|
|
| Line 17: |
Line 17: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:Topics: EPRI NP-4128 Risk assessment Volume 2 l l Plant Safety Project 1842-4 1 | | {{#Wiki_filter:}} |
| ( Electric Power Plant availability Final Report I Research Institute Sequoyah nuclear power plant July 1985 l GO methodology i
| |
| Systems reliability analysis l '
| |
| l l
| |
| g~;'
| |
| ~
| |
| n; Full-Scale Plant Safety and 4
| |
| " 43 Availability Assessment-A Demonstration of GO System ,
| |
| Analysis Methodology Volume 2:
| |
| . Appendix-System Level Detailed Models Prepared by Pickard, Lowe and Garrick, Inc.
| |
| Newport Beach, California goMBRBMSlR7 e e
| |
| | |
| REPORT
| |
| | |
| ==SUMMARY==
| |
| | |
| SUBJECTS Risk assessment / Reliability, operations, maintenance, and human factors / Safety analysis TOPICS Risk assessment Sequoyah nuclear power plant Plant safety GO methodology Plant availability Systems reliability analysis AUDIENCE Safety and productivity managers Full-Scale Plant Safety and Availability Assessment-A Demonstration of GO System Analysis Methodology Volumes 1 and 2 The probabilistic GO methodology has demonstrated its ability to perform plant-level safety and availability analyses. The meth-odology proved effective in modeling system performance, and the GO sof tware, numerically efficient in quantifying system models and identifying critical components.
| |
| BACKGROUND in the past three or four years, utility analysts have found GO methods easy to use and computationally efficient in system reliability studies. The appli-cability of the method for larger, integrated full-plant safety and availability models, however, had not been evaluated. EPRI and cosponsor TVA initiated
| |
| . a demonstration study in 1981.They designed the study to provide a thor-ough plant-level test of the methodology without unnecessary detail.The initial phases of the assessment-through 1983-are described in EPRI report NP-3382.
| |
| OBJECTIVE To demonstrate the applicability of GO methodology and sof tware to a plant-level safety and availability analysia.
| |
| APPROACH For the safety study, the project team developed 14 initiating event sequences. Two of these sequences-large loss-of-coolant accidents and loss of steam flow-were quantified and analyzed.Those sequences are representative of the complexity found in a Level 1 probabilistic risk assess-ment. For the availability study, they modeled and integrated more than 40 production and support systems. They quantified the integrated models for assessing the plant performance at 100% rated power. The TVA's Sequoyah nuclear power plant served as the reference plant.
| |
| RESULTS The study demonstrated that the GO methodology is an effective system analysis technique for both safety and availability studies. In the safety study, the GO model representation of the event sequence, the integration of GO system models into the sequence, the quantification of the sequence model, and the identification of critical components all were successful. A plant-level availability model, c nsisting of more than 40 systems having EPRI NP 4128s Vols.1 and 2
| |
| | |
| g Je -
| |
| _--+h--w D- +d a 4 -
| |
| 4 > A ' +
| |
| J '=-w -=4--4>- 4-+a# *- ."La
| |
| *A-4 4 --a 2 h + &_-,-(e i more than 1500 compon:nts, was constructed and quintified. However, because of limitations on the scope of this demonstration, the quantita-1
| |
| -tive results constituted examples only, rather than the results of a com-plete plant-specific safety and availability analysis. ' '
| |
| In addition to updating the material provided in interim report NP 3382, this final report contains several new approaches developed in response to the requirements of this large, complex, plant-level analysis and more detailed information on system and safety models. Volume 1 documents the plant-level models, whereas Volume 2 contains the appendix docu-menting the detailed system-level models.
| |
| EPRI PERSPECTIVE in a large-scale system analysis, attributes such as communication,
| |
| .t comprehension, modification, and documentation of the models are very important. The GO methodology has very good characteristics in these respects. Especially when the analyzed results are to be applied to other engineering activities, such as enhancement of operating procedures and system maintenance, consideration of system design alternatives, and improvement of plant availability, the GO representation.of system function and interdependence with linked models, together with its effi-
| |
| ,, ciency in model quantification may possess unique advantages. The -
| |
| 1"-
| |
| methodology is also suitable for analyzing plant availability. This capa-bility is expected to be very useful to the electric utility industry.
| |
| PROJECT RP1842-4 EPRI Project Manager: Boyer B. Chu Nuclear Power Division Contractor: Pickard, Lowe and Garrick, Inc.
| |
| For further information on EPRI research programs, call EPRI Technical Information Specialists (415) 855-2411.
| |
| e b
| |
| k
| |
| | |
| Fuli-Scale Plant Safety and Availability Assessment-A Demonstration of GO System Analysis Methodology Volume 2: Appendix-System-Level Detailed Models NP-4128, Volume 2 Research Project 1842-4 Final Report, July 1985 Prepared by PICKARD, LOWE AND GARRICK,INC.
| |
| 2260 University Drive :
| |
| Newport Beach, California 92660 Principal Investigators P. H. Raabe D.A.Rony K. N. Fleming Contributors A. W. Barsell D. C. Bley W. C. Gekler J. M. Geumlek D.H. Johnson s A. Mosleh R. J. Mulvihill J. G. Stampelos D. W. Stillwell D. M. Wheeler Prepared for Electric Power Research Institute 3412 Hillview Avenue e Palo Alto, California 94304 EPRI Project Manager B.B.Chu Risk Assessment Program Nuclear Power Division l
| |
| | |
| ~
| |
| r ,
| |
| :9' i
| |
| ORDERING INFORMATION -
| |
| > Requests for copies of this report should be directed to Research Reports Center (RRC), Box 50490, Palo Alto, CA 94303,(415) 905-4081. There is no charge for reports requested by EPRI member utilities and affiliates, U.S. utility associations, U.S. government agencies (federal, state, and local), media, and foreign organizations with which EPRI has an
| |
| -information exchange agreement. On request, RRC will send a catalog of EPRI reports.
| |
| g f
| |
| 1 Ccpyright @ 1985 Electnc Fbwer Research institute,Inc. All rights reserved.
| |
| NOTICE This report was prepared by the organization (s) named below as an account of work sponsored by the Electnc Power Research Institute,Inc. (EPRf). Neither EPRI, members of EPRl the organZation(s) narned below, nor any person acting on behalf of any of them: (a)makes any warranty, express or imphed,with respect to the use of any information, apparatus, method, or process d1SClosed in this report of that such use nay not sninnge pnvately owned rghts, or (b) assumes any liabelaties with respect to the use of, or for damage 1 resulting trorn the OSe of.
| |
| . any information, apparatus, rnethod, or process disclosed in 8his report.
| |
| . Preparedby Pekard. Lowe and Garnck. Inc.
| |
| ' Newport Beach,Cahfornia
| |
| | |
| EPRI FOREWORD The Sequoyah nuclear power plant full-scale safety and availability demonstration has been a significant endeavor within the Risk Assessment Program of the Nuclear Power Division. The primary objective of this study has been to demonstrate the use of GO methodology in a large-scale system analysis and to assess the technical merits of the methodology in such an application. This foreword is intended to share experience and observations concerning the strengths and limitations of the GO methodology and sof tware in this large-scale application.
| |
| The use of G0 techniques for large-system analysis was successfully demonstrated in this study. Several system-level benchmark studies have also been performed recently by utilities. By now, the methodology has evolved into a practical engineering tool. At present, more than 30 domestic utility companies have in-house engineering capability for using GO methodology and more than 10 are employing this technique routinely. These applications continue to provide us with supplementary information to use in assessing the GO methodology. The collective assessment so far is summarized below.
| |
| G0 EVENT SEQUENCE DIAGRAM (ESD) DEVELOPMENT In some probabilistic risk assessments (PRAs), ESDs are used to describe the safety logic involved in an initiating event. These ESDs perform the same function as event trees (i.e., describing the progression, logic, and timing of event sequences). The GO representation has been use.d to characterize 13 ESDs in this study. It appears that the GO representation of ESDs provides a good portrayal of intrasystem dependencies and is flexible to manipulate yet can still be used to generate " standard" event trees in conventional format. However, the construction of G0'ESDs may require more manpower resources than the preparation of event trees. The logic models of those G0 ESDs could at times be complex to develop.
| |
| SYSTEM MODEL DEVELOPMENT AND QUANTIFICATION In this area, the GO method has demonstrated its strength. GO system model development appears to be less difficult than other approaches. The method can effectively handle system dependencies, feedback loops, system details, and model iii
| |
| | |
| modifications. The output of a GO computer run provides information on the maximum error accumulated from the roundoff error and the deletion error introduced from user-preassigned deletion criteria used in the model evaluation procedure. This is useful information in the system quantification process. Since the GO software uses a direct . evaluation procedure to quantify the GO models, the quantification procedure is numerically efficient.
| |
| FAULT SET IDENTIFICATION AND RANKING The GO software determines the minimum cut sets frc.n the G0 system model and ranks their importance by several criteria. However, there are several G0 operators, such as the NOT gate, the signal splitter gate, and two or three others, that have l logical structures very different from conventional fault tree analysis concepts.
| |
| Use of these types of GO operator will not allow accurate cut-set identification.
| |
| Furthermore, at the present time because the cut-set identification process used in the GO software is not numerically optimum, that process results in lengthy computer runs for large models. Additional software development may be required to eliminate this deficiency in the software.
| |
| SYSTEM LINKING AND INTEGRATION The GO system models can be readily and correctly combined in accordance with event sequence models. These sequence models can then be quantified efficiently. The models' linking, integration, and sequence quantification a,ppear to be as effective as other procedures. such as use of event tree or fault tree techniques in PRA.
| |
| However, some difficulty has been encountered in the identification of don.inant contributors in such GO sequence models--a very important aspect of system analysis.
| |
| In the report, a procedure has been devised for determining the dominant contributors by using GOST software (a GO module). However, the procedure still appears to be tedious.
| |
| OTHER COMMENTS In a large-scale system analysis, attributes such as communication, comprehension, modification, and documentation of the models are very important. The GO models have very good characteristics in these respects. The methodology is also suitable for analyzing plant availability. This capability is expected to be very useful to the electric utility industry.
| |
| iv
| |
| | |
| In conclusion, the GO methodology was found in this study to be a viable alternative to fault tree analysis for PRA. When the results of PRA are to be applied to other engineering activities, such as enhancement of operating procedures and system maintenance, determination of system design alternatives, and application to plant availability improvement, the GO representation of system function and inter-dependence with linked models, together with its efficiency in model quantification may possess unique advantages. However, the G0 approach will require further er.hancement, particularly in the identification of cut sets and dominant contributors in large models.
| |
| e We are in debt to Roberta Galante, Robert Christie, L. Wang Lau, and John Raulston of TVA and to William Sugnet of EPRI for their valuable suggestions and guidelines in this study. We are also grateful to TVA, owners of the Sequoyah nuclear power plant, for providing technical manpower and computer resources to support this work.
| |
| Boyer B. Chu, Project Manager Nuclear Power Division y
| |
| | |
| ABSTRACT This report marks the completion of a research project to demonstrate the usefulness and effectiveness of the GO methodology, originally developed by Kaman Sciences Corporation, to assess the safety and availability of nuclear power plants. The technical approach was to develop limited scope and availability assessment models patterned after a nuclear power plant design similar to the Sequoyah Nuclear Plant Unit 1 and to demonstrate that these models could be quantified using hypothetical data for a partially comple e list of risk and loss of productivity contributors. The basic capabilities of quantification of large plant level models and determination of contributors was demonstrated. Important insights about strengths, limitations, and ways to circumvent these limitations of the GO methodology in large, plant level applications were identified.
| |
| vii
| |
| - - - - , ,,n, ,,. , ,--- , - . ---- - , - , -- , , - - , - , , - - - , - --,--,._,,--,.-,----------------,,m,.--n<
| |
| ~ -,4,-..- n.----,
| |
| | |
| ACKNOWLEDGMENT The authors are pleased to acknowledge important contributions to those not listed as investigators. This study would not have been possible without the support of Tennessee Valley Authority (TVA) that provided the demonstration plant, documentation of the design and safety characteristics, and in-depth technical reviews of report drafts and project deliverables. Among the many at TVA deserving mention, Roberta Galante and Larry Proctor provided especially noteworthy contributions through their careful reviews and suggestions. The authors are deeply appreciative of the important enhancements to the technical quality of the report made possible by the review of William R. Sugnet of the Electric Power Research Institute. Finally, the publications staff at Pickard, Lowe and Garrick, Inc., is commended for producing a quality manuscript.
| |
| ix
| |
| | |
| h 4
| |
| 4 CONTENTS T
| |
| . VOLUME II
| |
| +
| |
| Appendix g A SYSTEM ANALYSES A.1-1
| |
| ~.
| |
| A.1 Introduction A.1-1 A.2- Electric Power System A.2-1 A.2.1 Introduction and Summary A.2 .
| |
| A.2.2 System Description A.2-10 l
| |
| A.2.3 System Logic Models A.2-56
| |
| . A.2.4 Quantification of System Unavailability A.2-89 A.3 Essential' Raw Cooling Water System s A.3-1 4
| |
| A.3.1 Introduction A.3-1
| |
| , A.3.2 System Description A.3-4 i A.3.3 - System Logic Models: A.3-21 A.3.4 Quantification of System Unavailability A.3-28 A.4 Component Cooling System A.4-1 A.4.1 Introduction A.4-1
| |
| ] , A.4.2 System Description A.4-5
| |
| !: , A.4.3 System Logic Models. A.4-18
| |
| !. , A.4.4 Quantification of System Unavailability A.4-28
| |
| ! A.5 Compressed Air System ~ A.5 l A.5.1 Introduction and Summary A.5-1 4
| |
| A.5.2 System Description A.5-7
| |
| : j. LA .5.3 System Logic Model A.5-21 A.5.4 Quantification of System Unavailability A~.5-27 A.6 Engineered Safety Features Actuation System A.6-1 A.6.1 Introduction A.6-1
| |
| 'A.6.2 System Description A.6-7
| |
| .g A.6.3 System Logic Models A.6-35 A.6.4 Quantification of System Unavailability A.6-42 A.6.5 References A.6-46 4
| |
| 4 1.
