Text

Rev 2 to RHR Sys Autoclosure Interlock Removal Rept for Diablo Canyon Nuclear Power Plant
	ML20236M673
Person / Time
Site:	Diablo Canyon
Issue date:	07/31/1987
From:	Burns N, Gerlowski T, Malinchak R; WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:	;
Shared Package
ML16342B369	List: ML20236M673;
References
	WCAP-11117, WCAP-11117-R02, WCAP-11117-R2, NUDOCS 8708110183
	Download: ML20236M673 (219)
	v • d • e

_ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ .

y1 WCAP-11117 Rev. 2.0-4 WESTINGHOUSE CLASS 3 i

RESIDUAL' HEAT REMOVAL SYSTEM

'AUT0 CLOSURE INTERLOCK REMOVAL REPORT FOR DIABLO CANYON NUCLEAR POWER PLANT Revision 2.0 4

.u_

Pacific Gas and Electric Company Contract No. 212-5-238-85 JULY 1987 N. L. Burns T. J. Gerlowski R. M. Malinchak 4

=. I Westinghouse Electric Corporation Power Systems P. 0. Box 355 Pittsburgh, Pennsylvania 15230 0057v:1D/070187 8708110103 870804 PDR ADOCK 05000275 P PDR

TABLE OF CONTENTS l

.Section Title P_a age ABSTRACT

1.0 INTRODUCTION

1-1 1.1 Background 1-1 2.0

SUMMARY

OF RESULTS 2-1 3.0 LICENSING BASIS 3-1 3.1 History of Regulations 3-1 3.2 Current Regulations 3-5 4.0- RESIDUAL HEAT REMOVAL SYSTEM '4-1 4.1 Funct' ions 4-1 4

.4.2- System Description 4-1 i 4.3-. System Operation 4-2 4.4 Component-Description 4-4 5.0 . PROPOSED. MODIFICATION 5-1 5.1 Functional Requirements' 5-2 5.2 Alternative Modifications 5-3 6.0 PROBABILISTIC ANALYSIS 6-1 6.1 . Introduction 6-1

'6.2 Data 6-1 6.3 Event V Analysis 6-1 6.4 RHRS Availability 6-4 6.5 Overpressurization Transients 6-5 6.6 Conclusions 6-15 l

7.0 CONCLUSION

S AND RECOMMENDATIONS 7-1

8.0 REFERENCES

8-1 APPENDICES i A Overview of Fault Tree and Event Tree Quantification A-1 l- B Event V Analysis B-1 l ,

C RHRS Availability Analysis C-1 j D Overpressurization Analysis 0-1 L

0057v:1o/112186 i

? ;

LIST 0F TABLES Table Title 1-1. .FrequencyofDHRLosses(1976-1983)

' 1-2 Categories of 130 Reported Total DHR System Failures When Required to Operate (Loss of Function) at U.S. PWRs 1976-1983.

3-l' AEC Inspired Modifications to RHRS Suction Valving 6.2-l' Data 6.4-1 RHRS Unavailabilities 6.5 Overpressurization Initiator Frequencies 6.5-2~ Nodal Failure Probabilities 6.5-3 Description of Consequence Categories 6.5-4 Summary of Overpressurization Analyses A.1-1 Fault Tree Component Identification Codes B Component Random Failure Unavailabilities

.B-2 Human Error Calculations l:' B-3 MOV 8701 is Open-Present Configuration Dominant Contributors B-4 MOV 8702 is Open-Present Configuration Dominant Contributors B-5 MOV 8701 is Open-Modification Dominant Contributors B-6 MOV 8702 is Open-Modification Dominant Contributors B-7 MOV 8701 is Open-NRC Modification Dominant Contributors B-8 MOV 8702 is Open-NRC Modification Dominant Contributors ii 0057v:1D/112186 i

LIST OF TABLES (Cont)

Table Title l

C.2-1 Component Random Failure Unavailabilities C.2-2 Human Error Calculations C.3-1 RHRS Unavailabilities ;

i C.3-2 Dominant Contributors l D.2-1 Actual Overpressurization Transients D.2-2 Plant Operating Experience D.2-3 Overpressurization Frequencies I D.3-1 Nodal Probability Calculations D.3-2 Consequence Category Frequencies (Per Year) for Letdown Isolation RHR Operable Tree D.3-3 Consequence Category Frequencies (Per Year) for Letdown Isolation RHR Isolated Tree l D.3.4 Consequence Category Frequencies (Per Year) for Charging /SI Pump Tree l

l D

~

l j iii 0057v:1D/112186

i LIST OF FIGURES Figure Title 4-1 .RHRS Flow Diagram 5-1 Valve Alarm - MOV-8701 5-2 Valve Alarm - MOV-8702 5-3 Position Indication 5-4_ Proposed Interlock - MOV-8701 5-5 Proposed Interlock - MOV-8702 5-6 Current Interlock - MOV-8701 5-7 Current Interlock - MOV-8702 5-8 Elementary Wiring Diagram - MOV-8701 5-9 Elementary Wiring Diagram - MOV-8702 6.3-I: RHRS Suction Valve Arrangement 6.5-1 Typical Heat Input Transients l

A-1 . Basic Fault Tree Symbols 1.'* B-1 Present Interlock Configuration 8701 B-2 Present Interlock Configuration 8702 B-3 NRC-Proposed Modification 8701 B-4 NRC-Proposed Modification 8702 I

i B-5 MOV 8701 Present Configuration Fault Tree l B-6 MOV 8702 Present Configuration Fault Tree B-7 MOV 8701 Modification Fault Tree B-8 MOV 8702 Modification Fault Tree

'B-9 M0V 8701 NRC Modification Fault Tree B-10 MOV 8702 NRC Modification Fault Tree iV 0057v 1o/112186 j .

I

L

\

4

.-y LIST OF FIGURES (Cont) ,

Figure Title-C-1 RHRS Startup Fault Tree

C-2 RHRS Short Term Fault Tree C-3 RHRS Long Term Fault' Tree C-4 MOV 8701 Fails to Open C-5 MOV 8702 Fails to Open C-6 Isolation Valves Spuriously Close Present Configuration C-7 Isolation Valves Spuriously Close Modification L

C-8 Isolation Valves Spuriously Close NRC idodification D.3-1 Charging / Safety Injection Pump Actuation Event Tree l

D.3-2 Letdown Isolation -'RHRS Operable Event Tree D.3-3 Letdown Isolation - RHRS Inoperable (Isolated) Event Tree 0.3-4 2 Trains of LTOP Fail Fault Tree

~

D.3 1 Train of LTOP Fails Fault Tree

! .. a ' D.3-6 Isolation Valves fail to Close Fault Tree 1:

4 1

l V

0057v:1o/112186

v WESTINGHOUSE CLASS 3 3,

, ABSTRACT A review and analysis has been performed which justifies the deletion of the

%" autoclosure interlock of.the Residual Heat Removal System suction isolation

. valves (MOV-8701,MOV-8702). The open permissive circuitry remains intact.

An alarm is added to notify the operator of an incorrectly positionod valve (MOV-8701,MOV-870?.). A probabilistic analysis was used to determine that deletion of the autoclosure interlock is' acceptable from a ' safety standpoint.

l

. 1

'b' .

1

]

i i

1 0206mIb*001386 vi

1.0 INTRODUCTION

I L1 Recently, the Nuclear Regulatory Commission (NRC) has expressed interest in the acceptability of removing the autoclosure interlock (ACI) on the Residual i

Heat Removal System (RHRS) suction isolation valves. This interest arises from a concern about the loss of residual heat removal capability during cold i

shutdown and refueling operations due to inadvertent isolation of the RHRS l caused by failure of the autoclosure interlock circuitry. Isolation of the

, RHRS while operating could result in a loss of decay heat removal capability, l

overpressurization of the Reactor Coolant System (RCS) with possible l

power-operated relief valve (PORV) challenge, and/or RHRS pump damage.

This report provides an evaluation of the removal of the Residual Heat Removal '

System autoclosure interlock at the Diablo Canyon Nuclear Power Pl..it. The I

report reviews the basis for the interlock in terms of regulations and justifies removal of the autoclosure interlock based on a safety evaluation of the effect of autoclosure interlock removal on low temperature overpressure protection, RHRS availability and interfacing system LOCA potential.

~

i

1.1 Background

A U.S. Nuclear Regulatory Commission, Office for Analysis and Evaluation of j Operational Data, report (Reference 1) analyzed U.S. pressurized water reactor (PWR) experiences involving loss of an operating Decay Heat Removal (DHR) system. This report indicated that 130 loss of decay heat removal events were reported between 1976 and 1983. The consequences of a total loss of DHR system under certain conditions could lead to core uncovery, and resultant fuel damage. In addition, analysis of operating data revealed that an underlying or root cause of most loss of DHR system events are human factors deficiencies. involving procedural inadequacies and personnel error. Most errors were committed during maintenance, testing, repair operations and at a time when the DHR system (or RHRS) is operational.

f 00s7v:1o/112186 1-1 L. .. . .. .. . .. .. ..

Reference 1 lists summaries of loss of RHRS events that occurred during 1982 and 1983. A Nuclear Safety Analysis Center / Electric Power Research Institute

{

report (Reference 2) identified loss of RHRS events for the period 1976

]

through 1981. Table 1-1 from Reference 1 is reproduced and provides a j tabulation of these 130 DHR system losses for 33 plants during the period of l

1976 through 1983. The leading category of loss of DHR system events (37 of 130) was an inadvertent automatic closure of the suction isolation valves in the RHRS. Most of these events were caused by human error. Table 1-2 is also reproduced from Reference 1 and tabulates the number of events for five categories of failure that cause a loss of RHRS operation and illustrates that 28.5% of the events were caused by inadvertent automatic closure of suction isolation valves.

The reader is directed to Reference 2 appendices for summary information on RHRS losses that occurred from 1976 to 1981. For the period of 1982 through 1983, Reference 1, Appendix A prcvidss additional summary information on RHRS ;

i losses.

l As stated in Reference 1, plant " operating data has shown that for RHRS i operation, removal of power or removal of the autoclosure interlocks to the RHRS suction isolation valve can be a safe, effective method for preventing spurious suction isolation".

Also, the Reference 1 case study report has stimulated much itterest in the subject of autoclosure interlocks. Based upon an earlier (1964) draft of this case study report, Sandia Laboratories performed a risk assessment as part of Task A-45 evaluating the competing risks associated with RHRS suction isolation valve closures and Event V. The Sandia report (Reference 3),

" Potential Benefits Obtained by Requiring Safety-Grade Cold Shutdown Systems,"

was done for the Calvert Cliffs plants' configuration. Subsequent to their quantification of risks, Sandia concluded that.

1 t j l

0057v:1o/11218s 1-2

l i

"The lowest core melt frequency due to the combination of loss of RHRS suction during cold shutdown and '!-LOCAs is obtained when there are no autoclosure interlocks on the RHRS suction valves... removing the l overpressure interlocks from the RHRS suction valves gives the best RHRS suction arrangement for PWRs based upon this analysis.

i

...when interlocks are present, loss of RHRS suction is the largest contributor to core melt frequency for all assumed values of probability of core molt given that RHRS suction is lost. However, when the interlocks are not present, the core melt frequency due to loss of RHRS suction is comparable to or less than the V-LOCA core melt frequency for l the "best estimate" cases.

Finally, we believe that the "best" RHRS suction valve arrangement is to have a single suction line without primary system over pressure interlocks on the valves."

In response to the earlier draft of this case study, NRR reviewed the issue of "RCS/RHRS Suction Line Interlocks on PWRs". NRR performed a prioritization evaluation (a simplified risk and cost assessment). As a result, on August 13, 1985, in Reference 4, the Director of NRR forwarded a copy of his staff's prioritization of this issue, assigned it a "HIGH" priority ranking, and directed the Director of the Division of Systems Integration to take the actions necessary to resolve this issue. .

It is also important to note that Westinghouse has evaluated Kewaunee's proposal for removing the autoclosure interlocks on the RHRS suction valves.

Reference 5 notes that Westinghouse's analysis concluded that for Kewaunee, the proposed modification would be a safety improvement. NRR has subsequently approved the modification. As noted in Reference 5, the effects of autoclosure interlock removal upon plant safety must be evaluated on a plant by plant basis because of numerous plant-specific differences.

0057v:10/112186 1-3

l Table 1-1 Frequency of DHR Losses (1976 - 1983) 1976 1977 1978 1979 1980 1981 1982 1983 Total Davis-Besse 4 1 9 2 16 Beaver Valley - 1 1 1 4 2 1 1 10 Calvert Cliffs - 2 2 1 2 3 10 Salem - 2 2 8 10 Crystal River 3 2 2 2 9 Calsert Cliffs - 1 2 5 1 1 9 Trojan 1 5 1 7 North Anna - 1 1 2 2 2 7 North Anna - 2 4 3 7 Salem - 1 1 3 1 5 Farley - 1 2 2 1 5 McGuire - 1 2 1 3 Millstone - 2 1 1 1 3 ANO - 2 2 2 Ginna 2 2 3 Maine Yankee 2 2 Palisades {

1 1 2 Rancho Seco 1 1 2 St. Lucie - 1 1 1 2 Sequoyah - 1 1 1 2 Turkey Point - 3 2 2 l l

Turkey Point - 4 2 2 )

Indian Point - 3 1 1 Fort Calhoun 1 1 San Onofre - 1 1 1 Oconee - 1 1 1 l Oconee - 2 1 1 I Zion - 1 1 1 l Surry - 1 1 1 l Sequoyah - 2 1 1 ;

Farley - 2 1 1 l McGuire - 2 1 1 1 Summer - 1 1 1 1 130 Annual Frequency of DHR Losses .06 .1 .5 .3 .6 .5 .35 .5

(# of events)

(# of Operating PWRs) 0057v:1D/112186 1-4 I l .

Table 1-2 Categories of 130 Reported Total DHR System Failures When Required to Operate (Loss of Function) at U.S. PWRs 1976-1983 No. of Events (%ofEvents_).

Automation Closure of Suction / 37 (28.5)

Isolation Valves Loss of Inventory Inadequate RCS Inventory Resulting 26 (20.0) in Loss of DHR Pump Suction Loss of RCS Inventory Through DHR 10 (7.7)

System Necessitating Shutdown of DHP System Component Failures Shutdown or Failure of DHR Pump 21 (16.2)

Inability to Open Suction / Isolation 8 (6.1) ,

Valve l l

Others 28 (21.5) 1 Total 130 (100.0) l l

i ewsa.-esose.

1-5

4 2.0 '

SUMMARY

OF RESULTS l

The analysis presented in this report supports removal of the autoclosure interlock. -Based on prior operating experience, the autoclosure interlock has C

been a dominant contributor to the loss of decay heat removal. Spurious i

closure of the khRS isolation valves due to false signals, deenergization of power buses and various testing errors has occurred steadily since the implementation of the ACI in the 1970s. Recently the effects of the spurious closure'of,.these valves are being reclized. An NRC report has determined that spurious closure'of the RHRS isolation valves account for approximately 29 percent of the total RHR system failures. This report has raised a concern i that the autoclosure inter 1cck has become detrinsatal to overall safety. Most recent reports on the subject favor removal of the autoclosure interlock or.

some type of modification to the interlock.

However, before a change can be implemented, the NRC has requested that the effects of removal of the interlock be examined. Through examination of the interfacing systems LOCA frequency, the RHRS availability, and the effects on overpressurization transients, the results of this report show that there would be no net increase in risk consequences from removal of the interlock.

Two modifications to the autoclosure interlock were addressed in this report.

The first modification considered was the addition of sn alarm which would actuate if the RCS pressure increased above a given setpoint and either of the RHRS isolation valves is open. The other modification, a single switch to

.close both valves (based on NRC suggestions), will not provide adequate assurance that the valves are closed. An alarm would have to be installed to alert the operator of a high RCS pressure and that the RHR suction valves are open. Based on the analyses presented in this report, a single switch and c alarm configuration does not result in an appreciable change in safety as !

. compared to the modification that includes an alarm only. Furthermore, during i

. leak rate testing of the valves, the single switch would have to be overridden

~

or bypassed in order to singularly test each isolation valve. Therefore, the design change that is recommended for Diablo Canyon is the deletion of the autoclosure interlock and the addition of an alarm.

l 0057v:1D/11218s 2-1 b_______________ "

3.0 LICENSING BASIS o

3.1 History During the 1960's, typical RHR systems for a pressurized water reactor plant consisted of twin (auxiliary) coolant trains connected to the RCS via a single suction line. Two closed valves in series isolated the RHRS from the RCS while the RCS was in operation. A " prevent-open" interlock wat, added to one of the valves to prevent its opening while RCS pressure was above RHRS design pressure. The second valve had its power disconnected via administrative procedures. As an additional der,ign feature, the valve motor operator was sized with insufficient torque to move the disc with a pressure differential greater than 600 psi. Finally, a relief valve set at RilRS design pressure was located just downstream of the suction valves.

The early 1970's saw the Atomic Energy Commission (AEC) pressing for a pressure interlock on both valves. (Reference 6). As two suction lines were also starting to make their appearance, the AEC position was extended to four o

suction isolation valves. Other AEC positions that evolved at that time (1971) were 1) interlocks for automatic closure on pressure, 2) diverse '

'~

principles foi 'nterlocks, and 3) commitment to IEEE-279. Table 3-1 provides j a brief impac' s these requirements and some of the plants affected.

The introduction of the autoclose interlock re-emphasized a previous concern, i.e. RCS pressure control during RHRS operation. Spurious closure of the :

suction valves isolates the suction line relief valves and the low pressure letdown line from the RHRS to the Chemical and Volume Control System (CVCS). !

Without the low pressure letdown line, plant operation in the water solid mode {

is difficult. . Additionally, should a pressure transient occur, automatic l

closure of the suction valves prevents the relief valve from performing its !

function, subsequently aggravating the transient. (Reference 7 & 8)

A joint meeting between industry (W, B&W, and CE) and AEC in March 1974 attempted to clarify the AEC's requirement for the interlocks. (Reference 9) !

(

l 0057v:1D/112186 3-1 1

This discussion brought about two acceptable methods of overpressure protection while the RHRS is in operation or when returning the RCS to

operation (Reference 10):

o automatic closure interlocks, or o sufficient capacity of the RHRS suction line relief valves, or o a combination of the above It was pointed out at the meeting that the AEC representative on the ANS l Committee 32.4 (Overpressure Protection of Low Pressure Systems Connected to l the RCPB) said he would not accept removal of the autoclosure interlock.

While the AEC replied that a committee member speaks only as an individual and not for the AEC, the AEC representative's position was later adopted as their l

official position. (Reference 11)

Over the next 1-1/2 years, Westinghouse performed several analyses in support ,

of the RESAR-3 and RESAR-41 applications. These analyses demonstrated that adequately sized relief valves were sufficient by themselves in protecting the j RHRS from overpressure, and that the autoclosure feature was not needed.

In parallel with the RESAR-41 application and NRC staff review, the NRC formalized their position and released it as a Branch Technical Position in I the summer of 1975. (Reference 12)

Faced with the requirement for retaining the autoclosure interlock, discussion with the NRC centered on raising the setpoint such that the autoclosure feature did not prematurely isolate the RHRS. This was in conjunction with lowered setpoints for the RHRS suction line relief valves (to 450 from 500 psig), to allow the relief valves to perform. The raised autoclosure setpoint, however, did not preclude transients initiated by a spurious closure of the valves. (Reference 13)

I cos7v:10/1121ss 3-2 I

The Safety Evaluation Report (SER) for the RESAR-41 application provided the final NRC position on the issue (Reference 14). While Branch Technical Position ICSB-3 required that "the valve operators should receive a signal to close automatically whenever the primary system pressure exceeds the subsystem design pressure," the RESAR-41 SER stated:

"In particular, the Residual Heat Removal System inlet isolation valves will be equipped with autoclosure and prevent open interlocks to prevent possible exposure of the residual heat removal system to excessive pressures. The interlocks will be designed to prevent the occurrence of a situation where there is only a single barrier protection against a possible loss-of-coolant accident outside containment. ,

i The autoclosure interlock will close the system isolation valves when the Reactor Coolant System pressure increases to 750 pounds per square inch. !

This pressure is greater than the Residual Heat Removal System relief valve set pressure plus accumulation, thus assuring that the relief valves will provide some overpressure protection to the reactor coolant system when in the cold shutdown condition.

i Westinghouse has designed the relief valves for the residual heat removal system to' prevent inadvertent overpressurization during plant cooldown or startup, considering normal operating conditions, infrequent transients, and abnormal occurrences. As part of our review of the final design for RESAR-41, we will require that Westinghouse provide a detailed analysis that demonstrates the adequacy of the capacity of the system relief valves to prevent overpressurization during plant cooldown or startup."

-The situation of a possible loss-of-coolant accident would exist should an operator neglect to close one of the series isolation valves when the plant is returned to normal pressure. Passive failure of the closed valve disc would expose the RHRS to full RCS pressure, resulting in a possible rupture of the RHRS outside containment. Then the NRC recognized an autoclosure setpoint above the RHRS design pressure separated the autoclosure feature from pressure

.. transient mitigation. The requirement, then, was to demonstrate the adequacy L

of the relief valves.

l oos7v:w 121es 3-3

....__.....__.........._.__._...._.._._...._-......__._.._......____..______J

The industry experienced problem of loss of RHRS capability and possible pump

, damage following a failure of the autoclosure interlock was reviewed in conjunction with the RESAR-3S application (Reference 15). Actions taken by

. . several utilities were to remove power from one or more of the suction valves during the timeframe when the RHRS pumps are most susceptible to damage due to loss of suction (i.e.' refueling). Westinghouse recommended this via a technical bulletin in mid-1977 (Reference ~16). Various other publications also dealt with the issue (References 17 & 18).

Use of the pressurizer power-operated relief valves in conjunction with the RHRS relief valves was reviewed and found acceptable by the NRC. While the NRC did recognize the higher (above RHRS design pressure) setpoint, they stopped short of permitting the removal of the autoclosure feature from the plant (Refere,1ce19).

In 1977, Working Group ANS-56.3 (previously ANS-32.4 and ANS-55.4) finished work on ANSI /ANS-56.3-1977 (Reference 20). This standard permitted the

, designer a choice between a suction valve automatic closure feature and relief valves having adequate relieving capacity. The standard also stated that:

- " Control Room indication shall be provided to indicate when isolation is necessary."

The issue remained quiet through the remainder of the 1970's.

]

In 1982, a study was published by Oak Ridge National Laboratory detailing the review and evaluation of events placed in the NSIC file involving the removal of decay heat in US BWRs and PWRs from June 1979 through June 1981 (Reference ;

21). The.0ak Ridge study reported that during the two year period "the most frequent event involving a significant problem with DHR system was the- j cavitation of RHRS pumps". Five events were traced to spurious closure of the l suction valves due to signals from their autoclosure interlocks,

~ i Shortly thereafter, an EPRI report also detailed events where RHRS operation j was curtailed due to inadvertent suction valve closure (Reference 2), l I Twenty-four events (occurring over five years) that involved inadvertent loss I of RHRS cooling due to the autoclosure interlock failing were identified. j i

C20$x 1b-050586 3-4 i

t _ _ _ _ _ _ _ _ _ _ _ . _ _

3.2 Current Regulations The removal of the autoclosure feature has been reviewed against applicable regulatory and industry safety standard criteria.

4 3.2.1 ANSI /ANS 56.3-1977

" Overpressure Protection of Low Pressure Systems Connected to the Reactor :

Coolant Pressure Boundary".

Section 3 of this standard describes several methods of protection that "shall be used" to prevent overpressurization of the RHRS. Specifically, Section 3.2.1 permits the designer a choice between the use of an autoclose feature or pressure relief sized on the basis of the most extreme pressure transient anticipated to occur during the plan operating condition when the two valves j are open. Figure 1 of the standard depicts these methods.

i Following removal, the method of overpressure protection provided is that !

depicted in Figure 1 as 1(b).

~

3.2.2 Standard Review Plan l

l

" Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plant," NUREG-0800, July 1981.

The NRC position is stated in two branch technical position papers: RSB 5-1 and ICSB 3. ICSB 3, positian B.2. states:

i "For system interfaces where both valves are motor-operated, the valves i should have independent and diverse interlocks to prevent both from opening unless the primary system pressure is below the subsystem desigr. pressure.

Also, the valve operators should receive a signal to close automatically whenever the primary system pressure exceeds the subsystem design pressure."

i l

I 0057v:1D/112188 3-5

Position B.1. of RSB Si l-states:

,; "The following shall be provided-in the suction side of the RHRS to isolate it from the RCS.

e ..

A. Isolation shall be provided by at least two power-operated valves in-

. series. The valve positions shall be indicated in the control room.

)

B. The. valves shall have independent diverse interlocks to prevent the valves from being opened unless the RCS pressure is below the RHRS I design pressure. Failure of a power supply shall not cause any valve

' to change position.

i C. The valves:shall have independent diverse interlocks to protect j against'one or both valves being open during an RCS increase above the l design pressure of the RHRS."

The -RSB position is clear in that an autoclosure interlock must be utilized and its setpoint must be tied'to the RHRS design pressure. The ICSB position however does not emphatically require an autoclosure interlock.

While the ICSB position makes no mention of relief valves, position C. of RSB 5-1 states:

"The RHRS shall satisfy the pressure relief requirements listed below.

1. To protect the RHRS against accidental overpressurization when it is in operation (not isolated from the RCS), pressure relief in the RHRS shall be provided with relieving capacity in accordance with the ASME Boiler and Pressure Vessel Code. The most limiting pressure transient during the plant operating condition when the RHRS is not isolated from the RCS shall be considered when r, selecting the pressure relieving capacity of the RHRS. For example, during shutdown cooling in e PWR with no steam bubble in

-' the pressurizer, inadvertent operation of an additional charging 00s7v:10/112186 3-6

___b

L pump or inadvertent opening of an ECCS accumulator valve should be i- considered in selection of the. design bases.

2. Fluid discharged through the RHRS pressure relief valves must be collected and~ contained such that a stuck open relief valve will 7 not:

.. (a) Result in flooding of any safety-related equipment, ,

l L (b) Reduce the capability of the ECCS below that needed to mitigate the consequences of a postulated LOCA.

L (c) Result'in a non-isolatable situation in which the water i provided to the RCS to maintain the core in a safe condition-is discharged outside of the containment.

3. If interlocks are provided to automatically close the~ isolation valves when the RCS pressure exceeds the RHRS design pressure, adequate relief capacity shall be provided during the time period while the valves are closing."

l The RSB position goes on to. state:

]

"D. Pump Protection Requirements i

The design and operating procedures of any RHRS shall have provisions to prevent damage to the RHRS due to overheating, cavitation or loss I of cdequate pump suction fluid." i

.The inconsistency in branch positions (one requires the autoclosure interlock (

while the other regards it as' optional) is compounded by the NRC's acceptance of the autoclosure setpoint above RHRS design pressure. As events from the past few years have shown loss of RHRS cooling to be a more serious and more i frequent transient than overpressure transients, emphasis should be placed on s .the recognized pump protection requirements of RSB 5-1.

0057v:1o/112186 3-7

1 l

An~ April 17, 1984 NRC memorandum (Reference 22) discussed a clarification of the design basis of RHRS interlocks and a concern centered on the safety )

implications of the failure mode of interlocks due to a loss of an instrument bus. Reference 22 concludes that: )

~

"In summary, the aspects of the RHRS interlocks which can result in

{

I automatic closure of the RHRS suction valves on a loss of an_ instrument bus make a negligible contribution to the design basis for which they are provided. However, the potential for a complete loss of decay heat removal capability by the RHRS is greatly increased by this design. 1 Therefore, it is recommended that in the interest of plant safety, action j should be taken to modify the design of RHRS interlocks for W plants such I

that a loss of an instrument bus will not result in a loss of RHRS cooling. Also, it is recommended that action be taken to clarify the purpose of the RHRS interlocks for the Diablo Canyon record as well.as any required changes."

A January 1985 RSB position states that (Reference 5):

"The issue of RHRS ACI reliability is being prioritized by SPEB. In the 1 meantime, proposals to change the RHRS isolation valve controls should be carefully considered, esoecially in light of the many overlapping concerns." ]

"There is no reason, as yet, to allow or even encourage whole scale removal of the ACI. The request by each plant should be reviewed on a case-by-case basis. As a minimum, however, any proposal to remove the ACI should be substantiated by proof that the change is a net improvement in safety. For example, requests for removal of power or the ACI should assass as a minimum, the following:

1. The means available to minimize Event V concerns.

~ 1

2. The alarms to alert the operator of an improperly positioned RHRS l NOV.

0057v:1D/112186 3-8 l l

I

3. The RHRS relief valve capacity must be adequate.

t

, 4. Means other than the ACI to ensure both MOVs are closed (e.g.,

single switch actuating both valves).

5. Assurance that the function of the open permissive circuitry is not affected by the proposed change. 1

6. Assurance that M0V position indication will remain available in the control room, regardless of the proposed change.

I

7. An assessment of the proposed change's effect on RHRS reliability, as well as on LTOPs concerns."

3.2.3 10CFR50.59 l

This section of the Code of Federal Regulations allows the utility to make a )

change in the facility as described in the FSAR without prior NRC approval if

, the change does not involve a change in the technical specifications or an i unreviewed safety question.

. 1 i

The change "shall be deemed to involve an unreviewed safety question (i) if I the probability of occurrence or the consequences of an accident or l

malfunction of equipment important to safety previously evaluated in the I safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in l

the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced."

The " Standard Technical Specifications for Westinghouse Pressurized Water Reactors", NUREG-0452, DRAFT Rev. 5, requires that verification of automatic isolation and interlock action of the RHRS from the RCS be conducted at least once per 18 months in accordance with surveillance requirement 4.5.2.d.1).

The " Technical Specifications for the Diablo Canyon Nuclear Power Plant, Units 1 and 2", NUREG-1151 does not contain a similar surveillance requirement, i 0057v:1D/070187 3-9 1

i k_m_m_ h - . - _ - _ _ _ . - _- _ - -__-._--_._. _

Thus the impact of the removal of the ACI on 10CFR50.59 is limited to determining if the removal constitutes an unreviewed safety question as 7

, discussed above.

. The first question that needs to be addressed is (i) as defined above: is there an increase in the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report?

Section 6.6 of this report concludes that based on three areas of probabilistic analysis: 1) the frequency of an Event V, 2) the availability of the RHRS, and 3) the effect on overpressure transients, there is an overall increase in safety due to removal of the autoclosure interlock. While it is true that the frequency of the overpressurization event does increase, the increase is from E-14 to E-12 and is considered to be insignificant and offset by the reduction in frequency of Event V and the slight increase in RHRS availability. The demonstrated improvement in RHRS availability will further reduce the probability of the accidents for which RHRS failure during shutdown

. cooling is an initiating event. Therefore, this change does not involve an increase in the probability or consequences of accidents previously evaluated.

Addressing the second question (ii) as defined above: is the possibility of an accident or malfunction of a different type than any evaluated previously in the safety analysis report created?

Chapter 15.0 of the Diablo Canyon Final Safety Analysis Report states that the analysis of an RHRS overpressurization accident, requested in Reg. Guide 1.70, rev. 1, is not necessary because the RHRS interlocks makes the overpressurization of the RHRS extremely unlikely.

The effect of an overpressure transient at cold shutdown conditions will not be altered by removal of the ACI. With or without removal of the ACI, the RHRS will be subject to overpressure for which the RHRS system relief valves

~

must be relied upon to limit pressure to within RHRS design parameters. This follows from the fact that while it is true that the interlocks provide an automatic closure to the RHRS suction valves on high RCS pressure, cos7v:10/070187 3-10

l overpressure protection of the RHRS is provided by the RHRS relief valves and not by the slow acting suction valves that isolate the RHRS from the RCS. The

., purpose of the interlocks is to assure that there is a double barrier (two closed valves) between the RCS and the RHR system when the plant is at normal

. operating conditions. The interlock function is to preclude conditions that could lead to a LOCA outside of containment due to operator error. The interlock function is not to isolate the RHRS from the RCS when the RHRS is operating in the decay heat mode.

l There are several levels of defense which would assure tLse is a double barrier between the RCS and RHRS when the plant is at normal operating conditions. The first level would be the plant operating procedures which instruct the operator to isolate the RHRS during plant heatup. The second level would be the installation of alarms that sound a " valve not full closed" signal in conjunction with a "RCS pressure - high" signal. The intent of these alarms is to alert the operator that either of the RCS-RHRS isolation valves l is'not fully closed, and the double isolation is not intact. The third level of defense would be revised alarm response guidelines and operator training.

. It should be noted that the open permissive interlock is not changed and it would still function to prevent opening of either RHRS suction / isolation valve when the RCS is at a higher pressure.

Thus, removal of the RHR ACI does not create the possibility of an accident different than that described in the DCPP FSAR Update. RHR overpressurization in shutdown modes is prevented because of the addition of alarms to warn the operator of " valve not full closed" and the relief capacity of the RHR safety valves. In operating modes, the open permissive interlocks function to prevent the opening of the RHRS suction / isolation valves when the RCS is at high pressure. The open permissive interlocks are not affected by the proposed ACI removal.

Item (iii) does not apply as the autoclosure interlock is not used as a basis for any technical specifications.

(.

1 1

0057v:1o/070187 3-11

o 1 3.2.4 10CFR50, Appendix R

.- Appendix R governs the Fire Protection Program to be applied to all nuclear power plants, and states.that "when considering the effects of fire, those

, , systems' associated with achieving and maintaining safe shutdown conditions j or importance-to safety because damage to them can lead to core l

l . assume ma damage resulting from loss of coolant through boiloff." Given that the result of the PRA portion of this report justifies the deletion of the autoclose interlock based on a criterion of availability and reliability the RHR system is made in effect, more available, this change does not adversely impact the current Diablo Canyon Appendix R Fire Protection Safety Analysis Report. Of course, changes made as a part of the autoclose deletion must be reviewed by l the customer and made in accord with Appendix R requirements that apply to Diablo Canyon, such as train separation, fire barriers, fire hazards' analyses, etc. as defined in section III.G. of Appendix R to 10CFR50.

b i

8 00s7v:1o/070187 3-12

2 2 t 1 1

. c d & &

e s n s y s n f t a t 1 e t 1 o f n l n l n 2 y A a s a a l a 2 k n l I l n a l o & a

. s P e P n V P & o C t

p e e p A C 1 n n i r p 1 o n a o u r o h e o . m l l o a i o t v o n C e b j P L w a L r a L o l a o e r o e i . a i r 2 K P 3 N B 4 Z D S D T r

s e n g i t o n t i e e o i e . i t .

G r d t d s n r g m c t N u i e i e u i s e u n n I s v l t h p s s n t s e i V s o a a T o s p a a ml L d e r n c r p g o e r r R n A n s r 5 t a H i n V s a p i l . t p 2 p R a o n o s S i 4 e e t i N o b : e t e R m r s e n t O i I s g l v H t e t u h o c I t e n d o l R n t u s a t c u T a d r a e r a e s o s C c n u r d t v e v y b e y o e U i a t d n h e s a r b t h e S f a e a o e t r p n t h i a e d c h p e n d i S d l f i s t o h a d e e R o w a e t o t h n t n d H M s l w r k t t o c o i e R m a d u c t r c e i s r d e n n l s o n d e r e n t n o 1 O e t o o e s l e e v e t s n c i f

- T r i i c n e r c s e o e 3 i u

t e n r e a u n a s c n e r S n i s a p t j e e i n n e

. E N q i d h n d s h r h s o i h L O e a d A c a i a i w g T i c l B I R t a A T n T A i d )

C a d 1 I M a (

F I

D .

O a M

D e E r r .

R u e y I s r t l P s m e a d p S e o v e S e p N S r r o e r R k e u I C p f t n g H c h s R e R o t C e a d r h s l r E h o e e w i o f e A t t h v t . t y f w t i t g e g l o op n t i r i n r i t e i n w e mi u s n v g e d s n s p e i n d s : c d n e s c t i e n

g e e a e l a p e 5 a a k j r c l

i n j k a r o r 2 l i r i d c n t p 4 d t o o s e l a o g s a s l r e s l i e t m t i e n y n t

D n e r s r i e u n o v e u t o v i b o l i i l t l s t s b l m c a t a n o s n y a a d d n s c v i r e e s v a e r i

g e u e s n p e t r v e a n s o v s e s o t i l n a o r h h n a l o r a e O w c a p t t O w c m O v lg I o n ) )

p w i 1 2 T s ( (

. u o

r .

G a 1

C

t 2

= c 2 -

e & 2 s s s f & ~ t t t 2 f 1 & n n n A 1 a a a

. r 1 l l l

. s h a P P P t a B e n y r p e p

- a o s i o r o l u t u o u o P q t G L t L e a c u S W M 2 F 3 r

, . o .

s r e - t g e n e - n u c i a r o t o i n a s o u i t t l a e p w - n d s t i u m r t r o n s c m a n 0 e i a e G e s o n e 0 e t t r e N n n o i e h 6 h n c S p h e I n a t t e t t i u C t V o r y u c b s s R r - i L c t e e f o - e k A .

r s !t m h o t o e h c V s e e t ' i c w h t o n n t r i h n t a e d t t o l N o a u u t e e n e - r i O i r s c o v e r o s e o e e t I t a s r b a h u h t h t T a p e i h t e m t t n u C c e r c es y y u r o s t i s U

S i

f s p r i f n m l o e b s f o e o o o H

) -

i o h o l h s s c r t d S d w ca r c t d e l l g a f e R o t t e r a e n j d u H M e n y f s p n n i d l e e n R 's o l i o g n n a a s h i d n r c l l t i a e n u t t O e i o a s c n s h p s g n T r a f d c e . a c o e i s f t o -

i t e i v y l l v s i o c S u n e d t l l o o e e l w ( N q o n d a a l o r r h a l l O e c o A m v a c t u t v o e n 1 I R n s r n i c

- T o s k e t n n 3 A ) c e c n n a e j C 2 r o i o h p d E I ( A p l l c c o L F B I A D .

