ML20136H268
| ML20136H268 | |
| Person / Time | |
|---|---|
| Site: | Seabrook  |
| Issue date: | 12/31/1985 |
| From: | PUBLIC SERVICE CO. OF NEW HAMPSHIRE |
| To: | |
| Shared Package | |
| ML20136H265 | List: |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737, TASK-1.D.2, TASK-TM PROC-851231-01, NUDOCS 8601090339 | |
| Download: ML20136H268 (193) | |
Text
{{#Wiki_filter:.. . n. n . .u. .~ , , -, -,.v.,. . . - , . . e, ~.e., e.g m m -~- -e-~~. , Rw , +s~< -assw~ .' <
;w~
s
~%y:
y ,
... .-.~;,
~g.. SP.' .', '
spe.: V. ,; p _ < m. ' ~ ,y
, + ,
..zmm,., ,
,, ;- n. .' - 4 .e w.
+ -
t ..: < c .. . . , , , y' n. ..
. .c .v q u .
a .' ~-'$
' - v i- i " <+ .is' , s ~ '
- +
++W:h Y'l S . n'f m f ' R~
fe'-^ g. f l:I ~ ) ;k_'% xh.'- , s'e -- a a e a_
! ~
l a w dCs!ML O:om ;se%. -p',i . s
. .. cm %. 1- & '
a rg qv.3, 7., , m e,r., p- v =~ m. -. .s o.s . _ . ,. ..' - w,*.~ r - . r '.hf--...s#D ! ?-' ,g
, '. #/,,~ - - < l' #~.
1 s F 4 ? s.jQ, .
.* :g - .-r_w1-e ',
'L'_'
k d L<. :~.. r ..Y p 4 ' [a., _.tl.C ; ' " ,, - -f,f,
'.-s.
Q.:s b. r m
. n_
,-g s
l} ; n "
- t
- 1
,-3.,
~
- 75; . , Q. l-g w. '
.- u ., , _ s 5_ ng ,
'-l.
_ x
)
- G;%;Q?lx.m # +
c
- 4. , , . 3 - -
/ s
- .q,._ . ,2 v
m g 6 9. tw s.-.4
-. . . .j , ,~ .
._ r. ; -urs,a y ' - ,
WS-ENh 'sGa f 4v .& i % . ' A~ 9:' ym, ~ r .
- a. ,w. , . .
s ,
.n r
, , s ,.c
) "* -'
- , -.1, r
, , . + -Y1 y . ,s..
f__'-T ,, 4 [. ' Tl 4 % j f
- w. .<.
as s'm 4 #
- - r k.!
,w ' .:n
."q%'..-
c
, "" 4 ,-A', \,
kc4% v ,/* s-s', '. "
., k.
v.
- ' , ,~ ~ e.py. w; -
y m
,' t m.i -
' - in g . ,,f_
f
- u.[
.- 4 a
- , . . .a 7 .;; , s 3
~ '
~~W2x, .
..fM- -! ~ -
SEABROOK STATION y w Q,4 - SAFETY PARAMETER DISPLAY SYSTEM # W >.Y _. _- - , (SPDS) g ., T, TMI TASK ACTION PLAN I.D.2 : s. a.
- w
! *-ys..g>_
~ ~ ,%,,
^t_' J w*'+y y
.. - ,Y. ,
s ,, > + -
rb. ^;f- -
1' i. t +-
- " u
~~'
, r_ , ; ,.f- , # q
~
41
- q. '=-- , , .-y y k . -
m
+3
; w' -c
- . ~
/
.w t
n gp",_. . . . ,q yt ,; c a i ;w s s..,.,-.. v: - 3.-,, ,.5 ',
N .[
Y P 2 y q'- p.fN'I ,. ,
+ g ;_ e #
V, p jv, x
< , >q
.s i 3
- 1. ,
,r. ,
- ( y '
u ]- , k a.- - ,w. u;~.- g;a;; ~ c a
- 5,,
- m. A g%JA, '
u , gq,~
,x
' f4. -
2 w(~ ~- - 1 d, ( , y a g F.. r ,4, m. . , - .
- f. ,'
,, , y .:
-3 -
-y. ,
,n
- . Ww 3
~e
;% y
=
- 1. ,
m, 4 r t; - :-<s.r -
. ..( . ,
^2 A .g p_g.. ,, _
- 'v' 2 '
- hJ J. * ~ a., = ~ 7y. n j ew 5 4 : t 4 I# *
$ #- 'P-F * -
1J,, '.
'a i
- 4 m ,
s
% + ..1.y u s.s v y,-
s d. a% s p7 n
, - 3
- u . - i .: : t*
- V.4. 4. - -
s , , t
,- u. 4 a'8.g, _-y b- .k ( ,%_? -
m~ . - t
's k. ). ,
er A it _'y'. ' I .,D c+ ,- p*.b y'. m ._ ,." ' 8601090339 B60106 ADOCK 05000443
- ~
4 - PDR
- ~ '
_. F PDR to g; > 2
.t g -
~ .
( _..=_.
-e. v-..
e f- I C i_. L yg
I i , SEABROOK STATION i . i : SAFETY PARAMETER DISPLAY SYSTEM (SPDS) TMI TASK ACTION PLAN I.D.2
; l I
T SEABROOK, NEW HAMPSHIRE DECEMBER 1985 l
( TABLE OF CONTENTS l r=
1.0 INTRODUCTION
.................................................... 1 2.0 CRITICAL SAFETY FUNCTIONS....................................... 3 2.1 Barriers to Radiation Release............................. 3 2.2 Safety Functions for Each Barrier......................... 4 f 2.3 Implementation of the Critical Safety Function Concept.... 6 3.0 STATUS TREES.................................................... 9 3.1 Status Tree Format........................................ 9 3.2 Definition of Priorities.................................. 10 3.3 Example of Status Tree Usage.............................. 13 4.0 BASIS FOR CRITICAL SAFETY FUNCTION STATUS TREE PARAMETER SELECTION....................................................... 18 4.1 Suberiticality Tree....................................... 18 4.2 Core Cooling Tree......................................... 20 4.3 Heat Sink Tree........................................... 23 4.4 Integrity Tree............................................ 25 4.5 Containment Tree.......................................... 28 4.6 Inventory Tree............................................ 29 5.0 SPDS CRITICAL SAFETY FUNCTION STATUS TREE DISPLAY ORGANIZATION AND INTERNAL PROGRAMMING........................................ 40 5.1 SPDS Display Organization................................. 40 5.2 SPDS Internal Programming....... ......................... 41 5.2.1 Sube'riticality (SUBC) Program..................... 41 5.2.2 Core Cooling (COCO) Program....................... 46 5.2.3 Heat Sink (HESI) Program.......................... 52 5.2.4 Integrity (INTEG) Program......................... 55 5.2.5 Containment (CONTA) Program....................... 60 5.2.6 Inventory (INVEN) Program......................... 62 5.2.7 Heatup Cooldown (NUCD) Program.................... 65 5.2.8 Core Exit Thermocouple Averaging (THERPO)
- Program........................................... 69 6.0 'EKAMPLES OF POSTULATED SPDS RESPONSES TO TRANSIENTS............. 83 6.1' Steam System Piping Failure............................... 83 6.2 Loss of Normal Feedwater F1ow............................. 86 6.3 Complete Loss of Forced Reactor Coolant Flow.............. 88 6.4 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power....................................... 90 6.5 Inadvertent Operation of the Emergency Core Cooling System During Power Operation............................. 93 6.6 Large Break L0CA.......................................... 96 TABLE OF CONTENTS f (continued) l Pare 7.0 VALIDATION OF SPDS WITH EMERGENCY RESPONSE PROCEDURES . . . . . . . . . . . 125 7.1 Steam Line Break Accident................................. 126 I 7.2 Inadequate Core Cooling................................... 127 7.3 Loss of all Feedwater..................................... 129 f 7.4 Anticipated Transient Without Scram (ATWS)................ 130 7.5 Steam Generator Tube Rupture (SGTR)....................... 131 7.6 Multiple Events........................................... 132 APPENDICES A Background Information for Pressurized Thermal Shock A-1 B Seabrook Station Emergency Response Procedures B-1
-lii-
{ LIST OF TABLES Number Title Page 7.1 Sequence of Events, Secondary Break Outside Containment 134
- 7.2 Sequence of Events, Inadequate Core Cooling 135 7.3 Sequence of Events, Loss of All Feedwater 137 7.4 Sequence of Events, ATWS from Full Power ,
139 7.5 Sequence of Events, Steam Generator Tube Rupture 141 7.6 Sequence of Events, Secondary Break Plus SGTR 143 e
-iv-
{- LIST OF FIGURES Number Title Page, 3.1-1 Branch and Block Formats for Status Trees 16 3.2-1 Status Tree Priority Identification 17 4.1-1 Suberiticality Status Tree 32 4.2-1 Core Cooling Status Tree 33 4.3-1 Heat Sink Status Tree 34 4.4-1 Integrity s'ta'lus Tree 35 4.4-2 Seabrooic Station Operation Limit Curve 36 4.4-3 Seabrook Station Operation Limit Curve with 37 Suparimposed LTOP Program 4.5-1 Containment Status Tree 38 4.6-1 Inventory Status Tree 39 5.1 Critical Safety Function Status Tree Monitoring overview 73 5.2 Suberiticality 74 5.2.1 Suberiticality Status Tree 75 5.2.3 Heat Sink Status Tree 76 5.2.4.A Integrity Status Tree 77 5.2.4.B Seabrook Station Operation Limit curve 78 5.2.4.C Seabrook Station Operation Limit curve with Superimposed 79 LTOP Program 5.2.5 containment Status Tree 80 5.2.6 Inventory Status Tree 81 ) 5.2.8 Distribution of Incore Instrumentation 82 6.1-1 1.4 Square Feet Steam Line Rupture, Off-Site Power Available 101 6.1-2 1.4 Square Feet Steam Line Rupture, Off-Site Power Available 102 6.1-3 1.4 Square Feet Steam Line Rupture, Off-Site Power Available 103 6.2-1 Pressurizer Pressure and Water Volume Transients for Loss 104 of Feedwater
-v-
i [ LIST OF FIGURES (continued) Number Title Page 6.2-2 Core Average Temperature Transient and Steam Generator 105 Water Volume Transient for Loss of Feedwater 6.3-1 Core Flow coastdown for Four Loops in Operation, Four 106 Pumps Coasting Down 6.3-2 Four Loops in Operation, Four Pumps Coasting Down 107 6.3-3 Four Loops in Operation Four Pumps Coasting Down 108 6.3-4 DNBR Versus Time for Four Loops in Operation, Four 109 Pumps Coasting Down 6.4-1 Uncontrolled RCCA Bank Withdrawal from Full Power with 110 Minimum Reactivity Feedback (80 PCM/SEC Insertion Rate) 6.4-2 Uncontrolled RCCA Bank Withdrawal.from Full Power with 111 Minimum Reactivity Feedback (80 PCM/SEC Insertion Rate) 6.4-3 Uncontrolled RCCA Bank Withdrawal from Full Power with 112 Minimum Reactivity Feedback (80 PCM/SEC Insertion Rate) 6.4-4 Uncontrolled RCCA Bank Withdrawal from Full Power with 113 Minimum Reactivity Feedback (3 PCM/SEC Insertion Rate) 6.4-5 Uncontrolled RCCA Bank Withdrawal from Full Power with 114 Minimum Reactivity Feedback (3 PCM/SEC Insertion Rate) 6.4-6 Uncontrolled RCCA Bank Withdrawal from Full Power with 115 Minimum Reactivity Feedback (3 PCM/SEC Insertion Rate) 6.5-1 Inadvertent Actuation of ECCS During Power Operktion 116 6.5-2 Inadvertent Actuation of ECCS During Power Operation 117 6.5-3 Inadvertent Actuation of ECCS During Power Operation 118 6.6-1 Peak Cloud Temperature - DECLG (CD = 0.6) 119 6.6-2 Core Pressure - DECLG (CD = 0.6) 120 6.6-3 Downcomer and Core Water Levels During Reflood - 121 DECLG (Cp = 0.6) 6.6-4 Core Power Transient - DECLC (CD = 0.6) 122 6.6-5 Fluid Temperature - DECLG (CD = 0.6) 123
-vi-
LIST OF FIGURES (continued) . Number Title Page 6.6-6 Containment Pressure Response Following 0.6 DE 124 Pump Suction Guillotine (Minimum Safety Injection) 7.1 Secondary Break Outside Containment, Pressures 145 f 7.2 Secondary Break Outside Containment, Temperatures 146 7.3 Secondary Break Outside containment, Levels 147 7.4 Secondary Break Outside Containment, Steam Flows 148 7.5 Inadequate Core Cooling, Pressures 149 7.6 Inadequate Core Cooling, Temperatures 150 7.7 Inadequate Core Cooling, Levels 151 1 7.8 Inadequate Core Cooling, Flows 152 7.9 Loss of All Feedwater, Pressures 153 t 7.10 Loss of All Feedwater, Temperatures 154 7.11 Loss of All Feedwater, Levels 155 7.12 ATWT from Full Power, Pressures 156 7.13 ATWT from Full Power, Te.mperatures 157 7.14 ATWT from Full Power, Levels 158 7.15 ATWT from Full Power, Power 159 7.16 Steam Generator Tube Rupture, Pressures 160 7.17 Steam Generator Tube Rupture, Terperatures 161 7.18 Steam Generator Tube Rupture, Levels 162 7.19 Secondary Break Plus SGTR, Pressures 163 7.20 Secondary Break Plus SGTR, Temperatures 164 7.21 Secondary Break Plus SGTR, Levels 165 A-1 Reactor Coolant Pressure and Temperature for a A-8 Representative Severe Thermal Transient A-2 Vessel Temperature Profiles A-9
-vil-
', 4 LIST OF FIGUREN (continued) ,
,I .
Number } Title Page (. t l A-3 Plow Propagation Conditions in Vessel A-10 A-4 , Vecsel Stress Profi16s A-11 l A-5 Basis for DeveloPtint of Crack Initiation Curve A-12 A-6 Example: Allowable Pressure Curve A-13 A-7 , Example Curve A-14 t A-8 Ma$'or Sections of a Reactor Pressure Vessel A-16 A-9
Seabr ok'LTOP Setpoint Program A-17 f
9 6 e
-viii-
-r m e-,_,-- - * - , - -
L-
1.0 INTRODUCTION
f This report provides Seabroc,k Station's response to Item I.D.2 of NUREG-0737, Supplement 1, dated December 17, 1982. Seabrook has developed a L Safety Parameter Display System (SPDS) which is an integral part cf its Emergency Response Procedures and Radiological Emergency Plan. The SPDS provides an explicit systematic mechanism for displaying critical plant variables to aid the operator in evaluating the plant safety state. This report analyzes the SPDS for Seabrook Station with regard to its capabilities for assessing the safety status of the plant. The parameters selected for une in this system will be discussed in concert with both the Seabrook Station Emergency Response Procedures and the Radiological Emergency Plan. Because of this integration, Seabrook Station management feels the operator's role in these activities is less diversified. Therefore, the operator's ability to mitigate any accident condition has been greatly improved and the requirement to establish outside communications has been folded into the normal format of emergency response. Processing selected plant parameters for the SPDS is accomplished by the main plant computer. The SPDS main plant computer displays can be viewed from multiple locations: o Any one or all four informational CRTs located on the Main Control Board (MCB). o The Shift Technical Advisor (STA) information stand located in the Control Room. o The Technical Support Center (TSC) communications area, o The Emergency Operations Facility (EOF) communications area. In addition, hard copies are available in graphic form for the operator to use with the parameters viewed from the MCB.
Seabrook Station Emergency Response Procedures are based on the
. Rsvisionel issue of the Westinghouse Owners Group (WOG) Emergency Response Guidelines (ERGS). These procedures are the mechanism that offer the operator o manual, independent means of monitoring the Critical Safety Function (CSF) otatus trees which are incorporated into the SPDS. In October of 1983, the WOG conducted its validation program for its Revision 1 guidelines at Seabrook Station. All guidelines were converted to plant-specific procedures and used in a week-long simulator test. Both the computerized CSF status trees and the manual hard copy reproductions were used successfully.
Reference is made to Seabrook Station's Final Safety Analysis Report (FSAR) for complete design and iran'sient parameter conditions /setpoints/assumptlons. As a controlled document, the information contained therein is the most accurate and up-to-date. Also, Westinghouse WCAF (10599), titled, " Emergency Response Guidelines Validation Program Final Report," was used as a confirmatory reference.
2.0 CRITICAL SWETY FUNCTTONS The logic in the SPDS and the Emergency Response Procedures is based on the CSFs. The relationship between CSFs and the three physical barriers against radiation release to the environment is presented in the following subsections. 2.1 Barriers to Radiation Release It has long been recognized that if the radioactive material in the reactor core of the nuclear power plant were to be released to the environment, the possibility of a serious radiation dose to the general public , could result. Hence, a fundamental goal of nuclear safety is the prevention of releases of radioactive materials from nuclear power plants that could cause a serious radiation dose to the general public. In order to accomplish this goal, the concept of " defense in depth," which translates into providing multiple barriers to the release of the radioactive material, was adopted at the start of the commercial development of nuclear energy as a cornerstone of nuclear safety. The barriers that are provided in every nuclear power plant consist, at the minimum, of: J o Fuel matrix and fuel clad o Reactor Coolant System (RCS) pressure boundary o Containment o Distance (exclusion area and low population zone) The first three barriers are direct physical barriers to the transport of radioactive materials and together provide the required " defense in depth." The fuel matrix and fuel clad retain solid and volatile fission products within the fuel element. The RCS pressure boundary blocks the transport of radionuclides that escape through the fuel rod barriers and those that are produced outside of the fuel rods themselves. Containment blocks the
I release of radionuclides that p ss through th3 RCS pressuro brundary cnd thssa l few radionuclides that form outside the RCS. In its most general form,
" containment" includes the main containment vessel, the boundaries of those systems that penetrate the main containment vessel (the main steam and feedwater systems and various auxiliary systems) and the boundaries of the i I
ceparate waste storage facilities (waste gas storage tanks, spent fuel storage and the like). Finally, by situating the plant away from major population centers, the possible serious radiation dose to the general public due to released radioactive material is further mitigated by decay, dilution and dispersion of the material in transit and, as a final means of protection, by providing time for evacuation of the population in downwind areas. l l As long as the fuel matrix / cladding, RCS pressure boundary and containment barriers are intact in a nuclear power plant, that plant poses no possible serious radiation dose to the general public. Should one or more of the barriers be faulted, the threat to the general public increases. If, in the remote possibility, all barriers are lost, the possibility of a serious radiation dose to the general public becomes significant, and external caergency actions may be called for. Therefore, the goal of nuclear power plant operation, in terms of nuclear safety, is ensuring that as many as possible of the three physical barriers remain intact at all times and under all conditions and circumstances that may exist. 2.2 Safety Functions for Each Barrier For each of the barriers, there is a set of functions that must be maintained on a continuing basis if the barrier is to remain intact. The full cet of functions that must be maintained in order to fully safeguard the general public from possible consequences of nuclear power plant operation is commonly referred to as the set of safety functions. There are a variety of methods available for identifying the components of a set of safety functions end, as a result, the tabulations of safety functions that are developed frequently appear to differ among themselves. In reality, the differences are usually semantic. The actual physical processes which must occur if the barriers are to be kept intact are the same, regardless of the method of cnalyzing the processes or the naming of the safety functions. For purposes of developing a SPDS for the operator, only the fuel matrix / cladding, RCS pressure boundary and containment vessel barriers need to _4
be consid;r:d. Th3 "dictcn20" b rrice is includ:d within tha scap3 cf ths Radioltgic01 Emergency Picn. A G;t of ccfcty functisna that is sufficient fcr the fuel matrix / cladding, RCS pressure boundary and containment vessel barriers in a piant consists of: l l o Maintenance of Suberiticality o Maintenance of Core Cooling l o Maintenance of Heat Sink l o Maintenance of RCS Integrity o Maintenance of Containment Integrity I o Control of Reactor Coolant Inventory This safety functions set is defined as the CSFs. These CSFs are cssociated with the barriers in the following manner: Barrier Critical Safety Function
"~ Maintenance of Suberiticality (minimize energy production in the fuel)
Maintenance of Core Cooling (provide adequate reactor coolant for heat Fuel Matrix removal from the fuel) and - Fuel Clad Maintenance of a Heat Sink (provide adequate secondary coolant for heat removal from the fuel) Control of Reactor Coolant Inventory (maintain enough reactor coolant for __ effective heat removal and pressure control) Maintenance of a Heat Sink (provide adequate heat removal from '.he RCS) RCS Pressure Maintenance of RCS Integrity Boundary - (prevent failure of RCS) Control of Reactor Coolant Inventory (prevent flooding and loss of pressure __ control) Containment Maintenance of Containment Integrity Vessel - (prevent failure of containment vessel)
Situntiens can arise in which the integrity of a b:rrice is lost and cannot be restored even though all CSFs are satisfied. The classic double-ended guillotine break of RCS piping constitutes an irrevocable failure cf the RCS pressure boundary barrier. In this situation, the RCS pressure boundary barrier is recognized to be failed, and all available resources are directed toward minimizing further degradation of the failed barrier and keeping the fuel matrix / cladding barrier and the containment barrier intact. 2.3 Implementation of the Critical Safety Function Concept The means provided for maintaining the CSFs, and thereby the integrity
-cf the barriers, vary with both the particular set of conditions that may cxist and the likelihood that that set of conditions will exist. The control systems, augmented by trained operator response to annunciator alarms, and backed by the plant Technical Specifications, serve to ensure that small departures from preferred operating conditions are rectified before any challenge to the CSFs develops. Under other circumstances, which are much less likely to occur and are usually contingent on equipment functional failures, the plant protection systems automatically act to block potential challenges to the CSis and to reinforce the protection of the fuel rod and RCS pressure boundary barriers. Specifically, the plant protections systems:
4 o Stop nuclear power generation by initiating a reactor trip. o Stabilize reactor coolant temperature, pressure and inventory by initiating a turbine trip, main feed isolation and steam line isolation, as appropriate. I o Insure the availability of a secondary heat sink by starting emergency feedwater flow and enabling the Condenser Dump System. o Prevent overpressurization in the Primary and Secondary Systems by (passively) opening the pressurizer and steam line safety valves, if necessary. Operator action is required only to ensure that the automatic protection systems are function 11g as intended and, depending on the actual cause of the reactor trip, to initiate recovery operations. . In those race, but potentially hazardous, situations in which either a barrier has failed (a loss-of-coolant accident or a steam generator tube rupture) or en essential function is jeopardized or lost (a Secondary System break or a station blackout, for example), the Engineered Safeguards System is Cetivated to insure that CSFs are maintained to protect the surviving barriers. The Engineered Safeguards System duplicates all of the safety functions provided by the plant protection systems and broadens the barrier protection processes by automatically: i o Starting the emergency diesel generators. i 4 o Initiating safety injection. o Isolating all nonessential containment penetrations.
'o Actuating containment spray, if appropriate.
Concurrently, trained operator response is invoked through the Emergency Response Procedures to verify that the automatic systems are functioning to identify the accident, to restore or replace lost essential functions and, when appropriate, to restore the plant to stable operating
- conditions as expeditiously as possible.
However, for the multiple event / multiple failure scenarios that go j beyond the design basis of the Engineered Safeguards Systems and the scope of the Emergency Response Procedures, the operator is provided with a means of directly monitoring the CSFs and with guidance for restoring any CSFs which might be in jeopardy. In this way, an additional and last line of defense is established against the potential release of radioactive materials to the environment because of barrier failure. l The means of monitoring any CSF has been reduced to the checking of an appropriate set of plant parameters. These parameter are then compared with f i previously selected reference values in a logical array called a status tree, i The combination of parameters existing at any time defines a unique path l through the tree and also a unique " status" of the respective CSFs. If the , " status" of the respective C3Fs is other than " satisfied," the operator is i l 1 l -
directed to an appropriate Functional Restoration Procedure (FRP) for instructions intended to restore the CSF to a satisfactory status. e OO Y e
.8-
3.0 STATUS TREE Each status tree consists of a series of binary decision points that check conditions in the plant relative to fixed reference criteria. The decision points require the user to decide only whether a condition does or does not exist, or if a certain process parameter limit is exceeded or not cxceeded. Examples: Is source range energized? Is power range less than 5%? Each possible response at a decision point leads on to either another decision point or a terminus. A terminus summarizes the CSF status for the particular combination of decisions leading to it. Each terminus consists of o color-coded symbol representing the degree of challenge to that CSF. The line extending from the last decision point to the terminus is also color and line-coded to convey the same information. Immediately adjacent to each terminus is an instruction which directs the operator to the appropriate FRP if the CSF is not completely satisfied. 3.1 Status Tree Format The plant parameters that define the state of each CSF are identified cn the associated status tree. Typically, only a few parameters are required to identify the status of a CSF. This limited set of parameters nust be cvaluated in a systematic manner to determine the CSF status. A branching structure inherent in a decision or event tree is the logical vehicle to structure the systematic evaluation of plant parameters that determine the status of a CSF. Each status tree has a single entry point and several exit points (termini) depending on the parameters that define the CSF status. Each pass through a status tree can produce only one exit point based on the values of the parameters in the status tree. Two basic formats for status trees have been developed, each with its own advantages. They are referred to as " branch" and " block" types as shown in Figure 3.1-1. The branch version states each question requiring a decision 1 l 1
I cn separate branches; that is, each question is asked twice - first in a positive sense, then in a negative sense, on symmetric branches. In the block version, each question is simply stated once in a positive sense, and the decision options "YES" or "NO" provide the branching. The block version has been found easier to evaluate since a question cnly needs to be answered once, and the branching follows from the decision. This form more closely approximates the logic which is programmed for a computer evaluation of a " branch point." 3.2 Definition of priorities In addition to identifying the safety state of the plant, the status trees also provide an ideal vehicle to prioritize operator response to CSF challenges. When CSFs are challenged, multiple challenges may exist requiring coditional guidance to structure operator function-related restoration. This coditional guidance is provided by prioritizing all potential challenges to CSFs. This predefined prioritization is accomplished by prioritizing the CSFs (i.e., specifying the order in which the status trees are monitored) and prioritizing the termini of the status trees. prioritization of the CSFs is based directly on the barrier concept from which they are developed. Since the first barrier to fission product release is the fuel matrix / cladding', the CSFs related to this barrier are given the highest priority. Challenges to this barrier can come from inside
- cnd outside the barrier. The internal challenge comes from excessive core heat production resulting from fission power production (normal decay heat f, production is considered in safeguard systems design). Core heat production in excess of safeguard systems core heat removal capability is the most severe challenge to the fuel matrix / cladding barrier. If the core is at power, the energy production represents a potential additional significant challenge to the other barriers which may also be challenged or failed. Consequently, suberiticality is the highest priority CSF. The external challenges to the fuel matrix / cladding barrier come from inadequate decay heat removal due to oither inadequate reactor coolant or secondary coolant. Even though the j reactor core is shut down, f ailure to remove the thermal energy from decay heat production can rapidly lead to sufficiently high core temperatures to i
fail the first barrier. Core cooling and heat sink are the second and third priority, respectively, CSFs. , The second barrier to fission product release is the RCS pressure boundary. Although challenges can a5ain come from inside and outside, only the internal threats are considered in prioritizing CSFs since only they can be addressed by the operator. Potential internal threat due to excessive core heat production and inadequate core heat removal are addressed through the cuberiticality, core cooling and heat sink CSFs. The remaining internal . threat to the RCS pressure boundary results from a reactor' vessel pressurized , thermal shock condition. Such a challenge can result from thermal stresses ccting on a radiation embrittled reactor vessel in a low temperature reactor coolant condition. Therefore, the RCS integrity is the fourth priority CSF. The third barrier, containment, is analogous to the second barrier in that only internal threats are considered in prioritizing CSFs. Containment is the fifth priority CSF. The sixth priority CSF is reactor coolant inventory. This CSF is cetually a subset of the core cooling CSF but is considered separately to facilitate status tree construction and prioritization of challenges. The CSF cddresses situations wherein reactor coolant inventory is adequate to satisfy the core cooling CSF but not within nominal operational limits. The challenges associated with the reactor coolant inventory CSF are the lowest priority of all CSF challenges. The prioritization of CSFs based on the barriers to fission product release results in the following order:
- 1. Suberitica11ty (S)
- 2. Core Cooling (C)
- 3. Heat Sink (H)
- 4. Integrity (P)
~
In summary, the priority of operator action is fixed by the physical ! creangement of the trees. Each tree contains multiple termini, each of which represents a possible current status of that CSF. Each terminus (and preceding branch) is color coded, reflecting the urgency of that condition regarding operator action and each also refers to the appropriate guidelines I to be used. 3.3 Example of Status Tree Usame The actual process of working through the trees will be illustrated by examining the first (suberiticality) status tree. The u?or enters the tree at the lef thand arrow and is asked if neutron flux (NIS char.nels) indication is less than 5%. The possible answers are either "YES" or "NO." If indicated power is greater than 5%, then the appropriate answer is "NO," so the user would follow the "NO" path directly to the terminus and determin3 that: o The' response priority is RED (immediate response required). o The appropriate FRP is FR-S.I. According to the " rules of priority " the operator should suspend whichever Optimal Recovery procedure (ORP) is being performed and immediately initiate the actions in Procedure FR-S.I. Monitoring of the status trees may continue for information purposes, but by rules of priority, no other higher priority condition can exist. When the actions required by FR-S.1 are complete, the operator is directed to " return to procedure and step in offect." This allows recovery actions to continue exactly where they were suspended when the RED priority was recognized. This also signals continued monitoring of status trees. In this case, the usa and/or operator would know, because of the FR-S.1 actions and checks, that the subcriticality tree would have no status more severe than YELLOW. If indicated power is less than 5%, then the first question block is cnswered with a "YES." and the user would follow the "YES" path to the next question block.
- 5. Containment (Z)
- 6. Inventory (I)
Having prioritized the CSFs, the challenges must be prioritized within cach CSF and between CSFs. Since each pass throJgh a status tree produces a single terminus (exit) based on the status of the CSF, the termini can be prioritized based on the severity of the challenge. Four status conditions (i.e., extreme challenge, severe challenge, not sati.fied and satisfied) are defined to permit each condition to be prioritized with respect to other CSF conditions. Furthermore, for each status tree, the parameter decision points Cro arranged so that parameter decisions that indicate extegme challenges are generally situated early in the status tree followed successively by decision j points that indicate severe challenges, not satisfied rind satisfied conditions. This permits relatively comparable conditions (e.g., two severe challenge conditions) within a status tree to be prioritized by the cerangement of decision points in the tree structure. As indicated previously, the prioritization discussed above is cxpressed by colored line codings and terminus symbols. The color coding is used as a mechanism to immediately inform the operator that a CSF is in jeopardy and/or line pattern coding to indicate the relative severity of the challenge. The relationship between priority, color, line coding and terminus symbols is shown in Figure 3.2-1. The priorities of each status tree terminus (representing some plant condition) have been evaluated against each other so that all internal priorities are consistent. The action which an operator takes in response to a CSF challenge is related to the severity of that challenge. Each terminus symbol which is not green (satisfied) is annotated with the instruction "GO TO FR-1.Y." The appropriate FRP "K" is the alphabetical code for the respective CSF (as given chove), and "Y" is the guideline number. Each of the RED priorities is cssigned the first guideline number; for example, the FRP for an inadequate core cooling condition [ RED priority on core cooling (C) status tree] is depicted as FR-C.1.
