ML20212Q670
| ML20212Q670 | |
| Person / Time | |
|---|---|
| Site: | Yankee Rowe |
| Issue date: | 05/19/1986 |
| From: | GENERAL PHYSICS CORP. |
| To: | |
| Shared Package | |
| ML20212Q662 | List: |
| References | |
| PROC-860519, NUDOCS 8609050347 | |
| Download: ML20212Q670 (179) | |
Text
- ,.,_.{
~
m j ',7 7 "
h., k.:'.2
'ifg v
i p.'. ', *. s,
uis:.).
Q jygd (x_ %
W: k r'
I PROCEDURES GENERATION PACKAGE FOR THE YANKEE EMERGENCY RESPONSE GUIDELINES I
f Prepared for Yankee Nuclear Power Station l5 I
May 19, 1986 I
General Physics Corporation i
l Columbia, Maryland 8609050347 860018 l E PDR ADOCK 05000029 I^E P
PDR I
J l
}ywC'?-T*
~
v s.
% I!sN
,k
[9 j
R Fu
,# y' p
c_p c. g. a h
,3 TABLE OF CONTENTS u
SECTION PAGE L
I.
INTRODUCTION................................................... 1 r-L A.
Purpose....................................................
1 B.
Scope...................................................... 1
[
C.
Organization...............................................
1 L
\\
l h
II.
PLANT-SPECIFIC TECHNICAL GUIDELINES............................
2 1
A.
General....................................................
2 B.
Yankee approach to ERGS...............................,.....
3 ty C.
ERG Usage.................................................
10 D.
Program Description Overview..............................
10 E.
Use of Westinghouse Owners Group Generic Technir al Guidelines................................................ 11 F.
Future ERG Revisions......................................
12
{
B 7II. WRITERS ' GUIDE FOR EMERGENCY RESPONSE GUIDELINES..............
13 A.
General...................................................
13 B.
Document Description...................................... 13 IV.
VERIFICATION AND VALIDATION PROGRAM FOR EMERGENCY RESPONSE GUIDELINES................................. 14 A
A.
General...................................................
14 B.
Objectives of V&V Plan....................................
14 m
V.
EMERGENCY RESPONSE GUIDELINES TRAINING PROGRAM................
17 A.
General................................................... 17 B.
Training Program Objectives...............................
17 C.
Initial Training Program..................................
17 D.
Continuing Training Program...............................
18 I
I I
\\
F a
d-a r
APPENDIX A Background Information on Yankee Emergency Procedures L
APPENDIX B Comparison of Yankee Plant to Reference Plant APPENDIX C Use of WOG Rev. 1 Generic Technical Guidelines APPENDIX D Writers' Guide for Emergency Response Ge'.delines APPENDIX E Verification and Validation Program Plan L
[
1 k
[
1
[
M
[
W
e ~ ~ --+ m m 1 e - 5.,, v+e N ?,f 1,A fa f h,
bd h % Af^bk L
I.
INTRODUCTION A.
Purpose The purpose of this Procedures Generation. Package (PGP) is to describe the Emergency Response Guidelines (ERG) development at the B
Yankee Nuclear Generating Station, located in Rcwe, Massachusetts. The Yankee Plant is a four-loop Westinghouse Pressurized Water Reactor that began commercial operation in 1960.
B.
Scope This document was developed in response to Supplement 1 to NUREG-I 0737, item 7.2b, which requires each licensee to " submit a procedures generation package at least three months prior to the date it plans to begin formal operator training on the upgraded procedures."
C.
Organization This document consists of the following five sections:
e Introduction e
Plant-Specific Technical Guidelines I
e Writers' Guide for ERGS e
Verification and Validation Program (V&V) for ERGS e
ERG Training Program Each of the sections describes the approach taken by the Yankee Nuclear Power Station as part of the overall ERG implementation plan.
In addition, appendices have been included which provide additional I
supporting information for the five basic sections of this document.
I i
I l
I I
i I
i
L T M % y;" 3 p.,
'g e r-a 3
r
\\.... %.4.$a a(,
, (. s..
1 u.
(
II.
PLANT-SPECIFIC TECHNICAL GUIDELINES A.
General
{
L Yankee has been an active participant in the Westinghouse Owners Group (WOG) Procedure Development Program since its initial formation following the TMI-2 accident. We participated in the Initial Study e
L (WCAP-9691) prepared in response to NUREG-Os78 2.1.9.c.
This report, issued March 30, 1981, was a generic study of the probabilistic risk assessment (PRA) evaluation of the Westir.ghouse PWR designs. The study I
identified major design basis events that, though primarily based on L
large PWRs of recent vintage, can be equated with the Yankee design and characteristics. Included in the study were Optimal Recovery Guidelines (ORG) designed to provide guidance for the operator to recover the plant from a known event / condition state. Implied in the guidelines was the maintenance of Critical Safety Functions.
As the procedure review program developed, it became obvious that the Westinghouse Owners Group procedures were excessively complex for adaption to the Yankee plant, a much smaller and simpler plant with a very compact control system. Yankee, therefore, formed an Emergency Response Guidelines (ERG) Committee made up of senior plant and NSD personnel. Each member of this committee holds or has held a NRC Senior
/
Operator's license and has had experience in the nuclear power industry ranging from 7 to 23 years. One individual on the committee was a representative ca the Westinghouse Owners Group Operations Cor.nittee (procedures).
This committee proceeded to develop ERGS that would satisfy Yankee's specific needs. They took full advantage of the following sources of information:
1.
Applicable portions of tne Babcock & Wilcox procedure program.
2.
Applicable portions of the BWR Owners Group procedure program.
3.
Applicable portions of the Combustion Engineering emergency procedure guidelines.
{
4.
All of the Westinghouse Owners Group procedure program concepts.
S.
The Yankee plant Probabilistic Safety Study program.
6.
The cumulative experience of Yankee plant.
7.
NUREG-0799, Draft Criteria for Preparation of Emergency Operating Procedures, for comment.
~
6.
NUREG-0818, Emergency Action Levels for Light Water Reactors.
2
, y. ev%
spxq l
=7 i f ),9
.Q b
Le i b d D il N
B.
Yankee Approach to ERGS The basic approach to emergency response and transient management used at the Yankee Plant integrates the components of symptom-oriented CSF/EOPs, Control Room design, the SPDS, and operator training in a framework which maintains the objectives of safe operation. Yankee bases its response to abnormal events on the maintenance of Critical Safety Functions which include reactivity, secondary cooling inventory,
)
[
main coolant inventory, core heat removal, and containment integrity.
I With these procedures, regardless of the event, the operator focuses on
)
the essential elements of plant control, mainly, what is necessary to control core power, to control core cooling, and to control containment integrity. Event-oriented recovery procedures (see Table 1) are then used once the Critical Safety Functions are being maintained and the
{
event has been diagnosed.
The objectives of the operators in the Control Room are to generate electricity, maintain a safe working environment, and avoid public
[
health hazards. Figure 1 is an outline of how these objectives are-perceived and how they should be met operationally. The people most directly involved in safe operation are the Primary System Operator, the
(
Secondary System Operator, and the Supervisory Control Room Operator.
The Shift Supervisor directly manages the process of generating electricity within the constraints of the license, maintains, with others, a safe working environment, and manages the process of detecting, verifying, diagnosing, and initiating recovery action in the event of an accident..The Shift Technical Advisor functions as the Shift Supervisor's assistant.
Five Critical Safety Functions have been established. These Critical Safety Functions - reactivity, secondary cooling inventory, main coolant inventory, core heat removal, and vapor container (containment) integrity assure the public health and safety. These CSFs were developed focusing on key parameter inputs necessary to assure the intergity of the physical barriers against radiation release. With this
[
specification, the Critical Safety Function parameter groups were developed as shown in Table 2.
Twenty-four key parameters were identified.
Each Critical Safety Function has associated with it at least one high level procedure identifying how to restore that Critical Safety Function given certain symptomatic conditions. Figure 2 indicates the Critical Safety Functions and the 10 syr'ptom-oriented Emergency Operating Procedure (EOP) sets that address potential upsets to the core cooling and containment integrity objective. Since the Critical Safety Function Procedure (CSF/EOP) are symptom-oriented and thus functional, the approach does not exclude specific actions necessary to respond to prescribed events as defined by the event-oriented procedures.
In fact, the CSF/EOPs may direct the operators to the event recovery procedures.
The hierarchy of eme'rgency response at Yankee is shown in Figure 3.
Upon detection of an abnormal symptom, the operators first assure
[
themselves that the Critical Safety Functions are being maintained. The particular CSF parameters that are challenged identify the CSF/EOP to 3
i...
/
h
$9I773
.. : s q.
\\'
.. M l
,~
l
- w.a u.m a
follow. When in the course of following the CSF/EOP an event is diagnosed, specific recovery procedures are followed.
A significant aspect of the emergency operations process is feedback. The effect of the operator action must be reflected in the status of the plant. Continuous monitoring of the Critical Safety I
Functions provides that feedback and may require additional actions ouside event procedures. The objective is to maintain the functions in a complicated multiple-failure scenario.
In addition to the existing Control Room instrumentation, a plant-specific Safety Parameter Display System (SPDS) was developed and installed incorporating the concepts described above. The purpose of I
the SPDS is to augment the information resource noted in Figure 1.
Yankee's approach to the SPDS is that it should not replace the control board as the primary source of information to the operators, yet it should provide the Shift Supervisor (SS), the Supervisory Control Room Operator and the Shif t Technical Advisor (STA) with a summary of the plant conditions.
I I
I I
I I
I I
I I
I
[
W -[ l i'
OPERATOR..RESPObSI E W j
EFFICIENTL AYlOPNUY fI" SAFE OBJECTIVES GENERATE HEALTH WORKillG I
ELECTRICITY CONSEOUENCES ENVIRONMENT I
[ PREVENT
[ PREVENT l
CORE J
l CONTAINMENT j MELT FAILURE I
l I
I I
BAUCS CONTROL CONTROL CONTROL CORE CORE CONTAINMENT POWER COOLING INTEGRITY I
I I
I CRITICAL SAFETY FUNCTIONS CORE MAIN SECONDARY VAPOR I
REACTIVITY I l HEAT I I COOLANT I l COOLING j 1 CONTAINER I
REMOVAL INVENTORY INVENTORY INTEGRITY I
PRIMARY SECONDARY OPERATORS SYSTEM SYSTEM OPERATOR OPERATOR h
SUPERVISORY CONTROL lSUPERVISOR
--==H TECHNICAL j OPE OR R ' SPONSI-MANAGES THE MANAGESTHE M AN AGES THE ll
' LITIES PROCESS OF:
PROCESS OF:
PROCESS OF:
GENERATING
- 1) DETECTING, MAINTAINING g
ELECTRICITY
- 2) VERIFYING, A SAFE WORKING WITHIN THE
- 3) CIAGNOSING.
ENVIRONMENT CONSTRAINTS
- 4) INITIATING I
OFTHE RECOVERY LICENSE ACTION I
l
[D
[D
[D l
RULES l
l SKILLS l
(KNOWLEDGE l PEOPLE INFORMATION GUIDELINES RECOURCES
.* UX OPS
-lNSTRUMENTS
-TECH SPECS
-TECHNICIANS
-CONTROLS
-PROCEDURES
-ENGINEERS
-ALARMS
-TRAINING I
-GUARDS
-COMPUTERS
-REMVEC
-MANAGERS
-SYSTEMS
- ALARA, OSH A, ETC.
-ETC.
-ETC.
-ETC.
cas.om 5
f ~* ' [:, " fr, f;
7...
- &T %
- %L U
FIGURE 2 CRITICAL SAFETY FUNCTION PROCEDURE NETWORK CSF v
Reactivity Reactivity EOP $1 I
I Secondary Secondary Secondary Secondary Secondary Cooling /
High Pressure High Level Low Level Low Pressure Inventory EOP $2 EOP $3 EOP $4 EOP 45 I
I Main Coolant High Sec. Rad.
Low M.C. Press Inventory EOP $6 EOP $7 I
I Core Heat Loss of Sat.
High M.C.
Margin Press.
Removal EOP $8 EOPl9 I
Vapor Container Vapor Container Integrity High Pressure EOP 010 Priority: Top to Bottom.
Left to Right 1E l
'I 6
I
p--
Y ; ' ?;
g
";p,;,, -
4 y..
r r_, I c!
,3 s ->'
FIGURE 3 f
EMERGENCY RESPONSE HIERARCHY l
L J
I DETECT ABNORMAL CONDITION r
L l
i F
VERIFY L
IF CRITICAL SAFETY FUNCTIONS I MAINTAINED p
lL I
L FOLLOW I
CRITICAL SAFETY FUNCTION 7
y EOPs (1-10)
DIAGNOSE 7
t FL FEEDBACK L
k
[
RECOVERY (EVENT BASED)
PROCEDURES W
l f
~
7
f
'g
'\\Is:l-. u. _.
y, TABLE 1 RECOVERY PROCEDURES I
Reactor Shutdown Scram Recovery Procedure OP-3101 Large Loss of Load W/O a Reactor Scram OP-3102 Natural Circulation OP-3109 Inadequate Core Cooling OP-3111 Loss of Main Coolant Locs of Main Coolant OP-3106 I
Loss of Secondary Coolant Steam Line Rupture OP-3115 Loss of Feedwater OP-3116 i
Steam Generator Tube Ruoture Steam Generator Tube Rupture OP-3107 Reactivity Anomalies I
Refuelino Accident OP-3117 Coldwater Accident OP-3110 I
Emergency Boron Injection OP-3105 Loss of AC Power Loss of AC Supply OP-3113 I
i 8
5
L, f'44;, K i,
[*M P 7 I,
E F
h bLi y a u, a L:a.
.ce TABLE 2 CRITICAL SAFETY FUNCTION PARAMETERS REACTIVITY CONTROL a.
Power range power level k
b.
Intermediate range power level c.
Source range power level I
CORE HEAT REMOVAL f
a.
Pressurizer level b.
Main coolant system pressure c.
Hot leg temperature
[
d.
Cold leg temperature e.
Core exit temperature f.
Saturation pressure SECONDARY COOLING AND INVEPTTORY a.
Steam generator level b.
Steam generator pressure c.
Steam flow d.
Feedwater flow e.
Steamline radiation f.
Emergency Feedwater Flow MAIN COOLANT INVENTORY a.
Vapor container flood level p
L b.
Pressurizer level c.
Air ejector radiation monitor d.
Main coolant system pressure e.
Vapor container pressure f.
Vapor container air particulate F
VAPOR CONTAINER INTEGRITY a.
Vapor container pressure b.
Vapor container high range radiation c.
Vapor container H2 concentration i
9 l
hIN:.
t U
J n
AY Y.
C.
ERG Usage The Recovery Procedures provide the operator with guidance suf ficient to effectively recover the plant f rom nominal emergency conditions and return it to a known safe state from which repair (if required) er return to power can be accomplished. Irrespective of the I
event-specific framework of these procedures, numerous verification or action steps, intended to ensure the maintenance of all Critical Safety Functions throughout the recovery, have been incorporated into them.
These procedures together with the Critical Safety Function EOPs permit the operator to respond to virtually any plant upset condition, I
including multiple f ailure conditions, and f ailures subsequent to initial diagnosis.
If diagnosis of the event is possible, the operator proceeds with I
the recovery actions specified in the Recovery Procedures until plant recovery is achieved. During recovery from a known event, the operator continually monitors the critical Saf ety Functions. If a challenge to a
'I Critical Safety Function occurs during the recovery, the operator uses the Critical Saf ety Function EOPs to restore the challenged safety f unction (s ). Upon restoration of all Critical Safety Functions the I
plant condition is rediagnosed and the appropriate recovery actions are taken.
If no diagnosis can be made immediately following the initiating I
event, the operator utilizes the Critical Safety Function EOPs in order to address the challenge to the plant. At the same time, diagnosis of the event is being attempted, so that when the plant challenge is removed through operator response, the plant may then be recovered by performing the appropriate Recovery Procedure steps.
The Recovery Procedures are listed in Table 1.
The ERG structure I
as developed provides for recovery of the plant during major identifiable emergency conditions. It also permits the operator to maintain plant conditions for all other cases, including non-diagnosed I
events and for cases where multiple failures or subsequent f ailures limit the applicability of the pre-defined recovery steps, f
The resulting Emergency Response Guidelines from this process made use of the Critical Safety Function (CSF) concept, referenced in WCAP-I 9691, and further developed in the Combustion Engineering and l 3 Westinghouse Owners Group emergency procedure guidelines.
.g i
D.
Program Description Overview l
Supplement 1 to NUREG-0737 in Sect. ion 7.1.a requires "...EOPs to be consistent with Technical Guidelines...".
In addition, Section 7.2.b.i requires the procedures generation package include "...a description of lg the planned method for developing plant-specific EOPs from the generic I
3 guidelines, including pla'nt-specific information". Yankee has chosen I
the Westinghouse Owners Group Revision 1 generic technical guidelines (LP plant) as the technical guidelines for its ERGS.
Although the 10
' I J
P 4.
7."b y *** ' %.' n
[
initial ERG generation process took full advantage of the sources of information previously listed, the final EhG set will have a solid technical bases with the WOG revision 1 technical guidelines. Thus, Yankee can show that the ERG set is coraparable to the WOG technical l
bases although the methods of implementation and use of the Yankee ERGS differs f rom the WOG methods. The method by which Yankee utilizes the generic technical guidelines is further outline 6 in the following F
subsections.
Yankee uses three basic tasks in creating a clearly identifiable reference to the low pressure version of the Revision 1 WOG generic
[
technical guidelines. These tasks are:
TASK 1 Perform a bases-to-bases comparison of the initial Yankee ERG set to the Rev.1 WOG LP generic guidelines TASK 2 Perform a step-to-step comparison of the initial Yankee ERG set to the Rev.1 WOG LP generic guidelines TASK 3 Revise the initial Yankee ERG Jet as dictated by the findings of Task 1 and Task 2 and in accordance with the
[
Yankee Writers' Guide Using these three tasks and the supporting documentation, Yankee will demonstrate that the final Yankee ERG set has a strong technical reference in the Rev. 1 WOG generic guidelines while maintaining consistency with Yankee operating philosophy.
Yankee has developed background information for both the critical safety function /EOPs and the recovery procedures. This background information containn ' amplifying information on the EOPs and recovery procedures. This information package along with the comparison to the WOG generic Technical Guidelines provides a strong technical bases for the final Yankee Emergency Procedure set. The background information package has been included with this document as Appendix A.
A E.
Use of Westinghouse Owners Group Generic Technical Guidelines As previously stated, Yankee will use the Rev. 1 Westinghouse Owners Group low pressure plant generic technical guidelines as the technical guidolines on which the final Yankee ERGS are based. Any differences between the Yankee ERG set and generic WOG guidelines will
[
be documentated and evaluated. Changes to the procedures will be made when deemed necessary and in accordance with the Yankee Writers' Guide and plant operating philosophy. The method by which the WOG generic galdelines will be used in support of the final Yankee ERG set is provided as Appendix C.
[
[
11
aw em N9 5 ~;
, [i h
f i'q
),
E[..
in d.
de 1as F.
Future ERG Revisions Recognizing that future ERG revisions may be necessary, Yankee will I
apply the various elements of procedure generation, as outlined in this procedures generation package, to future ERG revisions. Specifically, all future changes (other than editorial changes) should undergo com-I parison to the technical guidelines and any additional analysis per-formed, as necessary. The documents that support procedure generation (e.g. step difference sheets) would be updated as required.
In I
addition, procedures will be revised in accordance with the Yankee Writers' Guide and will be subject to verification and validation according to the guidelines for procedure revisions provided in the Verification and Validation Program plan.
I I
I I
I I
'I l
l I
I I
I I
12 I
'f
$* ( i Y
I.k
[
.,~ b &%
L '.b s
III. WRITERS' GUIDE FOR EMERGENCY RESPONSE GUIDELINES A.
General A writers' guide for ERGS is a plant-specific document that pro-i L
vides instructions on writing ERGS, using good writing principles and a methodology that adheres to sound human factors principles. The Writers' Guide also helps to promote consistency among all ERGS and r-their revisions, independent of the number of ERG writers.
The Writers' Guide will be revised, as necessary, based on feedback from operator training, experience, and validation.
The Writers' Guide is based on the following documents:
L 1.
NUREG-0899, Guidelines for the Preparation of Emergency Operating Procedures, August 1982.
2.
INPO 82-017, Emergency Operating Procedures Writing Guideline, H
July 1982.
3.
AP-0001, Rev.10, Plont, Procedures and Instructions, Yankee Nuclear Power Station.
B.
Document Description Information on the following major items are included in the plant-specific Writers' Guide for ERGS.
1.
Purpose 2.
Definitions f
3.
Procedure Identification System W
4.
Procedure Format 5.
Action Step Construction 6.
Printed Operator Aids 7.
Mechanics of Style 8.
Typing and Reproduction 9.
ERG Revisions and Updates A copy of the plant-specific Writers' Guide for ERGS is included as Appendix D of this docanent.
[
E E
[
W /z a$ p
..g hN j
II E
dd gh IV.
VERIFICATION AND VALIDATION PROGRAM FOR EMERGENCY RESPONSE CUIDELINES A.
General Verification and Validation (V&V) of the ERGS is the process used to establish the accuracy of information and/or instructions, to determine that the procedures can be accurately and efficiently carried out, and to demonstrate that the procedures are adequate to mitigate transient and accidents. Both technical and human factors engineering adequacy are addressed by the verification and validation process.
The V&V plan for the Yankee Nuclear Power Station was developed using the following references:
1.
NUREG-0899, Guidelines for the Preparation of Emergency Operating Procedures, August 1982.
2.
INPO 83-004, Emergency Operating Procedure Verification Guidelines, March 1983.
3.
INPO 83-006, Emergency Operating Procedure Validation Guidelines, July 1983.
B.
Objectives of V&V plan The V&V plan has the following objectives, which are based upon the objectives listed in NUREG-0899.
1.
ERGS are technically correct, i.e.,
they accurately reflect the technical guidelines.
2.
The ERGS are written correctly, i.e.,
they accurately reflect the plant-specific writers' guide.
3.
The language and level of information presented in the ERGS are compatible with the minimum number, qualification, training and experience of the operating staff.
f 4.
The ERGS are usable, i.e., they can be understood and followed L
without confusion, delays, errors, etc.
5.
There is a correspondence between the procedures and the
(
cont rol room / plan t ha rdwa r e, i. e., control /eq u ipmen t/i nd ica t ion s that are referenced are available inside and outside the control room, use the same designation, use the same units of
{
measurements, and operate as specified in the procedures.
6.
There is a high level of assurance that the procedures will
- work, i.e., the procedures guide the operator in mitigating transients and accidents.
14
{
QT T'yy) 3 I
h#k h
\\l L.
The V6V methodology employed in the V6V plan encompasses the eval-untion of these six objectives. Table IV.1 shows the correlation between each of these objectives and the specific components of the V&V process that accomplish the objective. The Verification and Validation Plan provides the details on how each objective will be met and is included as Appendix E to this document.
[
[
[
C
[
[
(
15 o
b e..
(,
)i 2,.
I'.
,e ih ).
t.'
t s..s
$# i, e u...'1
- 1. &
4..
Table IV.1 Correlation Between V&V Objectives and Process l
NUREG-0899 V&V Process Components V&V Objectives verification Validation I
a.
Technically correct e Comparison of tech-nical guidelines and l
EOPs (TT)
I b.
Written cotrectly e Comparison of EOPs and Writer's Guide I
(TT) e Evaluation Criteria l
Checklist (TT)
I e Review by operating e Evaluation during c.
Compatible with minimum number, shift complement slow-paced walk-qualification, train-in conjunction with throughs and "real-ing'and experience table-top review time" scenario l
of operating staff for objective "d"
exercises (SIM/WT)
B l
d.
Usable e Review by operating a Evaluation during shif t complement to slow-paced walk-I evaluate readabil-throughs and "real-l ity, completeness, time" scenario accuracy, and con-exercises (SIM/WT) venience (TT) l e.
Correspondence exists e Comparison of con-between procedures trol room instru-and control room /
mentation and plant hardware controls (IEC) and EOP references to I&C (WT) f.
Guide operators in e Evaluation of "real-mitigating transients time" scenario exer-and accidents cises (SIP /WT)
V6V Methods:
M - Table Top
- Individual or group evaluation WT - Walkthrough - Step-by-step enactment of scenario operator actions without carrying out actual control functions SIM - Simulator
- Control functions performed by operators in simulator 16 i
~
.: h
.(
? ';
[
,o s.:J a -
i V.
EMERGENCY RESPONSE GUIDELINES TRAINING PROGRAM A.
General The Emergency Response Guidelines Training Program was developed to support the smooth implementation of the Emergency Response Guidelines. The procedures writing team and the Yankee Training Department coordinated their efforts in the development of the Training Program.
B.
Training Program Objectives The overall Emergency Response Guidelines Training Program objectives are as follows:
1.
Operators will be able to explain the structure and format of the new Emergency Response Guidelines (ERGS) 2.
Operators will be able to state the technical bases for the ERGS 3.
Operators will be able to state how the procedures are used during an emergency 4.
Operators will be able to use the critcal safety functions (CSF) to control emergency situations 5.
Operators will be able to transition from CSFs to the recovery procedures and vice versa in response to an emergency 6.
Operators will be able to use the recovery procedures to reach long term plant stability Training objectives one, two, and three will be accomplished using classroom lectures and/or group discussions. Objectives four, five, and six will be accomplished during control board mockup training.
C.
Initial ERG Training Program The initial ERG training is scheduled to be conducted during the fourth quarter of 1986. This training will consist of four days of combined classroom lectures, discussions and control board mockup
[
exercises.
The initial portion of the four day training program will consist
(
of approximately four hours of classroom instruction on Yankee's philosophy on the new ERGS. This lecture will include ERG structure and use in transient and accident mitigation.
The remainder of the four day training program will consist of s
instructor controlled ERG discussions in a seminar training environment and control board mockup exercises. During the seminars, the students will discuss the technical content and bases for the ERGS as well as the 17
a
- f k^
"K a
l.
3:
method by which a crew would use the ERGS during a transient or accident. All E0Ps and event procedures will be discussed in this manner.
a In addition, the students will gain practice in the use of the ERGS through scenario-based exercises conducted on the Yankee control board mockup. During these exercises, a team training concept will be used whereby each team member will perform the duties of his normally assigned control room position. Scenarios will be chosen to exercise as many of the ERGS as is possible during the four-day period.
In addition, both multiple and sequential failures will be incorporated l
into the exercises. Following each exercise, the students will critique their performance with the instructor and other student observers. ERGS not utilized during the mockup exercises will be walked-through on the
,-e mockup.
D.
Continuing Training Program
'7-K In addition to the initial training on the ERGS, Yankee will have a continuing ERG training program. Specifically, ERG training is planned 3-for the following areas.
Initial operator license training
][
e operator requalification training e
Snecial training following significant ERG revisions
[-
e Operators are trained and retrained on emergency procedures during initial license training and subsequently during periodic requalification training. Accordingly, the new ERGS will provide the basis for emergency E
procedure training for these two areas in accordance with existing Training Procedures.
JE ik Following future ERG revisions, training will take place on the nature of the revision. Yankee will evaluate each ERG revision and f_
institute training as appropriate on the revision. This training could
=
take the form of required reading for simple changes to special classroom lectures or shif t briefings for raajor changes to procedure
,'l-intent.
gE y
P W
$5
.c I*
18 d'
ME E'
9'%. V?:
RM t'T " k
'l V
y.f',$
}$ty:, j':, ~
-. /,i.
dia..
6.,
I 1
I I
1 I
'I
.I APPENDIX A I
Background Information on Yankee Emergency Procedures I
i,I I
I I
I I
I I
I
I 4: - -
.-.w,,
z.
sy'r"?' M
{
' ['
Y, O,
L, f
4
. %,g E
t S. 1 TABLE OF CONTENTS Section Page
1.0 INTRODUCTION
................................................... 1 2.0 CRITICAL SAFETY FUNCTION BACKGROUND INFORMATION................
2 P
h 2.1 Reactivity Anomaly.......................................
2 2.1.1 Reactivity - EOP 1................................
2 2.2 S econdary Cooling and Inve ntory.......................... 3 2.2.1 Secondary High Pressure - EOP 2................... 4 2.2.2 Secondary High Level - EOP 3...................... 5 2.2.3 Secondar y Low Level - EOP 4....................... 5 2.2.4 S econdar y Low P re ssu re - EOP 5.................... 6 2.3 Main Coolant Inventory...................................
8 2.3.1 High S econdary Radiation - EOP 6.................. 8 2.3.2 Main Coolant Pressure Lov - EOP 7................
19 y
L 2.4 Core Heat Removal....................................... 12 2.4.1 Main Coolant Temperature High - EOP 8............
12 2.4.2 Main Coolant P ressu re High - EOP 9............... 14 2.5 Vapor Container Integrity...............................
15 2.5.1 Vapor Container High Pressure - EOP 10...........
16 3.0 RECOVERY PROCEDURES BACKGROUND INFORMATION.................... 17 3.1 OP-3101 S cram Recovery P rocedu re........................ 17 3.2 OP-3102 Large Loss of Load Without A Heactor Scram......17 3.3 OP-310 5 Em e r g e ncy B o r on I nj ec tion...................... 19 3.4 OP-3106 L.O.C.A.........................................
20 3.5 OP-3107 S team Gene rator Tube Rupture.................... 28 3.6 OP-310 8 Fue l Cladd ing Fa ilure.......................... 31 3.7 OP-3109 Natu ral Ci r enlation............................ 32 3.8 OP-3110 Cold Water Accident............................ 35 e
3.9 OP-3111 I nadequate Core Cooling........................ 37 L
3.10 OP-3113 Loss of AC Supply.............................. 40 3.11 OP-3115 S te am Li ne B r ea k............................... 41 3.12 OP-3116 Los s of F ee dwa te r.............................. 4 4 3.13 OP-3117 Re f ue li n g A cc i d e nt............................. 4 7 El A-1
- ~ '
w as[=4
,l.
i g
- e.,
1.0 INTRODUCTION
The Yankee Emergency Procedure Set set is comprised of both event-~-ssed recovery procedures and symptom oriented EOPs. This document provides a compilation of background information for the steps contained within those procedures. Section 2.0 provides information on the five critical safety functions and their associated ten EOPs. Section 3.0 provides information on the 13 recovery procedures.
E E
E E
E
[
E
[
E
[
[
,-1
[
y-c st -
h
?*
1
[w-l 2.0 CRITICAL SAFETY FUNCTION BACKGROUND INFORMATION 2.1 Reactivity Anomaly l
The reactivity critical safety function actions assure that the reactor l
is suberitical and maintained in that condition to minimize the amount of heat generated in the core. In the short term, reactivity is controlled by the l
insertion of the control rods. Borated water can also be added to the primary coolant via the charging pumps, the safety injection pumps, or accumulator to I
either supplement or replace the control rods as necessary.