T O a M

d n D e R o t d E d e - H i o n e R i v s R - t w e a v r I v l n -

s c t c i e P o a a r e n u a h r S r v r o h a s f j t e t N p t t t r o d i d I r c t e h

a w s o e a d h . l C a f r e e e t t c e d a n e E w u r n r n a v e n ga r A l s i u o e e l k r a s e a s t m a c i t e n e h t s n n n : v o s t g r t n e i i i s l t i p o r a e e r l i s f c p d t s n n e o u t n m . e f e n e i o t r s g s l h o h e t o i l n t i n o T c h c c r e i n e c s a r n i T e e n n o e r t e h n e s o i s c p s D t n . k w n h i l a o e a p e c

. o t n t i c h w er h l e c v t a r o o n e s s u c S u t n u e b s oi s d a C s i s d a a l l a i e e R s m i g s i w -

w sn v et e e v ) t n n o r prf i

O r r o 1 p r (

're a i e n o r i l

a a v r I t p t l t t e I o p a

e a.

t o c t n I )

. n o i o u i i p

w e 1 T s O t 1 m c s ml (

. u o

. r .

b G a 2

YI t

e t ,

c s s

e i s 's s

_ f r t t 2 -

t f r n n 2 3 n

_ A a a a & a e l H l l &

. 's P P 1 n P t n 'p 1 o -

n o e e t e a r r o n l s r l a u o o t l u

_ P e t L r g l t h u y o i u S F 4 B V M F

_ y l

l e a n -

_ c i d s

- i l e e t s r a n o p G

N m o o i c t l -

- I t t n

_ V u c y a L a u l l

_ A -

s l o V s o a o n t h u c N o -

y a a r c n O i I

T t

a t r e m ot g

C c i n n c i U i u i e a s S f c e e p

, ) i r s b r d S d i e 0

_ e R o c v t e 0 u H M l h 6

'n n R l a t i d o v e s t

n O e r

r v e e T t h a m h o i n t h i c c S u o o t a

. ( N q c b y e O e e e r 1 I R d e h h

- T e s t t e 3 A d o r y u

.. C d l f E I A c i b s L F B I A D .

T O b M s t -

e e - n e -

D t h n e e r n E r n t . i r h r e o R e e y l h c e r s c I r t c y f l c s a f u t P e a a 1 f p n i t E f s i e S v e j e o p o h i i s h N e r d v u i w e o t I

n g e

a i g s t n t r c r o e a p n e

.d r t C h s e a i r u e f v i d E w i n r k e s t o f e i A

g e g

. i t s o o c w t l b f h d s l e i a a o T e n n r i i l p t a s g m n ) t i i u s h n n c

n s p c i y r r n i 1 e . e e e s a mb e a p r a s ( k p n n n p e 5 e d l . a o n i g o r 2 a d l e t l t o o l i p 4 n e o s o a. l c s s i s s r e r 2 s n e t m t a o t o r t a t s o D i e u o

e v

w l c o n w u n e w n a i s o v t t a w t l t s b l S c s c l e l c a n y a a R d e e a n o r u n e s v H e r h r a v i o e s p

i v n R k o t l c t .

g e e a e c t d e t e t i r h h n o o o f e e v n r i v n

. r p t t O 't l m o n d i o o mi e O .

o i t i t s t m h v c t c n c n

) c d o e c a a e i 2 a a r p u e r p a

( E h p s s r t s t b

wb ;

e o t & t

. c 4 2 o e s 1 s s -

M f t t t t t f n h n 2 n n n n A a c a i a i o l a l & o l o i

, s P e P P P P t t B 1 c n p p y p n n a o t o y e o a u l o n o r k o i F P L i L r r L d o u u '

n l 2 P 3 a S. T 4 I c

i t

i r

C r

o G f N

I V d L e A r i

V s u n q

- N o e O i R

I t T a s C c e U i r

S f u

) i t

d S d a e R o e u H M F n R i d l t

n O e o T r r o i t c S u n q

. ( N o t

O e C I

I T

R e g

3 A n :

C a t

E I h c L F c e .

B I j 2 A D o b 7 T O N u 9 M S 1 D , ,

E d 0 R r 1 I

P o y l f S y a N a M I

H '

C _ . 7 E . I 3 A 7 R S P

, E n

r -

g e E t

i t ,

s e s e l e D v e l l s a a 1 u V n o i p h d g u g e i o n t

' . r r i a O I G t r I

I s s

e p e

p a WO

. u e o m :

r a e G S c r

u

. o 3 S iM

4.0 RESIDUAL HEAT REMOVAL SYSTEM o

4.1 Function The primary function of the Residual Heat Removal System (RHRS) is to remove decay heat from the Reactor Coolant System (RCS) during plant cooldown and I refueling operations. To effect this, the RHRS transfers heat from the RCS to the Component Cooling Water System (CCWS) to reduce reactor coolant

. temperature to the cold shutdown temperature at a controlled rate dui rg the 3

latter part of normal plant cooldown and maintains this temperature until the plant is started up again. !

As a secondary function, the RHRS also serves as part of the Emergency Core Cooling System (ECCS) during the injection and recirculation phases of a LOCA. The RHRS is also used to transfer refueling water between the refueling water storage tank and the refueling cavity before and after the refueling operations. l l

4.2 System Description l l

A schematic diagram of the RHRS is present in Figure 4-1. The RHRS consists of two heat exchangers, two motor-driven pumps and the associated piping, j valves and instrumentation necessary for operational control. The inlet line I to the RHRS is connected to the hot leg of reactor coolant loop 4, while the return lines re connected to the cold legs of each of the reactor coolant '

loops. l The RHRS suction line is isolated frcm the RCS by two motor-operated valves in series while the discharge 1ines are isolated by two check valves in each line. The RHRS isolation valves and the inlet line pressure relief valve are located inside containment while the remainder of the system is located outside containment.

During system operation, reactor coolant flows from the RCS to the RHRS pumps,

, through the tube side of the RHRS exchangers and back to the RCS. The heat is transferred in the RHRS exchangers to the component cooling water circulating through the shell side of the heat exchangers.

0057v:1D/112186 4-1 i

L___.._____________.__________ ~ . . . - . -

i j

I l

Coincident with RHR$ operations, a portion of the reactor coolant flow may be diverted from downstream of the RHRS heat exchangers to the CVCS low pressure letdown line for cleanup and/or pressure control. By regulating the diverted flowrate and the charging flow, the RCS pressure can be controlled. Pressure

]

regulation is necessary to maintain the pressure range dictated by the fracture prevention criteria requirements of the reactor vessel and by the No. 1 seal differential pressure and NPSH requirements of the RCPs.

The RCS cooldown rate is manually controlled by regulating the reactor coolant flow through the tube side of the RHRS heat exchangers. Instrumentation is provided to monitor system pressure, temperature and total flow, and to activate an alarm on low flow.

4.3 System Operation A discussion of RHRS operation during various reactor operating modes follows:

Reactor Startup Generally, during cold shutdown, residual heat from the reactor core is being

~

removed by the RHRS. The number of pumps and heat exchangers in service depends on the RHRS load at the time.

At initiation of plant startup, the RCS is completely filled, and the pressurizer heaters are energized. The RHRS pumps are operating, but the discharge is directed to the CVCS via a line that is connected to the common header downstream of the RHRS heat exchanger. Indication of steam bubble formations is provided in the control room by the damping out of the RCS pressure fluctuations and by pressurizer level indication. The RHRS is then isolated from the RCS and the system pressure is controlled by normal letdown and the pressurizer spray and pressurizer heaters.

0057v:1o/112186 4-2

Power Generation and Hot Standby Operation During power generation and hot standby operation, the RHRS is not in service but is aligned for operation as part of the ECCS.

Reactor Shutdown The initial phase of reactor cooldown is accomplished by transferring heat from the RCS to the Steam and Power Conversion System (SPCS) through the use of the steam generators.

When the reactor coolant nominal temperature and pressure are reduced to

< 350*F and less than 426 psig, respectively, approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reactor shutdown, the second phase of cooldown starts with the RHRS being placed in operation.

1 The reactor cooldown rate is limited by RCS equipment cooling rates based on

]

allowable stress limits, as well as the operating temperature limits of the j CCWS. As the reactor coolant temperature decreases, the reactor coolant flow through the RHRS heat exchangers is increased.

As cooldown continues, the pressurizer is filled with water and the RCS is operated in the water-solid condition. At this stage, pressure is controlled by regulating the charging flow rate and the letdown rate to the CVCS from the RHRS. Af ter the reactor coolant pressure is reduced and the temperature is 140*F or lower, the RCS may be opened for refueling or maintenance.

Refueling Both RHRS pumps are utilized during refueling to pump borated water from the !

refueling water storage tank to the refueling cavity. During this operation, the isolation valves in the inlet line of the RHRS are closed and the isolation valves from the refueling water storage tank are opened. J l

0057v:1o/112186 4-3 l

l I

After the water level reaches normal refueling level, the inlet isolation valves are opened, the Refueling Water Storage Tank (RWST) supply valves are closed, and RHRS operation resumes.

i During refueling, the RHRS is maintained in service with the number of pumps and heat exchangers in operation as required by the heat load.

Following refueling, the RHRS pumps are used to drain the refueling cavity to the top of the reactor vessel flange by pumping water from the RCS to the Rufueling Water Storage Tank.

i 4.4 Component Description This section describes the major components of the RHRS.

RHRS Pumps Two pumps are installed in the RHRS. The pumps are sized to deliver sufficient reactor coolant flow through the RHRS heat exchangers to meet the plant cooldown requirements. The use of two pumps ensures that cooling

~

capacity is only partially lost should one pump become inoperative. 1 The RHRS pumps are protected from overheating and loss of suction flow by miniflow bypass lines that provide flow to the pump suction at all times. A control valve' located in each miniflow line is regulated by a signal from the flow transmitters located in each pump discharge header. The control valves open when the RHRS pump discharge flow is less than 500 gpm and close when the flow exceeds 1000 gpm.

A pressure sensor in each pump discharge header provides a signal for an indicator in the control room. A high pressure alarm is also actuated by the pressure sensor.

0057v:1D/112186 4-4

The two pumps are vertical, centrifugal . units with mechanical shaft seals.

All pump surfaces in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.

RHRS Heat Exchangers i

Two heat exchangers are installed in the RHRS. The heat exchanger design is based on heat load and temperature differences between reactor coolant and component cooling water existing 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months after reactor shutdown when the ;

temperature difference between the two systems is small.

The installation of two heat exchangers ensures that the heat removal capacity of the system is only partially lost if one heat exchanger becomes inoperative.

-The heat exchangers are of the shell and U-tube type. Reactor coolant circulates through the tubes, while component cooling water circulates through

~the shell. The tubes are welded to the tubesheet to prevent leakage of reactor coolant.

RHRS Valves 8701, 8702, Inlet Isolation Valves l

These valves are motor-operated gate valves which are normally closed except when the RHRS is in operation. Both valves are provided with a manual control (open/ closed) on the main control board and will fail in the "as-is" position.

Valves 8701 and 8702 are interlocked with RCS pressure transmitters PT-405 and PT-403, respectively. These interlocks prevent the inadvertent opening of the valves, 8701 and 8702, when the RCS pressure is above approximately 390 psig. ,

Both valves also close automatically when the RCS pressure is higher than j approximately 700 psig.

Also, valve 8702 is interlocked such that it cannot be opened if the l temperature in the pressurizer vapor space (T-454) is above a temperature

. corresponding to a saturation pressure which would cause overpressurization of the RHRS.

4 oos7v:10/1121ss 4-5 i

4 i

A more detailed description of the interlocks is provided in Section 5.0.

8700A, 8700B, Pump Suction Isolation Valves These valves are motor operated gate valves which are normally open except when the RHRS is used as part of the Safety Injection System (SIS) during the i recirculation phase. An interlock is provided between valve 8700A (87008) and valves 8982A (89828), 9003A (9003B) and 8804A (8804B) to prevent the opening of the suction valve without closing the others.

HCV-637, HCV-638, Heat Exchanger Flow Control Valves These valves are air-operated butterfly valves which may be positioned from the main control room. By manually adjusting these valves, the flow through the heat exchangers may be controlled.

HCV-670, Bypass Flow Control Valves This valve, located in the heat exchanger bypass line, is an air operated butterfly valve which may be positioned from the main control room. By adjusting the valve the bypass flow around the heat exchangers may be changed to regulate the residual return flow temperature, and in conjunction with HCV-637 and 638 the total return flow. The line containing the valve is isolated from the RHRS pumps and heat exchangers by two manual gate valves in the piping cross-tie between the RHRS pumps and heat exchangers. These valves are opened prior to initiation of residual heat removal operations.

FCV-641A, FCV-641B, Miniflow Stop Valves These normally closed velves are motor operated globe valves which are located in the residual heat removal pump miniflow line. The valves are controlled by flow transmitters FIC-641A and FIC-641B, respectively, which are located in '

the discharge line of the RHRS pump. These valves will open when their respective pumps are operating, and the flow is less than 500 gpm. When the pump flow exceeds 1000 gpm, or a residual heat removal pump stops, the !

corresponding valve will close.

8716A, 87168, Crosstie Valves

. These motor operated valves, located in the piping crosstie downstream of the residual heat exchangers, are normally open during normal plant operating and l

l 0057v:1o/112186 4-6

RHRS. operation. These valves are controlled from the main control board and fail "as ic" 'These' valves _are used to align the RHRS for th'. recirculation phases following_a loss of coolant accident.

8948A,'89488, 8948C, 8948D, RHRS-Injection Line-Check Valves

.There is one check valve in each branch of the cold. leg injection.line to prevent backflow from-the'RCS.

8818A, 8818B, 8818C, 88180, RHRS Return Line Check Valves One check valve is located in each branch of the RHRS return.line to serve as a backup'in the event of leakage of the check valves on the cold leg injection ;

line.

8809A, 8809B Gate Valve There isuan eight-inch normally open, motor-operated gate valve in each parallel discharge line from the residual heat' removal pump, downstream of the heat' exchanger and discharge crosstie header.

8726A, 87268 Crosstie Valves These two manual gate valves isolate the heat exchanger bypass line. During startup of the RHRS, these valves must be opened.

l. ,

l 1'

0057v:1D/112186 4-7 1

. . . v - . - - -- - - --------- ------- ----- - - - - - - - - - - - - -- - -

._______La

6 f; g l.S....A. .c. evess 7 M8 g 1 ^!T1 V M ff f u c on r u ==.n r y i

..... / .. 4 ...

8 ..m..

i /AI.uo L y. ..e: , d'""'*

V.

ai s .. .- -. /

on i u ,, .....

.,.;.-....,.,_*1_----,

. u, -

s

- ca ... . m ,.m I

g .,. .

i n m-....,

. . ...e. .,, n ".'., r as_

.a . , - :n . _ g, : ,,

a,_ ""

.=6..

+ ,N 8 s. , ..

' . .. %. .<... ~.. )- ..

N

.au u. M: o.-m-c

..... ..... - . .a e1.:

y ;;;-- drM

... L.0P . 4 I

.; ....m..

E"*"

.n,t 6.77.%..

I 0**M

.. a. .

... ..... u,,. .,, ,

-- . n.c

~2

. .. . - w i , ,

. _ . .. ~.. . ...

/ .m.-

L.s a.,

. N _

w l ..

o- ,.,e

. .~, w r d .. c e. .um - -. .

=

i 21' s a % .t. h.,t..***

-- _ F sect . ains ym. ua m .,

, j yri.a,.. ,a.

l

y;..g. ,,

2--

n .,.

L % ,%-m.- ...

m_.~..

.'!J 2 s

... .__ y n g 8 __ c ..

-- .a pa -)gj;,.Hf

",': :: '+-N w "s -

r.r ;;. 3!*

.N. .- ..tg x..... l ;

y2

','

: : **--N.....

. N--

( m.til; " O... ---- J %g n . = ; , l, L.m,.

h .,e. Z!!!22 1 .l -. ] <-

l ... t. 4 *"-(., h I una .-

i o dn 1r h (,,ta.Po 1.,, -h--X r n .c e 7 4,

3, . _ _ _- ~

m....

e.

l . . FW P3 L-

.t. h. .? Ses 3 L DC (e- A

.p .e- q.

3 s..e

~ y,3e g . $.,...

. F,

=

s. . . ,. Nu , .:..

u. s.

ww

/

G o ng .

,,~,u._c , m, . .ser

~ - - .

W' ,

c'o E =

"c

._ .. .g g n ,,

-aoc.3[..,,,.

5.w - . .. , a'.i ~.

3. .m v.

s e.. ...%._.,

. /

~- < - - -

T / x.. # , . ... , r

-. .. n,

. ~. ,..\ /

= -

, i,. ,,,.

. . .h' ,

-- , ~ =

. , . tv-t e 0 me55LE emhbog

.swet /, ~- ~-

_"(g,,,,r g ,

y, .. ..

,.,, g., 4 ,,,,,

.. y h[,u. O t-L.,,, ,.....

'r o . ~. .

.. ~ ..

g 'A = = :- se m . _ , -mE 1;' ?n" '.?. (dr

, m .

J"**'

.T,'.. . w. 1 o,

3 .

- u. n a

% uove t uovts

>'-a a s q.g'.- 3,9

- ,o -

r..=..... -.

n

.%. * - - i/ c . -

_f._ f, m._. m. .. ..o. . l ,

N= ,1, _ ,y p\,,3 - m.-<u.

r v 2

== ....

s- n.a 3-F- 4 wQr ,

2 Aa* *M o - ae weit C5,'.,fr** ,. l ai .

~ _ .... c.

. yes y _.. ass ou -c.,.. ) ..

I. **.s

..i up tts ,,*;*

_ ru

~.,,

g f,) Y, ""

, .. .:h yT D m ./ X ./j ; e y @'f ...,

"*3,a :

g 7'22lHE *a=

fp.,SR

\...-m. L y"".'" uf- ,,,.g. ..

. g.7-- Y hI'#4' ..,

n a '

q.,. _

=-

1 e- so.*

8 74 8'//0 / 0 ~#l

_- is. -. , s N.oE'8 ' E L' N'/

aca**

l .. , ,s e .

h- '

i Y sN M \ .-L rso.*

gg. }TI

%- sea. -~ t /

KPERTURE l'1 _

s.,m

__e,u,;

sw ./.s

.CAIW o .. ..c a

@ m.,

~

e c, . .~' ' '

s i ~. .. ,4.o FIGURE 4-1 Also A,allable On RHRS FLOW DIAGRAM 44 Ag crture Card

.f h I

o 5.0 PROPOSED MODIFICATION To effect the removal of the autoclosure interlock (ACI), certain modifications must be made to the Diablo Canyon Plant. These changes fall into two categories: modifications to the electrical design, and modifications to the operating procedures. The following text defines the.

functional requirements.for these changes, and actual implementation of the

. changes will be by Pacific Gas & Electric. The model used in the analysis for this report is based on an' assumed method of implementation; this method was chosen based on inputs from both Pacific Gas & Electric and Westinghouse. The final modifications made to Diablo Canyon, both electrically and procedurally, must meet the given functional requirements to ensure validity of this report.

5.0.1 Current Interlocks

'I There are two normally closed' motor operated series isolation valves in the RHR pump suction line from the RCS loop 4 hot leg. Valve 8702 is the first !

valve from the RCS and 8701 is second. The interlock feature provided for both valves is essentially identical in function. Each valve is interlocked against opening unless the RCS pressure as measured by appropriate channels is less than approximately 390 psig; in addition, valve 8701 is also interlocked with RCS temperature and will not be permitted to open unless the RCS temperature is less than 475'F. Each valve is also interlocked to automatically close on increasing RCS pressure greater than 700 psig; for valve 8701, both RCS pressure and temperature are required for the valve to automatically close. These interlocks are shown functionally on Figures 5-6 and 5-7, and also are shown on elementary wiring diagrams in Figures 5-8 and ]

5-9. Currently, the velve control via the interlocks is shown in the center j of the elementary diagrams as a single line circuit comprised of contacts that )

close when the appropriate conditions are met; i.e., auto-close for valve 8701 i functionally receives inputs from'PC-405BX and TC454, and valve 8702 receives inputs from PC403BX. The open permissive is similarly shown. As can also be L . . .. . seen on Figures 5-8 and 5-9, marked revisions which implement the deletion of j the auto-close interlock are shown. These are encircled by clouds and are !

l'. . explained in section 5.1.1 through 5.1.3.

l l

I 00s7v:1D/11218s 5-1 ,

l

5.1 Functional' Requirements i

The items included in the functional requirements are discussed below.

5.1.1 Alarms are to be provided (for each valve in the RHRS suction line) that sound given a " valve not full closed" signal in conjunction with a "RCS pressure-high" signal. See Figures 5-1 and 5-2. The intent of these alarms is to alert the operator that either of the RCS-RHRS isolation valves in series is not fully closed, and the double valve isolation from the RCS to the RHRS is not intact. Valve position indication input to this alarm must be from the valve Stem Mounted Limit Switches (SMLS) and power to that SMLS must not be affected by power lockout to the valve. As with other power lockout-valves, there is no requirement for opposite train power for the SMLS, only that power to the SMLS is not affected by power lockout. (See Figure 5-3)

The elementary wiring diagrams also show the alarm circuits for the valves.

Tiiese were added to the upper right position of the diagrams, and indicate'a monitor light, an annunciator, a power source, a pressure input, and a valve position input. Also note 3 has been added which specifies that the valve position must-be input whenever the valve is not fully closed. This alarm must be verified safety grade just as other safety-related alarms would be, such'as those occurring for Refueling Water Storage Tank Level.

5.1.2 The autoclosure portion of the currant interlock will be removed, shown functionally on Figures 5-4 and 5-5. The only change is removing the ,

autoclose portion, as the open permissive circuit will not be altered. The original interlocks are shown on Figures 5-6 and 5-7, for comparison. The elementary wiring diagrams also show the auto-closure portion deletion simply by disconnecting the autoclose input line from contact 5 on each valve. This will effect the minimal plant required changes, and will also provide positive invalidation of the autoclose interlock. These changes are marked in the lower central portion of the diagram. Note that inputs will still be made to the interlock; however the contact (s) will never be closed by the autoclose signal, and thus the valve will never close from an "autoclose" signal.

l 0057v:1o/112186 5-2

5.1.3 The plant specific operating procedures for heatup from cold shutdown to hot standby must be modified to reflect the appropriate (new) alarm i

~ recognition and responses for the added alarms. These new procedure sections will verify that the operator takes steps to close the open valve, or if this is not possible, to return to the shutdown mode of operation.

Overall, the functional requirements reflect the deletion of the ACI, while retaining the open permissive portion of the interlock.

5.2 Alternative Modification f

In the determination of the modification which would be proposed, considerations were given to many factors including regulatory requirements, systems design, and' minimizing plant changes. The set of changes which best meet all of the considerations was chosen as the proposed modification as defined in Section 5.1. Other modifications were considered, but did not meet all the criteria as well as the proposed modification. For example, a single switch capable of closing both valves in series (instead of separate switches !

for each valve) was also considered. liowever, from a reliability standpoint, the single switch and alarm versus an alarm only, provides no significant advantage. Furthermore, in order to test the isolat Sn valves for leakage, pursuant to Technical Specification Surveillance Re..jirement 4.4.6.2.2, the single switch circuitry would have to be bypassed or overridoen so that each y valve could be " demonstrated operable by verifying leakage to be within its limit ..." (Reference 29). Thus, the alarm modification supports the

" minimum-change" concept with respect to plant design changes and operations.

oos7v:10/1121ss 5-3

l PRESSURE VALVE OPEN PI-405 OIOT FULL CLOSED)

HIGH SIGNAL May-8701 i

)

I W

! f

! I I 1 OPERATOR ALARM 1

VALVE 8701 DR 8702 DPEN l

l .

FICLIRE E-1 VALVE Af_ ARM - MOV-8701 5-4 1 _ _ _ _ _ _ _ _ _ _

l PRESSURE VALVE OPEN PT-403 (NOT FULL CLOSED)

HIGH SIGNAL MOV-8702 l

I

~

I l

! DPERATOR ALARM

, VALVE 8701 DR 8702 DPEN l

FIGLIRE 5-2 YALVE ALARM - MOV-8702 5-5

~

I i

V

\

j

(

NORMAL POSITION l l

MDV-8701 (MOV-8702) MOTOR SVITCH j

ALARM / MONITOR LIGHT INDICATION SEPARATE FROM NDRMAL !

INDICATIDN r

'b FIGLfRE 5-3 POSITION INDICATION ;

5-6

1

. SPRING RCTURN TD AUTO l

. AUTO = MAINTAIN PDSITION ;

1

1 P

DPEN AUTO CLOSE 405 l i

) HI 390 PSIG I

TT l I

454 l "I

475 T I

i l

1 o i ,

u l

l l

l i r i r DPEN CLOSE MOTOR DPERATED VALVE 8701 FIGURE 5-4 PROPO'Fn IKrERIDCK - EVEd i

5-7 l t

. SPRING RETURN TO AUTO AUTO = MAINTAIN PDSITION PT OPEN AUTO CLOSE j 4o9

( H1 l

J 390 PSIG 4

l l l I ! f 1 . .

l i t i r OPEN CLDSE !

MOTOR-UPERATED VALVE 8702 i

1 e

FIGL!RE 5-5 PROPOSED INTER 11)CK - K)V 8702 5-8 1

p.

j.

SPRING RETURN 70 AUTD AUTD = MAINTAIN PDSITION l

o OPEN AUTD CLOSE .[0h HI q I

) l i

390 PSIG TT '

454 l

1 475 F 1 f i f I F

. m LDSS OF SSPS ELECTRICAL PDVER m

a a I

1 P 1 f l a

DPEN CLDSE MOTOR-DPERATED VALVE 8701 FIGURE 5-6 CURRFXP TrrFRT ACK - MDV 8701 3

l 5-9 !

' SPRING RETURN TO AUTD

' AUTD

MAINTAIN POSITION y

1.

6 OPEN AUTO CLOSE 403- I I

. I J HI j 1

390 PSIG l i

1 I

o < r 1 4

[ LDSS OF SSPS ELECTRICAL POVER i r a a j '

f 1 I!

I P DPEN CLOSE NOTOR-DPERATED VALVE 8702

b FIGURE 5-7 f

co o mt m em ocr _ m v_8 m l

3 1

5-10 l

)J

w j

os.r33 o..ss s o r@st s %@:3 O.-@ta s 33 ss a.o ao -ec , o 4 to -

no 93

, %3g at g

- woTE s

-J

_t._. O OO OO O O O O O O M h Df

&&@W m"

~

4%1.b t.ZI ^ - Y sho" fN (_LME $%)7.

REFEE TO

'22 ~

W CLCSE ::py ctog,M /*

.sH. J R j'3 ' s.

- CS O O ASdf00 I

bd r TE4N.2+a cst %

4

" 4 s ov. s tb . co.v ,

l ASClBK)g.c ot.5 0 .

I 1 ,

. AAA l 5

N iii l d O

a j j[ l i

D.ys /

s s s\ \ \su \t .

E , a uce, (): d5 8 _ ~ ,,, . . 244z 3 W ' ' W ))D

!! . (c .

(of ]

O _

b 2 L1 4g MECH. INTERLOC TRANS. (C) 49 4BD120V La m3 p;49 u TI T2 T3 , ,

a O k O djo N NY I ':8 NOTEQ:

i. R VALVE. No. ~

O rU J $# I b*

o2

2. t/s -DEv. I SH.20 N.R*C. SH.2.1 r)j I

3.cowTROL SuoWN FOR Lt TYPE W MOTOR CONTROL CENTER. ,

ff 4.RtF. 'UMtTORQUE* DWG. 15 477 17 B S 3 4 27 Br. t 2- 20 4

w mQ S ADD JUMPER IF TORQUE SEATING 15 REQD. V .I. O

. to wh L..

u _ - - - - - -

/

moz.-^z-z

~

N -@n n .%.@n <-LG u R_@n q..@n A_O n ~9@3 %+ @33 \

r. o -bo ac ' -- do -

ec -

x. : a.c c. y 7 t

,.t3 g

u.n @

I bbo o o ob oo oo AR2

.6TE4- Adad7&b .

gy

}s3 yL M g 1 FDS/T/0A5td/TU/

Ril Jf \_ --

OPEN~~ ,

[ y pQ= is anz y .y 43 g O(GA-v 3 +g

?LSP swaQ " "d* " 6 A%

)'# UW \ b 9 p i

/

. A Nfh ON 10b h

YA ~EM Ib6E MCCI-ED AM l 1-8701 S T&WMM4 )

~

.. mmy Rr.smsssums is a w.ow AzG Psl wo Q

03 oz oxa L 4a ce)

a. .3 @dT&~f CM555 & LEU y Ata> #UIE I.s Abr Fuuf ,

CLOSS /

N q

' ctRCutT /b 1DSE%b l g- BY . SOURCE NOT* ,

AffGC7Eb 89 RLO. ,

tion

% ${r 3 &$

94 %3o q Y.C d Westinghouse Electric Corp

~ PA41 FIC GA5 d E L_ .

q,7

. c '2. ' APERTURE (A$14 b e6M mast.c cAwvow ut.nz .

CARD y " I -ir 7 utstm^w mms ems.

WM b E'h8 00 voTo= notarno vxws N/>d by3 -

.F< $

t---T,

4 w/ trod %c 1

' y#

f

$O $$

Alm Anilable On s

f(Ee'Mf'fe SHE"T- Id I Aperture Card

[ ,

Y

, 7. g

.W, NUCLEAR ENERGY SYSTEMS PITTS3UR GH. PA U.S.A.

FIGURE 5-8 ELEMENTARY WIRING DIAGRAM - S~J1 17/7//1/T' ~" 5-11 i

s_

@ @ l@ O os ss A ss L @ssos+ .r@13 R_@33 g as Lss

.r e.o - tc, e a.o 4.o --do gtj3 po

%;a@ Tf*"' S

-J L O O 6 O O O O O OO O m"

g y(MA I"'

~

cuncen part ro a 2- c ra h~tw die '

an sN. /$ o- d.T "E cB ASCl.AY)

A r.,4 l-PC403*M sa.zaa

" 4MOV. 56 Com g

ASC(ATO %2-5

~

6 i e AAA l e '

5 t)t)- )-

s\\ \\\

H /\\\\\\ e' e MCC, 01 Q4 05 (b u

i g

e a e .L 4 2 L C ' ~'L A2 .L .L .L +2. = W S -- - -

g- ( c ) p r- - (o) - .N o 6

.E l L1

ggty,g,4T7,R_Lo(

T R AN S.

49 400-120V L 7- u p49 u TI T3 -

O 2 i soTtg:

f O 07,2u y $

d

. #' ?

i.m-v^tvv_ so. 0 N 2.W -CEV I 5H.2.0 acoNTRot tucWNKj. FORR *c7 WSH.2.l TfPE iv MOTOR ccNTROL CENTER.

S;p* 3

,q]

1.REF/LtMITORQUE" DWG, 15 477-2185 3 4 278kh fn 4

5. ADD JUMPER tF TORQUE SUsTlH615 RY.QD. , l/, '

c- s-y

~. n

~~ -- - - - - _ _ - - _ _ ____-__ _____

/

M0 2- A2. - 2

@ @ @ @ M 33

'9 Q1@23R f @33

(_@n ,.; 12 -( ~_ 3' t (,, 3 5 0

~

@33 R . 33

~' ~

~ ~

~" " " ' '

' ~

- l T '4su.n 3*- @ -

I Tb D

O O O O O O O O O O O O

ARI f 4 l '[2A -hdl$ TED l l '

^ ^ @ fC.)l(10/)&d/TCil R11 $

M~ ,

R ~L

. . o y .-

A % < j RCSP

^ Y 902't j}22uECArd A1g(t20) A MODfoAU'a 9 Q 8 l-PC-

{ g__E$

z Wvb wkta_LANnT=Ja.ctc4-ner(es ASCM O*,Ol*2 1-8702 A ACCNTAC.T dt.OSES WHEN

~ ~

N.C.5 PRE 5 cure EYt.EEDS GCC - I b ACCNTACT ct.05ES

-. WHEN RCS FR!itSURE IS MG'F*-~\

03 Ox2 1

SaAt cc) idH50 MuiE I.S AbT' /

To- Fuuf C(LSEb.

4 $2(c) w h k

~~

? 0 okrs a&w \

Pa .504/4'CE A/07~

A$PEc768YPD't)&&

. uYK ndT CP,L.on 1

(

w ff if 4 o ai j Weatn$ouse Electric Corpordon 8 70 TI ei -Eps tt n 8 ~ i=A41FIC Ces d E LE.c" C .

UN Teal A, P Ell T U R E oe e, CANYON FIEW I & '2.

JJ dy

~

gs+l1 3" . s i merca enamo vatva CARD

.! u m u n s w w m c o m c. '

I g Tg, ~I u o wy eeun fg g- g- 7g g--- g ---

p~f c.x

E warod Mc]ui 5'E , < --

Also Amilaile P

i "[/.l.<j N S*O U-N ApFrt ure b,r, '"

fg! I g'

u : ;- y "

u.s.4-r kv-- ..

= r<t= . a c~cacv svsrcru FIGURE 5-9 ELEMENTARY WIRING DIAGRAM - 8702 f 870g/reif3 o3 s- n 1

~

r. ,- -

6. 0.: PROBABILISTIC ANALYSIS

[ 6.1 Introduction

.This section describes the probabilistic analyses performed to justify removal

~

e of the'autoclosure interlock. Three different areas were examined in this ;

analysis: _1) the likelihood of an: interfacing' system LOCA; 2) the potential. q increase in RHRS availability and 3)' low temperature overpressurization l

concerns. Each of the three areas were analyzed utilizing the current-configuration and then the proposed modification. The NRC proposed single j

. switch to close both isolation valves was also analyzed. The net change in-

~

I each area was determined and the overall net detriments and benefits were l' ;weighe'd to determine the acceptability'of removal of the autoclosure interlock..

!6.2 Data-I The data used in this analysis was derived primarily from the Interim Reliability Evaluation Program (IREP). When' data was unavailable for

~

electrical. components, other-sources were' chosen, particularly IEEE 500 and ]

WASH-1400. .The component failure data is presented in Table 6.2-1. j Testing information was obtained from the Technical Specifications while j maintenance information was extracted from the Zion Probabilistic Safety Study q (assumed to be representative of PWRs). 'j 1

Human error probabilities were obtained from Swain and Guttman (Ref. 27) and are explained in the individual analyses.

6.3 Event V Analysis An' interfacing systems LOCA, referred to as an Event V in WASH-1400, is a breach of the high pressure reactor coolant system boundary at an interface with the low pressure piping system. This breach has the potential to cause a LOCA in which the containment and containment safeguards radionuclides

.j. protective barriers are bypassed.

0057v;1D/112186 6-1 l

In this section, the frequency of an interfacing systems LOCA is calculated for the RHRS-RCS-system interface for three cases: 1) with the present if interlock configuration, 2) with the proposed modification logic, and 3) with

,the NRC proposed modification. I l *

, .. 4 Analysis i

Typically, RiiRS suction paths are the dominant V-sequence source. Figure. l 6.3-1 depicts the RHRS suction valve arrangement. As'shown in the figure, one l suction line contains two series motor-operated valves. Failure of these normally closed valves would exposa the low pressure piping upstream of the valves to the existing RCS pressure.

l Failure combinations involving rupture of two series motor-operated valves are included in the analysis. Also included are the combinations of one valve failing open and subsequent rupture of the other valve. Failure of both i valves to close dur_ing startup operations is not included because this condition would become apparent during startup testing and corrective action l would be taken..

Based.on the above information, the following expression is developed for the frequency of an Event V.via the RHRS suction path:

F(VSEQ)=1 2 0(Y 1

) + 11 0(Y2) + 1 2Q(V gR) where 1 = failure rate of MOV 8701 (rupture) j 1

1 2

= failure rate of MOV 8702 (rupture)

Q(V)3

= probability that MOV 8701 is open Q(V2 ) = pr bability that MOV 8702 is open l

Q(V1 R) = probability of rupture of MOV 8701.

0057v:1D/112186 6-2 .

1

.. . . . . . .. .. .. . . . . )

yn ,

1

~

r

) .(

- The following a'ssumptionsL were applied .in the development of this equatio'n:

1) The frequency of valve rupture is'that of catastrophic internal

. leakage. The failure rate 14 is the same for either valve given )

[ that the valve is exposed to RCS pressure.. l

2) ! Valve 8702 is at:RCS pressure and valve 8701 is'at RCS pressure only 1 if valve 8702 fails open.-

l L

3) .No common cause rupture of the two valves is considered. This is i based on the-fact that no common cause' ruptures of valves have 1

actually occurred. l

'4) The' calculation is based on an occurrence when the plant is not in the shutdown mode, i i

i

- Assuming that the total defined mission time is the time between refueling l outages'(i.e., every 18 months), the quantity Q(V 1R). = 6.57E-4. The valuss for'11,;and X2 are equal and are taken to be IE-7/hr. The

~

probabilities'for.Q(V )1 and.Q(V 2) were quantified through the use of the detailed fault trees (see Appendix B). The probabilities were calculated to-

, . be:

l With Present With With NRC Configuration Modification Modification MOV 8701 Q(V1 ) 2.39E-5 1.27E-8 1.19E-8 MOV 8702 Q(V2 ) 2.39E-5 1.27E-8 1.19E-8 Using these values and substituting in:o the V-sequence equation yields the following results:

', With Present With Proposed With NRC Configuration Modification Modification 1

.?

F(Vseq) 6.17E-7/yr 5.76E-7/yr 5.76E-7/yr 0057v:1D/112586 6-3

The frequency of an Event V decreases by approximately seven percent with removal of the ACI. The main contributor to the frequencies in each case is a

', double rupture of MOV 8702 then 8701. The deletion of the ACI has no impact on this contributor. The other contributor (the rupture of one valve while

[ the other valve has failed open) decreases from 4.19E-8/ year for the present configuration to 1.11E-11/ year for the modification case and to 1.04E-11/ year for the NRC modification case. This is a significant decrease in the occurrence of an Event V by this failure mode. The deletion of the autoclosure interlock and the inclusion of an alarm is beneficial in reducing this contribution.

Furthermore, several factors were not considered in the analysis but are worth mentioning:

1) Both suction valves have AC power removed from the operators during Modes 1, 2, and 3. This prevents opening of the valves during these modes.

2) Both suction valves have open permissive interlocks that prevent the valves from being opened whenever the RCS pressure is greater than approximately 390 psig. The second isolation valve also has an open-permissive interlock that prevents it from being opened if the pressurizer temperature exceeds 475'F.

l

3) It is highly unlikely that the valve could move against the high AP across the valve when the plant is in Modes 1, 2, or 3 (i.e., valve motor size is inadequate to open the valve given the high AP).

4) If a RHRS pump seal should fail during an Event V, water would spill onto the floor of the pump compartment. Each RHRS pump is in a separate, shielded compartment that drains to a sump containing two 30 gpm pumps that can pump the spillage to the waste disposal system.

,, Gross leakage from the RHRS can be accommodated in the pump compartments, each of which has a capacity of 9450 gallons.

.- )

0057v:1D/112586 6-4

5) If an Event V should occur, the RHRS relief valve would operate. This relief valve discharges inside containment to the pressurizer relief 1 tank. This relief valve would decrease the consequences of an Event V.

. Based on the analysis, a modification is beneficial in reducing the frequency ;

of an interfacing system LOCA, 6.4 RHRS Availability The availability of the RHRS during cold shutdown has been of increasing concern in the nuclear industry. Many events have occurred in which the ability to remove decay heat has been lost, either because a loss of flow in the RHRS or because of a loss of the heat sink. Abnormal events that occur shortly after initiation of the RHRS, while decay heat is high, can cause bulk boiling conditions if decay heat removal is lost and not restored by the

-operator in a time period as short as twenty minutes.