In this CO:ond blick, the us:r is cck:d wh3th r the intcemedicto r:ngo Start-Up Rate (SUR) is zero or negative. If the indicated rate is positive, then the user would follow the "NO" response path directly to a terminus and determine that: o The response priority is ORANGE (prompt response required). o The appropriate FRP is FR-S.I. According to the rules of usage, the remainder of the " status trees should be monitored to determine if any RED conditions are present. If no RED status is encountered, then any ORANGE condition would be reviewed for priority. Since suberiticality is the first status tree, the present ORANGE would be addressed first by rules of priority. Again, the operator would suspend whichever ORP was being performed and initiate the actions in Procedure FR-S.I. Monitoring of the status trees should continue in order to , promptly identify any RED conditions which might arise and take priority. When Procedure FR-S.1 is completed, the operator can again return to his
~
normal recovery action at the point where it was suspended - unless other ORANGE conditions require attention first. Again, order of tree sequence would determine ORANGE priority. If the answer to the second block question were "YES." the user would follow the "YES" path to a third question block. This time the question is whether the source range is energized. This can easily be ar..,wered by checking the detector high voltage indication, or by noting the source range indicator. If the source range is determined to be not energized, the user follows the "NO" path upward to another question block. Now he is asked if the intermediate range SUR is more negative than
-0.2 decades per minute (dpm). If the indicated SUR is between zero and -0.2 dpa, then the user would follow the "No" path directly to a terminus and find that:
o The response priority is YELLOW (action not required immediately). o The appropriate FRP is FR-S.2.
Since the status priority is YELLOW, the user would continue to monitor the remaining trees and deal with any RED or ORANGE priorities which might be encountered. If no other condition coded higher than YELLOW were present, then the operator would decide if the FRP should be performed or delayed. Often, a YELLOW is indicative of an off-normal condition which may be restored to normal status by actions already in progress. At other times, the YELLOW status may be indicative of an abnormality in a single RCS loop (a single Steam Generator (SG), for example) and may be considered acceptable for the particular accident in progress. Whatever the case, the operator makes the decision about responding to the YELLOW condition. If the intermediate range SUR is more negative than -0.2 dpm, then the user would follow the "YES" path downward to a terminus and find the condition coded GREEN, the annotated "CSF SAT;" the CSF subcriticality is considered satisfied, so the user proceeds to evaluate the next status tree in the sequence. I If the source range were found to be energized, in response to the third question block, the user would follow the "YES" path downward to another question block. This time he is asked if the source range (SR) is negative or sero. Since the source range signal is normally erratic, it will be necessary for the user to look at a recorder trend of count rate to properly evaluate the SUR. If positive, the user would follow the "NO" path upward to a terminus and find: o The responso priority is YELLOW. o The appropriate FRp is FR-S.2. The operator would again use his judgement regarding implementation of FR-S.2 while continuing recovery operations and observing the rules of usage for the other status trees. If the source range startup is observed to be negative, the user follows the "YES" path downward out of the question box and finds the condition coded GREEN, the safety function is satisfied. The user would move directly to the next tree in the sequence. t .
FIGURE 3.1-1 BRANCH AND BLOCK FORMATS FOR STATUS TREES ' , POWFR P.ANGE ORE ATER titan 5% -- - - --- A
._m - _ _ . - = ' = -
A l l 24TERuEDIATE RANGE StKt* POSITIVE a p m m c:s ers s en B " "'" " P=mB
+ g RANGE LESS THut5%
POWER R ANOE g LESS TilAN 5% 5 SOURCE R ANGE NOT Et4 Eros 2ED 5 C 24TERMEDIATE no e4TERMEDIATE RANGE StJR _ R AtaGE Sufi ZERO OA Hf GATIVE NEGATIVE YES SOLK)CE RANGE Et4E RGZED D - no SOUnCE
- rat 4GC Et4ERGIZED YES
*SUR = start-up rate I
BLOCK VERSION D BRANCH VERSION I
STATUS TREE PRibb [lNDENTIFICATION SymbolCode Status / Response Color Line Code The critical safety Red N function is under extreme challenge; immediate operator action is required. The critical safety Orange MMMM function is under severe challenge; prompt oporator action is required. The critical safety function Yellow eeoeee { conditon is off - normal. Operator, action may be taken. O The critical safety Green 1 I {V) function is satisfied. No operator action is needed.
. ,. ... es.
-u- .
4.0 BASIC FOR CRITICAL SAFETY FUNCTION STATUS TREE PARAMETER SELECTION , The CSF status trees, as shown and described in this section, are the basis for selection of parameters. In addition, the states (of the CSF) which result from following each path will be established. In this analysis, the examples are shown using line coding with color description in parentheses. 4.1 Suberiticality Tree (Firure 4.1-1) h This tree represents the highest priority CSF and, as such, is always entered first anytime tree monitoring is initiated. Since this tree is monitoring the reactivity state of the core, the parameters being evaluated are those characterizing neutron (leakage) flux behavior as measured by the excore Nuclear Instrumentation System (NIS). An adequately shutdown core typically exhibits a randomly fluctuating count rate on the source range instruments. For the purpose of this tree, the core is considered adequately shut down (suberiticality satisfied) whenever the level of suberitical multiplication is steady or decreasing in the source range (zero or negative SUR). Basis: Power Range Less Than 5% Following a reactor trip, nuclear power promptly drops to only a few percent of nominal and then decays away to a level some eight decades less. Decay heat levels resulting from a radioactive fission product decay are never more than a few percent of nominal power and also decrease in time. Safeguards heat removal systems are sized to remove only decay heat and not significant core power. The 5% level was chosen because it is clearly readable on the power range meters. Nuclear power above 5%, in a core supposed to be shut down, is considered an extreme challenge to the fuel clad / matrix barrier and a RED priority is warranted. Intermediate Range SUR Zero or Negative At this point, power range flux has been determined to be not significant, so no extreme challengo exists. However, a positive SUR in the
intormediate range will shortly lead to powar production if operator action is not taken since no inherent feedback mechanisms exist below the point of adding heat. A positive SUR is considered a severe challenge to the safety function and an ORANGE priority is warranted. Source Range Energized This decision point is used to determine if further evaluation should be directed at the cource range flux behavior or back at the intermediate range channel indicatl y Intermediate Range SUR More Negative Than -0.2 dpm Normally, following a reacter trip, intermediate range flux decays at a constant -0.3 dpm. A rate of decrease less negative than -0.2 dpm (e.g.,
-0.1 dpm) is considered to represent a not satisfied condition and a YELLOW priority is warranted. The appropriate procedure for function restoration is FR-S.2, " Response to Loss of Core Shutdown." If the rate of decrease is less negative than -0.2 dpm, then the CSF is satisfied.
Source Range SUR Zero or Negative Normally, following a reactor trip, neutron flux decreases into the I source range and stays there. Typically, source range count rate fluctuates and does not exhibit any sustained increasing trend. Such a trend, as indicated by a positive SUR, is considered a not satisfied condition and a YELLOW priority is warranted. If source range SUR is zero or negative, the CSF is satisfied. EQII: At this point in our description, it must be mentioned that the suberiticality tree and the next tree core cooling are not functional on the SPDS during power operations. It is not possible to monitor power under 5% and subcooling greater than 30 F when at power. These two conditions are not obtainable and are therefore bypassed at power. If a safety injection or reactor trip actuation signal is generated, these bypasses are removed and the trees are active.
4.2 Core Coolina Tree (Finure 4.2-1) l This tree monitors the state of core fuel clad heat removal based on RCS pressure, core exit temperature, Reactor Coolant Pump (RCP) status and reactor vessel water level. The CSF is considered to be satisfied if cubcooling is indicated at the core exit. The most serious challenge to the CSF is an indication of Inadequate Core Cooling (ICC). An inadequate core cooling condition is defined as a high temperature state in the core which has exceeded design basis' accident cceeptance criteria and where operator action is needed to prevent core damage from occurring. Extensive analysis'of design basis events (e.g., small and large loss-of-coolant accidents) have been performed and safeguard systems have been appropriately designed (e.g., Safety Injection and Emergency Feedwater Flow Systems) to ensure that no unacceptable level of core damage will occur for design basis events. If equipment failure or multiple evento I cecur and result in the design basis assumptions being exceeded, it is possible that conditions can exceed those predicted in design basis analysis. However, if the operator has's symptom indicating that this is occurring, ! cetions can be taken to use alternative methods to attempt to restore core cooling. The use of these actions is intended to be minimized since they are extraordinary and beyond the original design basis of the equipment (e.g., RCP restart under highly voided RCS conditions) or could lead to jeopardizing l Cther CSFs (e.g., pressurized thermal shock from rapid SG depressurization). l Two symptoms of inadequate core cooling have been defined in this tree - one using core exit thermocouples and reactor vessel level and the other using core exit thermocouples alone. Either indicates an extreme challenge to the I fuel clad / matrix barrier to radioactivity release, and a RgD priority is terranted. If an inadequate core cooling condition has not been reached, but a degraded core cooling condition as defined in this tree exists, then there are still operator actions to be taken to respond to the challenge. Therefore. l any condition symptomatic of either an inadequate or degraded core cooling condition has been given a RgD or ORANGS priority indicating an extreme or severe challenge to the safety function. If RCS subcooling is not indicated, then the RCS may be saturated. Since this is not a normal condition for core
~20-1 L
l 1 cooling and may be due to inadequate RCS inventory, possibly requiring Safety ! Injection (SI) flow, the function is considered to be not satisfied and a ! YSLLOW priority is warranted. Saturated conditions in the RCS are expected during some events and, if 31 is operational, adequate core cooling should be maintained. 33313: Core Rxit Thorinocouples (TCs) Less Than 1,200 F Analyses of inadequate core cooling scenarios show that core exit temperature greater than 1,200 F is a satisfactory criterion for basing cutreme operator action. At least five TCs should be reading greater than 1,200'F. Five has been chosen to allow for TCs failing high. This ! temperature indicates that most liquid inventory has already been removed from , the RCS and that core decay heat is superheating steam in the core. An extreme challenge to the fuel matrix / clad barrier is inuainent and a RED priority is warranted. The appropriate procedure for functional response is i FR-C.1, " Response to Inadequate Core Cooling." If the core exit TCs are less than 1,200"F, then subsequent blocks check for other extreme, severe, not satisfied or satisfied conditions for the safety function. RCS subcooling Greater Than 30 F ' a If core exit subcooling is less than 30 F, then SI flow should be ; maintained to the RCS to provide inventory makeup and the core cooling CSF is not satisfied. Subsequent blocks check for inadequate or degraded core cooling conditions. If greater than 30 F RCS subcooling is indicated, then the CSF is satisfied. l At Least One RCP Running i The Seabrook Station Reactor Vessel Level Instrument System (RVLIS) design has two ranges, full range and dynamic head rense, for use without RCPs , running and with RCPs running, respectively. This block determines which ! reading should be used to assess the core cooling CSF status in subsequent blocks. If any RCP is running, then the dynamic head range of the RVLIS should be used in assessing core cooling conditions. If no RCP is running, then the full range should be used, t [ L P
-c -.--,--,,-.,-,,-,--,--.--y
, n.x, n.,,.m-_m. . - ,,-,.,wn, ea - , - - - _ _ - - , - ,,m.,a-a,__,w_. , , , , ,,,. , , . , , ., - - - - --,,
RVLIS Dynamic Head Range Creater Than: 40% --- 4 RCP 30% --- 3 RCP 20% --- 2 RCP 13% --- 1 RCP If an RCP is operating, then even under a highly voided RCS condition, the core exit TCs can be expected to indicate saturated temperatures. This block checks for RCS voiding less than 507., which, if RCPs are subsequently stopped, would ensure the core would initially be kept covered and adequately cooled. If RVLIS dynamic head range is less than 44, 30, 20 or 13%, depending on the number of RCPs running, then a degraded core cooling condition exists. An ORANCs priority is warranted. If RVLIS dynamic head range is greater than 44, 30, 20 or 13%, depending on the number of RCPs rvnning, then only a saturated core cooling condition exists. A YELLOW priority is warranted. Core gxit TCs Less Than 700 F If at least five core exit TCs indicate greater than 700 F, superheat ct the core exit is indicated. An inadequate core cooling condition will cxist if, in the next block RVLIS indicates less than 3.5 feet (40%) collapsed 11guld level in the core. If core exit themocouples indicate less than 700 F, then an inadequate core cooling condition does not exist and the subsequent RVLIS check will assess whether a degraded core cooling condition has been reached. RVLIS Full-Range Greater Than 40% (core exit temperatures greater than 700 F) If RVLIS full range is less than 40%, then the core is uncovered and an inadequate core cooling condition has been reached. A RED priority is warranted. If RVLIS full range is greater than 40%, then a degraded core cooling condition exists since the core exit temperatures are greater than 700 F from the previous block. An ORANCs priority is warranted. RVLIS Full-Range Creater Than 40% (core exit temperatures less than 700 F)
~22
If RVLIS full range is less than 40%, then the core is uncovered, but since core exit temperature has not reached 700 F, an inadequate core ., cooling condition has not been reached. A degraded core cooling condition Cxists. An ORANGE priority is warranted. If RVLIS full range is greater than 40%, then only a saturated core cooling condition exists. A YELLOW priority is warranted. l 4.3 Heat Sink Tree (Finure 4.3-1) This tree monitors the state of secondary heat sink'and integrity based - on SG 1evel, feed flow and SG pressure. The CSF is considered to be satisfied if all SG 1evels and pressures are within the normal range. The most serious challenge to the CSF is an indication of the loss of l secondary heat sink. A loss of secondary heat sink occurs if decay heat I removal is needed through the SGs and 6.11 feed flow capability is loss. Feed I flow must be re-established or an alternative heat removal mode (e.g., bleed and feed) must be established to prevent core uncovery and eventually an inadequate core cooling condition. Since this is an extreme challenge to the fuel clad / matrix barrier to radioactivity release, immediate operator action l 1s required and a RED priority is warranted. The loss of secondary heat sink condition is the only RED priority included on this tree. There are no ORANGE priority conditions on this tree. A not satisfied condition YELLOW, on this tree can be reached ift (1) any SG pressure is above the highest SG safety valve setpoints; (2) any Sc level is higher than SG high-high feedwater isolation setpoint; (3) any 50 pressure is above the lowest SG safety valve I setpoint; and (4) any SG 1evel is below the narrow range. These conditions do not result in any extreme or severe challenge to a l barrier to radioactlyity release since they only indleste SG 1evels out of the l normal range in some SGs, or potential challenges to secondary integrity. Basist Narrow Range Level in at Least One SG Greater Then 5%/35% A level in the narrow range in any SC, including a ruptured SG, is sufficient to ensure an adequate secondary inventory for a secondary heat I l 23-l l
l t sink. If level is not in the narrow range, the operation of the feed system i t"111 determine whether a loss of secondary heat ink is iminent. 32 3 : At Seabrook Station, we have developed a computer program to l elevate affected setpoints for adverse Containment Building conditions. Should the Seabrook Station Containment Building l pressure exceed 4.3 pais, the reference les process error would invalidate the original setpoint. Seabrook Station has analysed the offset created by an adverse condition and developed an l automatic program to update new setpoints for adverse conditions. Instnaments used to indicate pressure and flow in this status tree are located outside of containment and, therefore, are not affected by adverse containment conditions. Total Feedwater Flow to SGs Greater Than 470 CpH Total feedwater flow of greater than 470 spm ensures that, in the l cbsence of narrow range level in any SG, the capability of feedwater to restore level and maintain a secondary heat sink is available. If not, then cn extreme challenge to heat sink is imminent and a RED priority is warranted, pressure in All SGs Less Than 1,225 pSIC In the event that pressure in any SG is greater than the highest steam l ! line safety valve setpoint, then the SG design limit may be exceeded and l integrity may be challenged. Also, there is no flow path in use removing energy from that SG. The heat sink function is not satisfied and s. YELLOW ! priority is warranted. Narrow Range Level in All 80s Less Than 84% l An overfeed due to excess feed flow or a SG tube rupture may lead to a high level in an 30. This block checks all SGs to ensure identification since it may cause unwanted atmospheric releases or challenge SG integelty. Note that although the level in the affected so may reach the top of the narrow range span, significant volume still exists before the SG fills with water. The heat sink function is not settsfied and a YELLOW priority is warranted. 1 l
=24-i
Pressure in All SGs Less Than 1,185 PSIG If any SG safety valve is open, then a potentially unisolatable heat removal path is being used. A better path is to use steam dump to condenser Cr SG Power-Operated Relief Valves (PORVs) which are controllable and isolatable. Also, condenser steam dump will not release steam to the cteosphere. The heat sink function is not satisfied and a YELLOW priority is warranted.
- Marrow Range Level in All SGs Greater Than 20%
Feedwater should be maintained until the levels in all SGs are in the narrow range unless a faulted SG is identified. Warrow range level is re-established in all SGs to maintaLn symmetric cooling of the RCS. If any level is low, the heat sink function is not satisfied and a YELLOW priority is warranted. ! 4.4 Intenrity Tree (Figure 4.4-1) l MQIIt Prior to a description of the basis for this tree, the i discussion of the pressurized thermal shock as presented in i Appendix A should be reviewed. l This tree is unique among all the CSF status trees in that all the reference values against which current plant parameters are compared do not appear explicLtly at the branch points. Rather, two reference values are curves separating operating re11a n in pressure-temperature space and are shown in Figures 4.4-2 and 4.4-3 (attached) following the status tree, since each reactor vessel is unique in material properties, weld composition and power history, Seabrook station specific curves are included tith the status tree for use. The main concern of the integrity status tree ! is the reactor vessel wall and its ability to maintain integrity when ! subjected to a rapid cooling or rapid pressurlastion transient. As the thick welled vessel ages, it tends to lose its ductility due to radiation embrittlement, and its nL1 ductL11ty temperature, that temperature at which Lt begins to exhibit brittle behavior, increases. Operators are trained to be l
aware Cf the brittlo fr:sture concern, and are required by T :hnical Specifications to limit heatup and cooldown rates to conservatively limit themal stresses below a critical yield stress. This is done to prevent a postulated vessel wall flaw from growing and possibly failing the vessel. Operators are also trained to maintain RCS pressure and temperature within Technical Specification limits to address both thermal shock and cold cverpressure concems. 33313: Temperature Decrease in All Cold Less'Less Than 100 F in Last 40 Minutes If the teinperature decrease in sn/ cold les has exceeded 100 F in the previous 60 minutes, then there is a potential concern for themal shock. If l not, then no other checks on rate-dependent limits are necessary. The only concern remaining is cold overpressure which will be checked in subsequent blocks. If the te'sperature decrease has exceeded 100'F in the previous 60 Cinutes, the decree of cooldown must be assecsed before a themal shock concern can be identified. This is checked in subsequent blocks. All RCS Pressure-cold Les Temperature points to Right of Limit A l i The objective of Limit A is to provide a limit that indicates a potential thermal shock condition exists if it is exceeded. The basis of this f limit is to prevent growth of a flew that could potentially be present in the vessel wall. The method used to calculate this limit is described in Appendix A, labeled, "pressurised Thomal Shock." If Limit A has been exceeded, then operator action is necessary to limit further RCS temperature decreases or.RCS pressure increases. A RED priority is warranted since an extreme challenge to the function is occurring. If Limit A has not been exceeded, then additional checks are made in subsequent block's to determine if a less severe themal shock condition exists. 391t To correlate the calculation of the following temperatures, refer to Figure 4.4-2. l l 1 i
All RCS Cold Les Temp;r;tur:s Cre:t:r Than 250 F (T g) The region between Limit A and 250 F is where a flaw is calculated to n:t grow, but where Limit A may be quickly exceeded if repressurization cccurs. If any cold les temperature is less than 250 F, then operator action is necessary to minimize further RCS temperature decreases and RCS pressure increases. An ORANGE priority is warranted since a severe challenge to the function exists. If all cold les temperatures are greater than 250 F, then a subsequent block checks for a less severe thermal shock condition. All RCS Cold Les Temperatures Greater Than 280 F (T2 ) If any cold les temperature is less than 280 F, then conditions are l close to the point where an extreme or severe challenge to an integrity limit t:111 exist. The temperature region between 280 F and 250 F is intended to cllow time for operator action to try to prevent entering a region of iminent l thermal shock. It has also been defined because cooldown limits more restrictive than the Technical Specification normal cooldown curves are required to safely achieve cold shutdown conditions. For these reasons the l function is not satisfied and a YELLOW priority is warranted. If all RCS cold leg temperatures are greater than 280 F, then the integrity CSF is satisfied. i l M011: To correlate the calculation of the following temperature, refer to Figure 4.4-3. RCS Temperature Greater Than 350 F In order to determine if cold overpressure is a concern, a check is made on whether RCS temperature has decreased to the tamperature below which the Cold Overpressure Protection System should be placed in service. Subsequent blocks check if a cold overpressure condition exists. 1 RCS Pressure Less Than LTOP Pressure Limit if the Cold Overpressure Protection System should be in service and RCS Pressure exceeds cold overpressure limits, then action may be necessary to
cinimize or decrease RCS pressure. The priority of acticn will b3 datorminsd in subsequent blocks. If RCS pressure has not exceeded the cold overpressure limit, then the integrity CSF is satisfied. All RCS Cold Leg Temperatures Greater Than 250 F (Tg ) If cold les temperature in any RCS cold leg is less than 250 F and RCS pressure is greater than the cold overpressure limit, then a severe challenge to the function exists and operator action is necessary to limit RCS pressure. An ORANGE priority is warranted. 4.5 Containment Tree (Figure 4.5-1) The intent of the containment CSF is to maintain containment integrity, 4 since this represents the third and final barrier against radioactivity release. In order to evaluate the status of .this CSF, the tree evaluates several possible challenges to containment integrity or essential equipment inside containment and directs the operator to an appropriate procedure for function restoration. The function is satisfied if containment pressure is below the 18 psis set pressure, containment water level is less than flood < 1evel and containment radiation' level is below the post-accident radiation I clarm setpoint. Basis: Containment pressure'Less Than 52 PSIC 4 d If containment pressure is greater than design pressure, an extreme challenge to the containment barrier exists. The challenge does not necessarily come from the pressure alone, but rather from the potential pressure spike which could result from a hydrogen-oxygen ignition. The total pressure could then potentially exceed the strength of containment. Also, cbove containment design pressure, le'akage may exceed design basis limits. It is expected that containment pressure suppression equipment should be able to maintain pressure below design pressurd., If not, then operator action is necessary to check containment functi'ons and a RED priority is warranted. s s k i k
- i
Containment Prcosur3 Less Thin 18 PSIC At a pressure below design pressure, it is unlikely that even a hydrogen-oxygen ignition could result in sufficient overpressure to fail containment. Pressure above 52 psig indicates a significant energy release to containment and merits prompt operator action to ensure operation of containment pressure suppression equipment and perfor1 nance of Phase B isolation. Pressure above 18 pois requires ensuring main steam line isolation cnd is considered a severe challenge to the containment barrier and an ORANGE priority is warranted. . Containment Sump Level Less Than 5 Fset-8 Inches High energy line breaks could result in a large volume of water being pumped into containment. As the water level rises, it might threaten the cvailability of equipment required for long-term cooling of the core and/or containment. Such a high water level is considered a severe challenge to the containment barrier and an ORANGE priority is warranted. Containment Radiation Less Than Twice Background Normally, Containment Building radiation levels are fairly low and constant. However, during an accident, significant radioactivity may be i released into the containment atmosphere. In-containment systems are available to filter and scrub the contaminants from the atmosphere, and radiation alone does not represent a threat to containment integrity. This is considered a not satisfied condition and a YELLOW priority is warranted. If containment radiation is less than twice background, then the function is satisfied. 4.6 Inventory Tree (Fiaure 4.6-1) 2 The inventory CSF is concerned with the maintenance of pressurizer level in the normal operating range (above the letdown isolation setpoint and above the pressurizer heaters, but below the high level reactor trip setpoint) and having a full reactor vessel (no voids in the vessel). Other aspects of RCS inventory necessary to maintain adequate core cooling have been integrated t 4
l
- into th) cero cooling CSF status trao sinco th3y cro moro dircetly colotcd to I core cooling and are of higher priority than this CSF. This tree contains no priority higher than YELLOW, indicating a not satisfied CSF.
Basist Pressurizer Level Less Than 92% This decision psint allows proper resolution of the actual inventory condition in subsequent decision blocks. If pressurizer level is above the normal operating range, the next decision block determines if it is due to excess inventory or voids in the vessel. If level is not high, then further questions check for low level and voids in the vessel. . RVLIS Indicates Upper Head Greater Than 90% (pressurizer level greater < than 92%) Having already determined that pressurizer level is high, this question tries to define the cause. If the upper head region is full, then the problem is simply one of excess inventory; the condition is considered not satisfied for inventory and a YELLOW priority is warranted. If the RVLIS does indicate voids in the upper head region, then the problem is likely due to some type of bubble in that region. Since the presence of a bubble, in itself, does not represent a challenge to the inventory CSF, it is considered a not satisfied condition and a YELLOW priority is warranted. NOTE: Seabrook Station again uses an intelligence containment pressure ! signal to determine if a normal setpoint or heated reference leg setpoint will be used in the decision block. Pressurizer Level Creater Than 17%/50% This block is entered after having determined that pressurizer level is not high. If level is also not low, then the pressurizer inventory is considered satisfactory and a further question is asked about reactor vessel level. If pressurizer level is not greater than 2%, then the problem is one of low inventory, with or without voids in the vessel. The condition is considered a not satisfied condition and a YELLOW priority is warranted. The k .. .
I i i care cooling status tree checks for more severe or extreme challenges to inventory that also challenge the core cooling CSF. RVLIS Indicates Upper Head Full Greater Than 90% Having determined that pressurizer level is normal, the remaining inventory question relates to water level in the reactor vessel. If level does not indicate that the vessel is full, some type of voids are present in the vessel upper head. The presence of an upper head void does not, in itself, represent a challenge to the inventory CSF. It is considered a not catisfied condition and a YELLOW priority is warranted. Y I
SUBCRITICALITY STATUS TREE (RED) GO TO FR S.1 (ORANGE) Go To f""""" FR S.1 NEUTRON FLUX NO I ENTER h LESS(RTP) THAN 5% - YES l (YELLOW) SO Go To l e FR S.2-E INTERMEDIATE go INTERMEDIATE NO MOR RANGE SUR _ - NEGATIVE YES YES THAN-0.2 DPM N GA VE CSF (GREEN) SAT "O SOURCE
- RANGE ENERGlZED YES (YELLO,W) Go To e FR S.2 e
SOURCE NO l RANGE SUR ZERO OR l YES l NEGATIVE l CSF SAT (GREEN) FIGURE 4.1-1 CORE COOLING STATUS TREE (RED) GO TO FR C.1 l G (RED) R- 1 CORE EXIT NO "O RVLIS-ENTER h THAN 1200'F TCs LESS - YES
- GREATER -
THAN 40 % YES NO = GO TO _ ICsES (ORANGE)
. FR C.2 THAN 700*F YEs (ORANGE) = GO TO FR C.2 AT LEAST NO ONE RCP - NO RVUS.
RUNNING yEs - GREATER - THAN 40% yes I
. GO TO RCS (YELLOW) FR-C.3 SUBC00UNG NO T0AN 30*Fs (ORANGE) G T R C.2 RVLIS-DYNAMIC NO HEAD _
GREATER ygg THAN 44 %4RCPs 30 ~ %3RCPs T GO TO 20 %2RCPs FR C.3
'3 "C"'
(YELLOW) (GREEN) CSF SAT FIGURE 4.2-1 HEAT SINX STATUS TREE l l RH1 . i TOTAL FEEDWATER NO FLOW TO _
~
SGs GREATER YES MAN 470 gom (YELLOW) GO TO eeeeeeeece g,g SG NR - PRESSURE IN LEVEL IN No ALL SGs NO I AT LEAST LESS ENTER F ONE SG YES THAN 1255 GREATER YES pglg BAN _h (YELLOW) GOTo a a eeeeeeees FR H.3 NARROW RANGE No LEVELIN ALL _ SGs LESS THAN YES 84.5 % NONADVERSE ADVERSE (YELLOW) GO TO SETPOINT SETPOINT ,,,,,,, e FR-H A 5% 35% PPESSURE IN g3 ALL SGS '
~
J L JL LESS 1185 PSIG YES (YELLOW) GO TO !
, FR H.5 NARROW CONTAINMENT "O RANGE LEVEL BUILDING NO IN ALLSGs PRESSURE GREATER YES GREATER THAN 28%
THAN YES 4.3 PSIG n CSF
, (GREEN) SAT FIGURE 4.3-1
INTCORITY STATUS TREE
, (ATTACHMENT A) 8 -
J v E E 5 5 O Ti Ta COLD LEG TEMPERATURE R P. Att RcS (ORANGE) GO TO COLoEG TEMPERATURE l"""" e FR P.1
- POINTS TO YES
",$', ' ai.L RCS No (YELLON).. GO TO T- EMauRe - .
FR-P.2 GREATER THAN YES 250*F (Ts) Al.L RCS TEMPERATURE COLD LEG NO DECREASE IN NO b TEMPER-ATURES ALL COLD ENTER h LEGS LESS THAN 100*F VES GREATER THAN 280*F (T2 ) IN THE LAST 60
"'"U
(GREEN) CSF SAT (ORANGE)y GO TO FR P.1 ALL RCS COLD LEG NO l ( ATTACHMENT Bb TEMPER-ATURSS YES RCS PRESSURE GREATER THAN LESS THAN NO 250*F (T,) , I RES URE GO TO UMli YES (YELLOW)eis FR P.2 NO RCS
- TEMPERATURE -
GREATER THAN YES , GF 350*F# SAT gi (GREEN) CSF SAT
- ARMING BISTABLE SETPOINT FIGURE 4. 4-1 SEABROOK STATION OPERATION LIMIT CURVE i 8 i I i ' I ! t I I I fI ' t 6 * ' 6 '
I !' I t iit l !I ie 6 e ! I i it i l!!I I
, i e i t iii e s s i s i I s i i t ! ! ' i . 5
""~
t i t i 6 . 6 i , i i . e , i i i t i*
, , . $ e i i . i . ! e i i ,i i 4 . . 6 i i . i i , t i i ' * * . . . e i i i, i . i e i i i i e i e i i i e i 6 . i i i i 6 e i i . i t i i e ... . i . . i i i e i e i i i . i . , , 6 . i ie t I
- i i t i i i i ? I 6 . . I l i iii 1 . i i e i . i i i I ' ' i ' ' i '
i i * . ! t I wen en 1 nonAm t A i i ' i ! ' e i i
- i i e i i 6 i i e i i q i j e i i LV%f , . L%J%/ e i ' 1M i w
i e i e i e ' ' *
! . . i , e i i/ iiie e i i e i i 6 e i i a e i i i i i i e 6 6 i i i e *
- I ' , e t t ! t *
- i
, , t i e i , , . / , t t t i
i j i i ! . . , A t i e ,I i e i 6 6 e i i i 6i i e i e i i , i i i j i . i i i i i e 4 , i i 6 . /6 . . i a .
. i e i i i . . ! e i i i e i i i !
i . , , , i e ij , e i . i , . . . t i e i . . . i . ie i j i . , , i y, a e i 6 i . . i e i i 4 6 , e ! e i i i i i . j 6 i i i i i i t
- e e i e yeoe, i ;/ s 4
, e . 9 i t i i '
**6=% T., s ! Ii ! i i i i e ' * ! i ear A ! rw,t e W /t i t I e
, I i e i i e . i i i e i i i i , ,
i s.www i r .s i CfI i . , i e i
" i , e , , . . . . . .
, , , j i i e
. . . , e i 4 i e e 4 t i r e a i i e i . . i i i 4
. . I i i i i ! , , ! ! 6 6 i i i i 6 6 6
. e i . . , e i .
i j . 6 i t i 6 i . 6 i i i
. i i . i a f I ii6 6 e i
, 6 4 i ! 6 i i 6 f . 4 i
. . I 6 i i e t i i e i i i .
i i i i 4 4 i i
- i + i e 6 6 i i . I i j i i i .
i 4 4 i i e
,iI i e i i i t 6 i I e i 6 6 . I i i . .
i i , . 6 i i 6 ef' i i i 6 6 . . . . . . . .