The reactivity critical safety function symptoms are explicit entry conditions for the actions to be performed by the operator in order to maintain control of the reactivity runction. The symptoms of the reactivity l
procedure represent a spectrum of conditions from an outright failure of the I
reactor to scram (including ATWS) to a successful scram which fails to establish significant shutdown margin, or to any situation in which the l
operator does not have full control of reactivity.
2.1.1 Reactivity - EOP 1 S**p 1 Once a reactivity anomaly is identified, the first step is to manually l
scram the reactor. If this is not accomplished via the normal scram buttons, the alternatives provide other means for scramming or shutting down the I
reactor. Four possibilities are presented:
l 1.
The All-Rods-In switch is immediately available to the operator and I
should be used to start the shutdown while the other three options are being pursued.
I.
2.
BK-1 and BK-2 circuit breakers are located in the Bus Room.
Pressing either trip button will interrupt the power supply and l
scram the rods.
3.
ACS 412 on battery bus 42 is also located in the Dus Room.
Switching it to OFF will remove DC power and scram the rods.
I 4.
If no electrical means will scram the reactor, then boron is the alternate poison to shut down the reactor.
l Emergency boration is achieved by disconnecting the trip circuitry to the charging pumps (i.e., pull the 7-8 fuses), resetting safety injection, and borating from the DAMT with the charging pumps.
Step 2 The second step is to verify that shutdown has been achieved. Either the rods are all inserted or shutdown margin is assured by the boron concentration.
If one control rod fails to insert, the operator is instructed to verify shutdown margin.
If more than one control rod fails to insert, instructions are provided to energency borate the primary coolant.
A-2
)
[,
js ~
g.
b E
Step 3
~
j The third step is to verify that the turbine has tripped in sequence with the reactor trip in order to prevent en uncontrolled cooldown.
If the I
turbine does not trip automatically, it is. esc-ntial to manually trip the turbine either at the MCB or at the turbine pedectal.
If the turbine cannot be manually tripped, the NRVs car be tripped to terminate steam flow to the I
turbine and prevent rapid cooldown. Closure of the NRVs, however, will cause a loss of condenser steam dump and vacuum.
Step 4 A deviation in normal Tave can be either a symptom, a cause, or a result of a reactivity anomaly. The operator is instructed to verify normal Tave, or to control it with the steam dumps, or to compensate for a reactivity inser-tion with an emergency boration on an uncontrolled cooldown. Finally, the operator is directed to go to EOP $8, "MC Temperature High", if these efforts fail to control a heatup.
Step 5 Once the plant is in a controlled condition, futher action is delineated in the appropriate recovery procedures.
2.2 Secondary cooling and Inventory The secondary cooling / inventory function is the second critical safety I
function to be maintained because of its importance as a heat sink.
Maintaining secondary cooling / inventory improves the probability that neither the main coolant inventory nor the core heat removal critical safety function will be challenged.
From the operator's perspective, whenever the plant trips, the preferred heat sink is the condenser via the steam dump.
If the condenser becomes l
unavailable, the backup mode of cooling is the steam generator atmospheric steam dumps. Along with the desirability of the secondary heat sink comes a danger of overcooling the core. Both reactivity and NDT limits could be i
threatened by an uncontrolled heat removal.
In order to maintain this critical safety function, inventory (level) i g and pressure controls are essential. Therefore, the secondary l E coo ing/ inventory critica safety function EOPs are oriented to accommodate the following kinds of challenges to the secondary cooling / inventory function:
1lI 1.
Any circumstance that results in steam generator high pressure (EOP 2) l 2.
Any circumstance that resulte f n steam generator high level (EOP 3) 3.
Any circumstance that results in steam generator low level' (E0P 4) 4.
Any circumstance that results in steam generator low pressure (EOP 5) l A-3 I
J
[5Q da Kd'(, y?ta, P
/.);
?..
U e.
F L
2.2.1 Secondary High Pressure - EOP 2 Step 1 900 psig corresponds to a saturation temperature of 5320F and is near the low set code safety valve on the S/G. This condition indicates inadequate P
heat removal from the primary side. Consequently, if this condition exists, W
the reactor must be scramed and the turbine tripped.
F Step 2 The NRVs represent a relatively likely and easily verified cause of secondary high pressure. The first two alternatives reflect required I
responses to inadvertent NRV closure. The reactor scram required above 60%
power reflects a conservative limit to prevent lifting secondary safety valves and a primary system high pressure excursion. From below 60% power, a single closed NRV may be re-opened. In all cases, two or more closed NRVs require a L
reactor scram.
Step 3 The throttle and control valve also represent possible and easily verified causes for secondary high pressure. The response to this potential is to match the primary and secondary power levels. If a turbine throttle valve closes, the associated control valves must be closed using the test devices. The throttle valve is re-opened and turbine loading is controlled by the control valve operation.
Control valves may be controlled with the turbine governor or test device depending upon valve affected and type of failure.
Step 4 The condenser backpressure is another possible and easily verified cause of high secondary pressure.
It, in turn, may be caused by the circulating I
water system or air in leakage or air ejector failure. There is an auto turbine trip at 18" vacuum.
Step 5 An increase in secondary pressure, especially if it is located in only one S/G, must alert the operator to check further for signs of primary to I
secondary leakage.
If found, EOP $6, " Secondary Radiation High", provides the appropriate actions.
Step 6 If secondary pressure is restored to normal, proceed to other duties, the problem has been discovered and corrected so conditions may be restored to I
normal.
If all these efforts have f ailed to restore secondary pressure, the function is being severely challenged and manually scramming the reactor is appropriate to regain control of secondary pressure.
A-4
L Y.
['J *.
7"4. "
7 p
e d' s.A F
Step 7 L
The actions in this step assume that the plant is tripped at this point in time. The operator is directed to control secondary pressure through use e[
of the steam dump to the condenser. In the event that the condenser is not available, the alternative is to use the atmospheric steam dumps to control secondary pressure.
L Step 8 Once the plant is in a controlled condition, further action is r'
L delineated in the appropriate recovery procedures.
2.2.2 Secondary High Level - EOP 3 L
.S t'El Twenty-five feet on any S/G corresponds to the highest reading on the wide-range level instrumentation.
It represents an imminent threat to the steam lines and turbine. Therefore, the reactor scram, turbine trip and feedpump trip are imperative for this condition.
Step 2 Excess feed flow for whatever reason is a verifiable and possibly correctable cause of this symptom. If it is, then directions are provided to I
take manual control.
If even manual controls do not work, the plant must be tripped.
Step 3 l
An increase in secondary level, uspecially if it is located in only one S/G, must alert the operator to check further for signs of primary to i
secondary leakage.
If found, EOP #6, " Secondary Radiation High", provides the l
appropriate actions.
Step 4 l
Once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedures.
2.2.3 Secondary Low Level - EOP 4 I
Step 1 1
-13" on two or more S/Gs correspond to a reactor protective system trip.
I A-5 j
U i
c- -..
7 c
n b* Y:
kl Yk
.::j L
sA 3.
s Step 2 Verifying all S/G level > 10' assures that there is sufficient inventory to provide adequate core cooling. The alternative is to scram the plant since
~
steam secondary inventory is low. The main cx>olant pump in the low S/G is tripped to reduce heat input to that S/G. If the low level is in the S/G with the only operating main oaolant pump, then all steam demand is from that F
S/G. Tripping the one remaining operating main coolant pump will result in y
each remaining operable S/G providing the necessary core heat removal requirements.
F L
Step 3 This step directs the operator to find and then isolate any leaks in the E
feed system which may be the cause of the observed low level in one or more L
steam generators. If it is possible to isolate the leak, the event will be terminated and remvery via Step 4 can proceed. If the leak is found and p
cannot be isolated, knowledge of its location will aid the operator in L
determining the optimal remvery actions to restore and maintain steam generator levels.
{
If it becomes necessary to isolate main feedwater to a steam generator, the plant must be placed in Mode 3 prior to isolating the loop and tripping its main coolant pump.
CAUTION Any steam generator which does not show a level on wide-range instrumentation must be assumed dry even though it may still have 3' of inventory. A dry steam generator may not be fed due to the potential for a severe thermal shock to the S/G.
Step 4 Whether the plant is still operating or shut down by this point, the I
Main Feed System is the preferred method to restore S/G levels. However, if this cannot be accomplished, the plant must be placed in Mode 3 or lower.
Then the various alternate feed mechanisms may be used to restore lavel.
I Finally, if no method of restoring level works, EOP $8, " Main Coolant Temperature High", should be checked for applicability.
Step 5 Once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedure.
2.2.4 Secondary Low Pressure - EOP 5 Step 1 Lew secondary pressure may be due to various correctable causes such as excess turbine load, open steam dumps, or any of several steam traps which I
could be isolated. Failing att'empts to restore pressure, however, the plant must be reduced to Mode 3 or less.
CAUTION NRV closure is not allowed in Modes 1 or 2.
A-6 I
J
{ % 5 'y
' J I[.
[!
i 2
c.'- N h \\.L./h,.
f.
4b r
- w
.a s a.
s..-
Step 2 If either Action or Alternative il solved the problem, then the procedure may be terminated at this point. If not, then all NRVs are to be tripped to bottle up the system. This will assure that any serious loss of steam and possible overcooling effects will be restricted to just one S/G.
Step 3 Identification of the affected S/G is important so that steps can be taken to lessen the effect on the plant. Several indications have been listed as an aid to the operator in identifying the problem S/G, i.e.:
One S/G may exhibit lower steam pressure than the other because of increased steam flow out of the leak.
Visual verification may be a means of identifying the affected S/G.
Steam flow / feed flow mismatch between S/Gs may help identify the affected S/G.
Cold leg MC loop temperature may be lower due to excessive steam flow out of the break.
S/G levels may identify the problem S/G since low steam pressure may cause excessive steam flow and attendant level rise (swell).
Step 4 This step directs the operator to discontinue feed to the affected steam gene r ator (s). Terminating feed to the affected steam generator will limit the energy release from the break and minimize the resulant Main Coolant System cooldown.
If NRV closure has isolated the break and stabilized the secondary pressure decrease, the event is terminated.
Step 5 Securing the main coolant pump in affected loops will limit the amount I
of primary to secondary heat transfer that takes place. This will limit the Main Coolant System cooldown.
Step 6 Restoring level to the unaffected steam generators will insure their I
availability as a heat sink for the Main Coolant System heatup which will occur once the steam line break is isolated.
A-7 I
p
- v. '
/a W p
[
J o t.Ul. bis h
{
Step 7 Use of the atmospheric steam dumps will be required to control Main Coolant System temperature once the steam line break is isolated and the r
f subsequent Main Coolant System heatup begins.
I I
Step 8 l
once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedures.
2.3 Main Coolant Inventory The main coolant inventory function is the third critical safety l
function to be maintained by the operator. Its procedures are designed for diagnosing low probability, high consequence situations such as LOCAs, steam generator tube ruptures, and steam line breaks of such magnitude as to l-challenge the Main Coolant System inventory. The function of main coolant inventory is influenced by feedbacks from either the reactivity critical I
safety function or the secondary cooling / inventory critical safety function.
The operator's basic objective with this function is to maintain appropriate l
ir./entory in the Main Coolant System (MCS) at all times, keeping the core I
covered, and maintaining effective cooling. Inventory control is normally maintained automatically by the charging and volume control systems. In the l
ovent that MCS inventory and/or pressure becomes inappropriately low due to a breach of the MCS or excessive cooling of the MCS from excess steam flow, MCS I
inventory is maintained by injection of borated water by the Charging System, safety Injection System, or accumulator.
The main coolant inventory critical safety function entry conditions are outlined in two procedures:
(1) "High Secondary Radiation" and (2) " Main Coolant Pressure Low".
The second, EOP 67, " Main Coolant Pressure Low", is the basic procedure for response which replaces normal controls with safety systems pumping for level and pressure in the MCS. The result is an alternative but stable and safe plant condition.
Recognizing that the basic method could aggravate the special case of a Steam Generator Tube Rupture (SGTR), however, a second method is presented as EOP 66, " Secondary Radiation High".
This method will also handle a loss of main coolant inventory but does so in a manner which would allow for a SGTR.
It is used whenever the symptoms indicate the possibility of this special case.
2.3.1 Secondary Radiation High - EOP 6 Step 1 The first step of this procedure is to verify that a break in the Main Coolant System / Secondary System boundary exists. The parameters which are individually verified in order to make this determination have a unique response in the presence of such a breach. Hence, the alternative to Step 1 is to proceed to EOP 57, " Main Coolant Pressure Low", in the event that the I
specified parameters cannot b? verified.
A-8
I' 6
7-:~*y, ~,
.a re-17 f;
- n.
t n
[
t
{.
C 4 e*
Diagnosis of this event can be done by observing the response of
[
specific parameters:
CAUTION:
When LPSI pumps are tripped, charging or intermittent use of
{
LPSI may be needed for inventory addition. This caution warns the operator when performing the rapid cooldown (shrink) and depressurization of the MCS that LPSI pumps p
after being secured may need to be re-initiated or charging L
pumps may need to be re-initiated in order to maintain sufficient MCS inventory. With LPSI secured HPSI discharge pressure is limited to 1 850 psig.
Step 2 -
Identification of the faulted S/G may be achieved from several observations. High steam line radiation is most likely since radioactive MCS liquid is leaking into the secondary side of the steam generator through a tube leak. The additional MC liquid i
introduced to the secondary side of the S/G causes the S/G level to rise and feed flow to decrease while steam flow remains essentially
[
constant, resulting in a feedflow/ steam flow mismatch. The faulted S/G may also show a secondary side level increase depending on the size of the break. Chemistry analysis will identify MCS fission products and corrosion products present in the secondary blowdown samples. This will positively identify the faulted loop - however, it takes considerably longer than the first three indications.
The alternative, if the operator cannot identify the faulted S/G, is to depressurize the MC System and equalize pressure with the secondary side of the S/G to reduce the leakage rate. The first
(
action is to shut down the plant. If the leak rate is severe, then scram the plant.
If the leak rate is not as serious, then a plant controlled shutdown is in order. If SI was automatically initiated, trim back the LPSI pumps, one at a time, to limit SI
{
shutoff head to 1 850 psi.
Setting the steam dump to 550 psi will cool the plant down rapidly, thereby shrinking the MC System and lowering its pressure. The operator is instructed to maintain a minimum subcooling of 25%
while reducing MCS pressure to below the low set SV.
The two notes let the operator know that it is possible that a void may develop under the reactor head during the rapid cooldown. This is acceptable as long as core cooling is maintained and 254 subcooling maintained. The object of this alternative is to prevent S/G overfill and spillage onto the ground from the faulted S/G safety valves (low set 935 psig).
Step 3 -
Reactor shutdown is purposely withheld until after the attempt to identify the affected S/G. This is done because the effects of a scram or shutdown on S/G conditions may be larger than the
[
parametric changes which are used to identify the affected S/G.
Caution: Do not proceed with the following ACTIONS until the
[
affected S/G is POSITIVELY identified.
If the S/G was identified in Step 2, then this caution is not A-9 F
ssp N7' gg q
qf)
.h
. sa applicable. If it was not identified, then the alternatives to Step 2 provide a new, stable and safe condition for the plant for sufficient time to allow a detailed analysis to determine the affected S/G.
1 l g Step 4 -
The objective at this point in the procedure is to isolate the l 5 affected loop. The MCP should not be operating in an isolated, faulted loop. However, even if the attempt at isolation does not succeed, the MCP associated with the break should still be tripped i
because forced MC flow through the affected S/G would aggravate the flow rate through the break.
I Step 5 -
Close the loop MC stop valves on the affected loop. Once the loop has been identified, reactor scramed, and MCP is off, then isolating the MC loop will stop the MC leakage through the ruptured tube (s) into the secondary side of the S/G and the accident is essentially over.
The alternative if you cannot isolate the loop, is to rapidly cool the secondary system and depressurize the primary system to l
equalize MC and secondary pressure while maintaining 250F subcooling in the MC System. Reduce MC pressure via pressurizer r
spray to between 820 and 900 psig.
(This is below the low set I
secondary SV of 935 psig.)
Stens 6, 7, and 8 - Tripping the NRV, isolating feed, and securing SI on the I
affected loop, completes the isolation of the loop. Once the MC loop stops are closed then SI to the isolated loop must be secured to stabilize MC pressure in the isolated loop. Closing the non-return valve in the f aulted loop, stops further depressurization on the secondary side of the f aulted S/G, and will help equilibrate sooner. Stopping main feed to the f aulted S/G completes the isolation and prevents overfilling the S/G.
Step 9 -
Once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedures.
i 2.3.2 Main Coolant Pressure Low - EOP 7 Step 1 -
Failures in the normal pressure control systems may be an easily I
correctable cause of low MC pressure. The operator is first directed to check these controls for proper operation, then to correct them where necessary.
Step 2 -
Since Step 1 presents the possibility of correcting the problem, Step 2 is a break point in responding to MC low pressure. If it is I
corrected, then no further emergency action is required, though further investigation cay be warranted. If the low pressure still persists then scram the reactor and continue.
S tep 3 -
This step is to verify that two autcmatic f unctions have occurred. When the MCS pressure has reached 1700 psig, initiation of SI and closure of the non-essential VC isolation valves should i
have occurred.
If not, the alternative to this step instructs the A-10
L K K ***' '.
TTr s
- ^
L h.
- v..
c r
A N iI
,. us e Las ua operator to manually initiate SI and to close the non-essential VC isolation valves. In either case, the purification pumps are e
tripped once the non-essential VC isolation valves are closed.
This is done to prevent damage to the purification pumps once y
PU-MOV-541, the pumps suction valve, is closed.
Caution: With a loss of MC pressure but without VC level or VC pressure increase, then consider EOP $6, " Secondary Radiation High".
A Steam Generator Tube Rupture (SGrR) is a special loss of MC inventory in that it requires a different method for treatment. EOP (6 provides an alternative method which will handle a loss of MC inventory but not aggravate an SGrR.
{
Step 4 -
Component cooling water flow to the MCPS is verified to ensure proper MC pump cooling exists.
p Step 5 -
VC non-essential isolation has been initiated automatically or L
manually. To completa the isolation, the MC bleed trip valve TV-222 must be tripped manually. This will reduce the MC System inventory loss and aid in limiting the pressure reduction or aid in
(
its restoration.
The alternative if TV-222 cannot be tripped is to close the bleed f
line root isolation valve, CH-MOV-525.
Step 6 -
Verify SI flow when MC pressure is less than the shutoff head or 1500 psig. A flow indication will verify that the SI System is operating. If no flow exists, the operator is directed to manually align the system. If that still does not get SI flow, then initiate full charging flow.
Step 7 -
The operator is instructed to trip all Main Coolant Pumps (MCPS) if I
the MCS pressure is < 1200 psig. This procedure criterion is based upon accident analysis consideration such as excess loss of MCS inventory out the break due to MCP operation and concerns of core uncovery should the MCPS be tripped at a later point in the event.
Step 8 -
Verify SI-MOV-1 is closed at
-70" on the accumulator. This is an automatic function which should be verified because, if it fails to I
occur, the accumulator could blow nitrogen into the MCS rather than SI.
A key-locked switch may close SI-MOV-1 if it fails to close automatically.
Step 9 -
At 19' in the SI tank trim back to 2 SI trains operating. With 3 trains running at 19' there nay be a cavitation problem due to low I
suction head. Two trains are all that are necessary to have in operation according to the accident analysis, so trimming back to 2 trains should not affect oore ocoling and it should prevent pump cavitation.
1 A-ll I
l
9 ~ >. P' n' g..
p-p g
eng w ---~
f l,'.
t, 6'
S u.:..-
y Step 10 - At 11' in the SI tank, the operator is directed to switch over to the VC recirculation system. Obviously, a VC level indication is also required to complete the transfer.
If, for any reason, this cannot be done, then a series of alternatives are offered. It is imperative that some source of borated water be delivered to the MCS.
Step 11 - Once the plant is in a controlled condition, further action is A
delineated in the appropriate recovery procedures.
2.4 Core Heat Removal
~
L The purpose of the core heat removal critical safety function is to ensure the integrity of the core. This is accomplished by first l
assuring the mechanical integrity of the Main Cooling System (MCS) as a
^
water and/or pressure retaining vessel, then assuring adequate core cooling by delivering sufficient water to the MCS and removing residual p
and decay heat from the core.
L The core heat removal critical safety function entry conditions are identified in two procedures:
(1) " Main Coolant Temperature High" and (2) " Main Coolant Pressure High".
These procedures focus the operator on both the absolute and the relative conditions of both temperature and pressure. That is to say that, in either case, simple high temperature
{
or high pressure must be relieved.
But, also in either case, one parameter may be high with respect to the other. Normal temperature may i
be too high if pressure is inadequate to prevent boiling. Likewise, normal pressure may threaten NDT limits if temperature is too low.
I Generally speaking, these two prc :cdures provide for relieving high temperature and pressure while assuring adequate core cooling but
(
avoiding mechanical failures due to pressurized thermal shock.
2.4.1 Main Coolant Temperature High - EOP 8 l
Step 1 -
Restore MC temperature with normal controls. This step instructs the operator to regain MCS temperature by use of the normal controls of the plant. Driving control rods into the core to l
reduce MC temperature or increasing the turbine load, using more steam will draw more heat from the core or inserting more poisons (Boron) into the MC System to reduce core power, thus reducing MC l
temperature. The alternative, if MC temperature cannot be reduced quickly enough by normal means, is to scram the reactor and further I
reduce MC temperature by use of steam dumps and feeding steam generators to regain level.
If the plant is in Mode 5 or 6, increasing shutdown cooling flow or component cooling flow will reduce MC temperature.
Step 2 -
If Step 1 was nuccessful and main coolant temperature is now controlled, this step instructs the operator to address his I
attention to normal duties.
1 A-12 I
L 5
L l1 r
s ev If not, the alternative to this step instructs the operator to use all possible means to establish temperature control through use of y
the secondary system as a heat sink for the MCS. This is a powerful step in that the S/Gs can be provided with feedwater f rom
{
a variety of sources through a variety of flow paths, hence, availability of the secondary system should be assured.
(
The note included in the alternative is to remind the operator that L
in order to establish natural circulation, the steam generator saturation temperature must be less than the temperature of the hot leg. The operator can cause this situation to exist through use of the steam dumps to control secondary pressure at the desired g
condition.
I' Step 3 -
Initiate SI if continued attempts to bring MCS temperature under k
control do not work, then MCS cooling must be established via primary feed and bleed (SI on and open the PORV).
If SI is not' operable, then all charging must be initiated to get SI into the core.
(%
Step 4 -
Verify core exit thermocouples less than 6500F (6500F is saturation temperature for 2200 psig). If E pressure is - 2000 psi, SI will be of no benefit since its shut off head is 1550 psig. Charging will be the only pumps available to pump SI against 2000 psig MC pressure. The alternative, if core exit thermocouples are greater than 650 F, is to open the PORV to reduce MCS pressure via the 0
pressurizer steam space and allow SI to flow into the core when MCS pressure drops below 1500 psig. The mass discharged out the PORV is recoverable for recirculation flow if the secondary heat sink is not restored in a reasonable timeframe.
[
Step 5 -
While the MCS cooling is being provided via primary feed and bleed (SI and PORV open) major efforts should be directed in restoring the secondary heat sink. If secondary cooling is not restored, the
[
alternative is to continue MCS core cooling via SI and the open PORV. When the SI tank level is depleted, change over to SI recirculation flow f rom the VC.
Sump level is required. S tep-by-
{
step instructions are given in the " Loss of Main Coolant" procedure, OP-3106. A note warns the operator if MC System cooling decreases the MCS temperature. The operator has to consider MCS pressure limits since challenges to NDP may exist.
(Refer to OP-3102, " Steam Line Break" for NDT Curve.)
Securing LPSI pumps limits SI shutoff head to - 850 psi.
Securing HPSI limits SI shutoff head to - 250 psig.
J A-13 a
f Step 6 -
This step addresses control of SI and charging flow once saturation margin is recovered. The operator ir instructed to regulate SI and/or charging flow in order to maintain the desired saturation
{-
margin. This is done to match SI flow with the decreasing decay heat load.
F Step 7 -
Once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedures.
2.4.2 Main Coolant Pressure High - EOP 9 Step 1 -
Decrease MC pressure by proper control of the pressurizer heater / spray, charging /MC bleed or SI Systems. The operator is instructed to decrease high MC pressure by the use of normal controls. If pressurizer heaters did not shutoff, then shut them off manually.
Initiate pressurizer spray to reduce MCS pressure.
(
Cut back or secure charging or increasing bleed flow to reduce MC pressure. With a lower than normal system pressure and an SIAS, the operator may have to trim back SI pumps. Securing LPSI pumps
{
with HPSI pumps operating, limits SI shutoff head to -850 psig.
Trimming back all HPSI pumps limits SI shutoff heat to -250 psig.
If, during a steam line break, SI is initiated due to MC shrink SI must be terminated at shutoff head of SI with no flow
(
L indication if secondary cooling is available. Attachment A, Steam Line Break of OP-3115, gives these instructions for termination of SI.
The alternative to Step 1 is to open PR-SOV-90 and PR-MOV-512 to decrease MCS pressure.
Close the hydrogen supply to LPST when PR-SOV-90 is actuated since the rupture diaphragm will rupture and spill into the VC.
Hydrogen will flow freely out of the LPST to the VC.
Step 2 -
When LTOP is armed, check for correct operation.
If it is not required, do not use the alternatives to Step 2.
The alternatives
{
are intended for use when LTOP is required but is not operating correctly.
Given that situation, secure the pumps which could be causing the
[
problem or open the PORV (PR-SOV-90) and its block valve (PR-MOV-512).
Caution: Given the situation which has potential for mechanical damage to the main coolant boundary, it is most prudent to avoid operations which could shock the system.
.J A-14
[
r
%u n, e
m=q f
- y, M
3 e
e u
Q g ~'
h.,
3 wt> d Thisstepinstructstheope(rato.%,,
Ial thedissin coolant
[
Step 3 -
to t..
j 6
temperaure at an appropriate value for current plant conditions.
The control of main coolant temperature in this addresses two concerns:
1)
A heat up has brought about the pressure increase.
2)
A cooldown is in progress in which NDT limits may be challenged.
Each concern will be dealt with separately, using the same controls.
MC Pressure High Due to MCS Heatup If the plant is tripped, the operator must regulate the steam dump (s) to maintain an appropriate cooldown and avoid overcooling.
If a cooldown is in progress due to a reactor / turbine power mismatch, the operator must either match the power or initiate a reactor / turbine trip prior to reaching NDT limits.
If the overcooling is due to excessive S/G feedwater flow, the operator must regulate S/G feed to maintain MC temperature.
Step 4 -
Once the plant is in a controlled condition, further action is delineated in the appropriate recovery procedures.
The notation to Step 4 is included as a reminder that, per Technical Specification 3.4.8.1, some situations may require a cold shutdown.
2.5 vapor container Integrity
[
The objective of the vapor container integrity safety function is to L
prevent major radioactive release by maintaining the integrity of the vapor container. This is achieved by assuring containment isolation, containment pressure and temperature control, and combustible gas
(-
control. Containment isolation ensures that all normal containment penetrations are properly secured upon the appropriate isolation signal. While the ultimate heat sink function is passive in the vapor container shell, the operator will need to monitor VC temperature and pressure for conditions requiring VC recirculation cooling. Combustible gas control is needed to prevent containment overstress caused by hydrogen gas detonation. Hydrogen gas is removed by venting through the plant vent stack charcoal filter (or by hydrogen recombiners). The containment recirculation fans also help in combustible gas control by redistributing the hydrogen gas throughout containment, thus, preventing the formation of flammable pockets of hydrogen gas.
~
b A-15 E.
nb f
h agl,,
~
w.>
u n:
2.5.1 Vapor container High Pressure - EOP 10 Step 1 -
Increased containment pressure is an,important diagnostic tool in differentiating the classic events, such as LOCA, SGTR, steam line breaks in and out of containment, etc.
(
Besides these events, however, apparent or real pressure increases can occur for a variety of relatively benign reasons. The alternatives listed reflect the more likely and correctable causes.
Step 2 -
If VC pressure < 5 psig and stable, the apparent cause has been corrected and normal power generation may resume unless other f
serious conditions have developed affecting plant operation. The L
alternative, if VC pressure is not less than 5 psig, is to scram the plant and initiate SI.
Then bypass CCTV 205 and 208 to assure component cooling for MC pump cooling and initiate VC isolation,
{
since the only way VC pressure can quickly increase to _> 5 psi is f rom a primary or secondary system breach inside containment.
Opening CCTV 205 and 208 allows component cooling to circulate through MC pumps inside containment and return to be cooled outside containment with the possibility of carrying radioactive MC outside the VC.
Step 3 -
This step instructs the operator to start the post-accident H2 recirculation fans. The purpose of this step is to insure a uniform distribution of any hydrogen gas which may be present in the containment. This action will preclude the formation of pockets of hydrogen gas in flammable concentrations.
Step 4 -
If VC pressure is > 42 psig, the operator is instructed to vent the VC in order to maintain pressure below 42 psig. Venting the VC will most likely result in a release of radioactive material to the environment. This controlled release is preferable to the uncontrolled release which would result should a VC rupture occur. Forty-two psig was chosen as the pressure at which action is taken because it is above the pressure calculated in the accident analysis yet lower than the VC burst pressure.
Step 5 -
Once the containment pressure is under control and stable, the operator is directed to his other duties.
A-16
} (-
u 44
- i. i.
p f
i y
I w'/ w v com tAs e
3.0 Recovery Procedure Backoround Information
[
3.1 OP-3101 SCRAM RECOVERY A plant trip trom power can be manually initiated or initiated r-automatically by the reactor protection system, turbine, steam generators or plant electrical systems. Technical Specification Table 3.3-1.
In the event a Reactor Scram is required and has not occurred automatically or the reactor fails to scram when a trip is initiated, this is identified as an " Anticipated Transient Without A Scram" Event (ATWS Event).
I This procedure provides the necessary actions to ensure the reactor is placed in a safe shutdown condition for this event.
l^
Restart tripped main coolant pumps as soon as possible and leave all pumps running unless a bonifide loss of main coolant pressare has caused E
automatic initiation of the safety injection system. If low main coolant L
pressure has caused automatic initiation of the safety injection system, and the MCS pressure decreases to 1200 PSIG and SI flow is verified, immediately trip all operating main coolant pumps.
7 NOTE: Cavitation is an indication of loss of overpressure. Check MC pressure versus highest observable MC temperature and/or verify the MC saturation margin on the saturation monitor.