Removal of the autoclosure interlock will reduce the number of spurious

~

closure events and thus increase the availability of the RHRS system.

Analysis Three different scenarios were postulated to evaluate the unavailability of the RHRS: 1) failure during startup of the RHRS, 2) failure during the first 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after initiation (in which two trains of RHRS are required), and 3) failure during long term cooling (a 6 week time period was assumed in which only one train of RHRS is required).

The models used for the analysis are fault trees. The major components in the RHR system were modeled including valves, heat exchangers and pumps. The two suction valves are modeled in detail to explicitly show the changes in the unavailability due to removal of the autoclosure interlock. Detailed descriptions of the analysis are shown '.n Appendix C.

l l

0057v:1D/112186 6-5 l

n ,

J l

The results of the analysis are shown in Table 6.4-1. As can be seen from the table, the unavailability of the RHRS slightly decreases with removal of the

', autoclosure interlock. A trend appears to be occurring in which the change in unavailability (with and without the interlock) decreases more rapidly as the

.'. time period required for RHRS operation increases. Thus, removal of the )

1 interlock increases the availability of the RHRS. l 6.5 Overpressurization Transients I A number of occurrences in the past have happened in which the temperature -

pressure limits have exceeded a plant's Technical Specifications. A majority of these events have occurred during startup or shutdown conditions. These j pressure transients are of concern because the vessel material is more brittle -

at relatively low temperatures than at operating temperatures. l j

The effect of an overpressure transient at cold shutdown conditions will be i altered by removal of the autoclosure interlock. With removal of the interlock, the RHRS will'also be subject to overpressure for which it may not be designed to handle. However, the RHRS relief valve will be available to help mitigate the transient. The tradeoffs between these two must be considered in the analysis of the RHRS autoclosure interlock, i

The overpressurization analysis uses event trees to model the mitigating i acticns (both automatic and manual) following the occurrence of low temperature overpressurization events. These mitigating actions affect the j severity of the overpressurization events and reduce the possibility of damage to the plant. The analysis is divided into two parts: 1) determination of the frequency of cold overpressure events and 2) the effect of mitigation on the transients. Each part is discussed below.

INITIATING EVENTS Hany past reports hcve characterized the different types of transients possible at cold shutdown. These events have been grouped into two general

,- categories: 1) events that affect the balance between mass addition and mass letdown; and 2) events that affect the heat input / heat removal balance. These 0057v:1D/112186 6-6 l

l l.

I i

types of events have actually occurred and the NRC has expressed concern over the frequency of these events. This section describes each transient event

", and attempts to quantify the frequency of these events.

." Premature Opening of the RHRS Overpressurization of the RHRS could occur if the RHRS is opened prior to ,

reducing the RCS pressure below the RHRS design pressure. However, the RHRS isolation valves are equipped with " prevent-open" ir,terlocks. These interlocks prevent the opening of the suction valves before the RCS pressure is below a given setpoint. Furthermore, the valve motor operator is sized with insufficient torque to raise the stem with a pressure differential across the valve greater than 500 psi.

To date, this type of event has not occurred, although attempts to access the RHRS prior to reduction of the RCS pressure have resulted in valve motor failures. Because of the design features on the RHRS isolation valves, this type of event is not considered plausible and was not analyzed.

Rod Withdrawal Rod withdrawal during shutdown would have only a minor effect on the RCS. The neutron flux would increase to the source range trip setpoint prior to core generation.

A Westinghouse analysis of this event for the RESAR-3 and -41 designs utilized the following assumptions:

1) Reactor is suberitical by 1% ak/k.

2) One loop of the RHRS is isolated from service.

3) RCS temperature and pressure are 350*F and 425 psig prior to the event.

.- l l

i 0057v:1D/112186 6-7 i J

It was determined that the transient pressure would not exceed 110% of RHRS design pressure. The RHRS relief valve would also be available to help

f .

mitigate this transient. The removal of the autoclosure interlock has no effect on this transient. Thus, this event was not considered a critical event and was removed from the analysis.

Failure to Isolate RHRS During Startup During plant startup, the RCS is completely filled, and the pressurizer heaters are energized. The RHRS pumps are operating, but the discharge is directed to the CVCS. After the RCPs are started, pressure control via the RHRS and the low pressure letdown line is continued until the pressurizer steam bubble is formed. . Indication of steam bubble formation is provided in !

the control room by the damping out of the RCS pressure fluctuations and by pressurizer level indication. The RHRS is then isolated from the RCS.

If the RHRS is not isolated by the operator, RCS pressure would increase to that of the suction relief valve. Discharge through the relief valve would prevent the operator from increasing the. pressure further.

If only one of the suction valves is closed, RCS pressure can be raised to operating pressure. Should the' operator fail to close the remaining valve, a ;

loss-of-coolant accident could occur if the closed valve opens or ruptures. !

This scenario is addressed in Section 6.3. ,

Pressurizer Heaters Actuation During startup, all of the pressurizer heaters are energized and letdown is !

initiated (or increased) in order to form a steam bubble in the pressurizer.

If the pressurizer heaters are inadvertently actuated, the same scenario results. The expansion rate due to boiling in the pressurizer is greater than that due to merely heating the pressurizer water. If the RHRS is not isolated, the pressure increase is limited by the relief valve on the RHRS suction line. However, if the relief valve failed, the RCS pressure would o057v:10/112186 6-8

1 increase above the RHRS design pressure. The transient will continue until ;

the decreasing pressurizer water level actuates an automatic heater cutoff (at approximately 10% of pressurizer volume).

,' Startup of an Inactive Loop l The startup of an inactive reactor coolant pump is another heat input transient. This transient occurs when charging flow is continued for a period of time without having all of the reactor coolant pumps in operation. This cold water collects in the low areas of the loop piping. When the inactive reactor coolant pump is started, the cold water mixes in the warm steam q generators, and the cold water expands as its density decreases. This ]

expansion results in an increase in RCS pressure. I I

1 Loss of RHRS Cooling Train I l

Loss of an RHRS cooling train may occur at any time during RHRS operation. !

However, such a loss would have its greatest impact if it were to occur immediately following RHRS initiation during plant cooldown. At this time, the heat generation rate exceeds the heat removal capability of the remaining cooling train. The RHRS relief valve will protect the RHRS from overpressurization as long as the RCS does not boil. A loss of cooling would !

I cause a slow rise in the coolant temperature and pressure. )

Opening of Accumulator Discharge Isolation Valve The opening of an accumulator discharge valve will input water into the RCS which is already water solid. The peak pressure reached during this event will be between the initial RCS pressure and the accumulator nitrogen pressure.

l Letdown Isolation l For this event, two scenarios are considered: isolation of letdown while the RHRS remains functional and isolation of the RHRS itself. Of these, the l pressure transient associated with the second event is greater in that the j l

0057v:1D/112186 6-9

mass addition transient is coupled with a heatup transient. Additionally,

' isolation of the RHRS precludes the nse of the RHRS relief valve in mitigating

~, the pressure rise and places this action on the LTOP system.

~ l

. Charging / Safety Injection Pump Actuation

-l

'Under stable pressure conditions, the inadvertent actuation of a charging pump i or safety injection pump that results in coolant addition without an increase

~

in letdown will cause a pressure transient.

These transients were researched in order to determine the frequency of these events. Appendix D details the events.that have occurred and the quantification of the frequencies of these transients. Table 6.5-1 lists the transients and the frequencies calculated based on operating experience.

HEAT INPUT ANALYSIS

[ The investigation of reported cold overpressurization events showed these heat

., addition mechanisms.

1) inadvertent operation of all the pressurizer heaters.

2) heat addition.from core decay heat at 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months following an extended

. period of operation,

3) inadvertent startup of a reactor coolant pump with temperature asymmetry between the reactor coolant system and the steam generator.

Past analyses assessed the effect of these transients in terms of the change j in RCS pressure associated with each transient. Figure 6.5-1 was generated from these analyses. Note that the above transients are applicable to Diablo Canyon Power Plant, see Reference 25.

This figure shows that heat input transients occur quickly in time. The

.- figure also shows that given that RCS temperature and pressure are below 350*F and 450 psig, the RCS pressure change is less than approximately 200 psi for 0057v:1D/112186 6-10

._ _o

i the decay heat addition and pressurizer heaters actuation. For these cases, the RhRS suction valve autoclosure interlock would not be activated (the setpointis700psig). Furthermore, the LTOP system and the RHRS suction relief valve are capable of mitigating these transients. The probability of

. the failure of the RHRS relief valve coupled with failure of two trains of the LTOP system is extremely small (on the order of 3E-09). Given that the initiating event frequency for pressurizer heaters actuation is 6.32E-3/yr, I the frequency of RHRS damage from this event is roughly 1.9E-11/yr. For the decay heat addition case (loss of an RHRS cooling train) the initiator j frequency (5.37E-1/yr) coupled with failure of the RHRS relief valve and the LTOP system (3E-09) yields a frequency of RHRS damage of 1.6E-9/ year.

For the startup of an inactive reactor coolant pump with a temperature l asymmetry between the RCS and the steam generator, the peak pressure change is approximately 1500 psi and occurs in roughly 90 seconds with no relief valve L

actuation. Because the RHRS motor-operated valves closing time is l

I approximately two minutes, the RHRS would be subjected to the high pressure l* before the valve could close. This could lead to the possibility of an lf interfacing systems LOCA. However the probability of this event is small because the RHRS relief valve and the LTOP system must both fail in order for !

this event to occur. Given that the frequency for startup of an inactive loop transient is 6.95E-2/yr, the frequency of an interfa'cing systems LOCA would be i approximately 2.1E-10/yr.

From this analysis, a modification to the autoclosure interlock will have no l effect on heat input / removal transients that occur during cold shutdown.

MASS INPUT ANALYSIS In order to depict the slower mass input transients (relative to the heat input transients), event trees were utilized to model the mitigating actions that occur following the transients. Operator actions and mitigating systems are included in the event trees.

I o0s7v:lo/112186 6-11 L _ _ _ _ _ _ _ _ _ _ _ __

Event trees were constructed to determine the consequences of the mass input transients. The safety functions, i.e. the event tree top events, for the

~

event trees are defined below:

. 1. InitiatingEvent(IE): The n. ass input initiator that could lead to overpressurization and/or possible RHRS damage.

2. RHRSisolated(RI): The RHRS will be isolated during certain periods L

of shutdown. This dictates whether or not the RHRS relie' valve is available to mitigate the transient and if the possibility exists for damage to the RHRS.

3. RHRS Suction Relief Valve Lifts at P=450 psig (RV): If the RHRS is not isolated, the spring loaded relief valve will open at a pressure of approximately 450 psig. The valve is sized to relieve the combined flow of both charging pumps into the RCS at cold conditions and this prevents exceeding the RHRS design pressure.

. 4. LTOP System Operates at P=450 psig (LlP): The low temperature l overpressure protection system consists of two redundant and independent systems utilizing the pressurizer PORVs. When the system is enabled and reactor coolant temperature is below 330*F, a high pressure signal (above 450 psig) will trip the system automatically and open a PORY until the pressure drops below the reset value.

1

< Sa. RHRS Suction / Isolation Valves Automatically Close at P=700 psig (RS):

When the pressure increases to 700 psig, the autoclosure interlock receives a pressure signal that actuates the circuitry and closes the motor-operated valve. This node is addressed in the present

, configuration case only.

4 5b. Operator Detects Overpressure Alarm and Isolates the RHRS (OD): For

. the modification case, an alarm would sound when the pressure reached approximately 700 psig. Through a revision in operating procedures,

. )

l o057v.1D/11218s 6-12 )1 i

l l

it is assumed that the operator will detect the overpressure and I isolate the RHRS before the pressure reaches 150% of the RHRS design L ;. pressure.

..' 6. OperatorSecuresRunningPump(OA1): Given an alarm, either by actuation from'the RHRS relief valve opening to the pressurizer relief tank (PRT), or from the operation of at least one train of LTOP, or from an RHRS pump low flow alarm (on autoclosure of the RHRS suction valves) or from the'high pressure alarm on the RHRS suction valves (in the modification case only), the operator will stop the extra running pump (either an SI or charging pump). If the operator stops the running pump, the overpressure event is halted.

7. Operator Opens a PORV (OA2): Given an alarm, if no or one relief valve operates successfully and the pressure stili continues to rise, the operator may open a PORV .in order to reduce the pressure. The operator may also open a PORV if he fails to stop the running pump in order to increase the time available to mitigate.the transient.

8. Pressurizer Safety Relief Valve Opens at P=2485 psig (PZR): If the charging SI pump has sufficient suction head, the RCS pressure could be increased to the safety relief valve setpoint (P=2485 psig). If the charging pump is not secured then the valve will cycle open and closed.

9. RHRS Relief Valve Reseats (VR): Given that the RHRS relief valve successfully operated and the transient was terminated, the relief valve must reseat or coolant would be lost to the PRT. If the transient is not stopped, the relief valve will cycle open and closed and is assumed to eventually fail open.

10. Pressurizer PORVs Reseat (PRV): Given that one or more of the PORVs has opened and the transient has Lsen stopped, the valve must close in i S- order to avert a loss of coolant condition. If the transient is not !

. stopped, the valve (s) will cycle until failure occurs.

0057v;1D/112186 6-13

Success criteria for each event tree top event were developed and system /

l component failure probabilities were calculated for each of the nodes. The l

calculation of these probabilities is detailed in Appendix 0. The results of these calculations (i.e., the failure probabilities) for each of the nodes is

! shown in Table 6.5-2.

l The event tree sequences were classified into discrete consequence categories. Each consequence category then represents a number of individual sequences that all have similar characteristics associated with them. The consequence categories were defined by the parameters listed in Table 6.5-3.

The event trees were quantified using system / component failure probabilities along with the initiating event frequencies to determine the frequency of the consequence categories for the present configuration and the modification case. Each initiating event is discussed below.

Opening of Accumulator Discharge Isolation Valve l This event does not require an event tree analysis. The opening of an accumulator discharge isolation valve would produce a pressure peak between the initial RCS pressure and the accumulator nitrogen pressure. At cold shutdown conditions, the RCS pressure is below 450 psig. The accumulator design pressure is 700 psig and the normal operating pressure is 650 psig.

Therefore, the maximum pressure possible would be less than 650 psig. Ihis pressure would not damage the RHRS. The RHRS autoclosure interlock may close for this case but this would only occur if the RHRS relief valve and the LTOP system failed to operate. Therefore, the interlock has no effect on this transient.

Letdown Isolation /RHRS Operable The quantification of the event tree for this case is shown in Appendix D.

The consequence frequencies for most of the categories decrease or do not change. However, the frequency of a high overpressure interfacing systems

. LOCA increases from 6.54E-15/Yr to 2.28E-12/Yr. These frequencies are cor.servative because it was assumed that the operator must act within 10 0057v:1D/112186 6-14

minutes of the onset of the event, and that if he fails no other operator action would take place. Furthermore, with a mismatch between the charging

flowrate with'no letdown (maximum flowrate of 550 gpm) the pressure would not increase as quickly as some of the other transients. Another important

.' assumption is mada that the RHRS could not withstand great pressure. This is also discussed in Section 6.3. The final assumption that is conservative is that the charging pump will continue to run at its maximum flowrate against the large AP that would exist.

Letdown Isolation /RHRS Isolated This event puts the transient's overpressure effects on the RCS and not on the RHRS. Thus, the removal of the RHRS autoclosure interlock does not affect the mitigating systems available to stop the transient.

However, the initiating event itself causes this transient. Spurious closure of the isolation valves initiates the overpressure transient. If the autoclosure interlock is removed, the initiator frequency would be reduced.

," Thus it was conservatively assumed that the frequency of this transient would j be reduced by one half (from 2.34E-1/Yr to 1.17E-1/Yr). (The removal of the l interlock would essentially decrease the frequency by much more than one half. However, to account for some unknown spurious closure events, the frequency was conservatively to be reduced by one half. See additional l l

explanation in Appendix D.) The result of the reduction in initiator j frequency decreases the challet.ges to the mitigating systems in the RHRS and j reduces the frequencies of the consequences. I J

l Charging / Safety Injection Pump Actuation J

l The analysis of this transient (assuming maximum flowrates from the pumps and no letdown) in regard to removal of the autoclosure interlock showed an )

increase in the frequency of high overpressure interfacing systems LOCA from j 5.89E-15/Yr to 2.05E-12/Yr. Most of the other consequence category frequencies decreased.

0057v:1D/112186 6-15 I

I

The conservative assumptions discussed in the letdown isolation - RHRS operable case also apply in this analysis. Specifically it is doubtful that

~

, both pumps will continue to run at maximum flowrate as the pressure increases. Thus more time would be available in which the operator can

~

. mitigate the transient because the pressure would increase more slowly.

A summary of the overpressurization analysis is shown in Table 6.5-4.

6.6 Conclusions l

Based on the three areas of probabilistic analysis - the frequency of an Event V, the availability of the RHRS, and the effect on overpressure transients, the overall increase in safety due to removal of tha autoclosure interlock can be seen.

I The frequency of an interfacing systems LOCA decreased from 6.17E-7/yr to 5.76E-7/yr at power while the frequency increased from approximately 1.24E-14/yr to 4.33E-12/yr in the overpressurization analysis. Compared to l the "at power" case, the overpressurization case frequency is not as significant as the decreased frequency at power conditions.

Furthermore, the availability of the RHRS increases slightly with removal of the autoclosure interlock (from 2.28E-2 to 2.21E-2 for the long term cooling analysis). The trend in this analysis shows that the longer the RHRS is required, the more of a detriment to decay heat removal is the autoclosure interlock. Also, the loss of one power bus (due to failure or testing) will cause closure of the RHRS suction valves and failure of an inverter supplying power will cause the suction valves to fail closed in the present configuration. With removal of the interlock, these types of concerns will not be as significant.

I From a probabilistic point of view, the removal of the autoclosure interlock

. indicates an increase in safety.

h 0057v:1D/112186 6-16 I

TABLE 6.2-1 DATA

~

' FAILUEE O DE FAILUEE RATE ErATA BASE REMAELS C09DNENT

. AIR OFERATED VALVE FAILURE TO OPERATE - X-03/D 1REF ALARM FAILUFI 10 0FERAit 6E-07/H IEEE-500

$USES ALL MDDES 1.0E-06/W IEEP CHEtrVALVE FAILUEE TO 0 FEN IE-04/D 1REF CIEUlf BEAKEES SFUE1035 0 FEN- 1.0E-06/H IEEE500 CIECUlf BREAKERS FAILURE TO DPEN 2.0E 06/H IEEE-500 CIECUIT D HAKEES FAILUEE TO CLOSE 3.0E-0B/H IEEE-500 CCDESAFETYVAiVES FA!LUEE TO 0 FIN IE-05/D 1REF CODE SAFETY VALV!$ FAILUFI TD CL0SE lE-02/D 1 REP FUSES PREMTURE OPEN 3.0E-06/H IREP LIMITSWliCH CONTAti$SHORT 2.70E-08/H WASH 1400 LIMIT SWITCH FAILUEE TO OFERATE 1.0E-04/D 1REF MANUAL SWITCH FAILUFI TO TRANSFER 3E-05/D IREF FAILUEETOOFERATE 3E-07/H IREP 1 ACTUAT10N/ MON RANUAL VALVE RANUA'. VALVE FAILUEE TO OFERATE lE-04/D IREP ETOR DElVEN PUMF FAILUEETOSTART 3E-03/D IEEP M10F DRIVEN FUMF FAIL TO RUN,51VEN START 3E-05/H 1 RIP ;

M010R OFERATED VALVE FAILUEE10CLOSE 3E-03/D IREF MOTOR OFERATED VA;VI FAILUEE TO DPEN 3E-03/D IREP

- MIDF OFERATED VALVE FAIL TO REMAIN OFIN/CLOSE 1E-07/H llEF i' MDTOROFEEATELVALVE CATASTRDFHIC 1E-07/H IREP

," DVEELDAD BEEEER PEEMATUM OFEN 3.0E-06/H RATEFORAFUSE FRESSUEE TEANS"!TTER ' LOW DUTFUT 6.0E-08/H IEEE-500

- FEESSUE TEANSM! ITER ALL EDES 1.73E-06/H IEEE-500 FRESSURETRANSKITTER HISHOUTPUT 1.3E-07/H IEEE-500 RELAYS CONTACTS FAIL TO TRANSFER 1.0E-06/H EEP RELAYS ~ CONTACTS FAIL 10 TRANSFER K-04/D 1 REP RELAYS HEM OFEN CONTACTS SHORT 2.7E-08/H WNTD RELAYS M EM CLOSED CONTACTS OPEN !.2E-07/H WNTD RELAYS C0!L FAILUEE 3.0E-06/H EEP RELA)$ C0!L FAILURE M-06/H IREF RELIEF VAWES FAILUEE10CLOSE E-02/D 1REF ELIEF VALVES FAILUEE TO 0 FEN R-04/D IREF RDIARYMANUALSWITCH CONTACTS Fall DFIN 1.70E-06/H WNTD ROTAR)MANUALSW'ICH S CRi ACEDSS CONTA*TS 1.70E-06/H WNTD TEMPERATURE TRANSMITTER HISH DUTFUT 1.5E-07/H IEEE-500 TEMPERATURE TRAN!MITTEk ALL MLDES 1.7tE-06/H IEEE-500 TERFIEATUEE TFAN!M11 TEE LOW OUTFUT 6.0E-06/H IEEE-500 TOUJE ShliCH FAILUM i0 0FE8iATE 1.0E-04/D !KEF TOECUESWITCH CONTAETS SCEi 2.7E-0B/H UA!H 1400 TRAN!FDEKEES ALLICES 3.5E-07/H IEEE-500 WlE!! 0FENIIECUIT E-06/H IREF k!EES S GFi TO 6 EUN5 3E 07/H 1REF WiME E CET TO F0WEEED 3E-05/H 1REF 6-17 l

m _ _ . . . _

TABLE 6.4-1 RHRS UNAVAILABILITIES 1

Present NRC l

..' Configuration Modification Modification MOV 8701 Fails to Open 5.02E-3 5.02E-3 5.02E-3 NOV 8702 Fails to'Open 5.02E-3 5.02E-3 5.02E-3 MOVs 8701 and 8702 6.64E-5 2.22E-5 2.22E-5 4 Spuriously Close (T=72 hrs) l MOVs 8701~and 8702- 9.29E-4' 3.11E-4 3.11E-4

Spuriously Close (T=1008 hrs)

RHRS Failure During Startup 2.07E-2 2.07E-2 2.07E-2 RHRS Failure Over Short Term 7.11E-5 2.69E-5 2.69E-5 l[

l., (T=72 hrs)

RHRS Failure Over Long Term 2.01E-3 1.39E-3 1.39E-3

! (T=1008 hrs) l Total RHRS Unavailability 2.08E-2 2.07E-2 2.07E-2 Over Short Term Total RHRS Unavailability 2.2aE-2 2.21E-2 2.21E-2 Over Long Term l

0057v:1D/112186 6-18

1 I s L

TABLE 6.5-1 OVERPRESSURIZATION INITIATOR FREQUENCIES l -' ." . Initiating Event Frequency (Per Reactor Year)

.. 1.0' PREMATURE OPENING OF RHRS Not Analyzed '

2.0 ROD WITHDRAWAL Not Analyzed 23.0 HEAT INPUT / REMOVAL 3.1 Failure to Isolate RHR Not Analyzed During Startup-

~3.2 Pressurizer Heaters Actuation 6.32E-3 3.3: Startup of Inactive RCS Loop 6.95E-2 3.4 -Loss of RHRS Cooling Train 5.37E-1 4.0 MASS INPUT / LETDOWN 4.1 Opening of Accumulator Discharge 1.89E-2 Isolation Valve 4.2 -Letdown Isolation 4.2.1 RHRS Operable 1.01E-1 4.2.2 RHRS Isolated (Present) . 2.34E-1 (Modification) 1.17E-1

'4.3 Charging / Safety Injection Pump 9.72E-3

Actuation l

.{

o 0057v:1D/112186 6-19

a A

' TABLE 6.5-2 NODAL SYSTEM / COMPONENT FAILURE PROBABILITIES Node -Conditions Failure Probability RI Charging Pump Tree 0.9 Letdown-RHRS Operable Tree 1.0 Letdown-RHRS' Isolated Tree 0.0 RV 3.0E-4 i:

LTP One Train Fails 7.71E-3

~Two Trains Fail 1.50E-5

.RS Present. Configuration Only 1.44E-5 OD Modification Cases Only 20 minutes action time 5.25E

10 minutes action time 5.02E-3 0A1 0.217 OA2 Given Success of Previous Task 0.21 Given Failure of Previous Task 0.36 PZR 1.0E-15 VR 3.0E-2 PRV Given One PORV Opens 3E-3 Given Two PORVS Open 6E-3 c

t 0057v:1D/112186 6-20 m_____

. j ';

TABLE 6.5-3 DESCRIPTION OF CONSEQUENCE CATEGORIES Identifier Description H .'High Pressure Transient (P>2485 psig)

M Medium Pressure Transient (450<P<2485)

L Low Pressure Transient (P<450 psig)

L -SF Small finite inss of coolant (<1000 gpm)-

LF Large finite loss of coolant (>1000 gpm)

SC Small continuous loss of coolant (<1000 gpm)

LC Large continuous loss of coolant (>1000 gpm)

OP- Overpressure I RHRS Isolated 0 RHRS Open V Interfacing Systems LOCA h

.a 0057v:1o/112186 6-21

TABLE 6.5-4

SUMMARY

OF OVERPRESSURIZATION ANALYSIS

~

, Initiating Initiating Event Effect of Removal Event Frequency (Per Yr) of Autoclosure Interlock

~

. 1. Premature Opening (None to Date) No effect. The prevent-open interlock is of of RHRS importance in this case, not the autoclose interlock.

2. Rod Withdrawal (None to Date) No effect. A small increase in temperature is expected but this increase would not affect the RHRS.

3. Failure to Isolate Not Analyzed This transient is described in Section 6.3.

RHRS During Startup However, the RHRS relief valve's operation would stop further increases in pressure.

1. Pressurizer 6.32E-3 This transient causes a slow rise in pressure.

Heaters Actuation The relief valves are available to mitigate the transient. Pressurizer heaters would automatically shutoff. No effect.

5. Startup of an 6.95E-2 No effect. The rise in pressure is too quick Inactive Loop for the slow closing isolation valves.

6. Loss of RHR 5.37E-1 No effect. The rise in pressure from decay Cooling Train heat is slow which would give the operator more time to react.

7. Opening of 1.89E-2 No effect. Mass would be input from the Accumulator Discharge accumulator until the RCS and accumulator Isolation Valves pressure equal. Accumulator pressure would not exceed 700 psig.

s O

ooS7v:1o/112186 6-22

f

' TABLE 6.5-4 (Cont)

SUMMARY

.0F.OVERPRESSURIZATION ANALYSIS Initiating Initiating Event Effect.of Removal

... Event Frequency (Per Yr) of Autoclosure Interlock-

8. Letdown Isolation- 1.01E Increases frequency of high overpressure

.RHRS Operable. . interfacing systems LOCA from 6.5E-15/Yr to 2.28E-12/Yr. Decreases other types of consequences.

9. Letdown Isolation .2.34E-1(Present) Decreases frequency of.all consequences due to RHRS Isolated 1.17E-1(Modifi- decrease in letdown isolation from inadvertent cation) ' closure of isolation valves.

10. Charging / Safety 1.01E-1 Increases frequency of high overpressure Injection Pump . interfacing systems LOCA from 5.89E-15/Yr to

/ Actuation 2.05E-12/Yr. Decreases other types of

[ consequences.

1 =

O

,e 0057v:1D/112186 6-23 i

L 1-- __ __-_z_______ j

L--

L l l l

. 1 l

1 1

4--

8701 8702 l N N 1

__ __ 1 i BE25 l r r ,

\ toc kF ,

i {

_e RCS b 113BE25

+

q l

i 1

l l

1 FIGURE 6.3-1 j

RHRSuctionValveArrangement i

.- l 6-24

1600 .

L -

RCS/SG AT = 50'F 4 .l 1400 . .

1200 1000 -

S E

E 800 , , t

. E -

5 ,

g ?

a )

0 600 - - l g j e

E i I

400 <,

LOOP SEAL AT = 120'F 200 , ,

DECAY HEAT ADDITION IZER HEATERS 20 40 60 80 200 ,

l TIME SEC '

Figure 6.5-1 Typical Heat Input Transients No Relief Valve Actuation 6-25

7.0 CONCLUSION

S

~~

, .This section outlines the conclusions reached from the analysis. The conclusions address the NRC concerns expressed in Reference 5.

1. MEANS AVAILABLE TO MINIMIZE A LOCA OUTSIDE THE CONTAINMENT I 1 l l

The two motor operated valves serve as the primary Reactor Coolant System pressure boundary. They are remote operated, and are powered by separate electrical sources. Therefore, the capability of this set of. valves to l isolate the Residual Heat Removal System is very reliable. Plant operating i procedures instruct the operator to isolate the RHRS during plant heatup, so the likelihood of these valves being left open is remote. Therefore, during normal heatup and cooldown operations,' redundant valves and operator action are adequate to insure RHRS isolation.

Should a pressure peak occur in the RCS, the pressure would not be imparted to the low pressure portion of the RHRS, since a relief valve (900 gpm/450 psig)

~

protects the low pressure system. This relief valve discharges inside containment to the pressurizer relief tank (PRT). A discharge would be detected by high temperature, level, and pressure alarms in the PP.T.

It would be noted that there are Technical Specification surveillance requirements applicable to these valves.

The frequency of an interfacing systems LOCA is reduced from 6.17E-7/yr for the case with the autoclosure interlock to 5.76E-7/yr for the case with j removal of the ACI and addition of an alarm. j

2. ALARMS TO ALERT THE OPERATOR OF AN IMPROPERLY POSITIONED RHRS ISOLATION l W

VALVE

,- -Each isolation val"- has its position indicated on the main control board at c its control switch. In addition, should both valves not be closed when RCS

,- pressure is above RHRS pressure, the relief valve would actuate, resulting in I

i 0057v:1D/112186 7-1 j f

t PRT pressure, level and temperature alarms. Also the RHRS contains pressure alarms _which actuate as the pressure approaches the RHRS design pressure.

', Additional alarms will be implemented to provide indication of an isolation r valve being open when RCS pressure exceeds a pre-determined value. The

.' proposed Westinghouse design change incorporates additional alarms in the control room to alert the operator of valve position when the RCS pressure-reaches a given pressure.

3 ', VERIFICATION OF THE ADEQUACY OF RHRS RELIEF VALVE CAPACITY t

In support of RESAR-3 and_RESAR-41 applications, Westinghouse performed several analyses that demonstrated that the relief valve does protect the RHRS from overpressure. These analyses were reviewed, and their applicability to the Diablo Canyon Power Plant was verified as a'part of this program.

4.- MEANS OTHER THAN AUTO-CLOSE INTERLOCKS TO ENSURE BOTH ISOLATION VALVES ARE ;

CLOSED (E.G. SINGLE SWITCH ACTUATING BOTH VALVES)

, Operating instructions, along with redundant position indication and alarms, are sufficient to insure isolation.

Furthermore the alarm which would actuate given a high pressure signal and either isolation valve open would indicate the position of the valves along with the indicating lights.

l A single switch to close both valves alone would not provide adequate assurance that the valves would be closed. An alarm would also have to be '

installed. However it is believed that the location of the hand switches (for both valves) near each other on the MCB is sufficient to ensure timely operator actions.

5. ASSURANCE THAT THE OPEN PERMISSIVE CIRCUITRY IS NEITHER REMOVED OR

,. AFFECTED BY THE PROPOSED CHANGE

_,- - The Westinghouse design leaves the open permissive circuit intact.

l 0057v:1D/112186 7-2

i i

/

I

6. ASSURANCE THAT ISOLATION VALVE POSITION INDICATION WILL REMAIN AVAILABLE IN THE CONTROL ROOM REGARDLESS OF THE PROPOSED CHANGE The Westinghouse design leaves the valve position indication at the main

. control board intact. This indication will be by two means (i) continuous valve position indication (MCB status lights)

(ii) absence of the alarms provided with the autoclose interlock removal.

7. ASSESSMENT OF THE EFFECT OF THE PROPOSED CHANGE ON RHRS AVAILABILITY, AS WELL AS LOW TEMPERATURE OVERPRESSURE PROTECTION This change will increase the availability of the RHRS relief valve to mitigate low temperature overpressure occurrences, thereby reducing challenges to the power operated relief valves, and keeping RCS pressure at cold temperatures in an acceptable range with respect to Appendix G limits.

The probabilistic analysis of the reliability of the RHRS showed that the

[ availability slightly increased with the deletion of the autoclosure interlock.

Several overpressure transients were modeled to show system and operator response to these transients. An increase in the frequency of a LOCA at shutdown conditions was found. However the relative magnitude of the resulting frequency is insignificant compared to the frequency at power conditions.

f Based on the answers provided to the above concerns, removal of the j autoclosure interlock along with implementation of the recommended I modification results in a net improvement in safety.

l 0057v:1D/112186 7-3 ,

l l

8.0' REFERENCES !

I l

~, 1. U.S. Nuclear Regulatory Commission, Office for Analysis and Evaluation of '

Operational Data, Case Study Report AE0D/C503 " Decay Heat Removal Problems

. at U.S. Pressurized Water Reactors," December 1985. 1 l

1

2. Nuc1 car Safety Analysis Center / Electric Power Research Institute, l

" Residual Heat Removal Experience, Review and Safety Analysis, Pressurized I Water Reactors," NSAC-52, January 1983.

3. D. R. Gallup, D. M. Kunsman, M. P. Bohn, Sandia National Laboratories,

" Potential Benefits Obtained by Requiring Safety-Grade Cold Shutdown Systems," USNRC Report NUREG/CR-4335, November 1985.

4. Memorandum from H. R. Denton, NRC to R. M. Bernero, " Schedule for -

Resolving and Completing Generic Issue No. 99--RCS/RHRS Suction Line j Interlocks on PWRs," August 13, 1985.

l

5. Memorandum from B. W. Sheron, NRC to RSB members, " Auto Closure Interlocks

[

for PWR Residual Heat Removal (RHR) Systems," January 28, 1985.

6. Westinghouse letter, R. I. Hayford to J. D. McAdoo,

Subject:

AEC Concerns for Administrative Positioning for Critical Valves, E-EPS-596, August 24, 1971.

7. Northern States Power Company letter, L. O. Mayer to J. F. O' Leary (AEC),

Subject:

Exceeding Allowed Pressure-Temperature Limit During Startup Testing, Docket 50-282, November 9, 1973.

8. Westinghouse letter, R. W. Fleming,

Subject:

Reactor Coolant Pressure Control, F11H2-S0-76, March 7, 1974.

9. Westinghouse Trip Report, D. W. Williams,

Subject:

Mecting with AEC on

. Residual Heat Removal (RHR) System Valve Interlocks - March 21, 1974,

. NS-RPE-81, March 25, 1974.

0057v:1D/112186 8-1

10. Atomic Energy Commission staff memorandum, G. R. Mazetis, to T. M. Novak,

Subject:

. Summary of Meeting with PWR Vendors, April 9, 1974.

L ,.1 11.' Atomic Energy Commission letter, T. M. Novak to Reactor Systems Branch l

.' Personnel,

Subject:

Shutdown Cooling System Requirements, November 27, 1974.'

This_ letter imposed the AEC position identified in an AEC maeting of February 13, 1974 and documented in:

Atomic. Energy Commission staff memorandum,'J. Angelo,

Subject:

RP-TR Staff Meeting of February 13, 1974 Regarding the Requirements on Shutdown >

Cooling System Designs, February 28, 1974.

12. " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," NUREG-75/087, Branch Technical Position ICSB-3,

~

September 1975.

[ 13. Wisconsin Public Service Corporation. letter, E. W. James to J. F. O' Leary

.(AEC),

Subject:

Abnormal Occurrence Report, Docket 50-305, October 4, 1974.

14. " Safety Evaluation .7eport by the Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, in the Matter of Westinghouse Electric Company Reference Safety Analysis Report RESAR-41, Docket No. STN 50-480,"

NUREG-75/103, December 31, 1975, pp 5-17 to 5-19, 7-15, 7-16, and Appendix C.

15. Advisory Committee on Reactor Safeguards letter, D. W. Moeller, Chairman to M. A. Rowden (Chairman NRC),

Subject:

Report on Westinghouse Electric Corporation Reference Safety Analysis Report, RESAR-35, July 14, 1976. r l

l

16. Westinghouse Nuclear Service Division Technical Bulletin,

Subject:

l 4 Residual Heat Removal Pump, NSD-TB-77-7, Pittsburgh, Pennsylvania,

_;- July 15, 1977.

)!

0057v:1o/112186 8-2 j l

i

)

l 1

-17. " Staff Discussion of Fifteen Technical Issues listed in attachment to November 3, 1976 memorandum from Director, NRR, to NRR Staff," NUREG-0138, l

.", U.S. Nuclear Regulatory Commission, November 1976, Issue 15.

.' 18. Casto, William R., " Reactor-Vessel Pressure Transients," Nuclear Safety, Vol.18, No. 4, July-August 1977, pp 513-519.

19. Nuclear Regulatory Commission letter, R. W. Reid to R.'H. Grace (Yankee j Atomic' Electric Company), Docket 50-309, August 22, 1977.

20. .American National Standard, " Overpressure Protection of Low Pressure Systems Connected to the Reactor Coolant Pressure Boundary," j ANSI /ANS-56;3-1977, American Nuclear Society, LaGrange Park, Illinois, April 7, 1977.

'21. Haried, J. A., " Evaluation of Events Involving Decay Heat Removal Systems in Nuclear Power Plants," NUREG/CR-2799 (0RNL/NSIC-209), Oak Ridge Netional Laboratory, Oak Ridge, Tennessee, July 1982.

22. Nuclear Regulatory Commission Memorandum, to R. Mattson, "RHRS Interlocks for Westinghouse Plants," April 17, 1984.

2

23. AE00 Case Study Report, Low Temperature Overpressure Events at Turkey Point Unit 4, March 1984. '

24. NSAC/84, Zion Nuclear Plant Residual Heat Removal PRA, Pickard, Lowe and Garrick, Inc., July 1985.

25. WCAP-10529, COMS - Cold Overpressure Mitigating System, R. W. Fleming, February, 1984.

26. WCAP-9540, Results of Analysis for Pressure Mitigation of RCS Cold

. Overpressurization Transients in 412 and 312 Plants, A. M. Sklencar, July

. -1979.