| |
| xi i
| |
| tr
| |
| #w--rm.-w.+-, ,ws-ir-,, - - . . - ,-w--r_ w w 7y ~~,.v. . p ,.f e v r ' 'Tr-''v*fw'vw- M " = ~n 5 C 9 7 *-~'"~-~P**T ** W-T'""*"""'M*w'-''P"***** "--* " * '<'-- we
| |
| | |
| CONTENTS (continued)
| |
| VOLUME II Appendix Page A.7 Reactor Trip System A.7-1 A.7.1 Introduction A.7-1 A.7.2 System Description A.7-2 A.7.3 System Logic Models A.7-16 A.7.4 Quantification of System Unavailability A.7-20 A.8 Auxiliary Feedwater System A.8-1 A.8.1. Int'roduction and Summary A.8-1 A.8.2 System Description A.8-3 A.8.3 System Logic Model A.8-15 A.8.4 Quantification of System Unavailability A.8-21 A.9 Emergency Core Cooling System A.9-1 A.9.1 Introduction A.9-1 A.9.2 System Description A.9-9 A.9.3 System Logic Models A.9-32 A.9.4 Quantification of System Unavailability A.9-82 A.10 Containment Spray System A.10-1 A.10.1 Introduction. A.10-1 A.10.2 System Description . A.10-5 A.10.3 System Logic Models A.10-14 A.10.4 Quantification of System Unavailability A.10-17 A.11 Auxiliary Systems Safety Analysis A.11-1 A.11.1 Introduction A.11-1 A.11.2 System Description A.11-4 A.11.3 System Logic Models A.11-11 8-1 B EVENT SEQUENCE DIAGRAM (ESD) AND G0 MODELS ESFAS OUTPUT WITH PERFECT INPUT C-1 C
| |
| D AUXILIARY TO FRONTLINE DEPENDENCIES 0-1 INPUT FILE FOR ESD 7 G0 MODEL E-1 E-xii
| |
| | |
| ILLUSTRATIONS VOLUME II Figure Page A.2-1 Sequoyah Electric Power System - Simplified Block Diagram A.2-2 A.2-2 Sequoyah Electric Power System - Operating Conditions A.2-3 Schematic A.2-3 Instrumentation and Control Power Systen Block Diagram A.2-5 A.2-4 Sequoyah Electric Power System P&ID A.2-16 A.2-5 Instrumentation and Control P&ID A.2-18 A.2-6 Air Conditioning Configuration A.2-23 A.2-7 Sequoyah Electric Power System GO Safety Model A.2-63 A.2-8 Sequoyah Electric Power System G0 Availability Model A.2-65 A.2-9 Safety Model Supertype 190 A.2-67 A.2-10 Safety Model Supertypes 150, 205, 210 A.2-69 A.2-11 Safety Model Supertype 180 A.2-70 A.2-12 Safety Model Supertype 170 A.2-71 A.2-13 Safety Model Supertype 175 A.2-72 A.2-14 Safety Model Supertype 230 A.2-74 A.2-15 Safety Model Supertype 240 A.2-75 A.2-16 Safety Model Supertype 250 A.2-76 A.2-17 Safety Model Supertype 260 A.2-77 A.2-18 Availability Model Supertype 170 A.2-78 A.2-19 Availability Model Supertype 150 A.2-79 A.2-20 Availability Model Supertype 175 A.2-80 A.2-21 Availability Model Supertype 200 A.2-81 A.2-22 Availability Model Supertype 210 A.2-82 A.2-23 Availability Model Supertype 220 A.2-83 A.2-24 Availability Model Supertype 230 A.2-84 A.2-25 Availability Model Supertype 235 A.2-85 I A.2-26 Availability Model Supertype 240 A.2-86 A.2-27 Availability Model Supertype 250 A.2-87 A.2-28 Availability Model Supertype 260 A.2-88 xiii
| |
| | |
| - ... .. . . _ . .. - - - - .- ~.. -- . . . .
| |
| 4 ILLUSTRATIONS (continued)
| |
| VOLUME II
| |
| ' Figure Pg i A.3-1 Schematic Diagram of ERCW Systeai A.3-8 A.3-2 .ERCW Pumping Station. A.3-14 A.3-3 Diagram of ERCW Header Supply to Diesel Generator Heat A.3-15 Exchangers A'.3-4 .G0 Model for ERCW Atailability A.3-24
| |
| 'A.3-5 G0 Model for ERCW Safety Analysis A.3-26
| |
| . A.4-1 Simplified Component Cooling System A.4-8 4 A.4-2 Component Cooling Water System / Essential Raw Cooling A.4-9 Water Header Arrangement A.4-3 .CCS Safety Model A.4-20 4 A.4-4 Availability Model A.4-29 A.5-1 Sequoyah Compressed Air System Simplified Block Diagram A.5-2 A.5-2 . Sequoyah Unit 1 Compressed Air System Boundary Conditions - A.5 i .A.5-3' Sequoyah Compressed Air System Schematic A.5-11 A.5-4 . Sequoyah Compressed Air System G0 Safety Model A.5-23.
| |
| I A.5-5 Sequoyah Compressed Air System G0 Availability Model A.5-24 A.5-6 Sequoyah Compressed Air System G0 Supertypes A.5-25 A.6-1 Logic Diagram of Engineered Safety Features Actuation A.6-12 System p A.6-2 ESFAS Basic Safeguards Actuation Diagram A.6-13 A.6-3 ESFAS G0 Model A.6-16 A.7 Reactor Trip System Block Diagram A.7-6 A.7-2 Reactor, Trip Breaker RTA A.7-8 A.7-3 Reactor Trip System - G0 Model A.7-18 f A.8-2 A.8-1 Sequoyah Unit 1 Auxiliary Feedwater System Simplified Block Diagram A.8-2 Sequoyah Unit 1 Auxiliary Feedwater System Physical A.8-4 Boundary of Conditions
| |
| ,. A.8-3 Auxiliary Feed.4ater System Simplified System Schematic A.8-7 A'.8-4 Sequoyah Unit 1 Auxiliary Feedwater G0 Model A.8-18 A.9 ECCS Simplified P&ID A.9-13 ;
| |
| A.9-2 Sequoyah Lower Head Cold Leg Accumulators Simplified P&ID A.9-14
| |
| 'A.9-3 HPI Model-(ST 1900) A.9-40 A.9-4 CVCS Subsystem for HPI Model (ST 1930) A.9-43 A.9-5 CVCS Injection Paths for HPI Model (ST 1931) A.9-44 q I
| |
| 3
| |
| ; xiv
| |
| __ - - . . . ~ . _ _ _ _ , _ . _ _ , _ . . . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ . _ _ _ _ _
| |
| | |
| ILLUSTRATIONS (continued)
| |
| VOLUME II Figure Page A.9-5 SI Subsystem for HPI Model (ST 1910) A.9-45 A.9-7 SI Paths for HPI Model (ST 1920) A.9-46 A.9-8 Bleed and Feed Models A.9-48 A.9-9 High Pressure Subsystem of Bleed and Feed 1 Model (ST 1901) A.9-49
| |
| -A.9-10 CVCS Subsystem for Bleed and Feed 1 Model (ST 1932) A.9-50 A.9-11 CVCS Injection Paths for Bleed and Feed 1 Model (ST 1933) A.9-51 A.9-12 SI Subsystem for Bleed and Feed 1 Model (ST 1911) A.9-52 A.9-13 SI Paths for Bleed and Feed 1 Model (ST 1921) A.9-53 A.9-14 High Pressure Subsystem of Bleed and Feed 2 Model (ST 1902) A.9-54 A.9-15 CYCS Subsystem for Bleed and Feed 2 Model (ST 1934) A.9-55 A.9-16 CVCS Injection Paths for Bleed and Feed 2 Model (ST 1935) A.9-56 A.9-17 SI Subsystem for Bleed and Feed 2 Model (ST 1912) A.9-57 A.9-18 SI Paths for Bleed and Feed 2 Model (ST 1922) A.9-58 A.9-19 PORV Configuration A.9-60 A.9-20 PORY Models for Bleed and Feed 1 and 2 Models A.9-61 (STs 1905 and 1906)
| |
| A.9-21 High Pressure Recirculation Model (ST 1500) A.9-62 A.9-22 RHR Subsystem for HPR Model (ST 1950) A.9-63 A.9-23 CVCS Subsystem for HPR Model (ST 1960) A.9-64 A.9-24 SI Subsystem for HPR Model (ST 1970) A.9-65 A.9-25 SI Paths for HPR Model (ST 1910) A.9-66 A.9-26 Low Pressure Injection Model (ST 1100) A.9-71 A.9-27 Closed Loop Residual Heat Removal Model (ST 1700) A.9-72 A.9-28 Low Pressure Recirculation Model (ST 1400) A.9-78 A.9-29 Low Pressure Hot Leg Recirculation Model (ST 1800) A.9-79 A.9-30 Single Accumulator (ST 100) A.9-80 A.9-31 Accumulator Model A.9-81 A.10-1 Centainment Spray Simplified P&ID Diagram A.10-7 A.10-2 Containment Spray Injection Model A.10-18 A.10-3 Containment Spray Recirculation Model A.10-19 xv
| |
| | |
| ILLUSTRATIONS (continued)
| |
| VOLUME II-Figure Page
| |
| 'c A.11-1 Simplified Auxiliary Systems Diagram A.11-6 A.11-2 Auxiliary Systems G0 Model A.11-13 A.11-3 Supertype 260 - Diesel Generator Availability A.11-21 A.11-4 Supertype 250 - ERCW Valving for Diesel Generators A.11-22 A.11-5 Supertype 185 - Diesel Generator, ERCW Dependency Logic A.11-23 A.11-6 Simplified Diagram of Diesel Generator - ERCW Dependency A.11-24 A.11-7 Simplified G0 Model of Diesel Generator - ERCW Dependency A.11-25 B-1 Large LOCA ESD 1 B-2 B-3 B-2 Medium LOCA ESD 2 B-4 B-3 Small LOCA ESD 3 B-5 B-4 Steam Generator Tube Leak ESD 4 B-6 B-5 Loss of RCS Flow ESD 5 B-7 B-6 Loss of Feedwater Flow ESD 6 B-8 B-7 Total Loss of Steam Flow ESD 7 B-8 Turbine Trip ESD 8 B-9 B-10 B-9 Spurious Safety Injection ESD 9 B-10 Reactor Trip ESD 10 B-11 B-12 B-11 Steam Loss Inside Containment ESD 11 B-13 B-12 Steam Loss Outside Containment ESD 12 B-14 B-13 Core Power Excursion ESD 13 B-15 B-14 ATWS Event Tree ESD 14 B-15 G0 Model for ESD 1 Large LOCA B-16 B-17 B-16 G0 Model for ESD 2 Medium LOCA B-18
| |
| : B-17 G0 Model for ESD 3 Small LOCA B-19 B-18 G0 Model for ESD 4 Steam Generator Tube Leak B-20 B-19 G0 Model for ESD 5 Loss of RCS Flow B-21 B-20 G0 Model for ESD 7 Total Loss of Steam Flow B-22 B-21 G0 Model for ESD 11 Steam Loss Inside Containment B-23 f B-22 G0 Model for ESD 13 Core Power Excursion B-24 B-23 G0 Model for ESD 14 ATWS C-2 C-1 Event Tree For ESFAS With Perfect Input 4
| |
| i xvi l l j l
| |
| J
| |
| | |
| TABLES VOLUME II Table Page A.2-1 EPS Safety Analysis Unavailability Results A.2-7 A.2-2 IaC Power System Safety Analysis Unavailability Results A.2-9 A.2-3 EPS Availability Analysis Results A.2-11 A.2-4 Major Safety Loads and Functions A.2-13 A.2-5 Major Components Used in the Electric Power System Model A.2-21 A.2-6 Listing of Electric Loads by Boards A.2-25 A.2-7 Unit 1 S5utdown Board Loads Automatically Stripped A.2-47 Following A Loss of Nuclear Unit and Preferred (Offsite) " ver A.2-8 Diesel Generator Load Sequentially Applied Following A.2-48 a Loss of Nuclear Unit and Preferred (Offsite) Power A.2-9 Loads Having Manual Transfer Between Power Trains A.2-50 A.2-10 Controls, Indicators, and Alarms A.2-52 A.2-11 Sequoyah Electric Power System Diesel Generator Test A.2-54 Schedule A.2-12 EPS Output A.2-57 A.2-13 EPS Model Supertypes A.2-61 A.2-14 Electric Power System Model Signal Generators A.2-62 A.2-15 EPS Class 1E Distribution Board Unavailabilities A.2-90 A.2-16 EPS 6.9 kV Shutdown Board State Unavailabilities A.2-91 A.2-17 I&C Power System Board Unavailabilities A.2-92 A.2-18 EPS !aC Power System State Unavailabilities A.2-93 A.2-19 Safety Analysis Data A.2-94 A.2-20 Availability Analysis Data A.2-95 A.3-1 ERCW Minimum Success Criteria A.3-7 A.3-2 ERCW Isolation Valves A.3-12 A.3-3 ERCW Electrical Dependencies A.3-13 A.3-4 Automatic Actions Regarding ERCW System Components A.3-18 A.3-5 ERCW Safety Model Component Failure Modes and Data A.3-29 A.3-6 ERCW Safety Model Results A.3-30 A.3-7 ERCW Availability Model Component Failure Modes and Data A.3-32 xvii
| |
| | |
| TABLES (continued)
| |
| VOLUME 11 Table Page A.3-8 ERCW Availability Model Results A.3-33 A.3-9 Fault Cutset Summary for ERCW Safety Model A.3-36 A.3-10 Fault Cutset Summary for ERCW Availability Model A.3-38 A.4-1 Sequoyah Unit 1 CCS A.4-4 A.4-2 Power Supply to Major CCS Electrical Equipment A.4-12 A.4-3 Normal and Post-Initiating Event Cooling Loads of a A.4-15 Component Cooling System Train A.4-4 Failure Data for CCS Components A.4-35 A.5-1 Sequoyah Unit 1 Control Air System Availability Model A.5-5 Leading Contributor Fault Sets A.5-2 Sequoyah Control Air System Availability Component A.5-6 Importance List A.5-3 Sequoyah Control Air System Safety Model Leading A.5-8 Contributor Fault Sets A.5-4 Sequoyah Control Air System Safety Model Component A.5-9 Importance List A.5-5 Major Components Used in the Compressed Air System Model A.5-12 A.5-6 Sequoyah Unit 1 Component Electrical Power Suppl,y A.5-17 A.5-7 Sequoyah Unit 1 Control Air System Component Controls, A.5-20 Indicators, and Alarms A.5-8 Sequoyah Compressed Air System G0 Component Modeling Chart A.5-26 A.5-9 Sequoyah Component Unavailability Rates (Availability Model) A.5-28 A.5-10 Sequoyah Component Unavailability Rates (Safety Model) A.5-32 A.6-1 List of References A.6-3 A.6-2 ESFAS Quantification Results (Mean Values) A.6-4 A.6-3 Summary of Results A.6-6 A.6-4 Requirements for Process Instruments Producing ESFAS Output A.6-9 A.6-5 ESFAS Model Input Signals A.6-37 A.6-6 Supertype 111 Bistables and Electrical Dependencies A.6-39 A.6-7 ESFAS G0 Model Output A.6-41 A 6-8 ESFAS Components Failure Data A.6-43 A.6-9 ESFAS Subsystem Unavailability Cause Summary A.6-47 A.7-1 List of Reactor Trips A.7-3 A.7-2 Reactor Trip System Power Supply A.7-9 A.7-3 Control Board Selector Switches and Pushbuttons for A.7-12 Manual Operation xviii
| |
| | |
| TABLES (continued)
| |
| VOLUME II Table P_ age A.7-4 Component Failure Data for the Reactor Trip System A.7-21 A.8-1 Sequoyah Unit 1 Auxiliary Feedwater System Leading A.8-5 Contributor Fault Sets A.8-2 Sequoyah Auxiliary Feedwater System Components A.8-8 A.8-3 Sequoyah Unit 1 AFWS Electrical Support A.8-11 A.8-4 Controls, Indicators, and Alarms A.8-14 A.8-5 Sequoyah Unit 1 Auxiliary Feedwater System Component A.8-20 Modeling Chart A.8-6 Sequoyah Unit 1 Auxiliary Feedwater System Component A.8-22 Unavailability Rates A.8-7~ Sequoyah Unit 1 Component Testing Frequencies A.8-26 A.9-1 Analysis Results A.9 A.9-2 Leading Contributor Fault Sets A.9-5 A.9 Electric Power Buses Needed for ECCS System Components A.9-18 A.9-4 Controls, Indicators, and Alarms A.9-28 A.9-5 Tests and Surveillance Requirements A.9-30 A.9-6 ECCS Top Event Requirements A.9-33.