\M- if 1,
i i i i . . 6 i _ . i i ! 1 i J p p i i i . . !
. , I S2 . . 4 . . .
m l
, e 6
i . e e , i
- 8 i i 6 I $ .
e i i 47.! t ! . I ! i ! i f e i 4 i i e i e t , ! if . . , 4 t t t i i i
- I I i e i t 6 i 6 i i i i i . .
l 4 4 f i , 9 i 8 i . 8 l I l' j g i ! i , , i t . * . i . i (g ri i i . i e
- t ' i ' ' ' 6 y Al e i e i i . 6 i i e !
%.; e i t i i . . <
J f I ! > i e i . i
. i 6 i e i e i e e i 6
. i ..a- . .
CO UI i 6 6 ' ' .
- W j t i . i6
. i . . , it!
I t i e t . . . . . g 1 b- . . 4 i 6 i e . sw , - ML L. F 1 i,f m ., . I WMl7VL i i-. , w, i i>i
, a i i i
, 4 6i
~ ~ . - .
V RLL.IN
, i ,
! i i e i i i e i 6
i i e i , i e i , . . 6 i . j j i . . 6 , i i . . f j i 1 i i . 6
- 4 e i i , ., i 1 I 6 ] j e e i 6 6 i . . 6 i . i i s i i 6 * . i i e ij ) i e i i i a . . i . . . i ; '. i i . i af i e i . . i t i
, I i i 8 l 4 ! l .
I i i . 6 i 's e i i If e . 6 i i t . i i i .
! I i , 4 9 f l i i i i ~t i I i i i e I { [ . . e i i i 8 e i I l 't 6 . k 6 i } e . I e i !
i i , .
. i t i l i 4 5 6 l . i . f I I . 5 e i g 3 l I O r r r i I W
19 f I I I I Il T2 TEMPERATURE (*F) FIGURE 4.4 -2 t
SEABROOK STATION OPERATION LU11T CURVE WITH SUPERIMPOSED LTOP PROGRAM i . , ie i i e . i+' i f e 6 . i ' i . f . .. . I i i ! i 6 6 . ! . ! i . . . . . .
. i * . ! iii . i i i . i i i i i . . . . !6 i . i i , i . i .I i . i . ! , . . .
i . , , i , i . . i . i i i i . . . i i , i . . . ! i i i i i . i e i . . . e i i , . ! i i i . 6i . . . i i! . . 4 . ..! . I i 6 . i . i 1 . . .. . . 4 . . . i i , f . i ! I . t t . i . ' i i i ' . 6 1 i
's i i . i . ' .
[ i , i , e. . i . . i . i ! . , . . i i
. ; . . . . , , i . . . i i ! e i . . . . . , t . ! . . . i i
. . . , , . . . . , 6 . ! , i , . . . . i . . i . . . , . . . . . .
i I i , , , , . i i i . . .. . . . > i ! i i i a . . ., i i i . . . . . , , . I ! i i , 4 i . . . 1 i . . , . . . i i I . . . i i . 6 * . . 4 , i . , , , . . . . . , , , , , , . . . . . . . . i m,- - , . b= M ve '.bE!Y' { i j I i i l I ! t . i ! ! I i . t t . I ! ! .' l . I I l 1 I I l t . e i i e 2sso_ , _
. -- i ..
l . i , . i . .,
.J r:
i
, i
. . -. i .
. ' INV ' v85 2.=~
. rum rg.'..i i . . i !
2500
, . , i . . i . . . . . i . i t , i . . , i i , i '. i
. , . . . . . . . , . . . ,1 i i , i ! , . . . i . , .. ~ -- .
2385 i , , , . . . . . . i , . . .
, ,r ,
6 . .
. i
, . . . r.
, . .l . , . . , . ! . .
3 i , i i i i . ,
! , i i . . . . ! f. !
i , I i i i r 3 . 4 i . t t , ill i . . t i . E . 4 . (/) i i i i i , i i if i . i i i i . i i . i i li i i i i . . b ! l . t . . . g: .
. . . . . f f .I f e , i . .
%# i i i . . t i i i i t i E! i ! ei . . . I i i I i tf . 6 . I ! ! ! ! . ' i t i i . 4 i ! i i y . . . 6 . . i , i 3 6 if . i . i e i .' , . . . i r.. . . . . e i i i i i h"2O N-- i , . . . . . 1 i, . .
,f ii' z
! i . i i . . i . i . .; i i 6 . i i . i . i i 4 . . . . . . i .
- I i i i . .. . . i i i i ; e i . . . .
! ! . , .I i i Ii l . ' i i { l 4 i . ! i I . lli i i e i I i e i . . i I (i .l . I e i .
i . , O i i . t j i t i ! Ji! i ! . i $ i ! . . . i i A i 3 . . i .
- p. i i i , i , i. ! i i rii i .! i . i i s 6 6 I i .
i . .
. i .
- i. i .
7i i i
! - i i i i i . i i . . .
- . . i ' .
g i i i . 6 4 . i l .iii i ?r. t . . . I ! t i t/ . . l . . t . , ' t . i l i t , , e ! i
. t t ilt ! ! . . . , i . i i i i / ' i - ?' . ! .' . i . ' t 1
- i , i ! !
- tli ! t ! . . I ! . i i e t / i i ! ' i I . . ' , e ' i f
. i i , i i li i 1 . ' ! . I i ! . i ! / i t ! i i ! t i i ! i . I 7p l i .. . . , f i e , ! , , i i . i .
e . . * ! . . Ii . r i . . . 1 i . . . . . 1 . i. . . . i ! . . i if f6 , i ! I i !.! i 1, , . t O . , . . . . !r!
! ! li .i...
. . e , , . . + . , s
! II .
!l 1
. ' i . ,
. i Q,, I t i i . 3 ! ! . ! i !
i . i
. 4 . .
. i ! . . . , !ll . . . . . i ! . . . fi i . t i i . . . i . . i i i . / ii i . . . i . . . . . .
I 1 2 .
, t i t
11 l. iv i . .
. i !
t
! # t /
/ t I
i i i l iie Io , . t i . i e 2 e i . . . i iI . . . . . '! . . ., , /. 6 i . ! i . . . . . M ] Anp I . I i t 6 ilt i ! i I . . ' i i ! V ! ! t I i i i i . . ' ' ! ' i
-tvvv i i ! , . 6 il! 6 i e i . 6 i . / . ! !4 i i . 1 i i . . . i * )( 6 . i 4 . lai . ..
Ii . i? i . i i i i i V i / 1 i i t i t i 6 . i i ! . 1 . .
, i i . . , i ? i 4 i e e ! ! .
a nnA o di i! ! . > 4
? V! ! i i . ! i , i I I
i i . . . . i ! , 2 . 1 i i t aw . 4 . If i . , i . . .
. . 4 i 6 jr.
f .. i. 4 . i . . 6 . i ! i i . . 6 . . . . .
. . ,, , ,J, . . , . . . , . . , . , , . , . i . , . . ,
i i! l , , , i ! i .,. 4 . , . 6 i , i i 4 . ! . . . . . i . e , i 6 .i !ij l 6 /i ! . . . 4 i i . I e 6 i 6 mmmas ii -. i . . , . . . . . ! , , i 500 a !. i i , i . i i 1,w -,4 . 4 6 4 . .. , , . i s , ! , i . . , ,
, , . i. ! . . . e i . i ,
J
, i 1 , . , , i, . , . . . . . , .. . . . . . , , . . 4 , , i . i
! , ! ! . , r i ,i i . , . . . 6 ! . . . . . . ! . . . . , . , i , , . .
! . I I i I i . ,
I ii i i i ! . 6 i
! . . * , , i l t , i j
- i e i
. . . . . t , i , i . . . . . . . . 3 . . . . i , i . . . . . . .
200 . IbO 15 0 200 250 300 350 4bO T*I T8 I lLTOP RCS TEMPERATURE ( F) ARMING POINT 350 F FIGURE 4.4-3 _ _ - . . _ . _ _ _ - - ._.s_. . . . . .. 1 CONTAINMENT STATUS TREE l l 1 l R-Z. CONTAINMENT NO ENTER h PRESSURE
"^"
$'PS G YES (ORANGE) GO TO PW"MMMM FR Z.1 I E CONTAINMENT No PRESSURE LESS THAN 18 PSIG YES (ORANGE) umm - - GO To FR-Z.2 E
CONTAIN* 'ENT BUILDINL NO 's LEVEL - LESS THAN 'bb sn 8,n (YELLOW) GO TO
*** FR-Z.3 I .
CONTAINMENT RAOIATION NO LESS THAN _ TWICE
*b BACKGROUND CSF (GREEN)
FIGURE 4.5-1
. _ _ _ . _ .. . . ~ . . _ . _ . _ _ . _ ._. ._ _ _ _ __
INVENTORY STATUS TREE i (Y' ELL'OW)
~
GO TO e FR-l.3 e RVLIS INO: CATES No VESSEL LEVEL GREATER YES THAN g /, e
,,, GO TO FR l.1 (YELLOW)
PRESSURIZER NO (YELLOW) Go To ENTER h $ pan
'tg[7 92 %
YES , FR-l.2 e e PRESSURIZER NO LEVEL GREATER y, (YELLOW) GoTo THAN % % EGG m
- , F R l. 3 RVLIS INDICATES No NONADVERSE ADVERSE _
VESSEL LEVEL SETPOINT SETPOINT
^ '
17 % So */, THA */.
~
h
} CSF
"""" SAT suimNe NO (GREEN)
PRESSURE GREATER THAN YES 4.3 PSIG. FIGURE 4.6-1 1
_ _ _ = 5.0 SPDS CRITICAL SAFETY FUNCTION STATUS TREE DISPLAY ORGANIZATION AND INTERNAL PROGRAMMING 5.1 SPDS Display Organization The computer-generated automatic CRT displays consist of a high level display, showing the current status of all trees, plus separate displays of cach of the individual trees. The high level display consists of a matrix of rectangles (see Figure 5.1). For each of the CSFs, only the color of the most cetive path will be shown, illuminating one of the matrix rectangles. The , high level display updates constantly to accurately reflect the change in any ctatus tree condition. The capability exists for each tree to be displayed ceparately, with the active path of the individual tree indicated by " flashing" its branch with two different intensities of color. On each tree a reduced form of the high level matrix is shown. In the lower left portion of the individual trees, a one-line color bar is presented (see Figure 5.2). This color bar is subdivided to represent the active status of all status trees. This allows the operator to scan through the individual trees and yet never lose sight of the complete set of CSF status. The selection of the high level display occurs automatically upon receipt of a reactor trip or safety injection actuation signal. From this point on, all selections are made manually by the operator. It was the developer's opinion that a priority automated reselection of displays would create confusion. If the operator had a status tree displayed, and it cutomatically changed before the parameters were verified, confusion would prevail. To remove the necessity for this type of automated changeover, the full spectrum color bar on each status tree was developed. With the placement cf the cursor on any of these status colors within the bar, the operstor with a single pushbutton entry can concisely select a tree that indicates a more severe challenge. At the terminus of each path within the status tree there are directions for the operator to follow. These directions either inform the (perator that the status tree is satisfied or at the terminus of the challenged paths' directions to functional recovery procedures. Seabrook Station operating philosophy dictates that results from these computer programs are verified to its conclusion by checked parameter validity with indicators on the MCB prior to any operator action. In an attempt to simplify this process, the post-accident monitoring instruments were used for computer inputs. These indicators are uniquely identified on the MCB by an ORANGE identification label. The SPDS uses only analog signals that are determined to be reliabl9 by the computer. Every time an analog value is scanned by the main plant computer, it is checked for: o Sensor millivolt value reasonable o open circuit o Off-scan o Substitute values o Old data (values have been updated in last 5 scans) o Invalid gain If any of these checks are unsatisfactory, then an unreliabic status word is assigned to that analog point, and it is ignored by the SPDS computer calculation. If all the points necessary to make any determination are unreliable, then a conservative substitute value is inserted by the computer. Example: If all four steam generator levels were auctioneered for any level tbout 85%, and all four level signals were considered unreliable by the computer, its circuitry would iridicate that a level was above 75%. This type cf conservatism applies throughout the SPDS programming. 5.2 SPDS Internal Programming 5.2.1 Suberiticality (SUBC) Program The program SUBC was written to provide calculated points (c-points) to the analog data base. The e-points are used by the Color Graphics System (CGS) to display system parameters and to indicate an end result in the SPDS CSF display suberiticality. The CSF is shown in Figure 5.2-1. Most cf th2 c-p31nts fcr cach d:cicien block in th3 cuberiticality status tree are calculated by subroutines of SUBC. The subroutine corresponding to each decision block is listed below that decision block in Figure 1. The value of the e-points generated by these subroutines are written on the actual display. The end result of the status tree logic based on the c-points and the corresponding decision block setpoints are determined in a subroutine called LOGIC. In the main program, SUBC uses the Analog Input System (AIS) subroutine NVALST to call the data used by the subroutine from the analog data base. The cnalog points (a-points) called are the source range, intermediate range and power range detector signals, and previously calculated SUR data. The main program then calls the various subroutines and passes the data to them. The.first subroutine called by SUBC is PORA. The subroutine sums the signals from the top and bottom Power Range (PR) detectors at each excore detector location. The summed values are then auctioneered iugh, and the result is returned to the calculated data base, d 1 The next subroutine called is INRA. INRA is used to calculate SURs from the input Source Range (SR) and Intermediate Range (IR) excore detector Dignals. The SUR is defined as the log change in reactor power per unit time. The units of the SUR are expressed as dpm. INRA calculates either the SR SUR or the IR SUR, which is appropriate. ( The calculated SUR is based on the change in reactor power as indicated by the detector signals. These are scanned and updated in the analog data base every five seconds. The form of the signals in the data base is logarithmic.-so the new SUR is found by subtracting the power at the last scan from the present power. The SURs are calculated as a weighted average. The
- old SUR is given a weighting of 2/3 and the newly calculated SUR is weighted 1/3. In this way, the stochastic nature of the detector signals, especially the SR signals, are minimized. This weighting also provides an acceptable response time. If it is determined that a faster response, or a less fluctuating SUR, is necessary, the weightings can be adjusted accordingly.
The detector signal value used to calculate the SUR is an auctioneered high value of the two inputs. If one of the inputs is found to be unreliable,
. .. .- ~- . - - _ . - - - - - - - . - . - - _ - . - - - _ - .-
i
- L i
the other is used. If both inputs are unreliable, then no new SUR is ! calculated. The subroutinS keeps track of how many consecutive times this ) occurs by using a e-point counter. If the counter reaches 5, then the default , value of 100 is assigned to the e-point. The maximum value the counter is allowed to reach is 10. Each time reliable input is passed to the subroutine - cnd the counter is greater than 0, -1 is added to the counter to bring it back to 0. Finally, the subroutine writes the counter, the calculated SUR and the dettetor signal to the calculated data base. All three will be used by the ,, cubroutine the next time the program is run, but only the SUR is used to cvalunto the status tree. > ! The third subroutine, SORA, returns an auctioneered low value of the SR detector signals. If one of the inputs is found to be unreliable, the other is used. If both inputs are unreliable, then the default value of -100 is casigned to the c-point. . The last subroutine used in SUBC is called LOGIC. LOGIC reads in all the e-points generated by the other subroutines in SUBC and evaluates the decision blocks of the status tree. The subroutine returns a e-point which has an integer value from 1 through 6. These values are used by the CGS to , determine the final outcome of the status tree. For example, a value of 1 indicates the status tree should be red (the first, or top, possible outcome). A 6 indicates the last, or bottom, outcome (this is green). The , values 2, 3, 4 and 5 are used for the final outcomes in between 1 and 6, in ceder of the ascending value from top to bottom. t The setpoint for the first decision block, " neutron flux less than 5%," was determined by observing the PR a-points when the simulator was at a ' modeled reactor power of 5%. The setpoint for " source range energized" is 10 cys. This setpoint logic assumes the decision block requires the SR detectors be energized and on scale. In the simulator version of the programs, the reliability checking , portion of each subroutine is bypassed and all output status words are set i j L-
to 0. This is done because reliability of data status words has no meaning at the simulator. The program is set up to run by the periodic scheduler every five seconds. In this way, the data is being continuously updated and the CSF is closely monitored. 5.2.1.1 Calculations The following calculations are performed by SUBC: SUR = (PNEW - PPAST) x 12 SCANS / MINUTE SUR = (SUR x 1/3) + (SUR PAST x 2/3) where: SUR = New (instantaneous) Startup Rate PNEW = Present Logarithmic Detector Signal PPAST = Logarithmic Detector Signal From Last Sean SUR = New Usighted Average Startup Rate SUR PAST = Weighted Average Startup Rate From Last Scan 5.2.1.2 Analog Inputs Point ID Name Instrument No. A1000 SR DET 1 LOG PWR NI-NM-31F A1001 SR DET 2 LOG PWR NI-NM-32F A1002 IR DET 1 LOG PWR NI-MM-35B A1003 IR DET 2 LOG PWR NI-NM-36B A1004 PR 1 TOP DET PWR NI-NM-41C A1005 PR 1 BOT DET PWR WI-NM-41D A1006 PR 2 TOP DET PWR NI-NM-42C A1007 PR 2 BOT DET PWR NI-NM-42D A1008 PR 3 TOP DET PWR NI-NM-43C A1009 PR 3 BOT DET PWR NI-NM-43D A1010 PR 4 TOP DET PWR NI-NM-44C A1011 PR 4 BOT DET PWR MI-NM-44D 5.2.1.3 Calculated outputs Point ID Name Type Output / Units
- C0709 SR PAST POWER - SPDS LOG CPS
- C0710 SR SUR - SPDS DPM
Point ID Name Type Output / Units
- C0711 IR PAST POWER - SPDS LOG AMPS
- C0712 IR SUR - SPDS DPM
- C0713 SR UNREL COUNTS - SPDS N/A
- C0714 IR UNREL COUNTS - SPDS N/A C0715 PR AUCT HI - SPDS NAMPS C0716 SR AUCT LO - SPDS LOG CPS C0747 FAULT TREE LOGIC - SPDS INTEGER INDICATION 0 = Also Used as Inputs Input / Output I
SUBC is run automatically every 5 seconds by the computer periodic ccheduler. No operator action is required. The input analog points are cccessed directly from the analog data base and the output calculated points cre written directly back into the data base'using the AIS subroutine PLACIP. Subroutines SUBC internal subroutines: PORA INRA SORA LOGIC AIS subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB NOTE: The above description reflects the current design. We intend to substitute inputs from the new qualified excore nuclear instrumentation in place of the inputs currently from the original Nuclear Instrumentation Systems. This change will be reflected appropriately in the CSF status tree.
5.2.2 Core Coolint (COCO) Programming The program COCO was written to provide calculated points (c-points) to the analog data base. The e-points are used by the CGS to display system parameters and to indicate an end result in the SPDS CSF display COCO. The CSF is shown in Figure 5.2-2. All of the c-points for each decision block in the core cooling status tree are calculated by subroutines of COCO. The subroutine corresponding to cach decision block is listed below that decision block in Figure 5.2-2. The . value of the c-pointe generated by these subroutines are written on the actual display. The end result of the status tree logic based on the e-points and the corresponding decision block setpoints are determined in a subroutine called LOGIC. The AIS subroutine NVALST is used to call the input data from the cnalog data base. In the first subroutine, CETC, the core exit thermocouple temperatures are called directly. The subroutine LOGIC also calls the data it uses directly. The other subroutines in the program are passed data from the main program. The first subroutine called is CETC. The subroutine checks each input point for reliability. Any values which are found to be unreliable are not used. The subroutine next sorts the TC data in ors of lowest to highest temperatures. The ten hottest TCs are averaged. This average and the hottest TC are returned to the calculated data base. If less than ten TCs are found to be reliable, the subroutine averages all input. If no TCs are found reliable, the default value of 12,000 F is assigned to the average and hottest TC c-points, and the corresponding status words are set unreliable. The next subroutine called is RCSSUB. RCSSUB calculates the RCS subcooling margin. RCSSUB uses as input the average of the ten hottest TCs calculated by CETC and the hot les pressures. The subroutine calculates a saturation temperature for the input and auctioneered low value of pressure using a three-part, third order polynominal curve fit of the pressure-saturation temperature curve. The curve is divided into regions of < 300 F, 300 F to < 1,000 F and g 1,000 F. The input thermocouple I temperature is then subtracted from the saturation temperature, and the resulting subcooling margin is placed in the calculated data base. If the cubcooling margin is less than 0, it is set equal to O to avoid indicating a negative subcooling margin. RCSSUB auctioneers low the input RCS hot les pressures. If one of them is found to be unreliable, the other is chosen. If both are unreliable, or if the average thermocouple temperature input is found to be defaulted, the cubcooling margin is assigned its default value of -1,000 and the associated c-point status word is set unreliable. The third subroutine called is RCPR. RCPR counts the number of running RCPo and returns the number to the date base. The input RVLIS is checked for reliability and converted to true vessel level using the a-point true RVLIS curve. A RCP-dependent dynamic RVLIS is also calculated. Both of these values are returned to the data base. The subroutine also performs a I comparison of the converted RVLIS with setpoints which vary depending on the number of running RCPs. A binary-type output is returned based on the comparison. In detail, the subroutine works as follows. The subroutine uses the digital input system subroutine DGSTAT to input the RCP breaker information. The logical function TSTBIT is called to determine the breaker positions. The number of closed breakers are added in the variable NRCP, thus indicating the number of running RCPs. Breaker position information is found in bit 15 of the digital input words. Using the input RVLIS information, RCPR next calculates the dynamic RVLIS. The dynamic RVLIS value is compared to the setpoints given in the "RVLIS Dynamic Head ..." decision block of Figure 5.2-2. These setpoints vary depending on the number of running RCPs. If the dynamic RVLIS exceeds the tppropriate setpoint, a 0 is returned. If the comparison outcome is no, a 1 is returned. In the cases of no reliable RVLIS input, a 1 is always returned. Lastly, the subroutine converts the RVLIS input according to the three-part curve. This number is returned to the data base for use by this program and others.
. . . . . . .-- _- _ _ _ . ,- .- - _ _ _ . .= - _ .- . __ _
COCO also defines a logical function called TSTBIT. TSTBIT is used to check the condition (alarm or return) of a specified bit in the input 16 bit word. If the specified bit is in the alarm state (i.e., equal to one) the function is true, otherwise it la false. In the COCO subroutine RCPR, TSTBIT checks RCP breaker positions. Closed breakers are indicated by the 15th bit 1 being in the alana state. Digital data base bits are numbered 0 through 15, right to left. l 4 The last subroutine used in COCO is called LOGIC. LOGIC reads in all the e-points generated by the other subroutines in COCO and evaluates the
' decision blocks of the status tree. The subroutine returns a e-point which has an integer value from 1 through 8. These values are used by the CGS to determine the final outcome of'the status tree. For example, a value of 1 indicates the statua tree should be red (the first, or top, possible outcome). An 8 indicates the last, or bottom, outcome (this is green). The values 2, 3, 4, 5, 6 and 7 are used for the final outcomes in between 1 and 8, in order of ascending value from top to bottom. ! The program is set up to run by the periodic scheduler every five ceconds. In this way, the data is being continuously updated and the CSF is closely monitored.
5.2.2.1 Calculations The following calculations are performed by COCO: Dynamic RVLIS RVD = RVIN x (0.2 + 0.8 x NRCP/4) Converted RVLIS
- 1. If RVIN 1 73, then RVCI = (1.222 x RVIN) - 22.2
- 2. If 73 > RVIN > 28, then RVCI = (0.111 x RVIN) + 58.9
- 3. If RVIN 1 28, then RVCI = RVIN x 2.214
- - _ . ~ . _
RVC = RVCI x (1 + NRCP) Where: RVD = RVLIS, Dynamic RVIN = RVLIS, Input NRCP = Number of Running Coolant Pumps RVCI = RVLIS, Converted Intermediate Solution RCV = RVLIS, Converted Subcoolina Martin
- 1. If P # * ""
HL T SAT
= .3225 x 10 x (PHL ~ * * *
(PHL) + 1.2997 x PHL + 228.4
- 2. If 300 s PHL < 1*000, then:
~
Tgg = 1.1186 x 10 x (P HL ~ * * * (P + * *
- HL HL +
- 3. If PHL 1 1.000, then:
T * * ~ SAT "
'HL (PHL) + 0.1897 x PHL + 394.32 Finally:
SH =T - SAT Where: P HL
= Auctioneered Low Hot Les Pressure T = Saturation Temperature at Pressure P ST HL T = Average of 10 Hottest Core Exit Thermocouple Temperatures SM = Subcooled Margin 5.2.2.2 Analom and Digital Inputs Point ID Name Instrument No.
A2850 INCORE A THIMB 1 H15 TEMP IC-TE-43 A2851 INCORE A THIMB 2 K02 TEMP IC-TE-38 A2852 INCORE A THIMB 3 L10 TEMP IC-TE-13 A2853 INCORE A THIMB 4 PO4 TEMP IC-TE-48 A2854 INCORE A THIMB 5 H06 TEMP IC-TE-4 A2855 INCORE A THIMB 6 D12 TEMP IC-TE-31 A2856 INCORE A THIMB 7 B06 TEMP IC-TE-39 A2857 INCORE A THIMB 8 E09 TEMP IC-TE-12 A2858 INCORE A THIMB 9 H03 TEMP IC-TE-26
- A2859 (LATER)
- A2860 (LATER)
A2861 INCORE B THIMB 2 ALL TEMP IC-TE-54 A2962 INCORE B THIMB 3 K06 TEMP IC-TE-8 A2863 INCORE B THIMB 4 F01 TEMP IC-TE-51 A2864 INCORE B THIMB 5 F07 TEMP IC-TE-7 A2865 INCORE B THIMB 6 R06 TEMP IC-TE-50 A2866 INCORE B THIMB 7 N14 TEMP IC-TE-55 A2867 INCORE B THIMB 8 NO2 TEMP IC-TE-56 A2868 INCORE B THIMB 9 H13 TEMP IC-TE-24 A2E69 INCORE B THIMB 10 E11 TEMP IC-TE-21 A2870 INCORE C THIMB 1 C09 TEMP IC-TE-3 A2871 INCORE C THIMB 2 R08 TEMP IC-TE-44
- A2872 (LATER)
A2R73 INCORE C THIMB 4 B13 TEMP IC-TE-58 A2874 INCORE C THIMB 5 H11 TEMP IC-TE-9 A2875 INCORE C THIMB 6 J14 TEMP IC-TE-36 A2876 INCORE C THIMB 7 J01 TEMP IC-TE-46 A2877 INCORE C THIMB 8 LO8 TEMP IC-TE-10 A2878 INCORE C THIMB 9 F03 TEMP IC-TE-30 A2879 INCORE C THIMB 10 EOS TEMP IC-TE-20 A2880 INCORE D THIMB 1 J07 TEMP IC-TE-2 A2881 INCORE D THIMB 2 R11 TEMP IC-TE-53 A2882 INCORE D THIMB 3 B08 TEMP IC-TE-35 A2883 INCORE D THIMB 4 L13 TEMP IC-TE-32 A2884 INCORE D THIMB 5 N04 TEMP IC-TE-41 Point ID Name Instrument No. A2885 INCORE D THIMB 6 D14 TEMP IC-TE-49 A2886 INCORE D THIMB 7 C05 TEMP IC-TE-11 A2887 INCORE D THIMB 8 D03 TEMP IC-TE-42 A2888 INCORE D THIMB 9 J10 TEMP IC-TE-6 A2889 INCORE D THIMB 10 Lil TEMP IC-TE-18 A2890 (LATER) A2891 INCORE E THIMB 2 F14 TEMP IC-TE-40 A2892 INCORE E THIMB 3 H04 TEMP IC-TE-14 A2893 INCORE E THIMB 4 M07 TEMP IC-TE-16 A2894 INCORE E THIMB 5 N13 TEMP IC-TE-45 A2895 INCORE E THIMB 6 J08 TEMP IC-TE-1 A2896 INCORE E THIMB 7 C07 TEMP IC-TE-28 A2897 INCORE E THIMB 8 F08 TEMP IC-TE-5 A2898 INCORE E THIMB 9 C08 TEMP IC-TE-27 A2899 INCORE F THIMB 1 D08 TEMP IC-TE-15 A2900 INCORE F THIMB 2 H02 TEMP IC-TE-34 A2901 INCORE F THIMB 3 B03 TEMP IC-TE-57 A2902 INCORE F THIMB 4 L15 TEMP IC-TE-52 A2903 INCORE F THIMB 5 N06 TEMP IC-TE-29 A2904 INCORE F THIMB 6 G12 TEMP IC-TE-17 A2905 INCORE F THIMB 7'A09 TEMP IC-TE-47 A2906 INCORE F THIMB B P09 TEMP IC-TE-37 A2907 INCORE F THIMB 9 N08 TEMP IC-TE-25 A0349 RCLP1 WIDE RNG HOT LEG PRESS RC-TE-405 A0350 RCLP4 WIDE RNG HOT LEG PRESS RC-TE-403 A0382 RX VESSEL NARROW RNG LVL RC-LQY-9405 C0731 AVG 10 HOTTEST TCs - SPDS CALCULATED INPUT C4330 RC-P-1A BKR RC-52A C4332 RC-P-1B BKR RC-52A C4334 RC-P-IC BKR RC-52A C4336 RC-P-1D BKR RC-52A 5.2.2.3 Calculated outputs Point ID Name Type output / Units C0731 AVG 10 HOTTEST TCc - SPDS DEC F C0732 CONVERTED RVLIS - SPDS % C0733 RVLIS WR LVL CHECK - SPDS BINARY C0734 NUM OF RUNNING RCPs - SPDS INTEGER C0735 HOTTEST T/C - SPDS DEG F C0752 FAULT TREE LOGIC - SPDS INTEGER C0753 RCS SUBC00 LING - SPDS DEC F C0755 DYNAMIC RVLIS - SPDS % Input / output COCO is run automatically every 5 seconds by the computer periodic scheduler. No operator action is required. The input analog and digital points are accessed directly from the data base, and the output calculated points are written directly back into the data base using the AIS subroutine , PLACIP. Subroutines COCO internal subroutines: CETC RCSSUB . RCPR LOGIC TSTBIT AIS and digital input system subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB DGSTAT 5.2.3 Heat Sink (HEST) program The program HESI was written to provide calculated points (c-points) to the analog data base. These c-points are used by the CGS to display system parameters and to indicate an end result in the SpDS CSF display heat sink. The CSF is shown in Figure 5.2-3. The e-points for each decision block in the heat sink status tree are calculated by subroutines of HESI. The subroutine corresponding to each decision block is listed below that decision block in Figure 5.2-3. The values of the e-points generated by these subroutines are written in the Cetual display. The end result of the status tree logic based on the e-points and the corresponding decision block setpoints is also calculated by a subroutine. In the main program, HESI uses the subroutine, NVALST, to call the data used by the subroutines from the analog data base. The analog points called cre the narrow range SG level, the emergency feedwater flow to the SGs and the SG pressures. The main program then calls the various subroutines and passes the' data to them. The calculations are performed and the e-point is placed in the data base using the AIS subroutine PLACIP. The first subroutine, NRSGL, auctioneers high the SG Narrow Range (NR) level data. If the status word of the_ input indicates all the data is unreliable, then the default value of -10,000% is returned. The subroutine NRSCLA also auctioneers high the SG NR level data. Unlike NRSCL, NRSCLA requires that all the data is used in the calculation. If one or more inputs are found to be unreliable, the default value of 10,000% is placed in the data base. The last SG NR level subroutine, NRSGG, auctioneers low the input data. Like NRSCLA, it requires reliable data from all the SGs. A default value of -10,000% is returned if one or more inpute are unreliable. The subroutine, WRSCL, is identical to NRSGL except it uses the Wide Range (WR) level data as input. TEFWF sums all the reliable emergency feedwater flows input from the taalog data base. If no reliable inputs are found, the output is set to the default value of -1,000 spm. The last decision block subroutine, SGPL, averages two pressure indications from each SG and then auctioneers low the averages. When one input of a pair for a SC is found to be unreliable, the other is used. Since the decision blocks for SG pressures require data from all SGs, if one or more gGs are found with both inputs unreliable, the output c-point is defaulted to 10,000 pais. The last subroutine in HESI is called LOGIC. LOGIC reads in all the e-points generated by the other subroutines in HES1 and evaluates the decision blocks of the CSF status tree. The containment pressure e-point comes from the program CONTA. The subroutine returns a e-point which has an integer value from 1 through 8. These values are used by the CGS to determine the final outcome of the status tree. For example. a value of 1 indicates the ctatus tree chould blink red (the first, or top, possible outcome). An 8 indicates the last, or bottom, outcome (this is green). The values 2, 3, 4, 5,~6 and 7 are used for the final outcomes in between 1 and 8, in order of cscending value from top to bottom. The program is set up to be run by the periodic scheduler every 5 seconds. In this way, the data is being constantly updated and the CSF is closely monitored. 5.2.3.1 Calculations HESI performs no calculations other than auctioneering and simple cveraging. 5.2.3.2 Analog Inputs Point ID Name Instrument No. A0734 SG E-11A NARROW RNG 3 LVL FW-LT-519 A0744 SG E-11B NARROW RNG 3 LVL FW-LT-529 A0756 SG E-11C NARROW RNG 1 LVL FW-LT-537 A0725 SG E-11D NARROW RNG 2 LVL FW-LT-548 A0727 3G E-11D WIDE RNG LVL FW-LDY-504 A0737 SG E-11A WIDE RNG LVL FW-LDY-501 A0747 SG E-11B WIDE RNG LVL FW-LDY-502 A0757 SG E-11C WIDE RNG LVL FW-LDY-503 A0795 SG E-11A EMERG FW HDR FLOW FW-FT-4214 A0796 SG E-11B EMERG FW HDR FLOW FW-FT-4224 A0797 SG E-11C EMERG FW HDR FLOW FW-FT-4234 A0798 SG E-11D EMERG FW HDR FLOW FW-FT-4244 A0720 SG E-11D STM OUTL 1 PRESS FW-PT-544 A0723 SG E-11D STM OUTL 2 PRESS FW-PT-545 A0730 SG E-11A STM OUTL 1 PRESS FW-PT-514 A0733 SG E-11A STM OUTL 2 PRESS FW-PT-515 A0740 SG E-11B STM OUTL 1 PRESS FW-PT-524 A0743 SG E-11B STM OUTL 2 PRESS FW-PT-525 A0750 SG E-11C STM OUTL 1 PRESS FW-PT-534 A0753 SG E-11C STM OUTL 2 PRESS FW-PT-535 C0726 CONT PRESS AUCT HI - SPDS (PSIG) N 5.2.3.3 Calculated outputs Point ID Name Type Output / Units ADBI C0721 AUCT HI SG NR LVL - SPDS % 8913 C0722 AUCT LO SG LVL, ALL SGs - SPDS % 8914 C0723 AUCT HI SG LVL, ALL SGs - SPDS % 8915 C0724 SUM EFW FLOW - SPDS GPM 8916 C0725 AUCT LO SG PRESS - SPDS PSIG 8917 C0749 FAULT TREE LOGIC - SPDS INTEGER INDICATION 8941 C0760 AUCT HI SG WR LVL - SPDS % 8952 Input / Output - HESI is run automatically every 5 seconds by the computer periodic scheduler. No operator action is required. The input analog points are cecessed directly from the analog data base and the output calculated points cre written directly back into the data base. Subroutines HESI internal subroutines: NRSGL NRSGG NRSGLA SGPL TEFWF AIS subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB 5.2.4 Integrity (INTEC) Program The program INTEG was written to provide calculated points (c-points) to the analog data base. The e-points are used by the CGS to display system N parameters and to indicate an end result in the SPDS CSF display integrity. The CSF is shown in Figure 5.2-4A. Most of the e-points for each decision block in the integrity status tree are calculated by subroutines of INTEG. The subroutine corresponding to cach decision block is listed below that decision block in Figure 5.2-4A. The values of the e-points generated by these subroutines are written on the cetual display. The end results of the status tree logic based on the e-points and the corresponding decision block setpoints are determined in a cubroutine called LOGIC. The e-point for the first decision block in the CSF is calculated by a separate program, HUCD. This program is discussed in its Cwn program description (Section 5.2.7). In the main program, INTEG uses the AIS subroutine NVALST to call the data used by the subroutines from the analog data base. The analog points called are hot les and cold leg temperatures and hot les pressures. The main program then calls the various subroutines and passes the data to them. One of the subroutines, RCSA, uses as input c-points calculated by some of the other subroutines. The subroutine RCST supplies an averaged RCS temperature value from the two RCS hot leg and two RCS cold les temperatures passed by the main program. Unreliable values, as indicated by the status words of the data, are ignored.