0057v:1o/112186 8-3

l

27. NUREG/CR-1278, Handbook of.. Human-Reliability Analysis with Emphasis on

. Nuclear. Power Plant. Applications, A. D. Swain, H. E. Guttmann, August 1983.

t.. .

28i Diablo' Canyon Updat'd e FSAR. !

9 29.~Diablo Canyon Technical Specifications.

30. Diablo. Canyon Operating Procedures.

OP L-5 REV. 6 9/03/84.

OP B-2:V REV. 2 8/31/84.

OP B-2:IV REV. 2 8/31/84. l l

I i

I t

.e .

l c

l

\

0057v:1D/112186 8-4 l

4 APPENDIX A OVERVIEW OF FAULT TREE AND EVENT TREE QUANTIFICATION l

.. l I

0058v:1D/112486 {

t l

l

+

3

~

APPENDIX A

> l i

I h* OVERVIEW 0F FAULT TREE AND EVENT. TREE QUANTIFICATION b

I.'f This' appendix provides an overview of how fault trees and event trees are quantified. The first section explains fault trees while the middle section

. describes event trees and the final section summarizes the computer codes. used' intheanalhsis.

A.1 Fault Trees, i

A fault-tree' analysis can be simply' described as an analy'tical technique, i

q. whereby.anLundesired state of the system is specified (usually a state that is

>< critical from 'a ' safety standpoint),land the system is: then analyzed in the i context of'its environment and operation to find all credible ways in which.

~

k 'the undesired event can occur. The fault tree itself is a graphic model of-

'the various parallel and sequential combinations of faults that will result in i 'the occurrence of the' predefined undesired event. The faults can be events

[' .that are associated with compo'nent hardware failures, human errors, or any-other: pertinent events that can lead to the undesired event. A fault tree

.thus depicts the logical interrelationships of basic events that' lead to the i

. undesired event--which is the top event of the fault tree, j J

It is important:to; understand that a' fault tree is not a model of all possible

. system failures or all possible causes for system failure. A fault tree-is-tailored to its top event which . corresponds to sone particular system failure mode, and the fault-tree thus includes-only those faults that contribute to

-this top event. 'Moreover, these faults are not exhaustive--they cover only the.most credible faults'as assessed by the analyst.

It is also important to point out that a fault tree is not in itself a quantitative model.. It is a qualitative model that can be evaluated quantitatively and often is. This qualitative aspect, of course, is true of q

,.7

virtu' ally all: varieties of system models. The fact that a fault tree is a y particularly convenient model to quantify does not change the qualitative nature of the model itself.

0058v:1D/112486 A-1 l

1

_ M._ _ z _ n i _

A fault tree is a complex of entities known as " gates" which serve to permit or inhibit the passage of fault logic up the tree. The gates show the relationships of events needed for the occurrence of a " higher" event. The

" higher" event is.the " output" of the gate; the " lower" events are the

," " inputs" to the. gate. The gate symbol denotes the type of relationship of the input events required for the output event. Thus, gates are somewhat analogous to switches in an electrical circuit or two valves in a piping layout. Figure A-1 shows the type of gates commonly used in fault tree analyses.

I I

The basic events identified in the fault trees are divided into four l categories: 1) hardware failure unavailability 2) maintenance outage unavailability, 3) test outage contribution and 4) human error probability. 1 The sections below describe these four categories.

A.1.1 Hardware Failure Unavailability In fault tree development two types of contribution to component average

," unavailability are considered:

o Hardware Failure o Hardware Outages The hardware failure contribution arises because the component may fail prior to or during its operation. The outage contribution arises when the component is removed from operation for testing, preventative maintenance, and/or repair.

Two important considerations are made when evaluating component failure I contribution. The component may be operating or it may be in a standby mode.

If the component is part of a standby system, the average unavailability is estimated using either a time-based failure rate or a demand failure probability for the component failure modes being assessed.

1 A time-based failure rate is applicable when the failure mechanism causing the failure mode is related to the time the component is in service between checks i l

0058v:1D/112486 A-2

L I

of its operability.. The time between tests is thus an important part of the unavailability calculations for such component failure' modes. A demand I". failure probability is appropriate for component failure modes that do not l depend on the test period length, but rather are related to the number of ;

. times that the component is " demanded" to operate. The length of test period is irrelevant for a component whose failure mode is truly demand dependent.

The component average unavailability using a time-based failure is given by the expression:

I o,c = 1/2 is TT (I) i 1

where qc is the component average unavailability, Xs is the standby ,

failure rate (failures per hour), and T Tis the length of time between tests (hours). An estimate obtained using this expression is adequate assuming an exponential failure distribution and if the product of ITT < 0.1.

l The demand failure probability is given directly by the data base and thus:

.' 4e " qd (2) with qcdefined as before and gd is the demand failure probability.

l A more appropriate model for calculation of the unavailability of components !

'in standby assumes that such components have both time-dependent and demand failure contributions given by:

qc *Ad + 1/2 is TT (3) )

I 1

with the parameters qc ' Ad , is and TT are as previously defined. Data is unally not available to estimate both the time-dependent and demand related portion of component unavailabilities.

. When a component test period is relatively small(e.g., on the order of three

- months or less) either expression (1) or expression (2) may be used to

.- estimate the unavailability of standby components without introducing !

sufficient error in the results obtained in fault tree quantification.

0058v:1D/112486 A-3 1

P The calculation model to compute the unavailability (unreliability) of non-repairable components in operating system is given by the expression:

q'*l T '- (4)

, c oM

.with .cq as previously defined, 1,is the. operating failure rate

-(failuresperhour)andT Mis the total defined mission time. Again, the

- expression is adequate assuming-an exponential failure distribution and if the product of 1, Tg 5,0.1 In standby safety related systems, components once actuated may fail to perform for.the desired mission time (e.g., a pump fails to start and run for a desired time).- The una.";1 ability calculation model for such components is given as:

4c *Ad+A o Tg (5) or

, qc = 1/2 is TT+loTM .(6) with each parameter for both of the above expressions as previously defined.

L The selection of which expression to use for the quantification being performed is dependent on the type of data given by the selected data bank being used. Depending on a particular component's operating failure rate and total mission time used, the last term of expression (5) may be dropped from being considered as.the calculated operating failure probability may be much less than~the component's demand failure probability.

A.1.2 Maintenance Outage Unavailability i- As stated previously, component outages can occur when components are removed from service for test, preventative maintenance, and/or repair. These stre

- generally classified as:

0058v:1o/112486 A-4 L

i o Scheduled outages resulting from periodic tests and scheduled preventative maintenance.

o Unscheduled outages resulting from a need to repair a failed component.

Scheduled preventative maintenance may be performed by some utilities on major safeguards equipment during normal plant operation. When scheduled preventative maintenance removes a component from service, then a scheduled maintenance outage contribution to component unavailability occurs.

Unscheduled outage occurs when a component fails and is in need of repair to continue system operation. For standby component, this usually happens during a periodic test when a component is discovered to be in a failed state.

Often repair ensues when a component is found to be degraded but operable (i.e., leaky pump and valves seals, excessive back leakage through check l valves, etc.) as well as when a catastrophic type failure occurs. Thus the frequency with which unscheduled repair occurs should be as least as large as

'," the component's failure rate, which in many reported data banks, includes only catastrophic failures.

The unscheduled repair (maintenance) outage contribution to component unavailability due to failure detected during test is given by the expression:

ARM

IR (TR /TT) U) where qRM is the component unavailability due to unscheduled repair, fR is the frequency (per test period) with which repair is expected to occur, tR is the mean component repair time (hours) andT T is the test period. {

The scheduled preventative maintenance outage contribution to component J l

unavailability for point value computation is estimated by:

4y*fM 3 (*M/T) T (0) l 0058v:10/112486 A-5

)

where q3g is the component unavailability due to scheduled maintenance, fM is the frequency (per test period) with which scheduled maintenance occurs,

, t M is the mean component outage time for scheduled maintenance, and TT is the test period.

- ]

i In both of the above expressions (i.e. 7 and 8) since qRM and qSM am '

probability values all of the parameters on the rlght hand side of the expressions must be compatible and cancel out so that respective 'q" values obtained are dimensionless. For instance, for monthly testing, if the test period (TT ) is expressed in hours per month, the repair duration (tR) is in hours, and f Ris the reciprocal of the number of months between repair acts, then qRM is dimensionless.

The mean component repair time (tR) is used to compute repair outage unavailabilities for failed components detected during scheduled tests. The mean value selected should be in accordance with a plant's technical specification outage limit.

,' The frequency (f R

) per test period with which repair is expected to occur is abstracted from the Zion PRA Study and is assumed typical for PWR plants.

Test period related with the data covers monthly and quarterly testing and the data presented is given as events per hour. Therefore QRM can be directly calculated using the data by the expression:

gg (Events /Hr)(tR I (9)

A.I.3 . Test Outage Contribution Most testing of safeguards equipment during normal plant operation will not prevent such equipment from carrying out its intended safety function if an accident happens while the equipment is undergoing testing in accordance with l the plant's technical specification. If a test procedure results in a compc ant being removed from active service for all or a portion of a test,

- then a test outage occurs. The unavailability of a component due to testing

. is given by the expression:

qt * *t/T T (10) 0058v;1D/11248* A-6

I l where gt is the average unavailability from the test outage,t i is the average duration of test (hours) and TT is the interval between test in l . hours. This data can be extrected from the Technical Specifications. !

. A.1.4 Human Error Probability l Both event tree and fault tree modeling presented consider operator error as an input parameter. Considerable work has been done by Swain, Bell, and Guttman to develop techniques and procedures for conducting human error l reliability analysis. Their work along with examples is documented in NUREG/CR-1278, " Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications". This document will be used to establish the methodology for the quantification of human errors as required for event and fault tree quantification. Brief summaries of selected task of human reliability analysis are given in the paragraphs that follow. .

A task analysis of each task operator contributing to an event tree sequence and/or system unavailability quantification using fault trees is to be

,' performed. This forms the basis for the development of human reliability

. analysis probability trees. Tasks given by emergency operating procedures, test procedures, and maintenance procedures are formally broken down into smaller units (steps) of human behavior. These individual units of performance constituto elements of behavior for which potential errors can be identified. A task analysis table is prepared based on analysis of tasks.

The format of the table is not important, however, the table should contain all information pertinent to required task (i.e. equipment on which action is performed, the required action by operator, limits of his performance, location of controls, etc.). The details in task analysis and the amount of information recorded are used to obtain human error probability (HEP) estimates used at a later time in the analysis quantification of human errors.

Once the breakdown of tasks steps are completed, errors likely to be made by the operator are identified for each step. The steps are listed in chronologically order. Based on the actual performance situation, the analyst

.- determines which types of error the operator is likely to make and which he is 00SBv:10/112486 . A-7

i l

not. Errors of commission and omission are to be considered. Extreme care should be exercised in deciding which errors, if any, are to be discounted, j

, Rather than discounting a " questionable" error the analyst thinks unlikely, it l should be included in the analysis. j

= !

Human reliability analysis (HRA) probability trees are then developed for each task identified by accident event trees and system fault trees. In the development of the HRA probability tree, each likely error defined in the task !

analysis is entered as the right limb in a binary branch of the tree.

Chronologically, in the order of their potential occurrence, the resultant branches of errors form the limb of the HRA tree, with the first potential error starting at the highest point of the tree.

Any given task appears as a two-limb branch of a HRA probability tree, with each left limb representing the probat,ility of success and each right limb that of failure. Once a task is diagrammed as having been completed successfully (or unsuccessfully) another task is considered. The binary branch describing the probability of the success (or failure) of the second j task extends from the left (or right) limb of the first branch. This process '

is repeated until all tasks are included in the development of the HRA tree.

When completed, every limb of the tree following the initial branching will depict a conditional probability.

A HRA probability tree is quantified by assigning nominal human error probabilities to each task limb on the tree. Error probabilities assigned are obtained from Chapter 20 of NUREG/CR-1278. To use the values given by Chapter 20, the analyst categorizes all tasks based upon the operator manipulating valves, performing a check of another operator's work, using a written procedure, or attempting some other type of task. Values are then selected from Chapter 20 that most closely approximates the description of a task being considered. In some cases the description on Chapter 20 will detail a scenario only slightly different from the one in analysis, thus the analyst can use the Chapter 20 values for the scenario as is in knowing that the

- difference between the scenario being analyzed from that of Chapter 20 will

,. not materially affect anal .;is results. In other cases, the actual situation oD58v:1D/112486 A-8

l

'and the one described in Chapter 20 may reflect tasks that are basically the same but are performed under different circumstances (e.g., operator. stress

~

. level, available operators etc.). For such cases the human error probability must then be modified to reflect the conditions under which the task is I actually being performed. This is usually done during the assessment of the l performance shaping factors acting on the task as detailed in NUREG/CR-1278.

Once. human error probability values are assigned to each task limb of a HRA tree,-the uncesilability of an operator to perform a particular procedure can be obtained by summing the conditior.a1 failure probabilities of failed branches representing failed tasks associated with the procedure.

A.1.5- Fault Tree Component Identification Codes Table A.1-1 describes the coding system used in the fault tree analysis to identify components, trains and failure modes.

A.2 Overview of Event Tree Quantification

.; Event trees are inductive logic methods for identifying the various possible outcomes of a given initiating event. In risk analysis applications, the initiating evcut of an event tree is typically a system failure, and the subsequent events are determined by the system characteristics.

An event tree begins with a definsa accident-initiating event. This event could arise from failure of a system component, or it could be initiated externally to the system. Different event trees must be constructed and evaluated to analyze a set of accidents. 1 Once an initiating event is defined, all the safety systems that can be utilized after the accident must be defined and identified. These safety systems are then structured in the form of headings for the event tree.

' 0058v:1o/112486 A-9 t

)

l l

Once the systems for a given initiating event have been identified, the sat of possible failure and success states for each system must be defined and l enumerated. Careful effort is required in defining success and failure states for the systems to ensure that potential failure states are not included in )

. the success definitions; much of this analysis is done using fault tree l'

technique.

Once the system failure and success states have been properly defined the states are then combined through the decision-tree branching logic to obtain the various accident sequences that are associated with the given initiating event. The initiating event is depicted by the initial horizontal line and the system states are then connected in a stepwise, branching fashion; system suucess and failure states have been denoted by S and F, respectively. The format follows the standard tree structure characteristic of event tree methodology, although sometimes the fault states are located above the success states.

The accident sequences that results from the structure are shown in the last column. Each branch of the tree yields one particular accident sequence. The system states on a given branch of the event tree are conditional on the previous states having already occurred.

Once the final event tree has been constructed so that the results associated with each accident sequence have been defined, the final task is to compute the probabilities of system failure. Fault tree analyses are used to calculate the conditional probabilities needed for each branch of the event tree. Multiplication of the conditional probabilities for each branch in a sequence gives the probability of that sequence. (

Reference:

McCormick, Norman J., Reliability and Risk Analysis, Academic Press, New York, 1981.)

A.3 Computer Codes I

This section describes the compt '-* codes used in the analysis. The codes i* used in fault tree analysis (WESa i, SIMON 2 and GRAFTER 2) are presented

. followed by the event tree codes (SUPER 3).

l

\

0058v:1D/112486 A-10 l 4 L- _ .

A.3.1 GRAFTER 2

'; GRAFTER 2 is a computer code written in FORTRAN and ASSEMBLER languages to construct fault trees interactivity on an IBM-XT or an IBM-AT computer. It is

. used in conjunction with the SIMON 2 and WESCUT codes to carry out fault tree

. analysis from construction stage, to data base management, then to quantification.

-The GRAFTER 2 code can be used to construct, store, update and print fault trees interactively. The code can construct fault trees containing up to 2064 boxes (gateorbasicevent). A menu of commands is provided to construct the faults trees. Computer keyboard is used to move to different locations of the fault tree.

A.3.2 WESCUT WESCUT is a computer code written in FORTRAN 77 to run on an IBM-PC model AT or XT. It identifies the minimal cutsets of a fault tree. It also quantifies the mean failure probability and variance of the top event and other specified

] lowerievelevents.

1 For each gate specified in the input for cutset identification, the code identifies and prints out the cutsets. The cutsets are listed in order of decreasing probability. The mean probability and variance for the gate is also. calculated and is printed.

A.3.3 SIMON 2 SIMON 2 is a computer code written in FORTRAN to be run on IBM-XT or an IBM-AT computer to support the fault tree analysis done by the GRAFTER 2 code. Three major objectives are defined for the implementation of the code:

l l

L, 1. To minimize hand calculations and data entry that go into fault tree f analysis.

l .. ,

l I

0058v:1D/112486 A-11

2. Provide tables for documentation.

~

, 3. Improve' quality assurance by providing a master data file for all the fault trees needed for a given project.

SIMON 2 calculates and tabulates basic event failure probabilities and variances. If requested, these probabilities and variances can also be placed in a GRAFTER 2 fault tree (to be referred to as a " GRAFTER 2 database")

generated by GRAFTEP,2.

A.3.4 SUPER 3 i

SUPER 3 is a code for event tree analysis using an IBM-XT or AT computer. The code will draw an event tree or draw and quantify an event tree. In addition, !

the code will run a series of quantifications of a single event tree using ;

alternate event probabilities if required for sensitivity or other studies.

i The code can be used to construct and quantify an event tree with a maximum of 25 nodes and with up to 10 branches for each event node. The event tree is further limited to a total of 650 branches. The event tree may be repeatedly recalculated with multiple set of probability values for the purpose of conducting sensitivity or other studies.

Output includes or may include the event tree picture, accident sequence number, number of failures, sequence pathname, sequence probability, sequence frequency and sequence category, consequence category, consequence probability and consequence frequency and, finally, the event tree frequency (sum of the consequence frequencies).

The code can present the output information in any of several formats selected to suit user needs.

S 0058v:1D/112486 A-12 j l

_. _--_ __ a

g j TABLE A.1-1 FAULT TREE COMPONENT IDENTIFICATION CODES

+

Nine or ten character codes identify component failures in the fault trees. q

.. 1 The format of component failures in the fault trees is STCCCXXXXF where:

S:is the system identification code.

T is the identification of the train to which the component belongs.

CCC is the component type identification code. !

XXXX is the number designating the single component in the P& ids.

F is the specific component failure.

The following lists the codes used in this evaluation.

COMPONENT IDENTIFICATION CODE ,

Code Letters Component Identification System R Residual Heat Removal System Train 1 Train #1 2 Train #2 Mechanical Components

~

.* HE Heat Exchanger

,-- PV Pressure Vessel PM Motor Driven Pump oosev:1o/it24ss A-13

TABLE A.1-1 (Cont)

COMPONENT IDENTIFICATION CODE Code Letters Component Identification CV Valve, Check HV Valve, Hydraulic Operated AV Valve, Air (Pneumatic) Operated LS Limit Switch LO Lockout Relay or Switch SW Manual Switch (Pushbutton)

SR Manual Switch (Rotary)

M0 Motor MS Motor Starter RE Relay RL Relay (Latching Type)

CN Relay or Switch Contact QS Switch, Torque OL Thermal Overload Element

. XY Valve, Manual MV Valve, Motor Operated AV Valve, Relief Pneumatic or Hydraulic Operated AS Valve, Relief Solenoid Operated SV Valve, Solenoid Operated Electrical Components CB Circuit Breaker CS Control Switch I CO Coil FU Fuse CT Transformer, Current !

TP Transmitter, Pressure l

TT Transmitter, Temperature I

.- TE RTD Temperature Element 0058v:1D/112486 f.-14 l

_0

t'-

TABLEA.1-1-(Cont)

FAILURE MODE IDENTIFICATION CODE Code Letters Failure Mode A Does Not S' tart B Open. Circuit

C , Closed D Does Not Open-

-F Loss of Function (Does not operate / start /run) !

I' Interference .i J Degraded

'K Does Not Close

-l M Maintenance N No Input 0 Open P- Plugged Q Short Circuit R . Rupture S Short to Ground 4

.T Test U. Spurious Opening V Spurious Closing X Does Not Run H Fails High L Fails Low VS Visual Detection

__ ST Status Light DE Operator Error TST Test MAIN Maintenance l-0058v:10/112486 A-15 i.. . _ . . . . . : .....m_ . .. .... .._.. . _ . . . . _ . . . . . _ . . . . . . . _ . _ . . . _ . . _ . . . . _ _ . . . . . . . . . _ . . _ . . . _ . . . . . . . . . . _ . . . -

i p, .

I l' y3 yg fx

. 1 ,

.l 1 i i1 man un

"" '^" am aan ano an Anu NW-t

==> aan "'/ j',' !

/ h f b i

- .I i .i : , , 3 i,

.an . un N SATI Enne:mattet sa?I emomu \, /

") =

/,,,,

O.

-m - .,

a:::::::\;;

nn "I I'E* Themarge 3s 3,gg:;

Bt BAAAME M

{

Tt e 44asu4attaa I

l::

/a enn,e mn mn ,,.:s na..rs .n ...:,

Figure A-1 .

i Basic Fault Tree Symbols ;

I A-16

i

\ \

l 1 i

i a l APPENDIX B EVENT V ANALYSIS i

i 0058v:1D/112486

APPENDIX B EVENT V ANALYSIS The frequency of an interfacing systema LOCA is an important safety concern

, ' because a direct release of radionuclides to the atmosphere may occur. In this appendix, the frequency of an event via the RHR suction path is calculated for three cases: 1) with the present interlock configuration, 2) with the proposed modification, and 3) with the NRC proposed modification.

The failure combinations considered in the analysis involve: 1) rupture of two series motor-operated valves and 2) one valve failing open and subsequent rupture of the other valve.

The following conditions were applied in the analysis:

1. The frequency of valve rupture is that of catastrophic internal leakage.

The' failure rate X is the same for either valve given that the valve is exposed to RCS pressure.

2. Valve 8702 is at RCS pressure and valve 8701 is at RCS pressure only if valve 8702 fails open.

3. No common cause rupture of the valves is considered. This is based on the l fact that no common cause ruptures of valves have actually occurred. ;

4. The calculation is based on an occurrence when the plant is at power, not in the shutdown mode.

5. All electrical power is assumed to be available with a probability 1.0.

The frequency of an event V is calculated using the following expression:

,. F(VSE0)=1 2 0(V1 ) + A1 0(V2 ) + 120(V IR) 1 .

l 0056v:10/112486 6-1

-w here-

, L *, X 2 := failure rate'of MOV 8702 (rurture)

-A p .= failurt rate.of MOV 8701 (rupture)'

. Q(V1 ) " probability that MOV.8701 is open:

Q(V2 )-= probability that MOV 8702.is open Q(V1 R) = probability of rupture of MOV 8701.

The failure rate due to rupture of a motor-operated valve is 1.0E-7 per hr l(11 and 12 ). The quantity Q(V1 R).is determined by assuming that the

total defined mission time'is the time between. refueling outages (i.e., every 18 months). The' rupture of motor-operated valve 8701 is assumed to occur randomly in the time. interval 0 - TM where gT is the total defined mission time.. Therefore the probability of MOV 8701 rupturing-is

T M 13140 hrs

-Q(V 3 R) = 1 7 = 1.0E-7 hr

2

{ ;Q(V1 R) =.6.57E .

t

-.. In' order to determine the' probabilities of motor-operated valves 8701 or 8702 ;

'being'open while at power, detailed fault trees of-these valves were used.

Figure B-1 and B-2 shows the elementary wiring diagrams for MOV 8702 and 8701 respectively for the'present interlock configuration. Figures B-3 and B-4 show the NRC proposed modification to these diagrams in which the autoclose portion is deleted and an alarm and a single switch to close both valves is added. The other modification considers the alarm only.

The fault trees developed from these elementary wiring diagrams are shown in Figures B-5 to B-10.

l The scenarios examined in the fault trees are: 1) the valve is not closed 3

'after previous use (either by operator error or failure of the autoclosure 1* l

,. l l ..

0058v:1o/112486 . B-2 ]

_w!

r

~

interlock) 2) the valve fails to close when the operator turns a switch'and 3) the. valve spuriously opens. Each'of these scenarios is described below.

For the present interlock configuration motor-operated valve 8701 or 8702 can

- .E be left open after previous use by the operator failing to close the valve

'during startup, an operator failing to detect the wrong valve position via the status light during mode transition and the autoclosure interlock failing to close the valve. For the modification case with the alarm only, another error is added in which the operator fails to detect the wrong position via the alarm and the autoclose portion is deleted.

With the modification of a single switch in place, if the operator fails to 1 close a valve, neither valve would be closed. If the plant was beginning startup operations, the position of the valves would be detected and corrective action taken. Thus, with a single switch to close both valves, the operator failing to close one valve is not a credible event and not included in the analysis.

Spuriously opening of the valves for both cases involves an operator failing

[

. to rack power out to the valves in combination with a failure in the "0 PEN" valve circuitry.

The valve failing to close when the operator turns the switch is another failure mode. In this scenario, the valve's circuitry or mechanical components cause the motor-operated valve to not close on demand. The operator must detect this failure either by the status light in the present configuration case or by the status light and alarm in the modification case. j Table B-1 show the failure probabilities used in the fault trees based on a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months detection interval.

This interval is based on the fact that the valve's position will be detected within one shift. To calculate the basic event probabilities, the following formula was used:

g, 1 T detect 2

0058v:1o/112486 B-3

where:

". Q = basic event probability

.' x = failure rate for component T detect = detection interval Also presented in Table 0-2 are the human error probabilities calculated in the analysis. The probabilities were obtained from Swain, et.al and the detailed calculations and the values used are documented for each human error scenario.

Results The probabilities obtained from the fault tree quantification for the isolation valves being open are:

~

With Present With With NRC Configuration Modification Modification MOV 8701 is open 2.39E-5 1.27E-8 1.19E-8 Q(V1)

MOV 8702 is open 2.39E-5 1.27E-8 1.19E-8 Q(V2)

The major cutsets (failure combinations) obtained from the quantification are i shown in Tables B-3 and B-4 for the present configuration. The dominant i cutsets for MOVs 8701 and 8702 are failure of the valve to close when the operator turns the switch in combination with the failure of the operator to detect that the valve is still open by use of the status light. )

i For the modification case, the dominant contributors are listed in tables B-5 1 and B-6. For the NRC modification case, Tables B-7 and B-8 show the cutsets obtained in the quantification. The dominant failure combination in both cases is the operator fails to detect that the valve is still open after he l

l e' l i

i l

00s8v:1D/112486 6-4

, 1 turns the switch. However, now the valve position will be detected by the status light and the alarm. Both devices would have to fail or the operator would have to fail to recognize these two indicators in order for the possibility of an Event V to occur. .

\

The frequency of an Interfacing Systems LOCA is calculated for each scenario.

The results are shown below: i With Present With With NRC Configuration Modification Modification F(VSEQ) 6.17E-7/yr- 5.76E-7/yr 5.76E-7/yr

. The frequency of an Event V decreases by approximately seven percent with removal of the ACI. The main contributor to the frequencies in each case is a I double rupture of MOV 8702 then 8701. The deletion of the ACI has no impact en this coritributor. The other contributor (the rupture of one valve while the other valve has failed open) decreases from 4.19E-8/ year for the present i

configuration to 1.11E-11/ year for the modification case and to'1.04E-11/yer for the NRC modification case. This is a significant decrease in the occurrence of an Event V by this failure mode. The deletion of the auto closure interlock and the inclusion of an alarm is beneficial in reducing this contribution.

From this analysis, it can be concluded that a modification is beneficial in reducing the frequency.of an interfacing systems LOCA by reducing the frequency of contributions other than a double valve rupture event, i

i l

l l

l 0058v:1o/112586 B-5

(-

a

i t e C o e C s n n A f n A

. y e i 5 i 5

. l m b 0 'e b 0 7 a m m 4 t m 4 n o o 1 a o 1 A C C R R C R 3, -

t y n t e i v l E i . 5 7 6 5 b 7 7 - 5 5 - 7 7 5 t a - - E E - E - - E - - -

l b E E 2 2 E 0 E E 4 4 4 2 E E E 4 3 E u o 6 6 0 6 0 1 8 8 - - - 0 6 6 8 -

a r E E E E E F P 3 3 1 1-6 2 1 1 1 1 1 1 3 3 1 3 3 3 S

E I

T n I o L i I s e B s m - - - - - - - - - -

A i i -

L M T I '

A V

A N

U l

- E n B R o l d d d d d n n U i a n n n

- E L t v s s s s s s s s a a a s s s s a a s L I t c r r r r r r r r r m m eme re hr hrh rh em e mh r B A l e et h h h h h h h h A F u t d d d .

d d a e n 2 2 2 2 2 2 2 2 2 2 2 2 T

N F D I 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 O

. D N

A R

T N

E E r r r r r r r r r r r N C h h h h h h h h h h h O N e / / / / / / / / / / / r P E r 8 8 6 8 8 7 6 6 d d d 6 8 8 h d d 8 - / / / -

M U u .

- - - - - - - - / / / - -

O Q l e E E E E E E E E 4 4 4 E E E 6 4 3 E 7 0 0 C

E S

i t a a 0 0 7 7 0 5, 0 0 -

E E E E E E

- F R 6 6 1 2 1 3 3 3 I 1 I 1 6 6 3 3 3 6 V

2 e e e r 0 t t t e 7 n n a a a f 8 n e e r r r n s e p p e e e e e n s d p O O p p p p r a o n O O O O O u r a w w e e w w l T C o o s r r o o o s o o i 1 e L l u u u t t t u L l a o o L o

0 r o t t F t t 7 u s s t t i s a a s s s i s s 8 l e l l r r r i i o o u i e e l m m l i i i u i i i i i i l l r l l l l i d f

a o a a h h p a r r a a a p a a o a a a E F M F F S S S F P P F F F S F F C F F F K

e r L L L L K K e e X X Q U 0 U X X

, r i A A A C 0 C B B A

T f 5 4 Q 0 0 T A A U 5 4 F C 0 3 M i 0 5 N 2 9 3 3 3 N 0 5 0 2 7 0 E t t 4 4 C 4 U F U 4 3 3 3 C 4 4 C 4 8 4 T l n P T R N B T U L S S S R P T S N V P S u e T T S C C C F 0 0 L L S1 T 1

T M1 ICI M T I I 1 Y a d 1 1 I I I I 1 1 S

F I R R R R R R R R R R R R R R R R R R o "'

c

i t o s n f

. y e l m e 3 a m n o t

R a

A C f

t y n t e i v l .

E i 5 7 6 7 7 b - 5 5 - 5 - 5 t a E E - E - - E - E -

l b 2 2 E 0 E E 4 2 4 E 2 4 E u o 0 6 0 1 8 8 - 6 - 8 6 E

- 8

. a r E E

) F P 1 1 6 2 1 1 1 1 3 1 1 3 1 t -

n o

c

(

n S o E i I s e T

I s m i i L M T I

B

) A t L n I o A C V

( A n

- N o l d d d n

1 U i a n n .

. - t v s s s s s s a s a s s a s B E t c r r r r r r r m r m r r m r R l e e h h h h h h e h e h h e h d

. E U u t t d d L L a e nI 2' 2 2 2 2 2 1

2 1 1 1 1 1 1 1 1 2 2 2 B I F D 1 1 1 1 A A

, T F M

O D

N A

R E r r r r r r h r

h r

C h h h h h h T N e / / / / / / / r / d r N E r 6 8 8 7 6 6 d 8 d h 8 4 h E U u - - - - - - / - / / - - /

N Q l e E E E E E E 4 E 4 6 E E 6 O E i t 7 7 0 5 0 0 - 7 - - 7 0 -

P S a a E E E E M - F R 1 2 1 3 3 3 I 2 3 3 2 3 3 O V

're C r

- e

~

f f 2 e s s n

0 t n 7 n n a a a 8 n e e r r r e p p e T e T e d p O O p r r n O O o u o u a e e t l t l s r r o . i i 1 e u u u t e a e a 0 r o t t s r F s r F 7 u t t i s a a s t u t u 8 l e r r r l m ml r l l r l l i d o o u i e e i o i i o i i V a o h h p a r r a h a o h a o O F M S S S F P P F S F C S F C M

e r Q K Q K N N e e Q U N N

, r i A . C C C F C C F

: T f Q 0 0 T 5 5 0 3 3 0 M i N 2 9 3 0 0 C 0 0 C E t t C 4 U F U 4 3 4 4 5 4 4 3 T l n R N B T U L S P P 0 P P 0 S u e S C C C F 0 0 T T 4 T I T 4I 2 2 2 Y a d 2 2 2 2 2 2 2 I S F I R R R R R R R R R R R R R o "'

t I

i t c c s n i i

. y e f f m

l i i a m d d n o o o A C .

M M t y n t e i v l E i 5 ~

b - 7 5 6 7 6 7 t a E - - - - - -

l b 4 4 2 E E 4 3 E 5 4 E E 5 E u o - - 0 6 8 - - 6 - - 6 6 - 6 a r E E E E E E E F P I 1 1 3 1 3 3 3 3 I 3 3 3 3-S E

I T n I o L i I s e B s m - - - - - - - - -

A i i L M T I

A

) V t A n N o U C

( E n - -

R o l d d d d d d d 1 U i a n n - -

n n n n n

- L . t v a a s s s a a s a a s s a s B I t c r m m r r r m me erh me em h rh er hm r A l e e e e h h h E F u t t d d d d d d d L a e nI 2 2 2 2 1 1 1 1 1 1 1 2 2 2 B M F D 1 1 1 1 1 1 1 A O - -

T D N

A R

T N r r r r E E h h .

h h N C e '

/ / r r / r /

O N r d d 6 8 h d d h D D 8 h D 8 P E u / / - - / / / / / / - / / -

M U l e 4 4 E E 6 4 3 7 5 4 E 7 5 E 0

O Q i t - - 7 0 - - - - - - 0 - -

C E a a E E E E E E E E E E S F R 1 1 1 6 3 3 3 6 3 1 6 6 3 6 V

r r 2 e et r e e r e e 0 t e t f e t f 7 a a f a s f a s 8 r r n s e r n s r n e e r ano sp e r aa n e a d p pep e p r n O O O u r l O T r t O T t a w l T C T u u o o s o i o o p o o p 1 e t t u L a o o t t o t t t t 0 r o - F t t t u u 7 u s s i s s s O s s O 8 l e l l i i u i i i i i i i r l l l l l l l wii l l w

i d a a p a o a a a a a o a a o V a o O F M F F S F C F F F F F L F F L M

F F F e r T T C

T C

e e 0 U C K K A A

. r i 0 C A A 2

T f A A U 3 F C 0 M K K 5 M K 3 M i 3 3 N 0 0 2 7 R N S 0 R N 0 E t t 3 3 C 4 C 4 8 A C L 4 A C 4 T l n S S R P S N V L R L P L R P S u e L L S T M C M A S A T A S T 1 2 2 2 Y a d 2 2 2 2 2 2 2 1 I I S F I R R R R R R R R R R R R R R o't

I TABLE B-2 HUMAN ERROR CALCULATIONS L1. Operator prematurely racks power out by opening the breakers for MOV's l 8701 and 8702 using operating procedure.0P B-2:IV.

t' 1.- Omission error --

operator fails to close MOV HEP = 0.01- Table 20-7 no checkoff provisions, l long list, t'10 items i

2. Commission error -

operator selects wrong circuit breaker 1

-HEP = 0.003 Table 20-12 3 .- Recovery e'rror.- - ' checker f ails to detect errors by others HEP-= 0.1 Table 20-22

. \

i

- 1 Al=0.01 i

ii A2=0.003' A3 =0.1 A 3 =0.1 P=0.01(0.1)=1E-3 P=0. 99 ( 0. 003 ) ( 0.1) =2. 97E-4

, POE = 1E-3 + 2.97E-4

= 1.297E-3

'* = 1.3E-3 fault Tree Identifiers: R1CBDEB and R2CBOEB em. u + o... g.g a

1 TABLE B-2 (Cont)

Operator fails to remove power.from valve at circuit breaker for MOV's

- 2.

8701 and 8702.using operating procedure OP.B-2:lV

1. Omission er.ror- --

operator fails to open circuit break HEP = 0.01 Table 20-7 no checkoff provisions, long list, a 10 items ,

2. Commission error -

operator selects wrong circuit breaker HEP = 0.003 Table 20-12 ,

3. Recovery error -

checker fails to detect errors by others HEF = 0.1 Table 20-22

.. j 0.99 Al=0.01 l

A 2 =0.003 ,

(

l 1

A 3 =0.1 A 3 =0.1 )

i

/ \

P=0.01(0.1)=1E-3 J P=0. 99 (0. 003 ) (0.1) =2. 97E-4 4

.. P Ot

= IE-3 + 2.97E-4

= 1.3E-3 1:.' .. Fault Tree Identifiers: RICBREMOE and R2CBREMOE cm. wws" B-10 l

1

v

.J TABLE 3-2 (Cont) 1

3. . Operator fails-to close MOV efter previous use.using operating procedure

?.

OP B-2:!V :

1. Omission error -

operator fails to close MOV

~

, HEP =.0.01 Table 20-7 no_ checkoff provisions long list, 210 items ,

2. Commission error '- operator turns rotary control in wrong direction HEP = 0.0005 Table 20-12 l

3. Recovery error -

checker fails to detect errors by others )

HEP = 0.05 Table 20-22 l I

~

0.99 l A1=0.01.

1 i

(

A2=0.0005 i

i A3=0.05 A 3 =0.05 P= 0. 01 ( 0. 05) =5E-4 P=0. 99 ( O. 0005) (O. 05) =2. 4 8E-5 . .;

, POE = SE-4 + 2.48E-5

.. = 5.25E-4 I

Fault Tree Identifiers: R187010LO and R287020E0 cm. ..ea

B-11 l l 1

TABLE B-2 (Cont)

,. . 4' . ' Operator fails to detect wrong position via status light

..' 1. Omission error -

operator fails to detect HEP = 0.01 Table 20-27 long list > 10 items

2. Commission error' -

checker fails to detect HEP = 0.5 Table 20-22 second checker 0.01 i

.,. Al=0.01 l

.. l l

'l 0.5 A2 -0.5 i

P=0.01(O.5)=5.OE-03 j i

,_ POE = SE-3 ,

Fault Tree Identifiers: R187010EST and R287020EST l

.l 0058v:1D/112486 B-12

a E TABLE B-2 (Cont).

7d 5. ' Operator fails to detect wrong position via alarm

1. Omission error -

operator fails'to detect HEP = 0.0001 Table 20-23 one annunciator l..

2. Recovery error -

checker fails to detect HEP = 0.5 Table 20-22 second checker I i1v 3 .c ,

A l =0.0001 A 2 =0.5 !

I P=0.0001(0.5)=5E-5 i d

i i

a l

'POE = SE-5 I

,. Fault Tree Identifiers: R28702ALDE, R18201 ALDE J

cm. i ... . g.13 ]

E r!,

k TABLE B-3

$- MOV 8701-IS OPEN-PRESENT CONFIGURATION DOMINANT CONTRIBUTORS

x. .