Manually and automatically initiated plant trips that do not result in auto bus load shedding and reenergization of the No.12400 volt station service bus are covered in Attachment A of the procedure.
Plant trip conditions that result in automatic isolation and l
reenergization of the No. 1 2400 volt station service bus are covered in Attachment B of the procedure.
Flant trip conditions that result in automatic isolation and deenergization of the No.12400 volt bus are covered in Attachment C of the I
procedure.
Attachment D covers the Auxiliary operators (both primary and secondary AO's) actions required on a plant trip or manual scram.
I 3.2 OP-3102 LARGE LOSS OF LOAD WITHOUT A REACTOR SCRAM DISCUSSION Altbough very improbable, two conditions exist that could cause a large loss of plant load which would not result in an immediate and direct reactor scram.
I 1.
If, by some fault on the interconnecting systems or through operating error, certain circuit breakers are opened, the generator could drop to auxiliary load level without a reactor scram.
A-17 I
J
L
.- s.z.,
re.
,~s
~vm f!
'f
.h
!]
.4
!a::Y $b 5%
2.
If there was a failure in the turbine generator permissive circuitry and because of scrne plant f ault condition the turbine generator was tripped, all load osuld be lost without a reactor scram.
This accident could result in the automatic opening of the pressurizer solenoid relief valve, PR-SOV-90.
The operator must re-affirm closure at the proper reset point or close PR-MOV-512.
BASIS Step 1 A manual scram is very important since the turbine has either tripped or cut back steam demand considerably and reactor power must be drastically
{
redt.ced.
If the manual scram does not drop all the control rods into the core, then comence all rods in while initiating Emergency Boration (OP-3105) while another operator proceeds to the bus room to open BK-1 and BK-2 Scram Breakers and also de-energize the DC power to the control rod magnetic latch coils which will allow all rods to drop into the core. Once the scram is assured, initiate " Scram Recovery" procedure OP-3101 for plant shutdown instructions.
Steos 2 & 3 Since reactor power continued while the normal heat sink diminished - the operator could expect high MC temperature and pressure.
MC high pressure, secondary high pressure plus PR-SOV-90 alarms may actuate.
NOTE 1:
Lists indications to look for to verify PR-S07-90 actuation.
NOTE 2:
List warning signs of a stuck open PR-SOV-90.
Step 4 i
Classify the emergency, OP-3300. Depending on severity, the "E" plan may be actuated which will bring more plant personnel into action to help in controlling the accident and recovery.
S tep 5 Since the plant has sustained a severe temperature transient, further checks are necessary to assure fuel integrity. If fuel clad f ailure is suspected, initiate OP-3108, " Fuel Clad Failure."
Step 6 If PR-SOV-90 actuated, the LPST hydrogen supply must be secured at the MC Board.
I A-18
TN'. UN, e&
NU FM 8
[\\\\
'ycj j
i
[;s f,ua;: t "2
p n
d Y d4 &&
S
- A '
3.3 OP-3105 EMERGENCY BORON INJECTION i
DISCUSSION I
Emergency boron injection is available to back up or augment the shutdown capacity of the control rod system. Three specific cases are cited which I
require this activity, but it is an option available to the operator at any time that he questions the reactivity or shutdown margin of the core.
I By analysis, the control rods, when inserted, provide ample shutdown margin for all transients except a rapid, uncontrolled cooldown. In that case, the rods are adequate but not ample. For conservatism, therefore, an emergency boration is used to guarantee ample shutdown margin for sny I
uncontrolled cooldown.
Secondly, the rods are only useful if they successfully scram. While the I
drive system for a scram (gravity) is reliable, it is conceivable that I
mechanical interference could occur. For one control rod, no action is required. Actually, for all cases except the cooldown, the number of stuck I
rods required to have any real effect is large.
But, for conservatism, an emergency boration is specified for two or more.
Finally, an emergency boration is specified for any non-specific reactivity anomaly.
BASIS I
Step 1 i
The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 Any situation which requires an emergency boration also requires a plant I
Step 3 I
Classify the emergency.
Steps 4 to 8 Align the charging system for full, three pump, flow of boric acid.
Step 9 OP-4708 provides guidance on how long to pump boric acid.
I A-19 I
)
cm w ~~.
f w.. q. v :-~. 2
{
'}; j
," \\
- /t.-q h
- na m.# L. %,4"M E
Step 10 The BAMr level indication will verify how much boric' acid actually went into the system. With this information, further calculations of shutdown margin will assure the operator of control.
Step 11 to 13 Normalize the charging system.
Step 14 NRC notification may be required.
3.4 OP-3106 L.O.C.A.
DISCUSSION A loss of coolant accident is defined as a breach of the main coolant system boundary which results in the interruption of the normal mechanism for removing heat from the reactor core and exceeds the available capacity of the charging system.
The purpose of this procedure is to ENSUPI ADEQUATE CORE COOLING BY CONTINUING TO PUMP FOR PRESSURE AND LEVEL IN BOTH PRIMARY AND SECONDARY SYSTEMS UNTIL THE PROCEDUPS CALLS FOR OTHER ACTION.
The primary system pressure decreases at a rate which is a function of the break size. When the main coolant system pressure has decreased to 1700 psig, or the vapor Container pressure has increased to 5 psig, automatic initiation of the safety injection system occurs to provide flow to cool the core and prevent fuel meltdown.
i This procedure covers any loss of main coolant which requires SI initiation.
"DO NOT" attempt to isolate the MC leak by closing loop stop MOV valves.
If a loss of main coolant occurred while in Modes 4, 5 or 6, rather than follow this procedure, the primary concern of the operator is to keep the reactor core flooded and cooled.
Following a LOCA, it a s expected that voids will form in the Main Coolant System unless the system pressure reaches an equilibrium pressure above saturation temperature. The SI System is designed to cope with expected voiding if the main coolant pressure has decreased below the saturation temperature. The operator'is cautioned not to rely on pressurizer level indication alone, because void formation may make this indication misleading.
[
A-20
7~:q.,
Sm' g
(
- m"
-i f
k hN 3
g;.4 e %
~ t A,. (
[]
A Loss of overpressure, based on core thermocouples is the primary indicator of void formation. Recognition of void formation could be based on loss of subcooling. The main ooolant saturation monitor provides a continuous display of the subcooled margin to saturation.
In a LOCA in which the main coolant system pressure does NOT decrease below saturation temperature, the steam generators are the primary means of cooling, supplemented by the SI.
The SI in conjunction with the pressurizer solenoid relief can cool the core as a backup system (feed and bleed method). The charging pumps are also available to supply flow via the loop fill lines for long term cooling.
The steam generators are needed for heat removal for a LOCA situation where the MCS pressure does not decrease below SI shutoff head (i.e., small breaks). Therefore, in a LOCA with _ the main coolant system pressure NOT
[
decreasing to less than SI shutoff head, it is mandatory to maintain level in at least TWO steam generators, and establish natural circulation.
Eoron concentrations, following a large cold leg break, will begin to increase within the core region due to steaming in the reactor vessel. The 0
solubility limit of 47,000 ppm at 212 7 may be attained during the recirculatien phase of long term cooling unless water can be forced to circulate through the core region. Therefore, hot leg injection will be started prior to reaching the solubility limit for boron in the core region, thus reducing the boron concentration.
During a loss of coolant accident, the combined effect of decreasing saturation temperature with decreasing pressure, and injection of colder SI fluid can be a rapid drop in Main Coolant System temperature. This can cause large thermal stresses in combination with a reduction of ductility of the reactor vessel. When these conditions are present along with internal pressure, the structural integrity of the Main Coolant System can be challenged (Pressurized Tnermal Shock). Therefore, specific guidance is provided to allow identification of potential Pressurized Thermal Shock Conditions along with recommended actions to protect the reactor vessel.
BASIS Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 Verify closure of certain valves assures the operator that the MCS pressure reduction is not caused by inadvertent valve operation.
~
A-21
L c-
,\\
s-ti i i
I ff
'i wi%
.L s
Step 3 OP-3101, " Scram Recovery," will secure the remainder of the plant in a normal but rapid sequence.
Step 4 Verification of SI operation assures the operator that the emergency cooling system is operating when required to provide necessary core cooling and MC inventory.
Step 5 If for some reason conditions return to normal (isolation of the leak in Step 2), then certain criteria must be met before SI may be terminated.
[
OP-3219, " Termination for Inadvertent SI Actuation" fills these requirements.
Step 6 Isolating containment prevents radioactivity from leaving the VC.
Resetting TV 205 and TV 208 leaves component cooling available for MC pump operation. VC isolation at 5 psi causes NRVs to close causing loss of condenser vacuum.
(OP-3202 addresses these problems.)
Step 7 Assures the operator that SI water is flowing into the MC system where it is needed.
Step 8 C
Instructs the operator how to reset SI so that he can trim back on pump operation when needed.
Step 9 Trimming down to two trains of SI with 19' in the SI tank is required for NPSH considerations. This action will be required in about ten (10) minutes
(
for a large break situation.
Step 10 The operator checks emergency power available for SI operation, operation of valves, pumps, and instrumentation. The operator starts D/G not already running so that emergency power will be available if loss of AC is experienced on the off site electrical distribution system.
+
A-22
r,-
(
1
/.
.J s %, *A $ W-i Step 11 Main Coolant Pump Operation I
When, and if, the MCS pressure falls below 1200 psig, the operating MCP's are tripped. Operation of MCP's in certain small break scenarios at MCS pressure below 1200 psig may lead to an inadequate mre cooling situation.
The effect of operating MCP's in this regime is to reduce MCS inventory more I
than if the MCP's were tripped. Analysis presented in WCAP-9584 show this effect in greater detail. Thus, the MCP's are tripped at the pressure point up to which their operation has no deleterious effect upon the outcome of the I
accident.
The MCP pressure trip setpoint of 1200 psig is sufficiently low enough to preclude inadvertent tripping of the MCP's during non-LOCA transients or accidents with the exception of large steam line breaks where the MCS pressures (and temperatures) can reach relatively low values. It should be noted that tripping of MCP's is not as crucial in large break situaticas as it I
is for the small break situation.
NOTE:
Flow of mmponent cooling water to the MCP's is crucial to I
prevent damage to the motor bea' ang.
The manuf acturer's recommendation is to trip the MC.P's within three (3) minutes upon loss of component cooling water. Preventing MCP damage is of high priority if the MCP operation is required at a later lI time.
cat"JION :
Do not feed a S/G indicating less than 300 psig is a
- I consideration for a dry or nearly dry steam generator. Adding cold feedwater at a high rate could compound the accident (tube rupture) or f urther decrease MC pressure due to cooldown.
Steps 12 and 13 g
Maintaining 18 ft. feedwater level in the steam generator assures g
suf ficient inventory to provide secondary cooling, help establish natural circulation if required, and provides the necessary heat sink for decay heat removal.
I Initiating heat removal from the reactor plant via the steam generators minimizes the release of additional heat to the VC f rom the break flow.
l Step 14 E
Trimming back to two trains of SI operating at shutoff head and zero flow I
is a consideration to:
1.
Conserve electric power if loss of AC has occurred concurrent with loss of MC pressure.
2.
Keep only the required pumps operating - keeps one in reserve while trying to meet SI termination criteria.
A-23 I
o
,_-c-m - ;
[4^
(
Y L.# L % d ~ b L.
E I
CAffrION :
If conditions deteriorate, re-establish three train operation for maximum cooling and MC inventory.
Sp; 15 k
Initiate recirculation flow expeditiously in the transition from SI tank suction to VC suction.
Circulation of SI to the VC is the long term post-accident method of heat removal from the core. The VC itself acts as a heat exchanger in this case.
Initiation of VC recirculation is necessary when the safety injection tank reaches 11' to prevent pump cavitation and assure proper NPSH. The amount injected (77,000 gallons) assures an adequate VC sump level. However,
{-
trimming back to one train of SI when containment pressure is less than 10 psig is necessary to prevent pump cavitation. Only injection via the NPSI is possible in this mode.
NOTE: 1.
Since the SI pumps are taking suction from the VC sump which may 0
I be at an elevated temperature as high as 250 F, coupled with reduced flow, an increase in main coolant temperature end pressure will be anticipated. If thermocouples increase to 6500F this is an indication of insufficient flow to the core for cooling so proceed to OP-3111, " Inadequate Core Cooling."
2.
Throttling of MOV 46 may be recuired when no LPSI pucps are operating to maintain SI flow f rom the HPSI pump < 250 gpm to prevent cavitation in the operating HPSI pump.
Step 16 Instructs operator to classify the accident per OP-3300 procedure.
Step 17 The following Steps 17.a and 17.b, allow the operator to search for the break location.
Step 17.a - Breaks in SI Piping 3
The SI loop flow indicators are helpful in determining break location by noting asymetry in SI flow delivery, especially in the case where the break is in the SI piping ahead of check valve SI-V-18, 19, 20 or 21.
(The safety analysis for the 2.5" ID Thermal Sleeve Small Break with direct spillage of SI to containment gives the characteristics for this break.)
A-24
{%, ph f.,
y?N 2'(
M Step 17.b - Stuck oprn Prw urizAr. Sole idR$lksfVal
- u..n:
c.
% a m d.e. 4.
If the break is through the pressurizer solenoid relief (PR-SOV-90),
I inflow to the pressurizer would be relatively cooler fluid and would result in a surge line temperature decrease. Outflow from the pressurizer would cause high PR-SOV-90 discharge temperature. A rising or abnormally high pressurizer I
level coincident with decreasing main coolant system pressure are the symptoms of a break in the pressurizer vapor space. A stuck open PR-SOV-90 is possible if PR-SOV-90 has lifted at its set pressure due to some other initiating
- g event. VC humidity, temperature and air particulate monitors may exhibit high g
readings.
High noise level at the Brass Drain Box station and the pressurizer SV/RV I
flow position channels would indicate flow in relief valve discharge piping.
Step 18 Maintaining the secondary systems' heat removal capability is mandatory if the break is small and not capable of removing decay heat. The secondary system is the preferred system for removing decay heat (not the PORV which I
should only be used as a last resort).
If the break is large enough MC pressure will soon become less than S/G pressure.
Step 19 Shutting down Control Room and Switchgear Room fans prevents potentially radioactive outside air from being brought in the Control Room, thus helping I
maintain control room air quality for as long as possible.
Initiate OP-2604, "CREAC System Operability" to maintain clean air in the Control Room during the accident.
Step 20 i
A release of coolant to the containment atmosphere will cause a response on the Accident Area Radiation Monitor (AARM) due to degassification of the released coolant. This response can be correlated to the severity of the LOCA with respect to fuel failure by referring to OPF-3106.4.
Plotting the AARM I
vs. time will be used in evaluating the adequacy of a long term core cooling.
It is important to note that the Area Radiation Monitor detectors can be I
depended upon as being reliable in the POST LOCA environment. The Process Radiation Monitors can be used as a diagnostic tool until high background radiation levels render them inaccurate.
The anticipated response to the Accident Area Radiation Monitor for three specific cases of radioactivity release into the VC is given in Figure OPF-3106.4.
Plotting the AARM response on OPF-3106.4 gives an indication of the 8
severity of the accident and the inadequacy of core cooling.
If Case I values (coolant releases only) are exceeded, some degree of fuel failure has occurred and Procedure OP-3108, " Fuel Clad Failure" is initiated.
A-25 I
I
e a
r; q
r~
[ ',
9 _
g I-b 'O;
'S I
Step 21 If safeguards equipment functions properly, no appreciable fuel failures I
will occur such that the AARM response will be less than Care I results.
However, one must not misinterpret the results for Case II (Gap Activity Release) and Case III (Significant Core Damage). Cases II and III are I
provided for guidance due to a combination of coolant release, gap gas activity release, and release of activity from the fuel itself.
I Step 22 This step is a kickout to SI throttling and termination procedure if the break has been isolated.
Isolation of the break is indicated by increasing MCS I
pressure and subcooling margin. Depending on Main Coolant System temperature, increasing pressure may challenge the reactor vessel (pressurized thermal shock). Attachment A of this procedure provides guidance for evaluating and stabilizing Main Coolant System conditions and for subsequent recovery.
Step 23 This step provided guidelines for cooling the plant via the secondary system during a small break LOCA. Since cooling of the plant is beneficial from the standpoint of system and core cooling, the operator should take
- I normal actions to initiate the described cooldown.
In some certain small break scenarios, the secondary system is the primary heat removal mechanism since the break cannot take away decay heat. As such, secondary system availability is mandatory.
Where steam generator tube leakage is suspected the operator should be
.g aware that as a general rule if fuel damage is suspected, i.e., high incore 5
th r= c "9'* 'adicati "" r " = Pri=*'v o
- "' **** *=> it ** *dv*"'*9* ""
to keep the cecondary side pressure above the primary side pressure in order to minimize radiological releases.
W On Step "C" note that the cooldown described is not excessively rapid and should be controlled to normal operating technical specification restrictions and plant makeup capability.
Step 24 I
The operator is instructed to check for signs of inadequate core cooling. Safeguards equipment have been operating and the situation should be turning around.
If core exit thermocouples are increasing in an uncontrolled I
manner or read higher that 6500F, then OP-3111, " Inadequate Core Cooling" should be carried out immediately. During an accident, the signs of inadequate core cooling must be checked f requently.
Instructions are also provided to monitor for approach to pressurized thermal shock conditions as identified in EOP #9, Main Coolant Temperature Low.
If excessive core cooling is provided, the structured integrity of the Main Coolant System can be challenged.
l l
A-26 I
L c,s e m '- ~_ :
c.-
c r
l
,t rh
- A bhk Step 25 The requirement to place a VC hydrogen moniter in service within 30 minutes of a SIAS provides the function of monitoring the VC atmosphere for hydrogen concentration within a reasonable time. The 30 minute time requirement is mandated by the NRC in NUREG 0737 Item II.F.1, Attachment A.
Step 26 Operation of the VC Post Accident Recirculation fans at the one hour mark assures a well-mixed containment atmosphere, preventing the localized buildup of hydrogen (if released to such an extent).
Step 27 Instructs the operators what steps to take if recirculation suction is lost.
f Step 28 Reminds the operator that MC voiding is possible in this accident and with plant management approval, he may initiate OP-2671, " Operation of the Main Coolant System Vent System" for void detection and possible venting.
Step 29 An assessment of the plant status, i.e.,
system pressures, temperatures, radiation levels, core geometry, et :., must be made by the plant staff prior to placing the shutdown cooling system in operation. Since the shutdown cooling system (SCS) is a relatively low pressure system, an inadequate core cooling situation could result if an attempt is made to get on SCS prematurely. There is nothing wrong with cooling the core at high pressure and system temperatures near (but below) normal operating values.
Step 30 It is important to assure SI integrity by periodically checking the PAB for leakage. If radiation levels permit, a visual inspection should be carried out because local radiation monitor operation may be erratic.
SI recirculation flow MUST be maintained at all times. If it cannot,
{
then injection through all available paths described in the Inadequate Core Cooling Procedure, OP-3111, must be attempted. The procedure discusses ventilation recirculation flow to the PAB.
Step 31 The plant is now in a mode where a timely evaluation of plant equipment and systems can be made in order to determine the proper course of recovery.
Critical MC system parameters should be closely monitored for signs of inadequate core cooling.
A-27 I
L
(
r;.: ~
p I_ '
I' i'
g 3
b b
a Step 32 In a cold leg break situation, the core boron concentration increases since the boron is not removed with the boil-off and SI spillage. The core boron concentration increases slowly such that hot leg injection must be l
initiated at 20-24 hours since the start of the accident to prevent boron precipitation.
The valve line-up achieved in this step assures that adequate flow to remove decay heat is being injected into both the hot legs and the cold legs. If the containment pressure is higher than 10 psig, it is optimum to operate a LPSI pump and two HPSIs to achieve the required flow. It should be noted that the LPSIs are only boosting the HPSIs at this time.
Step 33 This step assures containment integrity is maintained until a plant staff evaluation warrants removal of the VC isolation signal.
Step 34 Any hydrogen buildup in the Vapor Container is handled by OP-2658.
3.5 OP-3107 STEAM GENERATOR TUBE RUPTURE DISCUSSION The steam generator tube rupture procedure requires significant operator
[
action to terminate the transient, more than any cf the primary system L
depressurization precedures. The other " break" type procedures such as LOCA (large and small) and steam line break typically require less operator action, particularly the manipulation of primary and secondary plant controls.
The operator must take specific actions to terminate the release of radiation to the environment. Steam generator tube failures can range from a few gallons per minute leakage to upwards of 400 GPM in the double ended tube break.
The equivalent of a design basis break did occur at Prairie Island on October 2, 1979. Tne break size was the equivalent of a circumferential rupture. The break was a slit 1 1/2" long by 1/2 inch maximum across. At the time of the break fuel integrity was good. From the air ejector radiation
{
monitor alarm to low pressure trip was 10 minutes (all three charging pumps running). Safety injection actuated seconds later. The MC pumps were manually tripped 13 minutes into the transient. The faulted steam generator MSIV was closed 27 minutes into the transient. The plant was depressurized by cycling the PORV. The primary pressure was reduced to the secondary pressure 0
59 minutes into the transient and a 50 F cooldown continued on natural 0
circulation using the condenser and holding a loop Delta-T of 30 F.
A-28
.y c
r I
For Yankee-Rowe the steam generator tube rupture will in most cases, be identified primarily by main steam radiation monitors and air ejector high radiation. The steam generator blowdown radiation monitor will be delayed by approximately 30 minutes due to transit time and is isolated on a SIAS.
Although Prairie Island is a larger plant, Yankee-Rowe will respond similarly. The same parameters used to first identify the accident and later I
identify the faulted loop will be used at ankee-Rowe.
Identifying the failed loop at Prairie Island was by the following indications listed in their order of importance.
1.
High level in the faulted loop.
2.
Lower Feed Flow in f aulted loop prior to trip (- 4% lower).
3.
Survey instrument held to steam lines (10 mr on faulted loop background on other loop).
4.
Steam generator blowdown radiation level and grab sample results.
B ASIS Step 1 B
The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to I
monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 Allows for a rapid controlled shutdown for a small leak.
Step 3 OP-3101, " Scram Recovery" will secure the remainder of the plant in a normal but rapid sequence.
Steps 4 and 5 These steps ensure that emergency equipment is operating when required and in anticipation of further requirements.
Step 6 Identification of the faulted SG is done by comparison to the other
" normal" loops.
I I
A-29 I
I J
L y
- , t y.. a...;
b Mh
[h d i;
' $-[
Step 7 Steam generator tube rupture could release contaminated steam, hence OP-3300, " Classification of Emergencies" must be initiated to classify the emergency.
Step 8 l
This step represents a branch point in the procedure. The operator has two possible solutions to the problem. Case I is definitely preferred; but, if it is not possible then Case II provides a viable solution.
Case I, Steps 1 to 5 Isolates the faulted loop to prevent S/G overfill.
Case I, Step 6 Verifies isolation.
If successful, continue on.
If not, go to Case II l
immediately.
Case I, Step 7 to 14 l
Normalize the system.
Case II, Step 1 1
477 F and 850 psig were chosen as targets for stabilizing the system quickly and safely and to prevent a release through the secondary safeties.
l 478 P is less than 50 F colder than normal Tc (515 F). Therefore, the 0
I cooldown can be as rapid as is physically possible.
850 psig is the shutoff head for HPSI, it is below the safety setpoint and provides adequate l
subcooling.
The drawback of this operation is the likelihood of drawing a bubble under the head. However, given the choice, the decision is consciously made l
to suffer the inconvenience of the bubble in order to quickly remove the danger to the public.
l Case II, Steps 2, 3 and 4 Cut back criteria for SI.
1 Case II, Step 5 Continuation of Step 2.
Case II, Steps 6, 7 and 8 Normalizes the primary to the secondary side.
A-30 1
17'*K QTD E
h;.
p-ty
~'"Q:
u a
Case II, CAUTION once normalized, there is a potential'for diluting the main coolant boron concentration.
Case II, Step 9 Hold the stable condition pending further analysis of the situation and direction from management.
3.6 OP-3108 FUEL CLADDING FAILURE DISCUSSION This emergency condition is defined as a significant fuel cladding failure. The plant design is such that only minor fuel cladding failure can be handled by the purification system during normal plant operation.
BASIS Step 1 The Critical Safety Functions, O?-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to I
monitor and respond to threats to the Critical Safety Functions. Recovery procedures follow a conferred diagnosis of the situation.
Step 3 Secure feed and bleed lines to prevent spreading radioactivity in the MCS throughout the PAB.
Step 4 Survey the valve room to verify the bleed line monitor readings and pinpoint the source of the radiation.
Step 5 Check incore thermocouple readings to determine if cladding damage is indicated and severity.
Step 6 A positive check for cladding damage is MCS sample.
Step 8 The requirement to place a VC hydrogen monitor in service within 30 minutes of a SIAS provides the function of monitoring the VC atmosphere for hydrogen concentration within a reasonable time. The 30 minute time I
requirement is mandated by the NRC in NUREG 0737 Item II.F.1, Attachment A.
A-31 I
J
rm em C
79 h
x i.#-/d g
has
'k
~
s Step 9
~
Analysis demonstrates that the fans are not required during the first hour of the worst case events. However, operation of the VC Post Accident Recirculation fans at the one hour mark assures a well-mixed containment atmosphere, preventing the localized build-up of hydrogen (if released to such an extent).
l 3.7 OP-3109 NATURAL CIRCULATION DISCUSSION A loss of forced reactor circulation could result from any of the following events:
IL 1.
Loss of off-site power 2.
Loss of coolant s
3.
Steamline or feedline rupture
[
4.
Steam generator tube rupture 5.
Loss of component cooling 6.
Loss of feedwater 7.
Fartial loss of AC This procedure should be implemented any time the main coolant pumps are not operating or the shutdown cooling system is not in use, when required for cooling the main coolant system. Main coolant pump forced circulation heat transfer to the steam generators is the preferred method of decay heat removal whenever the plant temperatures and pressure are above shutdown cooling entry conditions. However, there is sufficient natural circulation capability in Yankees plant design to remove decay heat through the steam generators as long as two steam generators are operable with secondary water levels greater than eight (8) feet.
In a natural circulation cooldown, the low flow in the reactor head region will cause this region to remain at a temperature higher than the main
)
coolant temperature. The highest system temperature will be seen on the core exit thermocouples. This requires a slower cooldown rate to be employed. It 0
is recommended that cooldown rates be limited to 20 F/hr based on 100 F subcooling, considering the highest system temperature (core exit 0
thermocouples or TH).
It is possible to reach up to a 30 F/hr cooldown on natural circulation.
Indications of voiding in the main coolant system are unexplained pressurizer level increase. To assure voiding is not occurring stabilize cooldown rate and increase subcooling margin by increasing main coolant pressure by use of the pressurizer heaters.
It should be noted that if natural circulation is taking place in a loss of condenser vacuum condition and the secondary steam pressure has increased to the safety valve setpoint, the loop narrow range instruments may read off scale high. This is an anticipated event and will require the operator to i
A-32 I
g
.q r-S i...')
Q 'Q h
ab.a bh.d a
sa d
I assess heat removal by use of thermocouples and loop wide range temperatures.
In this event it is anticipated the thermocouple temperature should be less I
then 5800F with main coolant pressure at 2000 psig, which will still allow adequate subcooling.
It must be remembered that the basic driving force behind natural I
circulation is convection. Heat must be removed f rom the SGs via steam dumping and the SG pressure should be regulated by the dumps. The pressure must correspond to a Tsat which is lower than Primary T
- h If limited feedwater capabilities exist, main coolant pump operation is not recomended because of the additional feedwater required to remove pump I
heat. Additional feedwater requirements amount to approximately 5-10 gpm per pump in addition to the requirements for decay heat removal.
Do not operate main coolant pumps if MC overpressure does not exist or if I
a LOCA is in progress since mass loss out of the break will be increased with MC pump operation.
B ASI3 Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery I
Procedures follow a conferred diagnosis of the situation.
Step 2 OP-3101, " Scram Recovery" will secure the remainder of the plant in a normal but rapid sequence.
Step 3.a Operation of the steam dump or atmospheric dump will remove heat from the I
steam generators and limit plant heat-up while reactor Delta-T is establishing thermal driving head for natural circulation flow through the reactor core.
If condenser vacuum is lost, then atmospheric steam dump, use of hogging I
jet steam, emergency boiler feed pump operation, steam line drains to atmosphere blow at the auxiliary boiler room and the main steam before throttle valve drains directed to the auxiliary boiler blowdown tank may be I
necessary to have sufficient steam blow to remove core decay heat early in the accident. The availability of particular steam flowpaths will be dependent upon whether the NRV's are open or closed.
I I
A-33 I
g mM e
iz j u/]
)
w g
hg g
I Step 3.b j
Eight feet in two steam generators provides adequate heat transf er W
surface for decay heat removal. However, this criteria is the minimum criteria - therefore, the operator must establish feed to the steam generators to increase their water levels to above the "U" tubes (-18 f t.) as soon as I
possible to insure heat transf er surf ace is above the minimum requirements.
Over cooling should be avoided to prevent a secondary induced primary presssure transient resulting in a decrease in the subcooling margin.
Step 3.c I
By maintaining 100 F subcooling this insures voidless main coolant system 0
flow and also insures adequate power to flow ratio. voids under natural circulation flow could compromise core cooling.
Step 3.d Initiating pressurizer heater operation to return the water phase I
temperature to saturation conditions in the pressurizer insures design pressurizer response.
Step 4 This list of parameters must be monitored mntinuously throughout the procedure to insure that sufficient natural circulation flow is established I
and is adequately removing decay heat.
Step 5 Natural circulation cooldown at a maximum of 20 F/hr while maintaining 0
main coolant subcooling greater than 1000F will provide a controlled cooldown, which will prevent void formation under the reactor head.
If subcooling is I
decreasing then operation of additional pressurizer heaters will increase pressurizer / main coolant pressure regaining main coolant subcooling margin.
Step 6 If natural circulation flow cannot be maintained or regained with intermittent operation of MC pumps, then core cooling must be established I
through the use of Inadequate Core Cooling procedure OP-3111.
Inadequate Core Cooling procedure resorts to last-ditch efforts to establish core cooling.
I I
l I
A-34
r --- e.
t i
M il d's; a A i:
&h L
3.8 OP-3110 COLD WATER ACCIDENT l
L DISCUSSION l
The reactor has a relatively large negative moderator temperature coefficient at End of Life. The effects of this accident are most severe at 5
zero power, and End of Life.
P l
A downward temperature change could come about through a combination of interlock failures and operating errors in any of the following manners:
1.
Cutting a cold isolated loop into a hot operating reactor: Due to failure of the 300F (normally set at 200F) main stop valve interlock and operator error in t.ot matching loop temperatures before cutting in the loop.
1 2.
A very large and rapid increase in feedwater flow while operating the
~
reactor at low power: Due to a serAes of operator errors in not following H
established procedures for operating the feedwater control system.