.If all input data is found to be unreliable, then the default'value of 0 F is used for'the average temperature.
The subroutine RCSCL returns a e-point which is an auctioneered low value from one of the two RCS cold leg temperature indicators. If the status word of either value indicates it is unreliable, the other is chosen. If both values are found to be unreliable, O F is the defaulted auctioneered value. The next subroutine, RCSOP, supplies an auctioneered high value of one of the two RCS hot leg wide range pressure indicators. .If the status word of either value is found to be unreliable, that value is ignored. If both values cre found to be unreliable, 10,000 psi is assigned toithe e-point as the ! default value. , , l
N The subroutine RCSA uses the e-points produced by subroutines RCSCL and RCSOP to determine if the RCS pressure-temperature point is to the right of the Limit A on the pressure-temperature plot. See Figure 5.2-4B for a diagram cf Limit A. The subroutine returns a binary type output (1 = NO, 0 = YES) depending on the result of the Limit A check. If either the cold leg temperature or the hot leg pressure e-points are found to be defaulted, as cxplained in the preceding paragraphs, a 1 is always returned. The subroutine works by calculating a pressure which is on the Limit A curve at the input cold leg temperature. If the input hot les pressure is less than the calculated pressure, then the pressure-temperature point is to the right of Limit A and e 0 is returned. If the input pressure is equal to ce greater than the calculated pressure, then the pressure-temperature point is not to the right of Limit A and a 1 is returned. The last subroutine used in INTEG is called LOGIC. LOGIC reads in all the c-points generated by the other subroutines in INTEG and evaluates the decision blocks of the status tree. The e-points for the first decision block come from the program HUCD. The subroutine returns a c-point which has an integer value from 1 through 8. These values are used by the CGS to determine the final outcome of the status tree. For example, a value of 1 indicates the ctatus tree should be red (the first, or top, possible outcome). An 8 indicates the last, or bottom, outcome (this is green). The values 2, 3, 4, 5, 6 and 7 are used for the final outcomes between 1 and 8, in order of cscending value from top to bottom. In the determination of the "RCS pressure less than cold overpressure limit" decision block, the setpoint is calculated from the curve shown in Figure 5.2-4C. The RCS cold leg temperature (from RCSCL) is applied to the equation of the curve and a pressure setpoint is calculated. If the input pressure from RCS0p is less than this calculated setpoint pressure, the cutcome of this decision block is yes, otherwise it is no. The program is set up to run by the periodic scheduler every 5 seconds. In this way, the data is being continuously updated and the CSF is closely monitored. The e-point associated with the first decision block, from NUCD, is updated every 30 seconds. 5.2.4.1 Calculations The following calculations are performed by INTEC: Limit A
- 1. If TCL < 194 F, then return 1
- 2. If 194 F 1 TCL < 226 F, then P = 64.0625,x T - 12,428.i25 CL
#' I # *" - 2,752.5 CL '
calc = 21.25 x TCL if P #* "#" HL 1 'cale'
- 3. If TCL g 250 F, return 0 Cold Overpressure Limit
- 1. If T I "" HL < 500 psi, return 0 AVE
- 2. If TAVE > 90 F, P ealc = 5.752 x e(0.016 xAVE , then if T
P g <T , return 0 Where: T = RCS Hot Log Temperature HL T = RCS Cold Leg Temperature T * * *E' * * *"* AVE P HL = RCS Hot Les Pressure P ,1 = RCS Calculated (Setpoint) Pressure I j .-
5.2.4.2 Analog Inputs Point ID Name Instrument No. A0339 RCLP1 WIDE RNG HOT LEG TEMP RC-TE-413A A0340 RCLP2 WIDE RNG HOT LEG TEMP RC-TE-423A A0343 RCLP1 WIDE RNG COLD LEG TEMP RC-TE-413B A0344 RCLP2 WIDE RNG COLD LEG TEMP RC-TE-423B A0349 RCLP1 WIDE RNG HOT LEG PRESS RC-TE-405 A0350 RCLP4 WIDE RNG HOT LEG PRESS RC-TE-403 C0746 COOLDOWN CHECK - SPDS (BINARY) 5.2.4.3 Calculated Outputs Point ID Name Type Outputs / Units C0717 LIMIT A CHECK - SPDS BINARY C0718 AVG RCS TEMP - SPDS OF C0719 AUCT LO COLD LEG TEMP - SPDS OF C0720 AUCT HI RCS PRESS - SPDS PSIG C0748 FAULT TREE LOGIC - SPDS INTEGER INDICATION Input / Output INTEG is run automatically every 5 seconds by the computer periodic scheduler. No operator action is required. The input analog points are cecessed directly from the analog data base and the output calculated points cre written directly back into the data base using the AIS subroutine PLACIP. Subroutines INTEG internal subroutines: RCSA RCSCL RCSOP RCST LOGIC
AIS subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB 5.2.5 Containment (CONTA) Program The program CONTA was written to provide calculated points (c-points) to the analog data base. The c-points are used by the CGS to display system parameters and to indicate an end result in the SPDS CSF display integrity. The CSF is shown in Figure 5.2-5. All of the e-points for each decision block in the containment status tree are calculated by the subroutines of CONTA. The subroutine corresponding to each decision block is listed below that decision block in Figure 5.2-5. The values of the e-points generated by these subroutines are written on the cetual display. The end results of the status tree logic based on the e-points and the corresponding decision block setpoints are determined in a cubroutine called LOGIC. In the main program CONTA uses the AIS subroutine NVALST to call the data used by the subroutines from the analog data base. The analog points called are containment pressure, containment building level and containment radiation. The containment radiation a-points are not presently modeled on the simulator. The main program then calls the various subroutines and passes the data to them. The main subroutine called by CONTA is CORP. This subroutine cuctioneers high the data passed to it from the main program. The result is then placed in the data base. All input values are checked for reliability. When no reliable values are found then the e-point is assigned a default value. This default value is 10,000. Since all the decision blocks of the containment fault tree require the data be auctioneered high this is the only subroutine necessary for the CSF.
The last subroutine used in CONTA is called LOGIC. LOGIC reads in all ! the e-points generated by the other subroutines in CONTA and evaluates the decision blocks of the status tree. The subroutine returns a e-point which has an integer value from 1 through 5. These values are used by the CGS to determine the final outcome of the status tree. For example, a value of 1 indicates the status tree should be red (the first, or top, possible outcome). A value of 5 indicates the last, or bottom, outcome (this is green). The values 2, 3 and 4 are used for the final outcomes in between 1 and 5, in order of ascending value from top to bottom. In the simulator version of the programs, the reliability checking portion of each subroutine is bypas' sed and all output status words are cet = 0. This is done because reliability of data status words have no meaning at the simulator. Note that this simulator version of CONTA does not input the containment radiation a-points because these points are not modeled at the almulator. The containment pressure a-points used in CONTA are not the instruments listed in the Re'gulatory Guide 1.97 response. Again, this is because these points are not modeled by the simulator. The program is set up to run by the periodic scheduler every 5 seconds. In this way the data is being continuously updated and the CSF is closely monitored. 5.2.5.1 Calculations r
- No calculations other than simple auctioneering are performed by CONTA.
5.2.5.2 Analon Inputs P Point ID Name Instrument No. A0500 CONT PRESS PT 1 SI-PDY-934 A0501 CONT PRESS PT 2 SI-PDY-935 A0502 CONT PRESS PT 3 SI-PDY-936 A0930 CONT SUMP TK-10A OVFL LVL CBS-LQY-2384 l A0931 CONT SUMP TK-10B OVFL LVL CBS-LQY-2385
5.2.4.3 Calculated outputs Point ID Name Type outputs / Units C0726 CONT PRESS AUCT HI - SPDS PSIG C0727 CONT SUMP LVL AUCT HI - SPDS FT C0728 CONT RAD AUCT HI - SPDS R/HR C0750 FAULT TREE LOGIC - SPDS INTEGER INDICATION Input / Output CONTA is run automatically every 5 seconds by the computer periodic ccheduler. No operator action is required. The input analog points are cecessed directly from the analog data base and the output calculated points tre written directly back into the data base using the AIS subroutine PLACIP. Periodic Changes No periodic changes are expected. Subroutines INTEG internal subroutines: CONP LOGIC AIS subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB 5.2.6 Inventory (INVEN) Program The program INVEN was written to provide calculated points (c-points) to the analog data base. The e-points are used by the CGS to display system
parameters and to indicate an end result in the SPDS CSF display inventory. The CSF is shown in Figure 5.2-6. Most of the~c-points for each decision block in the inventory status tree are calculated by subroutines of INVEN. The subroutine corresponding to 4 cach decision block is listed below that decision block in Figure 5.2-6. The values of the e-points generated by these subroutines are written on the cetual display. The end results of the status tree logic based on the c-points and the corresponding decision block setpoints are determined in a subroutine called LOGIC. The e-point for the "RVLIS indicates ..." decision r block in the CSF is calculated by a separate program, COCO. This program is discussed in its own program description. In the main program. INVEN uses the AIS subroutine NVALST to call the data used by_the subroutines from the analog data base. The analog points called are the pressurizer levels. The main program then calin the various cubroutines and passes the data to them. The main subroutine called is PREZL. This subroutine auctioneers high ce low the input pressurizer level data, and then places that value in the data base. If the subroutine argument J is 1, then the subroutine auctioneers high. If J is 0 then it auctioneers low. The subroutine checks the input data for reliability. If one of the inputs is found to be unreliable, the other is used. If both are found to be unreliable, a default value is returned to the data base. The value is 1000 for the auctioneered low c-point and -10,000 for the auctioneered high c-point. The last subroutine used in INVEN is called LOGIC. LOGIC reads in all the c-points generated by the other subroutines in INVEN and evaluates the decision blocks of the status tree. The e-point for the "REVLIS indicates ..." decision block comes from the program COCO. The containment pressure e-point used in the second decision block comes from the program CONTA. The subroutine returns a e-point which has an integer value from 1 through 5. These values are used by the CGS to determine the final outcome of i the status tree. For example, a value of 1 indicates the status tree should be red (the first, or top, possible outcome). A value of 5 indicates the
last, or bottom, outcome (this is green). The values 2, 3 and 4 are used for the final outcomes in between 1 and 5, in order of ascending value from top to .
. bottom.
The program is set up to run by the periodic scheduler every 5 seconds. In this way the data is being continuously updated and the CSF is closely monitored. 5.2.6.1 Calculations . No calculations other than simple auctioneering are performed by INVEN. 5.2.6.2 Analoa Inputs Point ID Name Instrument No. A0332 PRZR LVL RC-LDY-459 A0333 PRZR LVL RC-LDY-460 C0732 CONVERTED RVLIS-SPDS % C0726 CONT PRESS AUCT HI-SPDS PSIG ) 5.2.6.3 Calculated outputs Point ID Wame Type outputs / Units I C0729 AUCT HI PRZL LVL SPDS % C0730 AUCT LO PRZL LVL - SPDS % ! C0751 FAULT TREE LOGIC - SPDS INTEGER INDICATION Input / output 4 4 INVEN is run automatically every 5 seconds by the computer periodic ccheduler. No operator action is required. The input analog points are cecessed directly from the analog data base and the output calculated points cre written directly back into the data base using the AIS subroutine PLACIP. l i 4 1 Subroutines INVEN internal subroutines: PREZL LOGIC AIS subroutines and functions: NVALST PLACIP SETBT SETBF RELIAB 5.2.7 Heatup Cooldown (HUCD) Program The program HUCD was written to provide a calculated point (c-point) to the analog data base. The e-point is used by the CGS to display system parameters and to indicate an end result in the SPDS CSF display integrity. The CSF is shown in Figure 5.2-4A. Most of the c-points for each decision block in the integrity status tree are calculated by subroutines of INTEG. The subroutine corresponding to cach decision block is listed below that decision block in Figure 5.2-4A. The values of the e-points generated by these subroutines are written on the cetual display. The end results of the status tree logic based on the e-points and the corresponding decision block setpoints are determined in a sutroutine called LOGIC. See the INTEG program description for more information. HUCD provides the e-point for the first decision block in the integrity display. A separate program was written for that decision block because it ers necessary to make the program specific to the simulator. The program also runs every 30 seconds instead of every 5 seconds like the other SPDS programs.
~
HUCD calculates the RCS cooldown rate based on a 1-hour period. It does not calculate a heat up rate. The calculated point returned to the data base is a binary type. If the maximum cooldown rate is exceeded, a 1 is returned, otherwise the e-point is 0. The maximum cooldown rate is 100 F in one hour. HUCD uses three c-points when it is running: 1) the RCS auctioneered low cold les temperature (called TCLIN), 2) a counter (called TIMER), and 3) the maximum cold leg temperature in the past hour (TCLMAI). These points are input using the AIS subroutine NVALST. The AIS subroutine PLACIP is used to return the points to the data base. HUCD works by keeping track of TCLMAX in the past 1-hour period. TCLIN is subtracted from TCLMAX and if the result is equal to or greater than 100 then the maximum cooldown rate has been exceeded. TCLMAX is found by one of two ways: 1) if TCLIN > TCLMAC, then TCLMAX = TCLIN; or 2) if 1 hour has passed during which TCLIN does not exceed TCLMAX, then TCLMAX = T(120). The variable T is an array of 120 elements containing TCLIN for the past 1 hour. Condition 1, above, will occur when the RCS temperature is increasing. Each time TCLIN > TCLMAX, the variable TIMER is reset. TIMER is used to count the time since TCLMAX was found. When TIMER reaches 120, then condition 2, above, has been reached. This will occur when the RCS temperature is steady or decreasing slowly, and means that TCLMAX is more than 1 hour old. The new TCLMAX is now made to be the TCLIN from I hour ago, T(120). If TIMER exceeds 120, it is set to 150. By checking the e-point corresponding to TIMER it can be determined if TCLMAX is 1 hour old. The cooldown rate check is next performed. Lastly, the array T is spooled (so that T(119) becomes T(120), T(118) becomes T(119), etc.) and T(1) is set equal to TCLIN. The variables cre all returned to the data base or disc to await the next running of the program. The array T is written to and read from dise when the program is run using the subroutines READA and WRITEA. These subroutines are located in the VAS common areas and are brought into HUCD by the include lines (25 and 26) in the source, and by the attribute and common statement in the job stream HUCD.
An additional feature of HUCD is that it can tell when the simulator has been reset. This is necessary for the program because the simulator may be reset many times in an hour, each time with a different set of conditions. When the program senses a reset, all variables are reinitialized to zero. The variable RESCTR (located in the global common) increments each time the cimulator is reset. By comparing the present value of RESCTR with its value from the previous run, the program can determine if a reset has occurred. The previous value of RESCTR is stored in T(121). The program is set up to run by the periodic scheduler'every 30 seconds. In this way the data is being continuously updated and the CSF is closely monitored. 5.2.7.1 Calculations No calculations are performed by HUCD. 5.2.7.2 Analog Inputs Point ID Name Input Type / Units O C0719 AUCT LO COLD LEG TEMPS - SPDS F C0754 MAX COLD LEG TEMP - SPDS OF C0756 COUNTER - SPDS N/A 5.2.7.3 Calculated outputs Point ID Name Type Outputs / Units C0746 C00LDOWN CHECK - SPDS BINARY C0754 MAX COLD LEG TEMP - SPDS OF C0756 COUNTER - SPDS N/A Input / Output HUCD is run automatically every 30 seconds by the computer periodic scheduler. No operator action is required. The input analog points are cecessed directly from the analog data bare and the output calculated points tre written directly back into the data base using the AIS subroutine PLACIP.
m The array T is read using the subroutine READA. It is written back to disc using WRITEA. The variable RESC7R is located in global common at the cimulator. Subroutines AIS subroutines and functions: NVALST PLACIP t Other external subroutines: READA WRITEA 5.2.7.3 Calculated Outputs Point ID Name Type Outputs / Units C0746 COOLDOWN CHECK - SPDS BINARY C0754 MAX COLD LEG TEMP - SPDS OF C0756 COUNTER - SPDS N/A Input / Output HUCD is run automatically every 30 seconds by the computer periodic ccheduler. No operator action is required. The input analog points are cccessed directly back into the data base using the AIS subroutine PLACIP. The array.T is read using the subroutine READA. It is written back to disc using WRITEA. The variable RESCTR is located in global common at the cimulator.
_( , Subroutines AIS subroutines and functions: NVALST PLACIP i Other external subroutines: READA WRITEA ( 5.2.8 Core Exit Thermocouple Averating (THERPO) Program The program THERPO was written to provide calculated points (c-points) to the analog data base. The e-points are us'ed by the CGS to indicate Core , Exit Thermocouple (CETC) temperatures on a core map. The map is shown in
; Figure 5.2-8.
! The core map divides the core into nine regions. Each region contains from 5 to 9 flux thimbles, Which contain the CETCs. THERPO outputs nine e-points which are the hottest CETCs found in each region. The core map, driven by the CGS, will display different colors for each region depending on the value of that region's e-point. 2 In the main program, THERPO uses the AIS subroutine NVALST to call the data from the data base. For each region, the subroutine TCHOT is passed the CETC data and the e-point's ADBIs. TCHOT determines the hottest CETC and i places the value into the data base. I In the simulator version of the program the reliability checking portion of each subroutine is bypassed and all output status words are
- set = 0. This is done because reliability of data status words has no meaning ct the simulator.
I i i -- -. . . - - _ - - . - _ . . - , _ - - - - - - . . _ _ _ . _ _ _ - . . - . - _ _ - , - _ _ . , _ _ _ . . . _ . _ _
The program is set up to run by the periodic scheduler every 5 seconds. In this way, the data is being continuously updated and the CETC , temperatures are closely monitored. 5.2.8.1 Calculations No calculations are performed by THERPO. 5.2.8.2 Analog and Digital Inputs . Point ID Name Instrument No. A2850 INCORE A THIMB 1 H15 TEMP IC-TE-43 A2851 INCORE A THIMB 2 K02 TEMP IC-TE-38 A2852 INCORE A THIMB 3 L10 TEMP IC-TE-13 A2853 INCORE A THIMB 4 PO4 TEMP IC-TE-48 A2854 INCORE A THIMB 5 H06 TEMP IC-TE-4 A2855 INCORE A THIMB 6 D12 TEMP IC-TE-31 A2856 INCORE A THIMB 7 B06 TEMP IC-TE-39 A2857 INCORE A THIMB 8 E09 TEMP IC-TE-12 A2858 INCORE A THIMB 9 H03 TEMP IC-TE-26 A2861 INCORE B THIMB 2 All TEMP IC-TE-54 A2862 INCORE B THIMB 3 K06 TEMP IC-TE-8 l A2863 INCORE B THIMB 4 F01 TEMP IC-TE-51 A2864 INCORE B THIMB 5 F07 TEMP IC-TE-7 A2865 INCORE B THIMB 6 R06 TPMP IC-TE-50 A2866 INCORE B THIMB 7 N14 TEMP IC-TE-55 A2867 INCORE B THIMB 8 NO2 TEMP IC-TE-56 A2868 INCORE B THIMB 9 H13 TEMP IC-TE-24 A2849 INCORE B THIMB 10 E11 TEMP IC-TE-21 A2870 INCORE C THIMB 1 G09 TEMP IC-TE-3 A2871 INCORE C THIMB 2 R08 TEMP IC-TE-44 A2873 INCORE C THIMB 4 B13 TEMP IC-TE-58 A2874 INCORE C THIMB 5 H11 TEMP IC-TE-9 A2875 INCORE C THIMB 6 J14 TEMP IC-TE-36 A2876 INCORE C THIMB 7 J01 TEMP IC-TE-46 A2877 INCORE C THIMB 8 LO8 TEMP IC-TE-10 A2878 INCORE C THIMB 9 F03 TEMP IC-TE-30 A2879 INCORE C THIMB 10 EOS TEMP IC-TE-20 A2880 INCORE D THIMB 1 J07 TEMP IC-TE-2 A2881 INCORE D THIMB 2 R11 TEMP IC-TE-53 A2882 INCORE D THIMB 3 B08 TEMP IC-TE-35 A2883 INCORE D THIMB 4 L13 TEMP IC-TE-32 A2884 INCORE D THIMB 5 N04 TEMP IC-TE-41 A2885 INCORE D THIMB 6 D14 TEMP IC-TE-49 A2886 INCORE D THIMB 7 G05 TEMP IC-TE-11 A2887 INCORE D THIMB 8 D03 TEMP IC-TE-42 A2888 INCORE D THIMB 9 J10 TEMP IC-TE-6 A2889 INCORE D THIMB 10 Lil TEMP IC-TE-18 A2891 INCORE E THIMB 2 F14 TEMP IC-TE-40
s Point ID Name Instrument No. A2892 INCORE E THIMB 3 H04 TEMP IC-TE-14 A2893 INCORE E THIMB 4 M07 TEMP IC-TE-16 A2894 INCORE E THIMB 5 N13 TEMP IC-TE-45 A2895 INCORE E THIMB 6 J08 TEMP IC-TE-1 A2896 INCORE E THIMB 7 C07 TEMP IC-TE-28 A2897 INCORE E THINB 8 F08 TEMP IC-TE-5 A2898 INCORE E THIMB 9 C08 TEMP IC-TE-27 A2899 INCORE F THIMB 1 D08 TEMP IC-TE-15 A2900 INCORE F THINB 2 H02 TEMP IC-TE-34 A2901 INCORE F THINB 3 B03 TEMP IC-TE-57 A2902 INCORE F THIMB 4 L15 TEMP IC-TE-52 A2903 INCORE F THINB 5 N06 TEMP IC-TE-29 A2904 INCORE F THINB 6 G12 TEMP IC-TE-17 ! A2905 INCORE F THINB 7 A09 TEMP IC-TE-47 A2906 INCORE F THINB 8 P09 TEMP IC-TE-37 A2907 INCORE F THIMB 9 N08 TEMP IC-TE-25 5.2.8.3 Calculated outputs Point ID Name Type Outruts/ Units C0736 HOTTEST T/C, REGION 1 - SPDS OF C0737 HOTTEST T/C, REGION 2 - SPDS OF C0738 HOTTEST T/C, REGION 3 - SPDS OF C0739 HOTTEST T/C, REGION 4 - SPDS OF C0740 HOTTEST T/C, REGION 5 - SPDS OF C0741 HOTTEST T/C, REGION 6 - SPDS OF C0742 HOTTEST T/C, REGION 7 - SPDS OF C0743 HOTTEST T/C, REGION 8 - SPDS OF C0744 HOTTEST T/C, REGION 9 - SPDS OF Input / Output THERPO is run automatically every 5 seconds by the computer periodic scheduler. No operator action is required. The input analog and diei tal points are accessed directly from the data base, and the output calculated points are written back into the data base usinE the AIS subroutine PLACIP. Periodic Changes l ! No periodic changes are expected. Subroutines THERPO internal subroutines: TCHOT AIS and digital input system subroutines and functions: NVALST PLACIP SETST SETBF RELIAB { ( l ( ( _n_ r
e .
't ; - , _ ^
3 a ..
.. . V ,
. ;.,_ ; . . , '. I(yll.,
jy. g- .-
. .'. ~N ', , ~ , u . '-
, . ,, -l .: s t, f.f p { r, , -Q , .k (
* ;4
. .y
,A.' .. +
f _y ' ' - -
,A ep,. .g, h. , / , 1 * .. r ., , . .
s
, ., p t
g.
,,.,g,.,,
. . z, .
y **\,-
,;L f.
;' . -. ; ^ f- ;- ,, ' .
r n s , ,_ ' -
- j. -- ' ' ! $ < *Q (
_ ' * ' l - o - k .c . t e , i . , .
,5 -l r , ,. .L *
i ,
,g b "
'.' ,' 3[ ,. f ' [, .,.4 .,: -
[. 9 - ., p,. ~, . % I- f. ; t ,;. ,e' . -' +
- .- .. - . . - - _i s3f,
'. - 4 * -
+ a'. ~ '
.4 -)
.* , .- ;-. s: -
t
+
.~ .
=
. ' .,.. skq- ->: , < .
'.- n 9, p, ', ,. . ',. , ,-
?
. . . -- .4
- -t % .
, 4 ,r ,,,( i. .
k, .' - + .$.
- .- ,P. - , .
4...
* .: , . ,,r , i .4
*. 4
?
"_, s Q.N , --
, - . , e. .
. . >1
. , .* f. i . + . . -
g ., w, ,.
' ~- -
1 - , - ji. ' _5,g . x , 4,, c-,. - *
..,.=p .ru- ~. ,y . e 4 4, .. u . . . .,
- s . e.
n.g e
,.,w3 :.
w
.-~.. ,
.v .,' ..
. . y x .. .
. ,, ._ . . L.,
.' ' . ' : ;-M .. a~ ,? : ', -* -
y.a , % ',. , ,, ' ' . ~ ?
* %, s ,
.., . :.ys '., 3 : .
.s . g. - . d- .. ". , . <.,' ' . . .. . A,.[g ..-
,z, y i =.
~, y _ -f- . _ . " ,
- s. _. ,.. .
_n r
-%g.._
-. . - . . J,. . , . ~ . .. .:.. ."
. .. n. ,1 + v ,3 , - .. . - ~ <
.; y ;, , , . ,
g, . -
.s.-
aem. A +- _
-', 4 ,, .
-*<w,,._ ..,
R '.
. . : . , , '. ; * , .- - a
-l
,% - G-s x'-
~ ,'- '- . , - . ;i . , ' . v.
c n .' .- b ,> y -. , >.. > '- * ,. ' t.4 ., g%5,.i- ;, ,
,s s 92 , _, ..
r . ..+--. - ,_~/. .
..,ty '
e .
< - + 2 '.1 - , g, , . .-
4.," ,.,
.- .w . ' , , t_.
3 4 - - p .K ., . p .
,.-'# -Y a r .' + . .
'k ".,.
, -..% i . .,+ .. ,)
[ _. '[eQ * * *% . g ., * , ' - - . ',.
^-
- I, o , . . < . ,
, . . . j" .,. , ,, > . . ..p ,.c.
. .+,.
.. e, 4 ,
.- h, .t6- s s ..
') ', M. 8. g [ ( '
a: kiv ;.'. 4
.,f ,g' . ' ;, _ .
,'.I u -
' g.h *.. ., ., .e, .
t ;- V;
<s.: ) . f F . .
g 3, ~. . , , - - - , ,, ., . - .. .-
-A .
e ,} g ' 9,-- r, " _'
, .y, ., .,
', ' ,4 . 6, ;. , - . (., -d4
- t. ,.s
. ,-'y- ._ , "_g,_.
, , 8, n O q& .-
) ,l.
,9
.ft f ., . , ,
* ., ~ . '
' ' . ' 's.
s q v- 3' ., ,w.. .s. , .9 s _L
- ,f.'.