. . . yy.

' Percent Cut Set Contribution-Probability to Unavailability Cut set Description

1. ~1.50E '62.8 R1MV8701K, R187010EST. 8701 Fails to Close and Operator Fails to Detect via Status Light

2. 6.50E-6' 27.2 RICBOEB,.R187010EST Operator Prematurely Racks Power Out and Fails'to Detect via Status-Light P 3. '1.50E-6 6.3 R1CN42CAK, R187010EST Contact 42(c)AFails-toTransfer and Operator Fails to Detect via

-*' Status Light

"* - 4. 5.00E-7 2.1 .R1L533ACU, R187010EST Limit Switch 33AC Fails Open and Operator Fails to Detect via Status Light

=5. l'.50E-7~ 0.6 R187010EST, R15RCNK Close Contact on Switch Fails to Transfer and Operator Fails to Detect via Status Light Nean Unavailability = 2.39E-5 1

005Bv;1o/112486 B-14

i TABLE B-4 MOV 8702 IS OPEN-PRESENT CONFIGURATION DOMINANT CONTRIBUTORS Percent Cut Set Contribution Probability to Unavailability Cut set Description

1. 1.50E-5 62.8 R2MV8702K, R287020EST 8702 Fails to Close and Operator Fails to Detect via Status Light

2. 6.50E-6 27.2 R2CBOEB, R287020EST Operator Prematurely Racks Power Out and fails to Detect via Status Light

3. 1.50E-6 6.3 R2CN42CAK, R287020EST Contact 42(c)A Fails to transfer and Operator Fails to Detect via

- Status Light

4. 5.00E-7 2.1 R2LS33ACU, R287020EST Limit Switch 33AC Fails Open and Operator Fails to Detect via Status Light

5. 1.50E-7 0.6 R287020EST, R25RCNK Close Contact on Switch Fails to Transfer and Operator Fails to Detect via Status Light 1

Mean Unavailability = 2.39E-5 O

0058v:1D/112486 B-15

l p

TABLE B-5

?g MOV 8701 IS OPEN-MODIFICATION l DOMINANT CONTRIBUTORS Percent Cut Set Contribution Probability. to Unavailability Cut set Description

1. 4.50E-9 35.4 .R18701EST, RITP405CNK, Alarm Pressure Transmitter Relay-R18701K Contact Fails to Transfer, Valve l Fails to Close, Operator Fails.to Detect via Status Light 2.7 1.95E-9 '15.4 R18701EST, R1TP405CNK, Alarm Pressure Relay Contact fails RICBOEB to Transfer, Operator Prematurely l

Racks Power Out and Fails to

. Detect via Status Light.

3. 1.50E-9 -11.8 R18701EST, RIALLSK, Alarm Limit Switch fails to R18701K Operate, Valve Fails to Close and Operator fails to Detect

. '4. 7.87E-10 6.2 R187010E, R18701EST, Operator Fails to Close Valve, RITP405CNK Fails'to Detect via Status Light and Alarm Pressure Relay Contact Fails

5. 7.50E-10 5.9 R18701EST, R18701ALO, Operator Fails to Detect via Status R18701K Light and Alarm, Valve Fails to Close

.,' Mean Unavailability = 1.27E-8 005Bv:1D/112486 8-16

-l v

i TABLE 8-6

.- MOV 6702 IS OPEN-MODIFICATION DOMINANT CONTRIBUTORS -

Percent

-Cut Set Contribution Probability to Unavailability Cut set Description

1. 4.50E-9 35.4 R28702EST, R2TP403CNK, . Alarm Pre:sure Transmitter Relay-R28702K Contact fails to Transfer, Valve-Fails to Close, Operator Fails to Detect via Status Light

2. 1.95E-9 15.4 R28702EST, R2TP403CNK, Alarm Pressure Relay Contact Fails R2CB0EB to Transfer, Operator Prematurely Racks Power Out and Fails to Detect via Status Light.

. 3. 1.50E-9 11.8 R28702EST, R2ALLSK, Alarm Limit Switch Fails to

l. R28702K Operate, Valve Fails to Close and Operator fails to Detect l*

l l'

4, 7.87E-10 6.2 R287020E, R28702EST.. Operator fails to Close Valve, L

R2TP403CNK Fails to Detect via Status Light and Alarm Pressure Relay Contact ^

L L Fails l l j

5. 7.50E-9 5.9 R28702EST, R28702ALO, Operator Fails to Detect via Status R28702K Light and Alarm, Valve Fails to Close l'

Mean Unavailability = 1.27E-8

~ l l

0DEBv:10/142486 8*17 L

-f L ____m_______________ __

i- '

b_, "') l

L i

, TABLE 8-7

'l .

MOV 8701 IS OPEN-NRC MODIFICATION DOMINANT. CONTRIBUTORS '

Percent i Cut Set Contribution; Probability' to Unavailability. Cut set Description 1..-4.50E-9' ~ 37.8 ' R18701EST,'R18701K, Valve Fails to Close,-Alarm' N R1TP405CNK Pressure Relay Contact Fails to Transfer and Operator Fails to Detect L 2.- 1.95E-9 16.4 R1CBOEB,' R18701EST, Alarm Pressure Relay Contact Fails

-R1TF405CNK to Transfer, Operator Prematurely

! ' Racks Power Out and Fails to Detect via Status Light.

3. '1.50E .

12.6 R18701K, R18701EST, Valve Fails-to Close, Alarm Limit R28702K Switch Fails to Transfer, Operator Fails to Detect

~

-4. 7.50E-10 6.3 R18701K, R18701EST, Valve Fails to Close, Operator R18701ALDE Fails to Detect via Alarm and

. Status Light

5. 6.50E-10 5.5 RICBOE8, R18701EST, Operator Prematurely Racks Power R1ALLSK Out, Fails to Detect and Alarm Limit Switch Fails to Transfer Mean Unavailability = 1.19E-8

! 0068v:1D/112486 . 8-18 l

+-

TABLE B-8

); H0V 8702 IS OPEN-NRC Modification DOMINANT CONTRIBUTORS Percent

~

Cut Set Contribution Probability to Unavailability Cut set Description-

1. 4.50E 37.8 R28702K, R28702EST, Valve Fails to Close, Alarm R2TP403CNK Pressure Relay Contact Fails to Transfer and Operator Fails to Detect

2. 1.95E-9 16.4 R2CB0EB, R28702EST, Alarm Pressure Relay Contact Fails R2TP403CNK to Transfer, Operator Prematurely Racks Power Out, Fails to Detect via Status' Light

. , 3. 1.50E-9 12.6 R28702K, R28702EST, Valve Fails to Close, Alarm Limit l

.. R2ALLSK Switch Fails to Transfer, Operator Fails to Detect

4. 7.50E-10 6.3 R28702K, R28702EST, Valve Fails to Close, Operator R28702AL0E Fails to Detect via Alarm and Status Light

5. 6.50E-10 5.5 R2CBOEB, R28702EST, Operator Prematurely Racks Power R2ALLSK Out, Fails to Detect and Alarm Limit Switch Fails to Transfer I-l ,- Nean Unavailability = 1.19E-8 0056v:1D/112486 B-19 I

L_ ._____________ _ _

li %g i

li

@ @ O A,33 A _@Ss% @ds %+ @33 R_@33 B3 tC bts AO ao AO -

bo s ; bc $ o.O g3 HOTE 5 e

%337 ac

@ i, l

L__ O OO O O O O O O O O O- - "

CB A d L2l R11 AUTO CLOSE ::py cio5g,% 3/m L22 R11 v Y 3

CB AiclB') 902,- O

, @ 402 li-A (8 Tc+s4

t 4 sov. 5 4.com ] 'ASc(B'K) a H.7 C 5

L-m / AA l

!s ii l g 5)3$-H l

( ,s 5 l MCC,01 4

@ 42(c) v cv m I E J. . d . 4. 42 .. .L .L 42 _ : 7" S

- (c) y -

- (o) _ 42(o) o b 2 t. ) _- 4g MECH. INTE.C3

- TRANS. {C) l 49 480izov tE o TI T2 T3 qx 9 g49 i .

h b O 0 /pg N I NOT E*4 :

i. u vALvt. No. [4 i

. 2.1/5 -BEN. i 91.20 N.P'C. SH.2.1 o.['-

g) N 3.couTROL ".>HoWN FOR d TYPE W MOTOR CONThot. CENTER. l 4.REF, *t.tMITORQUE' DwG,15-477 E7 BS 3 4 27Bf. h S. AbD JUMPER IF TORQUE SEATING 15 REQD.

[

O j$

O l

i

W uJ l 6 8 9

o

' WW %g y ......:....._--...-::...

/1 t

moz-Az-z i. .

@ @ @ i >

%.@M 33- A @n LG u CL_ss R-@s3A _@33 ~ Clos % @33 i l T & ' ~

~' *- -

-' ~

~ *C -

- " '~a' '

C-i un@- -

' I' T'

O O O OO O O O O OO AR2 l A

2B A' SM s

I Rll J ** I OPEN:: l y

'* I #5 v

X, k X -

A5dB)()

i 1/ A =1-P(.-usq 2 Tc454

\ '

J

) g) SW.146 VALVE TRMW ALMTERLDCK NOTES ,

/ 901-2 j 1 87of S & GCNTM.T C. LOSES WHD4 , j RrS PRE 550RE EXCEEDS l 600 PSI OR PZP VAPOR l SPACE TEMP. EXC.EED5475*.: 1 AGCNTM.T CD5ES WHEM RCS PRENmSORE lS BEL 4WV 47.5 PSI AND I PER VAPOR SPACE TfDAP O3 Q2 Ox2 IS SELow 475! ,

.L.42(c)

T a- <

_. < uc) j b I M 4 2.

(o

??%

pjn g; 43 3 M}; e

,,, m westinghouse Electric Corporation .

PAGIFIC GAS d EL.ECTRid CO.

~

TI APERTURE

,j o 4

oiA.e,to cANvow uN nTS* I $ 9. -

x gi ELEMEmASN mam__q otAc.. voTom twinerte vAwt CARD v

hja , , o W M S otu.s '/sho dadeu M. gg gg 1 d

4' w/nos 8/phd # ,, f _ _ _ _ _ _ _ _ _ Also Available On g(gfu /'fs SHEET- 14 i Aperture Card h.IN,m'S NUCLEAR ENERGY SYSTEMS PITTSBURGH. PA Lt.S.A.

FIGURE B-1

. PRESENT INTERLOCK CONFIGURATION 8701

. B-20 Dffff0 /$ $ 'O -

l

@ @ @ O )

Ar33 A .13 A f@st % @33R-@33 33 Dbb0

, go -

- bC, 1 a.O + AO --bo $3 33 ,i ac@ Y) , HOTE. 5 L O OO O O O O O O O O -J CB H

LII R21 CLOSE~~b siEn LZ1 R22 v y v CB o

ASC(AK) C302-4

_e1.Pc402 l~ sd. 248 4mov s$ Gov l ASC(ATO %25 I %

AA I E

9 Ttt -H i sS)35 L_

h 1 Mct 01 d5 0 tu n I {442(C)

E ". . J. 4 . 42 . . .L .L 42 = "

S ------(c) 3- T- -

to) _ 4 2 (cb o ] _ b 2 Li _

MECH. INTERB 4g TRANS. CJ/

d 49 4BO.120V LE

(

l y TI T2 T3 gy '{49

" O EDk NOTEg:

O

t. w -vAtv=_ so. o 'h.*

0a l

2.W EcoHTROL-bEv.SHOWN I SH.Zo FORM.R 'C SH.2.l W MOToi'. CONTROL CENTER.

W TYPE M -

l e.REF.AlMITORQUE' DWG. 15 477-2785 3 4 278(=-5 5, ADD JUMPER tF 70RQUE SEAT 1H615 REQD.

f

_ g

1

5' '

9

-o

d**

1 20f.-A7.-2.

@ n '

9

( @n bt

. 33 A@%@ss n R.@ss CL-@s3 N.@134@35 % 33 i

--bo **C 7 to - bo WC Sc.

L -- bt - bt +

cu.n @ l T6 0 .O O O .O O O'O O O O ARI n B L M g Rin #N oPEN:h If If -

r- h Rtt h j ( 10 W $

v v $ vi ill f, i

ASCM 9o1-1 1

_n-PC-3 4 -~

z 405AX TRMM A lWW_RLocK NOTES SH.24& VALVE. <*

@)tol-2) ~

L- 8702 A bCOMTMT c.UDSES WHEN RCS PRES URE EX/_EEDS Goo l A C.CNTM.T C.t.OSES

)

WHEN RCS PRE 550RE 15 bet.cw 42.5 PS) 03 Qt Ox2 L 4L (o')

T 4.

-ga(c) s^

jr.

i

[ff MA *

^

}L Westinghouse Electric Corporation Ow v-P' @V P aft '5

m ~~MIFIC GAsd ELECTRid C O. APERTURE

Q g

owm n c.ANyoN usiTsw i 4 2.

ELEMENTARY WlRING OtAG. MOTOR OPERATY.O VA).VE CARD h A W LSo l 6 __ __ __

g ,

l $bikM ' hd

,y , Mj NUCLEAR ENERGY SYSTEMS PITTSBURGH, PA U.S.A.

FIGURE B-2

- PRESENT INTERLOCK CONFIGURATION 8702 B-21 8707 //0 / 23 -cif A

~

o-

+--

~

@ A _@as%@ss ou @ R_@Ls l@

\~-

A rn ta 33

'< C 5 a0 -

bC ' o.O $ AO --bo i

g3 as

(

AC@-'

Yil

_L__. O O O O O O O O O O O

~

f H A

t.L/ LII S i

Ct056 CloSE :: I , gorof c j 870Z. lt Zi- 8 70lL22 RU REF. ,5#./%2. se <

J <

CS O l $

f ASC/M 8

l

{

.A(t 4 SOV. b & GO ', ] ASCIO) 1 l l e AAA -

l

'1 * '

i 1)t t-H

~

I l s .

^

g \ s\ g \ \ \ t l

! MCC. O l 04 ( 5 \\ Y

8 ._ ~ y i .L4am

! 2 0

'... . J.s.. '.L 4 2 ;. .L .L 42 ::.:

T*

4 .

- (c) .g . (o) , _, 42 (O)

O _ b 2 L. i

" 7 4g _ME@

! < . , TRANS. (C) 49 4Bo izov

, 'E ~

o Tl T2 T3 *

-t-

-[49 C

M NOTEg:

f O $Nh dlsw.

i. m -VAL.vt. No. og 2.1/m -ttv. I c.>i.20 N.Pt." SH.2.1 J

, 3. CONTROL SHOWN FOR E TNPE W MOTOR CONTSCL CENTER. F)j i.REF. *LtM1 TORQUE

DWG. 65 477 E 185 3 4 2784 5 u. 2 t 5, ADD JUMPER IF TORQUE SEATING 15 READ. '

I,I O

%PERTURE "f'6

. CARD 6 Also Available Aperture Card Ori

,u

/

mo z- AZ-z i l@

NL 13 n L - @n %@ss R_@n R _@ssCL.O ss %@s3 % @33 T '4s '

- t- ~

~ 'c ~" '~ ^ ' '

c-

n. s un@

} kO ,

O O O OO O O O O O O

AR2 47Fh A'd#@ '

V Tcs/T/04 M/7'C ,

B L M Q 3 -

an G R j_$

pO O(h,' h l fA OPEN : f y gp Q .

)1 Rt1 y .5- el Ay v v -

g TL6Y AAAUAGAM 31 AscleX) w .: gg g fs -

- sm/ A 'JOhr/ ) T@o} q .

3454 z Tc & i W4 +3 M-5 g)SH901-2 148 YALvE. TRMN A thlTERLOCK HCTES j -

j 1-87oI e AcoNTM.TC. LOSES WHEN i l Rcs PRES 50RE EREEDS f PNj

.&ccWTN.T c10SES WHID4 p e c. m m R E I S 1 eel.cw 41E PSI AND i PER VAPOR, SPACE TEMP } ]

O3 Ox2 i BELow 4157 -

1 l{a*# 3 dalla' CT Cl.D5&S AHEAli u AL(c) Y6Lf6/5$0TRlUY NTE.RLOCW *

<e) -

3 pj R1% ,g Westinghouse Electric Corporation 1' I

@p ' 2 ' .i & q ..t PAdlPIC CmASd ELECTWid Co.

f4f i

'A h' 6fD 6.

k DiAst_o CANYCN UN ITE" 16,, O. -

I

[

"I tttutmAm mwsmAG. ' voTom c+tm ATto vAtva E (ju.L 4 Wm Sm.ns hfo t

k

\n

-l was?

f _

m e wased "hed "

'!s sa gg

,, / - - . - - - - - - -

b .g hj[I gj& /yj SHEET- l4 i j i

)mS NUCLEAR ENERGY SYSTEMS PITTSBURGH PA., U.S.A.

FIGURE B-3 g NRC-PROPOSED MODIFICATION 8701 B-22

$7p yff Of V 3 # Ow -

)

s x

@ F @ #

D

. %.r 33 A_@ssAr@ss%+ @33 R _ba . 33 tC

\_ _ s s o

i ? 40 --bc '

o.O a.0 -

- b o, 33 l' l O O st@ f*

-J OO O O O O O

}

_L O O j CB H

.I '

-s

'i '

t.t/

I- R21 c ase .l.'2 2- e t-- no o ~*

! 8 701 L2i~w T 1

j V V f?

l esY $f ASC(Ak) 4 5 a

. 4!

[ $

I 4EOV b6 40m I l ASCNOG i i i

/ AA l 1 b i ii l j J l j @ ' L~"" s \ \ s \ \\

b > \\\\\\\

l 2 MCC.01 4 ( 5 0 ew n 5 4Z(c) 4 E d.-- .--. . 8J . 4 2 J. .A. .l. 42. = Y j $

- (c) y. -

- (o) . g 4E(CD b

o _

2

('

Li 43 MEca, r TRANS. C 49 480-noV

'E 3

tu ? ~[49 o TI T2 T3 O

0 1,l l NOTtg: t

.j i.u -VALVE. No. g f*

l

' LW accHTROL-DWWoWN 4.REF,-inMITORQUE" I SH.ZoFOR Wkl.R

'TYPli 'C7 SH.2.l W MOTOR CONTROL DWG.15 477-r785 3 4 276&b 6 i 5

rggg[ j 5 ADD JUMPER tF TORQUE SEAT 1H615 READ.

)

~

l. CARD i

Also Available On Aperture Card t

/ l MO 2-A2. - 2 .

R ._' @ts 33 % _ @3" ' (@u 3 4_ _@n R.@n R_l.9 n M@u % @33 ~

' --' ~

~' ~

~**' ~~ " " * *- i T '4s

.s R Ln@ t rso : l O O O O O O OO O O O ;

ARI g- f(M4176b

' & 70.51170A) 60)lTCN 4

g gg --

)

i , OPE ~~h II 1F b 0 0 Rlt d N M$$

M HW f

"A "K l j

RbP f ASCM 32 - 4. 9ea.-l AdddMCd70f maaog user z g f g4o3Bx j g ~I l-R' 9 0 2248 g z 4I VA1.v t. TRMM A luTw_RLock. NOTES !) ' -

g.5 ^5dAO901~ IJ I 1-87o2 A ACONTALT dt.OSES WHEN f j ~ - '

N.C.S PRES URF o-ExLEEDS GOO I 5 ACcNTA4T CtDSES !

WHEN Rcs Fes%uRE is l e5LON A2.5 PS\ '

hDAMCT* Cf.OSE5 UEd

~

1%cc) ME /s$0T MU9 i T 8-C/f56b. .!

{*N !

LrtR. hoc _h _ 4 z, ,i (o j

}

i lt > 6ff $pe g Q Westinghouse Electric Corporation w .?

% 4- 4A1 ni$o @!? ( m ~PAclFIC C,AS/,! ELE.CTRIC CO, Q "",id* o y

~tstAm m canyon uN rrse i g. 9.

ttt = A w wmma oixs. waren enurso vatva

[

w1 SN a TJr'2P'S" fZ;&

9 o - @ @ _ _-- !'

rg SHEET- 1 4'2.

a D yy#4 bh )m?nNUCLEAR F*NERGY SYSTEMS PITTSBURGH, PA U.S.A.

FIGURE B-4 B-23 NRC-PROPOSED MODIFICATION 8702 77ggffpjgg g 7

_ _ _ __- __ - __ -_ ~

h' - .

j$ -

ll lh } b O l [ l t.h b

~

j

]

a e* IteLO'les I.* - WAL Ft fsff d' seen is was

(

j G u

esse

, * . I I e . .e,.. ePf.4,se , .

SPWienLt Spin te SLFSE fet SPOD p* F

[3 [3 9003 hcl

- 1 I I ePtaa'se f aits ses crea ePreates f ails avvectaet ages opgestes rests le ef 89ff P9efte SPtT250thf te elett ser sof fLptr fatet f t Mf ttf Witet Peen 20 ePteS Af fre P' A If98 SA P99 t f lee fte Pet ESWeII AFIN Steftft Lleest

!. E .

. M 9003 esta SeM 9804 4013 Ott911tet See'esent tepe get .

j, g 9.3eter 84 9 310st ce 5.eeeet es

9 e000f 44 0 0000f 96 6.gess-et g f l l l

? Paese age tier testar t et een a raskuet le rews f anget actung i

! reassm este essaskt Gpts sistvit le sleever

eane see ePre neste

89Bf aff SLOWS l

0 i n sepi

.,0 tele 8435 s.

Site 42044 16300t 97

$ SeGer Si

.- 1 I l l j Pet stsett . SPts 80statt 44e C64tUtf f e 448'ee8W e FtP58 SleWB tegem4L f attput tetet

, 'farte4' Wet tLHf t estatte Fant F Atti efteLe4D 15 3GBT AUPf el4'lW em%Lf ePfe se ntogtf Nfits tistvif Fan testerfs geset fsPEtt Perstafettf erts C M

.e ... 9 tee 6 Get s 8022 4154tt0 estFf GIFE48 Be h eeU t.e200t es 3 seest as 4 .0000t -69 I.seest et 9 900er 91 0 esser-ei 9 0000t te 8 Meet 44

-- I I I l l

stLaw teef ert p*We a sus aPreatse tructeus tear L ins t tie ttu asp Limit evasta safee tsagers i edeM4LLv OPtB MfU4'les F#tM*Ve8LT er tiettill failedt SWittel 3349 9Plef 9914 FAILWE I 54sille 54954L terms P8Wtt sist enf atte arts l

O p

e.e. e.g. .. .. n 0023 l1 91 fP oettge to delerf f Sietets Sited ethg334rg tieiscer .

l . elect .eP F.300st gf 8.peest ce t .seest -04 6. Steer -99

. Soest ..e - . .es. ., .B.3eeer

.see. ..I -e3 .. see. ... e see..el 9..,

y. _ i f on- ..I,t , i t . f ..n f

, , ,33ft mt f. 9Plet er ,o,t .m 3J Ae.OP.r f ePew. et i

.e,. .c.,

e. .,f. .n . . ,40.

..se. . ...e0....

90s., -., . e.sa 9,

\

l i

11 l 10 l 9 l 8 l 7 l 6 l 5 li

~

_ _ _ = = _ ,

{' / j i

h, ."4 h J J

l f2 l 1- ,

F i

)

l c i

1 i

vastt f asts te stett se 988e44 40 Pleafes 9 ACLS 19 -1990 F

'O '

043P 1 -

neeen yteatre f aset #F08 yt.anean 99 9ftf rasts Faste te steer usess cettfies fle 9fetiPG 680ist E

.r/\ 44 l l 1 -

Tet.We IWesteettet FAttet acttes Fastinir ceces set. PseAets FLILWRt le P9eE4 914CUlf 69 $4098 Sh tf F A869 fe8LS 70 Slept , flStulfet fG Steet es,1

.....m se,, . ,,,,

3 Seter 43 8,esagt es I f -

f astet Mt.s enett tensarq f astutt scens 85 4ePf 0ft99t f aitS 80 le glacW4ftf PMI SP $400 Wit f taterft C

Sees g,,,,

3.esset 95 9 90 set et l I ---

Pgtssielt f= e~ .t.u.t.es tes a

. t n.its.che.tt m., t , ..t

=

B APERTURE CARD e...

..... . ..se e.

00s ..

' Also AV8Hable On Aperture Card

.'in ,.n a' ... ..s.,.,4..... .,.o. E

.t..,s.

f.

e, t. . . .

felt 0

=

. .. A essa 0033 0034

. . . . . ...e,' . , , , , WESTINGHOUSE i

. w. i . ee., r . .sw .., ew

. n ,.i . . w .. esn. MOV 8701 PRESENT CONFIGURATION g /g/% "g g FIGURE B-5 15: 45 2-APR-86 !

4 1 3 1 2 I i B-24 wwa - - __ _ = . - _

PT

'I -

f

.' r Il 1.

.- 1 li l\

II l 10 l. 9 .. .l 8- l 7 l 6 l 5 _I ese testaples q'

' eau see arti le arte i ,'

, 1 0

" , Me I

i

- I I ses eres ytaates rasLs

)

erustomete artes se eLest ens I!

q.

0798 c .*

4 F

n

.00. ...

s k.

I I I erreates taets ser eres ePteates f a#Le ageocteet este erresten talks 18 erett Peute Seuntepet f fe CLett est est SLMt sakft US etttet Wilene Fest 214 Cent gPtos Mtte See tret es feelfleII estAfire , Petituellaf tee B.,,.

(

E M

e.e. .

e... .

.e esos ee.s 3 SFettet ste'easet esePossear t.aeset 45 e 2100t.94 8.eeeet es 8.eenet-et 0.ecoet-et 9.eemet-es l l l l ,' ret ssuet contact ettena f a4Let in Peutt l f astust occus; f eaant s tte seennLLt ePte siegut t te esecggt falls ag Ffe esegle f teclatt eLeste i

' D (3

M 4

sees set e e830 g

GNe430ae 4.83est aef 0.eeser-se

- I I I I' Petstung erge sentact ane giacent teagreiers reJet Petstariserte tateonal rasteet occine inleuptstAf tes eLeste ses%Lt antante faite ePtse estettes ettler le esecult FAlta pts eseIInf erse ttuelt retsim'teit arts ePtos C

d es.. .0,8 go.e es Geet a0t$ 0032 4214c00 sitif RFuu 424L eeU 1,6 test-Se 8 60est-46 6.Geest -SS 5.stest-OS 0 0000t*9 4 Seest 09 0 0000t-91 8 000et-95

- 1 I I I atta' contact sPieltaus erteafen gaaevif setaste genes evisen ase Lisess evites RDies steelte see%Lt erte Petesuer Petsta'testit emissieUSLt felPs f enedt SWi f C40 3kat ePtes Celt FatLINtt

$sio4f e test 994tef a'les eMa$ P9ste ea8t arte effeattee B

.ee, teet .0,. .os , O -. .,

Ge33 agre enaces $2483afte GNeu efteert e2Le33 aft ap4ty 8.53eer-er 3.secot er 6.3eest -93 4 8eest ce t Seset-94 8 4eest 01 4.teest -64 e ecost et s.eeest 9s e seeer se 0 seest 65 4.eeest si I

toesut eviten Lenit swucss 33fe ePfee 33ao optee Fa8LtRE to f a4Lullt te

.e ePtitatt , SPfetit A

m. et,,

ef0523f eU etL 833aeU

. ..seet . . . .sest . ..

. .o.et se e e.o.E ...

11 l 10 l- 9 l 8 l 7 l 6 l 5

_ . ,_ _ . . , _ . _ _ _ _ _ . _ _ _ . _ , _ _ , _ _ . _ . , _ . _ . , _ _ _ _ _ _ _ _ - _ _ _ _ . _ _ _ _ _,_____.__m_______ _ _ _ _ _ . _ _ _ _ _ _ _

"r-t t a a 2 i i 1

I G 1 etas a f.fift ';%t F

9 003F 1' .

siseen spl erteAlm f aste 3

P4Lvt. ts.aa't3 FAIL 10 SLMt t SEf tet U5500 Peenfle E

W ',

l' I l ~

'l fpasti

. sWesinetts FalLIAL .cctme attistt f85asktME f.WEA El ett.ute tUlf SS CLMt fasmFPtsa'E.3 9A&tt A6LO f F AIL 9 f t SLMF fl8C#f f 4f CLNt -

,g d *

/

i 0

8539 3 000E -.3 0 8eeH'.l -

t 1 *-

')

.' f alLWE .CCW$ CLME CWI ACf F AIL 4AE SCCW9 IG M f f Alta I. 85 CLMullAf FAef .f ' Cl9CLH. evil laangrts 3- c 8t 00).

21999 4 ,,

S Geest .9 '"

.. ... j y I' I ~ j Mf etL Mt

{ cefart P.t90amt

$WIMf.430stA f evigsse testestsq4fges ]

i ffl.Ae AIL S.f E3 3 l'l SP P&lLS )

I a.tawir G8 sLests 1

, APERTURE l

.L .

8031 C PtD - <

i

.e

i..... t i

Also AvaHable On l

t..'.t; ,t.

!"'"' !!!!'. ::!'."J....

,m. Aperlure Card A

1 N34 0033 8034 im x. . as x, e. w,, WESilNGHOUSE

..w...

... s n n.

. m.n ...

3-a e m.= ...

..F HOV 8702 PRESENT CONFICURAil0H g//d/ ,,,O FICURE B-6 13fJ9 4-APR-86

l. 4 l 3 l 2 l 1 B-25 l

t . .. _u, _ l

%==W

....--__l_~

13 12 j al j to j y ( 8 7 e ,se... iee emetver eres to apre G

)

l ese.

i I

i

~ l f I noe eien errearce f aite sm er raits seveiousti eates to stest noe se < test see eres setenese seits se etsses F

(3 (3 (3

.os, .. esas

- l l l _

i seteatee pans roe croi ortsaron raets eersatee f aits seteates rans Watet vans to erseason antie i

e etnoeg powie seveiest s to nesa noe to oe rtcv veone se artics osome stest were to o<eret onome 7,680 to erges af fte sue Ust festf tee via festfice ela ergea80s fWeies Postflee ela j stal#s tiefef at aste eWif 5li sf alUs LleMt

]

E i M eseJ ees s ees s ecos een e sole esce, rarir '

e s s'e s er eieresser sees e.sesor as a tsoes se e.seeer es e secos es e ecoot si s.essea-ei

.- 1 I I I i euss see etw qe ertsaiee #ans ataan sans se catec #ans to esitusa occuns teasemi t% e ce=s ar seemast 'e or<te's re stiger snome screatt ete$r is ciecuuse rans ano sete e=ee's posshes na roe tes cros toe 8Mi Stoff1 ae a8N a esse seis - esas esos esse esas I picee rene e i e n oi nt er eiersie e easos.ei s.seost es s sooer es

( e ecose se e esoot se e noser.es i - 1 I I I Pet ssuet , ePEN EMlat i sf(4 POJBf(e PH lWeir assen f aits f attUer is Pewte

'twisatser et est s tinit suisse ass.sumetseios to orreast siscus s sos f ouss otaries scenastt sete raits to f aite rait toef et tg gescaf leasep to C

eene enir esas sees een s esas e s mes s t at t et ein sen e .esent .os i . coces .es s eeoot.se a seeer ei e sooer se e essor.es

-- I I I I ertas contact seusinus attas toernes artee sett Per ssuei sie steevir lo sess enes e soewtv eets artsaries siosat emit s to ranvas sessemeraries enaste ra Le rans spea g g tenegy ge ( Att g gyn g eogs g ne*tes B

ow es.e ess e eene een eau eens sier soscas oi tosac te si te gescos ei toscor si cosac er siter e .e poor .or F .soeet .o r s sooor se s.cocer es s soest .or e.neoor C e eeoot.o. e eeoot.es ee .e, e one,r.si e .es e one..e

_ i e,, s a ,o e, .

e, .iee,s,,isi,

,.s, .,n, e,e s s

. e.t e , so .me.u A

e.,e en

e. ren's e..ea

i. e.. .ea e .co.a. se e .ei s . ee.or .oi 13 l 12 l It l 10 l 9 l 8 l 7 a s s.

3 .7 , ..,.

/

, 7 - ..

C I

F I f _

.f. .( fI.C

. f.. #.

s_.....

E

./.A43

_ _ s D

, I _

r nu., .ccur.

.st..st. c. m e.s t

,,...., ..L...

C 41 34

3. f .S I i l I ! -

, st g.v.

tot.% i t .v se st.

ev t .t . L.in.i r .vi tcm . L 3 .im.C .Pt.i.s sa n.ov f qL ..lL W.f s.st c ff.st ics.

ff 4L.,4.

.fPt.

. JE .Wl f CN .e t r.a ct . . ...

.. t n-- '

B rp[

.B.

.. ) n a

.... .... ...... . . . .~....

At Lm f'URE

...4 i. r ... .. ... .. ..

. . . . . , . ... . ... . ... C'A.I Jy.

f -

e 4 .viic. ir 3 't.. L 3

,in.c.*.v.i,s..

E 8 fltt f. pt..it f .lt. 1. .*t D.tg A!no Available On A

A;,erture Card

. . .o 3.

.]

. 510.,, 'hESilNCHOUSE i..,... .. ...

. ... . ... NOV8701 NODIfICAT10N gggg/g g =/d FIGURE B-7 15 53 2-APR-86 l 6 l 5 l 4 l 3 l 2 1 B-26

~~

_ _ _ . _ - - - ._ _ _ _ - - _ _ . - . . _ - _ - - . - _ - _ _ _ _ _ _ _ _ _ - - - - _ _ _ . - . . _ - . _ , - - - - - - . - - - - - - _ - - - - - - - - _ . - - - _ - _ _ - - . - - - , . - _ - - . - - - - _ _ - - - - _ - - - _ . - _ _ _ - _ - - _ _ ~ . .

.. I_,

I' I_ d f ,_ d i' ,,} _ ,L _ ,_ j __ (_

ne i.eLa'iee f aLTt IWf 9>e3 IC SPtt G

m'

. ., i.

-.. I i l sov erea erfea'se raels ekst satte se

- ePulttBIPSLT OPfe9 Te stosi var etest nos 8703 SPrea'se f allo le Mittf .

s S

[ [ [\

0808 4001 sets

-- 1 l l 1 ortesten rasts see eres erf es'ee easts opteatee ta:Ls seteassa raats valet f alls te optearse saltt

'S of eWrt PeWte Sausieugtf f6 Eteet est f 5 Mff tf Iftene to Mtsti tense Elew allege TO Mittf We f sDR tiefWif SPt et af fte eMe WM Pest flee ela Pesittee sta speseten feest - Pettfite sta

$st eef e 9f afUs 11080t at aAss $84 tt4 StafWt Llent

.m .1, .,

seta est e Geld

.. set t .,s..... .se,s ,

8 3ecet-83 9 890et.Ge 9.sem ues 4.0empt sl e eeest .et . G.seest.el

- 1 I l l Perssuet contaes es egra arenaces f asts kan s paats to 94Ltd f aits to Fa: Lust scene f aaesna rtre ses%Le ePre to afsttf Wees erf a'aet thess is caetustes f aits age sPts sMeef3 eselflee fla foe Wf e788 testact CLests n ame D

- I .s i, e is mi

.00. ... me 4

naccesene sas?sJetet / saessas y e.steet-er s.eeset .es 3 esset es 9.eeeef SI 8 SeeM el 0 estet.91

-.- 1 I I I Pettsuet gese toutett sites muests PMsswis aLaen f asts f astemt le rewLa let flet sf a' lee ' steers Liself settsu lasteustetatlet to artenft tietvit fallo see%LT SPtt Fa6LG E0 faaLB teef aCf 6 Speeftf titeerts e

v

eget 9047 3033 Goes pet s 983F

~

83esee0 92kL ee eaaL 49st f.etect 95 9.eeeef .e4 3.000M 98 4 0000E -96 9 spect et e seeH-ti

-- I f I l ettav costart stuniess Mtat costar's attat seat Per sset ase tieeves . tesest enere SceMaLLI $ Pit ACTeatles Stemat f atti 10 f alLUet lu f flPt o let t 0ll 98tante f a LO FalLB rhapf 3 vo testte FalLI sPuoleU5Lf 9'tel C

9007 90e9 0019 Seit sett 0431 9e39 e,.ein e, e, . .ex.e = > <e x., enmaet, 8 t.,

.....estes . r .es. .e. s .00. ... .seet . .80...,

.l.. 00. ..ee. ... .. . .e00, ..I . see .el . - . . . .se. ..,

..e.

.ees. $!

_ i ePt es tDe $ PUD 100s f e BP 98 Pe.tMat,ifetti

. e. es . .u. .et t.ief.Ul

.e f n

A 1

me me

..t.0,, , ,ce, i . tes. .., . see. e

. . seest ... . see...I 3 i

1 1

a i3 I 12_ l 11 l 10 l 9 l 8_ Ll ,

u !

- v 1

- a

.a _a_ 4 J -

2_ .

/ l i

i G

l l

i

- 1 i

j e

F n .. .

1 I R f .. .

FJ M f f.tflA f WRM.

.l.i,f t.

l s

E

/.A..

=u D

t stunt .ceves 1

C

.034 I I I , I .-

.l .a..s. .m.L., L..~tai ..

e,s.v.i re.m ano L.t o, 7v.a.r Patutwa

. . n, f.s.yn

. .# s.e.rce..ef

. . . .A.Ita s.ee.t.ati.e< ecs a

.PM. ,.t..iWettf

. . .P18 .. . . . . , .

2; B

n TI

.)

. . - c.

. ~ . .

- - . , l

.n..,

, . . . APERT.URD u CARD Fette f .*t . R4tt f a , L. f. .Pt. Att Also Available On

^

berture Card 1

. una .x.n WESilNGHOUSE I

. * . . . e ..i MOV 8702 MOD 1F1CAi10N 1

FIGURE B-8 15,54 2-APR-86 gyor//of13 H 6 j 5 l 4* l 3 l 2 i B-27

- - - - -it. -

.ina..*is - m - -

. _ _ _ _ _ . _ _ _ _ . _ _ -i . , , _ , , _ _ _ _ , , , _ _ , _

en,e

,a -

i l3- l2 ll l IU f 9 O [

't -

II eien tematism f at98 #DW

]& 8789 IS SPES

)

G

?

5 --

i -

, - I e

ei r tuft f asts

- sepe SPla n s'ustt t GPtse it tLett age T

OPitatet Falta

9 Bf f ff f ll b

i* F

[ [1 4 esas eat s l

5 h-t l

I ~ l I I l

9Pt4AION Fall $ SPttafM Fall $

1 F.t ta.'.#R f,a.lL S. 4W9 9. '43, f aL.Ft f ,

> .i a,( .

.Pt ..

CL mo. t .er atit f 3

. .f. n. ..

eu, m .v.