L 3.
A very large and rapid increase in steam flow while operating the reactor at low power: Due to a failure of the turbine control valve hydraulic y
l system and operator error in not maintaining the turbine load limit oil pressure within the range of the governor oil pressure.
The mechanism of this accident exposes the primary system to a double temperature excursion. After the initial cooling the increase in reactivity could result in a rapid increase in reactor power which would increase temperature. The fast, negative fuel doppler coefficient and negative moderator temperature coefficient would limit the extent of the temperature change.
On the initial cooling portion of the transient, the SI system may be activated. On the subsequent power excursion, the pressurizer solenoid relief valve may operate.
IL BASIS Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 Initiation of OP-3101, " Scram Recovery" insures an orderly plant shutdown.
Step 3 Initiation of OP-3105, " Emergency Boron Injection" insures adequate shutdown when positive reactivity insertion takes place due to the uncontrolled cooldown.
A-35
smt m%
,. ~.
a j (b k
1,h bN sua g:
Step 4 L
Verification of SI operation assures the operator-that the emergency
)
cooling system is operating when required to provide necessary core cooling i
and MC inventory.
5 Step 5 P
The operator checks emergency power available for SI operation, operation of valves, pumps, and instrumentation. The operator starts D/G not already running so that emergency power will be available if loss of AC is experienced
(
on the off-site electrical distribution system.
Step 6 This step gives the operator instruction whereby he may limit the pressure decrease by isolating bleed flow, increase charging flow, and placing all pressurizer heaters in operation.
L Step 7 At low power levels, feedwater is normally in manual control. Changeover f rom bypass feed to normal feed flow could cause excess feed if the manual controls are not properly positioned, therefore, the operator is reminded in this step that manual control could be the cause of the accident condition.
Feed flow / steam flow mismatch or one steam generator level not agreeing with others are signs of excess feed flow.
Corrective action is to manually adjust valve position and/or close feed line MOVs.
I-Step 8 This step reminds the operator that the cooldown can be caused by other I
- means, i.e.,
turbine picking up load or steam dump operation. Step 8(a) and (b) tell the operator how to address these malfunctions.
Step 9 Another possibility for the cooldown is when an isolated loop is cut into the reactor with temperature differential between operating loops and the idle I
loop.
(a) is the direction for solving the loop cooldown problem.
Step 10 This step assumes that the cooldown has been terminated in the previous steps and directs the operator to control the subsequent heatup/ pressurization.
Step 11 If PR-SOV-90 has opened, the operator is directed to reaffirm auto closure at the reset pressure (2350 psig).
I A-36 I
J
I N
Y*.N
)'
da \\.m da b
L If PR-SOV-90 cannot be closed, PR-MOV-512 is then closed to terminate the pressure decrease.
g 1"
The note to this step lists a variety of indications by which the operator can determine if PR-SOV-90 is open.
lh Step 12 P
This step instructs the operator to use forced circulation as the means of core cooling.
In that forced circulation is the most effective means of core cooling.
3.9 OP-3111 INADEOUATE CORE COOLING DISCUSSION This procedure is entered when incore ther;nocouples are greater than 6500F or increasing uncontrollably and/or the loss of saturation margin is imminent and/or as required by the CRITICAL SAFETY FUNCTION procedure.
Ultimately, core cooling by the secondary side is desirable.
In the case where the SI cannot supply adequate core cooling, secondary cooling is an l
absolute necessity. Preferably water is only supplied to steam generators which exhibit level. However, the procedure describes a way to attempt to I
bring a dry steam generator on line to perform cooling.
l Once level in at least one steam generator has been obtained and the loop I
cut in (if isolated) natural circulation should initiate itself.
If, however, it does not, due to incondensibles or voiding, main coolant pump operation is l
suggested to " sweep away" the voids and set up conditions for natural I
circulation. Failing this, cooling of the core reverts to the SI flow out the PR-SOV-90.
Only one main coolant (MC) loop cold leg (TC) stop valve shall be closed at anytime for MC pump restart.
BASIS Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions.
Recovery I
Procedures follow a conferred diagnosis of the situation.
Step 3 If the MC pressure is below the SI shutoff head and no flow is present, the SI piping system is suspect and must be checked. A large break LOCA with insufficient SI flow would be cause for inadequate core cooling. Checking the I
SI system for proper operation is prudent to re-establish proper flow conditions.
I A-37 I
i i
L T~" % p a A
T""Y! P I
~'.
& } rL % [ L ia['-
ii i.,
L
^
F Step 4 An immediately available backup system to the SI is the charging pumps.
It is implicit that, if not already done, the charging pump control must be L
regained by re-setting the SIAS and the WL's and then place all three charging pump control switches in the " TRIP" position to reset the lockout function.
If the Safety Injection Tank is unavailable or empty use recirculation of y
l spilled water frcza the VC, or as a last resort use of demineralized water is allowed.
CAUTION : When using demineralized water for E inventory - causes a i
L dilution. The operator is reminded to monitor reactor count rate for signs of increasing counts and to borate the MCS to correct this problem. Careful control of boric acid addition m
will extend use of demineralized water for MCS inventory and core cooling.
I Step 5 L
This step calls for an evaluation of the adequacy of secondary cooling.
r In that a wide variety of water sources and flow paths exist to get feedwater L
to the steam generators, it is implicit in this step that for the particular method chosen, each component of the entire feed train is to be verified to be in its proper position and operating correctly. Choice of the best method would be delineated in OP-3116, " Loss of Feedwater," which the operator would perform concurrent with this procedure if the normal feedwater flowpath was not available.
Step 6 A likely cause of inadequate core cooling is loss of or reduced SI flow.
A likely cause of loss of SI flow is Main Coolant (MC) pressure above shutoff head of the SI pumps. This step creates further routes to bleed off
{
E pressure; PR-SOV-90 is open and apparently not providing adequate bleed of MC fluid to reduce pressure.
Step 7 Depressurize secondary side by dumping steam from S/G to condenser or atmosphere. This will cool and depressurize the primary system - improve SI
(
flow to the core. If electric power is not available for the atmospheric dump
- manually open locally at the valve operators.
Step 8 Re-establishment of secondary cooling is a long range goal and it is of the utmost importance to feed the steam generator (s) which exhibits level in order to prevent it from going dry.
A-38
my b
TN 'l F"^
kk I
Step 9 I
Trip Main Coolant Pumps if SI flow is established to reduce heat input to MC System f rom MC Pumps and insure core cooling by SI.
Steps 10,11 and 12 I
This set of instructions provides a last option method of establishing secondary cooling when all generators are dry. It provides for isolating a I
sound generator on the primary side, feeding it and carefully placing it in service. Also, MCP operation is allowed once the generator is unisolated, if natural circulation will not self-establish. Check for signs of success in establishing core cooling by observing core exit thermocouples.
Steps 13 and 14 If mre cooling is successful via secondary cooling, then close PR-SOV-90 to stop M': depressurization and reestablish or insure M:: subcooling.
I continue monitoring for sufficient core cooling.
If core cooling is unsuccessful or lost once it was gained, then reinitiate core cooling via SI and PR-SOV-90.
Step 15 As a precautionary measure to protect the control room from airborne I
activity the control room emergency air cleaning system is placed into service per OP-2604, Part A.
Step 16 Once SI tank is depleted, core moling via SI recirculation flow is required. Definitive steps to accomplish recirculation flow are found in I
OP-3106, " Loss of Main Coolant" procedure step 15.
Step 17 Check thermocouples for signs of cladding failure, (i.e., higher thermomuple readings), also check bleed line gamma guard reading and other area monitors for signs that MC contains large amounts of fission products.
Step 18 Start post accident recirculation within one hour of the accident to disburse any hydrogen gas that may have collected at the VC top.
Step 19 Run VC recirculation f ans for 15 minutes to mix any gas mncentration and sample. Note that gas sample could be very radioactive so monitoring is I
advised.
I A-39
I r -
GF"'E
(
F Step 20 L
If a hydrogen gas bubble does forh. ur. der the reactor head, upper y
management will decide on best method of disbursement or venting. Several l
options are suggested to pick from.
i Step 21 F
Further cooldown will be determined by upper management depending on plant conditions. M: samples to check for fuel damage and other cautionary measures will be initiated to help prevent spread of contamination and
(
radioactivity throughout the plant.
3.10 OP-3113 I,OSS OF AC POWER b
DISCUSSION Total loss of AC supply results from a complete separation of the plant H
L from the interconnected electrical transmission system. An autcznatic turbine throttlestop valve trip and reactor scram will accompany the total loss of power. The return of AC supply is subject to transmission line conditions and
(
system operation. The total loss of AC supply emergency procedure will be initiated if both transmission lines are dead. Emergency power is available to maintain the plant in a safe condition.
In this accident, it is vitally important to initiate Emergency Boiler Feed to all four steam generators expeditiously. A total loss of AC supply will result in a loss of Main Coolant flow and feed flow, causing a MC pressure-temperature excursion and possible operation of the pressurizer power operated relief valve (PR-SOV-90) and the possible operation of the main steam safety valves.
The formation of voids in the reactor vessel is possible during this accident, therefore, operators are cautioned that f alse level conditions could p
exist in the pressurizer.
It is of utmost importance to maintain MC system L
overpressure greater than that corresponding to the saturation temperature to prevent voids from forming in the reactor core.
(
Three cases will be considered depending on the available service water and component cooling pumps in order to re-establish power to at least one of each of these pumps as soon as possible.
Case I:
No.1 service water pump and No. I component cooling pumps in service.
Case II:
No. 3 service water pump and No. 2 component cooling pump in service.
Cas'e III: No.1 service water pump out of service and No.1 component cooling pump in service.
A-40
(
q*..
W C'"+-
t+
- h...
's h*
h @y
-Q k
/
\\
F.
ja
.] j ( g 4-->
The procedure is written to require only the Control Room - Secondary
(
Operator to leave the Control Room to perform electrical switching. This L
leaves the Control Room - Primary Operator to monitor the reactor plant and re-establish pressure control when power is restored.
(
The completion of this procedure will leave the plant in the following FINAL CONDITIONS.
1.
A total loss of AC condition exists and the plant vital equipment is being
[-
supplied through the operation of emergency diesel generators, or 2.
Restoration of Normal AC supply af ter a total loss of AC, OP-2501, is in progress.
3.11 OP-3115 STEAM LINE BREAK DISCUSSION
(
This procedure should be followed for a steam line break g any feedline L
rupture on the steam generator side of a feedline check valve.
Main coolant temperature and pressure would drop very rapidly. With the
{
current mode of plant operation (i.e., boron shim, essentially all rods out of control), the reactor would remain subcritical after the scram even if the highest worth control rod failed to drop.
In time main coolant pressure would be restored via the SI pumps to over 1500 psig.
(
The rapid decreasing main coolant temperature would cause an increasing temperature difference across the reactor vessel wall and consequent increasing thermal stresses. In addition, the decreasing reactor vessel
{
temperature could result in reduced ductility of the reactor vessel material. The combined effect in association with stress from internal pressure could cause existing small cracks to propagate deeper into the wall, challenging the integrity of the vessel. Guidance is provided in Appendix A for recognizing and avoiding these conditions along with subsequent restrictions should potentially damaging conditions have been encountered.
(
The precise action to be taken will be greatly influenced by the magnitude and location of the break and the conditions resulting after the break. Therefore, the subsequent operator action has been broken down into two cases. Case I - Unisolated Steam Line Break Between NRV and Steam
[
Generator Case II - Steam Line Break af ter NRVs. Higher supervision should be notified as soon as possible so that all available assistance may be rendered promptly.
For medium to large breaks a rapid cooldown will result in a dry pressurizer with voiding in the primary system. As system pressure is
{
recovered by SI, the volds will collapse and the pressurizer level will be restored with water phase temperatures less than saturation. Although the pressurizer emptied, the bubble will not be entirely drawn into the hot leg.
(
For a single steam generator blowing down, the break will in essence self-L isolate as the faulted steam generator goes dry.
(-
A-41
IL g
J;
!.2 M M
i a
d If the rupture were sufficiently large, the blowdown would cause main f
coolant temperatures to decrease below the temperature of the intact steam generators. A heatup and repressurization will commence f rom decay heat input and heat transfer from the hotter intact steam generators. If adequate steam F
generator inventory exists (18'), steam dump should be used to minimize this L
heatup by attempting to hold primary temperatures at a minimum point.
If temperatures cannot be held, the primary system will expand and may p
L cause PR-SW-90 to open. If this condition persists, two phase flow may occur through PR-SW-90.
Corrective action includes initiating bleed flow to contain the swell and preserve the steam bubble. If the swell continues but f
the system pressure is kept up to insure subcooled conditions, the solenoid L
relief PR-S07-90 will handle the expansion readily either as steam, two phase, or solid water relief and the spring loaded safeties PR-SV-181 and 182 will p
not actuate.
L The process variables referred to in this Instruction are typically monitored by more than one instrumentation channel. The redundant channels should be checked for consistency while performing the steps of this I nstr uc tion.
{
The pressurizer water level indication should always be used in conjunction with other specified reactor coolant system indications to evaluate system canditions and to initiate operator actions.
B ASIS Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recover y Procedures follow a conf erred diagnosis of the situation.
Step 2 OP-3101, " Scram Recovery" will secure the remainder of the plant in a normal but rapid sequence.
Steps 3 to 10 Set up the Engineered Safety Features systems (VC isolation, SI and NRV's).
Note that flow f rom the SI accumulator into the MCS is not anticipated to occur under steam line break conditions. Injection of a significant amount of water by the accumulator is an indication of loss of MCS inventory.
A-42
em 77.Pb s
,,k '.,L C
g)h ka e
Step 11 If a secondary system rupture occurs, OP-3300, " Classification of Emergencies" should periodically be re-evaluated to ensure that the event classification is based upon the current situation or an anticipated degrading
(
condition. The Area Accident Radiation Monitor (AARM) should be continuously monitored to assist in determining plant condition.
Step 12 The NRV system is a break point for this type incident. If the break is p
upstream of the NRV, the Case I is applicable. When the break is downstream L
of the NRV, then Case II is applied. In the event that an NRV fails to function in conjunction with the steam line break, the event would appear to the operator and be correctly treated as a case I event.
Case I, Steps 1 to 4 Isolate the f aulted SG.
Case I, Step 5 Provide the heat sink for the sound systems.
Case I, Step 6 l
Steam dump to the atmosphere or the condenser should be initiated to I
control Main Coolant System temperature. The purpose of this step is to prove that control of the plant is possible. An excellent means of determining i
overall control of the plant is by using the steam dump to vary main coolant I
conditions. With steam dump available adequate subcooling should be easily attained.
l Case I, Step 7 Go to Attachment "A" for SI throttling termination criteria to limit amount of inventory added to the MC system. Guidance for addressing a possible challenge to Reactor Vessel Integrity is also provided.
Case I, Step 8 Boration of the MCS prior to cooldown is necessary to assure maintenance of the required shutdown margin.
Case I, Step 9 and 10 Re-establistaent of normal makeup and letdown and pressurizer heater control places the plant in a controlled configuration prior to plant cooldown. Prior to re-establishing pressurizer heater operation, suf ficient level in the pressurizer to cover the heaters should be verified. Compare pressurizer surge line, water space and vapor space temperature to determine if the pressurizer is approaching or'at saturation.
A-43
M T
~
il.
$~
Q' h
e.-
u r
s-p
(
A.
m Prior to returning operation to normal pressurizer level control, the containment temperature should be verified to be below temperatures where
(
significant environmental errors would be introduced to the level instrumentation.
{
Case I, Step 11 Management should be used in determining the mode of plant cooldown following any serious plant accident condition.
Case II, Steps 1 and 2
(
Case II should be quickly terminated via NRV closure.
Case II, Steps 3 to 9 Stabilize the system.
3.12 OP-3116 LOSS OF FEEDWATER DISCUSSION Loss of feedwater could be caused by the inability to restart boiler feed pumps after a plant trip; or due to a leak that may occur in the feedwater or condensate system at any point between the condensate pumps and the feed line check valves in the vapor Container. The immediate actions require
[
reestablishing steam generator water with No. 1 or 2 emergency feedwater pump via the normal flow path and then restarting No. 2 and No. 3 main coolant pumps if the Loop 2 and/or 3 feed paths are available. If the No. 2 EFWP or the
(
normal flow path is not available, then the operators must determine which of the optional emergency feedwater flow paths of Attachments B should be initiated based upon existing plant conditions and availability of systems. It is
{
important to maintain a water level in at least two steam generators.
Feed line breaks on the stern generator side of a feed line check valve are not covered in this procedure, since in all probability it would be impossible
[
to distinguish a break of this type from a main steam line break inside the Vapor Container. Feed line breaks of this category should be considered as steam line breaks inside the vapor Container and are covered in OP-3115, " Steam Line Break."
l
{
It is with a feed line break inside the VC on the stean generator side of the feed line check valve that safety injection could be initiated by the rapid
[
cooling and depressurizing effect on the Main Coolant System at 1700 psig or by increasing vapor Container pressure at 5 psig. If the safety injection system initiates it should only be cutback or secured when the shutdown criteria of Or-(
3106, " Loss of Main Coolant" is satisfied.
If loss of feedwater and a small main coolant system break occur
[
simultaneously the following would apply. The formation of voids in the reactor L
core is possible if feedwater is not restored in approximately one half hour to 0
provide an adequate heat sink for the main coolant system. If 40 F subcooling is maintained on the MC system with an adequate heat sink, the possibility of
[
forming voids will be minimized.
If the break is small enough to preclude a
{
A-44 r
k h
p a,
,.3 m
(
e a
de safety injection system initiation the charging pumps and pressurizer heaters should adequately maintain the required main coolant system
['
overpressurization. If the charging pumps cannot maintain main coolant system overpressure, the safety injection systen shall be manually initiated. If for l
some highly unlikely reason feedwater cannot be reestablished to provide a main
{-
coolant system heat sink it will be necessary to establish a SI flow path via the pressurizer power operated relief valve, PR-SOV-90, to provide for core cooling.
For indications of core cooling and main coolant overpressurization, monitor the main coolant system saturation monitor; and also the incore thermocouple temperature and T and Th temperature. Pressurizer level may c
provide erroneous indication if the break is in the pressurizer steam space.
BASIS Step 1 The Critical Safety Functions, OP-3100, have precedence over Recovery
[
Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 If loss of feedwater was caused by loss of main feed pumps, restart main f eed pumps or start standby pumps to regain feed control.
Step 3
[
Scram the plant and initiate " Scram Recovery" procedure OP-3101.
{
Step 4 Close the af fected S/G NRV and trip the af fected loop MC pump and isolate the affected S/G feed line.
Step 5
{
If this loop keeps running, the S/G will boil dry and cause partial loss of secondary cooling. The reactor is scrammed to reduce reactor power rapidly before losing secondary cooling.
Step 6 Isolating the feed to the affected S/G conserves feed for other unfaulted
(
feed lines.
CAtFION: DO NOT feed a dry S/G is a warning to the operator since MC 0
E-temperature will be 500 F plus and feedwater to the S/G will be 0
approximately 100 F - this temperature difference could cause a thermal shock to the S/G tube sheet and possible tube leakage or rupture.
[
(
A-45
p fg T"."TO p[J
[
F
' K "/x s k'.
u n
kw Step 7
- a. d '
An emergency feed pump shculd be started to recover water levels in all f
operable S/G.
{
NOTE 1: Reminds the operator that only one eraergency feed pump can be operated at a time due to NPSH requirements.
NOTE 2: Also a reminder not to run LPST makeup pumps when operating EFW pumps
[
since they could affect NPSH to EFW pumps.
Instructions to the operator prompts him to further verify emergency
(
feed flow to intact S/Gs. The operator is given several options to establish emergency feed via a variety of routes with a variety cef pumps. Each method is explained separately in an attachment.
F Step 8 Classify the emergency via OP-3300. Depending on seriousness of the accident, if the "C" plan is put into effect, additional help will be assigned to help in controlling the accident.
S_t99 9 Once feed is reestablished to unaffected S/G, then forced circulation in the MC system will enhance decay heat removal from the core and stabilize the plant in a shutdown condition.
Step 10 Once forced MC flow is reestablished, heat transfer is enhanced and more 1
steam is dunped which will require more feed - the operator is reminded to maintain S/G levels in unaffected S/G.
Step 11 Since more feed is required, then water sources must be watched closely and I
alternatives are delineated as to how additional water sources may be inade available.
Step 12 and 13 Secondary cooling via steam dumps to the condenser or atmosphere must be maintained to remove core decay heat. Centrol T,y, at approximately 515 F using steam dumps.
Step 14 Isolation of the break must be accomplished in order to restore feed to intact S/G and maintain secondary cooling.
I I
A-46 I
e -ng {Ty
{
t"*% b }9
_k h
k
& O Y &
nNhN Steps 15 and 16 Notification of higher management so that further actions can be planned I
and additional help activated to deal with the accident and remvery.
3.13 OP-3117 REFIELING ACCIDaES I
DISCUSSION I
Prompt operator recognition and response is of the essence to protect the plant staff and general public f rom the real and pctential hazards that could be encountered during the onset and progression of a refueling accident.
B ASIS S tep 1 The Critical Safety Functions, OP-3100, have precedence over Recovery Procedures. This step serves as a reminder of the constant requirement to monitor and respond to threats to the Critical Safety Functions. Recovery Procedures follow a conferred diagnosis of the situation.
Step 2 Five classes of refueling accidents are treated. They should mver all possible risks for release for radioactive material.
ATTACHME!E A Criticality Accidents This procedure deals with criticality accidents in the reactor and spent fuel pit while refueling. An accidental criticality could come about by violating procedures and withdrawing more than one mntrol rod f rom the wre, or improper loading of f uel in the reactor or spent f uel pit or by a dilution of the boron concentration in the main coolant system. Therefore, operators performing the ref ueling must follow written proced' res and established good operating practices while handling core components and operation of systems during refueling periods.
The licensed Control Room Operator (CRO) on duty in the Control Room would most likely be the first person to be aware of the approach to criticality due I
to increased munt rates on the Source Range meters. The refueling personnel in the Vapor Container would hear the audible count rate increase and alarm as well as the CRO. The refueling crane operator would also see the radiation monitor (mounted on the crane) meter increase and alarm.
Step 1 Suspend all mre alterations to prevent worsening the accident.
Step 2 Evacuate the VC is to clear all personnel from the area to prevent radiation over exposure.
I A-47 I
TVR'c \\UT j
D
'j%
b 4
[
Step 3
{
Initiate OP-3105, " Emergency Boron Injection" is the CRO response to borate the MC System and return the reactor to safe shutdown condition.
{
Step 4 Notify the Control Room and duty S/S since the-accident could have taken place in the Spent Fuel Pit and the S/S and CRO must be informed so that I
protective measures may be taken for plant personnel and the public.
Step 5 l
Checking accountability of all personnel is to insure that no one has been l
left in the accident area where they might receive radiation over exposure.
i Steps 6 and 7 Secure the VC hatch and shutdown the VC purge system is to contain any l
radioactive releases from the accident in the VC.
Steps 8, 9 and 10 f
The S/S must classify the accident via OP-3300, E.A.L.S. and notify proper authorities in order to protect the public and get additional help to address l,
the accident.
ATTACHfENT B High Gamma Radiation Accident While Handling Core Components j
The symptoms of this accident indicate that a Core Component or piece of irradiated equipnent has been exposed from its shielding. This could be caused from crane operation while lifting something out of the water or lowering the water level exposing previously shielded radioactive component.
Step 1 l
Reverse direction of core component movement to control the accident condition.
Step 2 Secure ventilation or purge to prevent spread of contamination.
Steps 3 and 4 Seek shielded shelter until situation is evaluated and exclude personnel from the immediate area of the accident to reduce radiation exposure to personnel.
Steps 5, 6, 7 and 8 Classification of the accident and notification of proper personnel is important so that they may help in evaluating the accident, supply necessary support personnel, and notify the public if needed.
A-48
j I flh hb' I'
l j' L L r..
daa d -
$~
ATTACHENT C Radioactive Spill Involving a Radiation Haz6rd to Personnel l
This accident involves spills of significant quantity of highly radioactive liquid.
l Steps 1 and 2 Containing the spill to prevent spreading of contamination to equipment and l
personnel is important to accomplish early in the accident.
Steps 3 and 4 l
Prompt notification to the duty S/S so that he may classify the accident and implement the proper actions to contain the spill, and notify proper I
authority so that additional personnel may respond to help in the cleanup is important early in the accident.
Steps 5, 6, 7 and 8 l
Guarding or barricading the area of the spill, removing contaminated I
clothing and monitoring personnel will all help identify the problem area and prevent the spread of contamination and reduce personnel exposure to radiation.
l Steps 9 and 10 Getting the accident under control, identifying the problem areas and i
l initiating the cleanup are necessary steps in protecting plant personnel and the public.
l Steps 11 and 12 Notification of proper authorities is necessary so that the public is l
warned if necessary and additional assistance can be directed to the plant as needed.
ATTACHENT D Damage to an Irradiated Fuel Assembly l
A serious accident where personnel in the immediate area must take quick pu and appropriate action to prevent over exposure to themselves and other nearby l
workers. If gas bubbles are escaping f rom the damaged fuel, once they break the surface of the water the gas becomes a highly radioactive airborne radiation hazard.
Immediate evacuation of the area is essential.
Steps 1, 2 and 3 Evacuate the area immediately, notify the Control Room and close hatches, doors a'nd secure ventilation will limit the accident to the immediate area and prevent spread of contamination.
l Steps 4, 5 and 6 Secure bus room fans to prevent radioactive gas that may have been released from getting pulled into the Turbine Building and Control Room.
A-49
}
[
w;.
(-
\\ i.-
p i
./
\\,
a, e.
As a precautionary method, administer iodine from Emergency Kit to saturate the thyroids of plant personnel with non-radioactive iodine so radioactive iodine will not be absorbed into their thyroids. Time check the primary vent stack recorder to keep track of any releases out of the PVS.
Steps 7, 8, 9 and 10 Notifying the duty S/S (emergency director) so that he can classify the accident, make necessary notifications, and direct actions to mitigate the accident, notify Radiation Protection supervision for evaluation and assistance in monitoring the area.
Steps 11 and 12 NRC notification 'is required. Bringing the accident under control is a major endeavor of the operators.
ATTAGMENT E Damaged New Fuel Assembly Damage to a new assembly is not as serious an accident since no fission gases have been generated in the new f uel. The new fuel is pressurized with helium gas and airborne alpha is a concern.
Step 1 Imediate notification to the Control Room and Radiation Protection supervision is necessary in order to take necessary protective action for equipment and personnel.
S tep 2 If fuel is not under water, airborne contamination of alpha is of concerns therefore, ventilation should be secured to prevent spread of contamination and personnel should be evacuated to prevent them from becoming contaminated.
Step 3 Stop all fuel loading until a full evaluation has been made is necessary since all fuel assemblies are needed in the core and investigation may reveal a weakness in the handling procedure.
Steps 4, 5, 6 and 7 Radiation Protection Department recommendations for personnel protection and contamination control to keep radiation exposure to a minimum and limit spread of contamination is needed. Bagging up the damaged element helps in contamination control. Upper plant management approval for transf erring the damaged element is needed to assure that a plan has been devised to handle the damaged element as little as possible and contamination is controlled.
{
A-50 F
J
1 t""."^
?~~'***
Q K+
~
(.
E
{
'e.
/
' i.
g 1
Mb d bad,k ads
't i
I B
'I
!I i
APPENDIX B Comparison of Yankee Plant to Reference Plant I
I I
I I
I I
I I
I I
i
'g
.A
'\\
~3 k}
/
c as;r u
a SECTION 1.
INTRODUCTION This document compares the Westinghouse Low Pressure Reference Plant (defined in terms of twenty-five separate systems) and the Yankee plant (defined in terms of twenty-three separate systems). The systems of each l
plant are compared with respect to overall function and how that function is l
carried out.
[
[
[
B-1
- j hh, l
l> atM A '
11 SECTION 2.
PIANT SYSTEMS COMPARISON 2.1 Reactor Protection System and Reactor Trip Actuation System The reactor protection system monitors specific process parameters and initiates a reactor trip if conditions exceed specified limits.
Exceeding these limits could lead to either core damage or a challenge j
to the primary system pressure boundary.
Although differences in monitored parameters exist, the Yankee plant and Westinghouse reference plant Reactor Protection Systems perform the same l
I functions in similar fashion.
2.2 Engineered Safety Features Actuation System and Miscellaneous Protection l
Systems Safety Iniection Signal l
The Westinghouse reference plant SI signal is initiated by low pressurizer pressure, low steamline pressure, high containment pressure, and operator manual actuation. The Yankee plant SI signal is initiated f
by low MCS pressure, high VC pressure, and operator manual actuation.
For excessive cooldown considerations, main coolant pressure is l
postulated to decrease to less than the MCS low pressure SI setpoint, thus initiating safety injection.
l Beyond the initiating events the SI signals for both plants are similar.
Both signals bring safety injection systems to full operation.
Although this technical difference results in procedure differences, they have only a minor impact. This difference would be addressed whenever SI is being blocked, where a reference to the low steamline pressure SI signal is not needed for the Yankee procedures.
Containment Spray Signal The Westinghouse reference plant utilizes this signal to start the l
containment spray system on high containment pressure or operator action. The Yankee plant has no containment spray system or containment spray signal.
The purpose of this actustion signal is to start the containment spray I
system and mitigate the containment pressure increase that would accompany a major high-energy-line break inside the VC.
The maximum allowable pressure for the Yankee Vapor Container is 34.5 psig, including a 10% overpressure allowance permitted under paragraph UG-125(e) of the ASME Boiler and pressure Vessel Code. The calculated maximum internal pressure in the event of a HELB is 31.6 psig, which is within the maximum allowable pressure.
B-2 1
W >7)
A. WW p
2 t
g d
Ja#h "ikki..
A Thus, neither a containment spray actuation signal nor a containment spray system are required for the Yankee Plant Vapor Container.
WOG ERGS incorporating the containment spray signal ares o
B-0, Reactor Trip or Safety Injection
{
The operator checks containment pressure and, if abnormal, checks containment spray system status. If containment spray is required, the operator verifies system actuation.
o E-1, Loss of Reactor or Secondary Coolant The operator terminates containment spray when containment pressure has decreased to the CS reset point.
o ECA-O Series, Loss of All AC Power and Recovery Strategies The operator places AC-nowered containment spray system components in pull-to-lock to prevent automatic initiation upon restoration of
[
power. In the recovery procedures, containment spray system L
components are activated (if required) in a manual, controlled sequence. If not required,the system is re-aligned to a standby condition.
u o
FR-Z.1, Response to High Containment Pressure Containment spray system actuation and flowpath are verified on a high containment pressure condition.