Y". , ,+ -. " ... >.$ -
.-rs ,fr.1 * -; -- y . .,
4 .<>
. - , - r n ,
- p- . . .< ,
y+,,'y.- i . _ ,
+- ,S . i
', +' - - 4.e , - , . "
,y' 1 - '
e y , 'n ' , * -- .m -, . s -
+
.. y - ' ! 't .
- p. /.? ,.- s. t - .
4,; . .:
} p .* ,,, , .-
n .-
, j,ny.?.
q A.-, - - .. a c 8. - e e,"4q,w' . _ ,.-. . , ,v ..
..- . x. , : _
1 t .. . p (9h e -
<. t. ' .'
y ,s g, g J
" ' , -.. j. *. .
'[p'.
4 . k h, .' y h..j ' . k , * ' ., b ' .- . .- ,'I. .
. . y 4 ,. j .
.' q, g*.. ,
C
, g - .
- * * - { _-' :' w)[. ( :,. [.) /- ' ', <- -
,i h,y y.
r ,p q;; ' y: .f
, \ .-t'Y.
e.,,
. , y'.
> s
,. s$h an -
sb .l.~; kly-
? , .,$ l h hu ~
- e. ~-
.: .g
,. . ~ . ,
.h b
{ h,4, p;.. .; H,. , ,..-
'. *? .] ' . * ,-'. . . -h 2*. Y+
. .- - '4. ., s- . ..
p/. , - _.. .g .h : .; . . w '" k4 . - . Y
. 9 ', Gz s
- . ,*s , y. .,, ,, :: . \ ... ' ,' _- 3 , . . . m. .p .'c , ..
,.3,. y f
- i .
- .. - n . , .y p.
eg, '- -
. 4 . ; ,,, .-
, p . g a.+ r , . ' :. :.- ,; . .AW. ..
'. , . : .: - y.,:
t y~ + ; s
-c .
- a. y t - [ 3 : .y. . , ,a . . .
. .; p >c g .. ,, . . . ... ,- -
- v. .
. ,. n , .
3-- , p . . ..
,n, -
-,5 g ; ,a1 g . , ... i a, s. ,s %- 1
.-*f j ,' . ' . . --.'.g*. . ..,- - - - - - - - . - - - - - c. ,F-E- v, M,
; [' ,
*v.,
y t j ,, ' ( , , e . '
,t 1
' ).
g,t ' ,
- b
, M ;
. [# 4 - i 'y ,
%,+, / ). f; g]=; * -,,
ng g %, g],
> ,h,, . > - ' -
4.. _ f.y . 3+ . ~ c.
..e . h*. , p. . , .. .
4
;ht- /.
, ,' . i w
. ... ee -
.y es
- a. -
. - .e fj' ^+bp [. , 8 ' j i' - - k
, f,K .
Q Q, j g' . 1 '#,-$ *, )'..' is 'b'Q . ,- 1 w..g . '"-g., *;., -; @ * , ,,..].
..e
-, ' , "; ., 7 '"{.
, g- } ' . ,[f ..: .
e J ,,
. ' ,3 i ; /. _ ' . .
; .m 4.
e - 5,'r a y - ,. .,, 4
* . u ,. ,,./.-,. - - p4 c . ~, , .a -
. ,i t . . . - . .
-g,~
,,f et
. ; n f , ,.g -
*ip .Nhy t .
q . - ] .,e, e. 1,
., 94.,'. ,, e' yg$
r 1.'. ,[t w'*4y
.,e .ei,a .
.,6
.c'.
-.-t' j ',. .: .,;A c." i I , f .
1 ' . %) ;, ., A g..'A
.. . f- 4
, . .-a,i,t s , , , " ' , 3
-(,g'd *M. i M.. -% ,..y p ?,- ,
,,,, , '. , r ..', ,! , v,
*y' b' J 4
,) ,-
,- ' ,j,e
,c...~ %.,y.' -= 3. .,. ,. ,. '- f* '
t u k. . .-.:. - 3 ,,w, l" /,_W .d.
,e . . , i. 3.
qu a. i , ... ;-. ,. n, 9.- .+s
, , .. e .
,e ,n . . .
4 . . .~.g,. . .x.. _m, . a,c n,3.f< .. .:.... :a . ..., , .,. y:., a m s-
.. .. ic, g ,.3 7 . . n,
,r ~:. 1 1 ; .
3
' ~~
.k ,, .
- - s; .,.t
- f ,.
a , T,g *
.p - *
- 6 ., '.j*. i
- e
.i
* . . , .*g ;
. ' , 4 ..: ,' . -
g
.e.' . f , ,, ' f ,\ , ,.
- g. f f ; .y ,' , p -
Se ,
- I O, '. .$'$ ,. .- <. .' '4d. . f_ , , v.. i.- M- _-e' t' ,. ,, ,,".
i , 4 . ' 1}, ) g1 ,.. . . j ..s %, , g)p- p ) g, ' ,-
, -} , +,.
- gg a 1 .( - , s .- ,. <. :.
d . ,_.w,'., g %,_ .
,.,...e
,,,'%.. * . /, * %
e %- s.
.t. ,
4 1
.-4 -' '
- r. - ,v,.- . e, 1, . ; . , . - 9
- a
.G. . .
i
; -j.. >
J ! ' * " J ^* . , J- g . , i
- f. g
, 4 y(i ;
, . , - *,,.t .
.c , . c , . , v r . 3.g' 'i 2 ,
o . e, -
% ~ . ' [,4 > u , v : .o ,-
x q h ,s c m g ', g s, .t.
-)
$ g.
., -I's .
f d 1 a Y l
',** J g
*c l-#* t. W $
h f
,.,..,Y e +
- gJ . c . ii,' . e .(
( ".s. .. s . , .- .- ,.'.gp I. he g ',4,", ' = 's ,y (" pg,.,.'4 i' 5.. -r j jp ,'( 3 -p.$.. ..' . g .3
- d. .' %.v,% 5,4 '
i . -- t 4, E -.1
-g -
M p *:
-'e.W ~' c e , y', #. k:I, s . .i .t m.9 .,o ' s. * = *,7- .y i"'.
'ja w .i ) 'f
. , f f ,"bp,
- 9f. = 8 4 ,4 I -l#
3 ,. , a .M ( a . ,3 , / . - . ' ij - .,.. ,4
- f. .. .- -f g . , , _ , W d.(. .i.', )<y. +$.1 i.: . '
.- 2.
t,..,,.. ,
^*(1gi -4.v,-
4 g .
. ..: a t
b ..- ? . ) ,- - (g, . # '- - i l 1 g ; . - . ' . . . l*-
- ,'p 'V,.,,,,, . - (. y,,.
vb .g L .'g, '< ,
,' .Op . "' ,' p . g 'f ' - a ,,1
'4?.
J
,. -3
; ,- M
- ., I"
'. :., f, ga, , g . , , :g- P s " .g 9.
g g i; g , g, i Wg. p,p,g. , ' , ,
). / 43 ys ,.; - - j,..
^. ,3 g
,c e g y,
[ ).Q .: ; . - ( , . a < p , .a, . ,; ^ ~,;,v,. , ( ; _' , f* %.]
, '. _ p._ { ?'. Q.52.), , ' ' ,* . . *
.f . y.j9.
'.j , ;E ~ ,
, f-fA. lQ . Y, ' %,s. l',T' ' , '
.'N f .h i i'"l,
'- ~
l'~f u '-'.f. s. - s - n- - hk yk) , .'4 e y &
'f[ Ig h
;' *n,
.',- ,r' -
Q '[ ' : ' '( -!'. .- - --
, f, .. .g J ii b -
' - ,' '- ' .b ^ 'I 3 3 - 4 .
r
..',, , r..,,-
", "j . , . , ,
,,i -
6 ; j . ; . . h ,p,
,, h..,--' *
. f_,
...y s
' . t .
_E, , y. g ee. i f . ,,. gi. . , .
. e . 3. , 'p.
+
<, 4 rg
; g. v t,q ). h; ~e, ,, m ,x
.- ', t ',,
*.4,>...,.'7
, .- % ,jf ,,
4, 7/g,3 1W.i ..3,y'g,.. '4 ' M , '. A,]- dt *
, $, *
- t ,- ^?.,.',,- . . ' . + ' '# { - 'n ' " W - '
-' : . . ,**y1 1,- ) '.
'y'
,i
] , ,
( 4 - <s .; } , , , .
. , p qpg . qy g , . .,. .g ) ; . 3 ,. t .,.m "m y ,A
,.g y L ; ' ,l g , " ,* . . , . _
t'i
. .2,
,lp L.
i',' - n a y,.- {"' 1
. ,Q . - ' '
+ ; _';- ., , ;. <..- '. -O # Th ,.7,,.
u a s. Q * : *?.,<*- -s . i 5,
-(
h ' .,. :: .t g '., .- ' j [i s. - 4, -{ x A.. , h, ' s,. 7 l, . - _g ". . ' E ~ , ,, 6
', ',. l ,i .
A...;r .
- m. .,. o y. .. t ,. . . - s . 2, , , c., +
;..,". ,y
;ne.-
a 4 . . , - , g -
' v- A4 - : y m, .
/, . .g,4 , 4. +.1..gigf e. .
)
3
, .p x__;- n . . . .
. _ ',,.- - . q, - .. .,, ; , . = . -
-. + y _
, : -', .,... y t.- ,. .. '
ec , -
,9 p.n., +, . . w. ..+..- ,- -- --- ,- , ( :
.s- <
1, .. .-
, . s+
..' (
= , , * .
._,'. -u . - .,'.
. , .h p... .
' -:.f,-} Ac,* .tf . ... L. . %. .
h
,'.,y.
," .-[*+ . ,, t-
'+ '
i
, . ,e
, [ - , e b, g , , , ,- *
'j -
.: 't
(:.4
- n , g ,
. s, I,iN ,. ,b , .. .. r T- 7, .;.. . . ,1- & * ' .. .- -
- . t-; 3,, ...,*; a+
$ ,) ' g.
. * ' . 9..
[,' - " k /.dg' / t e.'
- o. . " -
'-,. ,' - ' .' * . ,- ','[' ,- -} -
,,'.,l D.
, .: ..ec e l
.:. .E,i x < ,: .w
* .), .i .,
p., -- +
. . sy . , .
.g g- . , y, g. - . , - t se
'.: " . . . + _ ,, , , . - &. ' ,
%q',,,, J -
,( , , ' .
- 4 .. -- [, .. . . . .
4 '. e .,
, ,,3
" ..... -, ..-% a . . . . - ,-.'.
e m . .
- F,. e * *i t .. ,
- s. .
.8/ p
.u
...S t i
,g 4 ,. M .1i . .,.( 's*, - ,t -
. ,* ......."/
- ) ,,, .. ._3w. .-
"t -
v t
, - . . e-y; , ,_, ' f_ , f g y S k. ./ , . ';.f4 ...b',,,,.s*
- i> s
,f A
g ,. 3 4, ', s - - 4 y .e.. $ ,. ., - . .
- e. < . , . . c.,. s. *- , j. P ., y . ny . 6 ,s v - . - - - =.+
- o **
. .. v
-. v . . . .
,. .- + .- a.~s '
.x.
i 3
..N.. .;w . .. ' . '.-.
,t,'a'. s,* ~* ,> g .
.:.t ,- -,-, -- gm ,_. , ' *. ' . m.
I J.;
*-.f -
~
.F .. ' - '. (** 1 .x
,f 3 ,f*- *
,e 7 -.4 ep-x .
g ,. .- .
-.s .e ,. - .
g,. s - A ,,4 _
.4 % ,. 4* - -
ta. ,, IN
.l, I' . ,pl l. ~ l [ l ' i .' .~ ,,_ hI{ N - l , s. ...,'
S l*# . . . ~ p?i*{l. Y i .n -
~ ,.' f. :
i+* . es e'
,' 5.
- s , ,'. , _ %
..g
^
g
- <W, _ , *" _
4"
*,,,. -'.y ',e'- a '
g
'p',
s u.
.r.. - - .. ..t ,- ,
y
- 1
{, ,
~, . c.. ..
(
.~-k
~
r, e' . ;'.- 5 y -.
..h.,'*..- '.
d .< I,-
' '.'.'.'i ,, .-- 4 me . ~- + . . ~. ,' q, g m u
- , y1/.9% .) - . c
+
' u ~%-. .,..
t 1
, , 4p O. .* $ -... - s - '
e a g"_.t,r..* . . .' 3 1
=
- 4 Is a .p' .
- y ;.:
.s W. , v - .. - ;r :. , ,-
ms;.
.k. ~p , . . , -
- .i.; - :: ~t.:. an . .- > - 5 %v " ,
4. te , ,. ( y:..
.. . .g . , ,
- _ s c s
- - , , . ,7 g . cog % ,-
s 4.
.. % , u-
% . v.Y,9 .
p, .. b [. .. k~ g m.g ' ,. , s j
.~. yycc'. Q', . '.
. , e. .
f {. ' z.. . - ,. . g ;8 9 4*
.tg ' , , , 4 , . Y. --g,
.m.r ,' ,..#,.. s a - - ,
- e
.c. - ,,+
,s,
- .,.- -.',,a,,..- * .
<2 .i -
. . . ,q.,7 .. , 5s.: . ;$1. Ag
- ,.e
+.
,,. s,., .. . . %. .p.- ...' - s..
% - - :g b ' , . . ,,,
, .. . $ h '
i . -m -
. , s.
- [ .?,
,j , ,- k, ?. '1-i. .
le . ?. ,.)>- . ag.: ., ; . , .,.&. ; .*f , f. .w _'
. . ' *: v 'd .... . .-
y.... .y - ,. f, - .. , t,. . . s , .
- ;. ,y+n + '<.:
qn .~ ats.. <e ~. _' e,- _ , ;,, ".
- ~ ~.'-.
.,u
..g,'. .. . . i. '. - p4 .-
. ., .. :,Q. .; y r . :
. _ ,. . L
.y ,
~'- - '
%.1.
y.. s .. , ...s
, 4 n
A.,y '. - i s. g ,'
. 7 i .[
g..-
~
,e
..J-
'N v,., . '. .4l- .- ...g n y;. . .'l - g
+f.43,;p)
; . , _ _ r .p ~
. . m .. 7..
v, . t ,$7j; y,,. y -
- s. , . . - k_ ; :
s, .;. , . . 3,
.. 2 .. . -
.: . - w. e , ,,-
y ..,
+
y -; l9 ,, .- y % g s.y'; :.~s . c. r c
.. r .; . ., (. . ;,.( . . . 9 : -
, . .+ ;e o ,n'
. .-' . ..- c s. g ,
, 4 -A - '
7- 3, ( j. . g.j ,7, ....~,. 3 r i.{ -4 *
,' .,,g 7,~ ( .; * .- .'.,.p-, . - g,
'p' .y
' g.,g ; ),. ,,s, A,.g,, .- (,-
',,1 -g e
~
,,e,
- r - . t, . ,,. m -, ; _., - . p,t:
. .g ,
;. , , ;. q,;, , , . . . q
,( . . ..a, w
- g. - i < 1, . .% . y, -_ ',
g
. . . . 4.4,' e-
.~ - ,
y-
- , ,.3. .
. (.l _ p
." ; ~
. q,y% ug..-'3.
p9b *. (,*,
. . 3; a 5 t,
..Y[
, -d. .. .
s;z 3 , - , .' p, .-> s g, -
- .. . .w g. - ;. ,,_,s.p. _-
',,...e
..,p-. '
;,-[t
,. '- . wf' *.
...,L.i<'\',.,.
,,:2 .-
. ' ' , _ . _ . , . r~ . - ,
1s, . n . 9 s y,-
' : ,, j,-f.-' }4 , .'.:. .- , _ . % ' ,;',,* . f .. . ,
0 F, (-- c > ' - ;~* ' .... 4 *
' ' .W
.i
~,
? , , . .
, ..- . ! .t z. .
e,
. .s g ..-t
;# +9 i ' $ - 1 , g ' p. ' .
',* . ~ . ' -", ,....J.
.l ..
c j-..*: * . . .( I. ? ~ w , y g g-7, , .
] g .. . . . . ., r. - ,
i .". .. - q(. i e ., , g , , c ..-
.: .e e -,
y .. y 5 < 3.,7.w ..t J
;.. , ,_ ' , . %*.f (.p g ' 4 g. M.'r d . ,,"
- g' .' ,.:-.N'.. Q '1
*' * ' - ' . we .-d,
.gig. .g;,- ' .. ,, . , ' .
4 l_- g. . - 2 - . .,.s 3 , 3 ,
- ( ,', " ..' i , .. ' ' f .. - t .- / J'. " ~ L ,' -
T, -/W " y,,',0+
",;. ' g , _-o, J'
..."..$,... ",am , .
', .u s.,
., 'i.3,.<,gsql,d,p,kn'".,e j } ,<
,a , s Y ( j i.,, / , '.1 urn ,' .i,. , '] , '
i
%, a. y
- .., .~. 3 .
. , , A , o .,:
,,ra .
4 ,
; t ., . . , :7., . - wg . , . ,;
e ,. ' - p,:- ,1 - _ - m- ,
,+ ,._n.
. , 8 ,
v 4.i . g. ,* < ., .. .,,i,,. s g ,3 ,.x . s - -. , __.-r e. , t g.imr - ... n
,f . 4y . . t,,,.>, j e,, . < s 1
. w . %. ..r.. .3. ,',t-:. ,
., ,,.x, f, , ,
4
- g. g . .. ,
.4.
% - bN -
j', .~,p
- f. 3u. ; q ,.
ey. :.e v
. . .o ,
.. s-
- x. . -
+.a,..
c.-m
' . .s .
p-p g r , y,,,. , . c, . , ,: .s.i - A ,,
.. , W c,y:
n2 - v ,< .g< .' . y . .-. ..
- s+w* ., ,,~,...e,- .
> t.;,- v
, % .. ..$., ,, . y ,,3 1 7' , . ..
%,' " . *> J - t ,, . - .4,A K.s c ,- i d. . ~"'
gN x
,. / . .. 3 .T.
- pd, a .: *
,.r._ V. .
. g<, e r., .-
.x , ', , &,..,4p % i
?k . ./.y~. - , ) , ; ' .. m . t p . /
o ,, . - ..
- a,.- . h, :. , . 1 ~, . ,',%, y,.'..
- ., y{x.,.
g e<y,L n, ., . s- . , .. , ,- ,% -
. .. * '^, . f.' , , ..
., 7
,;.....n % _,.:. -,, .-, p, .v
, 3 4 ' ';
q..
. w.n - p
- :. _, <% + .
J> ,, :' ?
- *>. .n ; , <
- s. g ,x.e - -
o 2. x ,n , - p ,. . :- . :'- .. ,; f
,. i s, ,y % .. < :u,. ~ s.
x w. .*-u ". .,gf "c e ,. e,~ne . v ' ,e ,p ...s. (_. .- .- ' .
. y/ , . .
i 1
> u m, .
u.y -
. ...,.s-.
s . . . y., 3 ' ..
, 8 3.
- f .;
," .k . - ' _ , ,l,*,,' *p-
* .,4 _,
,_ ,s. , .g I '
1, .e i=*
. ;', . , ,- ~\.r.w.. W, '.u. %q' b ',.., " $' , t.h,y
;. -- =; ~" p. .s. =
'yi , :-
%g4 c' 7 i:. :.. . . g .? ' , .*, . - . . .
.' '=p.,
* ~
y ^ -;; . . t
,,q
- ..c q , , eq , qi,
...- ~
g .y f (,. 3 . 1, w+ , ..- ,e
'g .Q., ty ., . , - w . . , , .i i
t
.e E]l k.. ' '- 4 -
,,[* ] ' _
,, '1 4 t , , -
.. j-g2 i I' t
* ., ,, , .. ' , s.
%- n i - - 7 <q .
p
- r. .g j. V ,p * ' ..},,,'
. %pg..1 , .,
z.1, 4 h n, g i . . = i,;
/-
, g!['.; ', .k.} - ' { '
, l. g , b < >
Ej .. , .
$ .. 7 . , , , _ . ", ; . { .j. ,'
g $- , ,. .' /'"g g- . - '- '
,. ! c tg ; -
e 't x e * - ' 4,
,'.'7,,'.
i, [ 3 ( h, , , ,'," ;,' '.,i U I
',h qk t P3 A-[-[Ng L #.+-
P.~ M N. +-h. *$ .. . g
- 1 a , ', - -
..i+'
/
' , . e-l_
v ' ;L i,,,, t
'.- ' 4. + p,".' <. t,*
) ,i, - q4- 3 .
. . . , 9> > *,. - . ... . P,- , , g t s I.t.. ,- r
,i i ..r- i tW , ; ,, n .
,p ; , j' . ,4 .
. y' , 4 y , :< ,4 -
%? .. . . -
n
. . ,a,r_ ,e,y,,...
,....., 4 s.. ,. u
* * ,-p.@4 . . . . , g gi
. 1 .
, _, p, w
.% ,. t - <
4 ' .7 y i n ,. ,t- ,
",..'q' ;.<.,t . .T ; ' '.,p ,, ,2 y,- (%.74.,q_,,_ ? ,9 i
l ,.f.g., y J. .
, r -, - * , . - ,, , , . -
e4 -v 3 4. , , i
,p.'". ,'.
, ' .' l i .' . ' y ) ,p 8. , , e.. _' f , p '. .
_j' # . . f v, . . , t, f ,,, / . ' ,
.< J
, ' ly.3,.-,, --
i r
, ' , -N. i . ;, ,
., ,j ., .? ,
74 c ' . . , , 9-
. a .. . - >.
- s, , .+ i ,. , 31, ' . m, ,N_ 9,. .
7 -e ;. . 4 gV, . p',,n,,j .n- '. . .. ;r l. g,,,l 3 .p
= ~
' ,p, , ;y,, 4 ' .. } . , o, . . j ,. z. L .g . ; S,4
. 3 .- -.. -7
, , f j, ,(
,y , , ,
'. -- y < 4e..p,..";N,7.
- . - . c 1 , - y- - m a, : u, w -
- 1. .
..\,,,
-+,- .
$ r. . '. /~ 5,,-
- ogs .e*
t s . .
, , , ." , , , a t'$' i
,,.m y
.g . . .. .
.+.'
,, 3 -
, s ... ' .
, , :.e i, 3., + ,*gt- - . 7
'- ' .' f;
w ',, . .5, <t3.
'.a g, , _p*'. 4 ','; - . ,
. tL
' ." a
, - -.,. .; ,. ,8 ',, - s. - D i '_- 9 , g -- ,g g
- p. . , , [t 1, ," .. ',
4
.r e s.1, ,1 '.
7, gl. . s' ,. f. O,af ,) ' N_ f'
&( ',;' . _ ' k ' ,'_ . ' - , g ', .,- - ;
9 . 3 _ .. o ; e ,,1 g, .- - ,}~.' . :t c
.,ap ,
.' . .4 .y &\,- . y. ;',p ..,' , *..,i,'
-s
+'
~ g: 4 .u,' , y \ ;; ; . 9;
..y. 3...,%, .
._. , ,, 4 s ' , , , , . - , ; ......_- s., m. _v .- . -
.4- e i .y ( ,, , J,1 v- 4 ,t .'
- 7.,
,j - -2 1
- . 5 g,
}(.'- . , ,, ,' ,
7
.gk' a .'
l,
.t ',i*,'. .,P/ iss-
.' .,r((- '
- 4- 3 .:,1_ 3 , ,. ,. . . . , -
,$>.v . ,.
g , i ap ,
.g.,..-
s,..., - ,
SUBCRITICALITY STATUS TREE l t L r .. (RED) GO TO 4 FR S.1 L LOGIC (ORANGE) Go To [ f""""" FR S.1 NEUTRON FLUX NO I ENTER h LESS(Rm THAN 5% -- ns (YELLOW) ee Go To FR S.2-e LOGIC INTERMEDIATE go INTERME0 LATE NO MOR RAN 8
- - NEGATIVE YEs RO 0R YES MN-0.2 ON NEGATIVE
~
INRA INRA CSF (GREEN) too c
= RANGE ENERGlZED YEs (YELLO,Wj GoTo 1" FR S.2 e
e LOGIC { SOURCE NO RANGE [ SUR ZERO OR NEGATIVE
~
INRA CSF { (GREEN) tocIc FIGURE 5.2.1 [
~
_ - - ----------- )
HEAT SINK STATUS TREE A TOTAL C FEEDWATER NO l i
~
FLOW TO ~ SGs GREATER
^"
$7o gom (YELLOW) GO TO
.......... FR H.2 TEFWE SG NR - PRESSURE IN NO ALL SGs NO kEVEL'"
(EAST L ENTERh ONE SG YES TH N 1255 GREATER YES THAN_ % (YELLOW) GO TO d lNRSGLd L SGPL ggggggggg
. FR H.3 l' ARROW LOGIC FANGE no LEVELIN ALL SGs LESS THAN YES 84 5 %
NONADVERSE ADVERSE SETPOINT SETPOINT NRSGLA
....... GO TO LOGIC FR H.4 5% 35%
PRESSURE IN gg ALL SGs LESS 1185 PSIG YES SGPL (YEM) GO TO I'**** FR H.5 LOGIC NNNT NARROW g BUILDING NO IN ALL SGs PRESSURE GREATER YES GREATER THAN 28% THAN YES 4.3 PSIG NRSGG p C$p SAT (GREEN) , LOGIC ! I FIGURE 5.2.3
INTEGRITY STATUS TREE
,, (ATTACHMENT A) 8 .
as v E E l
% 8 l N Ti Ta COLD LEG TEMPERATURE LOGIC R P.
L IC ALL RCS (ORANGE) GO TO CS't$'tEG TEMPERATURE ["""" e FR P.1
- PolNTS TO YES LOGIC
? f i' 1 . BERE
~
GREATER THAN YES
" :D ?Ni
- 250*F (Ts) ALL RCS TEMPERATURE COLD LEG NO DECREASEIN NO RCSCL L TEMPER- -
ALL COLD ATURES ENTER h LEGS LESS GREATER THAN THAN 100*F YES 280 F (T2 I LOGIC MINU E RCSCL WHEEN) CSF suco SAT (ORANGE), GO TO FR P.1 ALL RCS LOGIC COLD LEG NO TEuPER. ( ATTACH M E NT B)r- ATURES YES RCS PRESSURE GREATER THAN LESS THAN NO 250*F (T,) LOGIC r-- QS$uRE RCSCL
- GO TO uuir YES (YELLOW) , FR P.2 NO RCS
- TEMPERATURE - RCSOP t IC GREATER THAN YES (GREEN) csp 350*F* SAT (GREEN)
RCST li , CSF l L0u C SAT
- ARMING BISTABLE SETPOINT FIGURE 5.2.4.A
l' SEABROOK STATION OPERATION LIMIT CURVE l
= g9
,,,, , i , i l , , . .i , i i s ...
i .
- i. ...i..i
..ieite i , i e t i . -
'es i 6 t. 6i ii i i . i t i . . , ,
i i '
. i e i ! ! I i
,i, , , . , , ! . . , r , t i i ia !
- i !
i i i I ! ? i i - - ,
, e i i , ei e
. . . . t
! ! , , . , , . i . . - !
i . , , i .ii, , , , , i . . . ! . .
, ; . 1
, i . , i e a i i i i , i ,,, I i i e i t I i i t e
, , i e ! ' i * ' ! I * '
) i i i i e i f
! ' i P
' I i jm e i emee m t - Men - I ! t i t i t i i *
- 9 i t i i i i t i e 1 1 6 i , i _LW i i i GN=F%#< i 6
i i i - = . i .
. = t s, , i , . , i , . .J ,... . 4 . . . .
' t f ' i l ! I e
, , , i , i t ' ' ' !
. . * , / I 1 ! I t i ' ' ! i t i e , i t ! ! *
- f f i * ' 1 ' I i ? ' i ! I - -
i ; e e i t i if f f i i * ' *
!3 !* i ! ' ! i i
- I i - i i ! I i t Ii i 4 i .'I i e . . e
, , , , , i , i .
; . i t ii i ! 6 i i i .
. ,/ , . .
, i . . , , ,
i ! ! ' i i . i i , f, i 3 3 4 i e , i * * ' ' !
! p i . i ' f i ' i I I ' '
I I i I t i i i ' A! ' I 1 i ! i 9 I l ? i t i ' '
! t ' i !
e i 6 , /i i e ! i i6 i i i i , i i i ! I i _dMJ. tr.t.I . it i i , , i , -
. . i i t i ' i
, i i ! I f I i i i
- i r I t . -
!irr we a r= A / t i ii .i t i , , l i . 4 .
r i t ;i ew.,w h 6 i , i, a , , , , . , , i i i
. , ~ ri , . , . , i i . i .
, , i M
i ! i i ' !
, , i . ,
- 6 i ! I t ' ! I t i i i i . i i , . . ,
l .I j i i t j
, i , , ! ! , i , i
, , , , , , i i
, , . , in . i i 3 i I . i . , t ! i i i e i 6 !
I i i If. , , i . . i i i i , i i . . i I , 1 . i i ui , a ie i 6 i t ! ! t_ fi i i i i i , i i 6 , , i i i i
; i
, , i i i i i ' i 4 i d
! t j t' i . t l ' 4 ' '
IJ 1
! ! i # i i l ! i i !
iI i i t [ l ! i i + i e i i , i i i.I e i e i ' I i 1 6 i i I i f f t i i
' ! I I -
i ( ll i i '
! i I
( i ! i l ,
, i i , , , i
$2 a
, , t i i i ! + i i i I cn i i i i e i i i t 't_
g if i e + ! i i i l tri f ! *
- t ! t i I e !
- i l i i 1
' ' t I i i ! ! t i .
i l J i i i i i i e i i i . !6
- e 6 ,
i i i i e i 1 ! t I i i . 1 i a 1 t f f '
! i t t i t i ') ! . ! s ! t i I e f i ! i i l i i i i i '
i Z it i i i i . i i i i i i i i 4 E i i 1 ;> ii i . i, e e i i i 4 i i i i i ! i i ! i i i e i T li i t i . . i e * , i i 1 i t
+
! i i i i t ':>. t t
- Qf i i i I i i I I * < e t _ l e*7I !
! i
- t i i
~'
, i i ! ! i ! ! !U- !
i W i
+
i J
! i ' t i i ! i i i ! !
i i I
- i i i '
gg i ! ! i i I i ' i 1 . t 1 i ia I j =eJ s i
. 3 i e e a i i i i e i i 6 (i i i , ( i I I i ' I i ? ? ! ' i '
i 9 I , 6 a kRMP i i@i
- i i iM MFT'*kk i ! -
~
' l%Ir"* M i l i i ! w ns.n i i i i + i n5u ~
i . r Gn 1%E M'm i! t t i acc" : i~! +#i. ! ' _ i i i ! i ! i
- i -
l i i i ! i 1 1 !
' i l i i i! ' i i I i i
- i. l ! # i ' ! t
. t . I _ i i i i i i i 3 > > f f
. . ! i i i i I !i 1i 1 i !
e ! I f i i . . i a * . ' i l i i i i i f i i i ' !
' I i ' i ll ., i ! I i i ! 1 i !
i i . + + i i i i I i !
' i i i t i 't e i i t i I ,,
i i
- i
.
- i i e i i t i i i * .
i I i ! i i i i f J i 3 6 I i t ( t ! ' i 8 t ! ! i i i I I t ! i ! ' [ I i i * . t ! t i i i ! I i . ; i . 6 i i 400 O , f i I 300 10 0 / M IW I I I i TI T2 TEMPERATURE (*F) l FIGURE 5.o.4.B .
SEABROOK STATION OPERATION LI!!IT CURVE WITil SUPERIMPOSED LTOP PROGRAM 1 1 , . ! , _ !
, , ,. i. ,"" ! i i ! i i i i ,
i ; ; i , ! i . I i i i e ! I i e ii ' I i e ! i
. I i i I I r! t i ! I ! ! i !