| |
| A.9-7' Auxiliary Support. Dependencies A.9-38 A.9-8 ECCS Function Model Dependencies- A.9-39 A.9-9a High Pressure Pump Maintenance Unavailability Operator A.9-41 A.9-9b Low Pressure Pump Maintenance Unavailability Operator . A.9-41 I A.9-10' High Pressure Injection Model Data A.9-47 A.9-11 Bleed and Feed Model - (Start and Run 6-Hours) . A.9-67 A.9-12. Bleed and Feed Model Data - (Continue to Run 6 Hours) A.9-68 A.9-13 High Pressure Recirculation Model Data A.9-69 A.9-14 Low Pressure Injection Model Data A.9-73 A.9-15 Closed Loop RHR Model Data A.9-75 A.9-16 Low Pressure Recirculation Model Data A.9-76 A.9-17 Low Pressure Hot Leg Recirculation Model Data A.9-77 A.9-18 Accumulator Model Data' A.9-83 A.10-1 Analysis Results A.10-3 A.10-2 Leading Contributor Fault Sets A.10-4 A.10-3 Containment Spray System Power Supplies A.10-10
| |
| ^
| |
| A.10-4 Impacts of Testing, Inspection, and Surveillance A.10-15 Requirements
| |
| ;xix
| |
| | |
| TABLES (continued)
| |
| VOLUME II Table Page A.10-5 Containment Spray System Injection Model A.10-20
| |
| - A.10-6 Containment Spray System Recirculation Model A.10-21 A.11-1 Sequoyah Safety Auxiliary Model A.11-2 A.11-2 Auxiliary Systems Dependencies A.11-7 A.11-3 Auxiliary Model Supertypes A.11-14 A.11-4 Auxiliary Model Signal Designations A.11-15 B-1 E5D Logic Developed Into G0 Models B-25 D-1 Auxiliary Systems Model Output Signals D-2 D-2 Auxiliary Input to Safety Systems D-5 G
| |
| Xx
| |
| | |
| Appendix A SYSTEMS ANALYSES A.1 INTRODUCTION This appendix presents detailed systems analyses for five separate auxiliary systems, three safety systems, and the emergency core cooling system (including eight modes of operation). In addition, a separate auxiliary systems safety analysis is provided in Section A.11. This latter analysis uses all five auxiliary systems into a single model for use in the safety study portion of the G0 model demonstration. The specific systems analyses and their location in Appendix A are as follows:
| |
| Section Systems Analysis A.2 Electric Power System (EPS)
| |
| A.3 Essential Raw Cooling Water System (ERCW)
| |
| A.4 Component Cooling Water System (CCS)
| |
| A.5 Compressed Air System (CAS)
| |
| A.6 Engineered Safety Features Actuation System (ESFAS)
| |
| A.7 Reactor Trip System (RT)
| |
| A.8 Auxiliary Feedwater System (AFW)
| |
| A.9 Emergency Core Cooling System (ECCS)
| |
| A.10 Containment Spray System (CS)
| |
| A.11- Auxiliary Systems Safety Analysis A standard fonnat has been used for each analysis except the auxiliary systems safety analysis. This latter analysis differs since it evaluates a pseudosystem function developed from results of the five separate system studies presented in Sections A.2 through A.6. In the standard systems analysis formats, success criteria are defined for both availability and safety, as appropriate. Then, analyses are perfonned leading to separate GO models which address those criteria and are appropriate for use in plant availability and safety evaluations. Both availability and safety GO models are provided for the electric power, essential raw cooling water, component cooling water, and compressed air systems. All other systems are analyzed for GO safety model input only.
| |
| A.1-1
| |
| | |
| ' Plant primary and secondary systems which are a part of the plant availability model' are evaluated in Section 2 of the main report.
| |
| A11' individual systems analyses in this appendix also are quantified with respect' to success criteria for each system. This quantification addresses and identifies system availability and dominant contributors within the boundary conditions established for the analysis.
| |
| Further details on the scope and results of each analysis are provided in Sections A.2 through A.11.
| |
| k A.1-2 1
| |
| ...___.m_ _ - _ _ _ _ _ _ _
| |
| | |
| A.2 ELECTRIC POWER SYSTEM A.2.1 Introduction and Summary A.2.1.1 System Definition.
| |
| A.2.1.1.1 Overview. The electric power system (EPS) includes all the electrical distribution equipment used in supplying AC or DC electric power needed for the operation of plant equipment. The EPS supplies power to both Units 1 and 2; therefore, it is common to all systems of both units.
| |
| The accident mitigation function of the EPS is to provide adequate electric power to all safety loads and major plant electrical equipment during abnormal (postulated accident) conditions. Its availability function is to provide adequate electric power to all loads necessary for 100% power production for Units 1 and 2.
| |
| The EPS consists of the high voltage distribution system (500 kV and 161 kV), the medium and low voltage distribution systems (6.9 kV and 480V), and the instrumentation and control (I&C) power distribution system (250V DC,125V DC, and 120V AC).
| |
| The medium and low voltage distribution system consists of two identical distribution systems (one for each unit) and a common distribution system shared by both units (see Figure A.2-1). Each unit's distribution system consists of two equivalent power distribution systems designated as trains A and B.
| |
| The EPS receives power from three different sources (see Figure A.2-2).
| |
| Under normal operating conditions, power is supplied by the two main generators; Unit 1 supplies power to the Unit I distribution boards and Unit 2 supplies power to the Unit 2 distribution boards. During abnormal operating conditions (startup, shutdown, or postulated accident), power is supplied to both unit distribution systems by two separate offsite power circuits. If offsite porer is unavailable, power can be supplied to the shutdown boards by the four onsite diesel generators in order to complete a safe snutdown of the reactor.
| |
| The I&C power distribution system consists of a 125V DC/120V AC vital
| |
| -instrument power system and a 250V DC/120/ AC preferred power system (see A.2-1
| |
| | |
| 1 l
| |
| m 1I iI l . . . , _ .
| |
| l l ...,
| |
| ' = ='
| |
| g .=.
| |
| g 4 t o I,
| |
| -4 i m
| |
| .. . . I 1 m
| |
| ==== ..
| |
| .s.
| |
| I..
| |
| l
| |
| == ..
| |
| 1 I
| |
| l< " ,
| |
| ~~
| |
| P...
| |
| .. F..
| |
| m.
| |
| I E.-
| |
| . . , < E..e
| |
| .E,--
| |
| l I
| |
| : p. p. I p. g
| |
| @ @ l@ @
| |
| l o m o o l o m , m o Io_
| |
| l ....
| |
| l ._. ...
| |
| l
| |
| ~2 ,,., ; ,,
| |
| I I o m o ,
| |
| e o
| |
| =_ =_ = =_ :.. =
| |
| =.. =. l =- w~ =~
| |
| l.= """''"
| |
| l m o I o o I _ . .. .. . _ . < .
| |
| l
| |
| .n l .a.
| |
| Figure A.2-1. Sequoyah Electric-Power System - Simplified Block Diagram 4
| |
| A.2-2
| |
| | |
| [
| |
| NORMAL CONDITIONS ABNORMAL CONDITIONS OFFSITE (PREFERRED)
| |
| NUCLEAR UNIT POWER ONSITE (STANDBY)
| |
| POWER l 6.9 kV UNIT BOARDS l l 6.9 kV SHUTDOWN BOARDS ELECTRIC POWER SYSTEM Figure A.2-2. Sequoyah Electric Power System -
| |
| Operating Conditions Schematic A.2-3
| |
| | |
| Figure A.2-3). The 125V DC and 120V AC vital instrument' power (VIP) system has four independent channels specified as I, II, III, and IV. Each channel consists of one 125V DC battery board and two 120V AC vital instrument power boards, one for each unit. Each battery board receives power from a battery .
| |
| charger (which is supplied from one of the 480V shutdown boards), or from its own dedicated battery. Each vital instrument power board normally receives power from its channelized battery board through a dedicated vital inverter. Each VIP board may also be powered from a channel associated 120V AC instrument power distribution panel.
| |
| The 250V DC and 120V AC preferred plant power system has two independent
| |
| . 250V DC battery boards. Each battery board receives power from a battery-charger, or from its own dedicated battery. Each battery charger may be powered from either the 480V AC auxiliary building comon board (normal), or from one of the 480V AC shutdown boards (alternate). Each battery board supplies one 120V AC preferred power board through a 120V AC, single-phase, i' preferred inverter. The 250V DC turbine building boards (1 and 2) are supplied from either battery board.
| |
| -A.2.1.1.2 Purpose of the analysis. This analysis has a dual purpose:
| |
| (1) to analyze the availability of the EP5 in supplying loads needed for 100% power production for Unit 1, and (2) to analyze the availability / reliability of the EPS in supplying the safety loads needed .
| |
| a during a postulated accident condition.
| |
| , ' A.2.1.2 Analysis Boundary Conditions / Initial Conditions. Since all initiating events in this study result in a trip of the main generator, power supplied from 4 this source is not considered in the safety analysis. The safety analysis is -
| |
| malfily concerned with the operation of the EPS during abnomal conditions.
| |
| In analyzing the EPS in an abnomal operating condition (postulated ,
| |
| ; accident), we assume the following initial conditions:
| |
| e _- The EPS is.in a normal operating configuration for both units prior to the initiation of an event sequence. During the event sequence, Unit 2 is in a hot-standby condition.
| |
| .e For 'all initiating events except the loss of offsite power, the preferred power source .is offsite power. The standby power source 4- comes from the.onsite diesel generators.
| |
| p r
| |
| A.2-4
| |
| * .. ~. . .-- . - - - - - - - - , ..----e.. , , , g..-. .- - , --w.-., + -v
| |
| | |
| 4 4 4 4 4 4 4 4 4
| |
| ,,~. m m.
| |
| . l
| |
| . 1; n, n-l E. .I 1t <.,.
| |
| .D Mf,tM pffM . M.,t.y ..t., p , .e ng
| |
| .. _. . . in i oo l l oo o n} {o o _.