Auxiliary Feedwater Start Signal The Westingnouse reference plant utilizes this signal to automatically start the auxiliary feedwater system. The Yankee plant does not employ automatic start of its e:nergency feedwater system.
The main feedwater system consists of three electric motor-driven parallel boiler feedwater pumps with a common suction and discharge header that provide normal feedwater flow. The pumps take suction from the condenser via three parallel condensate pumps. Flow is controlled by four separate control valves. In the event of a total loss of main
(
feedwater, an emergency feedwater system is available to provide water I
to the steam generators.
The emergency feedwater system includes one positive-displacement steam-driven pump with minimum capacity of 80 gpm. This pump does not rely on electrical power and can function following total loss of ac power.
Steam to drive the pump may be supplied from either the main steam system or the auxiliary oil-fired boilers. In the event of total loss of ac, natural circulation cooling would be procedurally controlled and this steam-driven pump would provide feedwater to the steam generators. Decay heat removal would occur via blowdown through the
[
steam generator safety valves. The steam-driven feed pump takes steam from either upstream or downstream of the non-return valves and suction from the demineralized water storage tank.
4 B-3 j
D9hET dm8 EinDd h b cO.
In addition to the steam-driven pump, two motor-driven emergency feedwater pumps of 150 gpm capacity each are available to increase the capability and redundancy of the emergency feedwater system. Piping permits feedwater addition, with either pump, through either the normal f
feedwater piping via the steam-driven emergency pump header or through k
the blowdown piping via the alternate emergency feedwater header. These motor-driven pumps can be started either remotely from the control room or locally by operator action. Remote indication of emergency feedwater
(
flowrates through the normal feedwater path is available in the control room. Local flow indication is available in the combined pump minimum recirculation flow piping.
A back-up system to supply water to the steam generators in the event of failures in the emergency feedwater system is the plant's three charging pumps with a total capacity of approximately 100 gpm (33 gpm/ pump). The system is connected permanently by a spool piece that connects to the main feed line header. The charging pumps can take suction flow from the 135,000 gallon primary water storage tank. High pressure safety injection and low pressure safety injection pumps provide another back-up source to supply water through the same permanently connected spool' piece used for the charging pump path. More than 100 gpm flow is available from the combination of a single high pressure safety
[
injection (HPSI) pump and low pressure safety injection (LPSI) pump, and there are a total of three HPSI pumps and three LPSI pumps. The HPSI and LPSI pumps can be powered by the diesel generators.
WOG ERGS incorporating the auxiliary feedwater start signal:
{
e E-0, Reactor Trip or Safety Injection The operator verifies AEM start as necessary following a reactor trip or safety injection.
e ECA-O Series, Loss of All AC Power and Recovery Strategies The ac-powered auxiliary feedwater pumps are placed in pull-to-lock to prevent automatic initation upon restoration of power. In the recovery procedures, auxiliary feedwater pumps are activated in a manual, controlled sequence.
If not required, the pumps are re-aligned to a standby condition.
FRP-H.1, Response to Ioss of Secondary Heat Sink e
The operator's first actions are focused on restoration of AFW l
flow, with manual actuation or re-alignment as required to recover
(
heat sink.
Containment Isolation Signal The Contaiment Isolation Signal for the Westinghouse reference plant is similar to the Yankee plant Vapor Container Isolation System. Both serve to isolate the essential and non-essential containment
(
penetrations to prevent or minimize the release of radioactive material outside the containment.
B-4
]
T%Q
}\\ VT I
N I
,I,
- 9... j!. *.
t s
f r
g.
Main Steamline Isolation Signal and Non Return Valve Trip System
[.
The Main Steamline Isolation Signal for the Westinghouse reference plant is similar to the Yankee plant Non-Return Valve Trip System. Both serve to limit the cooldown of the Main (Reactor) Coolant System following a main steamline break accident.
The non-return valves (NRV) provide automatic steamline isolation. Each
[
NRV is equipped with a stored energy actuator to provide for automatic l
closure within 3-5 seconds. In addition, each main steam line is l
equipped with three redundant pressure sensors to provide a signal to:
(1) close all NRVs, (2) trip the reactor, and (3) isolate containment on a 2-out-of-3 coincidence of low pressure signals for any single main steam line. This design prevents the blowdown of the remaining steam
{
generators subsequent to automatic NRV closure and limits the primary plant cooldown transient to the inventory of a single steam generator.
The same 2-out-of-3 coincidence of low main steam line pressures also generates a permissive signal to trip the main condensate pumps.
Containment Ventilation Isolation Signal
(
The Containment Ventilation Isolation Signal for the Westinghouse reference plant automatically isolates containment ventilation penetrations to prevent release of radioactive materials outside containment.
{
The Yankee plant containment ventilation penetrations (e.g., purge supply and exhaust) lines are normally blank flanged. ~During refueling operations the containment purge fan shutdown system is required to be operable. This system is not automatic and is manually initiated from the primary auxiliary building fan room.
Main Feedwater Isolation Signal and Boiler Feedwater Pump Trip System The Main Feedwater Isolation Signal for the Westinghouse reference plant is similar to the Yankee plant Boiler Feedwater Pump Trip System. Both circuits serve to minimize feedwater addition to a potentially faulted steam generator.
The difference in the two circuits is that while the Westinghouse reference plant circuit closes feedwater flow control valves, bypass valves, and isolation valves, the Yankee plant circuit trips the boiler feedwater pumps.
2.3 Nuclear Instrumentation System At both the Yankee plant and the Westinghouse reference plant the Nuclear Instrumentation System monitors and displays the reactivity state of the core. The types of instruments used vary but the same function is performed in a similar fashion.
B-5
]".
T I'9 4y T****>
l h f i-e F.
1_- s : -g f,
Le 52 ts--
L,;$ w I
2.4 Control Rod Instrumentation System I
The Control Rod Instrumentation System monitors and displays the position of control rods within the reactor core. The system also provides for rod bottom indication. The Yankee plant and the Westinghouse reference plant use slightly different means to accomplish
.I these functions, however, both systems perform the same function.
2.5 Radiation Monitoring System Both the Yankee plant and Westinghouse reference plant Radiation Monitoring Systems monitor radioactivity levels in specified process systems and specified areas internal and external to the plant.
2.6 Containment Instrumentation System The Containment Instrumentation System mon
- tors the environmental condition and isolation status of the vapor container. The Yankee plant ar.d the Westinghouse reference plant systems use similar means to accomplish the same function.
2.7 Main Coolant System and Reactor Coolant System The Main Coolant System and the Reactor Coolant System both transfer heat from the reactor core to the main staam system or residual heat removal system. Further, both systerrs provide a barrier against the I
release of reactor coolant or radioactive material to the containment environment.
I The Yankee plant and the Westinghouse reference plant systems have some system design differences. The Yankee plant MCS is a four loop closed systems each loop contains a hermetically sealed, canned rotor, canned stator main coolant pump, a check valve to limit reverse flow in that I
loop when the MCP is shutdown, a U-tube steam generator to transfer heat from the MCS to the secondary coolant, a motor operated gate valve on both the inlet and outlet of the reactor vessel, and various loop temperature, pressure, and flow sensor devices.
The Westinghouse reference plant RCS consists of two loops. Each loop contains a reactor coolant pump, a U-tube steam generator, various loop I
instruments for temperature, pressure, and flow determination, and an RTD bypa n manifold.
The Yankee plant and the Westinghouse reference plant systems (MCS and RCS) perform the same functions in a similar fashion utilizing similar designs. The physical differences between the systems permit different types of operations not common to both facilities.
I I
B-6 I
{
T% D:
% W"ID
% s (n.m24 P
<W aps r
g l
The major differences are as follows:
1)
The hermetically sealed, canned rotor main coolant pumps do not l
have controlled-leakage seals. On a loss of all AC power event, loss of MCP seal cooling and subsequent seal failure are not I
possible. This design feature precludes the need for MCS depressurization and cooldown following a loss of all AC power, therefore, the major actions of NOG procedures ECA-0.0, ECA-0.1, and ECA-0.2 are not required.
l 2)
The loop isolation valves are used at Yankee to isolate a ruptured steam generator only after it has been positively identified. This I
design feature terminates primary-to-secondary leakage and allows j
the operating staff to cooldown and depressurize the MCS at a more l
i-controllable rate.
2.8 Safety Injection System 1I In both the Yankee plant and the Westinghouse reference plant, the Safety Injection System furnishes sufficient cooling water to the core j
to ensure all of the acceptance criteria are met as specified in 10CFR50.46. Both f acilities' Saf ety Injection Systems are comprised of a high head system, a low head system, and an accumulator system. While there are differences in the design of both Safety Injection Systems, they accomplish the same purpose in similar fashion. Additionally, the Yankee SI system can be cross-tied to provide flow to the steam generators to maintain secondary cooling.
2.9 Shutdown Cooling System and Residual Heat Removal System I
The Yankee plant Shutdown Cooling System and the Westinghouse Residual Heat Removal System both remove heat f rom the MCS (RCS) during plant shutdown operations and at low MCS (RCS) pressures. The component configuration for both systems is similar.
2.10 Charging and Volume Control System The Charging and Volume Control System, CVCS, provides makeup water to
'the MCS (RCS) and provides core reactivity control for normal operations I
and any event that does not require Miscellaneous Protection Systems (ESP) operation.
I The Yankee plant and the Westinghouse reference plant CVCS systems perform the same function in similar f ashion.
2.11 Component Cooling Water System For both the Yankee plant and the Westinghouse reference plant, the Component Cooling Water System provides heat removal f rom potentially radioactive system processes and equipment.
The design of the f acilities' CCW systems are similar, and they perform the same function in similar f ashion.
B-7
^
L JLJ M PAL h
2.12 Se_ rvice Water System The Service Water System provides a means of heat removal from non-radioactive system processes and equipnent, and the component cooling l
l water system to the ultimate heat sink.
l i
The Yankee plant and the Westinghouse reference plant Service Water l
Systems perform the same function in a similar fashion.
2.13 Containment Spray System 1
The Westinghouse reference plant utilizes a Containment Spray System to provide containment pressure suppression and airborne fission product removal for high-energy line breaks inside the VC.
The Yankee plant design does not incorporate a Containment Spray System. One of the purposes of the system is to mitigate the pressure j
increase that would accompany a HELB inside containment. The maximum allowable pressure for the Yankee vapor Container is 34.5 psig including a 10% overpressure allowe.nce permitted under paragraph UG-125(e) of the ASME Boiler and Pressure Vessel Code. The calculated maximum internal f
pressure in the event of a HELB is 31.6 psigg which is within the M.5 psig maximum allowable p: essure. Thus a containment spray syst.em is not I
required for the Yankee plant.
I The Yankee plant does not have any active means inside the Vapor I
Container to remove atmospheric contamination, such as iodine, l
subsequent to an accident. Analyses performed and documented in l
Sections 8, 9,10,11, and 12 of the Yankee Nuclear Power Station Probabilistic Safety Study describe core melt assumptions and radioactive nuclide release assumptions that, in view of their conservatism, preclude the need for a means to remove airborne fission products.
l The WOG ERGS address containment spray in the following procedures 1
o E-0, Reactor Trip or Saf ety Injection Containment spray system operation is verified if the actuation setpoint is exceeded. If required but not operating, the system is manually actuated.
o E-1, Loss of Reactor or Secondary Coolant The operator terminates containment spray when containment pressure has decreased to the CS reset point.
o ES-1.3, Transfer to Cold Leg Recirculation The operator is instructed to align the containment spray system I
for recirculation, i~f necessary.
I I
a i
- d Ye 2.s.
d.a L
I e
ECA-O Series, Loss of All AC Power and Recovery Strategies l
The operator places AC-powered containment spray system components in pull-to-lock to prevent automatic initiation upon restoration of f
pcwer. In the recovery procedures, containment spray system L
components are activated (if required) in a manual, controlled sequence.
If not required, the system is re-aligned to a standby
-condition.
o ECA-1.1, Loss of Emergency Coolant Recirculation containment spray flow is reduced to minimum to minimize RWST L
depletion.
If possible, containment spray is re-aligned for recirculation from the containment sump. When the RWST empties, any containment spray pumps not aligned for recirculation are stopped.
e ECA-2.1, Uncontrolled Depressurization of All Steam Generators Containment spray is terminated when containment pressure is reduced to less than the CS reset point.
e FR-Z.1, Response to High Containment Pressure Containment spray system actuation and flowpath are verified on a high containment pressure condition.
2.14 Vapor Container Atmosphere Control System The Containment (VC) Atmosphere Control System provides for containment heat removal, filtration, and combustible gas control. The Yankee plant and the Westinghouse reference plant both ur,e similar designs to accomplish the same purpose in a similar fashion.
2.15 Main Steam System
[
The Main Steam System provides for controlled heat removal from the steam generators through the boundary of the vapor container to the turbine throttle valves or the condenser via a direct path (bypassing the turbine if necessary).
Both the Yankee plant and the Westinghouse reference plant Main Steam System accorplish the same purpose in a similar fashion.
2.16 Main Feedwater and Condensate System l
The Main Feedwater and Condensate System provides water to the secondary l
side of the steam generators during plant power operations.
Both the Yankee plant and the Westinghouse reference plant use similar system designs to accomplish the same purpose.
B-9
.E
er-W g
W j
h h
hj b}
! E nNd'Lis w-7.17 Emergency Feedwater System and Auxiliary Feedwater System I
The Yankee plant Emergency Feedwater System and the Westinghouse reference plant Auxiliary Feedwater System provide coolant to the secondary side of the steam generators during plant shutdown operations and for events'that require Miscellaneous Protective Systems (ESP) operation.
Both facilities employ similar system designs to accomplish this purpose I
in a similar fashion. A difference occurs in the manner each system is started up.
See Section 2.2, Auxiliary Feedwater Start Signal.
2.18 _ Steam Generator Blowdown System The Steam Generator Blowdown System provides letdown from the secondary side of the steam generators for shell side solids concentration I
Control.
The Yankee plant and Westinghouse reference plant use similar system designs to accomplish the same function in a similar fashion.
2.19 Samoling System The Sampling Systems provide a means for sampling process systems.
The Yankee plant and Westinghouse reference plant use similar system I
designs to accomplish the same function in a similar fashion.
2.20 Spent Fuel Storage and Cooling System The Spent Fuel Storage and Cooling System controls fuel storage positions to ensure a suberitical geometric configuration and provides heat removal to maintain stored fuel within specified temperature I
limits.
The Yankee plant and Westinghouse reference plant use similar system designs to accomplish the same functions in a similar fashion.
2.21 Reactor Control System and Rod Control System The Reactor Control System and the Rod Control System provide short-term reactivity control in the reactor.
The Yankee plant and the Westinghouse reference plant control systems perform the same function in a similar fashion.
2.22 Turbine Control System The Yankee plant and Westinghouse referenc? plant Turbine Control Systems control the turbine generator. Both facilities use similar I
system designs to accomplish the same functions.
I B-10
)
""T e,
3 P.
e.e.,
- g
{
y, {.
j i.
, ca. \\ : h as -
2.23 Electrical Power System ll The Electrical Power System provides AC and DC electrical power to
,a equipment that require electrical power to perform their functions. It consists of an offsite AC power supply, and onsite AC and DC power supplies.
.I The Yankee plant and Westinghouse reference plant both use similar system designs to accomplish the same function in similar fashion.
2.24 Pneumatic Power Systems i
The control Air System supplies dry, oil free air to plant pneumatic I
controllers and instrumentation.
l The Yankee plant and the Westinghouse reference plant use similar system designs to accomplish the same function in a similar fashion.
I I
I I
I I
I I
I
'I I
e.11 g
,i
/
. A:eh
,t i.
d _;M.s' i k u. /d A ~L i:,..
til lI l
lI i
lil 4
1 l
j APPENDIX C l
USE OF WOG REV. 1 i
GENERIC TECHNICAL GUIDELINES I
I I
I I
I I
'I I
I I
mW m.
g.
c,.._s
/
i r.
9 w.w,
- o. k u I
TABIE OF CDNTENTS Section Page 1.0 INTRODUCTICN'................................................ 1 2.0 PROGRAM DESCRIPTION...........................................
2 2.1 Task 1: Cmparison of Bases Documentation............... 2 I
l 2.2 Task 2: S te p-to-ste p Compar ison......................... 2 2.3 Task 3: Final Yankee ERG S et Developent................ 2 I
3.0 TAS K P ROCE DURES............................................... 3 3.1 Task 1: Cmp'arison of Bases Documentation............... 3 3.1.1 Review of Existing Yankee Documentation......... 3 3.1.2 Matrix for Cmparison of WOG and Yankee Procedures...............................
4 I
3.1.3 Bases Cmpar ison Documentation.................. 4 3.1.4 Dif f er ence Tracking System..................... 13 3.1.5 Re solu ti on o f D iff e r e nce s...................... 13 3.2 Task 2: S tep-to-ste p Compar ison........................ 13 3.2.1 S tep-to-step Cmpar ison Documentation.......... 14 3.2.2 Dif f erence Tracking System..................... 14 3.2.3 Resolu tion of D if f er ences...................... 14 3.3 Task 3: Final Yankee ERG Set Developent............... 16 3.3.1 Use of Diff erences Sheets...................... 16 Tables 1
Yan ke e P roce d u r e S et..................................... 6 I
2 NOG P r oce d u r e S e t........................................ 7 Figures 1
Matrix for Cmparison of WOG and Yankee Procedures....... 5 2
Bases Cmpar ison Wor ks heet.............................. 10 I
Sample Dif f erences Documentation Sheet................... ll 3
4 D if f erence Tracking Log Shect........................... 12 5
S tep Compar ison Wor ks heet............................... 15 I
I C-i
~~
r-,cr....
- c. - e,.,
(A T'"S, *. ",
b 7.'
/
{
1:, 'N'. s '[Nb
.ti,
- i' l.0 INTPODUCTION The overall objective of the Yankee ERG developnent effort is to develop a technically sound set of emergency procedures and background documentation,
(
which will satisfy the requirements of Supplement 1 to NUREG-0737. To this end, Yankee will use the Rev.1 WOG LP generic technical guidelines as the technical basis for the Yankee ERGS. The initial Yankee ERG set will be
[
compared with the WOG generic technical guidelines, using both a basis-to-L basis and step-to-step comparison. The results of the comparison study will then be used to develop the final ERG set.
E
[
[
[
[
[
[
[
[
[
C-1
l
- y. 7 _
A 79 N
k, h ' j)
' k !,4 Q
g gi
~ ' 41, E
.I 2.0 PROCRAM DESCRIPTION i
The WOG generic technical guidelines will be used to support three basic tasks. These tasks are briefly discussed in the following subsections.
Detailed technical direction for each task is provided in Section 3 of this document.
2.1 Task 1: Comparison of Bases Documentation I
Task 1 provides a basis-to-basis comparison of the Yankee ERG set against the Westinghouse Owner's Group technical guidelines. The objective of this task is to compare the WOG background documentation against the Yankee ERG set bases documents and to provide an evaluation and recommendations on any I
differences noted.
2.2 Task 2: Step-to-step Comparison Task 2 provides a step-by-step comparison of the Yankee critical safety function and recovery procedures against the Revision 1 Westinghouse Owner's I
Group guidelines. The objective of this comparison is to identify differences between the generic guidelines and the Yankee procedure steps and to evaluate ar.f make recommendatias on the disposition of differences.
The step-by-step review will be a systematic, well-documented effort to compare the Yankee procedures to the WOG ERG set.
A procedure comparison worksheet will be used to document how each WOG ERG step compares to a Yankee I
procedure step. Any differences including additions or omission, will be documented on a difference sheet. The difference sheet will be used to document the nature of the difference, the evaluation, and the reconnended and I
actual disposition of the difference, including a justification for differences that required no corrective action. The final disposition of all differences will be decided by the Yankee Procedures development team.
2.3 Task 3: Final Yankee ERG Set Development Tasks 1 and 2 described above will result in the documentation of the I
differences between the initial Yankee ERG set and the WOG generic guidelines. All differences will be evaluated by the Yankee Procedures Development Team, and the initial Yankee ERG set will be revised to the recommendations of the Team. Revisions will be made using the Yankee Writers' I
Guide.
I E
II I
I
~
i
i M.
[
- in ns.L L
3.0 TASK PROCEDURES This section provides specific technical instructions for use by the project team during performance of each of the three tasks. These instructions provide overall guidance for accomplishing each task; however, u
the day-to-day operation of the project is primarily directed by the project manager. Any questions or concerns about the project should be directed to the project manager.
3.1 Task 1: Comparison of Bases Documentation The bases conparison involves the comparison of Westinghouse Owners Group (WOG) technical guideline background documents against the bases of the Yankee ERG set. 'Ihe objective of this comparison is to determine how the Yankee procedure set compares to the WOG set and to evaluate and recommend corrective actions for any differences found.
To perform this task efficiently, all personnel must be thoroughly familiar with the Yankee procedure set, its development, and overall Yankee philosophy. Therefore, each team member will be indoctrinated to the project by the project manager. It is imperative that all team members be thoroughly
[
btaefed and familiar with the Yankee procedures before actual work begins. In addition, all team members must be equally familiar with the WOG generic technical guidelines.
The bases comparison will be accomplished using a coordinated team concept. This method is necessary because there is not a direct one-on-one relationship between the Yankee procedure set and the WOG procedure set. By
[
number alone, we see that WOG uses a much larger number of procedures than does Yankee ERG set. Therefore, we must expect the bases-to-bases comparison to encompass more than just a one-on-one comparison to WOG procedures. In fact, our approach will be to first start by examining the Yankee and WOG sets as a whole and then narrow down to each procedure in the Yankee set to evaluate how it compares to corresponding WOG procedures. Our procedures comparison team will accomplish this approach.
The procedures comparison team will meet early in the project after all
(
team members have been indoctrinated. At these initial meetings, the approach L
to accomplishing the comparison will be discussed and a detailed direction given for accomplishing the task. The project manager will develop any additional technical direction as a result of these meetings.
[
3.1.1.
Review of Existing Yankee Documentation f
Early in the project the project manager will review existing Yankee L
procedures-related documents. The objective of this review is to evaluate the adequacy of existing documents to support the emergency procedures upgrade. This review will include, but is not limited to, the following documents:
o Accident analysis assumptions
[
e Portions of the PRA e
NRC staff review checklist of Yankee PGP e
Results of procedures review by Yankee PRA group C-3
h ; d'
'd N4
!.)
(
& L %,,
~
A e
Background documents on procedure set (technical guidelines)
[
e Work previously done by Lund Consulting e
Existing V&V data including table-top reviews Where possible, useful documents should be utilized to minimize efforts.
3.1.2.
Matrix for Comparison of WOG and Yankee Procedures As part of the bases comparison, a matrix will be developed that shows a procedure-by-procedure relationship between the Yankee and WOG
(
emergency procedure sets. Figure 1 shows the matrix form to be used.
L This matrix will be developed in draft form at the completion of the bases comparison and will be further refined, as necessary, during the step-by-step review (task 2).
[
3.1.3.
Bases Comparison Documentation The Yankee-to-WOG bases comparison will require strict documentation to ensure a complete and accurate conparison is performed. This is especially important when one considers the differences in the number and subject differences between the WOG and Yankee procedure sets. As can be
[
seen from Tables 1 and 2, a large difference in scope exists between the Yankee and WOG event-oriented procedures. Particularly, the Yankee set covers more types of events than the WOG set. Furthermore, it can be
{
seen from these tables that a direct one-on-one correlation does not exist between many of the WOG and Yankee procedures. Accordingly, our efforts must be controlled and documented to ensure a complete and thorough comparison is performed.
Figure 2 shows the worksheet to be used during the bases comparison efforts. The ensuing description provides details on how this worksheet
[
will be completed during the Task 1 efforts.
The bases comparison will be performed based upon comparing the
[
procedures of similar event or function. For example, the Yankee event procedures that deal with a LOCA will be compared against the WOG LOCA procedures. Similarly, functional procedures will be compared. However, it is important to note that in some cases a direct one-on-one
[
relationship will not exist and therefore a bases comparison may not be possible. Furthermore, careful evaluation of the Yankee procedures will be necessary to ensure that possible points of comparison between the
{
procedure sets are not overlooked.
[
[
[
[
C-4
! - } t,d M
g
\\
k
((.
f g
~
L C'l-Ud 5
e E'l-ud 8
n-ad 7
C'Z-Ud u
c3 E7-Bd Q
\\
F y
L7-Wd j
N 8
E'd ud I
L'd-W3 l
I 6
9'H-Bd V'H-Ud E
C'H-Wd L
E'H-Ud 2
O L'H-Ud m
o C'O-Ud g
z
[
a D
E'O-Ud a
L'O-Ud oO E S-83 m
a.
L'S-Ud ww C C-VO3 x2 2C-VO3 a
L'C-YOB C
W CC-S3 4
O F @
E C-S3 O
L t t C.S3
[
E-3 0
mw 2
2 L'E-VO3 O
3 m
W E-3 EE 9
o E L-VO3 n.
C 2
L' L -vD3 O
C o
y P L-S3 g
8 C' t -S3 8
I E
E' L -S3 E
L a
E L'L-S3 2
4 m
L-3 E
c.
O g 0-y33 L'0-VO3 0 0-VO3 t'0-S3 20-S3 L'0-S3
[
0-3 006 E E I E E E E E 9
J s
O$z N
c.
- c. c. c. O
- c. c. <
- c. c. W
- E-E s a s s a s s e : e s t B 98 8 8 8 88 8 E8 8 5$
E3 O**
w$ 8*0 IE O
o E E E E E E E E E E E E z>
o kE
$0 d d d d d d d d d d i i W
E
>z O O O O O O O O O O O O E m
2 o
[
S3 BOO 3DOud AB3AOO3B SNOl10 nod A133VS 7Vol11BO 00LC-dO C-5 i
h g.
.c
-)
b b.
i Y
d d
TABLE 1 Yankee ERG Set F
L Procedure No.
Name Procedure Type OP-3100 Critical Safety Function Function (all)
{
BOP 61 Reactivity Anomaly Function - Reactivity EOP62 Secondary Pressure High Function - Sec Cooling and i
Inventory
(
EOPf3 Secondary Level High Function - Sec Cooling and L
Inventory EOPG4 Secondary Level Low Function - Sec Cooling and Inventory EOPf5 Secondary Pressure Low Function - Sec Cooling and Inventory EOP66 Secondary Rad High Function - Main Coolant Inventory EOP67 Main Coolant Pressure Low Function - Main Coolant Inventory EOPl8 Main Coolant Temp. High Function - Core Heat Removal
[
EOPl9 Main Coolant Pressure High Function - Core Heat Removal EOP810 VC Pressure High Function - Vapor Cont.
Integrity OP-3101 Scrnm Recovery Event OP-3102 Large Loss of Load Without Event a Re30 tor Scram
[
OP-3105 Emergency Boron Injection Event OP-3106 Loss of Main Coolant Event OP-3107 Steam Generator Tube Event Rupture OP-3108 Fuel Cladding Failure Event OP-3109 Natural Circulation Event
{
OP-3110 Cold Water Accident Event OP-3111 Inadequate Core Cooling Event OP-3115 Steam Line Break Event OP-3116 Loss of Feedwater Event p
L OP-3117 Refueling Accidents Event
[
[
[
[
C-6 n
I fI fj%
A t... N tw W % :_
LL j' TABLE 2 WOG Procedure Set Procedure No.
Name Procedure Type F-0 Critical Safety Function Function Status Trees F-0.1 Subcriticality Function I
F-0.2 Core Cooling Function F-0.3 Heat Sink Function F-0.4 Integrity Function I
F-0.5 Containment Function F-0.6 Inventory Punction FR-S.1 Response to Nuclear Power Function Recovery -
Generation /ATWS Subcriticality I
FR-S.2 Response to Loss of Core Function Recovery -
Shutdown Subcriticality FR-C.1 Response to Inadequate Core Function Recovery -
Cooling Core Cooling FR-C.2 Response to Degraded Core Function Recovery -
Cooling Core Cooling I
FR-C.3 Response to Saturated Core Function Recovery -
Cooling Core Cooling FR-H.1 Response to Loss of Secondary Function Recovery -
Heat Sink Heat Sink FR-H.2 Response to Steam Generator Function Recovery -
Overpressure Heat Sink FR-H.3 Response to Steam Generator Function Recovery -
I High Level Heat Sink FR-H.4 Response to Loss of Normal Function Recovery -
Steam Release Capabilities Heat Sink FR-H.S Response to Steam Generator Function Recovery -
Low Level Heat Sink FR-P.1 Response to Imminent Function Recovery -
Pressurized Thermal Shock Integrity I
Condition FR-P.2 Response to Anticipated Function Recovery -
Pressurized Thermal Shock Integrity I
Condition FR-Z.1 Response to High Containment Function Recovery -
Pressure Containment FR-Z.2 Response to Containment Function Recovery -
I Flooding Containment FR-Z.3 Response to High Contain-Function Recovery -
ment Radiation Level Containment FR-I.1 Response to High Pressurizer Function Recovery -
Level Inventory FR-I.2 Response to Low Pressurizer Function Recovery -
Level Inventory I
FR-I.3 Response to Voids in Reactor Function Recovery -
Vessel Inventory
'I C-7
NI 4
opv
~
w waL a
g TABLE 2 (Continued)
WOG Procedure Set Procedure No.
Name Procedure Type E-0 Reactor Trip or Safety Event Injection ES-0.0 Rediagnosis Event I
ES-0.1 Reactor Trip Response Event ES-0.2 Natural Circulation Cooldown Event ES-0.3 Natural Circulation Cooldown Event With Steam Void in Vessel (With RVLIS)
ES-0.4 Natural Circulation Cooldown Event With Steam Void in Vessel I
(Without RVLIS)
ECA-0.0 Loss of All ac Power Event ECA-0.1 Loss of All ac Power Recovery Event I
Without SI Required ECA-0.2 Loss of All ac Power Recovery Event With SI Required E-1 Loss of Reactor or Secondary Event I
Coolant ES-1.1 SI Termination Event ES-1.2 Post LOCA Cooldown and Event Depressurization ES-1,3 Transfer to Cold Leg Event Recirculation ES-1.4 Transfer to Hot Leg Event Recirculation ECA-1.1 Loss of Emergency Coolant Event Recirculation ECA-1.2 LOCA Outside Containment Event E-2 Faulted Steam Generator Event Isolation ECA-2.1 Uncontrolled Depressuriza-Event tion of All Steam Generators E-3 Steam Generator Tube Rupture Event l
ES-3.1 Post-SGTR Cooldown Using Event Backfill ES-3.2 Post-SGTR Cooldown Using Event Blowdown ES-3.3 Post-SGTR Cooldown Using Event i
Steam Dump I
ECA-3.1 SGTR With Loss of Reactor Event Coolant-Subcooled Recovery Desired ECA-3.2 SGTR With Loss of. Reactor Event I
Coolant-Saturated Recovery Desired ECA-3.3 SGTR Without Pressurizer Event Pressure Control C-8 l
i
Qi t
semy. ; ~.qg d
e The worksheet shown in Figure 2 should be completed using the following guidelines. Refer to Figure 2 for the following discussion.
e Event or function - List the event or function for which the I
procedure bases are being compared. For example, events are L
LOCA, SGTR, Loss of secondary heat sink, etc. Examples of functions are suberiticality, core heat removal, containment integrity, etc.
e WOG/ Plant Specific Bases Comparison - This section provides documentation on the bases comparison. It has been subdivided into two basic subsections which are further subdivided into two additional subsections each. The two basic subsections include one section for the WOG bases and one section for the Yankee bases. Each of these sections is further divided to include a column in which the bases are highlighted and another column which lists the procedural steps which apply to that particular basis.
