , - - , . - - . . , - = , . . - - . - . . - . . - - , . - . .
DRAFT Sr29/92 EVENT: RWCU LOCA OUTSIDE OF THE PRIMARY CONTAINMENT :
This event is postulated to occur coincident with a undiscovered common mode f allure of the Essential Multiplex System (EMUX) in such a manner that all vald and correct EMUX control and monitoring data transmissions are lost, ,
AUTOMATIC ACTIONS Instruments are located at various areas in the secondary containment to detect reactor coolant leaks and provide isolation and alarms in the main control room. These instruments in the secondary containment will sense equipment area temperature, t.rea radiation level, area HVAC cooler differential temperature, floor drain sump level, and reactor building differential pressure. The Leak Detection and Isolation System uses high RWCU equipment area temperatures, diff erential flow, and RPV Water Level 3 signals to initiate automatic isolation of RWCU. For RWCU line break outside of the primary containment,it is postulated that because of the EMUX f aiiure, automatic isolation of RWCU will not occur. The feedwater control and pressure control system s are ,ndependent of EMUX and will continue to operate. Atter a reactor scram, these systems will function to remove decay heat utilizing the rnain condenser as the heat sink.
EOP ENTRY CONDITIONS:
The following alarms are pro,vided by equipment independent of the EMUX. These are the entry conditions for emergency operating procedures expected for RWCU LOCAs outside of the punary containment.
SAR Appendix 18F Reference
- 1. ARE A TEMP HIGH [FlXED PoslT10NJ, Column 8.18F-198
- 2. AREA RADIATlON LEVEL HIGH [ FIXED POsmON), Column 8.18F-2o6
- 3. AREA COOP.;I af HIGd [ FIXE 0 POslTION], Column 8.18F-2ol
- 4. sECONDAFIY CONTAINMENT Floor nRAIN SUMP LEVEL Hi-Hi[ FIXED PoslTION]. Column 8,18F-209 OPERATOR ACTIONS PER EOPS For this event scen0rio, the normal feedwater and condensate system continues to operate to automatically control RPV water levet. The feedwater level control system independent of EMUX. The feedpumps and coMensate pump equipment controls are also irdependent of EMUX. The expected principal operator actions are given herein All contrni functions and process parameters are provided by '
equipment independent of EMUX.
- 1. Enter EOPs developed from Secondary Containment Coroni Guideline on either of the Entry Conditions,
- 2. Operate available area coolers.
- 3. Operate available secondary containment HVAC.
4, if area temperature, or radiation level, or water level exceeds its maximum normal operating value, j_ isolate the RWCU1 .
l Execute steps 5 and 6 concurrently:
- 5. When an area temperature, or radiat:on level, or water level exceeds us maximum safe operating value :n more than one area, shutdown the reac'or using RFCS to reduce core flow and RCIS to insert control rods.
1 c aton RWCU isolation valve to be provided with control room manuai initiation capability and valve position ind' whch are hardwired and indepenoent of EMUX.
- 6. If RWCU system is discharging into th0 secondary containment:
(a) Defore any area terrpereture, or radiation level, or water level reaches its maximum safe operating value, enter the RPV Control procedures and initiate a manual scram. Control RPV water level (Water level signal is hardwired) using the feedwater and condensate system, and control RPV pressure using the turoine bypass valves.
(b) When an area temperature , or radiation level, or water level exceeds its maximum safe operating value in more than one area, emergency depressunzatbn is required. Rapidly depressuri2e the RPV using the turbine bypass valves.
CONTAINMENT RESPONSE Sinco no steam is discharge to the suppression pool, the containment parameters will remain within their normal operating values.
SUMMARY
For the postulated event of RV.CU *e break outside pnmary containment coincident with an EMUX common mode f ailure, sufficient automatic control functions, information, and controls that are independent of EMUX are avaHable in the main control room to mitigate the event, assuming that all operator actbns will be limited to the main control room for the first hour. Sutticient water inventory is available for decay heat removal dunng that one hour period. Subsequently, reactor cold shutdown conditions and post accident recovery operations can be initiated using the Remote Shutdown System.
l l
l DRAFT 5/19/92 EVENT: RCIC STEAM LINE BREAK OUTSIDE CONTAINMENT T_his event is postulated to occur coincident with a undiscovered common mode f ailure of the Essential M9hiplex System (EMUX) in such a manner that all valid and correct EMUX control and monnoring data transmissions are lost.