| |
| o ,
| |
| } }o o
| |
| .. m. .
| |
| ..,.. .m.... .im.,
| |
| . =. .m....
| |
| -, n .m - i. .
| |
| 1 A m o 4 4 " " I b_ _o_{
| |
| i., ..n
| |
| ~..n.,. ..
| |
| : n. .n,. -
| |
| n 1' I I 1P iP II
| |
| . ,i..
| |
| -1 11 .um.
| |
| -Ill i-I-l.m. N
| |
| . . . ~..
| |
| o e o o e o E 17 E NK N.K
| |
| .im g .IM. ,tr,o.
| |
| , .c .. . .. -
| |
| . .1 .n i -.... gp =7 o o o e n
| |
| - ,.n i
| |
| .im.. u
| |
| ..i.......
| |
| 175V K BATTERY BOPRDS AltD raiOV K BAfi[RV BOARD 5 AND 220V E VITAL laSTRurtti P0tTR 307.D5 W E PREFERRED POWER BOARDS Figure A.2-3. Instrumentation ar.d Control Power System Block Diagram
| |
| .-~
| |
| ~.
| |
| A.2-5 a
| |
| | |
| m o For the loss of offsite power initiating event, the only sources of power are the onsite diesel generators.
| |
| e Only automatic actions are modeled. No manual recovery actions are considered in this analysis.
| |
| Assuming that both units are in a normal operating configuration prior to the initiation of an event sequence and Unit 2 switches to hot standby during the event sequence, both units will switch from main generator power to offsite power.
| |
| In addition to the initial conditions, we also assume the following boundary conditions:
| |
| e Offsite power is considered as a power connection to both main transformers; common station service transformers (CSST) A, B, C, and D; and cooling tower transfonners A and B.
| |
| o Essential raw cooling water (ERCW) for the chilled water coolers and diesel generators is available.
| |
| e The diesel generator start signal is available.
| |
| e The success criterion is defined as supplying power to the distribution board or motor control center from which individual components draw their power. The breaker that feeds an individual component or load is included in the system analysis to which the component belongs.
| |
| e The system failure analysis is extended to 24 hours for all of the EPS except the diesel generators. The diesel generator failure analysis covers a period of 6 hours following a loss of power to the 6.9 kV shutdown boards.
| |
| The following are the boundary conditions and assumptions for the availability analysis:
| |
| e All power supply boards necessary to support 100% power production from Unit 1 are essential.
| |
| e All operator actions essential to maintaining system operation and all electrical equipment are considered in this analysis.
| |
| 'A.2.1.3 System Analysis Results. Table A.2-1 summarizes the results of the safety analysis. There are three offsite power operability states considered in this analysis and three corresponding sets of results. The three states considered are offsite power available with a probability of unity, offsite power unavailable with a probability of unity, and probability of offsite power failing during the 24-hour analysis period. The first state represents the results with 4 A.2-6
| |
| | |
| Table A.2-1 EPS SAFETY ANALYSIS UNAVAILABILITY RESULTS Offsite Power State Unavailability in Bus Available Unavailabic 24-Hour Period (K = 0) (E = 1.0) (A = 3.41-4) 6.9 kV Shutdown Board 4.47-5 1.17-1 8.44-5 480V Shutdown Board 8.63-5 1.17-1 1.26-4 480V ERCW MCC 8.63-5 1.17-1 1.26-4 480V RB MOV Board 1.09-4 1.17-1 1.49-4 480V Containment and 1.09-4 1.17-1 1.49-4 Auxiliary Building Vent Board 480V Auxiliary Building 7.81-5 1.00 4.19-4 Common Board Configuration State Loss of 6.9 kV Shutdown 8.18-5 2.20-1 8.18-5 Board 1A-A or 1B-B Loss of 6.9 kV Shutdown 5.24-6 1.37-2 5.24-6 Board 1A-A and 1B-B NOTE: Exponential notation is indicated in abbreviated form; i.e., 3.41-4 = 3.41 x 10-4 A.2-7 u
| |
| | |
| 4 no offsite power dependency. The second case represents the results for the loss of offsite power initiating event. The third case represents the results for all other initiating events. j All initiating events analyzed in this study ultimately result in a unit trip.
| |
| For transients other than those initiated by the loss of offsite power, it is possible that transmission network perturbations produced by this unit trip could cause a loss of offsite power. This probability of occurrence is included in the 3.41 x 10-4 unavailability used for state 3.
| |
| The results have been derived from the mean failure frequencies and unavailabilities described in Section A.2.4. The GO model constructed represents the configuration of components considered in this analysis and the failure frequencies associated with these components. It is important to note that these results do not include the effects of operator actions to recover failed equipment during the study period following an initiating event. This analysis approach is very conservative because inclusion of these recoverability factors would reduce system unavailabilities. However, there is no common caose or human error included so this would tend to make the results less conservative.
| |
| The loss of offsite power is a unique initiating event from the standpoint of EPS operation. Under this condition, the unavailabilities of all safety buses become the same and are dependent on the operation of the diesel generators.
| |
| In comparing the board results of state 1 (offsite power available) with state 3 (offsite power = 3.41 x 10-4), we see a significant increase in the probability of failure due to a loss of offsite power. Loss of offsite power is the dominant contributor to the unavailability of power to a shutdown board, and the most significant contributor to the unavailability of power to an M0V board, vent board, or MCC.
| |
| The I&C power system output is included as a dependency in the results of the medium and low voltage system operation. However, the I&C power system is analyzed by itself and the results are shown in Table A.2-2. The I&C power system is dependent on 480V power for operation of the battery chargers.
| |
| Therefore, the I&C power system results are shown for 480V supply power available and unavailable. The I&C power system results show that system reliability is A.2-8
| |
| | |
| . Table A.2-2 I&C POWER SYSTEM SAFETY AtlALYSIS UNAVAILABILITY RESULTS 480V Supply Power State Available Unavailable 125V DC Vital Battery Board 2.30-5 5.29-4
| |
| .120V AC Vital Instrument ~2.03-5 1.37-3 Power Board-120V AC Instrument Power 2.23-4 1.00 Distribution Panel 250V DC Battery Board 2.30-5 5.29-4 h'
| |
| 250V DC Turbine Building 2.30-5 5.29-4 Board-Configuration State 125V-DCL
| |
| ' Total probability of I or II 4.60-5 1.03-3 Unavailable
| |
| ; Total probability of I and II 5.00-10 2.68-7
| |
| : Unavailable 250V DC.
| |
| t.
| |
| Total probability of I or II 2.50-5 1.03-3 Total probability of I and II 2.00-10 2.68-7 Total . probability.of 1 or 2 4.04 1.03-3 Total probability of'1 and 2 4.00-10 2.68-7 NOTE: Exponential notation is. indicated in abbreviated form; i.e.,-2.30-5 = 2.30 x 10-5, 4
| |
| 1 L
| |
| I A.2-9 Wi ..-_ -- . . - - , _- . . .-
| |
| | |
| not dependent on 480V supply power and the system can provide a reliable power l supply from its battery source.
| |
| The results of the EPS availability analysis are shown in Table A.c-3. The availability analysis has only one result for one state: the availability of power to all the boards necessary for 100% power production from Unit 1.
| |
| A.2.2 System Description The electric power system receives AC power from the two nuclear power units, the two independent 161 kV preferred (offsite) power circuits, and four 4,000 kW diesel generator standby (onsite) power sources, and distributes it to both safety related and nonsafety related loads in the plant (see Figure A.2-1).
| |
| The instrumentation and control (I&C) power system consists of two Class lE systems and two nonClass IE systems. The vital 120V AC control power and the vital 125V DC control power systems supply power for safety related control. The 250V DC control power and the 120V AC preferred control power systems supply power for nonsafety related control (see Figure A.2-3). The I&C power system suppiies both Units 1 and 2.
| |
| A.2.2.1 A_ccident c Mitigation Function. The accident mitigation function of the EPS is to provide adequate electric power to all safety loads and major plant.
| |
| electrical equipment during abnormal (postulated accident) conditions.
| |
| During postulated accident conditions, electric power is supplied automatically at the 6.9 kV shutdown board level from the offsite (preferred) power system through the CSSTs, the 6.9 kV start buses, and the 6.9 kV unit boards.
| |
| In case of a complete loss of offsite power, the standby (onsite) power system provides auxiliary power to the 6.9 kV shutdown boards.
| |
| The vital 120V AC control power and _ vital 125V DC control power systems provide I&C power for engineered safety features (ESF) equipment and other essential AC and DC powered equipment. The I&C system capacity is sufficient to supply these loads during normal operation and to permit safe shutdown and isolation of the reactor in any emergency, including the " loss of all AC power" condition. In this condition, the batteries can supply all the vital safety loads of both units for a period of 2 hours.
| |
| A.2-10
| |
| | |
| Table A.2-3 f EPS AVAILABILITY ANALYSIS RESULTS Bus Unavailability 6.9 kV Unit Board 1.32-3
| |
| ;480V. Unit Board 1.71-3 480V Turbine MOV Board 1.30-3 480V Turbine Building Vent Board 1.30-3 6.9 kV Shutdown Board 1.30-3 480V Shutdown Board 1.31-3 480V Containment and Auxiliary Building 1.30-3 Vent Board 480V Reactor Building MOV Board 1.30-3 480V Reactor Vent Board 1.30-3 480V ERCW MCC 1.69-3 16.9 kV Cooling Tower Board 1.32-J 480V Auxiliary Building Common. Board 1.74-3 125V DC Battery Board 5.86-b 120V AC Vital Instrument Power Board 1.45-5 250V DC Battery Board 2.50-6 250V DC Turbine Building Board 9.75-8 120V AC Preferred Power Board 1.45-5 NOTE: Exponential notation is iDdicated in abbreviated form; i.e., 1.32-3 = 1.32 x 10-J.
| |
| A.2-11
| |
| | |
| A.2.2.2 Success Criteria. For plant safety during event response conditions, the success criterion is that the EPS satisfy all the electric power requirements of all the safety related loads and major electrical equipment needed for a safe cold shutdown. Major loads on the EPS having assigned safety related loads and functions are shown in Table A.2-4.
| |
| The safety related loads for each nuclear unit are divided into two redundant load groups. Each redundant load group of each unit has access to a standby source and to each of the two preferred offsite sources. Three out of four diesels and associated load groups are required to provide all safety functions.
| |
| The availability success criterion applied during normal operating conditions is for the I&C system to provide power to all equipment needed for plant operation.
| |
| The safety success criterion requires that during event response conditions, the I&C power system satisfy all I&C requirements of all the safety related equipment needed for a safe cold shutdown. The designated safety related loads of the vital 120V AC boards and 125V DC boards are shown in Table A.2-4.
| |
| -A.2.2.3 System Configuration. The EPS consists of the main generators, unit station service transformers (USST), CSSTs, diesel generators, batteries, and the electrical distribution system as shown in Figure A.2-4. Under normal power operating conditions, the main generators supply electrical power through isolated phase buses to the main transformers and the USSTs. The primaries of the USSTs are connected to the isolated phase bus at a point between the generator terminals and the low voltage connection of the main transformers.
| |
| Station electric power is taken from the main generator through these transformers. Under auxiliary power conditions (during startup and shutdown),
| |
| offsite power is supplied from the 161 kV system through the CSSTs, the 6.9 kV unit boards, and the 6.9 kV shutdown boards. During a complete loss of offsite power, station electric power is provided by the standby (onsite) power supply system through the 6.9 kV shutdown boards (see Figure A.2-4).
| |
| The standby (onsite) portion of the system is identified as the diesel generators, the 6.9 kV shutdown boards, the 480V shutdown boards, and all loads l
| |
| l supplied by the 480V shutdown boards. The standby power system serving each unit is divided into two redundant trains; namely, A and B.
| |
| I I
| |
| A.2-12 c.
| |
| | |
| y - - -t > - ._ _. . --
| |
| t Table A.2-4 MAJOR SAFETY LOADS AND FUNCTIONS Safety Loads Function Power Charging Pumps Provide emergency core cooling during 6.9 kV AC emergency shutdown.
| |
| Safety Injection Pumps Provide emergency core _ cooling during 6.9 kV AC emergency shutdown.
| |
| - ' Residual Heat Removal ' Remove reactor heat during a shutdown 6.9 kV AC_
| |
| Pumps rondition.
| |
| E Containment Spray Pumps Provide cooling spray inside contain- 6.9 kV AC ment during high pressure conditions.
| |
| Essential Raw Cooling Provide cooling water for component 6.9 kV AC
| |
| - Water Pumps - cooling system and other miscel-laneous systems.
| |
| Auxiliary Essential Raw -Replace the essentia? raw cooling 6.9 kV AC Cooling Water Pumps water pumps during flood or earth-quake conditions.
| |
| ; Auxiliary Feedwater Provide water-to the steam generators 6.9 kV AC Pumps 'during emergency conditions.
| |
| Pressurizer Heater Provide heat for maintaining adequate 480V AC Group pressure in the primary coolant system.
| |
| Component Cooling -Provide cooling water to the nuclear 480V AC System Pumps steam _, supply system equipment.
| |
| ' Spent Fuel Pit Pumps Cool spent fuel pit pool. 480V AC Fire Pumps Provicie water for _ fire control . and - 480V AC emergency feedwater.to steam generators. ,
| |
| Cooling Tower Fans- Cool essential raw cooling water 480V AC during closed cycle pumping of flood ccnditions.-
| |
| Reactor Lower Compart- Keep reactor lower compartment 480V AC ment Cooling Fans temperature within bounds.
| |
| Control Rod Drive Protect control rod drive mechenisms 480V AC 4' Mechanism Cooling Fans against excessive temperatures.