The bases for the WOG procedures are provided in the WOG background volumes. The bases for the Yankee procedures are
{
included in the procedures and in supporting technical information. All procedure bases will be listed on the worksheets even if a corresponding bases does not exist in the p
proceduces being compared (this would be a difference). In L
addition, the associated procedure numbers and steps which apply to that bases should be listed in the " procedure / step nos." column. This will facilitate the step comparison that
(
will be done later.
The possibility exists that one basis from the WOG set is
[
covered by several procedures and bases in the Yankee set, and vice versa. Be aware of this fact during the comparison efforts.
e Disc No. - This column is used to list the serial number of a difference. Any differences found during the comparison will be further documented using a differences sheet (Figure 3) and
{
assigning a serial number taken f rom the discrepancy tracking log (see section 3.1.4).
e Coments - This section is provided for the evaluators p
L comments. Any pertinent information, references, etc. should be listed here.
The differences sheet (Figure 3) is used to document differences between the Yankee and WOG procedures set. This sheet will be used for both bases and ctep comparison.
Initially, only the top portion of the
{
sheet, including a description of the difference, need be completed. If the person noting the difference can readily evaluate the reason for the difference, the evaluation section may also be completed. The disposition / justification sections will be completed later by a g
L reviewing team. The person noting the difference should sign and date in the places provided.
C-9
lI l
\\l{1\\
l 1;l1l\\i
,i 1i i
P D. &w
~
$a$nO*S*k".
w; ' WS es i.
. e R
5 P
/
w.
J 4j
-O k
\\
l I;
l R
ST4 fp ma0 R
C R
C S0 I0D8 R
ug ew e
irjne;s*,
a R
S EN U
I L
E0 6U G
t P
sA U
B U
lO C
A R e
)
o MG p
TS c
i AB v
TfSN T
2 RW N
A EO U
L E
S P
UE R
OS PU U
RO G
A H I
EG F
LN W.
f CI1 U5 R
q Nt A.
b Ew P
M E O K
f.
1 C.
NA8 S.
8 5
V0 1
A 1
R R
K_
. n A
sym P
FI v.
0 C
40 f
- v. w"",
C Y.
=a E
N, S
A 9_
A t
S G
1 fm S
f$A B
G R
E G
OW e=
=
re g
k i
l
<rl 11l
Differertce Number
{
YANKEE NUCLEAR POWER STATION CSF AND RECOVERY PROCEDURE /WOG ERG COMPARISON
[
DIFFERENCES SHEET OP/EO? Number and Titles
(
Step Number (s) :
Procedure revision:
MOG ERG Number and
Title:
Found During: Bases Comparison Step Comparison (check one)
Difference:
[
Evsluation:
E
[
Recommended Disposition / Justification:
[
Final Disposition / Justification:
[
Difference noted by:
Date:
Disposition / Justification Approved.by:
Date:
[
Figure 3 Sample Yankee /WOG ERG Comparison Differences Sheet C-ll
m 1
ll 1,
i1i l/rQ>eA*.lJ J.
- u s
k
- r J
.y(
m m
o ecne m
re f
f i
D n
fo no i
t n
p irc F
s C
e E
D n
JO f
R e
G P
i O
r n_
T L B
R G OP N I
P K
U 4
S CA E
E R UI R
D T U
A G
R E G C F
P N E
U R P E O F E F I
d E D e
E ev n
K tl N
ao A
Ds Y
eR U
d erey tB n
E N'
de er t e at DnE n
l r ae ibrm n
eu SN n
O n["
l J
1I1lllll
(
1 e
i~VI 41 Q
E.
[h h, M.
A 3.1.4.
Difference Tracking System A tracking system will be used to document and track all differences I
noted during both the bases and step comparisons. Each notable difference will be documented on a difference sheet as discussed in section 3.1.3.
Furthermore, each difference will be assigned a serial number taken from the Difference Tracking Log (Figure 4).
Those differences noted during the bases comparison will be prefixed with a
'B' (e.g., B-001) and those noted during step comparison will be prefixed I
with an
'S'.
Furthermore, separate log books will be kept for the step and bases comparison. The actual differences sheets will be kept in the log book behind the log sheets, in numerical order.
3.1.5.
Resolution of Differences All differences noted during either the bases or step differences i
must be recolved. Resolution may include technical justification based on plant specific system arrangement, procedure revision, or additional engineering analysis. In any case, the project manager will coordinate
-l with the Yankee Project team to resolve any differences. The Yankee 5
Procedure development Team has final say in any resolution and a designated Yankee representative should sign the differences sheets when the associated resolution is agreed upon. Once a difference has been I
satisfactorily resolved, it should be signed off in the tracking log (section 3.1.4).
I The project manager shall evaluate all differences and provide a recommended disposition for the differences. The recommended disposition will be documented on the differences sheet (Figure 3).
The recommended disposition will be presented to the Yankee Procedure Development Team at a scheduled meeting. ' The Yankee Procedure Development team will then review the recommended dicposition and either agree or provide an alternate disposition. Where additional action is needed, it should be so noted on the differences sheet. As previously noted, once the disposition of the dif ference is accepted, the difference is resolved and should be signed off and cleared from the tracking log.
3.2 Task 2:
Step-to-Step Comparison Once the bases comparison is well underway, the step-to-step comparison I
can begin. The objective of the step comparison is to determine how the individual Yankee procedure steps compare to the WOG procedure steps for areas where the bases are comparable. Based upon this comparison, we will document I
notable differences and make recommendations on disposition of the differences. This task will draw heavily from the work already accomplished during the bases comparison which, as part of its effort, identified the steps tnat apply to each basis.
The step-to-step comparison will use the same basic methodology used for the bases comparison. Accordingly., the coordinated team concept will be used with frequent meetings of team members to discuss findings and task status.
Documentation and differences tracking will also be similar to that used during the bases comparison.
C-13
1 S..\\ ), b
.y..
w
- s t
a d
3.2.1.
Step-to-Step Comparison Documentation L
As was the case for the bases comparison, the step comparison must be well documented to ensure a complete and accurate comparison is g
L Performed. Accordingly, a step comparison worksheet will form part of the documentation efforts. This worksheet is shown in Figure 5.
I The step comparison worksheet is similar to the bases comparison H
worksheet in layout and in its use. The following instructions provide details in completing this worksheet.
7 g
Procedure number, title, and step no. - Enter the applicable f'
L e
NOG and Yankee procedure numbers, title, and step numbers. In most cases, the compari' ton will deal with groups of steps as a l
comparison versus individual steps. These groups are identified in the bases comparison worksheet.
Step Cmparison Columns - The step columns will be used to list e
L the procedure steps as they appear in the WOG and Yankee procedures. From this step listing, steps or groups of steps may then be compared.
7 L
e Differences - The differences column is used to denote whether notable differences exist between the NOG and Yankee steps (s).
If a difference exists, the
'Y' column should be checked and a discrepancy number assigned (section 3.2.2). If no difference exists, check the
'N' column.
e Comments / Evaluation - This section is provided for the evaluators mmments. Any pertinent information, evaluation, references, etc. should be listed here.
The differences sheet (Figure 3) previously discussed in section 3.1.2 of this plan, will be used to document any notable differences found during the step comparison. This sheet will be used and filled out similar to the method used for the bases comparison.
3.2.2.
Difference Tracking System The step comparison efforts will use the same tracking system used for the bases emparison (see Section 3.1.3) except that step comparison dif f erences will be assigned the prefix
'S' versus 'B'. In addition, a separate tracking leg will be kept for the step comparison sheets.
3.2.3.
Resolution of Differences Any differences noted during the step comparison will be resolved using the method described in section 3.1.4.
1l(1
\\
$a.w
_o I
-b
~t
~W
- A Cef m
M.
P pf
.7 A
O h
7 M
A l
U LA F
W(
4 N
EM l
W f
O I
E 5
fC 3
N f
E N
R L
F E
Fe N
D I
D U
y U
G PU O
R G
NS OR C
I E
T N
A W TS O RE f
P S
f W U f
O 5
O H c
P s
G ti E
R NI fr R
A T
F P.
U S
r L
G C
T E
I U W N
A F
NO t
f T g~
P F N
- J
~
K O
e NS p
a A
I e
R V A w
P r
M U
r O
fg C
g S
E c
o R
ts U
c D
y P
E C
?
O g
R a
P g
f m
r w
P t
f G
M(
GO W
E L
) TWY s
1 c
f 5 e
I, s
- 8 #J f
I r
M M f f P
E f CE l
f f f
- R g
' P A
t GG
- R f E P
GM fM3 Ot fs Wn Zu t
l l
11
k*.
kM5 i
a-3.3 Task 3:
Final Yankee ERG Set Development The results of the Task 1 and Task 2 efforts will be used in development of the final Yankee ERG set. Specifically, the difference sheets generated
[
during the comparison efforts will identify how the ERG set should be revised to conform to the WOG generic technical guidelines. In addition, the final Y:nkee ERG set will be revised in accordance with the findings of the V;rification and Validation Program.
(See Appendix F of Procedures Generation PEckage.)
1 3.3.1 Use of Differences Sheets Prior to ERG set revision, the difference sheets from task 1 and task 2 will have been evaluated and the recommendations for action Those differences for which approved by the Procedures Development Team.
procedures revision is recommended will be assigned to procedures writers by the project manager. The project manager will sign-off the Difference All Tracking Log once the procedures revision has been accomplished.
procedure revisions should conform to the Yankee Writers' Guide and will be subject to the standard procedures review process.
[
C-16
.h
,8 W][
f'
~6 T'
g, u3 E
0;0*[#
r g-
['.4 N$ &{ ~
I I
'I
!I I
1 l
- I
- I 1
APPENDIX D
~
WRITER'S GUIDE FOR EMERGENCY RESPONSE GUIDELINES I
l I
I
- 5 I
I I
1 iI I
I
k t
s n.t g
E
[
WRITER'S GUIDE FOR EMERGENCY RESPONSE GUIDELINES L
May 1986
[
f YANKEE ATOMIC ELECTRIC COMPANY L
YANKEE NUCLEAR POWER STATION
[
1 7 n. _
T-"
QI.!p. I -- %
n s
v
-%T
. -d' f.1 u
m hbnb d
CONTENTS Page.
1.
SCOPE.........................................................
1 1
1
[
2.
PURPOSE.......................................................
1 h
3.
DEFINITIONS...................................................
1 3.1 Emergency Response Guidelines...........................
1 3.2 Critical Safety Function / Emergency Operating Procedures.............................................
1 3.3 Recovery Procedures.....................................
1 4.
REF E REN CE S....................................................
2 I
L 5.
PROCEDURE IDENTIFICATION SYSTEM...............................
2 5.1 Procedure Organization and Numbering Scheme.............
2 5.2 Procedure Title.........................................
2 5.3 Revision Numbering Scheme...............................
2 5.4 Page Identification.....................................
2 6.
PROCEDURE FORMAT..............................................
4 6.1 Master Critical Safety Function Procedure Format........
4 6.2 EOP Format..............................................
4 6.3 Recovery Procedure Format...............................
5 7.
ACTION STEP CONSTRUCTION....................'..................
6 7.1 Level of Detail.........................................
6 7.2 Step Sequencing.........................................
7 7.3 General Step Length and Content Guidelines..............
7 7.4 Types of Steps..........................................
8 7.5 Writing Style...........................................
9 7.6 Logic Terms.............................................
10 7.7 Conditional Statements..................................
11 7.8 Referencing and Branching...............................
11 7.9 Word Choice.............................................
12 7.10 Cautions................................................
13 7.11 Notes...................................................
13 7.12 Component Identification................................
14 7.13 Acceptance Criteria and Calculations....................
14 7.14 Methods of Emphasis.....................................
15 7.15 Placekeeping Aids.......................................
15 ii
(h 3
[
d.A h d.s.;a., b 2 A M
_n Page 8.
PRINTED OPERATOR AIDS.........................................
15 8.1 Types and Numbering Scheme..............................
15 8.2 Placement...............................................
15 8.3 Quality.................................................
16 8.4 Consistency.............................................
16 FL 9.
MECHANICS OF STYLE............................................
16 9.1 Spelling................................................
16 9.2 Abbreviations and Acronyms..............................
16 9.3 Capitalization..........................................
17 9.4 Hyphenation.............................................
17
(
9.5 Punctuation.............................................
18 9.6 Numerical Values........................................
19 10.
TYPING AND REPRODUCTION.......................................
19 11.
ERG REVISIONS AND UPDATES.....................................
20 11.1 Revision Requirements...................................
20 11.2 Revision Process........................................
20 APPENDIX A - EMERGENCY RESPONSE GUIDELINES.........................
A-1 APPENDIX B - SAMPLE FORMATS........................................
B-1 APPENDIX C - ACTICN VERBS..........................................
C-1 APPENDIX D - VOCABULARY............................................
D-1 APPENDIX E - ABBREVIATIONS AND ACRONYMS............................
E-1
[
[
[
iii
TI V y fr ymv
[
1 WRITER'S GUIDE FOR EMERGENCY RESPONSE GUIDELINES YANKEE ATOMIC ELECTRIC COMPANY L
YANKEE NUCLEAR POWER STATION 1.
SCOPE This writer's guide applies to the Emergency Response Guidelines for Yankee Nuclear Power Station.
2.
PURPOSE This document establishes format and content standards for Emergency Response Guidelines (ERGS). The ERG writer shall adhere to these guidelines in the writing of ERGS and in subsequent revisions.
3.
DEFINITIONS 3.1 Emergency Response Guidelines The ERGS specify actions to reduce or avoid the consequences of an p
accident or potentially hazardous condition. These actions logically L
fall into two major groups.
First, certain actions are required immediately and e
automatically for nearly all situations. These actions are covered in Critical Safety Function / Emergency Operating Procedures.
Second, certain actions follow diagnosis and may only be used e
for specific events. These are covered in Recovery Procedures.
Together the Critical Safety Function / Emergency Operating Procedures and the Recovery Procedures make up the ERGS.
3.2 Critical Safetv Function / Emergency Operating Procedures Critical Safety Function / Emergency Operating Procedures (CSF/EOPs) cover symptom-oriented, immediate operator actions required to ensure a stable or improving plant condition regardless of the initiating event.
While not a final solution to the accident, these steps secure the plant I
for a sufficient time to allow a sound diagnosis of the event.
In fact, the CSF/EOPs give significant information to the diagnostic process.
l 3.3 Recovery Procedures The Recovery Procedures flow logically out of the CSF/EOPs after event diagnosis. They contain the event-oriented, subsequent actions the operator takes to restore positive long-term control of the plant. They
[
do repeat CSF/EOP operator actions to provide more detail and verification steps for the operator.
1 l
y.*+ m r-.; 7 ----
b iii Nb(.
b{t l
I ip-
- /
{
4.
REFERENCES The following documents were used to prepare this guide:
1.
NUREG-0899, Guidelines for the Preparation of Emergency Operating Procedures, August 1982.
2.
INPO 82-017, Emergency Operating Procedures Writing Guideline, July 1982.
1 L
3.
AP-0001, Rev. 10, Plant Procedures and Instructions, Yankee Nuclear Power Station.
[
5.
PROCEDURE IDENTIFICATION SYSTEM 5.1 Procedure Organization and Numbering Scheme
[
The ERGS are uniquely identifiable by number, title, revision number, and attachment or case subdivision. They are numbered 3100-3199 and organized as follows:
A Master CSF Procedure, OP-3100, identifies the five critical e
safety functions.
(
e The EOPs are attached to the Master CSF Procedure. The EOPs are numbered 1 through 10.
The Recovery Procedures are separate from the Master CSF e
Procedure /EOPs and are numbered sequentially beginning with OP-3101. A Recovery Procedure may be subdivided into Case 1, Case 2, etc., as content requires.
Appendix A contains a list of all ERGS, their number, and title.
S'. 2 Procedure Title The Master CSF Procedure, each EOP, and each Recovery Procedure have a unique title. The title must be brief, yet descriptive, so two principles should be kept in mind:
e Keep the title 10 words or less.
Do not bury important words at the end of the title.
e 5.3 Revision Numbering Scheme Revisions of ERGS are numbered sequentially with Arabic numerals.
{
5.4 Page Identification The page layouts in Appendix B show the exact location of the page identification information discussed below.
5.4.1 Master CSF Procedure Page 1 of the Master CSF Procedure includes the following identification information in the upper right corner:
2
,fa 6
O
/dt
}:
/
\\ r.
4
\\.-. L
- i. :..
c.
t.
I e
Procedure number e
Revision number I
e Date The page number is not indicated on page 1.
Pages that follow (if any) have the procedure number and revision number in the upper I
right corner and the page number centered at the top (for example, ).
5.4.2 EOPs Each page of an EOP has the following identification information:
EOP number in upper lef t corner (for example, EOP #4) e e
Page number (including page 1) in upper center (for I
example, )
e Procedure number and revision number in upper right corner, for example.
OP-3100 Rev. O If an EOP continues onto another page, CONTINUED ON NEXT PAGE is typed after the last step on the first page.
5.4.3 Recovery Procedures Page 1 of a Recovery Procedure has the following identification information in the upper right corner:
o Procedure number I
e Revision number e
Date The page number is not indicated on page 1.
The pages after page 1 have only the procedure number and revision number in the upper right corner. The page number is centered at the top of each pae- ' tor example, ).-
5.4.4 Recovery Procedurt
'e ac' ents Each page of a Recovery Procedure attachment (including page 1) has the following identification information:
I Procedure number, revision number, and attachment letter e
designator in the upper right corner, for example:
OP-3108
,g Rev. O g
Att. A Page number at upper center, for example, -1.
e I
h
?,
b, D3IU
,i
[Y, f:,.s
?)
?
1 dd%
h 3
6.
PROCEDURE FORMAT The functions of the ERGS require different formats. The formats of the Master CSF Procedure, the EOPs, and the Recovery Procedures are presented separately below.
6.1 Master Critical Safety Function Procedure Format
[
6.1.1 Page Layout The Master CSF Procedure is a " single-column" procedure. The layout including margins is shown in Appendix B.
6.1.2 Major Sections The content of the major sections of the Master CSF Procedure is described below. The format is shown in Appendix B.
e SCOPE. This section briefly describes the intent of the Master CSF Procedure and the attached EOPs--to give the immediate actions necessary to detect, verify, diagnose, and initiate the appropriate response to all events that challenge any of the five CSFs.
e ENOLOSURES. This section simply lists the procedure contents by page number and revision number so that the operator may verify its completeness:
OP-3100 - Pg. 1 - Rev. 3 EOP 1 - Pg. 1 - Rev. 3 EOP 2 - Pg. 1 - Rev. 3 and so on.
e IMMEDIATE OPERATOR ACTIONS. This section contains numbered steps for immediate actions when a threat is perceived to any of the five CSFs:
Reactivity Secondary Cooling and Inventory Main Coolant Inventory Core Heat Removal Vapor Container Integrity This section directs the operator to one or more of the EOPs according to symptoms within the five CSFs.
6.2 EOP Format 6.2.1 Page Layout The EOPs are in dual-column format. The left column is
" Action" and the right is " Alternate."
4
2J al n.A as le L
variations of an event, " Case" subdivisions are used, for example, " Case 1" or " Case 2."
The format for " Case" subdivisions is shown in AppeMix B.
e AT1'ACHMENTS. Attachments are designated with capital letters (Attachment A, Attachment B) and should be referred to in order in the body of the procedure. The Attachments provide detail, discussion, and the rationale or basis for action steps in the body of the procedure. At a minimum,
[
each Recovery Procedure contains one attachment covering I
DISCUSSION and BASIS:
DISCUSSION. A discussion of the event and its potential ramifications.
BASIS. The technical basis for the prescribed actions.
Where additional detail is needed for one or more alternative actions, the operator may be directed to an attachment that details the steps of an action. This method keeps the body of the proceduce as brief as I
possible.
The format of a Recovery Procedure Attachment is shown in Appendix B.
7.
ACTION STEP CONSTRUCTION 7.1 Level of Detail An ERG should contain the detail needed by the least trained I
operator expected to use the procedure, specifically,.a newly trained and licensed operator.
Other factors affect the amount of detail needed, such as the I
potential or actual stressful environment in which the ERGS are used, and the frequency with which a given task is performed. A procedure cluttered with unnecessary instructions and information will hinder I
efficient per formance, especially in a stressful situation. However, although an operator may be trained in a task, he/she may need to perform it so seldom that instructions in the ERG may be helpful, indeed warranted.
In the Yankee-Rowe ERGS, the amount of detail is a prime difference between the Master CSF/EOPs and the Recovery Procedures.
7.1.1 Master CSF Procedure and EOP Attachments I
The conditions under which these procedures are used require that the operator function rapidly and efficiently. Operator training in the ERGS must support the level of detail in these procedures. Moreover, the dual-column format of the EOP I
Attachments forces brevity upon the writer.
I 6
I
'. ' - f) 2
/1 p c#
(
d.ud bkd I?kIb di Appendix B contains a sample page layout for EOPs. Each page contains the procedure number (OP-3100), EOP number, revision number, EOP page number, and EOP title.
6.2.2 Major Sections The EOPs contain two major sections, described below:
e SYMPTOMS. This section contains a single-column list of
{
symptoms (with logic wocds as appropriate) that initiate the EOP.
Appendix B shows the format of this section.
e ACTION and ALTERNATE. This section is in dual-column format. The actions are briefly stated in the left column. Should the correct response not be obtained, the
{
operator then performs the alternate action in the right column. The last step in this section directs the operator to the appropriate Recovery Procedure (or another EOP if required).
6.3 Recovery Procedure Format 6.3.1 Page Layout The Recovery Procedures are in single-column format because they contain more detail than the Master CSF Procedure and the EOPs. However, the Recovery Procedures must still allow for efficient operator actions during an event. Appendix B contains a sample page layout for the Recovery Procedures.
6.3.2 Major Sections The major sections of the Recovery Procedures are described below:
e SCOPE. This section contains a brief statement of what the procedure covers, o
ENCLOSURES. This section lists by page number and revision number the procedure contents. For example, OP-3101 - Pgs. 1 rev. 2 Attachment A - Pgs. 1 Rev. 2 Attachment B - Pgs. 1 Rev. 2 e
SYMPTOMS. This section lists plant symptoms or entry (L
conditions that uniquely define the event in progress.
e PROCEDURE. This section contains the operator action steps, numbered with Arabic numerals, to restore control of the plant. Where the subject matter involves two or more
[
)&
S
?
)
(,
I M' M b /_.~n.1 cd 7.1.2 Recovery Procedures The single-column forraat accommodates more detail, as stated earlier, particularly in its attachments (described in Section
- 6. 3.2). The general guideline still applies, however: The procedure and attachments are written for a newly trained and licensed operator.
{
7.2 Step Sequencing Steps should be listed in the required sequence. The operator f
assumes the sequence is mandatory unless the procedure specifically L
states otherwise.
Other considerations irl sequencing action steps are:
1.
Structure the control room action steps to ensure that minimum I
control room staff can perform the actions.
2.
Sequence the steps to minimize physical conflicts among operators.
l 3.
Sequence the steps to avoid unintentional duplication of steps by different operators.
l 7.3 General Step Length and Content Guidelines Regardless of the ERG formct, instruction steps should be short and simple sentences dealing with only one idea. The following specific guidelines apply to step construction in any ERG format:
1.
The number of action verbs per step should be limited to one, unless the actions are closely related, in which case up to three action verbs are acceptable. Appendix C defines some of I
the action verbs commonly used in ERGS.
2.
Complex evolutions should be described in a series of steps.
I 3.
The doer of the action, the operator, does not need to be stated.
4.
Imprecise adverbs (for example, frequently or slowly) should not be used.
5.
Double negatives should be avoided.
6.
When an action has three or more objects, they are listed vertically using hyphens. For example:
1.
Decrease MC pressure by control of:
Pressurizer heater / spray I
SI System ChargingA!C bleed I
7 I
[
..-.- r ~,
?
['
L 'a %
~ih, L.
7.
When actions are required based on receipt of an annunciated r'
alarm, the alarm setpoint should be listed.
L 1
8.
If required for proper understanding, the system response time l
associated with the action should be described.
9.
When system response dictates a time frame within which the action must be accomplished, the time frame should be stated.
{
Generally, however, using time to initiate operator actions should be avoided because operator actions should be related to plant parameters.
10.
When anticipated system responses may adversely affect instrument indications, (1) the conditions that will very likely introduce instrument error and (2) a means of
(
determining whether instrument error has occurred should be described in a CAUTION.
11.
When additional confirmation of system response is considered necessary, the backup readings to be made should be stated.
12.
A step should never be continued onto another page. A page may h
run short or long to avoid splitting a step.
7.4 Tvpes of Steps Guidance for different types of actions follows.
7.4.1 Simple Action Step Begin this type of step with the action verb:
Close.
Open.
Position.
7.4.2 Verification Step Begin with an action verb that clearly indicates that verification is to be performed:
Verify.
As stated in the guidelines above, list three or more items to be verified vertically.
7.4.3 Continuous Step Indicate clearly that this action is to be performed
{
continuously. For example:
Continue to scan for and respond to multiple challenges after Recovery Procedures are initiated.
8
},,' MK FS.,
v*
5.wure. p. ;,.
yt y-m.
p-
/t-.
.e l
j.- i Yg 144,'
dl' s.,. wn gg s
7.4.4 Recurrent Step Indicate clearly to the operator:
e When or how often the step is to be performed e
Under what conditions the step should no longer be carried out.
I The operator 'should also be reminded to carry out the step. An L
example of a recurrent step is:
Check... tank level every' 30 minutes.
7.4.5 Alternative Step I
State specifically that the prescribed step may be performed in alternative ways (if any) by using the logic word O_R.
For example:
3.1 Manually trip turbine at MCB, OR l
3.2 Manually trip turbine at turbine pedestal, OR 3.3 Trip NRVs l
7.4.6 Concurrent Steps Indicate clearly whether any steps need to be performed I
concurrently with other steps by using such words as
" simultaneously" or "at the same time."
I If the actions are closely related, join the actions with e
f "and" within the same step. Houver, "and" does not in itself imply simultaneous performance, so the need for I
simultaneous action still needs to be stated.
l If the actions are not closely related enough to be e
included in the same step, or if there are more than three closely related actions, list the steps with a lead-in instruction indicating the need for simultaneity, such as
" perform the following actions simultaneously."
l The number of concurrent steps should not be beyond the capability of the control room staff to perform them.
7.5 Writing Style The different formats of the ERGS require different writing styles. The EOPs and Recovery Procedures are treated separately below.
I 7.5.1 EOPs The dual-column format necessarily requires minimum words to convey an idea. Unnecessary words such as articles should not be used. For example:
9
}
.f k
4 b
L),& u.4 g y
i
~
c.
Too wordy for EOP:
Verify that the valve is closed.
{
More appropriate for EOP:
Verify valve closed.
7.5.2 Recovery Procedures The single-column format allows a less cryptic writing style in the Recovery Procedures. The words that were omitted in the EOPs may be used here. For example:
EOP:
Verify all rods in.
Recovery Procedures Verify that all rods are in.
However, excess wordiness is a detriment to understanding no matter what the format. Action steps should always be short and simple and should contain only one idea.
7.6 Locic Terms The following guidelines apply to the use of logic terms:
7.6.1 AND/OR Avoid the use of AND and OR in a conditional statement. When AND and OR are used together, the logic can be very ambiguous. For example, the following instruction could be interpreted in more g
than one sense:
i IF Condition A AND Condition B OR Condition C occurs, THEN go to Step 3.
7.6.2 AND When attention should be called to combinations of conditions, use the word AND between the conditions. Do not use the word AND I
to join more than three conditions.
If four or more conditions need to be joined, use a list format.
I When used as a simple conjunction, "and" need not be emphasized:
Stop the pump and place it in standby.
7.6.3 OR Use the word OR when calling attention to alternative combinations of conditions.
7.,6. 4 IF or WHEN...THEN When action steps are contingent on certain conditions or combinations, begin the "tep with "IF" or "WHEN" followed by a I
description of the condition (s), a comma, and the word "THEN" followed by the action to be taken.
"WHEN" is used for an expected condition.
"IF" is used to determine the specific course of action based on plant conditions.
10 I
h 1
6 q
g.x j
d,d-
,(
w a
7.6.5 IF NOT Use IF NOT only where the operator must respond to the second of two possible conditions.
IF should be used for the first condition. For example:
IF pressure is increasing, THEN stop the injection pump; IF NOT, THEN start an additional injection pump.
[
Examples of conditional statements using logic words are given in Section 7.7 below.
7.7 Conditional Statements Conditional action steps must be constructed simply and clearly
[
because of the often complex logic.and ideas. The following rules apply:
1.
The "if" clause must precede the action:
IF high radiation, THEN go to EOP #6, " Secondary Radiation High."
2.
Where multiple conditions exist, a list approach is preferable:
IF any of the following conditions are indicated:
A B
C THEN go to OP-3116, 3.
Where each condition produces a different action, the following structure may be used:
(
IF turbine bypass flow has initiated AND:
Power is greater than 30%, THEN go to Step 2.
Power is between 25% and 30%, THEN go to Step 3.
[
Power is less than 25%, THEN go to Step 4.
Conditional statements are treated in detail in NUREG-0899, Appendix B,
(
and in INPO 82-017, Section 2.3.18.
7.8 Referencing and Branching 7.8.1 Definitions The term " referencing" in connection with another procedure
[
implies that the referenced procedure will te used as a supplement to the initial procedure. Referencing can also occur within a procedure, either forward or backward.
[
11 p
A l
g
. fl'lin
- ?
- 1 l.
),L ji The term " branching" means that an operator exits the initial procedure and enters a new procedure, so that at any given time he/she is working with only one procedure.
7.8.2 Criteria Excessive referencing to other procedures or forward / backward I
within a procedure causes operator errors. The following criteria apply:
1.
Repeat the needed inforr.ation rather than referencing if the length of the procedure will not be substantially increased.
2.