.. w,u,

,i. .ia Sett l6m gf ateg Liesef AL afM E

een m.

Gete Self 00Je Ritenter storester 4 . 8060f -43 8.teest 43 4 todet es e.seest el

- l l PHis see finr sessart es#ena part reaks to tanter setups ytnaten rasts f AasPenI f f f 0 constaLLf SPts (Lett le statellst f6 Mftsf fallo acD SPtB esept f d FSA HBF G756 Ilmene Petitles CMraf t CLtite fla A6aAM D

O 9919 Mi 3 Han l , 40eg es6e 1 m. >.a ,,,,.,, ,,e.. uu

..u.=., . . .u . m.t ...

8 Seest*86 0.60008 el O Geset St

-- 1 I I P9f tSunt . 8 Pts tentatt f alLUst is PawEt Faltelet gettag ,

f tpartnafunt Clew s tittyt t lg IR8'RUDEstaf tm gonnasLS SPEG CIRCUl f fall 20slaffl 98soff C

m.

9006 00e 8 0032 O s S4Cee t .0200s -08 8 00eW 01

- I l I f stka' costart spun neus att teacust f aaeroeste stret PMeistung f ut enq6 L a nt i svi rtse C. )

OppoggLt gPg3 4ctgaelag gegen ggvaggt paigg p aste gpts evinL S46 fMSdt SWifCR 88108f 8 SPUtitutLT SPtst Mftti SPtf P9teta'tlitfLf EPEG B

m, .. m. .ui f3

-,. n 96 t7 409000 S t 40$ tt Ff esttf Rif uW Raat ted 4 )Seet $f P 30eet GF $400M-N I DMM 95 8. eccet -81 0 0000f 91 0 000et 01 6 9000f *GI $ 0000t -91 9 Deter-el

_ i i ePta=* on sposteus f air sonoot suisses Linst svi P9.f.ftaf.U4th..f GF tis

.uao.CWil ,Sa m ..ff.g>ts.s Pt.a.t ,IJae.0*tetee m .. Pt.a t ,

A

- , , .. . . i

..t. m., ...u. m.u ,

. .u .. .

..t... . . . ... ! ;

. 09 ..t .,..I . - . . . ..,-

13 l 12 l. II l 10 l 9 l 8 l 7 i

l 1

%W

- . - - - ~- - -d

/

j._ ca s i c i r i 2 T i C

1 l

l F

E i

4..

D I I _

=, c.=:-

]:.:w,=.

C u.b I I l l l _

-, _. m.

e TI

...... . . . , ...... ...... . . . . ...... MPERTUltE

. .., C,(g.g Also Availab;e o, Aperf ure Card WESilNCHOUSE !

HOV 8701 NRC NODIFICAil0N g 7p((/d [ Y FIGURE B-9 15:55 2-APR-86 6 l 5 l 4 l 3 l 2 i B-28

%e A l

L_. .U.- .$ L- . $ $ l ene itotatIe4 WM TG IIBf 3Pg3 53 0*tu C

/'

soni e

- I , I es,e eter entri raais se

%#v819 Ult f #*(tit (tett 499 SPt#48W f att$

99 M 't(#

F (3 [3 e.. .

~

- 1 I j ,an. ..u t . ..e. este, ,an s f. u a..a ait. .sia , ait, to arrett revte ePweievst t stess enefs to ef ffff emene t0 Of'Ett vesse Ffo# $4Af WII GPfNg gPl p a f9R fgegg fllllM V13 Fl4 94f sete Ovif tse Stalpl Ligest Pg$l,f ag sg e i$9 E

T eaa un.

9034 set t 60 JS SM9"f ftDE A3pPeggt 1 5000f 6J 0.eseg.g3 e esent Si 8.eenst-si

- l l eat ssues rates rans 90 98 4* set fit A toweur es tois soeutt erte st est r ait unt occvas is fl#Culfet errantee s eats F0 NTEtt YM OP Falts asp pris siseef 5 Fee tent test aptege Petities EDuf uf (199f t via atamel D

TT .0.. .. .e . ,

9009 Gen e

\ en.. .a. .....e eu... at u

..e, , a .., , e a e, 9 S0006 06 0 0000f 98 9 9000f-8B

- 3 1 1 Pet ssist eers sostact pastung as Posts pastvet occurs _sist itSteiaW4f afl0W CL 8tt i Eltruit 15 Lini fatt$ seewLt OPf 5 flStUl f f alN COWlaC?$ S0808f fRM C

ego, 000s nos s 00 3 R3 spree 4 .prosf -s e e soost si

- 1 I l l _

satae coelacf savaisus aae caprunt ll teswere**us rest Patrulvet emin% tenis switcy ano ten eOamtf eere utvatise enf ance f site asus eers sec essas tesour swissa er t'80e 'l 36 044L $PWWl905t f SPtus Dis nct SPt s petstatisagtf OPit B

(. . .O

.e . . ,9 o,e

. un

. . .. .O n ...... e e u ,, . , , . , . . . i 9 . 4 799f -0' 3 6004(-SP 9 5000E 90 0.StioM 89 81000ef 09

& S000f OI 4.SOO4f es S 409ef 81 9 90ect 81 9 SetM -St pe ta nt sea 00g swif th eu as.esppf a a , .u f , tiniest.f einv im f.i Lnain.e twSul.

Gates P9sfL4 tot Bet astE f alls 96 BPitaff f alt $ 10 SPf eaff eta F 90:0 0934 00J8 R2ctOf g parea speg n e gy p at s nafig 6 J900f -03 8.0000f -94 0.0000f 44 6.000ef 64 0 96991 91 0 9900f-91 9 9840f -De 9 9000f Si

~ -,

g#

j J j ; g ;

G F

E 7 -

,,m.1 14tf f

0 J.

r-I l -

}mee.uest.

w r.et 4 staasunt.f af t.u s.aan 1 .ptna tteass.

M..f,.i ttee F AIL.tet.W L

7 7

l **E3 3.

en.

IX! \ H g gg gy,g

...'.s f .. t Et g goggg.,,

. .e.er -.s 1 I I I I -

twi sesos a,saste attas soit 0E .st* C'. it F41L Wilt c.es3ect.es F4lL f oce s at t a.tf.sen s ac s F ALL Fell UR( P.at i 9f s.sunt i

'l TW AR$P(B iW438F E. f Alk. Ult.f 4fl

r. . ,. .. . .,

B TI A.PERTCh'h' cay.9 j Ao Ara;;,5;c 9n A Aperture Card ,

1 l

WEST 1NGHOUSE !

HOV 8702 NRC MODIFICAfl0N g / ((""! 3 FIGURE B-10 15:56 2 - /.PR - 8 6 6 I 5 4 3 2 i 1 1 1 B-29 4

APPENDIX C RESIDUAL HEAT REMOVAL SYSTEM (RHRS)

AVAILABILITY ANALYSIS l

I I

l l

e' 4 j I

I l

0058v:1D/112486 l

1

l l

APPENDIX C RHRS AVAILABILITY ANALYSIS ,

i ,

.- The residual heat removal system shown in Figure 4.1 was analyzed to determine the unavailability of the system to remove decay heat. Fault trees were used to determine unavailability for startup of the RHR system, for short term cooling (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) and long term cooling (6 weeks).

C.1 Fault Tree Development Guidelines were used in the construction of the fault trees to simplify and reduce the overall size of the fault trees since certain events are often not included owing to their low probability of occurrence relative to other events.

The following guidelines are described and the system components affected by the guidelines is discussed.

Random Fault Postulation and Consideration

~

Guideline a. The " local faults of piping" in a fluid system segment are not to be included in the fault tree model construction, since their contribution to the probability of system failure, compared to the contribution from the other components, is i insignificant. Pipe faults such as pipe plugging, orifice plugging and plugging from chemical crystallization due to loss of pipe heat tracing system are to be considered as credible ,

faults.

AFFECTED COMPONENTS: Piping faults will not be considered.

Guideline b. Random mechanical failure of locally locked open manual valves are not to be included in fault tree development since the 1 probability of failure is not significant relative to other {

. valve faults. The only credible random valve failure that j might occur is plugging of an open valve, but this is only 2

0058v:1D/112486 C-1 l l

I' significant if the source of water or other fluid is untreated (e.g., service water, etc.) and if the likelihood is comparable or greater than other system faults. Failures of unlocked manual valves will be included in fault tree development along

with locked open active valves (which are rare) that are locked at the control board. Disposition of locked open manual valves due to human error is considered unlikely due to locking mechanisms employed (e.g., chained locked or other mechanical devices) on most valves.

AFFECTED COMPONENTS: Vcives 8728A, 87288, 8720A and 87208 are sealed open and thus closure of these valves is not considered a credible fault.

Guideline c. Normally open manual, air and motor-operated valves that are not required to change state during operation will be treated as if they are locally locked open. However, disposition of !

- the valve prior to operation due to human error and/or a

- spurious control signal will be considered as a credible event if applicable (see treatment of test and maintenance faults to follow).

AFFECTED COMPONENTS: M0V's 8809A, 8809B, 8700A, 8700B, 8716A and 8716B are normally open valves that do not change state !

during RHR operation. Spurious closure of these valves during long term cooling with be considered.

Guideline d. Potential flow diversion paths of fluid system that are isolated from the main flow path by one or more locally locked closed valves will not be considered as faults of the system.

AFFECTED COMPONENTS: Manual Valve 8741 is a normally locked closed valve on the return line to the refueling water storage tank and thus is not a credible event.

i 0058v:1D/112486 C-2 1

j

i Guideline e. Potential flow diversion paths isolated from the main flow path by normally closed manual, air, and motor operated, and check valves will not be treated as faults of the system. However, valve disposition prior to operation due to human error and/or spurious control signal will be considered a system fault, if credible.

AFFECTED COMPONENTS: Motor-operated valves 8804A and 8804B are normally closed valves in the lines loading from the discharge side of the RHR heat exchanger to the suction side of the centrifugal charging pumps and safety injection pumps respectively. Motor operated valves 9003A and 9003B are normally closed valves in the lines from the RHR heat exchanger to the containment spray system. These valves are not considered.

Guideline f. Check valves failing closed to flow in the forward direction !

- and failing open to flow in the reverse direction will be included as credible events. An exception is made for the case of two check valves in series being used as isolation valves to block flow. These need not be included in fault tree development since their combined probability of failure to i isolate flow would be of low probability relative to other system faults.

AFFECTED COMPONENTS: The check valves on the cold leg

{

injection lines are two check valves in series and are not i 1

considered to fail open in the reverse direction.

Guideline g. Tank failures are to be included in fault tree development, but failure of heat exchangers (coolers) to transfer heat due to plugging of the tube side and leakage (primary to secondary) !

are not. An exception is made for the case of heat exchangers plugging when the tube side flow of coolant transfer medium is j

. untreated. Plugging is to be considered as a credible event for such cases if the coolant medium is urtreated.

00s8v:1o/112486 C-3

1 p

AFFECTED COMPONENTS: Failure of the heat exchangers due to plugging or' leakage is not considered a credible fault.

C.2- Quantification

~

.The availability of the residual heat removal system to remove decay heat is considered in three phases in this analysis. First, the RHR system must be placed into service and go through a warmup period in order to minimize the thermal shock to the system. Secondly, during the initial phase of cooldown.

the decay. heat load is high. For this phase, two trains of RHR are required for 72. hours. (Note: some plants can operate with only one train during this phase but the cooldown time is increased). The final phase of cooldown is long term decay heat removal. Six weeks was the timo period assumed for this phase (based on the average refueling outage time period).

The fault trees developed for these scenarios are shown in Figures C-1 to ;

C-3. Figure C-1 shows the fault tree for the startup of the RHR system. The

- fault tree in Figure C-2 depicts the initial phase of cooldown in which both

- trains of RHR are required. The long term cooling fault tree is shown in Figure C-3 (only one train of RHR is required).

Figure C-4 to C-8 show the detailed fault trees for motor-operated isolation valves 8701 and 8702. These trees are developed using the present interlock !

configuration and the two modification configurations. The unavailabilities calculated from these trees are input into the cooling and startup trees to calculate the system unavailability.

Assumptions The assumptions used to develop the fault trees are presented below.

1. Injection into two cold legs by two pump trains is required for success for the startup and short term cooling scenarios. Injection into two cold legs by one pump train is required for long term cooling.

0058v:1o/112486 C-4

1

2. The startup fault tree was derived using the operating procedures OP B-2:V.

3. The initial phases of startup and initial cooldown fault tree require two trains of operation. Therefore, no testing or maintenance operations are

assumed to occur during these phases.

4

j. 4. In the long term cooling fault tree, test and maintenance can occur.

Therefore, spurious closure of valves and operator error in mispositioning of valves is considered credible.

5. During the warmup period, it is assumed that pump No. 1 is started first

, and must run for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Pump No. 2 is started after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of warmup and must run for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

6. For long term cooling, it is assumed that pump No. 1 is operating and pump No. 2 is on standby and thus must start and run.

- 7. All electrical power (AC and DC) is assumed to be available.

C.2 Data Table C.2-1 shows the basic event probabilities used to calculate the unavailability of the RHR system. The formula used to calculate the basic event probability is

0 = 1 Tm where Q = basic event probability 1 = failure rate for component Tm = total defined mission time in which the component

. must operate 005Bv:1D/112486 C-5

Tae' unavailability of RHR pump 2 due to test is based on the technical

- specifications which allow for a two hour unavailability limit. Maintenance unavailabilities were extracted from the Zion PSS for standby systems tested monthly or quarterly assuming a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months component inoperability time limit.

The human' error probabilities (HEPs) are-calculated for each operator action I required during RHR operation'and are presented in Table C.2-2. The HEPs are

. extracted from Swain, et.al.

C.3' Results The results from the quantification of the fault trees is shown in Table

~

C.3-1. The dominant cutsets.for each case shown in Table C.3-2.

I l -O i

l

<4'

..- J 00581:1D/112486 C-6 I

, j ;) ii i I! !)

+

$ m r r m

e e t t p p u u g s s i t t t t t r r r o o a r

a s n h h t t -

y e s s s s l

a m m

r r r r -

n o o o o o -

A C f f f f

[

7 t

n t e i y - -

v l E i t

l b

b a -

4 4 4 4 4 4 4 4 4 4 4 4 6 6 5 5 3 3 E E u o - - - - - - - - - - - - 1 1 - -

a r E E E E E E E E E E E E E E F P I 1 1 1 1 1 I 1 I 1 1 1 2 2 6 3 S -

E I s n T n r r I o u u L i o o s I s e h h r r B s m - - - - - - - - - - - - h h A i i 2 2 L M T 7 7 2 1 I

A V

A N

1 U 2 E n R o l d d d d d d d d d d d d C U i a n n n n n n n n n n n n L t v a a a a a a a a a a a a '

E L

I A

t c r l e e m

e de m em em em em eme me me me me m- - - -

.. B F u t t 'd d d d d d d d d d d A a e nI T M F D 1 1 1 1 1 1 1 1 1 1 1 1 O

n D N

A R

T N r r r r E e N r d d d d d d d d d d d d h h h h O u //// / / / / / / / / / / / /

P l e 4 4 4 4 4 4 4 4 4 4 3 3 5 5 5 5 M i t - - - - - / / - - - - - - - - -

O a a E E E E E E E E E E E E E E E E C F R I I 1 1 I 1 1 I 1 I 3 3 3 3 3 3 L

A V

O t t M

E n n n n n n n n n n r r R e e e e e e e e e e a a n n p p p p p p p p p p t t u un unu T O O O O O O O O O O S S R R R R A

E o o o o o o o o o o o o o o o o t t t t t t t t t t t t t t t t H

L e e r r e e re re re rer er er er er er e e e e A

U r

u e

u u r u u u u u u u l u u u u rur ur u l l l l D l l l l l l l l l l l l I i d i i i i i i i i i i i i i i i i S

E a o F M a a a a a a a a a a a a a a a a F F F F F F F F F F F F F F F F

' R e

e e r D A

D A

D B

D D D D D D D B C C D D B A s r i 8 8 8 8 8 8 8 8 D 0 S S e

s

. : T f 4 1 4 1 4 1 4 1 3 3 a

?

M i 9 8 9 8 9 8 9 8 7 7 A A X X X X e o

E t t 8 8 8 8 8 8 8 8 8 8 1 2 1 2 I I -

T l n V V V V V V V V V V M M M M M M e.

S u e C C C C C C C C C C P P P P P P Y a d I I I 1 2 2 2 2 2 I I 2 I 2 1 I m S F I R R R R R R R R R R R R R R R R e 9"

.ll ]I Il1 I ll ll 1jl J

m r r m e e t t s s g g i t n n s n y e l o ol

. l m

. a m r r n o o o A C f f t y n t e i v l E i 2 2 4 b - - -

t a E E E l b 3 3 3 3 2 2 3 3 3 3 4 3 3 4 3- 1 u o - - - - 0 0 - - - - - - - - 0 a r E E E E E E E E E E E E E F P 3 3 3 3 3 3 3 3 3 3 1 3 3 1 3 1 S

E I s s s T n r r r I o h h h L i I s e 8 8 8 B s m - - - - 0 0 -

0 0

- - - - - - - - 0 0

A i i 1

L M T 1 1 I

) A t V n A o

C :N

(

E n 1 R o l d d d d d d d d d d d d d

- U i a n n n n n n n n n n n n n 2 L t v a a a a a a a a a a a a a

I t c r m m m m m e em em em em em ememe m- -

C A l e e e e e e - -

. F u t t d d d d d d d d d d d d d E a e nI 1 1 1 1 I 1 1 1 1 L M F D 1 1 1 1

. B O

, A D T N A

R T

N r E e r r N r d d d d h h d d d d d d d d d h O u / / / / / / / / / / / / / / / /

P l e 3 3 3 3 5 5 3 3 3 -3 4 3 -3 4 7 - - - - -

M i t - - - - - - -

O a a E E E E E E E E E E E E E E E E C F R 3 3 3 3 3 3 3 3 3 3 1 3 3 I 3 1 L

A V e e t e t e s O t t a e e a e e -

M a a _

E n n r r n n n n r s s r s s R e e e e n n e e e e e o o ep lo o p p p p u u p p p p p l l l T O O O O R R O O O O O C C O C C A o o o o o o o o o o o o o o o y -

E H t t t t t t t t t t t t t t t l s

L A

e r

er r e re re re re re re re re re rerer er eo u -

U u u u u u u u u u u u u u u u u i r -

D l e l l l l l l l i i i i i i i i i i i i i i i u l l l l l l l l I i d a a a a a a a a a a a a a a a p S a o E F M F F F F F F F F F F F F F F F S _

R

+

e r 4 5 D D V e e 0 6 6 D D A B A 6 r i D 7 3 3 A B D D 6 K K 6 K 9 8

T f 8 3 W W 1 1 0 0 2 8 8 2 0 0 6 0

M i 3 3 C C X X 42 46 76 76 76 3 8 3 6 6 7 87 68 8 4 0

E t t 6 6 C C I 6

T l n V V X X M M V V V V V V V V V V m S u e A A H H P P M M A A X A A X A M I 2 2 1 I 2 I 2 I 2 1 2 I 2 I I 7

0 Y a d 2 S F I R R R R R R R R R R R R R R R R 0 n*

! , l! jll'

u

=

s s i t s n y e

.. l m a m n o A C t y n t e i v l E i 4 4 4 4 4 b - - - - -

t a E E E E E l b 1 1 1 1 1 u o 0 0 0 0 0 a r F P 1 1 1 1 1

._ S E

I s s s s s T n r r r r r I o h h h h h L i I s e 8 8 8 8 8 B s m 0 0 0 0 0 -

A i i 0 0 0 0 0 .

L M T 1 1 1 1 1 I

) .A t V n .A o N C U

(

.E n 1 .R o l

- U i a t 2 L t v I t c r C A l e e - - - - -

. .F u t t E .

a e nI L M F D

. B O

. A D T .N A

R T

.N E e r r r r r

.N r h h h h h O u / / / / /

P l e 7 7 7 7 7 M i t - - - - -

O a a E E E E E C F R I I 1 1 1 L

A V

O s s s s s M e e e e s s s s s e

E R

l o o ol o l o l l

T C C C C C A y y y y y E

H l l l l l s s s s s L e r

u u u u o o o o u

o A

U u i i i i i D l e r r r r r I i d u u u u p p p p p u

S a o E F M S S S S S R

e e e r V 8

v A

V B

V A

V B ;

'. ri 9 6 6 0 0

T f 0 1 1 0 0 L M i 8 7 7 7 7 L E t t 8 8 8 8 8 8 T l n V V V V V =

S u e M M M M M F 0

Y a d 2 1 I 1 2 2 0

S F I R R R R R o* .

i t o s n f y e l m e

. an o m t a

A C R g

t y n t e i v !

E i 4 6 b 8 7 7 7 6 -

t a - - - - - E E l b 0 E 6 6 4 4 4 5 6 4 E E 3 E 1 u o 0 0 - - - - - - - - 6 0 - 2 0 3 3 a r E E E E E E E E E F P 2 7 6 6 1 1 1 3 6 3 2 3 3 7 7 9 1 S E E S I O T L n I C o s s s L '

i s s s s I Y s e r r r r r r r B L s m h h h h - - - - h - h h -

A S i i -

L U M T 2 2 2 2 2 2 2 I O

) A I t V R n A U o N P C U S

( ~

E N n -

s 1 R E o l d d d d d d n r

- U P i a n n n n n 2 L O t v a a a a a a s h s h I t c r m m m m m m r C A O l e et .

e e e e e e h 8 h 8 F T u t - - - - d d d d - d - - d 0 E a e nI 2 0 2 0 L M L F D 1 1 1 1 1 1 7 1 7

'* B O I

, A D A T N F A

R -

T 1 r r r r r N 0 h h h h h E 7 e / / / / r / r N 8 r 8 7 6 6 d d d d h d 7 7 d h - / /

O u - - - - / / / / / / -

P V l e E E E E 4 4 4 5 6 4 E -E 3 7 3 5 - -

M 0 i t 0 5 0 0 - - - - -

O M a a E E E E E E E E C F R 1 3 3 3 1 1 1 3 3 3 1 1 3 1 -

L n A e p

V O O r r r r M s s e e e n E n -

n f f f e R e p

n e s s s e e p n n n s f

s i

a T O p O a a a o e n n m A O r r r l r a e e E y y T T T C u r h h p R H l el l T g g O s r s o o o o i i i o L e u u u t t t t a o H H o t A r o t o F t s s t

s U u i s a i s s s s D l e r l m r l l l l l l l l l l I i d u i e u i i i i i i i i i i S a o p a r p a a a a o a a a a a E F M S F P S F F F F C F F F F F R

e r H e e K K K K X 0 V

c. r i C O O A h H 1 1

T f U B T B K F 0 5 4 0 0

_

M i U 9 3 3 3 N 0 2 0 5 7 7 E t t n

B F U 4 3 3 3 C C 4 4 4 8 8 C T U L S S S R S N P T V V T l A C F 0 L Q L S M C T TI IN1 M S u e I I 1 1 1 1 1 I 1 I 1 Y a d S F I R R R R R R R R R R R R R R 7$

r E 1

!il3 ! .

) ji1 i!l1l s s i t s n

y e -

l m a

n o m

A C g.,

~ _

.t y n t

~ e i

.v l 6 5 6 5 5 4 E i b - - - - - -

t a E E E E E E

) l b 4 2 4 2 8 1 u o

d. 9 7 9 7 0 5 z e

u a r F P 1 2 1 2 1 1

n. -

i .

t. . E

n. S o_ O

~

c. L n

~

( C i

o S Y s e

^

E L s m - - -

I S i i T U M T I O

. ) L I t I R n B U o A P

. C L . S

. (

I n

A N s 1 V . E o l s s

.. - A P i a r . r r

. 2 N O t v s h s h s h U t c r r r r -

C -

O l e e h 8 h 8 h 8 0 - 0 i E E

R T

, u t t a e nI 0

2 0 2 0 2 0 L U L F D 7 1 7 1 7 1 s B L I

- , A I A

. T A F F -

N r r r O . 1 D 0 h h h N 7 e r

/

8

/

8

/

7 A . 8 R u - - -

V l e E E E T .O i t 7 7 5 N N a a E F R 2 2 1 N -

O P L M A O V C O M

E R

T A

E h H g i

L e s s H

A r U u t t s D l e r r l I i d c o i

_ S a o h h a

- E F M S S F

_ R -

e r e e Q C

V H

6 0

r i 0

T f Q A 4 0 M i N 2 5 4 0

E t t C 4 4 6 T l n R N T s S u e S C T I

7 0

Y a d I I 2 S F I R R R 0 70 i !

it o

. . sn f ye l m e am no t

a AC-R t y nt ei vl Ei -

4 6 4 6 5 6 5 b 8 7 6 6 7 6 - - - - -

t a - - - - 6 - - E E E E E E E l b E E E E 4 4 4 5 - 4 E 3 E 1 6 1 4 2 4 2 uo 0 0 0 0 - - - - E - 6 - 2 0 3 3 9 7 9 7 ar E E E E 0 E E FP 2 7 6 6 I 1 1 3 6 3 2 3 7 7 9 1 1 2 -

1 2 S E E S I O T L n

- I C o -

L i . s s s s s s I Y se r r r r r r B L sm h h h h - - - - h - h - - -

A S ii L U MT 2 2 2 2 2 2 I O .

)' A I t V R n A U o N P C U S

(

E N n -

1 R E oi d d d d d d s s s

- U P i a n n n n n n r r r 2 L O t v a a a a a a s h s h s h s h I t cr m m m m m m r r r C. A O l ee e e e e e e h 8 h 8 h 8 h 8

. F T utt - - d d d d - d - d . 0 0 0

- E L aen 2 0 2 0 2 0 2 0 L M L FDI 1 1 1 1 1 1 7 1 7 1 7 1 7 1 B O

. I -

g A D A

.. T N F A

R -

T 1 r r r r r r r N 0 h h h h h h h E 7 e / / / / r / r / /

N 8 r 8 7 6 6 d d d d h d 7 d h 7 8 O u- - - - - / / / / / / - / / - -

P V l e E E E E 4 4 4 5 6 4 E 3 7 E E M O it 0 5 0 0 - - - - - - 3 - - 3 7 O M aa E E E E E E E E C -

FR 1 3 3 3 I I 1 3 3 3 1 3 I 1 2 L n A e p

V O r r r O M s s e e e r n

E n n f f f e R e p

n e s s s e e p n n n s f

s i

a T O p O a a a o e n r a n

e e m

A O yT r r r T T C u l

r h p R h E y g H l e l l T g O o

s r s o o o o i i i L' e u u u t t t o

t a o H o t H s

A r o t F t s

t s

s t U u i s a i s s s s r

D l e r l m r l l l l u i e u i i i i i i i i i l l l l l l i o I id a S ao p a r p a a a a o a a a a h E FM S F P S F F F F C F F F F F S R

l' V er H ee K K K K X 0 V X ri C O 0 A A 2 2 B Tf U B T 8 K F 0 5 0 0 5 Q

_* M i U 9 3 3 3 N 0 2 0 7 7 0 N C

E tt B F U 4 3 3 3 C C 4 4 8 8 4 P R T l n C T U L S S S R S N P V Y S S ue A 2

C F 0 L Q L S M C T M M 2 2 2 2 2 2 2 2 2 2 2 2 T

2 2 Y ad R R S FI R R R R R R R R R R R R R 73 c E

.. S d a n S e u o y

. S n t q p t P o s . m i

, i e r o l n t t o c i

's s o u b i t s n i b s y Z i m l

'ru r a

, y e r e h o e t l m t t t h p i o m a m o s s n n o r i y o 2 n i A C F D S m7 i l e

c n

a y n t e i t l n i i b a S a M

_ E l 3 I i o -

T a t E I v 7 L a e 5 I n u B U D 1 A '

) L t I n A r o V u C A o

( N h U r /

1 u s

- E e o t 2 C c H n

-- N n e C A a r v v N n e E E E e P -

L T t E

._ B N n n s 2

, A I a i t 4

_ T A e a c M M M A 8 T

N E t N n O e P v M e O /

C s e r r m i u i a o L T p h A e V n R 7 O a M e o 8 E M t 1 R

T A

E n H o 2 i

L t .

7 A p o U i N D r p I c S s m E e u R D P

+

e r e e N

, r i I

T f A

i. M i M E t t 2 T l n N S u e P Y a d 2 S F I R nC

s . .

s p

1 m

- u

. _ 4 p

'n

- o 1 r i ) o t 4 y f a l r 3 r t u e s

~

d c t e e r t t p a s S u l e Q a s s t h ( n i t c o s n r e y i y e u T a t l o d c a m h r n n o 2 p 9 f e 2 u A C-T S

E y T t i

O l e g

T i b a E a t

) U l u 4

_ t D i O -

n a -

E o

_ i S v m t 6 C E a o s 0 n r e

' ( I

. 1 T U F T 9 1

1 I

- L 2

q I

B C A L

E I L A B V A A T. N U -

T N

E l N a n s O v e y P r e st a M L e w s d

O A t t C V n e e 2

~

O I B T 9 M

E R

T A f E o H

n L e o s A g i r U a t u D r a t o I e r s h S v u e E A D T 2 R -

e r e e T

., r i

T f 3 M t t i T E 2 T l n M S u e F Y a d 2 S F I R 9 n%

9 TABLE C.2-2 HUMAN ERROR CALCULATIONS

~ 1. Operator' fails to close air operated valve 638 or 637 or 670.

.e

1. Omission error -

operator fails to close MOV HEP = 0.01 Table 20-7~no checkoff provisions, long list, > 10 items

5. Commission error - turn switch in wrong direction HEP = 0.001 = 0.0002 Table 20-12

3. Recovery error - checker fails to detect errors by others HEP = 0.05 Table 20-22 special short-term 0.99 Ay=0.01

~*

,. A2=0.0002 A 3 =0.5 A 3 =0.05 P=0.01(0.05)=5E-4 i

P= 0. 9 9 ( 0. 0 0 02 ) ( 0. 0 5) =9. 9 E-6

'POE = 9.9E-6 + SE-4

= 5.10E-4 Fault Tree Identifiers: R2AV6370E RIAV6380E RIAV670KDE l cx . i .omie C-15 ;

i

in TABLE C.2-2 (Cont)

HUMAN ERROR CALCULATIONS I 2. . Operator f ails to open air operated valve 637, 638, 670, CCW valves

1. Omission error -

operator fails to open MOV HEP = 0.01 Table 20-7 no checkoff provisions, long list, > 10 items

2. Coinmission error - turn switch in wrong direction HEP = 0.001/5 = 0.0002. Table 20-12

3. Recovery error - checker f ails to detect errors by others. I

- HEP = 0.05 Table 20-22 special short term

~

O.99 A y=o,ol A 2 =0.0002 A3=0.05 P=0.01(0.05)=5E-4 l

p=0. 99 (0. 0 0 02 ) (0. 05) =9. 9E-6 {

J POE = 9.9E-6 + 5E-4

= 5.10E-4 R2AV63700E j Fault Tree Identifiers: RIAV63BDDE R1AV6700E R2ASV6700E )

R2HXCCWDE R1HXCCWOE )

i l

.,...~" C-16

f TABLE C.2-2 (Cont)

HUMAN ERROR CALCULATIONS k

~

2. Operator.' fails to open air operated valve 637, 638, 670, CCW valves

1. Omission error -

operator fails to open MOV HEP = 0.01 Table 20-7 no checkoff provisions, long list, > 10 items

2. Commission error -

turn switch in wrong direction HEP = 0.001/5 = 0.0002 Table 20-12.

3. Recovery error -

checker fails to dete:t errors by others !

HEP ='0.05 Table 20-22 special short term i 0.99 Al=0.01 A 2 =0.0002 A.3 5 x3=0.0s P=0.01(0.05)=5E-4 p=0. 9 9 ( 0. 00 02 ) ( 0. 05) =9. 9E-6 POE = 9.9E-6 + SE-4

= 5.10E-4 Fault Tree Identifiers: R1AV63800E R2AV63700E RIAV6700E R2ASV6700E R2HXCCWOE R1HXCCWOE dos 8v:10/112486 C-16

i TABLE C.2-2 HUMAN ERROR CALCULATIONS' L *.

1. Operator fails to close air operated valve 638 or 637 or 670. ;

1. Omission error -

operator fails to close MOV i HEP = 0.01 Table 20-7 no checkoff provisions, ;

long list, > 10 items i

5. Commission error -

turn switch in wrong direction i

0.001 HEP = = 0.0002 Table 20-12 5

3. Recovery error -

checker fails to detect errors by others HEP = 0.05 Table 20-22 special short-term

~..

O.99 Ag=0.01 A2=0.0002 A 3 =0.05 ^3"O*5 P=0.01(0.05)=5E-4 P=c . 9 9 ( 0. 0002 ) (0. 05) =9. 9E-6 POE

9'9E-6 + SE-4 .

= 5.10E-4 Fault Tree Identifiers: R2AV6370E RIAV6380E RIAV670K0E e

0058v:1D/112486 C-15

p

, TABLE C.2-2 (Cont)

HUMAN. ERROR CALCULATIONS i l *.

3. Operator fails to open manual valve 8726A, 8726B operator fails to open XV

1. Omission error -

HEP.= 0.01 Table 20-7 no checkoff provisions long list, > 10 items

2. Commission error . making an error of selection HEP = 0.008 Table 20-13 ambiguously labeled part of a group of valves

3. Recovery error -

detecting locally operated valves HEP = 0.005 Table 20-14 rising stem only 1

4 0.99 A l =0.01 A 2 =0.008 A3=0.005 A3=0.005 P=0.01(0.005)=5E-5 P=0. 99 ( 0. 008) (0. 005) =3. 9 6E-5 I

POE = 3.96E-5 + SE-5

= 8.96E-5 Fault Tree Identifiers: R1XV8726A0 R2XV8726B0 4*

1 6 0058v:1D/112486 C-17

l T.

TABLE C.2-2 (Cont)

HUMAN ERROR CALCULATIONS

, 4. Operator inadvertently closes valve (motor-operated or air operated)

~

1.- Commission error -

select wrong control HEP'= 0.001 Table 20-12 well-delineated

2. Recovery error -

' detect closed valve HEP = 0.2 Table 20-22 routine tasks

3. Recovery error -

basic walk around detection HEP = 0.52- Table 20-27 daily walk around Al *0.002

~

0.8 A2 =0.2 A3 =0.52 A3=0.52 P=0. 001 ( 0. 2) (0. 52) =1. 04 E-4 P= 0. 001 (0. 8) (0. 52) =4.16E-4 l

POE = 4.16E-4 + 1.04E-4

.- = 5.2E-4 Fault Tree Identifiers: R1HCV6380E, R2HCV6370E c m . t w eie C-18

l s-

i. TABLE C.2-2 (Cont)' !

HUMAN ERROR CALCULATIONS

5. Operator fails to open MOV 8701 or 8702

1. Omission error -

operator f ails' to open MOV HEP =.0.01 Table 20-7 no' checkoff provisions,.

long. list > 10 items

2. Commission error -

turn switch in wrong direction HEP = 0.0005 Table 20-12

-3. Recovery error -

checker fails to detect HEP = 0.05 Table 20-22 special short term O.99 A1=0.01 i

A2=0.0005 A 3 =0.05 A3 =0.05 P=0.01(0.05)=5.0E=4 P= 0. 9 0 ( 0. Go05) (0. 05) =2. 4 8E-5 POE = SE-4 + 2.48E-5

= 5.25E-4 Fault Tree Identifiers: R1MVB7010E, R2MV87020E I

,s C2L'ait-08068t (*}Q

l~ TABLE C.2-2 (Cont)

HUMAN ERROR CALCULATIONS

6. Operator fails to close breakers for MOV's 8701 or 8702

1. Omission error -

operator fails to close breakers HEP = 0.01 Table 20-7 no checkoff provisions, 4 long list, > 10 items !

2. Commission error -

select wrong circuit breaker HEP = 0.005 Table 20-12 densely grouped !

3. Recovery error -

checker fails to detect error HEP = 0.05 Table 20-22 ,

A" 01

[. l A2-0.005 A 3 "0'05 3"

P=0.01(0.05)=5E-4 P=0. 99 ( 0. 005) (0. 05) =2. 475E-4 POE = SE-4 + 2.47E-4

= 7.47E-4 Fault Tree Identifiers: RIACBV0E, R2ACBV0E e

0058v:1o/112486 C-20

l.

TABLE C.3-1 RHRS UNAVAILABILITIES With Present With With NRC ,

- Configuration Modification Modification MOV 8701 fails to open 5.02E-3 5.02E-3 5.02E-3 MOV 8702 fails to open 5.02E-3 5.02E-3 5.02E-3 MOV 8701 or 8702 Spuriously 6.64E-5 2.22E-5 2.22E-5 over T = 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months MOV 8701 or 8702 Spuriously 9.29E-4 3.11E-4 3.11E-4 Close over T = 1008 hours0.0117 days 0.28 hours 0.00167 weeks 3.83544e-4 months RNRS fails during warmup 2.07E-2 2.07E-2 2.07E-2 :

1

. i

. RHRS fails ever short term 7.11E-5 2.69E-5 2.69E-5

. 1 i

RHRS fails over long term 2.01E-3 1.39E-3 1.39E-3 Total RHRS Unavailability 2.08E-2 2.07E-2 2.07E-2 over short term Total RHRS Unavailability 2.28E-2 2.21E-2 2.21E-2 over long term l

l 0058v:1o/112486 C-21 l

r r e

. e f w k s a n e e a s r r o B T l C

o

- t i t o u t_

c e s .

r s l e s i V o i s l C O l a o i e M C F l a r e C F u s n o t l o e t c o t i l p a t c a C O s t a F l n s t o o i o l n

_ l t t a C i o a F ~

a C c s s y F i l l t a h n i i c l h c n a a a a e c t o h F F t R t i i c n i w t e r r o e w S p M o o C r S n .

i t t u y e S r e a a y s t r p R c v r r a s i a O O s l e e l e m t T e a p p e r i o o U D V O O R P L R 2 t B

- I 3, ls R T

. C i N a O

_ E F C

. ., L B 1 T E K A 0 N D 0 K N K T 7 A 1 E 1 A C O 8 N 0 D 0 0 5 B K I t 7 V 7 2 0 3 N V M e 8 B 8 4 4 3 C O O s V C V N P S R M D t N A N C T L S u I I I I 1 1 I R

C R R R R R R o y t t 3 i -

n l E o i 2 i b 0 t a 8 9 5 0 0 0 6 u l 5 b i 9 4 0 6 6 2 0 i a 5 1 1 =

r v Y

- t a T n n I o U L C I B

A L

I A

V A

y 3 4 4 4 4 4 5 N t - - - - - - - U i E E E E E E E l 0 7 5 0 0 0 0 N

. i 0 4 2 0 0 0 0 A

' t b E e a 3 7 5 3 3 1 3 M s b -

t o u r . . . .