| |
| l A.2-13
| |
| ~ w --- ~. , , , .,v.- , n ~ -- , eon e~ p-- ---c-- - - - wn --e- --
| |
| | |
| 4 Table A.2-4 (continued)
| |
| Safety Loads Function Power Containment Air Return Prevent vacuum conditions in the 480V AC Fans reactor lower compartment during accident conditions.
| |
| : Emergency Air Maintains safe air temperature in '480V AC Conditioning operating areas.
| |
| Ventilation System Controls air temperature and/or 480V AC and source and/or radioactive content 125V DC prior to, during, and following emergency conditions.
| |
| Vital Battery Chargers Maintain 125V vital batteries at 480V AC proper charge level.
| |
| Hydrogen Recombiner Maintain a safe level of hydrogen in 480V AC the containment.
| |
| Motor Control Centers Provide power for small motors, fans, 480V AC M0Vs, heaters, and small pumps asso-ciated with safety related equipment.
| |
| Trace Heating Cabinets Provide heat for pipelines carrying 480V AC boric acid solution.
| |
| Standby Lighting Provide power for emergency lighting 480V AC Cabinets in operating areas.
| |
| Solid State Protection Prevents re Ator from operating in 120V AC System unsafe condition.
| |
| Nuclear Instrument Monitors reactor power level for 120V AC' System reactor control and trip logic.
| |
| Auxiliary Relay Racks Auxiliary relays for process control. 120V AC and 125V DC Power Switchgear Control power for power switchgear. 125V DC ,
| |
| Vital Inverter Supplies power to the vital instru- 125V DC ment buses.
| |
| Reactor Trip Switchgear Trips reactor. 125V DC Diesel Generator Control Remote control of diesel generators. -125V DC A.2-14
| |
| | |
| Table A.2-4-(continued)
| |
| Safety' Loads Function Power Auxiliary Feed Pump Automatic start of au.tiliary feed 125V DC Turbine- pump turbine.
| |
| Emergency Lighting Provides power to emergency lighting 125V DC Cabinet panel.
| |
| Solenoid Valves - Controls flow through safety related 125V DC valves (p'neumatic valves with solenoid pilots).
| |
| A.2-15
| |
| | |
| += .
| |
| 1 =_. . a I nae -- i - - e sa Ia, e - - - -
| |
| T T e-- o ,, ,, ,,
| |
| e wu i .._ .
| |
| n, n- r ee -na se
| |
| .. o ._ o +. n.. _ ..A o .. o n .. _o. o ,,_ y o _,... ,,o_
| |
| : a. , ..
| |
| _,, 1,* ,, ee .m it ,, ie ,P ,,m it I, .m
| |
| _ll 11 II I
| |
| ~,1 leln T
| |
| ~ " " " ' -- - - - - = ---
| |
| T - - - -' '
| |
| F- - - - ~ ..
| |
| .. u. ..
| |
| .. u.
| |
| l l ;
| |
| I _o _ _ _o o .
| |
| o _o .., ,, _ .
| |
| ... y ., i . _ _ . _
| |
| , o ,, o o o ,, o ,, o ,, m o o ,, o ,,
| |
| j
| |
| ~, _,
| |
| n-n-n, n, n
| |
| - - , - - n ,n-- ,n, x,n,-- n g
| |
| M
| |
| -l ,
| |
| ra.s..
| |
| I ". + + _ , o " _. T4 _ . + E ft ." "
| |
| . + +. I ll ll IIl, ll l,ll ll ll 15llll ll ll ll ll
| |
| ,g, l,ll ll lI ll lIIIll
| |
| ,g, ,g, ll ll ll ll ll ll ll ll I
| |
| l og, _ . . . . _
| |
| " " " " f Y .. Y ,... Y .. ...
| |
| I
| |
| " , . h@ _. " ". h @ .. " " ., . h @ ,, , " "
| |
| ..@@.. " - - ~ ~ ~
| |
| l
| |
| " " " o u 4 4 ,,, , o o 4 4 ,,,., o -
| |
| j l . @ @ .. . _. @ @ .. ,,,, , , , ,
| |
| l l l t__________ ____ --____________o sie a snanas en a ames D==*.==.
| |
| g ..am. ..
| |
| Figure A.2-4. Sequoyah Electric Power System P&ID l
| |
| i
| |
| {
| |
| l
| |
| | |
| The configuration of the I&C power system is shown in Figure A.2-5. Figure A.2-5 consists of the safety related 120V AC and 125V DC power distribution, and nonsafety related 120V AC and 250V DC power distribution.
| |
| The safety related I&C power distribution system consists of four identical power channels (designated I, II, III, and IV), with the equipment of each channel being electrically and physically independent from the equipment of other channels. Each channel consists of a 125V DC vital battery board and two 120V AC vital instrument power (VIP) boards, one VIP board for each unit. Each battery board can be supplied by its own battery or through a battery charger which is supplied from the 480V shutdown boards. Each 120V AC vital instrument power board can be supplied from its own inverter which is, in turn, supplied from the battery board or the 480V shutdown board supply. Each 120V AC board can also be supplied directly by the 480V shutdown boards through a distribution panel which bypasses the inverter power supply. In addition to the I&C power boards discussed above, there are four instrument power transfer racks, two (A and B) per unit. Unit 1 (Unit 2) transfer racks are not channelized and can be powered from either 1A or 1B (2A or 28) instrument power distribution panels. These transfer racks are not channelized and supply nonsafety related loads.
| |
| The nonsafety 250V DC power and 120V AC preferred power system consists of the two independent subsystems. Each subsystem has one 250V DC battery board with its own 250V DC battery supply. Each battery board can also be supplied by a battery charger supplied by one of two separate 480V boards. A spare battery charger also supplied by one of two separate 480V boards is shared between the two battery boards. Each 120V AC preferred power board is supplied by an instrument power distribution panel and an inverter which is supplied by the 250V battery board or 480V board supply. In addition to the aforementioned boards, there are three 250V DC boards that can be supplied from either of the battery boards, and three 120V AC preferred distribution boards that can be supplied from either of the two 120V AC preferred power boards.
| |
| The I&C power system is that part of the electric power system which supplies electricity for I&C operations. It provides control power for operation of the circuit breakers and instrumentation associated with the following distribution boards:
| |
| e The 125V DC' vital battery boards supply control power for the following:
| |
| --6.9 kV shutdown boards 1A-A, 18-B, 2A-A, %d-B.
| |
| A.2-17
| |
| | |
| m.....m. . . m..
| |
| =. _4_ =. 4__ =. =. 4_
| |
| =,
| |
| &__ :. #_ _ :. b_ _
| |
| g _
| |
| F-1 i= I i- I l- .i l= l I-a l _.
| |
| I_
| |
| A n A n OAO n =,:
| |
| a g
| |
| =.:
| |
| g l -. l l --l 9,
| |
| 7 9,
| |
| Y T T (9 g ___
| |
| "~ g ff 11 11 ffll 11 f ((
| |
| 11 IB ll 11 fll n
| |
| 11 11 n n, y
| |
| ,,n n y 11 n
| |
| 11
| |
| =- =- y y
| |
| E
| |
| ~
| |
| ._r_
| |
| I I I I . :-
| |
| 7__._
| |
| i4 l i m _____.
| |
| nn " "
| |
| ~ ""
| |
| nn m , .. n n nn . , , ,,,, ..
| |
| .== =-
| |
| l l .- . . l l. .. I
| |
| \
| |
| E'., !3 E'".' .. ,.,,3
| |
| ' ~ ,,: '.. . s. -
| |
| ** o-a---
| |
| l 0 -a - = =.
| |
| l l I I I I y .ma ra>
| |
| es. '
| |
| - es. ' .r >
| |
| Figure A.2-5. Instrumentation and Control P&ID l
| |
| l l
| |
| | |
| --480V shutdown boards 1Al-A, 1A2-A, 1B1-B, 182-B, 2Al-A, 2A2-A, 2B1-B, and 282-B.
| |
| --480V auxiliary building comon board buses A and B.
| |
| The 250V DC battery boards supply control power for the following:
| |
| --6.9 kV start board normal and alternate feeder buses A and B.
| |
| --6.9 kV ur:it boards 1A, IB,1C,1D, 2A, 28, 2C, and 2D.
| |
| --480V unit boards 1A,1B, 2A, and 28.
| |
| --6.9 kV common boards A and B.
| |
| --480V service building main board.
| |
| --480V water supply board.
| |
| --480V turbine building common board.
| |
| --6.9 kV condenser circulating water cooling tower common boards A and B.
| |
| --6.9 kV condenser circulating water cooling tower boards A J B.
| |
| Various other systems require either 120V AC,125V DC, or 250V DC control power to operate instruments or controls.
| |
| The normal, offsite,- and onsite power operating conditions for the EPS have the following configurations:
| |
| : 1. Normal Power. Units 1 and 2 have separate but identical power distribution configurations.
| |
| Generator 1 supplies power to USSTs 1A and 18. USST 1A supplies 6.9 kV unit boards 1A and IB. USST 1B supplies 6.9 kV unit boards IC,10, and the alternate supply to 6.9 kV common board A.
| |
| ' Power from 6.9 kV unit board 1A supplies 480V unit board 1A and 6.9 kV unit board 1D supplies 480V unit board 1B through transformers 1A and 1B. The 480V unit boards supply the turbine MOV boards and turbine building vent boards.
| |
| Power for 6.9 kV shutdown board 1A-A is supplied by 6.9 kV unit board 1B with an alternate supply from 6.9 kV unit board 1A.
| |
| Power for 6.9 kV shutdown board IB-B is supplied by 6.9 kV unit board 1C with an alternate supply from 6.9 kV unit board 10.
| |
| Power for 480V shutdown boards 1Al-A and 1A2-A is supplied from two normal supply transformers and one shared spare transformer which are all powered from 6.9 kV shutdown board 1A-A. The 480V shutdown boards supply the reactor M0V boards, reactor vent boards, containment and auxiliary building vent boards, and diesel auxiliary boards. Train B, starting with 6.9 kV shutdown beard IB-B, has the same configuration as train A, explained above.
| |
| A.2-19
| |
| | |
| The Unit 2 configuration is identical to the Unit 1 configuration previously described. The offsite power configuration will be explained below.
| |
| The normal power supplies for the ;&C power system are the battery chargers. Battery chargers for channels I and II are supplied from 480V shutdown boards 1Al-A, lA2-A, IB1-B, and IB2-B.
| |
| Shutdown boards 1Al-A and 1B2-B are the normal supplies and boards 1A2-A and 181-B are t'ne alternate supplies. The channel III and IV battery chargers are supplied from 480V boards 2Al-A, 2A2-A, 281-B, and 2B2-B. Boards 2Al-A and 282-B are the normal supplies and 2A2-A and 2B1-B are the alternate supplies.
| |
| : 2. Offsite Power. Offsite power is brought in through three CSSTs to the start buses. CSST A feeds start bus 1A and 2A, CSST C feeds start bus 1B and 28, and CSST B is the standby transformer which can feed either 1A and 2A 'or 1B and 2B at any one time.
| |
| Start bus 1A (2A) feeds 6.9 kV unit boards 1A and 1C (2A and 2C).
| |
| Start bus 1B (2B) feeds 6.9 kV unit boards 1B and ID (2B and 2D).
| |
| From these boards on, the distribution configuration remains the same.
| |
| : 3. Onsite Power. The onsite power system censists of four diesel generators which supp'y power to the 6.9kV shutdown boards. The I&C power system consists of four independtit 125V DC battery supplies and two independent 250V DC battery supplies.
| |
| Diesel generators 1A-A,1B-B, 2A-A, and 28-B tre normally connected to 6.9 kV shutdown boards 1A-A, IB-B, 2A-A, and 2B-B, respectively. The fifth diesel generator, C-S, is designated as a spare and can take the place of any one of the four' primary diesel generators. The spare is connected to a bus which can be connected to any one of the four 6.9 kV shutdown boards. The distribution configuration from the 6.9 kV shutdown boards on down remains the same.
| |
| Each of the four 125V DC battery boards receives its power from its own independent battery supply. Each of the two 250V DC battery boards receives its power from its own independent battery supply. The batteries need only supply the battery boards if voltage from the 480V shutdown boards is not available. This can only take place if the normal, offsite, and onsite power supplies have all failed. Therefore, the probability of power being -
| |
| supplied to any one of the battery boards solely by its own battery supply is valid only if onsite (diesel generator) power fails.
| |
| A.2.2.3.1 Major components. The major components of the electric power system are tabulated in Table A.2-5. The main transformers, USSTs, and CSSTs are located in the 161_kV and 500 kV switchyard. The 6.9 kV start buses are located outside the turbine building and the 6.9 kV unit boards <
| |
| are located inside the turbine building.
| |
| A.2-20
| |
| | |
| Table A.2-5 MAJOR COMPONENTS USED IN THE ELECTRIC POWER SYSTEM MODEL Component Re e e e Function Failure Mode Main Generator 15E500 Provide power to the EPS during 1. Fails during operation.
| |
| normal operating conditions.
| |
| Breaker 15E500 Interrupt or establish a flow 1. Fails to function on demand.
| |
| path for electric power. 2. Fails during operation.
| |
| Eltetric Bus 15E500 Provide power flow path. 1. Fails during operation.
| |
| Diesel Generator 15E500 Provide AC power to the 6.9 kV 1. Fails to function on demand.
| |
| shutdown board during abnormal 2. Fails during operation, conditions.
| |
| 5 Transformer 15E500 Convert electric power from 1. Fails during operation.
| |
| one voltage and current to a different voltage and current.