Reference complete procedures or sections of procedures if I
possible. Requiring an operator to use another procedure for just a few steps is to be avoided.
3.
Be sure to clearly direct operator back to where h
r APPENDIX B L
SAMPLE FORMATS b
1.
PAGE MARGINS All the ERGS are typed and reproduced on 8 1/2" X 11" paper. The margins are the same for every page of every ERG:
e Left: 11 inch e
Right: 11 inch e
Top: 11/2 inch above identification information in right corner e
Bottoms 11/2 inch 2.
PAGE LAYOUTS This appendix contains the following sample page layouts and formats:
Figure Figure Title Page
{
l Master CSF Procedure Page Layout B-2 2
EOP Page Layout B-3 3
Recovery Procedure Page 1 Layout B-4 4
Recovery Procedure Page Layout (after
{
page 1)
B-5 i
5 Recovery Procedure Attachment Page Layout B-6 I
ri 1
l B-1 i
q h
b~ r d ias %
da L
r Proc. No. OP-3100 Rev. No.
O Date 3/27/64 CRITICAL SAFETY FUNCTION SCOPE The objectives of these instructions are to provide the immediate actions necessary to detect verify, diagnose and to initiate the appropriate response to all events which chailenge any of the five (5) Critical Safety Functions (CSF).
ENCLOSURES 0F-3100 - Pg. 1 - Rev. O IM"EDIATE OPERATOR ACTIONS 1.
Respoed to the symptoms of a threat to any Critical Safety Function using the Emergency 0;erating Procedures (EOP) as listed below I
2.
For multiple challenges, the priority is in numerical order with #1 of highest priority.
j 3.
Coatinue to scan for and respond to multiple challenges af ter this procedure I
or Recovery Procedsres are initiated, 4
Initiate OP-33CO, " Classification of Emergencies".
i I
CSF E00 REA:TIVITY Reactivity Aro aly l ECD #1 I
SECONCARY 5ecendary Seccedary Secondary Secondary i
CCO.IN3 &
Press High Level High Level Low Press low l
INVENTORY E0P #2 E0P #3 E0P #4 E0P #5 MAIN Secondary Main Coolant y
COOLANT Rad High Press Low I
INVENTORY E0P #6 E0P #7 l
CCRE HEAT Main Coolant Main Coolant l
RE C AL Te*c High Press High E0P #8 E0P #9 VADOR VC High CONTAINER Press High I
INTEGRITY EC: #10 Figure 1.
Master CSF Procedure Page Layout B-2 i
K.W T.,
3 e,3.m t m-s a.
c
.x rr 2
s ^
W '<
(
r.l,., y, l
.. 5%kis kk.
'^
r s
Y' N N };
OP-3100 E0P =4
-1 Rev. 0 SECONDARY LEVEL LOW SYMPTOMS:
- One or more steam generator low level and decreasing ACTION ALTERNATE 1.
If two or more S/G narrow range levels s -13", then verify auto scram
[
2.
Verify all 5/G 2 10 feet 2.1 Manual Scram, AND 2.2 Trip associated MCP's 3.
Isolate as recessary to main-NOTE: 3 loop operation is not allowed tain secondary system integrity C. At. i..! D. N..:..O. n l y f. e. e. d.. s t e. a m. g e. n e.
- a. t e r s.w. h..i c h.. s h. o. w.. a...l e. v e..l..............................
[
4 Restore and ratetain 5/G levels 4.1 Flant must be reduced to 5 Mode 3 with nain feed system 4.2 Feed with:
system
- Erergency feed pu*p 82
- Emergency feed cump #1 A 2.5 e rute celay prevee.ts
- Steam driven EEFP NOTE:
a restaet of the rain feed
- Ctaeging puTps pu c5 on a tu* tine trip
- Safety injection pumps-OR acc.e. 15 Mae 4.3 Go to EOD #8 "M.C. Temp. High" 5.
v ea 5/G 1evels a-e rest: red,
[
and ccatrollec at '10 ft proceed to apprcpriate recovery proceb res
[
Figure 2.
EOP Page Layout B-3
A
- 7 i
l:g f:-
w LCM h
w l
l Frne. No.
OP-3113 l
%ev. Nc.
Original Oate 07/19/85 LOS$ OF A.C. $UCplY g
SCOPE I
To place the plant in a safe condition following a total loss of A.C.
i power during modes 1-4 by providing emergency ele:trical power in vital l
I plant equipment.
l ENOLOSURES I
0P-3113 - Pgs. 1 Original OP-3113.1 - Pg. 1 - Original Atta:hment A - Origiral SYMPT 0ws 1.
Loss of Z-126 and Y-177 line voltage ir.dication with loss of Line l
Alive lights.
2.
Noticeable redu: tion in plant rotse and illuminatien levels.
l PROCEOU:E 1.
Verify that no challerges to tre CRITICAL SAFETY FUN:TIONS exist through continuous review cf the CRITICAL SAFETY FUN:ilCNS procedures using all available irdications.
If a challeece esists. ce fee ~ the ste;s asso:1sted with the a;;repriate I
CRITICAL SAFETY FUN; TION c*oce are c: incident with this prc:ecure.
I 2.
Reaffirm rea:ter scram and tuttine trip per OP-3101, " Scram Recovery Procedure."
3.
Ann unce on the plant page system that a tctal loss of A.C. has CCCurred.
i l
4.
Initiate OP-3303, " Classification of Emergencies."
1 5.
Close hRV's and control steam generator pressures with atrescheric l
steam du ;s.
I NOTE:
Pcwer for ate:s;heric steam dumps are supplied frem EM 0-3 and EM C-4.
6.
If PR-50V-90 actuates en this accident, verify auto closure at set point pressure (2353 psig). If FR-50V-93 does not close, initiate c1:sure. If unsu:cessful, close PR-MOV-512.
i 7.
Instruct se:endary A.O. to place nitrogen on auxiliary steam valve, establish feed path, start steam driven EEFP and place the main auxiliary oil pu*.;: in the trip pull-out position and C;en Main Cendenser Vacuum breaker.
l Figure 3.
Recovery Procedure Page 1 Layout 4
B-4 i
t t
y a
d d
OP-3108 I
Rev. O 3
Att. T ATTACHMENT A I
DISCUSSION AND BASIS FOR OP-3108 " FUEL CLADDIN3 FAILURE" 015tU5510N This emergency condition is defined as a significant fuel cladding failure.
The plant design is such that only minor fuel cladding failure can be handled I
by the purificatien system curing normal plant operation.
BASIS Step 1 The C*itical Safety Functices, CP-3100, have precedence over Recovery Preced.ees. This step serves as a reminder of the constant requirement te ronite a*d respord to threats to the Critical Safety Functions.
I Receveey p eced res follcw a conferred diagncsis of the situation.
Ster 3 Secu e feed aed tiee: 11res to preveat sp-eading radioactivity in the M 5 r
thecu;nout the FAB.
Step 4 5 *vey the valve rec
- te ve*4') the tieed lire ec* iter readirgs and pie;cirt tr.e sc ece cf the rac'.atica.
Ster 5 C*eca incere tae ccc.cle readings to dete-rine if cladding datage is tr:'catec are se,erity.
Ster 6 I'
A positive check for cladding damage is M:5 saeple.
Ster 8 The re;uicement to place a VC hydrogen monitor in service within 30 minutes of a 51A5 provides the fu ction of ronttoring the VC atmosphere for hydrogen a
cercentratien within a reascnable time. The 30 minute time requirement is re-dated by the NRC 1r NUREG 0737 Item II.F.1, Attachment A.
I Ster 9 Analysis de?onstrates that the f ans are not required during the first hour of the worst Case events. However, operation of the VO Post Accident Recirculation fans at the oee hour Park assures a well-mixed containment atmosphere, preventing the local 12ed build *up of hydrogen (if released to such an esteet).
I I
m s.
-~.
m.~.-
me. m-I B-6 I
1 9 d, i s V\\. pd
)
- 1
+
&W G Nu k O
U-y I
b APPENDIX C ACTION VERBS
{
The following are some of the action verbs commonly used in the ERGS.
1.
Allow - To permit a stated condition to be achieved before proceeding, for example, " allow pressure to stabilize."
2.
Check - To perform a physical action that determines the state of a variable or status of equipment without directing a change in status, for example, " check boric acid mix tank level."
3.
Close - To change the physical position of a mechanical device so that it prevents physical access of flow or permits passage of electric current, for example:
"close valve."
4.
Complete - To accomplish specific procedural requirements, for example, I
" complete valve checkoff list."
5.
Establish - To make arrangements for a stated condition, for example, I
" establish communication with control room."
6.
Inspect - To measure, observe, or evaluate a feature or characteristic for comparison with specified limits; method of inspection should be included, for example, " visually inspect for leaks."
l 7.
Open - To change the physical position of a mechanical device, such as a I
valve or door, to an unobstructed position that permits access of flow, for example, "open valve."
I 8.
Record - To document a specified condition or characteristic, for example, " record pressure."
9.
Set - To physically adjust to a specified value an adjustable feature, for example:
" set diesel speed to.
10.
Start - To originate motion of an electric or mechanical device directly I
or by remote control, for example, " start charging pumps."
l 11.
Stop - To terminate operation, for example, "stop charging pumps."
12.
Throttle - To operate a valve in an intermediate position to obtain a certain flow rate, for example, " throttle valve to.
13.
Trip - To activate a semiautomatic feature, for example, " trip breaker."
14.
Vent - To permit a gas or liquid confined under pressure to escape at a vent, for example, " vent pump."
15.
Verify - To observe an expected condition or characteristic, for example,
" verify discharge pressure is stable."
1 C-1 I
j
k,
}'r' j
s'
?.
t L... il 4.
a APPENDIX D VOCABULARY 1.
RECOMMENDED SPELLINGS bleed line (two words) blowdown (noun or adj.): " blowdown cross connection" bus (singular), busses (plural) cool down (verb) cooldown (noun or adj.):
" plant cooldown" de-energize (use the hyphen) feed line (two words)
I feed pump (two words) feedwater (one word) flow path (two words) line up (verb):
"Line up the feed line."
I lineup (noun):
" Verify valve lineups."
letdown (noun:
" Return letdown to normal."
makeup (noun or adj.):
" makeup water" I
motor deiven (no hyphen) motor operated (no h:' phen) re-energize (use the hyphen) re-establish (use the hyphen)
I setpoint (one word) shut down (ve rb) : " Shut down reactor."
shutdown (noun):
" Verify reactor shutdown."
I stand by (verb):
"to stand by" standby (noun or adj.):
"on standby," " standby pumps" start up (verb):
" Start up water treatment."
I startup (noun):
" plant startup" stea n line (two words) subcooling (one word) 2.
WORDS TO AVOID frequently - Imprecise I
normal - Do not use as the sole acceptance criterions too vague.
satisfactory - Do not use as the sole acceptance criterion; too vague.
shut, as in " shut the valve" - Use "close."
slowly - Imprecise I
i I
I I
D-1 I
d' d
ad APPEND 7X E ABBREVIATIONS AND ACRONYMS AARM Accident Area Radiation Monitor AC alternating current ACB air circuit breaker ASME American Society of Mechanical Engineers
[
ATWS anticipated transient without scram auto automatic BAMT boric acid mix tank
/
BFP boiler feedwater pump L
CAC control air compressor CC component cooling CREAC Control Room Emergency Air Cleaning System
(
CRO Control Room Operator CSF Critical Safety Function DC direct current DW demineralized water EBFP emergency boiler feedwater pump EFhP emergency feedwater pump OP Emergency Operating Procedure
[
gpm gallons per minute HPSI high pressure safsty injection LCV level control valve
{
LOCA loss of coolant accident LPSI low pressure safety injection LPST low pressure surge tank LTOP low temperature overpressure protection
[
MC main coolant MCB main control board MCC motor control center MCP main coolant pump MCS main coolant system MOV motor operated valve MWe megawatt (s) electric NPSH net positive suction head y
NR narrow range NRC U.S. Nuclear Regulatory Commission NRV nonreturn valve OCB oil circuit breaker PAB Plant Auxiliary Building
{
PORV power operated relief valve ppm parts per million press pressure psi pounds per square inch rad radiation RV relief valve SCS shutdown cooling system S/G steam generator SI safety injecti'on SIAS safety injection actuation system SIT safety injection tank E-1
~
[s ; f#',
kD b:T4 h
w*
b E hdb 43 L
SOV solenoid operated valve f
STA Shift Technical Advisor ST-EBFP steam turbine driven emergency boiler feedwater pump ST-EDFP steam turbine driven emergency feedwater pump SUR startup rate SV safety valve Tave average temperature Tc cold leg temperature l
{
temp temperature Th hot leg temperature TS Technical Specification
/
TV trip valve vapor container L
VC e
WR wide range
{
1ess than greater than 1ess than or equal to equal to or greater than N
approximately 1
approximately equal to at I
I I
I I
I I
I I
E-2 1
DRAFf I
lI I I I
I I
I APPENDIX E VERITICATION AND VALIDATION PROGRAM PLAN I
I I
I I
I I
I I
TNr73 T'v"F" c
'%f u
IL g h' \\.,
m e.
[
[
L Emergency Operating Procedures verification and Validation Plan E
e L.
{
Prepared for Yankee Nuclear Power Station
[
[
i F
March 1986 General Physics Corporation Columbia, Maryland
<. ve. cr. -
3-t ',
p.,-*
e 1
4 y f
r k
hjY b h [4 Ab di.
c5 t
t s i
TABLE OF CONTENTS SECTION PAGE 1.
INT RODU CT I ON.................................................. 1-1
{
l.1 B a c k g r o u nd............................................... 1-1 1.2 Obj ec t ive s and S cope..................................... 1-1 1.3 verification and Validation Plan Format.................. 1-2 1.4 verification and validation for Procedure Revisions...... 1-2 l
2.
EOP VE RI FI CAT I ON.............................................. 2-1 2.1 verification Overv1ew.................................... 2-1 2.2 Preparation Phase........................................ 2-1 2.3 Assessment Phase......................................... 2-2 2.4 Resolution Phase......................................... 2-5 2.5 Documentation Phase...................................... 2-5
[
3.
E OP VAL I DAT I ON................................................ 3 - 1 3.1 Validation Overview...................................... 3-1 3.2 Preparation Phase........................................ 3-1 3.3 Assessment Phase......................................... 3-8 3.4 Resolution Phase........................................ 3-10 3.5 Documentation Phase..................................... 3-12 4.
PROGRAM DOCUMENTATION......................................... 4-1 ATTACHMENT A Validation Guidelines for Observation and Debriefing ATTACHMENT B Evaluation Criteria Checklist 1
Sf'Q j
y y.
t~
k m
SECTION 1.
INTRODUCTION
1.1 Background
i Supplement 1 to NUREG-0737, " Requirements for Emergency Response Capability," (Ref. 1) specifies the Nuclear Regulatory Commission (NRC) requirements for upgrading emergency operating procedures (EOPs). The goal of the upgraded EOPs is to " improve human reliability and the ability to mitigate the consequ'enci of a broad range of initiating events and subsequent multiple failures or operator errors, without ths need to diagnose specific events" (Ref. 1).
To achieve this objective, transient symptoms, rather than specific events, and human factors considerations are to be incorporated into these procedures.
To provide guidance in meeting the requirements of NUREG-0737 Supplement 1 and identify the elements necessary for licensees and applicants to prepare and implement upgraded EOPs, the NRC has issued NUREG-0899, " Guidelines for the Preparation of Emergency Operating Procedures" (Ref. 2).
NUREG-0899 specifies verification and validation (V&V) as parts of the EOP development process and defines the objectives of the V&V.
With assistance from the Institute of Nuclear Power Operations (INPO), an Emergency Operating Procedures Implementation Assistance (EOPIA) Review Group was formed to develop guidelines for assisting individual utilities,in the implementation of upgraded EOPs. Two of the EOPIA documents developed as part of this ef fort were the " Emergency Operating Procedures Verificatitift Guideline" (INPO 83-004) (Ref. 3) and the " Emergency Operating Procedures validation Guidelire" (INPO 83-006) (Ref. 4).
The four documents discussed above (NUREG-0737 Supplement 1, NUREG-0899, INPO 83-004, INPO 84-006) provide the basis for the development of this EOP Verification and Validation Plan. This Plan describes in detail the methodology for conducting the verification and validation of Yankee Nuclear Power Station (YNPS) upgraded EOPs.
1.2 Objectives and Scope The NRC states in NUREG-0899 that an overall EOP verification and validation effort should address the following objectives:
a.
EOPs are technically correct, i.e, they accurately reflect the technical guidelines.
b.
EOPs are written correctly, i.e, they accurately reflect the plant-specific writer's guide.
c.
The language and level of information presented in the COPS are L-compatible with the minimum number, qualification, training and experience of the operating staff.
t 1-1
E cr= ;. c:
~
b O
_.s
.sL_
d.
EOPs are usable, i.e, they can be understood and followed without confusion, delays, errors, etc.
There is a correspondence between the procedures and the control e.
room / plant hardware, i.e., control / equipment / indications that are referenced are available inside and outside the control room, use the I
same designation, use the same units of measurement, and operate as specified in the procedures.
f.
There is a high level of assurance that the procedures will work,
'l i.e., the procedures guide the operator in mitigating transients and W
accidents.
The V&V methodology described in this Plan encompasses the evaluation of these six objectives. Sections 2 and 3 describe, respectively,'the approaches to be used for completing the EOP verification and validation processes.
3 Table 1-1 shows the correlation between each of these six objectives and the lg specific components of the V&V process that will accomplish the objective. As shown in Table 1-1, objectives "a",
"b" and "e" will be evaluated fully and objectives "c" and "d" will be evaluated partially during EOP verification.
I EOP validation will complete the evaluation of "c" and "d" and also will provide for the full evaluation of objective "f".
For objectives "d" and "f",
use of a simulator for the validation will provide the most thorough
.I evaluation and will provide the highest level of assurance that the procedures will work, as stated in objective "f".
For scenarios that go beyond the capability of the simulator, "real-time" walkthroughs of scenariot in the YNPS Control Room or Control Room mockup provide an alternative means of
=
evaluation. A primary assumption of this Plan is that the Zion control room simulator will be available and used during the EOP V&V.
1.3 verification and Validation Plan Format The detailed methodologies to be used to complete the EOP verification and validation are described in sections 2 and 3.
Section 4 lists the key documentation that will be generated during the V&V ef fort and correlates these records to the program objectives stated in Section 1.2.
1.4 Verification and Validation for Procedure Revisions Revisions to the Master CSF procedure, EOPs, or Recovery Procedures may I
be subject to applicable sections of the verification and validation process.
Applicable sections of the V&V process may include verification, validation, or both, depending on the scope of the procedure change. Table 1-2 shows I
suggested V&V elements to which revised procedures may be subjected. This will ensure that the procedure set remains a correct, usable guide to the operators during emergency conditions.
I l
I l-2
f D k QT a
e
'h Table 1-1 Correlation Between V&V Objectives and Process NUREG-0899 V&V Process Components VEV Objectives verification Validation a.
Technically correct e Comparison of tech-nical guidelines and EOPs (TI) b.
Written correctly e Comparison of EOPs and Writer's Guide (TT) e Evaluation Criteria Checklist (TT) c.
Compatible with e Review by operating e Evaluation during minimum number, shift complement slow-paced walk-qualification, train-in conjunction with throughs and "real-ing and experience table-top review time" scenario of operating staff for objective "d" exercises (SIM/WT)
(TT)
Review by operating e Evaluation during d.
Usable e
shift complement to slow-paced walk-evaluate readabil-throughs and "real-ity, completeness, time" scenario accuracy, and con-exercises (SIM/WT) venience (TT) e.
Correspondence exists e Comparison of con-between procedures trol room instru-and control room /
mentation and plant hardware controls (I&C) and EOP references to I&C (WT) f.
Guide operators in e Evaluation of "real-
[
mitigating transients time" scenario exer-and accidents cises (SIM/WT)
V&V Methods:
TT - Table Top
- Individual or group evaluation
[
W - Walkthrough - Step-by-step enactment of scenario operator actions without carrying out actual control functions SIM - Simulator - Control functions performed by operators in simulator 1-3
.p3 5?CQF-i $
+
t t:
?
f; I
a cu Z.
Lj fa:In :l a
e'%L L
n Table 1-2 V&v Suggestions for Revised Emergency Procedures Type of Revision V&V Elements Suggested (from Table 1-1)
[
1.
Editorial (typographic error b
correction; changes made to meet requirements of Writer's Guide, etc.)
L 2.
Technical content change to a,b,c,d,e existing step 3.
Addition of new procedure All elements 4.
Addition of new steps 1
All elements 4.1 Active Task 2
a,b,c,d,e 4.2 Passive Task 5.
Deletion of procedure step (s) a,c,d,f 6.
Step sequence change a,c,d,f 1 Active tasks are those requiring the operator to manipulate a control or component or direct an auxiliary operator to manipulate a control or component.
2 Passive tasks are those requiring the operator to monitor a parameter, make a notification, or perform an administrative task. This category includes all tasks that are not active tasks as defined in Note 1.
[
[
C
[
[
[
~
1-4
b 2
.e T
3 e.'
be i.
6<
hj j[ (
i f8 g - )-
p 1
c c...s r-.
wc u
(
SECTION 2.
EOP VERIFICATION L
2.1 Verification Overview The focus of the verification process will be to evaluate the written correctness and technical accuracy of the EOPs. In addition, the EOPs will be partially evaluated for usability and compatibility with the minimum number, g
L qualification, training and experience of the YNPS operating staff (these two procedure characteristics of usability and compatibility will be evaluated further during the EOP validation).
k The verification process is modeled after INPO Guideline 83-004 (Ref. 3) and includes four phases: preparation, assessment, resolution and f
documentation. Each of these phases is described separately in this L
section. Tabletop evaluations and walkthroughs are the principal methods to be used in conducting the verification.
2.2 Preparation Phase Preparation for verification will include identifying and obtaining the information needed to perform the evaluations, preparing evaluation criteria, esignating the personnel to perform the evaluations, and scheduling the different portions of the assessment.
(
The principal source documents for the verification will be the completed YNPS EOPs, the YNPS EOP Writer's Gaide (prepared in earlier stages of the EOP upgrade program), and an Evaluation Criteria Checklist to be developed during
{
this phase. The Evaluation Criteria Checklist will be based on items adapted from NUREG/CR-2005, " Checklist for Evaluating Emergency Operating Procedures Used in Nuclear Power Plants" (Ref. 5), INPO Guidelines83-004 (Ref. 3), and the YNPS Writer's Guide. The Writer's Guide was developed to provide the administrative and technical guidance for preparing the EOPs and includes human factors engineering considerations necessary for proper procedure writing. The Evaluation Criteria Checklist is included as Attachment B.
As described in Section 2.3, " Assessment Phase," a portion of the verification will include table-top evaluations by YNPS operating shift personnel. Where possible, a shift complement that includes each position (Shift Supervisor, Senior Reactor Operator, Reactor Operator, Shift Technical Advisor) will be represented and members from different shifts will b3 included to provide a sampling of experience and operating philosophy. The documentation of table-top discussions performed by Custom Training Programs and YNPS personnel will also be reviewed for applicability of unresolved operator comments. Relevant discrepancies noted from this review will be
{
incorporated into the Verification effort performed under this plan.
2-1
4 9j w) 4 i
h A
Q d % l5 %ys e
't I
lL
(
23 Assessment Phase The purpose of the assessment phase is to identify discrepancies by j
comparing the EOPs to appropriate source documents and evaluation criteria.
The Discrepancy Sheet shown in Figure 2-1 will be used to document these reviews and identify any discrepancies noted. This form provides for not only documenting the discrepancy, but also indicating the specific resolution. The p
L following evaluations, discussed in detail in the following paragraphs, will be conducted:
Comparison of EOPs and Writer's Guide o
Comparison of EOPs and Technical Guidelines e
Review of EOPs using Evaluation Criteria Checklist e
Review of EOPs by operating shift complement to initially assess
[
e L
usability and compatibility Comparison of control room instrumentation and controls (I&C) and EOP e
references to IEC 2.3.1 Comparison of EOPs and Writer's Guide A comparison of EOPs against the YNPS Writer's Guide will be conducted as part of the initial EOP preparation. This review is intended to verify that procedures are written correctly and include consideration of the human factors engineering principles factored into the Writer's Guide. An
[
individual with human factors engineering experience will conduct this review.
2.3.2 Comparison of EOPs and Technical Guidelines
[
The comparison of EOPs against the Technical Guidelines will provide an independent verification of the technical accuracy of the EOPs. This review will be conducted by personnel with operations and engineering experience and will consist of a step-by-step and bases by bases comparison of each EOP with Revision 1 of the Westinghouse Owners Group Low Pressure version of the Technical Guidelines. These step-by-step and bases-by-bases comparisons are covered under a separate project plan.
2.3.3 Review of EOPs Using Evaluation Criteria Checklist As discussed previously, the Evaluation Criteria Checklist (App. B) will be developed in the Planning Phase of verification using items adapted from NUREG/CR-2005 (Ref. 5), INPO EOP verification guideline 83-004 (Ref. 3), and
[
the YNPS Writer's Guide. This checklist is intended to be a screening device to aid the verification team in identifying the procedural deficiencies that are important in terms of their impact on operator performance. Eence, it will provide an additional tool for confirming that the EOPs are written correctly. Each EOP will be reviewed against the checklist and items not meeting the checklist criteria will be noted on Discrepancy Sheets (Figure 1).
An EOP Verification Worksheet (Figure 2-2) will be completed that identifies each checklist-discrepant item and its ccrresponding Discrepancy Sheet.
2-2
YS.
9**i S*'p[$
?
l.l,._ '\\
la-g. t:
):
rL DISCREPANCY GHEET J
F EOP
Title:
L EOP Number:
Revision:
l i
Discrepancy:
[
t Evaluator:
Dates Resolution:
[
[
[
Resolution Approved:
YES NO (Circle One)
Approved By:
Date:
Resolution Incorporated By:
Late:
Figure 2-1 Sample Discrepancy Sheet 2-3
'h..
p
~f -
j
. ;; N i
,/, ;. \\
. r. ; - s 7
s-
[
EOP VERIFICATION WORKSHEET EOP
Title:
EOP Number:
[
Source Documents Used (Title, Revision, Date):
1.
2.
3.
4.
5.
6.
Discrepancies:
('
Eval. Crit. CL Item Discrepancy Sheet No.
[
[
[
[
[
[
Evaluators:
[
Figure 2-2 Sample Verification Worksheet 2-4
[
L r--
g.
r 3
)'
d w
c L
2.3.4 Review of EOPs by Operating Shift Complement A table-top review of the EOPs will be conducted by a YNPS operating c
(
' shift complement to provide an assessment of the usability of the procedures and the compatibility of the EOPs with the minimum number, qualification, training and experience of the operating staff. In assessing the usability of I
the procedures, the readability, completeness, accuracy (given the operators perceptions of the plant), and convenience of the EOPs will be evaluated.
Although subjective in nature, this type of evaluation will likely identify
(
potential problems the control room crews may have in accepting and adapting L
to the upgraded EOPs.
Unresolved operator comments from the 1984 Custom Training Programs revie'W of the EOPs will also be evaluated.
F L
2.3.5 Comparison of EOPs and Control Room I&C This review will consist of control room or mockup walkthroughs with each EOP to verify correspondence between control room I&C and EOP references to I&C.
Each reference to I&C. equipment in the EOPs will be checked against control room labels displayed on the equipment. Additionally, units of f
measurement used in the procedures will be verified to be the same as those L
displayed on instruments. This review will satisfy the objective listed in Table 1-1 to verify that correspondence exists between the procedures and the plant hardware.
2.4 Resolution Phase During the resolution phase each Discrepancy Sheet will be evaluated by
[
appropriate YNPS personnel. Resolutions will be documented on the Discrepancy Sheets. Once a resolution has been incorporated, it will be signed off on the sheet. The EOP Worksheet and all Discrepancy Sheets will then be forwarded to YNPS supervisory personnel for independent review of resolutions.
y 2.5 Documsmtation Phase Following reviews and acceptance of all resolutions, an EOP Verification Completion Record (Figure 2-3) will be completed for each EOP.
This record p
and accompanying EOP Verification Worksheet and Discrepancy Sheets will L
provide the EOP Verification documentation package for each EOP.
[
[
[
2-5 d
L-I.