! I I r . . , iii i i i , e i i i ' + ' ! ' 1 i i ! ; i
'i '
i i ! i . i !iI+ h* ! t i t i ! ! ! ! i i ! i i i i i ! t ' T i i ! . i i * ' i i 1 1 4 ; . ! I ii I ; ! ' ! I + i i !e ? . 6 . ! ' ' ! i ' l i i i i !
' ! i i ! l! i i i ! ! !
j i i i . . i . . , . I i . .
- i i i i 4 i
, i , I i i ? i e i ! t i ' t ' ! ' i m e m mP' neaei i [ i I ! i i , . i 6 i i . i i . i t i f 6 i ; i ! l ! i & Ni TGLUi . 1 256o m 2500 wn li ,
y i 3 ,i
,1 . ! I i -
i i ! . 97A47-1 _ > mm i
-==vv'v v
. .f , . i i
- 2385- .i! i t i - .
E Et i I
. ! ' - . t i i -
i'!
.$ i . , i + ! , . i i . . ! ! i if i i i !
+
! i ! e . t
- I i ! * ! I e i ! f_ ! i i ? I i i ? . . ' Il ! i i ! +
W CL l . . r. . . .I
, I i i i I1 I . . .
i a ! ! . t . E_ e i e i . . . t i i .I i i i
- i l i ! +! .
- i TE! ii e I i ! i . ! . I I I i 17. i ' i ' i . 6 i i i ; i i . i i i 'I X +
! ! I a i i +
Ii i i ! i t/' ' T
'. i i z2000 I
* * ' 3 i
i ! :/. *
- i i +
+
i 3 i, . , I; 1 , , , .i . . ! i 1 ,; j , i i . , i i 1- i i 1 i i i ! . ! 1A I ! . ! i i . . i e i h ! I I ! ' i , f; . i ! ! I i i ! ill i i 1
+ . ! ' I i i i !
y ! ! l 6 ! i e i I i l l e i F! yI ! I i i i i . 6 . i y 1
' t. '
t ' F 1 1.t a' _t ' t t ! ' 1 i i ! 17. . ! t ! i + t i t t i ! ! ! ! i t f I i i i . i t ! ii i i i i ? I' [I! 8 t ~i l i i i i / i e i ! l i i e 1 l 8 l i It i i i
* , i i t i i [ . I i [ t . i + 9 ! [ t l gg i + ! ! I~! ! i i i e i / . I r . i . i . i .
i o 1 i t
., i f . . ',
t
! ( i i !
I I
! i , i 1
, i, 1 i i i i l + i i + ! i !fi i ,
i i i i i e e f ' ! , /. i , . ! i i i i
. . F e i J. I j i i ei i ;
E i i i i i i i f i 1
' i !
i i ! /
. /i! i I i 1 i i i .
"} i i, ,l, t ! . 1 i 1 , 1 1 i i . <1 . . i ! i , i , < i , .
.I
=1000 i !
i ! i t I I: Ii l! I i
' +' I! i i
/ i i be . i ! t 1 [ 6 r
t i i i i
. . i .
X I ' 1i O i
! ! ! ! I . i . . . . i . i i 4 '
i ' ' ! ! ! Ii i i
! M i i i . Ii ) I , ' i i~! ,! i .
i ! ! i i f ru% D Ef i
! /. ! '
i i ! l ; i i i ^
. , i r ^
. ' i ! 1 . ! IW! If i. . i . ! ! 6! . ; [ ]
I i i I i . . . _ .
. I . .
i 1 ft t ? i
. s ',T / .
, i i
! ! ! I i ! ! I ! li ! ! ! i /9 i t ! . ! I i . i j i i ! i i ! i i fi ! I i # 7 t i i ,a
"+'
1 i i , . , , , n' ,' -" ^ ;; 500 -- i' - i ' i -
!1 t i - i i i i
I i
' ! 1
' ! I I I t i
! .I l
i i i s i ! i
! i i i i
! i .
! i . i ,
j ,
'. - , i ,
7
^
.! i i < ! i. t . 1 1 . . r 1 .
. i i i 1 , ^ ^, ,
' l 1,i
! ! . ! . ! l ! i i 6 6 6 200, ' ' ' ' '
E l.l 5 IOO 15 0 200 250 300 350 400 . T' T' I LTOP RCS TEMPERATURE (*F) ARMING POINT 350* F l'lCUR E 5 . 2. 4 .C 1 l
CONTAINMENT STATUS TREE O CONTAINMENT NO PRESSURE ENTER h ' "*" ves (ORANGE) U'PSIG GO TO FWMMMMM FR Z.1 CONP I E CONTAINMENT NO PRESSURE LESS THAN g O TO [ OGIC , CONP CONTAINMENT BUILDING NO LEVEL - LESS THAN '" snein (YELLOW) GO TO 4
*** FR Z.3 CONP l g LOGIC CONTAINVENT RA0lAfl0N NO LESS THAN _
TWICE ygg BACKGROUND CONP CSF SAT (GREEN) LOGIC FIGURE 5.2.5 l
INVENTORY STATUS TREE
'(YELL'0W) GO TO e FR l.3 e LocIC RVLIS INDICATES No VESSEL ~
LEVEL GREATER YES THAN 90*/. RCPR *
,, GOTO F R l.1 (YELLOW)
LOGIC PRESSURIZER No (YELLOW) GO TO ENTER h $'s'73,3 92 % YE8 4 e LOGIC F R l. 2 PREZL PRES $URIZER No LEVEL
~
m GREATER THAN,% g (YELLOW) GGG GO To g, LOGIC
]k RVUS PREZ1. INDICATES No ADVERSE VESSEL NONADVERSE _ _
LEVEL SETPolNT SETPolNT cp(ATER YES 17 % SO % THAN90% A di RCPR T CSF CONTAMtENT SAT su u Ne NO (GREENloctC PMSSUME , GREATER THAN M3 4 3 PSlo. FIGURE 5.2.6
i TD TD' TD TD TD TD TD TD TD TD TO TD i TD TD. TD TD TD TD TO TD TD l TD TD TD TD l TD TO TD TD TD TD TD TD TD TD TD TD l TD TD TD TD TD TD TD TD TD TD TD
~ 3 TO TD TD TD TD TD TD TD TD TD T = THERMOCOUPLE (58)
D = MOVABLE INCORE DETECTOR (58 LOCATiqNS) SEADROOK STATION UNITS 1 & 2 l l [ FIGURE 5.2.8
~
. .= - -_ . -.- . - ... . . - _ . _ - . . - - . - - - - -
j 6.0 IIAMPLES OF POSTULATED SPDS RESPONSES TO TRANSIENTS In the previous sections, the SPDS has been described in detail. The
- bases and hardware for verification of operation are now proven, but, as yet, the practical application has never been carried through a complete scenario.
j The function of the SPDS during six major classes of events is discussed in [
- this section. Emphasis is on what indication the status trees would present !
7 to the operator during the postulated accident. Operator's response to ! threatened _ functions should be accomplished based on the rules discussed in f
- the previous sections. Information for this section is taken from Chapter 15 ,
of the Seabrook FSAR (Accident Analysis). Please be aware that the data from Chapter 15 used herein is for information only in explaining how the SPDS
- would operate. The FSAR should be reviewed if the accident analysis data is l needed for any other purpose. l i
- Chapter 15 offers several different examples in postulating plant accidents. We will examine one type of event in each of six major ;
classifications. The six major classifications are as follows: i 1. Increase in heat removal by the secondary system.
- 2. Decrease in heat removal by the secondary system. !
- 3. Decrease in Reactor Coolant System (RCS) flow rate, i
- 4. Reactivity and power distribution anomalies. !
l 4
- 5. Increase in reactor coolant inventory. !
l
- 6. Decrease in reactor coolant inventory. ,
l
- 6.1 Steam System Pisina Failure ;
l
- The steam release arising from a rupture of a main steam line would !
l result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes l- a reduction of coolant temperature and pressure. In the presence of a 1
5 n:getiva mod:rster tempersturo cocfficicnt, tha cooldown results in on s insertion of positive reactivity. If the most reactive Rod Cluster Control Assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a, steam line rupture is a potential problem mainly because of the high power peaking factors which exist , assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid injection delivered by the Safety Injection (SI) System. l I The analysis of a main steam line rupture is performed,to demonstrate that the following criteria are satisfied: $
% Assuming a stuck RCCA with or without off-site power, and assuming a single failure in the engineered safety features, the core remains in place and intact. Radiation deses do not exceed the guidelines of 10CFR100f Although Departure from Nucleate Boiling (DNB) and possible clad perforation following a steam pipe rupture are not necessarily unacceptable.
The following analysis, in fact, shows that,no DEB occurs for any rupture, assuming the most reactive assembly stuck in its fully withdrawn position. i
)
The major rupture of a steam line is the most limiting cooldown j transient and is analyzed at zero power with no decay heat. Decay heat would retard the cooldown, thereby reducing the return to power. s' , Figures 6.1-1 through 6.1-3 provide data for this event. During the first 75 seconds, and then again at 200 seconds, the status trees are checked cnd expected results are as follows: SPDS 75 Seconds 200 Seconds l 1 (S) Suberiticality Red Green (C) Core Cooling Green Green (H) Heat Sink Yellow Yellow (P) Integrity Green Green
- (Z) Containment Orange / Yellow Orange / Yellow
'(I) Inventory Yellow Yellow i
At the ontat of thio cecid:nt, th) first rcquircd ceticn by tha op:rcter would havo be:n dictetcd by ths cuberiticality ototus trsa. B:ccuss of the cooldown, with a strong negative moderator temperature coefficient coupled with the most reactive rod being stuck in its full withdrawn position, a return to power is observed. This causes the red path in the suberiticality status tree. The operator-directed response to this observation is to insert rods and emergency borate. With the pressure drop in the RCS due to the cooldown, SI is actuated. Therefore, the operator should only need to verify SI flow and boric acid addition. As can be observed by the accompanying curves, boron injection does reach the core; this returns the core to a i shutdown condition. l The core cooling status is satisfied because the exit core thermocouples never approach elevated temperature. Subcooling is maintained during the entire 200 seconds. The heat sink status tree will show yellow because one of the steam generators will never recover level into the narrow range. With a capable feedwater supply available and three intact steam generators, the heat sink status is never severely or extremely challenged. The integrity status tree stays green during this presented accident. Although the cooldown rate does exceed 100 F in any hour, the final temperature at the cold leg indicator does not see the necessary 280 F to offer any challenge. The containment status tree could show orange because of the pressure buildup inside of containment. This buildup would be limited once the feed to the faulted steam generator was isolated. If early detection of faulted steam generator is accomplished, then the orange path could be prevented; but with the activity present in this postulated steam line break, a radiation release would create a yellow path within the containment confines. If the steam line rupture were outside ek containment, then the containment status would be green. The inventory status tree would go yellow approximately 10 seconds into the accident and stay yellow because of the pressurizer level drop. Recovery l from this would not occur until pressurizer level was re-established above 17% indication. l
6.2 Loss of N*rmal Fe'dw'tcr Flow A loss of normal feedwater (from pump feriures, valv:a malfunctions or loss of off-site ac power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduce ~d, the primary system variables never approach a DNB condition. The following events occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):
- 1. As the steam system pressure rises following the trip, the steam generator power-operated relief valves [ Atmospheric Relief Valves (ARVs)) are automatically opened to the atmosphere. Steam dump to the condenser is hssumed not to be available. If the steam flow rate through the power-operated relief valves is not adequate, the steam generator self-actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
- 2. As the no-load temperature is approached, the steam generator power-operated relief valves (or the safety valves, if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
Reactor trip on low-low water level in any steam generator provides protection for a loss of normal feedwater. The Emergency Feedwater System (EFS) is started automatically. The motor-driven emergency feedwater pump is supplied power from the ESF buses. The turbine-driven emergency feedwater pump is driven by steam from the cccond:ry system cnd cxhrusts to thm ctmo:phira. Tha pumps taka cucticn directly from the condensate storage tank for delivery to the steam generators. Following a loss of normal feedwater, the EFS is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition. Assumptions made in the analysis are:
- 1. The plant is initially operating at 102% of the engineered safety features design rating.
- 2. A conservative cere residual heat generation based upon long-term operation at the initial power level preceding the trip.
- 3. Reactor trip occurs on steam generator low-low level.
- 4. The worst single failure in the EFS occurs (one of the two emergency feed pumps fails to start).
- 5. Emergency feedwater is delivered by one emergency feed pump to four steam generators.
- 6. Secondary system steam relief is achieved through the steam generator safety valves.
- 7. The ARVs are assumed not to function.
- 8. The initial reactor coolant average temperature is 5.8 F higher than the nominal value.
Figures 6.2-1 and 6.2-2 show the significant plant parameters following a loss of normal feedwater. SPDS status trees will be evaluated at 500 seconds and 4,500 seconds as follows: SPDS 500 S*cends 4.500 S conds (S) Suberiticality Green Green (C) Core Cooling Green Green (H) Heat Sink Yellow Yellow (P) Integrity Green Green (Z) Containment Green Green (I) Inventory Green Green The subcriticality tree would indicale green throughout the entire
- transient. Since the steam generator low level causes a reactor trip, the nuclear heat generating source has been removed as a concern during this accident.
The core cooling tree would indicate green throughout the entire transient. Neither core exit thermocouple temperatures nor the loss of margin to subcooling (30 F) reaches any condition tht.t wou"d
. cause an upset to the core cooling status tree.
The heat sink status is the only tree challenged at all during this transient. If the single emergency feedwater pump had not had sufficient capacity to supply the minimum amount of feedwater flow to the steam generator, then this accident would have been more severe. With the data presented in Figures 6.2-1 and 6.2-2, we can see tha*. the only problem of concern is the low steam generator levels which, once we have recovered from them, will give us a green tree and complete the safety functions being satisfied. The containment and inventory trees both stay green during this transient because containment is unaffected and the pressurizer never drops low enough for concern. 6.3 Complete Loss of Forced Reactor Coolant Flow A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss ef escicnt flow is o ecpid incresca in thn ecolant tcmpiritura. This incratsa could result in DNB with subsequent fuel damage if the reactor were not , tripped promptly. Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator. When a generator trip occurs, the generator breaker is tripped open, the buses normally stay energized and the on-site buses receive their power from off-site supply. What actually occurs is a reverse of power flow in the 345 kV system, l The following signals provide the necessary protection against a complete loss of flow accident:
- 1. Reactor coolant pump power supply undervoltage or underfrequency.
- 2. Low reactor coolant loop flow.
The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps; i.e., station blackout. This function is blocked below approximately 10% power. The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition resulting from frequency disturbances on the power grid. The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two-out-of-three low flow signals per reactor coolant loop. Above 48% power, low flow in any loop will actuate a reactor trip. Between approximately 10% power and 48% power, low flow in any two loops will actuate a reactor trip. If the maximum grid frequency decay rate is less than approximately 2.5 Hz/second, this trip function will protect the core from underfrequency events. Figures 6.3-1 through 6.3-4 show the transient response for the loss of power to all reactor coolant pumps with four loops in operation. The reactor is ccsumed to be tripp:d cn cn undsrvoltaga signal. Figura 6.3-4 shows thn DNB Ratio (DNBR) to be always greater than 1.30. Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values. The reactor coolant pumps will continue to coast down and natural circulation flow will eventually be established. With the reactor tripped, a stable plant condition would be attained. Normal plant shutdown may then I proceed. i l l Since the data provided is only critical for a period of 10 seconds and it would take this much time for an operator to respond, the safety function of the SPDS will be observed as follows: SPDS 10 Seconds (S) Suberiticality Green (C) Core Cooling Green (H) Heat Sink Yellow (P) Integrity Green (Z) Containment Green (I) Inventory Green Suberiticality is satisfied with the reactor trip and no complications. Core cooling is satisfied because core exit thermocouples and subcooling never leave their normal conditions. Heat sink status tree does elevate to yellow. This will occur with any trip from power conditions. Because of the steam generator level shrink on turbine trip, the narrow-range level indication in all steam generators will drop below the setpoint (28%) for the yellow tree indicator. The operator's response procedure will direct him to verify feedwater flow and re-establish a minimum level. The integrity status tree never sees a cooldown rate sufficient to offer any challenge. The containment status tree is not affected. The inventory status is also not j challenged. l I 6.4 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind tha cera p:wer scnsrstien until tha otsam gansrator prassura rasch2s the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad, the Reactor Protection System (RPS) is designed to terminate any such transient before the DNBR falls below 1.30. The automatic features of the RPS which prevent core damage following the postulated accident include the following: , 1. Power range neutron flux instrumentation actuates a reactor trip if two-out-of-four channels exceed an overpower setpoint.
- 2. Reactor trip is actuated if any two-out-of-four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
- 3. Reactor trip is actuated if any two-out-of-four T channels exceed an overpower T setpoint. This setpoint is automatically varied with axial power imbalance to ensure that the allowable heat generation rate (kW/ft) is not exceeded.
- 4. A high pressurizer pressure reactor trip is actuated from any two out of four pressure channels, which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
- 5. A high pressurizer water level reactor trip is actuated from any two-out-of-three level channels when the reactor power is above approximately 10%.
In addition to the above-listed reactor trips, there are the following RCCA withdrawal blocks:
- 1. High ntute:n flux (cno-cut-of-four pow 2r rangs).
- 2. Overpower T (two-out-of-four).
- 3. Overtemperature T (two-out-of-four).
In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made:
- 1. Initial conditions of caximum core power and reactor coolant average temperature and minimum reactor coolant pressure, resulting in the minimum initial margin to DNB.
- 2. Reactivity coefficients - two cases are analyzed:
(a) Minimum Reactivity Feedback A least negative moderator coefficient of reactivity is assumed corresponding 'to the beginning of core life. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed. (b) Maximum Reactivity Feedback A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.
- 3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118% of nominal full power.
The T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum l values. __ _ _ _ - . __-___ ,. m . _ .. _
- 4. Th2 RCCA trip inssetien charactselstic 10 bastd en thz esaumption
.that tha highest worth assembly is stuck in its fully withdrawn position.
- 5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at maximum speed.
The effect of RCCA movement on the axial core power distribution is i accounted for by causing a decrease in the overtemperature T trip setpoint
- proportional to a decrease in margin to DNB.
Figures 6.4-1 through 6.4-3 show the transient response for a rapid RCCA withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in T, and pressure result, and margin to DNB is maintained. B The transient response for a slow RCCA withdrawal from full power is shown in Figures 6.4-4 through 6.4-6. Reactor trip on overtemperature T occurs after a longer period, and the rise in temperature and pressure is consequently larger then for rapid RCCA withdrawal. Again, the minimum DNBR is greater than 1.30. i This transient would not offer any challenges to the SPDS critical safety functions. But with a reactor trip occurring from an at-power condition, the shrink seen in the steam generators would cause the heat sink tree to respond with a yellow condition. As previously mentioned, from any power conditions where steaming rates are large, this shrink will occur when that steaming rate is suddenly stopped or reduced severely. 6.5 Inadvertent Operation of the Emeraency Core Coolina System Durina Power ~ Operation Spurious Emergency Core Cooling System (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A ) spurious signal may originate from any of the SI actuation channels. , 4 l-
]
,, - - - - - , - , , , , , - . ~ . - . - - - . - , --,,--,.,-%. , - - , , - , . - . , , - - + - - --,---,-,,,-c-----n - , , , , , - ----,w , , . - . , - - -
Following tha cetuiticn cignni, tha cuetien of tha cooltnt ch3rging pumps is diverted from the volume control tank to the refueling water storage tank. The valves isolating the boron injection tank from the charging pumps and the valves isolating the boron injection tank from the injection header then automatically open. The charging pumps then force highly concentrated boric acid solution (20,000 ppm) from the boron injection tank through the header and injection line and into the cold leg of each loop. The SI pumps also start automatically but provide no flow when the RCS is at normal pressure. The passive Injection System and the Low Head System also provide I no flow at normal RCS pressura. A SI System signal normally results in a reactor trip followed by a turbine trip. However, it cannot be assumed that any single fault that actuates the SI System will also produce a reactor trip. If a reactor trip is generated by the spurious SI System signal, the operator should determine if the spurious signal was transient or steady state in nature. The operator must also determine if the SI signal should be blocked. For a spurious occurrence, the operator would stop the SI and maintain the plant in the hot shutdown condition. If the ECCS actuation instrumentation must be repaired, future plant operation will be in accordance with the Technical Specifications. If the RPS does not produce an immediate trip as a result of the spurious SI signal, the reactor experiences a negative reactivity excursion due to the injected boron, causing a decrease in reactor power. The power mismatch causes a drop in T, and consequent coolant shrinkage, pressurizer pressure and water level drop. Load will decrease due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open. If automatic rod control is used, these effects will be lessened until the rods have moved out of the core. The transient is eventually terminated by the RPS low pressure trip or by manual trip. The time to trip is affected by initial operating conditions including core burnup history, which affects initial boron concentration, rate of change of boron concentration, Doppler and moderator coefficients. Recovery from this second case is made in the same manner as described for the case where the SI signal results directly in a reactor trip. The only
differ:nco 10 ths icwer T,, cnd proscura ce ociated with the powar nicmatch during the transient. The time at which reactor trip occurs is of little , concern for this transient. At lower loads, coolant contraction will be slower, resulting in a longer time to trip. Because of the power and temperature reduction during the transient, operating conditions do not approach the core limits. Analysis of several cases has shown that the results are relatively independent of tims to trip. A typical transient is presented representing minimum reactivity feedback. Results with maximum reactivity feedback are similar except that the transient is slower. For calculational simplicity, zero injection line purge volume was assumed in this analysis, thus the boration transient begins immediately when the appropriate valves are opened. The assumptions are as follows:
- 1. Initial Operating Conditions The initial reactor power and RCS temperatures are assumed at their maximum values consistent with steady-state, full-power operation, including allowance for calibration and instrument errors.
- 2. Moderator and Doppler Coefficients of Reactivity A least negative moderator temperature coefficient was used. A low (absolute value) Doppler power coefficient was assumed.
- 3. Reactor Control The reactor was assumed to be in manual control.
- 4. Pressurizer Heaters Pressurizer heaters were assumed to be inoperable in or. der to increase the rate of pressure drop.
8
- 5. Beren Injectian At time zero, two charging pumps inject 20,000 ppm borated water into the cold leg of each loop.
- 6. Turbine Load Turbine load was assumed constant until the governor drives the throttle valve wide open, then turbine load drops as steam pressure drops.
- 7. Reactor Trio Reactor trip was initiated by low pressurizer pressure.
Figures 6.5-1 through 6.5-3 show the transient response to inadvertent cperation of ECCS during power operation. Neutron flux starts decreasing immediately due to boron injection, but steam flow does not decrease until
- later in the transient when the turbine throttle valve goes wide open. The mismatch between load and nuclear power causes T, , pressurizer water level
! cnd pressurizer pressure to drop. When the low pressure trip setpoint is reached, the reactor trips and control rods start moving into the core. DNBR increases.throughout the transient. As was the case with the previously presented accident, this transient would not cause any challenges to the SPDS safety function status trees. The ene exception is the heat sink tree with response to the plant trip. Because of steam generator level shrinkage, a low level condition will occur. 5 6.6 Larze Break LOCA Should a large break Loss-of-Coolant Accident (LOCA) occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A SI signal is generated when the cypropriate setpoint is reached. These countermeasures will limit the consequences of the accident in two ways: I i
- 1. R;cetor trip End baretsd kstsr injseticn etmplement void formttion in causing rapid reduction of power to a residual level corresponding to fission product decay heat. However, no credit is taken in the LOCA analysis for boron content of the injection water. In addition, the insertion of control rods to shut down the reactor is neglected in the large break analysis.
- 2. Ir jection of borated water provides for heat transfer from the core and prevents excessive clad temperatures.
I 6.6.1 Description of Large Break LOCA Transient Before the break occurs, the unit is in an equilibrium condition; i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals and the vessel continue to be transferred to the reactor coolant. At the beginning of the blowdown phase, the entire RCS contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. Thereafter, the core heat transfer is based on local conditions with transition boiling and forced convection to steam as the major heat transfer mechanisms. The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by rne Emergency Feedwater System. The SI signal actuates a feedwater isolation signal which isolates nornal feedwater flow by closing the main feedwater isolation valves, and also initiates emergency feedwater flow by starting the emergency feedwater pumps. The secondary flow aids in the reduction of RCS pressure. When the RCS depressurizes to 600 psia, the accumulators begin to inject borated water into the reactor coolant loops. Since the loss of off-site power is assumed, the reactor coolant pumps are assumed to trip at the inception of the accident. The effects of pump coastdown are included in the blowdown analysis.
4. Th3 blcwd:wn ph203 cf tha trcnslant ands whin ths RCS prassure i (initially assumed at 2,250 psia) falls to a value approaching that of the containment atmosphere. Prior to, or at the end of, the blowdown, the mechanisms that are responsible for the bypassing of emergency core cooling
- water injected into the RCS are calculated not to be effective. At this time (called end-by-bypass), refill of the reactor vessel lower plenum begins.
Refill is complete w'an h emergency core cooling water has filled the lower plenum of the reactor vessel which is bounded by the bottom of the fuel rods (called bottom of core recovery time). The reflood phase of the transient is defined as the time period lasting from the.end-of-refill unti-1 the reactor vessel has been filled with water to the extent that the core temperature rise has been terminated. From the later stage of blowdown, and then the beginning-of-reflood, the SI accumulator tanks rapidly discharge borated cooling water into the RCS, i contributing to the filling of the reactor vessel downcomer. The downcomer water elevation head provides the driving force required for the reflooding of
.the reactor core. The low head and high head SI pumps aid in the filling of the downcomer and, subsequently, supply water to maintain a full downcomer and complete the reflooding process.
Continued operation of the ECCS pumps supplies water during long-term cooling. Core temperatures have been reduced to long-term, steady-state i levels associated with dissipation of residual heat generation. After the water level of the refueling water storage tank reaches a minimum allowable
- = value, coolant for long-term cooling of the core is obtained by switching to
- the cold recirculation phase of operation in which spilled borated water is drawn from the engineered safety features containment sumps by the low head SI (residual heat removal) pumps and returned to the RCS cold legs. The Containment Spray System continues to operate to further reduce containment pressure. Approximately 24 hours after initiation of the LOCA, the ECCS is i realigned to supply water to the RCS hot legs in order to control the boric acid concentration in the reactor vessel.
4 Based on the results of the LOCA sensitivity studies, the limiting
- large break was found to be the Double-Ended Cold Leg Guillotine (DECLG). The 4
a 4
~ __ _ _ . . ._. - _ __ _
- maximum cicd temptr tura calculatsd for a largs brock it 1,965 F, which is less than the acceptance criteria limit of 2,200 F. The maximum local metal-water reaction is 3.17%, which is well below the embrittlement limit of 17%, as required by 10CFR50.46. The total core metal-water reaction is less than 0.3% for all breaks, as compared with the 1% criterion of 10CFR50.46, and the clad temperature transient is terminated at a time when the core geometry
. is still amenable to coolin.3 As a result, the core temperature will continue to drop and the ability to remove decay heat generated in the fuel for an extended period of time will be provided.
Figures 6.6-1 through 6.6-5 present the parameters of principal interest for the large break LOCA analysis. Figure 6.6-6 is present to associate centainment conditions with the present break. The first five ; figures show a cold leg break. Figure 6 shows the containment pressure after i- an intermediate leg break. Although the break sizes are the same, the pressure buildup from the intermediate leg break is higher because of the additional energy supplied to the leaking liquid by the steam generator. This substitution does not change the conclusion of the scenario and does add a more complete illustration of the events. The SPDS status trees' response to this accident are as follows: SPDS (S) Suberiticality Green or Yellow (C) Core Cooling Red (H) Heat Sink Yellow (P) Integrity Green l- (2) Containment Orange (I) Inventory Yellow l Following the blowdown phase of the LOCA, the reactor will be shut down with or without the control rods due to the absence of the acderator. During ( the reflood phase, the SI System will inject borated water. This borated water will maintain the reactor core in a shutdown condition. However, with l l the addition of the moderator, there may be a period of an increase in the i - cuberitical multiplication factor which could appear as an increase or a I I
- -- - , .- - . ~ , , .m . - ._ _ . _m,_..___m .-.%,.
, _ _ . - - ~ . _ , , - -,m - . . , - , , _ --_m, .-- ..,.
pacitivo attrtup rats. Wh:n vicwed by tha niutren datactors, this will bn interpreted as a yellow condition by the suberiticality tree. Core cooling will be the tree that has the greatest challenge. It will be in a red condition shortly after the break. This red condition is brought on by core exit thermocouples indicating greater than 1,200 F. The operator would be directed to ensure the ECCS was running at maximum operability and to
~
manually initiate or assist any portion of that system which had not started automatically. The major objective of the procedures is to make all attempts to add to RCS inventory. This would facilitate a heat transfer medium to cool the core. This procedure would maintain attention until either the condition was de-escalated or a more severe challenge appeared in the suberiticality tree. Heat sink would be in a yellow condition because of steam generators low levels and high pressures. Integrity status would not be challenged by cooldown and, therefore, would remain green. Containnant would show orange because of the pressurization occurring. When the operator stabilized the challenge to core cooling, this would be the next tree that needed response. The inventory tree would indicate yellow because of loss of inventory.