5 6

7 C P 1 2 3 4 nE !

p ,,

r r e

, e f s

, k a n e e a s r r o B T l C

t o i t o u t

- e r

u i

C c

r e

s V

O M

n l

C e

s o

o l

i F

t s

a l

C e

s o

l i

F s

a l o e t c o t i l p a t c a C O s t a F l n s t o o i o l n l t t a C i o a F a C c s s y F a

i l l t h n i i c l h c n a a a a e c t o h F F t R t i i c n i w t e r r o e w S p M o o C r S y

i t t u n r e a a y s s

t r a

e S c v r r a i

) p R s l e e l e m t t O O e a p p e r i o n T D V O O R P L R o o U

.. C t B

( I s R

. 2 l T

- i N 3 a O

- F C C E K 2 T D 0 K N K E 0 N 2 E 2 A C O L 7 A 0 D 0 0 3 B K B 8 N t 7 V 7 2 0 3 N A I e 8 B 8 4 4 3 C T V M s V C V N P S R

. O O t M A M C T L S M D u 2 2 2 2 2 2 2 C R R R R R R R o y t t 3 i -

n l E o i 2 t i b 0 n t a 8 9 5 0 0 0 6 e u l 5 c b i 9 4 0 6 6 2 0 r i a 5 1 1 =

e r v Y P t a n n T I

o U C L I

B A

L I

A V

. A y 3 4 4 4 4 4 5 N t - - - - - - - U i E E E E E E E

. l 0 7 5 0 0 0 0 N i 0 4 2 0 0 0 0 A t b E e a 3 7 5 3 3 1 3 M s b t o u r . . . .

5 6

7 C P 1 2 3 4

s s 2 2 l l 0 0 i i 7 7 a a 2 8 1 8 F F 0 0 7 V 7 V n n 8 O 8 O o o M M i i V V t t O n O n a a M i M i u u s

t t n s n c c i t i t A A r r s o s o 3 5 t h t h 0 0 s s r S r S 4 4 e e o o s s h t h t r r o o S c S c e e l l a a t t C C C t 'C t

) t t A n A n s i i y y 2 o 2 o r m m l l 4 C 4 C h s s s s n n u u t h t h 2 a a o o c c c c 7 n r r i i a t a t

= o T T r r t i t i T i u u n w n w

( t e e p p o S o S p r r S S C C e i u u y y s S r s s e e y r y r

) o R c s s v v a a a a t l O s e e l l a

l e

t o

l e

t o

n C T e r r a R R R R o U D P P V V C y B -

. ( l I s R 2 u T

. - o N 3 i O r C

C u p

. T E S N V V Q Q L A T T 2 1 C C B 2 N C C 0 0 A Q A Q A 0 I t A A 7 7 2 N 2 N T 7 M e 3 5 8 8 4 C 4 C 8 O s 0 0 V V N R N R D t 4 4 M M C S C S r u 2 1 2 1 2 2 I I o C R R R R R R R R 1

0 7

8 V

O o y N

t t i

n l o i

, i b 9 9 9 t a 4 4 8 8 9 u l 2 2 2 2 b i 0 0 0 0 i a 3 3 1 1 r v t a n n n o U o C i

t a

r u

g i

s f 6 6 n y 5 5 6 6 6 6 o t E

E E

E E E E E C i 2 0 0 4 4 4 4 l 2 t i 0 0 2 2 9 9 9 9

n t b 7 1 1 1 1 e e a 2 2 7 s s b e t o . .

r u r . .

3 4

5 6

7 8 P C P 1 2

?

g

's l l s 2 0

1 0

, i i -

7 7

, a a 2 8 1 0

8 7 F F 0 7 V 7 V n n 8 O 8 O o o N M i i V V t t O n O n a a M i M i u u s s t t n n c c i t i t A A. r r s o t s o

- 3 5 t h h 0 0 s s r S r S 4 4 e e o o s s h t h t r r o o S c S c a

e e l l a t t C C C t C t

) t t A n A n s i i y y 2 o 2 o r m m l l 4 C 4 C h s s s s .

n n u u t h t h 8 a a o o c c c c 0 n r r i i a t a t 0 o T. T r r t i t i 1 i u u n w n w

= t e e p p o S o S T p r r S S C C

( i u u y y r s s e e y r y r a

s S c s s v v a a a

) e R s e e l l l t l t t s O e r r a a e o e o n o T D P P V V R R R R o l U C C B

( I y

R

. 2 l T

- s N 3 u O o C i

C. r T' V V Q Q E u N T T 2 1 C C L p A C C 0 0 A Q A Q B S N 't A A 7 7 2 N 2 N A I e 3 5 8 8 4 C 4 C T 2 M s 0 0 V V N R N R 0 0 t 4 4 N M C S C S u 2 1 2 1 2 2 I I 7 0 R R 8 '

C R R R R R R r

o 1

0 7

8 o y V t t O i M n l o i i b 9 9 9 t a 4 4 9 9 9 u l 2 2 2 b i 0 0 0 0 2 i a 3 3 1 1 r v t a n n n o U o C i

t a

r u

g i

A f n y 4 4 4 4 5 5 5 5 o t E

E E

E E E C i 1 1 2 2 2 2

. l 2 2 7

t i 8 8 0 0 7 7 7 n t b 2 2 2 2 e e a 2 2 1 1 s s b e t o .

r u r . . . .

5 6

7 8

P. C P 1 2 3 4 l

g -

1 2 0 0

. 7 ~

7

. 8 2 8 1 0 0 V 7 V 7 O 8 O 8 M M _

V V n O n 0 i

M i M .

s n s n t i t i r r o s o s h t h t s s S r S r e

s e o o s t h t h o o c S c S l l a a -

c C t C t C n A n A

) y y o 2 o 2 s l l C 4 C 4 r s s h u u h t' h t o o c i c c 2 n i i t u t a 7 o r r i c i t

= i u u w r w n A

T t p p S i S o

( p S S C C i y .

y e r e e r y r y s S c v v a a a a o R s l l t o

l e

t o

l e

) l O e a a R R t C T D V V R R n U -

z o y B C l I

( s R u T f

2 o N

~ -

- i O

3 r C

. u -

Q C p T V V Q C C S N 2 1 E A 0 0 Q A Q A L 2 N t 7 7 N 2 N 2

~

B 0 I e 8 8 C 4 C 4 A 7 M s V V R N R N T 8 O t M N S C S C D u 2 I I 2 2 1 r .

C R R R R R R o -

1 0

7 8 .

V O o y n M t t o i i n l 5

t oi -

a i b 7 7 7 E c t a 4 4 7 2

i u l 8 2 f b i 2 2 8 8 8 i i a 3 3 d r v 2 o t n n a =

M -

o U Y d C T n I a L I

n B o A i

t B i a O c y 6 6 6 6 6 6 R P

i t - - - - - -

f i E E E E E E

- i l 0 0 4 4 4 4 N d i 2 2 9 9 9 9 A E

o t b M M e a 7 7 1 1 1 1 s b C t o R u r . . . .

5 6

N C P 1 2 3 4

] I l jll j ll i l I! lll.

)

-. ?

1 2

_ 0 0

, 7 7

, 8 2 8 1 0 .

0 V 7 V 7 O 8 O 8 M M V V n O n O i M. i M s n s n .

t i t i r r o s o s h t h t s s S r S r e e o o s s t h t h o o c S c S l l a a

c. C t C t C

) n A n A s y y o 2 o 2 r l l C 4 C 4 h s. s u u h t h t 8 o o c i c c 0 n i i t u t a 0 o r r i c i t 1 i u u w r w n

= t p p S i S o T p S S C. C

( i y y r e e r y r y e_ S c v v a a a a

. ) s R s l l t l t l

. t o O e a. a o e o e n l T D V V R R R R o C U

. C B

( y I l R

- .. 2 s T u N o

3 O

+. i C C r u T V V Q Q E p N 2 1 C C L S A 0 0 Q A Q A

. B .

N t 7 7 N 2 N 2

- A 2 I e 8 8 C 4 N

C R

4 N

T 0 M s V V R 7 O t M M S C S C 8 D u 2 I I 2 2 I R

C R R R R R r

o 1

0 7

8 V o y n O t t o M i i n l 4

t o i -

a i b 5 7 7 7 7 E c t a 5 1 i u l 8 1 f b i 2 2 8 3 8 i i a 3 3 d r v 3 o t a n n =

M o U d C Y n T I

a L I

n B i

o A t B S a O .

c y 4 4 5 5 5 5 R i t - - - - - - P f i E E E E E E e i l 1 1 2 2 2 2 N e d i 0 0 7 7 7 7 A s o

E s

?

o t b 2 M o M e a 1 1 2 2 2 e s b n C t o r e

R u r . .

3 4

5 6

. 2 o

N C P 1 2

$~

0 7 7 8 6 3 3 6 6 V

A V V A A e

n n s n n e e e o e p

e p

p p s n n l O O o e e C O O l p p o o C O O t

o t o t o

t t o o o s s s s s t t t l

l l l l i i s s s i i i n a a l l l a a a o F F i i i F F F i a a a t 2 1 F F F r r r p 0 0 o o o i 7 7 0 7 8 t t t r 8 8 7 3 3 a a a c 6 6 6 r r r s V V e p

e p

p e O O V V V u S D M M A A A O O O

) m R t r O n a T C

o W U B

- g

( I n R

- 2 i T

- r N 3 u O

D C E C E E s T 0 0 0 E l N 2 1 K 0 D K D 0 L i A 0 0 0 7 8 0 7 8 B a N t 7 7 7 3 3 7 3 3 A F I e 8 8 6 6 6 6 6 6 T M s V V V V V V V V R O t M M A A A A A A H D u 1 1 I 2 I I R

2 R

I R

R C R R R R R o y t t i

n l 2

o i -

i b 5 5 E t a 2 2 5 5 5 5 u l 7 b i 4 4 4 4 4 2 2 2 0 i a 2 2 1 1 1 r v 2 t a =

n n o U Y C T I

L I

B A

B

' O y 3 3 3 3 3 4 4 4 R t - - - - - - - - P i E E E E E E E E l 2 2 0 0 0 0 0 0 N i 0 0 0 0 0 1 1 1 A t b . E e a 5 5 3 3 3 5 5 5 M s b t o .

u r . . . .

5 6

7 8

C P 1 2 3 4

?m'

l ll! 11 !i iil

~

s.

g es i n

o n l n

_ C u R

__ y l e s u u n i

o i t

r n up o

C S

o 2 t

. 0

_ ) 7 l s 8 i r a h-. n r F o 'o 2 i s 7 t 1 p

= p 0 m T i 7 u

( r 8 P c

e s V R s S e O H

) o R D M R t l O n C T o y U

. C B

. ( l . I s R S 2 u T X

. - o N 2

. 3 i O N r C P

= - C g p

u. 2

T R E n S. N L i A L B l 2 N 0 S A o0 . I t 5 X T o7 M e 1 I C 8 O s V M D t M P m

r or C u 1 R

1 R

e T 1 0

t 7 r 8 o

h V S O o y M t t i

n l 5

o i i b -

t a 4 6 E u l 1 1

b i 3 6 i a 9 r v 7 t a =

n n _

n oU Y i

o C T

t I a L I

r B u

g A i B 6 r f O 8 n y 5 6 R 4 o t - - P 2 1

C i E E l 4 7 N 1

/

t i 6 6 A D

n t b E 1 e e a 6 4 M :

v s s b 8 5

e t o 0 r u r . . 0 P C P 1 2

?@

s g e n s i o n l n C u

'y R l e s u u n o i i t r n u

p o

C S

o 2 t 0

7 l 8 i a

n r F o o i s t 1 p p 0 m i 7 u r 8 P c

s V R e O H S D M R

) R t O n T o U

. C B

( I S

' . R X

. 2 T 2

- N M 3 O P

C 2

_ C g R n T -

E i N L L l A 0 S B o N t 5 X A o I e 1 I T C M s V M O t M P m D u 1 1 r C R R e -

T t

r o

h S

~

o y n t t o i i n l t o i 5 a i b E

c t a 5 4 9

i u l 6

f b i 2 7 i i a 8 1 d r v 2 o t a =

M n n o U Y C

C T R I N L I

d B n A a B n O

x. o t y 5 6 R P

i - -

t i E E N

, a l 2 7 A

+

c i 2 6 E i t b M f e a 2 4 i s b d t o o u r . .

M C P 1 2

?8

~

, j i ! il : !!

~

. p

- e c

n

,' a

, g n 8 A e n e 2 0

0 0

0 B s i t -

o n n # t 7 7 0 l n i s 8 8 3 C u p p a p e 7 R m mM mT V V 8 y u u u O O V

- l s

e u

P P o t

P o t

M M C u n d d d d d d o i n n e n e n n n i t a t a u a u a a a r n r D D u o n a n n n n n

- p C u t u e_ u y u s u s u S R S. R 1 R t R e R e R o b i s s 2 t o o o al ol o ol o o o 0 t t t t i t t l t n 7 l i b C C s p e

8 i s s s a s al s s .

a l l l v l l y l y l O n r F i i i a i i a a i

a s l i a s l i a o o o a a a n F u F t i s F F F U F v F u t 1 p a o o p 0 m l 2 1 2 l n l i 2 i 1 s i 7 u f # # # f U f r # r # l r 8 P u -

u i c p p p p p p p g a s V R m m m mS mS n F e O H u u u u u u S D M R P P P P P P

) R t O n T V X D o U N B 2 B

. C B I T 0 M 0

( I R A S 0 P 3 T X A M T 7 2 7

. 2 2 2 8 R 8

- N 2 2 3 O M M M N V V C P P P P M C

._ C 2 2 2 2 2 V 2 g T R R R R R A R E n N L 0 L i A 0 0 B l N t 5 X X X X X 7 X

. A o I e 2 I 1 I I I 8 1 T o M s V N M N M N V M C O .t M P P P P P M P I 1 I D u 1 I I I 1 R R R R m ,C R R R R r

e T

g n

o L

oy ~

'tt i

nl 3 oi -

ib 4 2 2 2 E t a 2 4 5 4 1 ul 0 0 0 bi 6 5 4 2 1 0 i a 4 4 2 rv t a =

nn n oU Y o C T i I t L a I r B u

g A B

s i

f O .

y 5 6 6 6 R n 4 4 5 5 - P o t E

E E

E C i 4 4 5 5 2 N 6 9

- , l 9 2 6 0 0 A 5 t i 2 1 0 7 7 0 0

- E 5 n tb 2 3 3 3 M 1

1 e

s ea 9 9 9 4 6 sb e t o . . .

7 0

r ur . .

3 4

5 6 7 8 2

0 P CP 1 2

?'

l

l l s b b u u 7 l a a o o o i l l i i t

. . a i i r r F a a u u l v t p p i 2 a a S S a g # n n F A

n U U 8 i e p 0 0 B n 0 s m 2 2 0 0 n o u # # 7 8

7 8

3 7

u l P p p 8 R C d m m V V e y n u U O O V u M M C l a P P n s -

i u n d d d d d n

t o u n n - n n n i R a a a a a o r 'nu n n n C u o n u p t u u u o S R e R R R R t s c .

2

' l o n o o o o s 0 i t a t t t t l 7 a : n i 8 F = s e s s s s a l t l l l l n F r 1 ,_ i n i t i i i a

o o i~ a i a s a a i s F a F e F F F t

g 1 M T i

p r P u

0 7

8 Q't P

1 p

t o

l f

p

'o t

1 p s s

e 2

p s s

e 1

p c r m o s R V iR a m u u e : eu m o u u m

u

)

S R

D e H R

O M

H t R S P d .

%D P C l

P C l

P t O :

n T - ' V X D o U N - B 2 B C B .

0 M 0

( I I T R

A S 0 P 3 T X A M T 7 2 7

=. 2 2 8 R 8

- N 2 2 2 3 O N M M M V V M C

. C P P P ,

P C '

2 2 2 2 2 V 2 g T R R R R R A R E n N L 0 L i A O 0 B l N t X S X 'X X X 7 X A o I e I I I 1 1 1 8 1 T o M s M V M M M M V M C O t P M P P P P M P 1 1 I D u 1 1 1 I 1 R R R m C R R R R R -

r -

e T

g -

n o '

L oy n tt ,

~

o i i nl t oi ,

a

~

ib 2 2 2 c t a 6 4 5 4 0 i ul 0 0 f bi 5 2 6 3 0 i ia rv 6 2 T.

d o t a M nn oU C C R

N d

n -

a

~

. n y 5 5 5 ~ 6 6 6 o t 4 4 i - -

t i E E E E E E E E 4 5 5 2 a l 2 1 6 0 7 4

7 0 0 0 c i 1 1 i tb 3 3 3 f ea 9 3 9 4 2 i sb d t o .

o ur . . .

4 5

6 ! 8 M CP 1 2 3 ay

\

%.y v 27 .I. as I as t 2 J. _2_3 1 :: I _ _a_s _ .1__t.o __ _t. . _ i..s . i is i i. _r _ _ j . . _ _i s . . . l. . .. ._i .s. . _.I _

. u.g.,..

.,, 6

' +i<

7

<..I..

(~~

r. .. .. _,. ,

g.,

' N' ,,,,

....... ... m. 2 i _

r c

.... . . . . . . e

. . .. . .. o.

o

.. .. ...C.. ..'.. .... . . ' .

t.s,

, n s

>e .

,g

'b

.\

.. . c

't I .

i

. ..I.... . . . . . . . . . .

...m.... ..1.. . . . . . ...I . . z.

i. ..... . . . . .

e I

l 'A I

l i

. .. .. . c

- - . . . . . . . , M.,,

3 .. ..

i l- ..... ...__

... ....o F. . ..~..

i

...t, ... ..

( .s. . . . . .

.. 3

([f;

. .M. a

...,y ..... .. / ..... ... . . . .

. . . .~ .a. r . __. ,.

.. . ... 4.,

. 2r f ., 2s l 25 1 2 I 23 1 22 I si l 2o I is l- is i ir I is 1 is I i<

v t

't

%8 *.em.s.

LL i3 J i2 . L _ ..o_ .i io t_ _e.i e 1 i i e i s j . l 3 1 2 I i H

..m...

C I

I F

i i

i ...

l lt

.e ..

i

.. .c . . .....

. .. (

D

w. .

n_ ... . . . .. ...m.. ... _

% ge

=

(.

_ _ . _.._, . ... .. .._ _... .... _ . . . _..I_. -

r

, . 5 CARD '

t- .a . . . . -

m..

...m.

e.

.m. .., n .

.. .. .u m.

.... ._. . . . . . Also Ayetilable On -

Aperture Ce.rd A

w s s l .j .. ) ) . . -

.w; .j J

. . ./. .... . . . .

.. . ..'... .L.. k E S f II.GHOUdE m

p ..

.s ..

a

+

. + + RHP3 blARfDP FIGUFt C-1 lb $1 2-AFR-86

>1 #3 I2 I si I' to I o T e i T I 6 7 5 I d i 3 1 2 i t d

C-33 g me urs -sp

. _ . , _ _ _ . . _ _ _ _ _ _ _ - - - - ~ - ' '- - - - "

Il

\

l a', l l

l 4 l 3 l 2 i i S404f TERM C00600eNr 3 f4Als RE0014t0 F04 f3 MOULTS C

C un *Los 70 s0 rL0s To tes u0 FLOW TO u0 rLDs 70 RCS C060 LES CQ60 kt0 LODP 2 att C060 LES #ct C06D 6Er.

LOOP 6 LOOP 3 LD08 4 e

9 M i B

/ 0002

/0004 000$ GJot

- i i flo'04 D41VCE MD'04 OPERAfCD fe'04 D4eFE# ISA Afl0m PM NO . 4 IS06Afl04 PnPFWO 2 # AstLS F AIL Fall 8 TO V ATES Falk TO FAILt 10 TO REMLB OP[B C0stleut RWWWING ttrnal# 0*te COWTimut RLatillse A M A 0003 004 000' RIPm t$ 9 t Mylth 42PCIS 3 1400, 03 4 6400f-01 3.ns00t-03 0 0000r-Di 0 0000, 0. 0. 0000r-Di RHRS SHDRT TERM FIGURE C-2 15151 2-APR-86 4 l 3 l 2 l 1 O

T C-34

1

(/ 6 w G F J - I - H i

I T

U5 P

- f #

RU USf 0 I C t l Ctt P 0 2 O' C

?#El ttB ui a

7MF l

3 1

T O.

T O PU s.

SPM 5t E RU RW!

UI 3

5 UOt C s

?

] C s e C0t 0 COE CT= O 4 S7 a t

0 c

YRE ?RE L0S t0S pt dt ae atr f* O FPF 1

5

. 1

- 6 I

T R.

wS =

oE U S.

P tL SfE F RJ S UBT .

sL 4 C T .

v1 3 7

}

iC C0T C79 0

0 _

L C 0S4 sE 0C fteS -

CR* dt 0 aeF 050 FPS n7 t 1

e 4 w

o L

s0 se istt 323 0

4S OE LL r

tL teO O

C b33 9

I TL L

USR.

aEO F SP e

tst9 S 5 3

0 8

9 7

4 0

0 E E 9 O 0 3 O 0 i

S.

1 0-(0 2a0 1

- 5 E 9 0 8 Le a13 0f sS3S eC eR 8E #

o tRP rU8S Cmi O r C9O set 0OO oC0L 1

=T L CS7C eF i

e wS

le t oE T t # tL U t

r 3PC at 0 O WU m 3 sL UI? 0 saet( i 0 ( oO '

C e 0 9 .

teet9 0 aC COE OTf 0

0

-. trt a5*

tg t

0 L 0SO TDE t

u!34 9 0C t C#P L0S t# O Ut _

oF O0O A#O 03w o7L FPT 4f#t 1 lJe v wC C 4

0 0 1

T _

o oE lL TL Esn

. F - -

& E E U F.

P m 4m t

r&

se 32 F

sL O

3 AtU FI*

$ 5 9 0 0 9 0 0 9 t 0 St 0 R c UOF 5J b0 0 9 0 9 0 0 L C W 0 I 0 {

ielt 0

0 0

t iso L

C o I

TW14 E 9 0

0 W f 1 0 CO O' M 0

1 Lt

S3S C O? 0SI #E mC oRsE #t

- Ot Cs 3

CRP O

PUeS P CTO

!L0S i.1 0SO OC A#F s#

eF eT L CONC L F* O J - 1 - H - G - F r\ (

__ /

_I - w- l 'a I o I m I <

a m,

E Q.

E a

.t .. m F g. l.. 43 - n

-t:

t e

t- -

o - 4 l !!e~ I! w m 5, 5 D

v .-

s e W . n.

.g. o z "

L jd Gi -

lej Gi "

m ism it. inn

.ra.

o g

!g a w

.w 3

[ del-i am di.

l hEB.

1 .

TI d.a -

l[:j .45 APERTURE il"j !;s i =. i

_ CARD I i

g D? .Eg., g 1

!j[ Q -

8i j [3; Also Available On i

,Ijg Aperture Card

.inrsz ce

.Yk .fi 858 IEF

= cal _ ,- : .a.

.N.

E

.g I

.!45 .k.

E2d ele I!ge I'e

"- /7 l- Q -

!Il !Eff WIl == . !3 i e i!I (s i l '

g

lm

!.g. E .is. i i:. ri.

.,g i ,g.

ilge j;!.k 3

$85 EEe

!!i

. b M M

~

!! '. !!: h!!

w w l;$

=

i e i;

!ri tI,s e? ?

E! ! "

en n api g rel

Eel s g; o2 Na g-

-p n -

a ras 5l _

.vg .

8 [:I x4 o hI h N $

i'th r. !; I /7 !.. a - !!I i: C !!

e

- i c

si (r u e!.

,s i,

ir u

,s:

.s.

8

. - ;e

_ p-Wi-- -

.vire= .rb o a ese :-

l I w l- o I o I m I < .

l C-35 !

N

e l

10 9 8 l 7 l 6 l 5 l 4 l l P04 B'06 F AILS

70 0*Em D

/N0001 f%

s a s

-- 4 FAILURf OCCURS FAILURE DCCUILS (PERA!DR FA;Lt V AVE T@

IW 9910A IN WiR188 FOR TO OPEJt VALVE FALLURC 81 confROL Crufen Orts c!RCult MOTOR . e 0*cn C

/\

0002

/\

0009 01 -s

[% [h RIMysF010f AltffD 5.2500f-04 38 0.0000f-01 08

-- t i l i {

ALR CIRCUlf TRANSF0tE R FVSE TMCRMAL DtCRLCAD L!nif AND LIMlf SWi!CH OPOI C047 BREATER FAIL 5 PRf*lA1RCLT BfflCf TOROJE $difCM 3380 FAILS 70 StifCM PC S*lm!0J5LT DPCMS WCN9 e $PUR10JBLT FAIL TO CLD5f cLost 70 CL0sf OPCNS \

B /

0006 0007 000s 0013

- 006 '

0003 0010

[% RICff RIFUW R10L4DJ RIL&3380R R1898 F.00006-07 4.0000f-08 6.0000f-06 1 0000f-04 36 0 0000f-On 0.0000?-01 0 0000f-01 0. 0000f- 01 08

- t I air CIRCulf OPC9 A'Ot F AILS limit $WifCM 7040JE StifCM 3RE At[M FALLS 70 CLo$E BRf AMES 3300 FAlt8 33 70 F AILS f0* ENS)

A 0004 0005 0011 0012 R1409J RI Ac5J0f RlL13380R Rl0533f04 3 0000f-Os f.e?000-De 1 0000f-De 1 0003f = 0*

0.00J0F-On 0-0000f-04 0.0000E 01 0 00000-01 10 9 l 8 l 7 l 6 l 5 l 4 l

i I.

4 I 3 1 2 l 1 1

I l

l D ,

i i

ca C A.,

hUDts Es fu C

) ,

to 1 j

M-0J D-04 ]

6 ! ! ._

sf h0f 09 ST ARTER CONT ACT .2 (0J A PRf33eJPt O OblL FAILURE 'A L8 70 TR A4$Mif fCR CLotf IN$fRtPfNfA?!04 I FAILS B

i j

-i . -i . /\

00tf Tr !

j

, , -CO, .,C..= ^

APERTURE t

Z7-05 6.0000f =06 3. 0000f-04 j

3, 0, 0, 0. <-a'

0. .

i .

CARD __ i AtaA' CON!Atf CDR FA4LIJRt rRftSJRE FAILS TO TRA499tf *ER TRA49fCR IN$ f RUNENT Afl0W s FAnuac Also Avnilable On Aperture Card

/ A

/

0448 0039 0020 Rife.OsrNr RiircCr Rifr.0sAe, WESTINGHOUSE 4 00008-04 4 003af-04 S.C000F-07 0 0coar-4. 0 00ao'-Di 0.aaaar-Oi MOV 8701 FAILS TO OPEN FICURf C-4 15: 42 2-APR-86

_ _l 3 l 2 l 1 C-36

~

77d T// 0/f 3 ~ M ,

l 1

9 8 7 l 6 l 5 i 10 l l l MDV SF04 FAILS 70 0*ER 1 D

/\

0006 v

[%

{i l

4 6

- 1 FAILURE DCCJR8 OPERA *0R F As FAILURE OCCUR 3 IN IGRING FOR TO CPCM tst IN fCf0R *0PCR* PIRCVlf j CONTROL CCNfCR C l

/\ /\0009 Ouh 0003

[% R2nV87 N

[% 5.2k 0 0004 1

f I i i !

fMER% 0/ERLOA0 Lintf ARD LIMif SWITCl FUSE AIR CIRCUlf _ TRANSFORMER DfYlCE 1042JE SWITCis 3390 FAILS FAILS PRCM'URCL T CLO$f BREAKER OPENS SPUR 10USLT FALL !0 PLOS' SPvR10dfLT OPEWS OPENS B h (3

/N 0003 0006 0007 0000 0010 0013 J R2L13JSI

[% R20!F R2FUJ R2A49J 6.0000'-06 f .LCD) 7.0000'-07 C.0000'-06 0 0000E-01 0.000 0 0000E-01 0 000J'-01 i i LIMIf $difCM ICROJE ##1TCM A.R CIRCJIf D*fR A'OR F AILS 33 70 F AILS

'O Cios' 333C FALL $

3RCARER FAILS

0PCNS) BRCARERS A

Oct i 00:1 000* 0005 R2iEJJ8CK R2054.:'OR R2 Argu R24Cf/of 1.0000f-04 1.c000'-04 2 0000f-03 7.470JF-04

0. 0000f - 01 0. 00CO'-O s 0 0003f-01 0 0000f-0:

' 0 l 9 9 8 7 l 10 l l wo - _ _ _ -

L

_ .l 4 l .' 3 l 2 l 1 D

1 VAff MEcnaglCAL FAILURE leCLilots ICfoR = ' AILS f.

oPEN .

C oo22 3

', R24rs /02.

g-o - s.oooor-es paos o.. coot-05 4

4 6 {

oPCJ CONT ACT MotM sf arf CR PRCS$URE 1

O. 841tCn FAILS Co% FAlLURC CONTACT.42fot

'A&LS ! A?RANfMif ffR

? CL0tt CL S? INSTRMNIAfloM FAILS B

i . oo,. o.. o .. /\

.. R3sf.CNE R2M5coF R2Cu42oA4 [h 1

s.oooor-os s.oooor-04 b-o4 3- o, -

s.oooot-os

.. ooo,-o ; o.o ox-o, o.o co,-oi APERTUlm I

RC' Af C.N! ACT Colk FA& LURE PRE S$Lmt MlRD --

FAli$ fo TR ATSMl!!f t YAATSFER INS?RM4f AfloN -

f A&LURC Also Available On A

Aperture Card oota ooit oo2.

ufrear ute.o2Ae, WESTINGHOUSE Raw .oseN 3.cooor-od E.cooot-ot 8.cooJ'-of o cooor oi . . .ocor- o i o cooor-oi MOV 8702 FAILS TO OPEN FIGURE C-5 15441 2-APR-86 l 4 l 3 l 2 l 1 1

C-37 i...

h74///d/f 3-/ 7 --

l J

I

=

D e C a B = A E 6 S

8 O -

L R C P A

YN -

LO 2 SI 0T 0A 4 1R 4 RU :

OC 5

_., P1 1

. SF g

E N S SO U EC V

O LT 6

_ H AN -

9 n

. 9e G VE C s

te N S ee I

e t eF a

s t

i Mrr 4

t t ae l

i NE OR E

R 1 i t m e P. S.

S tL tLs t

t 2e E IP U aat e T C

_ t ns see ege W A I tes L- F I O l 5 t S t - -9e- I t

a F r t se s . et ae e

2 I e n P. t. 2

e w3t owe tee s , M Ae rts a et l

1 t

e e

ss ee . s i-tt te , est t s tt tt oEaa As t ' . ese e aWtu t es '

. e. S. 3 st s

. I e e e 3 tttc nanA eee e eWl s

eef

.eo ste. lea ote m -

srte t sa elt eDeP rTtS Pat StA e .

l 1

t - e t . it 1

ae cte se

- - t' cS - -

itt waP rt es se tL tL .rte a._ e. s. .reee mFe 9Ae

f e u .. s e fnt nes

=

s t s-- s I

, " 4 4

I ae l

s e' t a

a-e

. 8 e oge ceoS e. a.e e.

res gtt e e' stm tec _ Te =

ns sta Aee eee ePL sOe -

aao vtt t LJt EeP W4e l

l 9 t 0e t

ee _

et nP ee e s

6ss 3 3 tt ee N

e 4

5 s l tL t s e W3e a4ts t

tne t

s nee ogs ces l

I 9 t tt 9e rs ye e

st - -

et tt tL vn cs at v ig e r ee se t s e wS o P. e. 6 _

6 . sL e9 te e

s I

t n M t 3e te al wt ot a e te tn.

ee te sP a C IS .

l -

1 L ..

t sa o. o-e es e

tt ti te tl aS t en t

e. t ,e e etaM sst esf 4

0 t

ss "* s e. t. 7 I e 7 eawat tt 0 9 ttle s

est

.ie eee.

trg tea ete e.

SPte t*su ett eteP Pet rttS Sla l

o l 4 s , .

t 0 8 aS 9e t tLe t - F - rt sli aF tL sa s ea S 0 cL eaee eFw

.s ee0 eat '

s vr n esMi a r s 0 l 0

a I n5 t

L I s s

e csa a e

s g

r e. 9 at e 1

tgW oe " .e o 8

eJ es Mtm e t S m

's estt .

ter ete s tt ees t t aUe ePt tt eao vFt t '0 e4P sSe D - C - B - A .

ap L( .

=

, -lii

C - B - A E 6 S 8 O -

L R C P Y A L 2 S

0 0 N 6

.. 1 R O 4

I :

UT 5 P

S A 1

, C E S I

S E F U V I

O L D 7 H A O -

G V M C N

I T N E S O R E

I U W T G A I L F O

S I

l CW Sww C

.e i f E AP A .o 2O " 2 ae 4

r. e i

I IL CLS T

C a 2

1 AAT #

T Eltn4 0 9e4 2W5 l

l ..

i T

C A

eo rr T

N e .o .o O

C " ea t

2 i

t r.

2

ESI S

S iS 2

a S R R Ow0 L94 rL($

' C l

l L .i AS ee CLs -

ILt GAP 9nc 2 o r e.

AFO 0 M i a T 4 g e. .

3 I

rS oU r0S L 0 0

/0 f C=

E CA3 fRM 5

"m.=

9 2

i 3

etF EUE 9 tS TLR vUO Lt oPL AA0 cSC TF7 l

l 5 i St Et ee To it8 srr C o LL t f AC T

T 4P 2O s A

2 ao l 4 4 W r. . 4 4

. WL OS . T

= a tlO AI LR U

/.f TL CLS AAT I MR C

I R

GR OU SP OO4 CN$

IS l

1 si ee le3 Ct T4 0 O oo wro lwM . W C

ro SS 5 mS Ir. ao o.

i R

s

t fr tA R

. Ot Ls f0

C l

l L . .

- AS oo ICLt gae tf T t xre nf L O os c 1 T

L Na%

i s

. 'ae- at u.

ia

'tt o. o G

/of st 4fs o r eJ r 0S stT tut vL4 9M hi ie tt sec %4a u a

nWr i e8 '

. OIWW r - e - A i i

i-k

(

' s 7 o 5 i 4 1 l 1 l 15Di Af l04 V AL FCS

$*Wt t 0J5L Y CLOSE I

~

l w l

/\0006

[%

l l

i

_ i Mor trol rios area 5PUR100stf SPUR 100sof CLD$tS CLO$tS l

l B

/\

0302

/N0337

[%, [%

- 4 4 I e _

V ALTE fi[CHANICAn. *fLOSE

SditcM Con f A01 42 A tc) CLost SWifCH V AL VC PECMANIC AL *f F A!LURf - F AIL 5 540Rf 8 FOR SPO! NDRMALLY OPEN SMORf 8 FOR 3702 FAILUitt - F AIL 5 Sk TO REPIAIN OPEN SM04f5 70 REMAIN OPE 5 033J 0304 0335 0008 RIMv s Polf RI54:u0 A.Cu42ACO 0006 R2Mrs W W l.0iO0f-04 J . F 203F -05 2.F200F 0$ l.0iO3F-04 0 0030f-01 0 0330E-On 0 0000F-04 0 0000F-Da 8 l 7 l 6 l 5 l 4 l s c -w

3 l 2 l 1-i C .;

1 l

1 i

B <

J l

hstess$o u YYrI s s rot on SM04f3

'd A

"[$ar es ",*!rl.'[ ...

a WEST 1NGHOUSE 1SOLAT1ON VALVES SPUR 1OUSLY CLOSE I

..ouar-o. ..n=c ei NRC MOD 1F1 CAT 1DN _

FIGURE C-8 15:52 2-APR-86 3 l 2 l 1 Tl APERTURE CARD l l- l Also Available On -

Aperture Card c-40 V7sytto/TS - d -

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ l

APPENDIX D OVERPRESSURIZATION ANALYSIS 1

i l

l 1

0058v:1D/112486 l l

APPENDIX D DVERPRESSURIZATION TRANSIENTS D.1 INTRODUCTION This appendix details the calculations and qualitative analyses involved in the determination of the effect of removal of the RHR autoclosure interlock.

The first section categorizes the types of initiating events and using operating experience determines the frequency of these events. The remaining section discusses the mass input transients and the consequences from these transients.

D.2 INITIATING EVENTS This section provides the data and calculations used to determine the frequencies of the transient events identified in Section 6.5. Table D.2-1 lists the transients that have actually occurred at U.S. PWRs by the type of transient.

In order to determine the frequency of these events, a compilation of operating years of experience was performed. This data is provided in Table D.2-2. This table shows, for each plant, a rough estimate of the total number l

of shutdown hours (in which the RHRS would be required to operate) along with the total report period hours. This data shows that roughly 31 percent of the f

time that a plant has been operating, it is in the shutdown modes.

Therefore to quantify the frequency of overpressurization transients the following formula was used:

f transients F (Transient) = # of shutdown years j

of transients Total report period years x % in shutdown l

~

of transients 510.30 years x 31%

Table D.2-3 lists the frequencies for each transient using the above formula.

l 1

0058v:1D/112586 0-1

For the loss of RHR cooling train initiating event and for the letdown isolation /RHRS isolated event, an estimate of the number of events was made utilizing the AEOD Case Study Report " Decay Heat Removal Problems at U.S.

Pressurized Water Reactors." The Letdown isolation, RH C isolated event was o

assumed to be synonymous with the automatic closure of Suction / Isolation valves events reported in Table 1-2 (37 events). The number of loss of RMR cooling train events was determined by subtracting the number of autoclosure events and the number of inability to open suction / isolation valve events from the total number of events (130-37-8=85 events).

For the modification case in which the autoclosure interlock is removed, the number of letdown isolation events due to isolation of the RHRS via autoclosure of the suction valves would essentially decrease to zero. However to account for some unknown causes of closure of the suction valves, the number of events was conservatively assumed to only decrease by one-half.

If the failure rate for a motor-operated valve to spuriously close is taken from Table 6.2-1 as 1E-7/hr, the frequency for a letdown isolation event due l to spurious closure of one of the motor operated suction valves would be:

1 7 876 "

x 31%

[ Frequency = 2 valves x x e

= 5.43E-4/ year l

Thus the reduction of the frequency by one-half is a conservative assumption.

D.3 MASS INPUT ANALYSIS i

The following section describes the assumptions and the calculations involved in the analysis of mass input initiated overpressurization events. The effect of these transients on the RHR system and on the RCS are categorized in order to determine the differences between the events that lead to high overpressure, medium or low overpressure conditions.

l l

i 0058v:1D/112586 D-2 4

l f

This analysis utilized event trees to depict the various mitigating actions that take place after a mass input initiated transient.