L s!" 1.s N.. k.?~ Df. [ EOP VERIFICATION COMPLETION PECORD r EOP
Title:
L EOP Number: Revision: I 1. Resolution effected for all applicable k Discrepancy Sheets 2. Verification is complete Technically correct Written correctly Compatible Usable Procedures / Hardware Correspondence Verification Engineer: Date Approved Sys Date [ [ [ [ E-g E Figure 2-3 Sample Verification, Completion Record ~ 2-6 ]
s t. J ~ .h hs k 1 Y~ Y tw ss L fw w. w I SECTION 3. EOP VALIDATION 3.1 Validation overview Validation determines if the actions specified in the EOPs can be r b performed by the operator to successfully manage the emergency condition. As shown in Table 1-1, the validation process will evaluate the ability of the EOPs to guide operators in mitigating transients and accidents. In addition, validation will complete the evaluations of EOP usability and compatibility initiated during the EOP verification. p The validation process, presented in Figure 3-1, is modeled after INPO L Guideline 83-006 (Ref. 4) and includes the four phases of preparation, assessment, resolution and documentation. Slow-paced walkthroughs and real-time scenario exercises in a control room simulator are the principal methods to be used in conducting the validation. This validation plan assumes that an appropriate control room simulator will be used to support the dynamic aspects of the validation process. Use of "real-time walkthroughs" of scenario exercises may also be required in addition to the simulator runs to provide for scenarios which cannot be run on the simulator. As shown in Figure 3-1, the preparation phase will focus on preparing [ lists of expected operator actions and performance evaluation guidelines for the scenarios. During the assessment phase, the scenarios will be simulated and the control room operating crew will use the EOPs to restore the plant to safe conditions. Based on a debriefing of the operators and, if necessary, an analysis of videotapes of the simulator runs, procedure-related errors will be identified. These discrepancies will be classified and resolved during the resolution phase. Documentation developed during validation will be collected [ and organized during the documentation phase to provide a traceable history of the validation program. 3.2 Preparation Phase As shown in Figure 3-1, the key steps involved in preparing for EOP validation in the simulator are: e Defining representative scenarios Preparing the lists of expected operator actions for the exercises e e Assembling the simulator validation team Each of these steps are discussed in the following paragraphs. [ 3.2.1 Define Representative Scenarios l A scenario is a collection of selected pre-planned events used as a [ framework in which to validate EDPs. A scenario includes the initial plant conditions, action sequences and expected outcome for a hypothetical plant emergency. To the extent possible, each scenario will be planned to include a [ unique set of paths through the EOPs in order to exercise as much of the 3-1
CJ F {/ y*:'c [o ,1 b a 33 pp 7 di L, E'hd. d., b (w N.h b C.. DEFINE REPRESENTATIVE SCENARIOS L F l I l DEVELOP TASK ANALYSIS WORKSHEETS I PREPARATION U r PREPARE SIMULATOR EXERCISE DESCRIPTIONS Eu F ASSEMBLE SIMULATOR L VALIDATION TEAM c L N CONDUCT SIMULATOR VALIDATION RUNS v ASSESSMENT DEBRIEF OPERATORS rL, ANALYZE VIDEO TAPES v CLASSIFY DISCREPANCIES RESOLUTION IDENTIFY RESOLUTIONS U [ DOCUMENTATION COLLECT DOCUMENTATION { Figure 3-1. EOP Validation Process [ 3-2 m
f -q s 3 [' 1 \\ h u w procedures as possible. A list of YNPS safety-related and non-safety-related systems will be used to define a set of scenarios which adequately samples various emergency conditions and the plant systems used in those conditions. The related YNPS plant-specific EOPs will be identified as well in this step. A systematic procedure for choosing events to construct a scenario will provide greater assurance that a representative sampling of events has been t chosen. One way to sample events is to select those that challenge the procedures to maintain critical safety functions of the plant. This methodology allows the validation team to design a scenario which will challenge one or more of the critical safety functions. Before defining the event path, the validation team will determine the final conditions of the scenario, which will represent a safe and stable plant condition. p Consideration of final conditions facilitates definition of a hypothetical L event path for the scenario. Restoration of the simulator to safe and stable conditions will be the ultimate criteria for validation. e l A narrative description of each scenario will be prepared that establishes the limits and conditions of the events to be analyzed. This overview will be especially beneficial for orienting operators to the { scenarios. It will include: e Initial plant conditions e Procedures used [ e Scenario sequence e Expected response e Scenario termination criteria 3.2.2. Develop Task Analysis Worksheets A Task Analysis Worksheet (see Figure 3-2) will be developed which [ indicates the operational steps' required in each procedure, along with the appropriate information and control requirements and availability of I&C present on the control boards. Completed Task Analysis Worksheets will serve as templates for conducting scenario runs. Data will be documented on the worksheets in the following manner: { 1. The discrete steps in the YNPS EOPs will be recorded in order of performance in the " Procedure Step Number" column of the Task Analysis Worksheet. Branching points, if any, will be recorded in f the " Scenario Response" column. Note that there may be more tasks L subsequently identified in Step 2 below than there are procedural steps. In this case, a dash will be entered when no explicit procedural step is present in the EOPs. 2. A brief description of the operator's tasks (in order of procedaral steps) will be recorded in the " Task / Subtask" column of the Task Analysis Worksheet. Note that there may be more tasks described [ than are explicitly called out in the procedural steps. All tasks, both explicit and implicit, will be documented by using operations, engineering, and human factors personnel. [ 3-3
L e. ,n. w-y s s ( / e i.' l :. Y ; b.. iLyk 21. t 3. The operator decision and/or actions that are linked to task [ performance are then recorded in the " Decision and/or Contingent Action Requirements" column. System functional response is described when appropriate in this column. This set of data [ includes branching points in the EOPs that determine the outcome of the operating sequence. { 4. Procedural IEC requirements for successful task performance are recorded in the "Information and Control Requirements" column. These would typically be plant parameters or components necessary for operators to adequately assess plant conditions or system status [ (e.g., hot leg temperature, reactor coolant system flow, pressurizer pressure). ( 5. The specific instrumentation and controls (I&C) that the operator uses during procedure use will be documented in the " verification" column. This documentation will satisfy the requirement to show that a correspondence exists between I&C referenced in the procedures and the I&C actually available in the control room. The l subcolumns for " availability" and " suitability" are used as follows: ( a. " Availability" of the necessary I&C for successful operator task performance is noted by a check in this column. { b. " Suitability" of the I&C to meet the information and control requirements of the operator task is noted by a check in this column. Generally, this column will be used to verify the adequacy of instrument indications, i.e., that the operator can [ use the indicator to resolve required parameter values and setpoints. ( 6. Comments Comments or candidate procedure discrepancies can be noted in this { column. The Task Analysis Worksheet thus serves as the complete record of operator tasks, decisions, information and control requirements, and I&C [ availability and suitability during the selected emergency operating sequences. This record will be developed through the series of steps described above. [ 3.2.3 Prepare Simulator Exercise Descriptions and Synopses of Expected Operator Actions Using the EOPs and the Tssk Analysis Worksheets, the validation team will prepare Simulator Exercise Descriptions and a synopsis of expected operator actions for each scenario. The Simulator Exercise Description presents a ( format for each simulator exercise which describes the scenario and identifies the plant conditions that need to be simulated. Using this format, events that are not able to be' simulated'can be readily identified and appropriate [ resolutions planned. For maximum efficiency, personnel familiar with simulator operations will be involved with this stage of the preparation. [ 3-4
g p,. q. - -) p --' n..s 1.. c W'$ b ru i p ja L 1 al 5 l [. F U [ .r x [ if B 5 l [ i, 5 b (ye a [ 3I [ i, ME a ra E i <3 = M Figure 3-2. Task Anal) sis Worksheet 3-5 ---____m
c~ c. t-w ,,,...,w..,,. i d _a?! aAL h&4. _.al.; ek M Having defined from the procedures and task analysis information the scenario and the procedure steps which the operators could follow in managing the emergency, the validation team will next prepare a description of expected operator actions for use in evaluating the scenario. The description identifies: e a procedure set for the scenario and specific steps from each procedure operator actions which follow an expected path through the scenario e e description of planned events / failures to challenge the EOPs The expected operator actions can be taken directly from the procedures and task analysis worksheet with additional actions specified in any cases in which the procedure / task analysis worksheet does not explicitly delineate actions. The actions need not be copied in detail from the procedure / task I analysis worksheet, however, a summary sufficient for observers to follow the action is needed. For example, instrument numbers are not necessary but a description of actions is. The advantage of using the summary is that it I provides a description of expected actions in one place, rather than having to flip through procedure tabs. In preparing these descriptions the validation team is defining a path I through the procedure set which the operators might use in attaining a safe and stable plant condition. It is recognized that many operator options exist at each branch point in the procedures and that the operators' actual path through the procedure set may differ from the path defined by the validation team. The procedure for dealing with deviations from expected operator action is described in Section 3.3.1. The delineation of a potential path through I the procedures for each scenario, and the construction of a list of expected operator actions based on this potential path, aids the validation team in evaluating the EOP. 3.2.4 Assemble Simulator Validation Team A team of individuals will be appointed to conduct the validation effort. The team will include: e training / operations personnel I e human factors specialist e simulator instructor e operating crew e camera operators Table 3-1 outlines personnel requirements and associated responsibilities. The subject matter experts from training and operations will be familiar with the procedures and the design and operation of the simulator and control room. The simulator instructor will understand the hardware design, software programming capabilities and operation of the simulator. During the actual simulator runs, additional personhel will also be required. A typical complement of operating personnel for the unit will be needed to follow the procedares during the runs. To the extent possible, the control room manning 3-6 I
L ) A p 3, s r L h tj 4 - a d.L et. 1 L r l Table 3-1. Validation Team Members and Their Responsibilities !L Training Human Operations Factors Simulator Operating Camera Personnel Specialist Instructor Crew Operators F i Prepare for On-Site Data Collection X X h Perform Simulator Runs X X X X X Debrief Operators X X X Determine Discrepancies X X X H Fill Out Discrepancy Sheets X X [ E E F m b 3-7
m w. p m - r~ q l 9t n Lir e M P 6 h k:. during the simulator runs will resemble the manning under normal plant operating conditions. Also, support personnel will be needed to run cameras for recording the exercises. Preparation tasks of the validation team will include collecting and reviewing supporting documentation and familiarization training of the operator shift complement in using the EOPs. Documentation necessary for the evaluation includes the following: e copies of the current revision of the EOPs e task analysis worksheets p e simulator exercise descriptions ( expected operator action summaries e e exercise evaluation criteria (Attachment A) 3.3 Assessment Phase This validation phase will focus on collecting information during the F simulator runs and reviewinc the results to identify performance discrepancies l (dif ferences in actual versus expected responses). This process includes the 5 following steps (Figure 3-1): l e conduct simulator validation runs debrief operators following exercises e analyze videotapes of exercises (if necessary) e l e conduct control room / mockup walkthroughs 3.3.1 Conduct Simulator Validation Runs l l The simulator runs will provide an objective context in which to evaluate the usability, compatibility and effectiveness of the procedures (refer to l Table 1-1). In contrast to walking through the procedures in a static environment in which oversights may continue to be overlooked, the simulation I environment will mimic operating conditions for a more objective challenge to the procedures. The simulation will also provide a setting in which the I operators can be faced with a reasonably realistic emergency situation for I which they must diagnose the symptoms and proceed accordingly using the new procedures. The operating crew chosen for the simulator runs will have been familiarized with the new procedures during training. The crew will not be briefed on the actual scenarios to be run. The operators will, however, be briefed on the purpose of the validation. It will be made clear to them that it is not their performance that is being evaluated, but the performance of the new procedurcs. This is especially important since the operators may be concerned about the videotaping. They should understand the necessity for recording the dynamic actions for later analysis of the procedures. Each scenario will be simulated separately with a debriefing session after the run. During the run, validation team members will be observers; at a minimum, one training / operations person and one human factors specialist will participate. Notes can be jotted on procedure copies or task analysis 3-8 i
W yh T"' N * %. l A l' ( lL r worksheets, but excessive note-taking should be avoided so that the observers are free to observe. The tape record of the scenario will permit the l observers to analyze occurrences at a later time, if necessary. During the simulator runs, if the crew takes an expected alternate path that is as correct as the expected path, they should be allowed to continue uninterrupted. If the operating crew momentarily takes an unexpected alternate path that is an incorrect path, and are able to get back on the correct path using the procedure within a reasonable amount of time, the simulation should continue undisturbed. If, however, the crew takes an I unexpected alternate path that is incorrect and shows no sign of recovering, l the simulation should be stopped. If an obvious, remediable error is involved (e.g., a page of the procedure was missing), the problem should be corrected and the run started again where it went astray. If, however, the problem is not obvious or readily remediable the simulator run will have to be postponed until such time as the problem is diagnosed or corrected. 3.3.2 Debrief Operators lg The operator debriefing session will be conducted immediately after each g scenario run. The comments of the operators who have participated in the t exercise provide one of the most important sources of information for I evaluating the procedure set. Operator actions which do not lend themselves I to direct observation, such as symptom diagnosis or conversion of displayed values can be described by the operators during the debriefing. The I operators' comments also contribute to greater accuracy in analyzing deviations from expected operator actions which occurred during the scenario. It is essential that the operators be debriefed as soon as possible j after the scenario has been completed so that their comments on the events will be comprehensive. A validation team member will explain the debriefing process and its l purpose to the operators and elicit from them general comments on the impact I of the procedures on their performance. These comments will be recorded and used later in the analysis phase. The operators will be asked to discuss l procedure-related problems they encountered during the scenario. This may be augmented by a videotape display of the specific action or set of actions in question. The operators will be asked to identify possible reasons for any procedure-related problems that they encountered during the run. Questions from Attachment A (validation evaluation criteria) will be asked to prompt the I operators on possible reasons. The operators should also be asked to present potential solutions to any procedure-related problems. The validation team members will then present problems and discrepancies they identified during the scenario. If the operators deviated from the EOPs, regardless of the path they took through the scenario, this should be discussed. This discussion may also be augmented by a videotape display of the specific action or set of actions in question. The operators will be asked to identify possible reasons for procedure-related problems. Again, the questions in Attachment A can be used to determine if a shortcoming in the procedure is a possible cause. The operators will also be asked to present potential solutions to these problems. All discrepancies, possible reasons, and potential solutions identified during the debriefing will be documented. 3-9 i
L 7' W q, y %u yp q / n V /2 V L i-P L 3.3.3 Analyze videotapes l The observers can make notes to some extent during the scenario, however, it may not be possible to record all discrepancies at this time. A review of the videotapes may be necessary to record actions and identify all L discrepancies. Comments elicited from the operators during the debriefing will be helpful to the observers. During the videotape review, further questions concerning operator actions may arise, which will require input from g i the operators. By comparing he expected operator actions to the actions performed during the scenario, the validation team will be able to note any additional discrepancies. 3.3.4 Conduct Control Room / Mockup Walkthroughs If a non-Yankee-specific simulator is used for procedure validation, L additional scenario walkthroughs will be required to assess the availability and suitability of control room instrumentation and control required in the EOPs. These walkthroughs should be conducted in the plant control room or using an up-to-date control board mockup. The task analysis worksheets will be used, and initial assessments of a correspondence between required and available I&C will be made. Any discrepancies noted during these walkthroughs will be documented, and resolutions will be recommended during the resolution phase of validation. 3.4 Resolution Phase l In the resolution phase of validation the discrepancies identified during assessment are evaluated. For some discrepancies, no resolution will be l required. Discrepancies that require resolution will be evaluated for type of error involved (Section 3.4.1) and recommended resolution (Section 3.4.2). I 3.4.1 Classify Discrepancies i L The purpose of analyzing the discrepancies between expected operator actions and actual operator actions is to identify potential shortcomings in the procedures. Each discrepancy identified daring the debriefing and videotape review will be analyzed on a case-by-case basis to determine if it is an error or if it is an acceptable discrepancy and should be deleted from F consideration. Figure 3-3 outlinep the steps involved in analyzing the discrepancies. A discrepancy that impacts adversely on operator performance or plant condition should be considered an error. An example of an acceptable discrepancy would be an op1erator action in a sequence that is different from the e,cpected order but equally admissible. l The validation team will use the evaluation criteria presented in l Appendix A to assist them in determining whether an error was due to a proceiural problem or other causes such as control room hardware, training, or manpower. Errors which can be identified as being caused by procedural 3-10
t~ q /-- l - ' ,/ Q 5 t-#./ Lo D oa E,ca die ida l B Identify discrepancies between simulator run j and expected operator actions I l U g Would discrepancy No Categorize as have an adverse impact acceptable I; on safe 'or efficient discrepancy. plant operation? I 1 I Yes E ll Y Was the error No Categorize as error not attributed to procedure-related i j procedures t I Yes a u l Categorize type of error. t I I Figure 3-3. Flowchart for Analysis of Discrepancies I 3-11 I l
g-p:N - p, ""P r3 1 tt L .x ) .e. G f 1 shortcomings will be documented on Discrepancy Sheets (Figure 2-1). When the procedure-related errors have been identified, these errors may be categorized I as follows: H (1) Error of omission (intentional or unintentional) e Omits an entire task e Omits a step in a task (2) Error of commission e Selection error Selects wrong control e Mispositions control e (3) Error of sequence (4) Time error u e Too early e Too late (5) Qualitative error e Too little e Too much 3.4.2 Identify Resolutions Categorizing errors will permit a summary of the types of errors caused by a procedure and suggest possible resolutions. For example, in a given procedure, if 80% of the errors identified were errors of omission, the analyst would want to verify that the reentry to a procedure from which the operator has branched was not causing him to omit steps. However, if 80% of the errors identified were qualitative errors, the analyst would want to check the level of detail of instruction for that section of the procedure. The final product of the analysis will be a compilation of procedure-related errors and recommendations for resolution that will be noted on Discrepancy Sheets and reviewed by YNPS supervisory personnel. Specific [ errors will be categorized into the types listed previously. A summary table of the procedure discrepancies and resolutions will be developed. { 3.5 Documentation Phase To provide a traceable history of the validation program, all documentation generated during the validation process will be organized for [ retention. As a minimum, this documentation is expected to include the following e list of validation team participants e evaluation guidelines e discrepancy sheets e simulator exercise descriptions [ expected operator action summaries e 3-12
b }: 3 f I\\ .- / s A 5, 4. PROGRAM DOCUMENTATION The correlation between the NUREG-0899 V&V objectives and process was shown in Table 1-1. Each of these process components has been described in I detail in Sections 2 and 3, including the documentation generated during these evaluations. The purpose of this section is to summarize the documentation generated during the V&v process and correlate individual documents to the NUREG-0899 objectives of the V&V process. Table 4-1 presents this summary and I correlation and will serve as an audit trail for the YNPS EOP V&V program. A Final Report for the EOP V&V will be prepared that includes all of the documentation listed in Table 4-1. I I I I I I I I I I I I 4-1 II
m r- ---s...
- m..
,/ n p r f we._. %. K.s L ai a Table 4-1 Correlation Between V&V Objectives and Documentation 7 L NUREG-0899 KEY DOCUMENTATION RELATING TO I L V&V OBJECTIVES 1:UREG-0899 OBJECTIVES Discrepancy Sheets (Figure 2-1) a. Technically Correct e Signature on EOP Verification e Completion Form (Figure 2-3) Discrepancy Sheets (Figure 2-1) b. Written Correctly e p l Completed Evaluation Criteria Checklist e Completed EOP Verification Worksheet e Signature on EOP Verification Completion e u Form (Figure 2-3) f~ L Signature on EOP Verification Completion c. Compatible with e minimum number, Form (Figure 2-3) (Table-Top Review) Discrepancy Sheets (Figure 2-1) qualification, e Completed EOP Validation Guidelines for f training and e L experience or ossery, tion ona o 3rieting (xte c3m nt 33 operating staff Signature on EOP Verification Completion d. Usable e Form (Figure 2-3) (Table-Top Review) Discrepancy Sheets (Figure 2-1) e Completed EOP Validation Guidelines for e Observation and Debriefing (Attachment A) O [ E 4-2
L r~- e-+- .4---, - - - - - g l Il ) r r L M h %d%h N Table 4-1 Correlation Between v&v Objectives and Documentation r l* (Continued) F h NUREG-0899 KEY DOCUMENTATION RELATING TO V6V OBJECTIVES NUREG-0899 OBJECTIVES l V l L l e. Correspondence e Task Analysis Worksheets I exists between e Discrepancy Sheets (Figure 2-1) L Signature on EOP Verfication Completion procedures and e F control room / plant Form (Figure 2 3) L hardware F L f. Guide operators in Completed EOP Validation Guidelines for mitigating transients for Observation and Debriefing and accidents (Attachment A) e Discrepancy Sheets (Figure 2-1) [ 1 E L w [ W 4-3
W Nl ' 'i @, fTg f, i s* i ~] t } f~ 4% i ;;,? I' g* d,% she su.s -- I 5 !I r 1
- 3 4
i ATTACHMENT A VALIDATION GUIDELINES FOR l OBSERVATION AND DEBRIEFING lI 4 II 4 il i i !.I 'I lI
Ps. N.,1 [A m.v r -, E r 6 - ,s\\ {,r,; L. -v d/ k (d { ,td Scenarios Date: Baergency Operating Procedures Validation Guidelines for Observation I The following validation criteria are presented in the form of questions and are to be used by the validation team as guidelines only; they provide structure to the observation process. Evaluators should check whether a criterion has been net or indicate N/A if the criterion could not be evaluated or was not applicable. Procedure-related problems, indicated on this form by "N", can be documented in greater detail using the attached comments sheet (e.g., whether it is a generic problem or occurs at one step in a procedure). I
- 1 Usability 1.1.1 Level of Detail 1.
Did the operator appear to have sufficient information to perform the specified actions at each step? 2. Did the operator seem uncertain at any division point? 3. Was the operator able to find needed equipment with the I labels, abbreviations, symbols and location information provided him? 4. Was the operator able to manage the emergency condition with the information provided him? 5. Were the operator's contingency actions sufficient? 6. Was the operator able to find referenced or branched procedures? 1.1.2 Understandability 1I 1. Did the operator appear to have problems with any of the following? a. Reading the typefsce I -
- Items noted with asterisk focus on procedure transition issues.
I I
b. Beaingf{guresandtables c. Interpolating values on figures and charts ( d. Understanding EOP step e. Understanding caution and note statements f. Understanding the organization of the EOPs g. Understanding the BOP step sequence 2. Did the operator's actions indicate that he had noticed emphr.sised items in the procedures? 3. Was the operator able to do the following? a. Find the particular step or set of steps when required b. Beturn to the procedure exit point without omitting steps when required c. Enter the branched procedure at the correct point d. Exit from the given BOP at the correct branch L 1.2 Operational Correctness 1.2.1 Technical Correctness L 1. Did the instructions provided to the operator appear to be appropriate for the emergency conditions? 2. Were the procedure actions able to be performed on the plant in the designated sequence? 3. Did the operator find alternate source paths not in the EOPs? 4. Were the procedure actions able to be performed on the plant at the designated time intervals? 5. Was the operator able to obtain the necessary information from designated plant instrumentation when required by the { procedur ? 6. Did the plant symptoms direct the operator to the applicable EOP by its entry condition? 1.2.2 Compatibility 1. Did the EOP instructions appear to be comp:stible with the operating shift manning? 2. Were the procedures actions able to be performed by the operating shift? [ f
l I,/ /,i, % t- ). /=L ( L 3. Didthe'BOPsappear'~tohelkcoordinate'theactionso.fthe ~ operating shift? ( 4. Did the operator have to use responses or other equipment not specified in the BOPS to accosplish his task? 5. Did the plant conditions seen by the operator correspond to what was in the BOP? 6. Were the instrument reading and tolerances consistent with the instrument values stated in the EOP? 7. Were the operators able to distinguish the BOP from other L procedures in the control room? 8. Were the BOPS physically compatible with the work situation ( (too bulky to hold, binding wouldn't allow then to lay flat on the work space, no place to lay the EOPs down to use)? 9. Was the plant condition compatible with the action which the EOP directed to be performed at a time interval or specified time? 10. Was the operating shif t able to follow the designated action step sequences? 11. Did the plant conditions allow the operator to correctly follow the action step? Signature of Evaluator [ [ [ [ [
E v s r e. 3, i:
- .7.
4 3 e v j : '\\., %(,,* (.: l' i L ( 4_A> o .= eu o-m anergency Operating Procedures Validation Comment Form This form is to be used to provide additional comments, information, or [ qualifying statements associated with the BOP validation guidelines. The q guideline item number should be entered here along with the appropriate comment. f Item Comment L F L b [ 4 [ [ [ [ [ m i
m cw my c,g p% ', I " [*, '[ 1 Scenario: [,, g g g{ Date Energency Operating Procedures Validation l Guidelines for Debriefing i The following validation criteria are presented in the form of questions and are to be used by the validation team as guidelines only; they provide I structure to the debriefing process. l \\ Evaluators should check whether a criterion has been met or indicate N/A if the criterion could not be evaluated or was not applicable. Procedure-related problems, indicated on this form by "N", can be documented in greater detail using the attached comments sheet (e.g., whether it is a generic problem or occurs at one step in a procedure). 1.1 Usability 1.1.1 Level of Detail 1. Was there sufficient information to perform the specified actions at each step? 2. Were all alternatives explicit at each decision point? 3. Could the operator use labeling, abbreviations, and location information as provided in the EOPs to find the needed equipment? 4. Were the EOPs missir.g information needed to manage the emergency condition? 5. Were the contingency actions as stated in the EOPs sufficient? 6. Could the operator use titles and numbers to find referenced or branched procedures? i 1.1.2 Understandability 1. Was the typeface easy to read? l 2. Were the emphasized items noticed? 3. Were the figures and tables easily and accurately read? ( I
's b [9 3 .w
- m. n -
ty m
- y r; y p.
( Was interklatiYobaTuesM, figures'Infid charts difficult? 4 I 5. Were caution and note statements understood? L 6. Was the organization of the EOPa understood? 7. Was the BOP step understa.)d? 8, were the step sequences understood? 9. Could the operator find the particular step or set of steps { when required? 10. Could the operator return to the procedure exit point without omitting steps when required? 11. Could the operator enter the bran::hed procedure at the correct point? 12. Could the operator exit from a given EOP at the correct branch? 1.2 operability correct 1.2.1 Technical CorrN:tness 1. Were the instructions appropriate for the emergency condition? 2. Were the procedure actions able to be performed on the plant in the designated sequence? 3. Did the operator find alternate success paths not in the EOPs. 4. Was the procedure action able to be performed on the plant at the designated time intervals? 5. Could the operator obtain the necessary information from designated plant instrumentation when required by the procedure? F 6. Did the plant symptoms direct the, operator to the applicable EOP by its entry conditions? 1.2.2 Compatibility 1. Were the EOP instructions compatible with the operating shift manning?
[9?- ) e f
- d
- "4 0.~ N sh i&
2. Were the PI~oc lh be p flormed by the u a e operating shift? 3. Did the BOPS help coordinate the actions of the operating / shift? L 4. Did the operator have to use responses or other equipment not specified in the BOPS to accoglish his task? 5. Did the plant conditions seen by the operator correspond to what was in the EOP7 { 6. Were the instrument readings and tolerances consistent with the instrument values stated in the EOP? 7. Were the operators able to distinguish the BOP from other procedures in the control room? 8. Were the EOPs physically compatible with the work situation (to bulky to hold, binding wouldn't allow them to lay flat in work space, no place to lay the EOPs down to use)? [ 9. Was the plant condition compatible with the action which the BOP directed to be performed at a time interval or specified { time? 10. Was the operating shift able to follow the designated action step sequences? 11. Did the plant conditions allow the operator to correctly follow the action step? Signature of Evaluator [ [ [ [ [ [
I DDhOT ~ L / s. / mc t. t. meergency Operat'ing' Procedures Validation F Comment Form L f h is form is to be used to provide additional comments, information, or k qualifying statements associated with the BOP validation guidelines. Se guideline item number should be entered here along with the appropriate comment. [ mm . e.e E [ E [ [ [ [ [ [ 1 [ W
\\, g A#f.ttNi' I I ATTACHMENT B I EVALUATION CRITERIA CHECKLIST -I I I I I I I 'I
e.m.. m t, f. "T *7 vs t c. 1 4 i ./, a s 6, a Yankee Rowe ERG Evaluation Criteria Checklist for I Verification Principle of Written Correctness Area Reference" A. PROCEDURE - GENERAL 1. Legibility a. Are page margins adequate? WG-App.B b. Are the text, graphs, charts, tables, WG-8.3 and figures legible and readable? 2. EOP Format Consistency a. Do the following section headingc exist WG-6.2 in each EOP: I Title Symptoms Action and Alternate b. Is the Action and Alternate section WG-6.2.1 presented in a dual-column format? c. Is the procedure format (page layout) WG-App.B consistent for all EOPs? 3. Recovery Procedure Format Consistency a. Do the following section headings exist WG-6.3 in each recovery procedures Title Scope Enclosures Symptoms l Procedure Attachments b. Is the procedure presented in a WG-6.3 single-column format? I c. Is the procedure format (page layout) WG-App.B consistent for all Recovery Procedure? I g ..,NPS Write,.s cuid. for EeGs 1
q q M2 -- N [. ,O SL N Arn i R7fnernca [ Master ' SF Procedure Identification Information 4. C i a. Is the procedure title descriptive of WG-5.2 I the purpose of the procedure? b. Does page 1 of the Master CSF Procedure WG-5.4.1 ( contain the following information in the L upper right corner: Procedure number l ( Revision date Revision number c. Does each subsequent page of the Master CSF WG-5.4.1 { Procedure contain the following information Procedure number (upper right corner) Revision number (upper right corner) Page number (upper center) { 5. EOP Identification Information a. Is the procedure title descriptive of the WG-5.2 purpose of the procedure? b. Does each page of the EOP contain the WG-5.4.2 following information: EOP number (upper left corner) Page number (upper center) [ Procedure number (upper right corner) Revision number (upper right corner) c. Does each page that is continued onto WG-5.4.2 [ another page contain the message " CONTINUED ON NEXT PAGE" after the last step on the page? 6. Recovery Procedure Identification Information a. Is the procedure title descriptive of the WG-5.2 [ purpose of the procedure? b. Does page 1 of the Recovery Procedure WG-5.4.3 ( have the following information in the upper right corner [ Procedure number Revision number Revision date. [ [ 2
M 'I'h p' M?P%k R7fsrsnc7 Arm (',e u.: - IV f 'Q.h. p h lI n .u ( c. Does each subsequent page of the procedure WG-5.4.3 contain the following information: Procedure number (upper right corner) [ Revision number (upper right corner) Page number (upper center) ( d. Is each Recovery Procedure Attachment WG-6.3.2 desi;nated with a capital letter, beginning with "A" and following in ( alphabetical order for each additional attachment? e. Does each page of a Recovery Procedure WG-5.4.4 [ Attachment have the following information: Procedure number (upper right corner) ( Attachment letter designation Revision number (upper right corner) (upper right corner) { Page number (upper center) B. STEP, NOTE, CAUTION - SPECIFIC 'L. Information Presentation a. Are the instruction steps numbered WG-6 ( sequentially using Arabic numerals? b. Are the instruction steps constructed to comply with the following: 1) Steps deal with only one idea or task. WG-7.3, 7.5.2 ( 2) Sentences are short and simple. WG-7.3, 7.5.2 3) The number of action verbs per step WG-7.3 [ is limited to one, unless they are closely related, in which case up to three action verbs may be used. 4) Imprecise adverbs are not used. WG-7.3 5) Double negatives are not used. WG-7.3 [ 6) When an action has three or more objects, WG-7.3 they are listed vertically using hyphans. 7) When an action is required based on WG-7.3 the receipt o.f an annunciated alarm, the alarm setpoint is listed. [ 8) The step is not continued onto another WG-7.3 page. 3
pg 7~, f my y - -; ~- 4 } Ref9rsnca Arm u $ L.a ' O Ah e.., I ( 9) Punctuation, hyphenation, and capitaliz-WG-9.3, 9.4, 9.5 ation are proper. I
- 10) Abbreviations and acronyms are acceptable.
WG-7.9.5, 9.2, L c. Do instruction steps make proper use of WG-7.6, 7.,7 r logic structure? L d. Are cautions and notes constructed to comply with the following: 1) They do not contain operator actions. WG-7.10.1, WG-7.ll.1 F 2) They contain proper emphasis. WG-7.10, 7.11 L Are cautions and notes used appropriately? WG-7.10, 7.11 e. [ f. Are cautions and notes placed properly? WG-7.10, 7.11 g. Are components properly identified? WG-7.12 h. .Are numerical values properly written? WG-9.6 i. Are values specified in such a way that WG-7.13 rL mathematical calculation is not required of the operator? ( j. Are figures, graphs, and tables used WG-8 properly? 2. Procedure Referencing and Branching { Is procedure referencing minimized? WG-7.8.2 a. [ b. Are only complete procedures or complete WG-7.8.2 procedure sections referenced? c. Is the operator clearly directed back to WG-7.8.2 { where he left off when referencing another procedure or procedure section? d. Do referencing and branching instructions WG-7.8.3 use the current format? [ [ [ 4 ---i _ _}}