AUTOMATIC ACTIONS instruments are located at various areas in the secondary containment to detect reactor coolant leaks and provide isolation and alarms lli the main control room. These instrumente in the secondary containment will sense equipment area temperature, area radiation level, area HVAC cooler diiferential temperature, floor drain sump level, and reactor building ditferential pressule. The Leak Detection and isolation System uses hgh RCIC area temperature, high RCIC steam line flow, low RCIC steam line pressure, and nigh RCIC turbine exhaust pressure these signals to initiate automatic isolation of RCIC. For RCIC line break outside of the primary containment, N is postulated that because of the EMUX f aliure, automatic isolation of RCIC will not occur. The feodwater control and pressure control system s are independent of
.r MUX and will continuo to operate. Af ter a reactor scram, these systems will function to remove decay beat utilizing the main condenser as the heat sink.
EOP ENTRY CONDITIONS:
- The following alarms are provided by equipment independent of the EMUX. These are the elitry conditions for emergency operating precedures expected for RCIC steam line break outside of the primary containmont.
SAR Appendix 18F Reference
- 1. AREA TEMP HIGH [ FIXED PoslTION), column 8.18F-198
- 2. AREA RADIATION LEVEL HIGH [rIXED POslTION), column 8,18F-206
- 3. AREA COOLER AT HIGH [rIXED POSITION), Column 8.18F-201
- 4. SECONDARY CONTAINMENT FLOOR DRAIN SUMP LEVEL HMil[ FIXED PCslTION), column 8.1BF-209 OPERATOR ACTIONS PER EOPS for (Ns event scenarlo, the normal feedwater and condensate system continues to operate to automatically control RPV wator level The feedwater level control system independent of EMUX. The feedpumps and condensate pump equipment controls are also independent of EMUX. The expectcd principal operator actions are given herein. All covitrol functions and process parameters are provided by
- equipment independent of EMUX.
- 1. Enter EOPs developed f rom Secondary Containment Control Guideline on either of the Entry
- Condhions.
l 2. - Operate tiailable area coolors.
- 3. Operate available secondary containment HVAC.
- 4. If area temperaturc , or radiation level, or water level exceeds its maximum normal operating value, Isolate the RCIC 1, g
. Execute steps 5 and 6 concurrently:
L 5. When an area temperature, or radiation level, or water level exceeds its maximum safe operating value in more than one area, shutdown the reactor using RFCS to reduce core flow and RCIS to insert control rods.
1 RCIC isolation valve to be provided with control room manual initiation capabihty and valve position incication which are hardwired and independent of EMUX.
~
g * '.
- 6. If RCIC system is discharging into the secondary containment; (a) Sefore any area temperature, or radiation level, or water level reaches its maximum saf e operating value, enter the RPV Controt procedures and inillate a manual scram. Control RPV water level (water level signal is hardwired) using the feedwa'er and condensate system, and control RPV pressure using the turbine bypass valves.
(b) Whten an area temperature , or radiation level, or water level exceeds its maximum safe operating value in more than one area, emergency depressurization is required. Rapidly depressurize the RPV using the turbine bypass valves.
CONTAINMENT RESPONSE Since no steam is discharge to the suppression pool, the containment parameters will remain within their normal operating values.
SUMMARY
For the postulated event of RCIC line break outside primary containment coincident with an EMUX common mode iailure, sutlicient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigat0 the event, assuming that all operator actions will be limited to the main control room for the first hour. Sufficient water inventory is available for decay heat removal during that one how period. Subsequently, reactor cold shutdown -
conditions and post accident recovery operations can be indlated using the Remote Shutdown System.
I l
L L
l' , . - . . - . - . - . . , . . - . - - , . . . . . . . . , - . . . , . . . . . - - . , . - - ,
DRAFT sea.. 2 l
EVENT: LOC A ItiSIDE CONT AINMENT This event is postulated to be a break of a feedwater line coincdent with a undiscovered cummon mode f ailure of the Essential Mtit plex System (EMUX) in such a manner that all valid and correct EMUX control and rnonitoring da'a tra%rNssions are lost AUTOMATIC ACTIONS After a feedwater line break inside con'ainment, the reactor would expected to automatically scram on High Drywell Pressure or RPV water Level 3. Because of the assumed EMUX common node f ailure, these scram functions are postulated to f ait. In addition, all ECCS systems are assumed not be available because of the postulated common mode f ailure. For the postulated line break, the RPV p* essure will drop rapidly, resulting in closure of the turbine control valves by the pressure regulator ard automat'c scram signals (hardwired) from the subsequent turbine inp. When RPV water level drops to Level 2, the ATWS scram functions are automatically activated (independent of EMUX) and initiates an automatic screm. Refer to Figure 6 for the response break of the fuel clad temperature af ter the postulated feedwater line break.