| |
| B a'.tery 45N700 Provide power for transfer 1. Fails to function on demand.
| |
| switch operations. 2. Fails during operation.
| |
| Current .imiting 15E500 Limits current to a board. 1. Fails during operation.
| |
| Reactor Battery Charger 45N700-2 Provide power to the batteries 1. Fails during operation.
| |
| and battery boards.
| |
| Inverter 45N700-2 Provides power to the vital 1. Fails during operation.
| |
| instrument power boards.
| |
| Fuse 45N700-2 Separates loads from common 1. Fails during operation.
| |
| grounds.
| |
| | |
| The air conditioning configuration that serves the shutdown board rooms, transformer rooms, and battery rooms, along with the Class 1E electrical
| |
| -equipment are shown in Figure A.2-6.
| |
| The diesel generator building houses the four main diesel generators, fuel supply, and associated auxiliary electrical boards'and equipment. There is an additional diesel generator building which houses the spare diesel generator and its equipment.
| |
| Each diesel generator set, furnished by Bruce GM Diesels, Incorporated, consists of two 16-cylinder engines (model 999-16, type 16-645E4) directly connected to a 6.9 kV generator. The continuous rating of each set is 4,000 kW at 0.8 power factor, 6.9 kV, three-phase, and 60 Hz. Each diesel generator set also has an additional rating of 4,400 kW for a 2-hour period. The normal operating speed of the set is 900 rpm. The diesel generator set ases a tandem arrangement; that is, each set consists of two diesel engines with a generator between them, and connected to form a common shaft. The four generator sets are physically separated and electrically isolated from each other. Each diesel generator set can generate its rated output of 4,000 kW with only 27 of its 32 cylinders firing since the generator has a lower-capacity than the two engines. The diesel generator auxiliaries are supplied with power from diesel 480V motor control centers located in the diesel generator building.
| |
| The control circuit voltage for the diesel generators is 125V DC.
| |
| -Indicating lights and contacts for the 125V DC service show when the diesel generator is: (1) ready for automatic start but not running, (2) cranking, or -(3) running. The source of the 125V control power is a battery and each diesel generator has its own battery. The battery is of the lead-acid type and has 57 cells connected in series and divided into 19 units, every unit having three cells. The battery is type KXHS-7, furnished by the Exide Division of the Electric Storage Battery Company. The battery system is capable of supplying the control loads for 30 minutes when the battery is at the lowest expected temperature and when the battery capacity has declined to 80% of its initial capacity. Each battery has an independent battery charger operating on a 480V, 60 Hz, three-phase power supply. This battery charger is of the static rectifier type and is equipped to maintain the battery fully charged at all times.
| |
| A.2-22
| |
| | |
| ERCW OTHER ERCW OTHER USERS 28 USERS 1A I f JP WATER WATER CHILLER CHILLER B-B A-A lf I f lf i f AIR AIR AIR AIR HANDLING HANDLING HANDLING HANDLING UNIT UNIT UNIT UNIT 28-B 2A-A IB-B 1A-A I f lf "B" TRAIN SHUTDOWN BOARDS ROOMS "A" TRAIN SHUTDOWN BOARD ROOMS Figure A.2-6. Air Conditioning Configuration A.2-23
| |
| | |
| A.2.2.3.2 Support systems. During normal power operations, the electric power system requires power from the unit generator.
| |
| During abnormal conditions, electric power is supplied from the'offsite power network or from the onsite power system.
| |
| The electrical equipment requires cooling water from the anential raw
| |
| - cooling water system to fulfill the cooling needs of the air conditioning system and the diesel generators.
| |
| A.2.2.3.3 Interfacing systems. The electric power system provides electric
| |
| , power to all systems, including the instrumentation and control power loads. A list _ of major loads is given in Table A.2-6.
| |
| A.2.2.4 System Operation. At the 6.9 kV unit board, power can be obtained from either the nuclear unit (during normal operating conditions) or from the offsite supply system (during shutdown, startup, or_ abnormal conditions). .
| |
| Power at the 6.9 kV shutdown board can be obtained from either the 6.9 kV unit board (nuclear unit or offsite supply) or _from the onsite power system (during abnormal conditions). The feeders connecting each shutdown board with these three sources .(nuclear unit, offsite, and diesels) are termed the normal, alternate, and standby feeders, respectively. The nomal and alternate feeders can derive power from the same nuclear USST via separate 6.9 kV unit boards. The
| |
| ' normal and alternate feeders can also derive power from the separate offsite source via separate windings on the CSSTs and separate 6.9 kV unit boards.
| |
| , During conditions where neither the nuclear unit nor offsite power is available,
| |
| . each 6.9 kV shutdown board is energized from its ovn separate standby diesel generator via the standby feeder.
| |
| The I&C system has two power sources: (1) the normal (preferred) power supply from the 480V shutdown boards; and (2) standby power supply from 125V DC batteries. The normal .480V AC power supply is shown as a nomally closed (NC) breaker and the alternate _ supply as a normally open (NO) breaker in Figure A.2-5.
| |
| A.2.2.4.1 Normal operation. During normal operations, generator 1 provides power to USSTs 1A and 1B and generator 2 provides power to USSTs 2A and 28.
| |
| USST 1A provides power to 6.9 kV unit board 1A which, in turn, provides A.2-24
| |
| | |
| .. i Table A.2-6 LISTING OF ELECTRIC LOADS BY BOARDS Loads Fed from 6.9 kV Unit Board 1A (45N721-1) 6.9 kV Shutdown Board 1A-A, Breaker 1716 Reactor Coolant Pump l'
| |
| ^ Condenser Circulating Water Pump 1A
| |
| -Hotwell Pump 1A.
| |
| No. 3 Heater Drain Pump 1A -
| |
| 480V. Unit Station Service Transformer LA
| |
| ~
| |
| Loads Fed from 6.9 kV Unit Board 1B (45N721-1) 6.9 kV Shutdown Bo -d 1A-A, ' Breaker 1718 Reactor Coolant Pump 2.
| |
| Condensate Booster Pump 1 A
| |
| -Condenser Circulating Water Pump 18
| |
| - No. 3 Heater Drain Pump 1B No. 7 Heater Drain Pump 1A ,
| |
| Loads Fed from 6.9 kV Unit Board 1C (45N721-1)-
| |
| 6.9 kV Shutdown Board 18-B, Breaker 1726 Reactor Cooling Pump 3 Condensate Booster Pump 1B Hotwell Pump 1B .
| |
| No. 3 Heater Drain Pump 1C' No. 7' Heater Drain Pump 118 Loads Fed from 6.9 kV Unit Board iD' (45N721-1) 6.9 kV Shutdown Board 18-B, Breaker 1728 Reactor Coolant Pump 4 Condensate Booster Pump 1C .
| |
| ' Condenser Circulating Water Pump 1C Hotwell-Pump 1C -
| |
| 480V Unit Station Service Transformer 1B ;
| |
| ?
| |
| A.2-25 1'
| |
| | |
| ~
| |
| Table A.2-6 (continued)
| |
| Loads Fed from 6.9 kV Shutdown Board 1A-A (45N724-1) q Equipment Safety Pressurizer Heaters-(control group 1D) No l Containment Spray Pump 1A-A Yes t
| |
| : 480V Shutdown Transformer 1A2-A Yes i
| |
| .480V Shutdown Transformer 1A-A Yes i Residual Heat Removal Pump 1A-A Yes j 1
| |
| Safety. Injection Pump 1A-A . Yes Centr ifugal Charging Pump 1A-A Yes ,
| |
| J Essential Raw Cooling Water Pump Q-A Yes Essential Raw Cooling Water Pump J-A Yes Auxiliary Feedwater Pump 1A-A Yes 480V. Shutdown Transformer 1Al-A Yes Auxiliary Building Lighting Board la yes Pressurizer Heaters (backup group 1A-A) Yes 480V Transformer 1A-A at New ERCW Pumping Station Yes .
| |
| Loads Fed from 6.9 kV Shutdown Board 18-B (45N724-2)
| |
| Equipment Safety Pressurizer Heaters (backup group 1C) No Containment Spray Pump 1B-B . Yes
| |
| ' 480V Shutdown Transformer 182-B Yes 480V Shutdown Transformer 1B-B Yes Residual Heat Removal Pump 1B-B . Yes Safety Injection Pump 1B-B Yes Centrifugal Charging Pump 1B-B Yes Essential Raw Cooling Water Pump N-B Yes Essential Raw Cooling Water Pump L-B Yes Auxiliary Feedwater Pump 18-B Yes 480V Shutdown Transformer 181-B Yes' Pressurizer Heaters-(backup group 1B-B) Yes 480V Transformer 1B-B at New ERCW Pumping Station Yes
| |
| , aFor. emergency flood preparation; spare feeder.
| |
| A.2-26
| |
| | |
| [
| |
| L k-
| |
| ! Table A.2-6 (continued)
| |
| I Loads Fed from 6.9 kV Common Board A (45N715) l Equipment Feeder' 480V Unit Board 2Ba Emergency 480V Unit Board 2Aa Emergency 480V Unit Board 1Ba Emergency
| |
| .480V Unit Board 1Aa Emergency Auxiliary Building Lighting Bus A, Boards 1 and 3 Normal Auxiliary Building Lighting Bus A, Boards 2 and 4 Alternate Turbine Building Lighting Bus A, Boards 1 and 2 Normal Turbine Building Lighting Bus A, Boards 3 and 4 Alternate 480V Water Supply Station Service Transformer A 480V Service Building Station Service Transformer A 480V Auxiliary Building CSST A 480V Turbine Building CSST A 161 kV' Switchyard Distribution Cabinets 1 and 3 Transformers 1-1 and 2-1 500 kV Switchyard Distribution Cabinet 1, Transformer 1 Auxiliary Building Chiller A 1
| |
| Loads Fed from 6.9 kV Common Board B (45N715)
| |
| Equipment Feeder 480V Unit Board 2Ba Emergency 480V Unit Board 2Aa Emergency 480V Unit Board 1Ba Emergency 480V Unit Board 1Aa Emergency Auxiliary Building Lighting Bus B, Boards 2 and 4 Normal Auxiliary Building Lighting Bus B, Boards 1 and 3 Alternate Turbine Building Lighting Bus B, Boards 1 and 2 Alternate Turbine Building Lighting Bus B, Boards 3 and 4 Normal 480V Water Supply Station Service Transformer B 480V Hypochlorite Building Transformer Auxiliary Building Chiller B 480V Service Building Station Service Transformer B 480V Auxiliary Building CSST B 480V Turbine Building CSST B 500 kV Switchyard Distribution Cabinet 1 Transformer 1-2 161 kV Switchyard Distribution Cabinets 2 and 4, Transformers 1-2 and 2-2 i -
| |
| aThrough 480V Comon Emergency Transformer.
| |
| L L
| |
| A.2-27 i
| |
| e i-.r g - -- , - -u . . . . - _ - _ _ _ - - - - -
| |
| | |
| Table A.2-6 (continued) f Loads Fed from 480V Reactor Ventilation Board 1A-A (45N755-1,2)
| |
| Equipment Safety
| |
| ~
| |
| Incore Flux Detector Drive Unit 1F No Reactor Coolant Pump 1 Motor Heater No
| |
| ' Hydrogen Analyzer 1A-A ; .
| |
| Yes
| |
| . Reactor Upper Compartment Cooler Fan 1C . No Reactor Upper Compartment Cooler Fan 1A No
| |
| ,_e"- . Ice Condenser End Wall Door 1A No Reactor Coolant Drain Tank Pump 1A No Reactor Coolant Pump 3 Motor Heater No Ice Condenser Floor Defrost Heater 1A No
| |
| - Containment Purge Air Exhaust Fan 1A MK 47A370-89 No 1 Containment Purge Air Supply Fan 1A MK 47A370-69 No
| |
| ' Reactor Lower Compartment Unit Heater 1A No Containment Instrument Room Unit Heater 1A No
| |
| - Reactor Coolant Pump 3 011 Lif t Pump No 4
| |
| f Reactor Coolant Pump 1011 Lift Pump No Incore Flux Detector Drive Unit 1E No
| |
| :Incore Flux Detector Drive Unit 1D No-
| |
| - Waste Gas, Compressor Package' A No Spreading Room S~pply u Fan MK 47A370-3 No
| |
| - Spreading Roam Exhaust Fan A MK 47A370-4 No Reactor Building Manipulator Crane 1 - No
| |
| , Auxiliary and Control Building 480V Receptacles No No
| |
| ~
| |
| '! Reactor Upper Compartment Heater 1C
| |
| ,; : Ice Condenser Floor. Cooling Pump 1A No
| |
| '- Ice Condenser Air Handling Units No
| |
| ". No
| |
| 'i J- < Stud Tension Hoists .