-100-
.25 g j i j j i 5u. 0.20 -
303 - 2 $ $ 0.15 e-2 -
$ $ oz 0.10 ae -
5 0.05 - 0 0.25 X - 3g 0.20 w F$a
<.2
< 0.15 -
wr3 -
- $ a 0.10 W e2 -
oE u 0.05 - 0 2500
, 2250 c 2000 m
g g 1750 -
$ G 1500 -
[ 1250 - g 1000 - 750 - 500 e 800 N 700 -
> 600 -
$"E e 500
$ $ 400
$ 3 300
$ $ 200 -
c 100 - I i l l I l l O . 0 25 50 75 100 125 150 175 200 TIME (SECONDS) 1.4 FT2 STEAM LINE RUPTURE. 1 SEABROOK STATION - UNITS 1 & 2 OFFSITE POWER AVAILABLE ' l FIGURE 6.1-1
-Avi- 1 l
O I 600 a E' I l l l l l l l y C 550 gl y 500 , INTACT LOOPS w 3 450 O _. N 400 , o w i FAULTED LOOP
< g 350 -
C
- 300 -
250 600 w o[ 550
$wx 500 -
e - g 3 450
<j 400 -
$ E 350 -
o2 uw 300 - 250 2000 N 1000 - Eb 0 WS
* -1000 2000 i'
500
~
2 g 400 - 2 300 - m g 200 -
$ 100 -
0
~
O 25 50 75 100 125 150 175 200 TIME (SECONDS) 1.4 FT2 STEAM LINE RUPTURE, SEABROOK STATION - UNITS 1 & 2 OFFSITE POWER AVAILABLE l FIGURE 6.1-2
-102-
l 1.0 g j j j l l . l 2 o 0.8 - x-a w G <z 0.6 - 3E Q<h C~ - w>2 w 0.4
* $a0u. 0.2 -
w 0 3.5 w2 3.0 p 30 3z< 2 u- O E 2.0 INTACT LOOPS 2hO 1 .5 - FAULTED LOOP h 1.0 -
' O.5 -
0 . 1000
$ 800 INTACT LOOPS 3
E w E 600 - E Di 2 S 400
< FAULTED LOOP W
200 - m 0 1.2 u, 1.0 30 0.8 o'z3 "o<p p 0.6 -
- 2 o 0.4 -
U u. 0.2 - l l l l I I I O O 25 50 75 100 125 150 175 200 TIME (SECONDS) 1.4 FT 2 STEAM LINE RUPTURE. SEABROOK STATION - UNITS 1 & 2 OFFSITE POWER AVAILABLE l FIGURE 6.1-3
-103-
2600 g j l
} } { l l 2500 - -
_E 2400 m m 3 2300 - E w
$ 2200 --
c e . S 2100 -- m y 2000 -- f 1900 - 1800 2000 , E w 1750 - lE D - _J o e 1500 - N E
$ 1250 -
e m 3
.E 1000 m
800 O 500 1000 1500 2000 2500 3000 3500 4000 4500 TIME (SECONDS) ) . PRESSURIZER PRESSURE AND WATER VOLUME TRANSIENTS SEABROOK STATION - UNITS 1 & 2 FOR LOSS OF FEEDWATER l FIGURE 6.2-1
-104-
TIME (SECONDS) 0 500 1000 1500 2000 2500 3000 3%0 4W M i l l l l I I 625 - c'_ E-a s00 -
$ 575 N
O
$ 550 -
s< 525 - 8 500 2200 2000 -
' n{
E 5 3 -
$ 1500 5
2 m g 1000 - E 5 5 o 500 3 5 0 I ' 0 O 500 1000 1500 2000 2500 3000 3500 4000 4500 TIME (SECONDS) CORE AVERAGE TEMPERATURE TRANSIENT AND STEAM GENERATOR WATER VOLUMETRANSIENT SEABROOK STATION - UNITS 1 & 2 FOR LOSS OF FEEDWATER l FIGURE 6.2-2
-105-
9 1.2 3 E 2 1.0 O Z u. O
. Z 0.8 -
9 - C m
- u. 0.6 -
3 S e g 0.4 - a w
$ 0.2 -
t 5 0 0 2 4 6 8 10 TIME (SECONDS) CORE FLOW COASTDOWN FOR FOUR LOOPS IN OPERATION, SEABROOK STATION - UNITS 1 & 2 FOUR PUMPS COASTING DOWN l FIGURE 6. 3-1
-106-
1.2 ~ l l l l a
$ 1.0 -
5 O z O 0.8 - l z O U ' { 0.6 5 e w c. 0.4 -
=
~
o 0.2 - D 2 0 2400 2 vi S. w 2300 c D E w E 2200 - e E 3 2100 - S E 2000 0 2 4 6 8 10 TIME (SECONDS) 1 . FOUR LOOPS IN OPERATION, , SEABROOK STAT)ON - UNITS 1 & 2 FOUR PUMPS COASTING DOWN l FIGURE 6.3-2 )
-107- ,
)
_ e._ -. 9 1.2 l l \ \ X D _J E3
> < 1.0 - <Z =
JZ w zzO' O.8 - 5z G9
=G c < 0.6 -
< c:
wb 0.4 1.2 X Da d $ 1.0 -
*i 4 0
$2m d0 0.8 -
2 2 2o IE Go p $ 0.6 - ou
=..
l 0.4 0 2 4 6 8 10 TIME (SECONDS) i O FOUR LOOPS IN OPERATION. SEABROOK STATION - UNITS 1 & 2 FOUR PUMPS COASTING DOWN
. l FIGURE 6'. 3-3
-108-
~
1 f 2.4 2.2 - 2 2.0 - e 4
$ 1.8 -
C 1.6 - 1.4 - 1.2 o 2 4 6 8 10 TIME (SECONDS) DNBR VERSUS TIME FOR FOUR LOOPS IN OPERATION, SEABROOK STATION - UNITS 1 & 2 FOUR PUMPS COASTING DOWN l FIGURE 6.3-4 I
-109-
1.40 1.25 - d 1.00 2 55 30 2[ EO 0.75 - s $zo , 8y 0.50 - Z< e E 0.25 - O.00
'r 0.0 2.5 5.0 7.5
, TIME (SECONDS) 1.2 1.0 -
.a x2 p- 0.8 -
d=
$$ 0.6 -
==
uJ O
$h 0.4 -
u< ' E
~
0.2 - 0.0 0 1 2 3 4 5 6 1 TIME (SECONDS) 8 UNCONTROLLED RCCA BANK WITHDRAWAL I - - - FROM FULL POWER WITH MINIMUM REACTIVITY SEABROOK STATION - UNITS 1 & 2 FEEDBACK (80 PCM/SEC. INSERTION RATE) l FIGURE 6 4-1
-110-
{ 2400 j I i i l l. R vi w j2300 - m E G. 5 N 2 2200 - S U f. I 2100 1400-
~
n E g1300 - 2 3 0 1200 - x " w g1100 t x y1000 - x 5 g 900 - f I l l l l l 800 0 1 2 3 4 5 6 7 TIME (SECONDS) UNCONTROLLED RCCA BANK WITHORAWAL FROM FULL POWER WITH MINIMUM REACTIVITY SEABROOK STATION - UNITS 1 & 2 FEEDBACK (80 PCM/SEC. INSERTION RATE) l FIGURE 6.4.-2
-111-
c n [m 610 g g, g j g j D E.600 t
# 590 -
w ' g- l
\
E w 580 -
$ 570 -
e 3 m 560 , x 8 3.00 2.75 - 2.50 - 2.25 - , x g 2.00 - Q 1.75 - 1.50 - 1.25 - l I I I- I I g 0.0 1.0 2.0 3.0 4.0 5.0 6.0 7.0 TIME (SECONDS) UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY SEABROOK STATION - UNITS 1 & 2 FEEDBACK (80 PCM/SEC. INSERTION RATE) l FIGURE 6.4-3
-112-
e 1.25 j j j g g 3 1.00 - mz
*5
- n. @ 0.75 g u. .
<0 .
W2 d0 or 0.50 z$e E 0.25 - 0.00 1.2 _ 1.0 _ J . XE 3g 0.8 -
"- z H u.
$0
=2 0.6 -
w9 ms Oy 0.4 - E 0.2 - 0.0 0 3 10 15 20 25 30 35 TIME (SECONDS) UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER SEABROOK STATION - UNITS 1 & 2 WITH MINIMUM REACTIVITY FEEDBACK (3 PCM/SEC INSERTION RATE) l FIRURE 6.4-4
-111-
w ._ 2s00 g ; j
; l 2500 -
E { 2400 w
@ 2300 E .
$ 2200 -
m
$ 2100 -
m D
$ 2000 -
E 1900 - 1800 1400 n~ 1300
.C W
1200 - b \ w i O 1100 - m
$ 1000 -
3 E 900 - e
$ 800 -
w
- E 700 -
, I I I I I I 800 1 0 5 10 15 20 25 30 35 i TIME (SECONDS) t i
~
UNCONTROLLED RC'CA BANK WITHDRAWAL FROM FULL POWER SEABROOK STATION - UNITS 1 & 2 WITH MINIMUM REACTIVITY FEEDBACK ! (3 PCM/SEC INSERTION RATE) l FIGURE 6.4-5
-114-
6 620 - l l l l l l 610 - w m p 600 - m y 590 - 2 w- [C [ 580 m 570 - w 560 - m O 550 - 540 3.00 2.75 - 2.50 - 2.25 - e
$ 2.00 -
c 1.75 - 1.50 - 1.25 - i ! ! ! 1.00 O 5 10 15 20 25 30 35 TIME (SECONDS) UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER l WITH MINIMUM REACTIVITY FEEDBACK SEABROOK STATION - UNITS 1 & 2 (3 PCM/SEC INSERTION RATE) ; l FIGURE 6.4-6 l
-115-
o 4 I . I 1 l 6 3 51.0 j-g . 2
$ 0.8 5 -
o g 0.s t E g0.4 - i w d o 0.2 - N 0.0 - soo
! C o,
E 50 - E 5 3-560 - E 5 8 u 540 - E a s< s20 - E 8 ! ! I I l 500 0 50 100 150 200 250 300 TIME (SEC) INADVERTENT ACTUATION OF ECCS SEABROOK STATION - UNITS 1 & 2 DURING POWER OPERATION l F IGURE 6 . 5.-1 l
~
** I I I I I g 2300 -
E
=
= 220o 2
E
$ 2100 E
D N g 2000 - 1soo - I I ! ! 3. 1750 C b 9 - g 1500 E 8 1250 - 5 7 licoo - E 8 750 - I ! ! I g o So 10o 150 2co 250 300 TIME (SEC) I l
)
INADVERTENT ACTUATION OF ECCS 1 SEABROOK STATION - UNITS 1 & 2 DURING POWER OPERATION l l FIGURE 6.5e 2
-117-
)
~
l l l l 1 4.5 , 4.0 h 3.5 - 3.0
~
2.5 2.0 I I ! I I 93 1.2 e v 3 1.0 - 5 i k 0.8 - 8 5 5 0.6 i h 0.4 - d I h 0.2
! ! I I !
0.0 0 50 100 150 200 250 300 TIME (SECl f INADVERTENT ACTUATION OF ECCS SEABROOK STATION - UNITS 1 & 2 DURING POWER OPERATION l FIGURE 6.5-3
-118-
m O O m O u m b m E f-m I 8 k O O u u - "
)FD( DOR TOH ERUTAREPMET EGAREVA DALC
) . d3Vt> 07VO 13Wd3UV1 nub - 0307D )00 :0'9( l 319083 9*9- I
-IT6-i
o E O S E O z O d a w E l l l l C a N a N a a a (VISd) 3HnSS3Wd t SEABROOK STATION - UNITS 1 & 2 l FIGURE 6.6-:
-120-
m e S
\
! E C
z 8 _m w E. r m k w 2 0 z E w 8 8 U __ g I l ! l l l l e
*. 9 c. 9 e e e e e 2 C $ Q $ N s N c' (id) 13A37 W31VM V
DOWNCOMER AND CORE WATER LEVELS O ING REFLOOD - DECLG (C D:0.6) SEABROOK STATION - UNITS 1 & 2 l FIGURE 6.6-3;
-121-
m
-S
- o m
O z O d a w 3 R
! i O
O
- 9 W v N e
' o 6 6 6 6 (Od/dl W3 mod i -
SEABROOK STATION - UNITS 1 & 2 CORE POWER TRANSIENT - DECLG (CO=0.6) l FIGURE 6.6-4
-122-
g: _. N b 8
)
~
6 ) w L N b G C 2 O d e w E _ g-S { 11 " W
! l l l l l
^
c k Ido) 3801V83dW310ln13 I FLUlO TEMPERATURE SEABROOK STATION - UNITS 1 & 2 DO l FIGURE 6.6-5
-123-
- e _
s 0 1
)
89 88 87 i6 i5 Y i4 R i3 _ O _ T i2 S 4 I 0 1 - H j i9 v8 s7 E i6 R i5 U . a4 S i3 S i2 E ) R C 3 E P . 0 S 1 g ( a9 E v8 T s7 M I i6 T N i5 E 4 M i3 N - I s2 A T '0 N 1 [ i9 O
/
u8 s7 C i6 5 i4 3 i2 . 0 1 T_ .
-} - :: ~ ' .
oo4 9S QS oon odN 99 O -Q E3mm%A OOZs2gmzd T mMgCmm n 3m" 0z(m A u T OEOSpo 0 m om TCh (cod A :- 0z 0c;rOdzm
)4
>4_CZ ) hz y(1 " > A 1 >
j EcE MF m<< ZN 0t5z-(23OO A 6
. - 3oc3m o 7 L z~8
7.0 VALIDATION OF SPDS WITH EMERGENCY RESPONSE PROCEDURES In October 1983, Seabrook Station hosted and participated in the Westinghouse Owners Group Emergency Response. Guidelines Validation Program. The actual validation was performed using preconverted plant-specific procedures. The reason for using the plant-specific procedures was twofold:
- 1. The guidelines are strictly generic; i.e., they contain no setpoints. They must be supplied by each utility using their own safety analysis for correct setpoints. .
- 2. The guidelines were written with a model plant as a reference.
Although Seabrook did not vary drastically from the model, it was not a 100% reproduction. The critical safety function status trees are a product of the WOG ERGS but they are strictly manual in nature; i.e., operators use the trees and check MCB indication for answers to the logics. Seabrook Station had a computerized system to perform this function and used it during the validation testing. The computerized system was used for three of the five days of testing and the manual system was implemented for the other two days. Based on these five days of testing, the computerized system was far superior. Along with Seabrook Station's supporting graphic system, the operators were able to confirm their indications of problems more rapidly and also maintain an observance of systems not directly related to the presented casualty. To preserve a record of plant behavior during each test scenario, a special software routine was written by Seabrook personnel to save a con.prehensive list of process parameters and equipment status at 5-second intervals during each test run. The parameters were obtained from the simulator data " pool" and copied to available storage space on a 300 megabyte disc. Following each test scenario, the same data was copied (off-line) to a magnetic tape. Data for each transient scenario was kept on a separate tape. Following the tests, the tapes were read into a Data General MV/8000 computer and a reduced set of data was stored in separate files. These files
-125-
I were subscqu:ntly ur:d to gen:rsta pista cnd to drivs dynamic dicplays to re-create the plant behavior for evaluation. The figures used in this section are copies of these computer-generated l plots. Accompanying the plots will be a sequence-of-events table. This table ' is derived from a review of the video tapes that were also taken during the validation program. The video tape has a time clock superimposed and starts at time zero from whenever the malfunction scenario starts. Since the data and the video tapes are not synchronized, there may be some minor discrepancies between the table and plot time scale. The particular scenarios presented below represent a spectrum of Emergency Response Procedure (ERP) usage, so serve to also demonstrate the technical consistency of the entire ERP network. An integral portion of that network is the SPDS critical safety function status trees. (Reference to Appendix B may be necessary for procedure identification.) NOTE: It should be noted that plotted parameters shown below are results of activities produced by simulator physics models and altered by manual action in response to the accident scenarios. The plotted parameters presented in Section 6 were reproduced from computer models that take multiple list conservative values and no manual action. To this conclusion, the comparison should not cause confusion when observing Section 7. 7.1 Steam Line Break Accident This event involved the failure of a single steam generator safety valve with the plant at no-load conditions at End-of-Life (EOL). The reactor was manually tripped in response to the observed uncontrolled cooldown (supervisor decision). The ERPs were correctly entered at E-0, reactor trip or SI procedure, and when it was determined that SI had not actuated, the correct transition was made to ES-0.1, Reactor Trip Response Procedure. Main steam line isolation valves were closed by procedure to attempt to stop the continuing RCS cooldown. Pressurizer level and pressure decreased because of the shrink associated with the cooldown. Charging was increased to maintain pressurizer level, and feed flow to Steam Generator "A" was increased to
-126-
maintain lOv31. Lev 01 and pr:0 cura b;h;vice cf Gen:rster A 1 d to dirgn sis of the secondary break. SI was actuated on low steam line pressure in Steam Generator A. Operator action was again directed by E-0; however, the requirement to verify Emergency Feedwater (EFW) to all generators was violated; feed was deliberately isolated to Steam Generator A based on the prior diagnosis. Actual diagnosis was correctly performed in E-0, the correct transition to E-2, faulted steam generator isolation procedure was made and Steam Generator A was completely isolated. Steaming from Steam Generator A continued to decrease as temperatures, pressures and level decreased. Following isolation, a correct transition was made to E-1, loss of reactor or secondary coolant procedure, where SI termination criteria were found to be satisfied. A further transition was made to ES-1.1., SI injection termination flow, to actually terminate SI. The scenario was terminated at this time with SI being terminated and the faulted generator almost completely dry. Pressurizer pressure and level had recovered somewhat due to SI flow. The RCS cooldown would be terminated shortly and heatup due to decay heat would follow. Maintenance of RCS pressure and pressurizer level would be adequately controlled using normal control functions. Level in the intact steam generators is sufficient to provide good RCS temperature control. The intent of the EOPs was correctly implemented in response to this event and the plant ended up in a stable condition, ready for a subsequent, controlled cooldown. Table 7.1 lists the sequence of events for this scenario, and Figures 7.1, 7.2, 7.3 and 7.4 show several elements of plant behavior during the transients. 7.2 Inadequate core Cooling This scenario was initiated at EOL conditions, shortly following a trip from extended full-power operations. Thus, decay heat was at a maximum level
-127-
when the LOCA cccurr:d. Pres;uriz r pr:ssura cnd 1 val wera cb Orv:d to be rapidly decreasing, prompting manual actuation of SI. However, all charging /SI pumps and high-head SI pumps had been placed out-of-service, so the only indication of actuation were the Phase A isolation, low-head SI pumps [ Residual Heat Removal (RHR)] start and SI actuation annunciators' light. Procedure usage began with E-0, and the event was correctly diagnosed as a LOCA with the associated transition to E-1. RCS pressure stabilized at approximately saturation pressure in the steam generators. RCS inventory decreased steadily as shown by decreasing pressurizer level a'd n then decreasing RVLIS, Shortly af ter the loss of subcooling, all four reactor coolant pumps tripped off due to " unexplained cauces," Loss of forced flow caused natural circulation conditions to develop, marked by a significant increase in hot les temperature. A brief transition was made to FR-C.2, Response to Degraded Core Cooling Procedure, because of the low reactor vessel level, but subsequent checks in the procedure returned the crew to E-1. The slow increase in containment pressure up to this time prompted a request for a containment hydrogen evaluation. Actions in E-1 had progressed sufficiently to cause the operators to transition to ES-1.2, Post-LOCA Cooldown and Depressurization Procedure. The cooldowns in this procedure were inadvertently missed because of concern over decreasing reactor vessel level. As level dropped to an indicated 40%, a transition was made to FR-C.2 where a cooldown was correctly initiated. This cooldown produced prompt decreases in RCS hot leg temperature and pressure. Because the hot leg was fully voided at this time and the loop seal (pump suction) had cleared, the heat transfer was from steam in the RCS to saturated liquid on the secondary side. The RCS pressure reduction associated with steam condensation soon brought on accumulator injection which further cooled and flooded the vessel. The additional pressure reduction associated with this cooling caused RHR pumps to inject, thus re-establishing system inventory.
-128-
The secntric was tcrainnt;d ch rtly cfter estchlishing RNR flow Dinco the inadequate core cooling condition had been eliminated. It had been thought that a controlled cooldown in ES-1.2 would have been sufficient to
- sufficiently depressurize the RCS and bring on accumulator injection without recourse to the FR procedures. Normally, an extended period of time is required for ICC conditions to develop; however, an increased leak rate was used in this scenario to accelerate the rate of inventory loss.
This scenario demonstrated that (for a smaller leak rate) normal recovery procedures would be adequate to restore cooling, and that the status trees would provide adequate symptoms to allow function restoration befets Acc conditions develop. Table 7.2 lists the sequence of events for this scenario, and Figures 7.5, 7.6, 7.7 and 7.8 show that behavior during the transient. 7.3 Loss of All Feedwater This event was initiated by a trip of both main feedwater pumps at full power.' Startup feedwater and both EFW pumps were inoperative. The operators correctly went to E-0 on the resulting reactor trip but no SI had as yet actuated. Because of the low pressurizer pressure at the time, SI was manually actuated based on supervisor judgment. Lack of EFW was identified in response to an E-0 procedure step, and the correct transition was made to FR-H.1, Response to Loss of Heat Sink Procedure. Because wide-range level in all steam generators was already below the setpoint chosen to indicate loss of secondary heat sink, the operators were directed to immediately initiate " bleed and feed" cooling of the RCS. ' All RCPs were tripped and both pressurizer PORVs were opened to provide the coolant vent path. Since SI had already actuated..the " feed" action was already complete. RCS temperatures responded initially to the RCP trip, and then to the cold injection water entering the system. EFW capability was restored s~iortly afterward; however, the procedure required continuation of this mode un.11 steam generator level was restored to the normal range.
-129-
The combination of continued SI flow into the RCS and addition of major quantities of cold EFW to the steam generators produced a severe RCS cooldown. In addition, the flow through the pressurizer PORVs soon overpressurized the Pressurizer Relief Tank (PRT) and tagan to produce a steady pressure increase in containment. In spite of these other disturbing conditions, the operators correctly remained in FR-H.1 and proceeded to terminate the " bleed and feed" cooling mode. Once this process was complete, they correctly transitioned to FR-P.1, Response to Imminent Pressurized Thermal Shock Procedure, to address the excessive cooldown, which was their next highest priority safety challenge. Here, both pressure and temperature were controlled to preclude any additional therumi stresses on the vessel and to allow the existing stresses to " soak" out. The scenario was terminated with all plant systems under control of the operators. Table 7.3 lists the sequence of events for this scenario, and Figures 7.9, 7.10 and 7.11 show plant behavior during this transient. 7.4 Anticipated Transient Without Scram (ATWS) This event was initiated from full power by the sequential trip of both main feedwater pumps. Reactor trip breakers did not open in response to a manual trip attempt. The operators correctly transitioned from E-0 to FR-S.1, Response to Nuclear Power Generation /ATWS, began to manually insert the control rods and to emergency borate. NOTE: As can be observed by the plots, reactor power decreased significantly faster than temperature, and on the shrink due to the subsequent cooldown, RCS pressure decreased rapidly enough to actuate an SI signal. (Improper rate component on SI setpoint simulator problem.) After satisfying the suberiticality criterion in FR-S.1, the operators correctly returned to E-0, diagnosed the SI as spurious, and correctly [
-130-
l tr:nsitien2d to ES-1.1 for SI tcrainstien. All cetions in this pecesdura wera l correctly performed, and the scenario was terminated with the plant stable at l no-load conditions. Table 7.4 lists the sequence of events for this scenario, and Figures 7.12, 7.13, 7.14 and 7.15 show plant behavior during this transient. 7.5 Steam Generator Tube Ruoture (SGTR) This event was initiated from full-power. conditions *at EOL. The tube , rupture corresponded in size to the double-ended shear of a single tube; i.e., the design basis. Because of the magnitudes of steam flow and feed flow, narrow-range level in the ruptured generator was not noticeably affected. The first indications in the Control Room were decreasing pressurizer level and radiation in the ruptured generator. The reactor was manually tripped because of decreasing RCS pressure and the operators correctly entered and performed E-0. The event was correctly diagnosed as a tube rupture and the correct transition was made to E-3, Steam Generator Tube Rupture Procedure. The ruptured generator was correctly identified by procedure, but then the isolation was inadvertently omitted. A few steps later, a procedural
~
" Note" informed the operators that "... isolation must be complete before proceeding...". This " Note" caused the crew to go back and complete the isolation. Subsequently, the RCS was cooled down, using the intact steam generators, and then depressurized using normal pressurizer spray. Pressure decreased during the cooldown due to shrink of coolant volume, and rapidly increased when the cooldown stopped due to continued SI flow. Following the depressurization, Which was terminated because of high pressurizer level, pressure also increased rapidly. Pressure finally decreased to equilibrium with the ruptured generator after the SI pumps were stopped. Normal charging and excess letdown were established to control primary inventory. (Normal letdown could not be immediately established due to a faulty reset switch.) The crew made a proper transition to Procedure ES-3.1, Post-SGTR Cooldown Using Backfill, and initiated actions for a normal
-131-
esoldown/depr:ssurizaticn using tha backfill methad. Ths gesnario was terminated after the cooldown process was well established. At that time, all major plant functions were demonstrated to be well under operator control. Table 7.5 lists the sequence of events for this scenario, and Figures 7.16, 7.17 and 7.18 show plant behavior during the transient. 7.6 Nultiple Events This event was initiated from a just-critical condition during a plant ctartup at EOL. The initial failure was a secondary break inside containment which caused a rapid steam pressure drop and containment pressure increase. The operators correctly entered E-0 on the reactor trip /SI, and then correctly transitioned to E-2 after diagnosing the secondary break. The faulted generator was correctly isolated and a subsequent transition was made to FR-2.1, Response to High Containment Pressure Procedure, to address the high pressure in containment; then after response to FR-Z-1, a correct transition was made to ES-1.2, Post-LOCA Cooldown and Depressurization Procedure. At this point, a level increase was noted in the faulted, isolated steam generator, and a transition was made to E-3 based on the E-1 foldout page cymptoms. Once in E-3, the reduced pressure in the ruptured generator caused (nother transition to ECA-3.1, SGTR With Loss of Reactor Coolant Subcooled Recovery Procedure. A second transition to FR-Z.1 was made at this time, again because of cn ORANGE status tree condition (high containment pressure). Af ter returning to ECA-3.1, the RCS was depressurized to restore pressurizer level. (This depressurization was attempted earlier, but there appeared to be an unexpected closure of the PORV, perhaps due to the LTOP System.) Conditions were restored for terminating SI and one charging /SI pump was stopped before a RED condition on the integrity status tree forced a transition to FR-P.l. Very quickly, SI pumps were stopped, accumulators isolated, and the RCS cooldown stopped. A large pressure drop followed the ECCS pump trips, resulting in come accumulator injection before they were isolated. Apparently, accumulator injection is coupled to a separate routine in the simulator sof tware, cxpecting RCS pressure to decrease to zero. The transient was terminated when RCS pressure unexpectedly dropped to zero.
-132-
Up until th3 time of tsemin2 tion, cpsester cetion hid followId EOP guidance to always move the plant to a safer condition. Both the initial secondary break and subsequent tube rupture were correctly diagnosed, and appropriate procedural actions taken and transitions made. The situation of a tube rupture in a faulted generator results in an uncontrolled cooldown of the RCS. The operators were in the correct recovery procedure for this combination of failures. The transition to FR-P.1 introduced steps to rapidly stabilize RCS pressure and temperature. Again, this was the best place to be under the existing conditions. Table 7.6 lists the sequence of events for this scenario, and Figures 7.19, 7.20 and 7.21 show plant behavior during the transient. l
-133-
)
TABLE 7.1 Sequence of Events Secondary Break Outside Containment Ilme_ Event (Min) (Sec) EOL, Startup 2:11 132 Pressurizer (PRZR) level decreasing 3:06 186 RCS temperatures noted down 3:25 205 Reactor tripped, 550 F 3:40 220 No (SI) 4:12 252 Go to ES-0.1 4:59 299 T,y = 544 F 5:35 335 Closing Main Steam Isolation Valves (MSIVs) 6:15 375 - T,y = 540 F, decreasing 8:00 480 Pressurizer level, RCS temperature decreasing 9:05 545 T,y = 520 F, decreasing SG A level problem 10:18 618 RCS pressure 2,150 psig 10:53 653 A level at 65% WR, RCS pressure decreasing 11:30 690 Using rediagnosis procedure 12:08 728 Closing blowdown on SG A 13:32 812 Charging suction switches to RWST (low VCT level) 13:35 815 SI actuated, go to E-0 15:02 902 RCS pressure, 2,050 psig, EFW NOT restored to SG A 16:20 980 Go to E-2, diagnosed faulted SG 17:00 1020 Isolating SG A 18:13 1093 Pressurizer level recovering 18:21 1101 Co to E-1 19:00 1140 Having trouble in E-1, check if SGs not faulted 20:14 1214 Go to ES-1.1, SI termination
-134-
TABLE 7.2 Sequence of Events Inadequate Core Cooling IAER Event (Min) (Sec) EOL 15 minutes post-trip 3:00 180 Shif t turnover complete 3:40 220 Charging pump, SI pump breakers observed w/o power 4:10 250 Pressurizer level decreasing 4:45 285 20% Pressurizer level 5:03 303 Initiate SI (annunciator on) E-0 5:45 345 Only RHR pumps or ECCS pumps running 7:00 420 RCPs not tripped (no SI pumps) 8:20 500 T,y 555 F 9:10 550 Diagnostics 9:25 565 Go to E-1, containment radiation 10:28 628 Subcooling 1 F 10:46 646 Yellow path on core cooling 11:30 690 RCS pressure stable 1,150 psis, RHR pumps not tripped 12:05 725 SI reset (in order to place D/G in standby) 13:40 820 RCPs trip A, B, C 13:56 836 RCP D trips 14:05 845 FR-C.2 15:14 914 RCS pressure 1,200 pais 16:09 969 RVLIS full-range 65% Return to procedure / step in effect 17:25 1045 Containment pressure 4 psig
-135-
TABLE 7.2 (Continued) Time Event (Hin) (See) 18:00 1080 Yellow on containment 18:37 1117 Containment hydrogen evaluation requested 18:50 1130 SG PORVs lift 19:07 1147 Go to ES-1.2 post-LOCA 19:17 1157 RCS temperature and pressure increasing 20:21 1221 Doing FR-Z.1 (orange path) 5 psig 24:25 1465 Going to ES-1.2 26:04 1564 Initiate cooldown step (not perforwed) 26:50 1610 THot = 580 F 28:00 1680 HVLIS 50% wide range 29:31 1771 RVLIS 40% FR-C.2 31:00 1860 Checking Accumulators 32:00 1920 Opening ASDVs (going for 150 psig) 33:25 2005 8% RVLIS, T * #*** "I Hot 34:28 2068 Accumtlator tanks dumping 34:40 2080 RHR flow, RCS pressure at zero 34:53 2093 Vessel filling 35:00 2100 count rate doubles 35:45 2145 [Go to FR-5.1 on orange] 36:20 2180 T = 580 Hot 37:40 2260 RHR flows: 3,400 spm/3,200 spm 38:11 2291 Using "Redlagnosis" procedure since core reflooded 39:00 2340 Source range counts back down
-136-
TABLE 7.3 Sequence of Events Loss of All Feedwater Time Event (Min) (Sec) . 3:00 180 Star'up t Feed Pump (SUFP) trip signal 3:18 198 Main Feedwater (NFW) pump trip 3:38 218 Reactor trip, go to E-0 3:58 238 No S1 4:48 288 Manual SI (low pressurizer pressure) 5:05 305 Report no EFW flow 6:53 413 Go to FR-H.1 WR level below 30% in SGs 8:10 490 Tripping RCPs, initiate S1 9:11 551 Opening Pressurizer PORVs I 11:05 665 EFW restored (WR = 30%) 12:35 755 At accumulator injection point 16:33 993 Hi-2 containment pressure 20:08 1208 Containment pressure 7 psig 21:20 1280 Pressurizer high level 21:40 1300 10 psig in containment Realized adverse containment 23:30 1410 291 F on core exit TCs 29:22 1762 15 psis in containment 31:19 1939 RCS hot legs 250 F 32:25 1945 Containment spray actuates at 18 psig 35:34 2134 65% SG WR level 36:25 2185 Stop B charging pump 37:36 2256 Stop A SI pump
-137-
e TABLE 7.3 (Continued) l Time Event (Hin) (Sec) 38:10 2290 "P" RED path, remain in FR-H.1 40:00 2400 RCS pressure stabilizes 900 psig 40:30 2430 Stop B SI pump 41:30 2490 RCS pressure stable 700 psig 42:11 2531 totablish normal chargir.g 43:20 2600 close PORVs Go to ES-1.1 (S1 term, Step 11) 44:20 2660 Go to FR-P.1 45:12 2712 240 F 45:30 2730 PORVs should be open Low Temperature Overpressure
, Protection (LTOP)
(wore in CLOSE vs. AUT0) 48:20 2900 Isolate accumulators 50:00 3000 PORVs opened (cycling on LTOP) 50:33 3200 PORVs back to AUTO 53:20 3200 Establish letdown 55:20 3320 Suction to volume control Tank (VCT)
-138-
TABLE 7.4 Sequence of Events ATWS From Full Power Ilme Event (Min) (Sec) 2:47 167 MFW Pump B 2:55 175 NFW Pump B 3:01 181 Reactor trip attempt 3:19 199 FR-S.1 (red path) 3:40 220 Manually drive rods 4:00 240 Emergency borate (start) 5:00 300 Maximum emergency borate flow 7:20 440 T 00 F H 7:57 477 Nuclear Instrumentation (NI) power approaching 5% 8:35 515 Back to E-0, Step 2 8:59 539 SI verified to be actuated 10:28 628 Steam lines at 1,190 psi 12:09 729 570 F decreasing 12:50 770 1,850 psig 14:19 859 Checking for SI termination on spurious 15:07 907 Going to ES-1.1 SI termination 15:56 956 Control banks inserted 16:27 987 Stop B charging pump 17:10 1030 Charging established 17:36 1056 BIT isolated 17:55 1075 SI pumps stopped 18:11 1091 RHR pump stopped 20:30 1230 Letdown flow established 23:30 1410 Normal makeup alignment complete
-139-
- TABLE 7.4 (Continued) ,
11E8 Event (Rin) (Sec) 24:00 1440 Establish seal return 24:30 1470 T = 557 - avg 30,:22 1822 Go to plant procedure in effect ' SIT until stable 31:50 1910 All rods manually in/ trip breakers open 4
'b
)
t i L 3 l E f L l l t *' -140-t
,~ )
TABLE 7 5 Sequence of Events Steam Generator Tube Rupture Time Event (Min) (Sec) 2:00 120 Shift turnover 4:00 240 SGTR in SG D 5:25 325 Pressurizer level noted to be decreasing 6:30 390 Radiation alarm in D 6:50 410 Reactor manually tripped, E-0 (SI followed reactor trip) 10:20 620 Diagnostics in E-0 10:42 642 Go to E-3 12:00 720 Resetting S1 13:29 809 Note catches missed step 13:50 830 Ruptured SG being isolated 17:00 1020 Determine cooldown endpoint (496 F) 17:30 1050 Cooldown begins at maximum rate 21:53 1313 514 F 22:00 1320 SG D narrow-range level off-scale high 24:20 1460 Cooldown complete 25:00 1500 82 F subcooling 25:54 1554 Opening pressurizer spray valve 28.08 1688 Pressurizer level back on scale 32:51 1971 MSIV closure, using Atmospheric Steam Dump Valves (ASDVs) 33:55 2035 Sprays closed, pressurizer level = 80% 34:30 2070 SI pumps stopped 38:50 2330 Opening excess letdown 40:00 2400 RCS pressure = SG D pressure 47:50 2870 Stop B, C, D, RCPs
-141-
TABLE 7.5 (Continued) Time Event (Min) (Sec) 50:50 3050 Go to appropriate recovery 51:40 3100 ES-3.1 (backfill) 55:30 3330 Isolate accumulators 1:01:10 3670 Begin cooldown 1:04:00 3840 Shrink due to cooldown causes RCS pressuro decrease - backfill 1:07:00 4020 T L p 1 = 490 F hot RCS pressure limited by NPSH [ Net Positive Suction Head (NPSH) for RCPs] 1:11:28 4288 Looping back in ES-3.1 to Step 3 1:20:14 4814 Looping back in ES-3.1 to Step 3 1:24:41 5081 End of scenario
-142-
TABLE 7.6 Sequence of Events Secondary Break Plus SGTR Time Event (Min) (Sec)
-8 3:26 206 Shif t turnover,10 amps (intermediate range, below the point of adding heat via the core), EOL, startup 5:09 309 Reactor trip, enter E-0 5:26 326 SI actuation acknowledged 6:26 386 Main steam lines isolated on high pressure 6:40 400 20 psis in containment ,
7:00 420 Stopping all RCPs 7:14 434 1,600 psis in RCS 7:39 459 RCS temperature 460 F decreasing 8:21 501 Diagnose SG B as faulted to E-2 9:40 580 EFW isolated to SG B 11:02 662 Requesting samples of secondaries 11:23 683 SI reset (for sampling) 12:09 729 No radiation on steam line monitors 12:25 745 Go to E-1 14:25 865 RCS pressure decreasing below 1,500 psig 16:00 968 Radiation in containment noted 19:41 1181 Starting hydrogen recombiners Go to ES-1.2 20:05 1205 Reset SI 20:45 1245 Go to FR-Z.1 (ORANGE) 21:30 1290 Restart containment spray pumps 23:10 1390 Go to ES-1.2 ) 23:36 1416 Go to E-3 from E-1 foldout based on increase in Level SG B 24:20 1460 PORVs opening on pressurizer, 1,100 psig (cycling due to LTOP)
-143-
TABLE 7.6 (continued) Time Event (Min) (Sec) 27:00 1620 Reset SI 27:50 1670 Stopping RHR pumps, RCS pressure increasing 29:00 1740 Go to ECA-3.1 based on zero pressure in SG "B" 32:50 1970 Cooldown step, actual cooldown already greater than 100 F/hr 34:09 2049 Depressurizing RCS used on PORV 35:33 2133 Co to FR-Z.1 (ORANGE) 37:20 2240 Return to ECA-3.1 38:20 2300 Core exit thermocouples at 250 F maximum 42:55 2575 THot = 270 F 45:30 2730 RCS pressure stable at 1,050 psig 47:40 2850 Second pressurizer PORV opened (supervisory recommendation) 48:30 2910 Pressurizer level recovering 49:07 2947 Pressurizer level at 17%, PORVs closed 50:40 3040 Starting RCP C 51:02 3062 Accumulators dumping 51:26 3086 Large RCS pressure oscillations 51:55 3115 Stopping one charging /SI pump 52:11 3131 RCS pressure approximately 1,150 psig 52:50 3170 Go to FR-P.1 (RED) 55:10 3310 RCS temperature 230 F 56:40 3400 SI reset 57:27 3447 Stopping SI pumps 57:55 3475 Establishing charging 58:40 3520 T stable at 220 F Hot 59:40 3580 Accumulators isolated 1:02:00 3720 RCS pressure at zero
-144-
SEABK - W.O.G. EMERG L V 1-RCS WR P 3-SGC P. 2-SGA P 9- ACC A P, 2500. 2250. -
= I 1 t & '
1 1 Y y -7M i g 2000. U E 1750. < 1 1500. O E 1250. 1 1000. ' 2_T J J J J J J c E 750. 3%' a 500* - ' m 250. . o <
" 0.