EOP EF .RY CONDITIONS:
The following alarms are provided by equipment independent of the EMUX. These are the entry conditions for emergency operating procedures expected for a LOCA inside the primary containment from instruments that are hardwired SAR Appendix 18F Ref erence 1, RPV WATER LEVEL LOW [ FIXED POSITION), Column B,1BF-14
- 2. DRYWELL PnESSuRE HIGH [FlXED POSITION). Column 8.18F-121 OPERATOR ACTIONS PER EOPS T he expected principal operator actions are given herein. All control functions and process parameters are provided by equipment independent of EMUX.
Upon entering the EOPs developed from the RPV Control Guideline on High Drywell Pressure or RPV Water Level Low as an entry condition, and concurrently enter EOPs developed from the Primary Containment Control Guideline on Drywell Pressure High alarm as an entry condrtion, the f ollowing sets of actions are executed corcurrently:
- 1. RPV Control
- 1. Initiate a manual scram if a scram has not been initiated .
- 2. Restore and maintain RPV water level (wMer level signalis hardwired) above Level 3 using the CR0 system, maximizing ficw into the RF 2
- 3. 11 RPV water level cannot be maintained above Level 3, maintain RPV water level above top of the active iuol
- 4. When RPV water level cannot be maintained above top of the active tuel, depressuriza the reactor usirig the turbine bypass valves
e *. .
I OPERATOR ACTIONS PER EOPS(continued)
- 11. Primary Containment Control:
- 1. Initiate wetwell sprays using the fire protection system and the firewater addition modu of RHR(C) for primary containment pressure control.
- 2. Il necessary, initiate drywell spray using the fire protection system and the firewater addition mode of RHR(C ) for primary containment pressute control (drywell pressure signalis hardwired).
CONTAINMENT RESPOt4SE As calculated for the Main Steam Line Break Outside Containment ewnt, the suppression pool temperature rise due to decay heat over a period of one hour was len., than 40 'F. For this 8: vent, the suppression pool temperature rise is expected to be less than 40 F due to the wetwell and'or drywell sprays inillated by the operator.
LOCA ANALYSIS The complete circumferential break of a feedwater injection line was analyzed For this case only the control rod drive rnakeup system was assumed to be available for RPV makeup. The CRD takes suction from the condensato system. The hotwell holds enough water to provide 4 minutes of rated feedwater tiow.
After scram the CRD injects water into the RPV. The CRD continues to inject water into the vessel but it is not enough to overcome the break flow. The wate' level continues to drop and the core is unco"ered (Figure 6) At approximately one and half hours from the tiart of the event the peak cladding temperature is only about 1857 *F (Figure 7) which is well below the 2200 #F limit.
SUMMARY
For the postulated event of a f eedwater line break inside the containment, sufficient automatic control functions, information, and controls that are independent of EMUX are available in the main control room to mitigate the event ar.d maintain the fuel clad temperature below its limit, assuming that all operator actions will be limited to the main control room tot the first hour. Sulficient water inventory is available for decay heat removai during that one hour period. Subsequently, reactor cold shutdown conditbns and post accident recovery operaticns can be initiated using the Remote Shutdown System.
. ,~ '
'01 8
E R
U T
A R
E P
A t
E.
T ~ .
! kf 6
D A.
C L
x ,
_ K -
A E
P .
i
)
t D n
e '
4 N ,
ki
..rm e.
O aa et rn l
b a
C 3o C
l E S
i .
e a ne v id a (
Li s D Un R .
FI C 7'
E e~
r
, M I
u g' .
T i "
F 2
i I
j[ '
' 7 0 ,
2 2
{ %!
4 3 6 0i 0 .
. - 0
_ 21- 1 0 f' x
d p't J
LZDt I
L CTLQ2L1 L
t .
ov <
lt t-
. :} ' i!:! ; i i: ij l i;i' 1! j: i1 ~ ,
m - '. '
Figure 6. FW Line 9reak I.' side Ccotai ><st CR0 asailable i 1
_ . . . - . _ . _ I 60.- i HOT CHANN[L i
} 2 AVERAGE CHANNEL j
- 3 TOP OF ACiiVE FUEL ,
1 4
.~
- 40. ?
-m i,
1 3 3 3 3 3 ,
3 v t n
t., ,n 1,
_; i v i -
Lij
'g , ,
f t V/ ~
Ltj 20. , ,
2 x %e} g_ _.
h n- : i
,l _Ad
<l
~, _
g , I _t_ : i i_I i i i i
) 8. 10'
- 2. 4. 6.
O.
LP2' n u ., TIME (SECOND,
_ ,,