| |
| te Water Intake Structure Trace Heating Cabinet No Containment Floor and Equipment Drain Sump Pump 1A. No fy t No Reactor Upper Compartment Heater 1A-
| |
| ~
| |
| 'ydrogen Electric Recombiner 1A-A Yes i
| |
| , k , ~ l' _g -
| |
| 1 A.2-28 4 , , , - -
| |
| | |
| Table A.2-6 (continued)
| |
| I Loads Fed from 480V Reactor Ventilation Board 18-B (45N755-3,4),
| |
| Equipment Safety Water Intake Structure Trace Heating Cabinet No Reactor Coolant Pump 2 Motor Heater No Incore Flux petector D.aive Unit 1A No Ice Condenser AHU No Incore Flux Detector Drive Unit 1C No Reactor Upper Compartment Heater 1B No l Reactor Upper Compartment Cooler Fan 1D No l Reactor Coolant Pump 4 Motor Heater No l Reactor Upper Compartment Cooler Fan 1B No Ice Condenser End Wall Door 1B No Reactor Coolant Drain Tank Pump 1B No Containment Floor and Equipment Drain Sump Pump 1B No Ice Condenser Floor Cooling Pump 1B No Ice Condenser Floor Defrost Heater 1B No Reactor Coolant Pump 2 011 Lift Pump No Reactor Lower Compartment Unit Heater 1B No Containment Instrument Room Unit Heater 1B NO Containment Purge Air Exhaust Fan IB MK 47A370-B9 No Containment Purge Air Supply Fan 1B MK 47A370-69 No Spreading Room Exhaust Fan B MK 47A370-5 No Incore Flux Detector Drive Unit 1B No Equipment Hatch Holst No RCC Change Hoist No ERCW Cooling Tower Makeup Pump No Ice Condenser Bridge Crane No Control Bay Suitp Pump 1 No Ice Condenser Air Handling Units No r Reactor Building Jib Crane No Reactor Coolant Pump 4 Oil Lift Pump No
| |
| ! Hydrogen Electrical Recombiner IB-B Yes l Incore Instrument Room Purge Supply Fan No Incore Instrument Room Purge Exhaust Fan No Reactor Upper Compartment Heater 10 No Hydrogen Analyzer 18-B Yes A.2-29
| |
| | |
| )
| |
| Table A.2-6 (continued)
| |
| Loads Fed from 420V Unit Board 1A (45N747-1)
| |
| Feeder I Equipment Condensate Demineralizer Pump 1A Raw Cooling Water Pump A Control Rod Drive Motor Generator Set 1A
| |
| , Condenser Vacuum Pump 1A Generator Bus Cooling Fan 1A Stator Cooling Water Pump 1A Generator Bearing Air Side Seal Oil Pump Steam Generating Blowdown Pump 1A EHC Fluid Pump 1A Turbine MOV Board 1A Normal Turbine Building Vent Board 1A Normal 480V Transformer Yard Cabinet 1 Turbine MOV Board 1C Normal Loads Fed from 480V Unit Board IB (45N747-2)
| |
| Equipment Feeder Condensate Demineralizer Pump 1C Condensate Demineralizer Pump 1B Raw Cooling Water Pump B Control Rod Drive Motor Generator Set IB Condenser Vacuum Pump 1B Condenser Vacuum Pump 1C Generator Bus Cooling Fan 1B Stator Cooling Water Pump 1B Steam Generator Blowdown Pump 1B Turbine Seal Oil Backup Pump EHC Fluid Pump 1B Turbine MOV Board 1B Normal Turbine Building Ventil3 tion Board IB Normal 480V Transformer Yard Cabinet 1 A.2-30
| |
| | |
| V
| |
| . Table A.2-6 (continued) ~
| |
| Loads Fed from 480V Reactor M0V. Board 1Al-A (45N751-1,2) :
| |
| . Equipment Safety
| |
| .Incore Instrument Room Cooler Fan 1A - No Backflow Gate Hoist Motor 1A-A Yes Reactor Building 480V Receptacles Elevations 733 and 743 No Centrifugal Charging Pump 1A-A Auxiliary 011 Pump Yes SIS Boron Injection Tank Heater 1A-A Yes Boric Acid Tank A Heater A-A Yes Boric Acid Tank C Heater A-A Yes Boric Acid Batching Tank Heater 2 No
| |
| ' ~
| |
| . Component Cooling System' Booster Pump A-A . Yes Containment Sump Spray Heater 1A Flow Control.. Valve FCV-72-23 Yes 4 RWST to Spray Header 1A Flow Control Valve FCV-72-22 Yes 1
| |
| . 48V Spare' Battery Chargera : No-
| |
| ; Reactor Building 480V Receptacles Elevations 733 and 782 No d
| |
| Boric Acid Batch Tank Agitator No 48V Telephone Battery Chargerb . No HPFP Header 1 Flow Control Valve 0-FCV-26-6 Yes' Boric Acid Transfer Pump 1A-A - Yes UHI Accumulator Isolation Valve Gag MTR-87-21 Yes Part Length Control Rod Drive Assembly Supply Transformer No
| |
| -RWST to RHR Pump Flow Control Valve FCV-63-1 Control Power Yes
| |
| -SIS Accumulator Tank 3 Flow Valve FCV-63-80 Control Power 4- Yes-RHR' Spray Header 1A Isolation Valve FCV-72-40 Yes Containment Spray Header 1A Isolation Valve FCV-72-39 Yes SIS Pump Outlet RCS Loops-1 and 3 Hot Leg FCV-63-156 Yes
| |
| - ? Seal Flow Isolation Valve FCV-62-63 Yes
| |
| ' Volume Control Tank-Outlet Isolation Valve LCV-62-132
| |
| .Yes
| |
| : Charging Pump Minimum Flow Valve FCV-62-98 Yes
| |
| - Charging Flow Isolation Valve FCV-62-90 Yes Refueling Water StoragecTank Valve LCV-62-135 Yes
| |
| 'RCS Pressure Relief Flow Control Valve FCV-68-333 Yes SIS Pump 1A-A Inlet Valve FCV-63-47 Yes
| |
| ~ SIS Pump 1A-A Outlet Flow Control Valve FCV-63-152 Yes
| |
| . SIS Boron Injection Tank Shutoff Valve FCV-63-26 .
| |
| Yes SIS Boron Injection Tank Inlet Shutoff Valve FCV-63-39 Yes RWST to'RHR Pump Flow Control Valve FCV-63-1 .
| |
| Yes
| |
| ,c SIS Pump Discharge to RWST Shutoff Valve FCV-63-3 Yes SIS Accumulator Tank 1 Flow Isolation Valve FCV-63-118 Yes SIS Accumulator Tank 3 Flow Isolation Valve FCV-63-80 Yes LSI' to RCS Loops 2'and 3 Flow Control . Valve FCV-63-93' Yes b RHR Heat Exchanger 1.to CVCS Charging Pump Valve FCV-63-8 Yes Containment Sump Flow Isolation Valve FCV-63-72 Yes RHR Pump 1A-A Minimum Flow Valve FCV-74-12 Yes aNormal Feeder bAlternate Feeder r
| |
| 4 A.2-31
| |
| /
| |
| vf ' e> w - - - -
| |
| --s .r- y 1 m , -.,~g - s -m,-me. - -e ,,.gr_p - r-- x m ---n,--3
| |
| | |
| Table A.2-6 (continued)
| |
| Loads Fed from 480V Reactcr M0V Board 1Al-A (45N751-1,2) (continued)
| |
| Equipment Safety RHR Pump 1A-A Inlet Flow Control Valve FCV-74-3 Yes ;
| |
| RHR Heat Exchanger A Bypass Valve FCV-74-33 Yes SIS Pump-Inlet to CVCS Charging Pump Valve FCV-63-7 Yes Containment Spray Pump 1A-A Recirculation Flow Control Valve FCV-72-34 Yes SIS Accumulator Tank 1 Flow Isolation Valve FCV-63-118 Control Power Yes Reactor Containment Pit Sump Ejector Pump No RHR System Isolation Valve FCV-74-1 Yes 480V Shutdown Board Transformer 1A-A Cooling Fans a ye3 480V Shutdown Board Transformer 1Al-A Cooling Fans Yes UHI Accumulater Isolation Valve Gag MTR-87-23 Yes UHI Positive Displacement Pump Recirculation Valve FCV-87-17 Yes Incore Instrument Room Circulatirg Pump 1A No Incore Instrument Room Chilled Water Compressor 1A No aNormal Feeder A.2-32
| |
| | |
| Table A.2-6 (continued)
| |
| Loads Fed from 480V Reactor MOV Board 1A2-A (45N751-3,4)
| |
| Equipment Safety Lower Containment 1C Coolers Discharge Isolation Valve FCV-67-95 Yes Lower Containment 1C Coolers Supply Isolation Valve FCV-67-91 Yes Lower Containment IA Coolers Discharge Isolation Valve FCV-67-87 Yes Lower Containment 1A Coolers Supply Isolation Valve FCV-67-83 Yes ERCW Header 1A Isolation Valve FCV-3-136B Yes Upper Containment Ventilation Cooler 1A Discharge Isolation Valve FCV-67-295 Yes Upper Containment Ventilation Cooler 1C Discharge Isolation Valve FCV-67-296 Yes Upper Containment Ventilation Cooler ID Discharge Isolation Valve FCV-67-142 Yes Upper Containment Ventilation Cooler 1C Supply Isolation Valve FCV-67-133 Yes Upper Containment Ventilation Cooler 1B Discharge Isolation Valve FCV-67-139 Yes Upper Containment Ventilation Cooler 1A Supply Isolation Va',ve FCV-67-130 Yes Annulus Standpipe Isolation Valve FCV-26-242 Yes SFPCS Heat Exchanger B Inlet Valve 0-FCV-70-41 Yes Compressor Cooler Heat Exchanger C Discharge Valve to Header A 0-FCV-67-151 Yes Station Service and Control Air Compressor Supply Header 1A Isolation Valve 0-FCV-67-205 Yes Auxiliary Building Air Coolers Supply Header 1A Isolation Valve FCV-67-127 Yes Containment Spray Heat Exchanger 1A Supply Control Valve FCV-67-125 Yes Containment Spray Heat Exchanger 1A Discharge Valve FCV-67-126 Yes ERCW Header IA Isolation Valve FCV-3-116A Yes ERCW Header 1A Isolation Valve FCV-3-136A Yes Component Cooling Heat Exchanger 1A Discharge Control Valve 1-FCV-67-146 Yes RCP Thermal Barrier Return Containment. Isolation Valve FCV-70-90 Yes RCP Thermal Barrier Return Containment Isolation Valve FCV-70-133 Yes 480V Shutdown Board Transformer 1A-A Cooling Fansa Yes 480V Shutdown Board Transformer A2-A Cooling Fans Yes ERCW to Component Cooling Heat Exchanger 2A Isolation Valve 1-FCV-67-424 Yes aAlternate Feeder A.2-33 4
| |
| | |
| I i
| |
| . l
| |
| ~ Table A.2-6 (continued)
| |
| . Loads Fed from 480V Reactor M0V Board 1 A2-A (45N751-3,4) (continued)
| |
| Equipment Safety
| |
| + - Containment' Standpipe ' Isolation Valve FCV-26-240 Yes Loop ~1 Deaeration Line Valve FCV-3-191 No
| |
| - Auxiliary Feedwater. Pump Turbine Steam Supply from Steam Generator 4 Isolation Valve FCV-1-15
| |
| ~
| |
| Yes Loop.2 Deaeration Line Valve FCV-3-192 .