The following assumptions and conditions were used in the development of the 4 . event trees:

1. The plant is in the cold shutdown mode (mode 5) with a temperature I

below 160'F and a pressure below 390 psig.

2. One charging pump is in operation and pumping at its maximum flowrate of 550 gpm. 4

3. Letdown via the RHRS is in operation and the flowrate is 120 gpm.

4. No RCPs are in operation.

5. An alarm must actuate before the operator can intervene and stop the

- - transient. This alarm can come from:

a) RHR relief valve discharge to PRT (pressurizer relief tank),

b) PORV discharge to PRT, c) LTOP system operation, or d) RHR pump low flow alarm due to closure of the RHR suction valves.

6. If the flowrate due to the transient is greater than the relief l capacity of the operating mitigation systems, another system must operate or the pressure will continue to increase with a rate proportionate to the difference in input / removal rates.

l- 7. When a pump spuriously starts, it runs at its maximum flowrate (charging pump flowrate = 550 gpm and safety injection pump flowrate =

l 650gpm). Furthermore, these pumps are assumed to have an infinite

~

weter source.

\.

0058v:10/112486 0-3 i

p The event trees derived in this analysis are shown in Figure D.3-1, D.3-2, and D.3-3. Figure D.3-1 depicts the mitigating actions given the initiator -

.. Charging / Safety Injection Pump Actuation, while letdown isolation with the RHR operable and inoperable are shown in Figure D.3-2 and D.3-3 respectively.

The node that is affected by removal of the autoclosure interlock is the RS node (RHRS Suction Valve Close). This node changes from an automatic system (the autoclosure interlock) to an operator action (given'an alarm). No distinction between the modification and the NRC proposed modification is made for this node.

The probability calculations for each node are shown in Table D.3-1. The success criteria for each node is also shown on the tables.

The results of the quantification of the event trees is shown in Tables D.3-2 to D.3-4.. These tables also detail the change in frequencies of the consequence categories due to the removal of the autoclosure interlock.

l 1:

0058v:1D/112486 D-4

000 0055R I I IV R005 005 5 RRNI 946 41 21 H HHHL S507 001 1 HHI H 585 6158R TTTR 665 611 5 RR T G V G G E OOO OOOOGI GDDD I O O O G D O pI OGGGVD TTT TTTTI SI EEEF STTTITTTSTII I LE

, SPSNNNE P S P SSSRL 050 0055P PEEEI 000P000 0PPPVC Y S 595 0223 0 PPPL 5224 10000 K 431 4444000OOOE 8444024444500FC 0 770E R 01 5 R 4 0 R MMM MMMM417VVV 2MMM9MMM1M557I V M OOO OOOO RRRR OOO OOO O LR E RRR RRRROOOOOOH ORRRORRROROOOEO R FFF FFFFTTTPPPR TFFFTFFFTFTTTRP E

C R

U YYYYYYYYYY O YY YYYY E S TTY TTTT 77 TTTTTTTTTT EET EEEE 11 EEEEEEEEEE P FFE FFFF - - FFFFFFFFFF N RRF RRRR 22 RARRRRRRHR SSR SSSS 88OO SSSSSSSSSS 3 S E DDEE .EEE0E T . . S. . . . .PEEEEPP . . . . . . . . . PPPEP N NHH NHNHNII RRNN NNNHNHNHHHNNNRN E E T I T T S N I N E M A L M R R T E R RN S T T EG U N E YFI J I N L RSS DEO 1 O S D G B LN T DESR N D E N R ERI S ETR O

- I T NN N T R RRS O SAEF I 2T R I LTOLRO T O RR OO O T N E T R

. A N E P N 0 RLOC DZ W I I I I I SSESEEEEEV O RRR OSE ROCSET R Y RTI OOOS UZ IH I DU E I E I S NNGNGGGVG R RRRE SBI RSO D P ER K GN RRRRRRR RD O EI T PPUPUUUOUN H RRRVLE GG ETT LU P N XXSXSSSHSAG R EEELRRLRNTLLNNR

. BS PLE EE E R N RNiREI NRI EEE Y AS RRT E EEE ELI RRRVGHCNTECR1? TN C OUU ESMI Ft RO N TE RNR TGE sLRLRRRGRLT RURUUUNUI S TTTNSNREEUR I I I EI E R I V NSNSSSISFE RRRE ETDTRTERVT r

P S TSO T RRRZTKC TCVTOI p EEEOSOESSSELNRS E R

E V

L R

N EIN VSI R

NRSRSSSLS EEEEEELES HRHRRRI RCG TTPTPPPFPPO S PPPRERLUPNLRONO UOOFTBFBRI EVCI P N

E O V E U

L E N A G I U P T N 6 T R O 2 676 C H 6 C E 4 2347 2 C 927 45 797 A 2 S

I O O T

R 374 797 91 9 7779 9991 1 11 1 1 82 88985 991 981 G

N

%79377691 19,78 I 1 91 79971 9119 ,

80 8 9 1

, ,311 I ,1 1 ,4 9931 5 8 N

1 1

8 , ,7 8 , , , ,91 85 G ,6 , , , ,5121 1 8 ,8 9 O 062 131 98948 9 R 7 8724 1 9 9 1 I 21 2 H32 1 2221H1 R 1L1 212HL HH171 T C E C H I CI TCC H T R HNB RTHNTVVYYRY C BRYVGBRRPPRTYY D P L RRE RCRUCOORRRR EPROUERPERRCRR I E O JJF HDJJUNNHNNH E FRMNRFMRSMHONt 1 T

R S L U I P I T

O H R O H C O L R T N S R E H R L V 0 U I 0 E M 1 T 1 T 2 T U T C E 11 R C N O2 R 2O2 A4 L 222O 2 E

. C R N N N N YY H R L RT I TRT TT22 F TTTR EE T1 1 P LN NLN1 NN O NNNL1LL1 N R O F SI F I SI II RR I I I S LL I RR E E O IO O OIOE OONN N OOOI ERRKONN P Z P P PI 2PPNN O PPP I VVOPNN2F I R

. G 1 E P E C AR2 I EC O RR O1 N I N U NI NUYYY R T NNNI URRCN YN U I YRR T RRRLEEEHHME R RAARRLEE RHHEUY S N RI I R I I I LKKTTEM L NI I I I VV .I TTL R S E RRD R DHD . RRRRRLM O NDDDR E P URN T NPNTRUUOORU S I NNNRTEE . R R C.D R R P N RNOORAU R O SPI S I PI SFTTNNSS I GII I PSDB0I NNFSS P oJ I

--EEE g -

U

-E E ' *

~

o 20-eS$ KEK-E EK W KW E 6 $8 $ 5 R$

g-dR$EE 8'-

EP

-4e!'o*e EEE"-E SE EEeEEoSe

~

Ei!6!il ElR0Rl![ Egg ls-s[Es m

rgrim

-- mmmm- Ig111gg:ggligt-m .. m e

> E d.

b E g sa w

.cece oow w:c e

w e

w g- s,_ , a m y QQQ

$-$s [&-

s s WEsssefsl sWENsWWWEwwwlEEE j ms a n,_ ss ESS BoWi9,a m

Ew d i 8

E[gsagega s g -

g E -i>mzE.

g - g gs ag! s gEas wgu a g -

g 8

w l m m '- E * [! s> "i !g "3lmgg.5 ms s! semam m=sa 1@ 4l$ds-al8 a

~

S---mm

.-- w

=

eqq E

E ', B ls s_ s s s_ ., A-g ,m BMC"alWem 3 Da s e, ssa

- m E 2,m_ g :

d ce e L e !$$.$~kWEm EE 68hl"g"""

a" p m 2 m m '-m m _ m agggg;l gE1"ww "-zg ed Ishmh _ _ _ e t a"sg 1 ~ :

g Et

~

RRJ p R ve m .

- A tewel. .

e pe v- e r - ,- . m p5e-g a - !'

e $D E a!e $ s n.44 5 8a - -R 8 "-- R s o- o 88 ccE db- a. e Ig-u-

- -- i

,sss o

, go sggbygWg8 g go l g E'mugg'est es,,smE- ,s<,4, . me egg ;

E z -c zza ,

I .

p 1 S I 2 1 l-NNn M

e. N ,_

L b 555 g5g "g *g$"b~gsdu *

-~

5 EEE

- ~ -*E"* r!E-e 2 e m ~-

-gEEE"3Nkgll l

- =en $5EE!U ne=l 5lewElensea$h,t nE mw-p D-6 j

l h

EgtRssccR24fD2 KRhKFb:R" RRRR4"2004:597244RR2RRh%7:422% E-ssssssssssssssssssssssssssssssssssssssssssssssssssisissi s N .,

E R8RR982RR8RREFSSRSVR228E88RRRRRRSESR2982RR8S8288SSR99RSR g

agaadaa -

R

. Iekgaaaakgkggfg$ggakagaIgga[EI.:a a $sKf o u- n -et 2.I e-2 aisaiagg!gaag;RR-REBFS$a NEREC8N8Kuc -FRa E E g -

a iuii a iiiiiiiiiiiin:iiannassi,tiit;< acce -- tis:iidiinniia~*

. -a az anu g IAi9 R -

t e

I 92R8R985SSRPRRER98Rf892R882999289822*SSSSSERERESRSARESS* R k "

y i.nsissi.si.ga'iagadiisaiesi'j:aaieijiiiiii.i.iigaaf.isii'ja'ai

~ ~. .M 8. .E8.s~ s8.".8.sd . 8. .R.s . ess u .88. ~.s~ d .8. m si -i.

1 Reg e Kees sanRensee*~sseessrs san:ce ve Ra~nR:#g: g r w e U

z w

a ra d R EFR*2RR9988RRER8*RR*RR82R8RR8"FRRR888FERR*RR8RRREFES28' - 8F u- -

gag a aa 4w E

- e62 . a a1ggRfBec.ggi ,.~I s;~s. >;s !. ms re~..: - x ag l Rc; is; agger.:a sa ;;;g i.:.:;:;5ataag;;gg;ca n.:;gsg1,jaaEi aig;;55 s

taaa: gag;;;;55 gIE,gg!g g

w- 8

.J F G. C C%

HW'

. a ;

O '

s 2RRR*B88R8R88Sf8898288888E22R828988R838R8R8F882298RSR898 8 A

' i' E

jiiii.i.iiii.iiiiiiiii.:iii'igEjidaaiaisigei.iiiiiii.Egisissaaa E . ~ . - .e n: .um : 8. . .e% den.ii u .S.~.:

. .usd 8. E

' s ::

sast K'vas.sRST:8:sa;;RR::s8:sc8vera nzss:ss :: RRs E g8.8.888.8.8.8.8.888.R.8.88.8.8.888388.8.8.8.8.8.88888.888888.8.8.8.8.8.8 b bM N -

c - - : ,,, e 8

a -

a

- gia.:c.:gart

- e ariaem e#R. {;ge;8&gn;;8;a.:ag.:.:s; n, eege gggg gage.g.:;agn~assag.:g{ata,:

e, g-- gge g; '

g i j

=

-n , , ,

-n \

> b EI

~

~~ -NI!- ~~" -~ -

a e

)g ~~* "hk ~ 'n$

i - dd - E5I ~5 gthE ypj r -u$ll-~~mIr.dd". % . I l WW" %

g g !

J-

"w-~ gIr#,

l

- l %, r*f to g

h.a ,

i sE !gl!sselin!s n!lfeelllfis!!!m!.!sg r fri u t -

r1 g!!sggglsgrh - -

n--rrn.. . -.g g nRR n.

e.. urn nce 0-7

TABLE D.2-3 OVERPRESSURIZATION FREQUENCIES Number of

. Transient Transients Frequency

1. Premature Opening of the RHR System 0 0

2. Rod Withdrawal Not Analyzed Not Analyzed

3. Heat Input / Removal 3.1 Failure to Iselate RHR Not Analyzed Not Analyzed during Startup 3.2 Pressurizer Heaters Actuation 1 6.32E-3/yr

- 3.3 Startup of Inactive RCS Loop 11 6.95E-2/yr 3.4 Loss of RHR Cooling Train 85* 5.37E-1/yr

4. Mass Input / Letdown 4.1 Opening of Accumulator 3 1.89E-2/yr Discharge Isolation Valve 4.2 Letdown Isolation 4.2.1 RHRS Operable 16 1.01E-1/yr 4.2.2 RHRS Isolated (Present) 37* 2.34E-1/yr (Modification) 19** 1.17E-1/yr 4.3 Charging / Safety Injection 16 1.01E-1/yr

~

Pump Actuation

From AEOD Decay Heat Removal Case Study Report.

- Assumed to be one half of present configuration case.

005Bv:1D/112586 0-8

Ih p

TABLE D.3-1 NODAL PROBABILITY CALCULATIONS l~ 1. RHR Isolated (RI)

Description:

For the charging / safety injection pump initiating event, it was assumed that the RHR is not isolated approximately 90% of the time during cold shutdown. ,For the letdown isolation RHR operable, the RHR

. is not isolated while for the letdown isolation, RHR isolated the transient has no effect on the RHRS.

,RI Failure Case Probability Charging / Safety Injection Pump 0.9 Letdown Isolation - RHR Operable 1.0

, Letdown Isolation - RHR Isolated 0.0 l

i I

l 0058v:1D/112486 D-9 k

L I:

TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS

. .g

2. RHR Relief _ Valve Operates (RV)

Success: RHR Relief Valve Opens at P=450 psig Failure: Relief Valve Fails to Open

Description:

The'RHR relief valve is a spring-loaded relief valve set to actuate at a pressure of 450 psig. It can relieve 900 gpm at 450 psig.

Probability (RV' Fails to Open) =.3E-4

'l 1

0058v:1D/112486 D-10

j TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS i _3. LTOPl System Operates at P=450 psig (LTP)

-Success: One or Two Trains of LTOP operate 1 Failure: Both trains fail to operate o

Description:

The LTOP system consists of two trains that utilize the PORVs. The operator must enable the system at P=475 psig or an alarm ,

sounds. The LTOP system is set at P=450 psig and T=323*F. A PORV can relieve 700 gpm'at P=450 psig.-

Failure Probabilities: The failure probabilities were calculated through the use of fault trecs. Figure D.3-4 shows the fault tree developed for two trains of LTOP while the failure of one train of LTOP is shown

- in figure D.3-5. 4 i

LTP Feilure Probabilities Two Trains Fail 1.50E-5 One Train Fails 7.71E-3 I

l 1

j 1

1 I

0058v:1D/112486 0-11 l

n

[, .

TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS-i .! c . <

4a).RHR Suction Valves Close at P=700 psig (RS)

Success: Autoclose feature Closes One of Two RHR Isolation

' Valves at P=700 psig

. Failure: .Both isolation valves do not close.-

p

Description:

The autoclose feature utilizes a pressure signal to actuate l , the valve operator which closes the valve.

Failure Probabilities: The failure probability was calculated using a L fault tree. Figure D.3-6 depicts the autoclose failing to close one of two isolation valves (MOV 8701 or 8702).

RS Failure. Probability = 1.44E-5 4

l cosav:1o/it24ss D-12 1,.

i

.i

TABLE D.3-1 (Cont) ,

N0DAL PROBABILITY CALCULATIONS ,

4b) Operator Isolates RHR System Given Overpressure Alarm (OD)

?

Success: _0perator closes one of two isolation valves when alarm sounds at P=700 psig.

. Failure: Operator fails to close either isolation valve.

(' ;

Description:

The modification cases assume an alarm operates when the pressure exceeds 700 psig and an isolation valve is.in the open position. Given this alarm, the operator (through trairil,rg and operating procedures) will close one of the isolation valves.

1 Failure Probability: The probability of failure is conditional on a tim factor. Ifanmitigatingsystemoperatessuccessfully,itin'asurhd

.. that the operator has 20 minutes in which to act. If no mitigating!

system operates, the operator has approximately 10 minutes in which to

- act. The calculations are shown below:

HUMAN ERROR CALCULATIONS

1. Diagnosis within time T by' control room personnel of abnormal event

[ HEP = 0.01 within 20 minutes Table 20-3 HEP = 0.1 within 10 minutes

2. Estimated HEP in operating manual controls HEP = 0.0005 -Turn rotary control in wrong direction (Table 20-12)

'4 e

0058v:1D/112486 0-13

~ - - - - - -

^^

j

. TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS l

4b)'(Continued).

3._. Recovery factor - special short term one of a' kind checking 1

Table 20-22 Ji HEP'= 0.05 10 minutes f 20' minutes-a.-u=

. .,... .,..... a r"* -

~*-"""' i

-...n.......... ....,......,,....,.,;.,,4

............n.....u...-.

r. P(20 minutes) = 5.25E-4 P(10 minutes) = 5.02E-3 1.

9' oosav:to/1124ss D-14

___-_.m.__

g.. _ - _ - - - _ . . - _ _ - - - - - _ - _ _ - _ _ _

H- >

,3 ;( -

t N/ 'i-4 ,

$ ,% 9 l . t

'[N

+

. TABLE D.3-1 (Cont)

N0DAL' PROBABILITY CALCULATIONS y.

y ,.(.

6 .e' '

b 5. Operator Secures' Running Pump (OA1)-

y( .; .

'a'

' ;.y '%

s. .

Success: Operator Stops Pump Failure: Pump Continues to Run

Description:

For any operator action'to' occur, an alarm must sound. The probability that the operator secures the pump also considers that the-operator neglects the~ alarm.

.' Failure Probability: The human error probability is calculated below:

1. Initial screening model for diagnosis in time T d HEP'= 0.1' within 20 minutes Table 20 .... ... '. Conditional probability of failure for task N given success .of precsdirg task (N-1)

.CP (Fail) = 0.13 Table 20-19 High Dependence 0.9 A3mo.3 0.87 A2"O*13 P=0.1 P=0.9(0.13)=0.117 P(operator fails to secure pump) = 0.217

-l 0058v:1o/112486 D-15 t_. _

o i TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS

{;

6. Operator Opens PORV (0A2)

. Success: Operator opens a PORV to reduce pressure l

Failure: Operator fails to open PORV

Description:

If the mass input is greater than the relieving capacity or if no relief valve operates, the operator can open a PORV to reduce the pressure. If the operator fails to secure the pump, he can open a PORV in crder to increase the time he has available in which to act.

Failure Probabilities:

Given failure of previous-task J

CP = 0.36 Table 20-18 Medium dependence Given success of previous task CP = 0.21 Table 20-19 Medium dependence l

oossv;10/112486 D-16

TABLE D.3-1 (Cont)

NODAL PROBABILITY CALCULATIONS

7. Pressurizer Safety Valve Lifts at P=2485 psig (PZR)

Success: One of three safety valve operate.

Failure: All three safety valves fail.

Description:

The safety valves can relieve approximately 875 gpm at P = 2485 psig and T = 100*F.

Failure Probability: The failure of one valve to open is 1E-5/D. Thus the failure of all three valves is:

P(valves fail to open) = (IE-5) (IE-5) (IE-5) = 1E=15 l

0058v:1o/112486 0-17

.;n i:

l: TABLE.D.3-1(Cont)

.N0DAL PROBABILITY CALCULATIONS l : ;s

.. 8. RHR Relief Valve Reseats (VR)

Success: Relief Valve C16ses Failure: Relief Valve Fails to Close

Description:

Given that the transient is successfully mitigated, the RHR .

relief valve must close in order to prevent a loss of coolant.

I Failure Probability: The probability that the relief valve will not reseat is 3E-2.

O.

i

,o 1

0058v;1D/112486 D-18 l

p' TABLED.3-1-(Cont) 3 NODAL PROBABILITY CALCULATIONS-

- 9. .PORVs' Reseat (PRV) 1 Success: The PORVS that opened close. .

' Failure: None of th'e actuated PORVs close.

Description:

Given that the transient is mitigated, the PORVs must close in order to prevent a loss of coolant.

Failure Probability: The failure to reseat for a PORV is 3E-3.

If two PORVs operated, two must close P(2 PORVs fail to close) = EE-3

...q_

2 4

0058v:1D/112486 D-19

t 1

. TABLE D.3-2' l

CONSEQUENCE CATEGORY-FREQUENCIES (PER YEAR)

, . . FOR LETDOWN' ISOLATION RHR OPERABLE TREE f (INITIATING EVEfJT FREQUENCY = 1.01E-1)

-Frequency Frequency Net Consequence Present Modification Change Cateogry > Configuration- Case (+ or -)

SUCCESS 7.6253E-2 7.6253E-2 0 HLCI 3.5505E-11 3.5327E-11 -1.78E-13 LLFO 4.7266E-4 4.7266E-4 0 .

LSFO .2.3576E-3 2.3576E-3 0 LLC 0 2.1917E-2 2.1917E-2 0 l LSCO- 3.7935E-7 3.7935E-7 0

.: MSFI 8.4341E-13 8.3919E-13 -4.22E-15 M0PI 7.4732E-11 7.4358E-11 -3.74E-13 MSCI 6.3120E-11 6.2804E-11 -3.16E-13 i HOVI 3.5505E-26 3.5327E-26 -1.78E-28 HOPOV- 6.5448E-15 2.2816E-12 +2.275E-12 I

Total Change 0 i.

Q 0058v:10/112486 D-20

^

f1 TABLE D.3-3 CONSEQUENCE CATEGORY FREQUENCIES (PER YEAR) c FOR LETDOWN ISOLATION RHR ISOLATED TREE l

(INITIATING EVENT FREQUENCY

.- PRESENT CASE: 2.34E-1/yr MODIFICATION CASE: ~1.17E-1/yr)

Frequency Frequency. Net Consequence Present Modification Change Cateogry Configuration Case (+ or -)

SUCCESS l'8212E-1

. 9.1062E-2 -9.1058E-2 LLFI 1.0908E-3 5.4542E-4 -5.4538E-4 LLCI 5.0386E-2 2.5193E-2 -2.5193E-2

. LSFI 4.2379E-6 2.1190E-6 -2.1189E-6

- LSCI 3.915E-4 1.9575E-4 -1.9575E-4 HLCI 3.510E-6 1.7550E-6 -1.7550E-6 HOPI 3.510E-21 1.7550E-21 -1.735E-21 Total Change -1.17E-1 i

0058v:1D/112486 D-21

TABLE D.3-4 !

I

_ CONSEQUENCE CATEGORY FREQUENCIES.(PER YEAR)

. FOR CHARGING /SI-PUMP TREE- !

(INITIATING EVENT FREQUENCY = 1'.01E-1/yr) i Frequency Frequency Net

= Consequence Present Modification Change Cateogry Configuration Case (+ or -)'

SUCCESS 7.6488E-2 7.6488E-2 0

'LSFI 4.7269E-5 4.7269E-5 'LLCI 2.1748E-3 2.1748E-3 0

' MSCI- 1.7133E-5 1.7133E-5 0 HLCI 2.5802E-7 2.5976E-7 -6E-11 HOPI 2.5802E-22 2.5796E-22 -6E-26 LSF0- 2.5343E-3 2.5343E-3 0 LLF0 1.2885E-5 1.2885E-5 0 LLC 0 1.9725E-2 1.9725E-2 0 MOPI 2.2420E-7 2.2408E-7 -1.20E-10 MSFO 4.6819E-13 1.7069E-11 1.66E-11 MSCO 4.4959E-12 1.6391E-10 1.594E-10 MSFI 4.9463E-10 4.9438E-10 -2.50E-13

~

HOPOV 5.8903E-15 2.0534E-12 2.048E-12 i

Total Change 0 l 0058v:1D/112586 D-22

RI RV LTP R5 OR1 OR2 PZR Mt PRV IE. menemmmamses 1 SuCM55 name =======- me umsmammassume namesame===s 2 L5FI e a 3 LLeg a mesmannssansammensmemomma a.

a menssammmmma 4 $UCM55 v mensen memesmananmem mamamamenemmemmassamme 5 LSFI

-as maammamamma a _

m a se a sensus= sus

==amamame=== 6 ftSCI

m a se a F ECI a assomsaussammessmusemos a

es smesses== -

aus smaamasassammennessum a NorI

,.. m e a 9 SUCMSS m um a a m_ r - m 10 L5F0 a -- ason m ausmessamemesammesuma a a messas-mman 11 L5F0 a

m ammesmemma. _ m a a menes==memen 12 LLFO a

m a a a mesessmens__ - um _ ummensmesmemanaammma 13 LLCO a

o e menemmassessa 14 $UCM55 a a

==

m a a a mammsmemmum 15 LSFO m a menssammen- a assoasemmesmemmesamma o a a mesmusammes== 16 LSFO m sessemammasam m amassamassaan a e a namesanmuseum 1F LLFO a

m ammmmame==== m a omssmom ens summassamm mmmassamamsu sumassmesumanammassmansmasu 18 LLCO m a m I e a a a a manussemenem== 19 $UCM55 e mm a a mammensansmessassammans. .

m massummesmosa 20 L5FI a a a smessemesmausas e a a a e a seemessmemmum ammmesa mmamaassumasessemanemmassuem 21 ft0FI a a e a a a e e a a ensemanummensmans - - mmamammmens== 22 ftSCI a a e a a es ammansnamsmus m a a a samassamemammesummemummmansmomensam 23 ECI e

a enemmmaammu se a mesmas_ assensnesasamum 24 NOPI a a m e o a sesmase-- nameuse 25 SUCM55 a as -

a mesmessammasmuseamm - mem

a a amusammesummemmasummmu 26 ftSFO as a mamammensame asemassummma a amemammmassenessmassammamassem. smessmensmmmmanom 2F ftSCO m

m menemmmmmmu 30 SUCM SS se assi asse a Nasesassetmanss_ _

mesmsamassen 29 LLFO m

a a es sesamm 30 LLCO a ausmensma vaun- mm_ .

a m a mamanumamma 31 SUCCESS as a ==

m ensamemammmmensmesummsens==-_ . - .

en mammennemsnm mammmmmmmum 32 ftSFI se a a m N a

- memmasses_ ammesummassam 33 ftSCI e a m es ensammmenesus 34 $UCM55 mamammemumm as a a ==

m a a ammusmaammans.

a emmemummassa 35 ftSFO m a a assesmanammme a a sesssemamammmesens_--. . =mmsmessanssum 36 LLCO a

m MeMessses mesmaassummassammammass- ammassammmmeses 37 ftSCO a

m Se SUCCESS messanssammam a

messamm __mm se aussassammesa

-- m 39 ftSFI se e a a semessam messammensammemmmamemamese m as0 ft0PI a er- a m_

o N m a meer ssesamsm ass _ namesessmansom 41 ftSCI a en

. a Se as esmesssamanism__. mesamenomassena 42 NLCI ensammmanumans

mammameneemas

- se 43 NDPI asumisemenssummmen__.. -- unsames a

a c NDPov m.memessesam messamm mmeness.samasu man.sso mssesme mmassa.nsmuse.amassesse Figure D.3-1 Charging / Safety Injection Pump Actuation D-23 i

F i

}

i RI mv LTP R5 OA1 en2 P2R Mt Fety SE 1 SacCE55 sus mm-- amene omsman- - a summmmuness 2 LLTI ;

e a a ==___ mamammesamm maammum 3 LLCI

e e ---. 4 gacCESS m

e uma a _. assammam ummmmemassee 5 LSFT e a a a a sus - assammmmmmenseus__ mesmusa 6 LSCI e a a m m 7 Is.CI sesman - en _ _ me em a um = 0 HOPI a

m samsmessammess 9 SUCCESS a mas a

m -m to LLFO a asma

==_

a a ammamememma 11 LSFO a a semannessen smusammemusa =

a = 12 LLFO

m a a a a a essa == - esmamse a 13 LLCO ammmmmmmmmm m o ammmmmmuness 14 SUCCESS e a ;-- -- =

a m l m a mammesseness SS LLFO m- -

J esma amammene omsmesumm '

es a a a asummmeammes 16 LSF0 m m as ammmmes a r aus es a m = 17 LLFO a a a a a e a ammmm mmensammesumme--

m 18 LLC 0

= a -

m a m !

19 SUCCESS a w as m

e a o susemamismessmem. .

mammamemaman sumsmenummmessen. 20 LSF0 m- m _ _ _

m es a ese name _ momens== 21 LSCO o a a mesmusammen a 32 38CCE55 <

a m snuseammesemman_

mmassem esummmmassen 23 LLFO ,

m seen_ 1 m a a e 24 LLCO a a m m 35 SUCMS$

a e ==

= m sessaimmasamesens -

- - se summme===== 36 L5F0 m sammanneem se a a m .27 L5C0 a es essenesensammesm__

messum _ _ summmmanssamma se SUCCESS m - mm aus u -

omsmesummammu 29 ftSFI a

e a a m 30 sq0PI m amm _ _ - sess_

m ._

m a a m 31 ftsC1 a m a _

m a ensammmmmmme s2 fe.cz ass a a a 55 NOVI a

a 34 HDFW emmassammmema__ ==_

Figure D.3-2 Letdown Isolation - RHR Operable D-24

l e

IE st! IW LTF sts OR1 OR2 F2R vlt P9tv

= 1 SUCCESS

-- ses em _ _ ==

-- - m mammmmmamass 2 LLFI e- e a a um a a 3 LLCI m

a m 4 SOCCESS mammesmusemann sai "em a saamassess a 5 L5F2 m a a a a sus sumsmsmemmunesem u 6 L5CI

a. N m a essansamenme m 7 DECT

= ese a sensus e e pe0PI e

= 9 SUCCESS

==

a m a a 10 LLFO sumamsmansumssummesuses suam

=

a m a a 11 LSFO emaneau som a aumena a a a a 12 LLFO a a a namesomeman .m sem assmusmessesammesmessesmemmassumasasemameuse m 13 LLCO e es a a a 14 $uCCE55 m a a a a a 15 LLFO a esmessemassamm am === esusammmme a a a e a m 16 LSFO em m se assumma-a m a a um 17 LLFO m as se a e a a ==__

manness assumsmemannum 18 LLCO se a a a a a assenessamenmessememisesum 19 SUCESS measumme __ meessuemmemummme

, a a a assmana ---- mm a 20 LSFO a a messannesmenessem m a a a es esmamemmesmennessummone == m-- samm 21 LSCO mem-- a 22 SUCCESS

a se sessammmammesamm _ mesummesm _ . ==

m emusammeassamassammmesema mesmessmussen 23 LLFO m a a se a ssmesumisemamense mesaammmemum mesms== 24 LLCO m a m a asessesmessamm 25 5UCCESS a

m as - = == 26 L5F0 N m a a a esm. m. samassumm-- == 27 LSCO semsmusumme=

se mess ==memamm as SUCCESS m smenusmammmmmmmmessam a emessemanassa esmessammann 29 ftSF1 m a e a e assusammeasssssessa emmassem . -- m m 30 ftDPI a a m a a m ammammmamassamm--- sum. m 31 ftSCI t a m u

-m a omrmamensmessum 32 DEC1 a mamme a muassimuses== = 33 envr

=

.m.seammesissssssamenessassasmaassessassenessesses - -

e e enrov I

i

)

\

Figure D.3-3 J Letdown Isolation - RHR Inoperable (Isolated)

D-2b

D - c - B - A A _

0 2 n 1

n 1

L 6 I

8 A 9

. F 1 P 6 O 3 T

. L 9 E F S 0 U S O N -

H G

I 4 N A -

I R 3 -

T T -

S D E 2 W E R

U .

G I -.

F E

Tt 1

W .A i

E. s } ..-

.,e.i.

.w 1 N. em.

1 i

..=7 w r e..

v..

t

,L I

. .A=

P,P l

l r

A E. .i .e 2 I

m. \.N.

W i

i

., =. e.

ea.

2

..W, 4 /.[ v.o

,t.

T . w..

t imC m,P .l PP A

l l

E Tt m I. .

..1 m M. .i.

P 3 I 8 3 ,

. ..e Ms i

., u. w.

c..

3 .

1mt r. .C . .T.. er s.

.e i

,,f A ..S.

..t i . ,L

..U l

A ,

T..P m,PmC mI,Am l

l

. ..te mmAleO t

t W.

A P . er 4 m-

. E . .

4 I

.,1T .

. . i e A t .

..EC DI . t . .Y i .

A L i

L ,.o t3

. DA A. . .L. I P ,A .

l l

f E

T ., .

A ITt.n . , _

A W L-L IGP m

, B. I 5 5 D..P ,

. L.

. P. ..

.i.

.m.1 .

1

. T U Y .

..PT a . L.

?T. , .fa t e..W 1.tC 1 L

rtt.

. iL ,A ,A.E. .e.1.

.t. l l

L I.t m E. 6 6 ,A D 3 ,

= P. .

1

..f.

T .T. T =. , . .9 0

t L

1 L

7

.A .

t.TP.

P

.L T

c B - A D - -

mm

6...,

A.

!.s 2 l 1 FA& LURE OF Out itAIN OF L10P I ..

B B

/N 0004

- l -

/ PMV FAILS to P09V FAILS 70 OPru 04 DEMNO RECEIFE NION P9E55Vitt SIGuA

=

A A 0002 0003 cire,0 ci,c,,,, WESTINGHOUSE 3.0000t-03 8.F200E 04 1 TRAIN OF LTOP FAILS FIGURE D.3-5 8: 40 3-APR-86 g 2 l 1 D-27

M- ..

4

. fq r - 83 l 12 I il l IU !' a l 8 l 7'

. .I

.i.::. eieie. .%.te e6su

~ ej ,

.4 4 d' C

t test i

. I '

alore'et 8 Alle e 8458e*88 f 4lC:

IS 0 Lost te ELest E

9et 80e#

~

6 I f f 4 stunt le POWte f AlttME ettWS .ALUR IWenafustak F4thamt le Q

$leCUlf le CleCWal FalktRE SletUlf F&the fe CLSet 0

e sett 8083 teet sepe entsverett s , -

8 0000t'43 0.eeest-et

~

. I i 5 i feaftlFeefEe Fult OLeWS SPueledt fetP FA8&tmt ettet f astget actWet feaggreeste F4the e'utestak.

vieL44 OF Eletutt le la AaffeCL958 F AILS

~ *~ of fitt 34 taste 44e8981 PAdit GF Cleetill 8

PttstAtWEELT SPts C

e Seed Seet ese Geef 8030 0009 Gent

' GICff altdu eseL4ep esceu ett ti 340006 0e 6 00638 $$ l SeB3t el 9.seest+es 3.tC e.seest es e.seest el G.ecettatt 9.0ee0f-88 e,sese

- I 4 I I e Linst edsfen 48e Limt selftw estee staaste testact estela Autec6est retssgitt fonedt eW8ttle 334e ept33 teth f atttigt tatLe te toegast 3Wittee gestagpgefAg 0*tE feMerte ' ertes folk eesst4LLt skette 8

/'l sel8 Sete est5 0017 0818 este GlL83JAt3 el80LGeF efte47t As ens 4C8W l seest Se 6 0000t+ 5 3 80808-e4 I eleet et S.eeset et 0.Seest *06 4 seest es 0 00000 se

. I I I Petsbytt.

'09ept svi ttu Liftt f SWIIcn atta= totisets attat teak 33f t e*t45 3443 SPt45 FAIL T9 Baaeltte f AILUst 't*Freaf tflit f olks to S'fDAf t f alLe to 9Pte4ft let tevot ele 2 F AILS A

... seis os.. esse soli

..4 018133159 9 ts t a 3400 s e 'P 40%t es Sles1AC9 6.9e00$ *94 4.e990t'e4 3.GSlof +04 A38886e' 9.eSeet 9% f. egg

. setet... . soset ... e eseef o. e seen e. e..so is l 12 l 11 i 10 l 9 1 8 1 7 w %,,.

e , _m____.-____ _ . - _ _ _ _ _ _ _ _ _ . - . _ _ _ _ _ . _

/

I i

l i

0 5 4 3 J i 1 1 1 1 i t l

I i

(

l I

E g

f. 41.LJ.Rt.9,C,Cun g ..g. .gg. .pa getASIC AL

,m.. .. et.=

0 4843

.m

. a -.,

I 5 , 5 -

Omf eetah CIRCWit getants f aittait Octuus sattung accusts

{ FMt e 98teg PitMI.EA. OrtRLc48 9tfitt 8'WRIOWELt TAIP5 le 8IACUlf se surectou FiltMf ustt BPEA P4Af Of CI A:Ulf C

een uso seas 0430 $33F E'Artas $306 400 pased 6 800M <.0 B.00608 85 4 0000E 06 9 400M 06 S.30006 56 4.00eM 64 i..ltit g t.S.?.t. .is.m.aus

.m ing t.s..e.t. test .ript.et.St.apf

.. . . . .te . con..s ac.i.43 tsp a .au.t.#.CL.U.it..

. . F.et.t. sun.g.....

m. ......... ... ... .. . .

TI s r? ,

,,,, APERTURE' St.SJJ4CU s eooor.o.

92tubt9F seen-es

$3C94JCM 3.sooss-o*

Af54Cag s .eason -es byt})L Al g Y g.ceast te 8.aecet-ti S. A00t-01 0.0000E 85 i i e _

IOM thif CM b leer t av s lam tt. Ae seitset ette, 50 6 . 9. E 5u. 6

Jf t 9 3348 f*tes f at.B 10 # Al.veg leSteusqtsteileg e

9 8'ttm'tf fB8 rawc #

ILir s A. cam *C ft

'P 481# E9 F At'. S Also Availalile On Aperture Card A eesa em ea es..

msme. . u . u.., ,,...3c., ,mx, ,,,,,,:,, WEstlNCHOUSE

. . .:.w ... . . .nn - . s.onon .. s .mi-a s inn..,

..n... . .u ..: e . mn .,i . . m.i ... . -suu . . ISOLATION VALVES Fall TO CLOSE FIGURE D. 3-6l l I ,8 9 d-APR-8G L 6 1 5 1 4 1 3 l 2 l 1 D-28 776t//0/P3-/f ~-

ML20236M673

Contents

Text

1.0 INTRODUCTION

SUMMARY

7.0 CONCLUSION

8.0 REFERENCES

1.0 INTRODUCTION

1.1 Background

SUMMARY

SUMMARY

SUMMARY

7.0 CONCLUSION

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Reference:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

m a a a a a essa == - esmamse a 13 LLCO ammmmmmmmmm m o ammmmmmuness 14 SUCCESS e a ;-- -- =

m as - = == 26 L5F0 N m a a a esm. m. samassumm-- == 27 LSCO semsmusumme=

Navigation menu

ML20236M673

Text

1.0 INTRODUCTION

SUMMARY

7.0 CONCLUSION

8.0 REFERENCES

1.0 INTRODUCTION

1.1 Background

SUMMARY

SUMMARY

SUMMARY

7.0 CONCLUSION

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Reference:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

m a a a a a essa == - esmamse a 13 LLCO ammmmmmmmmm m o ammmmmmuness 14 SUCCESS e a ;-- -- =

m as - = == 26 L5F0 N m a a a esm. m. samassumm-- == 27 LSCO semsmusumme=

Navigation menu

Search