O. 200. 400. 600. 800, 1000. 1200. 1400. 1600. TIME (SECONDS) i Figure 7.1 Secondary Breaks Outsice Containment. Pressures { 145-
SEABK - W.O.G. EMERG h V ~ 1-CL1T 3- Ci.IT 2-HLIT '9-HL3T 600. 580. 560. . g 540. Y, y - _.i 1 I 520. J m 500. d b g 480- ag h460.~ 4 4 440. 3 u 420. 400. O. 200. 400. 600. 800. 1000. 1200. 1400. 1800. TIME (SECONOSI l-Figure 7.2 Seconcary Break Outsice Containment, Temoeratures
-146-
i - SEABK - W.O.G. EMERG V4V 1-PRZR L 3-SGC WR 2-SGA WR 4-RVLiS 100. , 90.
" 3 3 m 80.
a 70. s 60. 2
, m cs 50.
'N ,
40' s cr 50
% ' \
$ 1 i '\g
~
N
=
10- - s ' O. . O. 200. 400. 600. 800. 1000. 1200. 1400. 1600. TIME (SECONOS) Figure 7.3 Secondary Briak Outside Containment, Levels
-147-
SEABK - W.O.G. EMERG VAV l-SGA STM2 2-SGC STM2 4 800. 700. ( 600, s I cv ' 5 S00. en ~ 1 a < e 400.
. 1N I N E 500.
5 e 200. b} e M 100. V * \ t C i 8.
- 0. 200. 400. 600. 800, 1000. 1200. 1400. 1600.
TIME ISECONDS) Figure /.4 Secondary 3reak Cutside Containment, Steam Flows l
-148-1
SEABK - W.0.G. EMERG h v __ 1-ACCA P 2-RCS WR P 2500. 2250. ~ , 2000. 1750. \l ! n. 1500.
= : . ' 125g, (2 L LL l
Nf
~
0 -
- 1000. ,
e 750. O 1 1 1 1 1 1 1 i e 500. 250. Jl 0.'
- 0. 400. 800. 1200. 1600. 2000. 2400.
TIME (SECONDS 1 Figure 7.5 Inacecuate Core CooHng, Pressures
-149-
SEA 8K - W.O.G. EMERG L v l-CL3T 2-HL3T 590. - 585. 1 T 580. &. Q 575. f 4 570. , 7
' I E 565.
Y f 560. I G <, T 7
; ! l r i
d 555. m ,, : ., 550. 545.
~
540. 1600. 2000. 2400.
- 0. 400. 800. 1200.
TIME ISECONDS1 Figure 7.6 Inaceouate Care Cooling. Temeeratures
-150-I
'T S EA8K - W. 0. G . ENERG W V - - -
, 1-PRZR L 2-SGC WR 100. 90.
- 80. -
7 ~4 c ' c /
-sc d
a
- 70. '
i 60. m u
- 50. '-
e
- 40. L 5
m 50. N E 20.
- 10. k t
I O.
- 0. 400. 800. 1200. 1600. 2000. 2400.
TINE (SECONOS1 Figure 7.7 Inadecuate Core Cooling, levels
-151- !
{ l 1 r
~
SEABK - W.0.G. EMERG WV . ,
. t RC LP 3 FLCu ( PERCENT )
120. 100.
%"4 4
, 80.< -
z w M 60.
, 40.
o J L on 20-c. J u 0. -" oc
-20.
O. 400. 800. 1200. 1600. 2000. 2400. TIME (SECONOS) Figure 7.8 Inadecuate Core Cooling, Flow ( -152-
SEABK-W . 0. G . EMERGV+V 1-RCS WR P 2-5GA P 3-ACCA P 2500. 2250. ;I 2000. ,
/t 1750.
E 8 1500. r ,i.
~ *
- c. 1250. I - f w 1000- c q ty.p N t '
- c. 750*
y j .I
/ N l 3'
Dl
- l
~
a 500. # ' ' ' 4
- - --] -s O
m 250. Y' t s N_ l l
' A '
0. O. 500. 1000. 1500. 2000. 25GC. 5302.. 5500. TIME (SECON051 Figure 7,9 Loss of All Feecwater, Pressures
-153-
SEABK 'd. 0.G . EMERGV+V ~ 1-CLIT 2-HL1T 3-TC H11 650. 600. N 550. t 8 , o
-- 5 0 0 . g I \
i a 450. , y s 400, \ ( \ i-
]
s
\ \
= 550. \\ h t --
8 "l' N'k d g e e ..- . . _
- 0. 500. 1000. [500. 2000. 2500 3000 3522 TIME (SECON?S)
Figure 7,10 Loss of Ali Feecwater, Temperatures (
-154-f
~
SEABK-W . 0. G . EMERGV+V 1-PRZR L 2-SGA WR 3-SGC WR 100. y 90. N -^-
- 80. ~
w 70. l A sf s i VL
~ - (
8 60. ! 4 m v f-50* g 40. h.J 4
,A f
a-e V ^ "
- 50. .- . . . . . . - . .
, [ja l
' I l e 20."
m a- 10. O. O. 500. 1000. 1500. 2000. 2500. 5000. 5500. fIME (SECONOS1 Figure 7,11 Loss cf All Feecwater, Levels
-155-1
SEABK-W.0.G.EMERGV+V 1-RCS WR P 2-5GA F5 3-ACCA P 2600. 2400. 2200. k b
- c. 2000. -
T }\ ((n LN N e-E 1800. s 1600. c.
- c. 1400.
e
- 1200.
1000. ! ' ;' '
- M '
m 800.
\ j,/
o <
- 600. ; .; 3 i
400. O. 400. 800. 1200. 1600. 2000. TIME (SECONOS1 k Figure 7.12 AT4T From Full Power, P essures
-156-l
SEABK-W.0.G.EMERGV+V 1-CL1T ~3-CL3T 2-HL1T 4-HL3T 3 650. 640. , 650. , n 620. ^
"1 I 610. u\ -
a m 600.
\
.590.
t J vh "
= 580.
J 570. 3
\
N d sGO ' i A fy. 4 :& - l 0. 400. 800. 1200. 1600. 2000. , TIME (SECONOS1 l l Figure 7.13 AT.T Fecm Full Power, Temeeratures T. L [ -157-L
SEABK-W.O.G.EMERGV+V 1-PRZR L 2-SGA WR ., 3-S.3C WR ,
- i 100.
90.
\n A /I L N &
- 80. .
s L ce 70. t
' q
- 60. l{
8 w
- S0. \
5 \ e 40.
- 50. \
g 20.
\ -p E 10 <p~ -
0. O. '400. 800. '1200. '1600. 2000. TIME iSECONOS1 I Figure 7,14 AT.T From Full Power. Lewis
-150-n= s %.
SEABK-W.0.G.EMERGV+V POWER RANGE LEVEL CHANNEL 1 (PERCENT) 120. C z 100. -
)
0
- c. 80.
d 60. E 40. d y
- 20. \# - -
S cc m w O'. O 400. N00. 1200. 1600. 2000. g TIME (SECONDS) -3 [ Figure 7.15 ATWT Frem Full Power. Power
-159-
SEABK - W.O.G . EMERG .hV 1-RCS WR P 2-3GB P 3-SGD P 2400. - 2200. A 2000.
\
- a. .
@ 1800.
m
- n. 1 G00. ' (-
E m 1400.<. A
- 1 \!l e 1200.-
1 ), x 1000 v ' - w 800.'
->4 =
- 0. 1000. 2000. 5000. 4000. S000. 6000.
l TIME (SECONOS) r [ Figure 7.16 Steam Generator Tuce Ruoture, Pressures [ -160-
t SEABK - W . O . G . EMERG . hV . 1-CLIT 2-CL4T 3-HL4T 660. I 640. 620. - 600. s 580. T 4 d 560. -%_4% T
- 540. I i
520. i i 500. \
- s
( g g u 480, -= y , , y' l 1 6 460.
, I
- 0. 1000. 2000. 5000. 4000. 5600. 6000.
( TIME (SECONGS1 l [ Figure 7.17 Steam Generator Tube Rupture, Tem;:eratures s
-161-
SEABK - W.O.G. EMERG.h V 1-PRZR L . 2- SGB LOR' 3-SGD LuR 100. 90. p
- a 'I t .
80. 1 1 m 70. 4 _
> tf /4 I \A
@ 60. %--
en ' I
- 50. -
a m 40. \ -- E 50. _a ( e 20. E c- 10. I J
- 0. i l O. 1000. 2000. 5050. 40GO. 5000. 6000.
( TIME (SECONDS) Figure 7.18 Steam Genera:ce Tuce Ru::ture, Level s [. ( -162-
SEABK - W.O.G. EMERG u V 1-RCS WR P 2-SGE P 3-SGD P 2250. - 2000. 1750.
' 1500. \ -
1250. ss c m" ~
/. \
co 1000. ' < N ' ' .' a ll n. 750. 0 k{ftb yl
$ 500. I i E! 250.
O. - - O. 500. 1030.1500. 2000. 25G0. 5230. 5529. 4GG0. ( TIME (SECONDS 1 ( Figure 7.19 Seconcary Break Plus SGTR, Pressures [ [ -163-L
~.
SEABK - W.0.G. EMERG L V l-CL2T 2-CL9T - 3-HL4T 600. 550.' - 500, b 450. 5
.a 400.
d 550. - 500~ l d 250. P' ( '%y ' I t 4 200. O. 500. 1G30.1500. 2G00. 2500. 5000. 5500. 4000. l TIME (SECONDS 1 l Figure 7.20 Secondary Break Plus SGTR, Temceratures
-164-
t SEABK - W.0.G. EMERG W V . 1-PRZR L 2-SGB WR- - 3-SGD WR 100. 90.
\
W~3 3 3 3 3 3 3 80.
- i g 70. 6
@ 60.
u,
- 50. k 40.
50.
-5 A f cr 20. /' /
$a. 10.
y[ _
- 0. 1
- 0. 500. 1000. 1500. 2000. 2500. 5000. 5500. 4000.
TIME fSECONDS1 ( { L Figure 7.21 3ec::ncary Break Plus SGTR, Levels i L f
- -165-
t, APPENDIX A Background Information For
, Pressurized Thermal Shock s
s e. s
\
\ ,
s l
DISCUSSION ! During the fabrication of the vessel or during the operational lifetime of the plant, small flaws may be created in the weld or base metal of the reactor vessel. These flaws can be propagated or extended into larger cracks if very high thermal or pressure (membrane) stresses are imposed on them by RCS transients. A severe thermal shock or a pressurized thermal shock can lead to a brittle fracture of the vessel wall such that a loss of vessel integrity may occur. A vessel thermal shock condition exists if a rapid fluid temperature decrease occurs in the downcomer region of the reactor vessel. A temperature l difference will then be established through the vessel wall with the inside of the wall initially rapidly cooled while the outside portion remains close to its initial temperature. An example fluid temperature transient is provided in Figure 1, and corresponding wall temperature profiles for various times are l provided in Figure 2. As time increases, the temperature profile flattens b(cause more of the wall thickness is cooled below the initial system temperature. The result of the through-wall temperature difference is that a tensile l stress is placed on the vessel wall acting to pull open any pre-existing small flaws in welds or base material. Figure 3 is a representation of a flaw at l the vessel inner surface and how temperature induced stresses act to extend the flaw into the wall. In addition, when the temperature of the vessel wall decreases, its ability to resist flaw growth also decreases (decreasing fracture toughness). If these conditions occur to a severe enough extent, the pre-existing small flaw may propagate into a larger crack. In addition to the temperature-induced stresses, the RCS pressure could act to assist the growth of a flaw. A thermal shock occurring with pressure in the RCS is called Pressurized Thermal Shock (PTS). Figure 3 shows how pressure acts on a flaw, and Figure 1 presents an example pressure transient for a typical PTS event. A-1 l
=
A representation of the combined stress from temperature (thermal stress) and pressure (membrane stress) for the example transient in Figure 1 is shown in Figure 4 where stress profiles at various times into the transient are shown at different wall thickness locations. In sose' cases, a thermal s stress alone can be su(ficient to propagate a flaw, while in other cases, significant membrane stress in addition to thermal stress would be required to ' initiate flaw growth. . s ,
- ( t I In general, whether a small pre-existing flaw will grow is dependent on the rate and amount of RCS cooldown, the RCS pressure, the material properties
- of the metal and the locatlan, size, and geometry of the flaw. In deriving the integrity status , tree operational limit, each factor has been considered.
>+ The assumptions used in development cf this limit will be discussed in the 4 following section.
x TheintentofkhaintegrityCSFREDlimitistodefineparameters o ' (symptoms) that indicate a challenge is occurring to the integrity CSF, and , that immediate operator action is required to address this challenge. Using fracture mechanics analysis techniques and an assumed fluid temperature transient, the minimum pressure at a given temperature required to initiate a flaw, called the allowable pressure, can be calculated and used as a basis lfor the definition of the RED limit. The other integrity priority levels (ORANGE, YELLOW, GREEN) will be based, in turn, on the definition of the RED limit. A typical allowable pressure curve is provided as Figure 6. SELECTION OF RED CONDITION ACTION LEVEL LIMITS s t The plant process parameters to be used in monitoring the integrity CSF are RCS pressure and RCS cold leg temperature. RCS pressure is an indication of the pressure in the vessel downcomer region, and cold leg temperature is the best'available indication of downcomer fluid temperature. In order to be compatible with the intent of CSF status tree f monitoring, the integrity action levels are required to be time independent. Since the severity of a thermal shock is dependent on the rate of RCS A-2 5
cooldown, o method is nocd:d to con:cevativaly oli=innts rats cffceto from tha cymptoms. This is done in calculating the RED limit by assuming a step decrease (or infinite rate drop) in fluid temperature in order to bound all possible coolduwn rates. The method used to define the RED limit is to use, in an allowable pressure calculation, a step temperature transient assumed to start at a downcomer wall and fluid temperature of 550 F, with fluid temperature then dropping to a lower specified constant temperature. Figure 5 provides a representation of some example temperature transients. Figure 6 presents an example allowable pressure calculation result. For each final temperature assumed, a different allowable pressure curve is generated. A series of minimum allowable pressures, each corresponding to a given final temperature assumption, is then used to generate a curve which is called the " Step Cooldown Crack Initiation Limit," as shown on Figure 7. Also included on Figure 7 is a curve called the " Isothermal Wall Crack Initiation Limit," which is an allowable pressure curve assuming a constant steady-state through-wall temperature, rather than the very extreme situation resulting from the step temperature decrease transient which places the maximum thermally-induced tensile stress on the vessel inner wall. For the steady-state, through-wall temperature case, temperature stress is nearly zero, but material fracture toughness or its resistance to flaw growth at low temperature is low enough so that excessive pressure alone is calculated to cause flaw initiation. For thick-walled vessels, it has been found that this curve is more limiting at high pressure than the " Step Cooldown Crack Initiation Limit." Therefore, the RED integrity limit has been defined as the lower bound of the " Step Cooldown Crack Initiation Limit" and the " Isothermal Wall Crack Initiation Limit." A-3 I
The RED pressure-temperature limit line is then conservatively defined as the boundary of a region below which a flaw may initiate, and is , independent of the time history of the transient. If conditions remain to the right of the RED limit, no initiation of a flaw will occur. If conditions are to the left of this limit, the potential for flaw initiation exists, and appropriate operator action should be taken to reduce the probability that an existing flaw will propagate through the vessel wall. The region to the right of the intersection of the " Isothermal Wall' Crack Initiation Limit" and the RCS safety valve pressure setpoint plus 3% . accumulation (2560 psig) is a full repressurization area. In this area, a flaw will not initiate any pressure up to the safety valve setpoint, and complete operating flexibility with respect to pressure can be allowed. In permitting this flexibility, it is assumed that at least one of the installed code safety valves will operate correctly to limit RCS pressure, if necessary. The region to the right of the RED limit line and to the left of the
" Full Repressurization Limit" line.(Figure 7) is an area where a flaw will be calculated to initiate if pressure increases above the RED limit line even at a coastant wall temperature. Since pressure can rise in some cases rather quickly, increased operator awareness is warranted in this region.
RT ORIES FOR OMMONE MTS NDT The material properties of a given reactor vessel determine the fracture toughness or resistance to flaw initiation of the vessel. The important characteristics of the material are the initial vessel metal and weld composition and the neutron irradiation damage sustained during the life of the vessel. A measure of the fracture toughness of a given material in a specific vessel is its RT * * ""#* ""' " ~ " I NDT Temperature) value. The higher the RT temperature, the lower the fracture toughness of the material and the more susceptible it is to flaw f A-4
init10tien. Thic pirameter, RTEDT, ht3 bein gsnsrslly ceceptcd as tha most usefull figure-of-merit for evaluating the susceptibility of a reactor pressure vessel to a PTS condition. The material properties to be assumed are dependent on the plant reactor vessel. Three categories of reactor vessel material have been used to generate generic curves which can be conservatively applied to any Westinghouse nuclear plant vessel. The categories are defined by RT NDT 1 levels for the limiting vessel material as follows: CATEGORY I 0 RTNDT i 200 F (Seabrook) CATEGORY II 2000F < RTNDT i 2500F CATEGORY III 2000F < RTNDT i 3000F The limiting location in the vessel for evaluating severe cooldown effects is generally the downcomer core midplane (beltline) region (Figure 8). This is true because at one or more points around the vessel circumference, at its inner wall, the fluence level (integrated neutron flux due to core leakage) is the highest of any RCS material. The peak axial flux generally occurs in the core midplane region, and the maximum embrittlement of vessel materials from neutron bombardment therefore occurs on the contiguous vessel beltline. In most vessels, the beltline region also contains either circumferential or longitudinal welds that are the critical locations for assuring the integrity of the vessel. In applying the RED limit for any particular vessel, the limiting location is taken to be the location in the vessel beltline with the highest RT * "" * "" ** * * *** NDT* metal. FLAW SIZE AND GEOMETRY In calculating the RED limit curve, all flaw sizes up to an including 0.25 times the vessel wall thickness (1/4 T) have been evaluated. This means that all potential pre-existing flaws in size equal to or less than 1/4 T have been covered by the RED limit generated. Flaws larger than 1/4 T are not expected to exist due to the quality of vessel fabrication and the reliability
, of inservice inspection techniques.
A-5
The geometry of the pre-existing flaw assumed is finite and thm cnolysis technique is consistent with the methods used in standard fracture mechanics calculations. SELECTION OF ORANGE CONDITION ACTION LEVEL LIMITS The intent of the ORANGE condition limit of the integrity status tree is to provide a warning area for the operator of an imminent RED condition. In the ORANGE region, a flaw is n2t calculated to initiate, but relatively small and possibly rapid changes in pressure or temperature will result in entry to the RED region where a flaw is calculated to initiate. For Category I plants, the ORANGE limit is defined as the region between the RED region boundary and the " Full Repressurization Limit" line (Figure 7). LIMITS OF APPLICABILITY This Function Restoration Procedure is intended to respond to a thermal shock or pressurized thermal shock event. If a normal cooldown is occurring and the cooldown rate limit on the status tree is not exceeded, but a subsequent RCS pressurization in violation of the Technical Specification pressure-temperature limit occurs, then it is possible to have an immediate ORANGE or RED indication without an excessive thermal condition. This case is - not specifically covered by the procedure, but the actions instructed do address any potential cold overpressure concern by requiring an RCS depressurization. However, the degree of depressurization necessary would be only that needed to return the RCS pressure to within the Technical Specification limits. Also, no soak is required and subsequent RCS cooldown should be within rechnical Specification cooldown limits. Seabrook design includes a LTOP System that automatically opens pressurizer PORVs to limit RCS pressure for a given RCS temperature. The programmed uTOP pressure-temperature setpoint maintains RCS pressure within Technical Specification cooldown limits. The operator should expect LTOP to h A-6 i
open the pressurizer PORVs automatically if a large cooldown occurs without a significant decrease in RCS pressure. In addition, a sudden RCS pressure increase without a thermal shock will also result in LTOP operation. See Figure 9. 90 t f N A-7
1000 C REACTOR COOLANT E PRESSURE & TEMPERATURE 5 66 - FOR A REPRESENTATIVE h _ SEVERE THERMAL E TRANSIENT FIGURE OP 1 (TC Rev 0 3/84) 2 N ( -- I I 0 2000 3000 0 1000 l y - . TIME (seconds) 3000
!b.
y 2250 - 3 g 2000 - m FIGURE 1
!E 1000 2000 3000 0 1000 TIME (seconds)
p i i VESSELTEMPERATURE PROFILES I FIGURE OP 2 (TC Rev 0 3/84) ' j 1 600
- 200 sec l 600 sec i
i 500 - 1000 sec 1 C , > e_ lE ' o 1500 sec D 499 - 2000 sec oc us 1 n. - ! E . 1 tu i l-300 i ) 200 - 1 I I i 1 1 l ! FIGURE 2 0 1 2 3 4 5 6 7 8 ' i VESSEL WALL THICKNESS (inches) l t l
~
VESSEL FIGURE 3 WALL INSIDE W OUTSIDE e LOW TEMPERATURE 1 r FLUID FLOW 1 r PROFILE l' 3r s PRESSURE , U ! FORCE FLAW i IN VESSEL WALL TEMPERATURE ' PROFILE . FLAW PROPAGATION CONDITIONS IN VESSEL FIGURE OP 3 (TC Rev 0 3/84) I e
~
64,000 VESSEL 56,000 STRESS PROFILES 48,000 FIGURE OP 4 (TC Rev 0 3/84) 40,000 - b PRESSURE 32,000 - AND THERMAL STRESS (PSI) 24,000 - 16,000 - 2000 sec ' 8,000 - r1500 sec . A\ v 200 sec 1000 sec l l l l l l l 600 sec
- 8'000 2 3 4 5 6 7 8 0 1 FIGURE 4 VESSEL WALL THICKNESS (inches) .
s
~
BASIS FOR DEVELOPMENT OF CRACK INITIATION CURVE FIGURE OP 5 (TC Rev 0 3/84) A>B>C . y 550 Pressures decrease with increasing radiation damage to vessel (RTNDT)
~
I (Critical Pressure = A psig) TEMPERATURE ("F) (Critical Pressure = B psig) . (Critical Pressure = C psig) 200 -
~
TIM E-* FIGURE S .
s EXAMPLE: ALLOWABLE PRESSURE CURVE FIGURE OP 6 (TC Rev 0 3/84) 1 l j i MINIMUM
~
l I . l I ALLOWABLE l PRESSURE PRESSURE i . l ALLOWABLE l PRESSURE l .- l TIM E-+ i FIGURE 6 h
b
. EXAMPLE CURVE FIGURE OP 7 (TC Rev 0 3/84)
SAFETY VALVE SET PRESSURE PLUS ACCUMULATION P POTENTIAL " CUSP" l NO I INITIATION REGION I INITIATION e PRESSURE / w FULL
, , ISOTHERMAL WALL CRACK
[
- l REPRESSURIZATION LIMIT
[g INITIATION l ; l LIMIT g ~ I STEP l l / COOLDOWN ,' CRACK l / INITIATION LIMIT l l l +-TEMPERATURE i FIGURE 7 1
m - i 1 P1 F1 P1 F t: s CLOSURE - HEAD MAJOR l REGION SECT!OF'* y OFA NOZZLE i REACTOR SH ELL- PRESSURE COURSE l E
=
REGION VESSEL
' FIGURE OP 8 (TC Rev 0 3/84).
i . BELTLINE ' REGION CRITICAL ' LOCATION I LOWER HEAD , REGION #[ FIGURE 8 l
SEABROOK LTOP SETPOINT PROGRAM FIGURE OP 9 (TC Rev 0 3/84) 2385 PSIG FIXED PORV SETPOINT 2500 y g 2385-l I p 2000- l L E l 2 ' I . ( 1500- , l - I o
' 1000- -
l
! 190"F l 2 1 N 500- I s I 200 , , , ,
100 150 200 290 300 30 400 RCS TEMPERATURE ("F) I LTOP l ARMING POINT j FIGURE 9 . 350"F
APPENDII B Seabrook Station l Emergency Response Procedures i { { { ,
i E-0 Reactor Trip or Safety Injection l ES-0.0 Redlagnosis l ES-0.1 Reactor Trip Response ' ES-0.2 Natural Circulation Cooldown ES-0.3 Natural Circulation Cooldown With Steam Void in Vessel (With RVLIS) ! ES-0.4 Natural Circulation Cooldown With Steam Void in Vessel (Without RVLIS) E-1 Loss of Reactor or Secondary Coolant R$-1.1 SI Termination ES-1.2 Post-LOCA Cooldown and Depressurization ES-1.3 Transfer to Cold Les Recirculation ES-1.4 Transfer to Hot Leg Recirculation E-2 Faulted Steam Generator Isolation E-3 Steam Generator Tube Rupture ES-3.1 Post-SGTR Cooldown Using Backfill ES-3.2 Post-SGTR Cooldown Using Blowdown ES-3.3 Post-SGTR Cooldown Using Steam Dump ECA-0.0 Loss of All AC Power ECA-0.1 Loss of All AC Power Recovery Without SI Required ECA-0.2 Loss of All AC Power Recovery With SI Required ECA-1.1 Loss of Emergency Coolant Recirculation ECA-1.2 LOCA Outside Containment ECA-2.1 Uncontrolled Depressurization of All Steam Generators ECA-3.1 SGTR With Loss of Reactor Coolant - Subcooled Recovery Desired ECA-3.2 SGTR With Loss of Reactor Coolant - Saturated Recovery Desired ECA-3.3 SGTR Without Pressurizer Control FR-S.1 Response to Nuclear Power Generation /ATWS FR-S.2 Response to Loss of Core Shutdown FR-C.1 Response to Inadequate Core Cooling FR-C.2 Response to Degraded Core Cooling FR-C.3 Response to Saturated Core Cooling Condition FR-H.1 Response to Loss of Secondary Heat Sink FR-H.2 Response to Steam Generator Overpressure FR-H.3 Response to Steam Generator High Level FR-H.4 Response to Loss of Steam Dump Capabilities FR-H.S Response to Steam Generator Low Level FR-P.1 Response to Imminent Pressurized Thermal Shock Conditions FR-P.2 Response to Anticipated Pressurized Thermal Shock Conditions FR-Z.1 Response to High Containment Pressure FR-Z.2 Response to Containment Flooding FR-Z.3 Response to High Containment Radiation Level FR-I.1 Response to High Pressurizer Level FR-I.2 Response to Low Pressurizer Level FR.I.3 Response to Voids in Reactor Vessel}}