| |
| No Condensate demineralizer Waste Evaporator Building Supply Valve 0-FCV-70-208 Yes Boric Acid and Gas Stripper Evaporator Package 1A Flow Control Valve FCV-70-168 Yes RCP OC Return Containment Isolation Valve FCV-70-92 Yes Auxiliary Building ERCW Supply Header 1A Isolation 4
| |
| Valve FCV-67-81 Yes Lower Containment 1B Coolers Discharge Isolation Valve Outside Containment FCV-67-104 Yes
| |
| ' Steam Generator Feedwater Isolation Valve FCV-3 Yes
| |
| . Sample Heat Exchanger-Header Outlet Valve FCV-70-183 Yes Lower Containment 10 Coolers Discharge Isolation Valve
| |
| - Outside Containment FCV-67-112
| |
| - Yes ERCW Header 1A Isolation Yalve FCV-3-116B Yes
| |
| . Auxiliary Feedwater Pump Turbine Steam. Supply from SG-1 Isolation Valve FCV-1-16 Yes
| |
| -RCP Oil Cooler header Containment Isolation Valve FCV-70-139 _
| |
| Yes Auxiliary Feedwater Pump Valve A-A Electrohydraulic -
| |
| . Actuator MTR-3-122 Yes Steam Flow to Auxiliary Feedwater Pump Turbine Isolation Valve FCV-1-17
| |
| ~
| |
| Yes Excess Letdown Heat Exchanger Control-Inlet Isolation Valve FCV-70-143 -
| |
| =
| |
| Yes Auxiliary-Waste Evaporator Package Outlet Valve 0-FCV-70-111 Yes CCS Heat Exchanger A Inlet Valve 1-FCV-70-25. . Yes CCS Heat Exchangers A and C Inlet Isolation Valve 1-FCV-70-23 Yes CCS Heat Exchangers A and C Isolation Valve 1-FCV-70-10 Yes
| |
| .CCS Heat Exchanger A Outlet Valve 1-FCV-70-8 Yes LRHR Heat Exchanger A Outlet Valve FCV-70-156 Yes
| |
| -SFPCS Heat Exchanger. A Outlet Valve 0-FCV-70-11 Yes
| |
| -RHR Heat Exchanger. A Header Inlet Valve FCV-70-2 Yes RCP Spray Isolation Valve 1-FCV-26-243 Yes Annulus' Sprinkler Isolation Valve 1-FCV-26-245 - Yes
| |
| .SFPCS Heat' Exchanger Supply Header Valve 0-FCV-70-197 Yes
| |
| . Miscellaneous Equipment Header Inlet Valve FCV-70-4 Yes
| |
| ' Steam Generator Feedwater Isolation Valve FCV-3-87 Yes Supply Header 1B to Header 2A Isolation Valve 1-FCV-67-223 Yes Supply Header 1A to Header 2B Isolation Valve 1-FCV-67-147 Yes i ;
| |
| 4 A.2-34
| |
| | |
| Table A.2-6 (continued)
| |
| Loads Fed from 480V Reactor MOV Board IB1-B (45N751-5,6)
| |
| Equipment Safety Incore Instrument Room Cooler Fan IB No Incore Instrument Room Circulation Pump 1B No Reactor Building 480V Receptacles, Elevations 680,' 693, and 782 No
| |
| ' Centrifugal Charging Pump 1B-B Auxiliary 011 Pump Yes SIS Boron Injection Tank Heater 18-B Yes Boric Acid Tank C Heater B-B Yes Boric Acid Tank A Heater B-B Yes Boric Acid Batching Tank Heater 1 No Containment Sump to Spray Header 18 Flow Control Valve FCV-72-20 Yes RWST to Spray Header IB Flow Control Valve FCV-72-21 Yes Containment Spray Header 1B Isolation Valve FCV-72-2 Yes 48V Plant Battery Chargera yo Compressor Cooling System Booster Pump 1B-B Yes 48V Spare Battery Chargera yo Boric Acid Transfer Pump 1B-B Yes Reactor Building 480V Receptacles, Elevations 680 and 693 No Incore Instrument Room Chilled Water Compressor 18 No SIS Pump Shutoff Valve FCV-63-22 Control Power Yes SIS Accumulator Tank 4 Flow Isolation Valve FCV-63-67 Control Power Yes SIS Accumulator Tank 2 Flow Isolation Valve FCV-63-98 Control Power Yes SIS Pump 18-B Discharge to RWST Shutoff Valve FCV-63-4 Yes RHR Spray Header 1B Isolation Valve FCV-72-41 Yes Containment Spray Pump 1B Recirculation Flow Valve FCV-72-13 Yes Containment Spray Pump 1B-B Seal Flow Isolation Valve FCV-62-61 Yes Volume Control Tank Outlet Isolation Valve LCV-62-133 Yes Charging Pump Flow RWST Valve LCV-62-136 Yes Charging Pump Minimum Flow Valve FCV-62-99 Yes Cnarging Flow Isolation Valve FCV-62-91 Yes RCS Pressure Relief Flow Control Valve FCV-68-332 Yes l SIS Pump B-B Inlet Valve FCV-63-48 Yes SIS Pump B-B Outlet Flow Control . Valve FCV-63-153 Yes SIS Boron Injection Tank Shutoff Valve FCV-63-25 Yes Refueling Water Storage Tank to SIS Pump Flow Control Valve FCV-63-5 Yes
| |
| . SIS Pump Outlet RCS Loops 2 and 4 Hot Leg FCV-63-157 Yes SIS Boron Injectior. Tank Inlet Shutoff Valve FCV-63-40 Yes SIS Pump B-B Discharge to RWST Shutoff Valve FCV-63-175 Yes SIS Accumulator Tank 2 Flow Isolation Valve FCV-63-98 Yes SIS Accumulator Tank 4 Flow Isolation Valve FCV-63-67 Yes SI to RCS Loops 1 and 4 Flow Control. Valve FCV-63-94 Yes aAlternate Feeder A.2-35
| |
| | |
| Table A.2-6 (continued) r Loads Fed from 480V Reactor M0V Board 1B1-B (45N751-5,6) (continued) l Equipment Safety SIS Pump Inlet from RHR Reservoir Heat Exchanger 3 Valve FCV-63-11 Yes Containment Sump Flow Isolation Valve FCV-63-73 Yes RHR Pump 1B Minimum Flow Valve FCV-74-24 Yes f
| |
| RHR Pump 1B-B Inlet Flow Control Valve FCV-74-21 Yes SIS Pump Inlet to CVCS Charging Pump Valve FCV-63-6 Yes SIS Pump Shutoff Valve FCV-63-22 Yes
| |
| , Emergency Boration Flow Control Valve FCV-62-138 Yes RHR Injection or Recirculation After LOCA FCV-63-172 Yes RHR Heat Exchanger B Bypass Valve FCV-74-35 Yes Backflow Gate Hoist Motor 1B-B Yes Auxiliary Boration Tank Agitator No UHI Accumulator Isolation Valve Gag MTR-87-22 Yes UHI Accumulator Isolation Valve Gag MTR-87-24 Yes 480V Shutdown Board Transformer 1B1-B Cooling Fans Yes RHR System Isolation Valve FCV-74-2 Yes A.2-36
| |
| | |
| r.
| |
| Table A.2-6 (continued)
| |
| Loads Fed from 480V Reactor MOV Board 182-B (45N751-7,8)
| |
| Equipment Safety cower Containment 10 Coolers Discharge Isolation Valve Inside Containment FCV-67-111 Yes Lower Containment 10 Coolers Supply Isolation Valve FCV-67-107 Yes Lower Containment IB Coolers Discharge Isolation Valve Inside Containment FCV-67-103 Yes Lower Containment 1B Coolers Supply Isolation Valve FCV-67-99 Yes Upper Containment Ventilation Cooler 1B Discharge Isolation Valve FCV-67-297 Yes Upper Containment Ventilation Cooler ID Discharge Isolation Valve FCV-67-298 Yes Upper Containment Ventilation Cooler 1C Discharge Isolation Valve FCV-67-134 Yes Upper Containment Ventilation Cooler 10 Supply Isolation Valve FCV-67-141 Yes Condensate Demineralizer Waste Evaporator Building Supply Valve FCV-70-207 Yes Upper Containment Ventilation Cooler 1A Discharge Isolation Valve FCV-67-131 Yes Upper Containment Ventilation Cooler 1B Supply Isolation Valve FCV-67-138 Yes 480V Shutdown Board Transformer 1B-B Cooling Fans a yes 480V Shutdown Board Transformer 182-B Cooling Fans Yes Station Service and Control Air Supply Header 1B Isolation Valve 0-FCV-67-208 Yes Containment Spray Heat Exchanger 18 Supply Control Valve FCV-67-123 Yes Containment Spray Heat Excnanger 1B Discharge Valve FCV-67-124 Yes ERCW Header 1B Isolation Valve FCV-3-126A Yes RCP Thermal Barrier Containment Isolation Valve FCV-70-134 Yes Auxiliary Building Air Coolers Supply Header 1B Isolation Valve FCV-67-128 Yes Lower Containment 1A Cooler Discharge Isolation Valve Outside Containment FCV-67 Yes Auxiliary Building ERCW Supply Header 1B Isolation Valve FCV-67-82 Yes Lower Containment 1B Cooler Discharge Isolation Valve Outside Containment FCV-67-96 Yes ERCW Header 18 Isolation Valve FCV-3-126B Yes Annulus Standpipe Isolation Valve FCV-26-241 Yes ERCW to Component Cooling Heat Exchanger A 0-FCV-67-478 Yes Loop 4 Deaeration Line Valve FCV-3-194 No Loop 3 Deaeration Line Valve FCV-3-193 No aAlternate Feeder A.2-37 L
| |
| | |
| r
| |
| . Table A.2-6 (continued)
| |
| Loads Fed from 480V Reactor MOV Board 1B2-B (45N751-7,8) (continued)
| |
| -Equipment Safety CCS Pumps A to B Suction Isolation Valve 0-FCV-70-34 Yes CCS Pumps 1A-A and 1B-B to C-S Inlet Isolation Valve 1-FCV-70-64 Yes RC Pump OC Return Containment Isolation Valve FCV-70-89 Yes Steam Flow to Auxiliary Feedwater Pump Turbine Isolation Valve FCV-1-18 Yes ERCW Header 1B Isolation Valve FCV-3-179B Yes Steam Generator Feedwater Isolation Valve FCV-3-100 Yes SFPCS Heat Exchanger Supply Header Isolation Valve 0-FCV-70-198- Yes ERCW Header 1B Isolation Valve 0-FCV-3-179A Yes Annulus Sprinkler Isolation Valve FCV-26-244 Yes RCP Oil Cooler Hcader Containment Isolation Valve FCV-70-140 Yes RCP Thennal Barrier Return Containment Isolation Valve FCV-70-87 Yes RHR Heat Exchanger B Return Header Isolation Valve FCV-70-75 Yes RHR Heat Exchanger B Outlet Valve FCV-70-153 Yes CCS Pumps 1A-A and 1B-B to C-S Inlet Isolation Valve 1-FCV-70-74 ' Yes CCS Pumps 1A-A and 18-B to C-S Outlet Isolation Valve 1-FCV-70-27 Yes CCS Heat Exchanger C Inlet Valve 0-FCV-70-22 Yes CCS Heat Exchangers A and C Outlet Isolation Valve 1-FCV-70-9 -
| |
| Yes CCS Heat Exchangers A a..t C Inlet Isolation Valve 1-FCV-70-13 Yes CCS Heat Exchanger C Outlet Valve 0-FCV-70-12 Yes CCS Pumps 1A-A and 1B-B to C-S Outlet Isolation Valve 1-FCV-70-26 Yes RHR Heat Exchanger B Header Inlet Valve FCV-70-3 Yes Steam Generator Feedwater Isolation Valve FCV-3-47 Yes Condensate Demineralizer Waste Evaporator Building Return Valve 0-FCV-70-206 Yes Auxiliary Fcedwater Pump Valve B-B Electrohydraulic Actuator MTR-3-132 Yes i
| |
| i l
| |
| A.2-38
| |
| | |
| p-3 Table A.2-6 (continued)
| |
| Loads Fed from Diesel Auxiliary Board 1Al-A (45N732-1)
| |
| Equipment Safety Diesel Generator. Building Lighting Cabinet LC45 Yes Diesel Generator 1A-A Air Compressor 2 No Diesel Generator Building Sump Pump A Yes
| |
| ' Emergency Diesel Engine Heat Exchanger Supply Valve from Header B FCV-67 .
| |
| Yes Cooling Tower D Supply Isolation Valve 0-FCV-67-363 Yes.
| |
| Diesel Generator.1A-A Battery Hood Exhaust Fan MK 47A370-84 Yes Diesel Generator 1A-A Engine 1A1 Water Heater Yes Diesel Generator 1A-A Engine 1A1 Lube Oil Circulation Pump Yes
| |
| . Diesel Generator 1A-A Muffler Room Exhaust Fan MK 47A372-17 No Diesel Generator 1A-A Day Tank Fuel Oil iransfer Pump 1 Yes Diesel Generator.1A-A Battery Charger' Yes Power Outlets No Diesel Generator'1A-A Room Exhaust Fan 1-A MK 47A370-81 Yes Lube Oil Storage Room' Heater MK 47A376-69 No Diesel Exhaust Monitor Thermocouple Alarm Relays Yes Diesel Generator Electric Governor Rheostat Yes Communication Remote Control Unit No Diesel Generator Room 1A-A Air Intake Damper Yes Corridor Electric Heater 1A MK 47A376-68 No aAlternate Feeder-v A.2-39 uu
| |
| | |
| ~ ,
| |
| d Table A.2-6 (continued)
| |
| Loads Fed from Diesel Auxiliary Board 1A2-A.(45N732-2)
| |
| Equipment Safety Diesel Generator 1A-A 480V Board Room Exhaust Fan MK 47A370-82 Yes tube Oil' Storage and CO LStorage 2 Room Exhaust Fan MK 47A370-85 No Cooling Tower B Supply Isolation Valve 0-FCV-67-361 Yes
| |
| : Diesel Generator 1A-A Air Compressor 1 .
| |
| No Diesel Generator LA-A Room Heater B MK.47A376-69. No Diesel Generator 1A-A Battery Charger a . .Yes
| |
| . Diesel Generator 1A-A Room Exhaust Fan 2-A MK 47A370-81 Yes Fallout Shelter Electric Heater MK 47A376-26 No CO2 Storage Room Electric Heater MK 47A376-67 No Diesel Generator 1A-A Day Tank Fuel .0il Transfer Pump 2 Yes
| |
| . Diesel Generator 1A-A 480V Electric Board Room Electric Heater
| |
| ;MK 47A376-29 .No
| |
| -Diesel Generator Building CO2 Refrigerator Unit No
| |
| -Diesel Generator 1A-A Engine 1A2 Water Heater- Yes Diesel Generator 1A-A Engine 1A2 Lube Oil Circulation Pump Yes Emergency Diesel Engine Heat Exchanger Supply Valve from Yes i Header A FCV-67-66 Diesel Generator 1A-A Space Heater .No
| |
| ' Diesel Generator 1A-A Room Heater A MK 47A376-69 No aNormal: Feeder J
| |
| h 1
| |
| A.2-40
| |
| _ _ _ - . _ _ - _ . - . _ _ . ~ ,
| |
| | |
| a Table A.2-6 (continued)
| |
| Loads Fed from Diesel Auxiliary Board 181-B (45N732-1)
| |
| Equipment Safety Diesel Generator Building Lighting Cabinet LC47 Yes Diesel Generator IB-B Air Compressor 2 No
| |
| -Yard Fuel Oil Transfer Pump No Diesel Generator Building Sump Pump B Yes Emergency Diesel Engine Heat Exchanger Supply Valve from Header A FCV-67-65 Yes Cooling Tower A Supply Isolation Valve 0-FCV-67-360 Yes
| |
| -Diesel Generator IB-B Battery Hood Exhaust Fan MK 47A370-84 Yes Diesel Generator 1B-B Engine 181 Water Heater Yes Diesel Generator 18-B Engine 181 Lube 111 Circulation Pump Yes Diesel Generator 1B-B Muffler Room Exhtust Fan MK 47A372-17 No Diesel Generator 18-B Day Tank Fuei 011 Transfer Pump 1 Yes Diesel Generator IB-B Battery Chargera Yes Diesel Generator 1B-B Room Exhaust Fan 1-0 MK 47A370-B1 Yes Diesel Exhaust Monitor Thermocouple Alarm kelays Yes-Diesel Generator Electric Governor Rheostat Yes Communication Remote Control Unit No Diesel Generator Building Corridor Vent Damper No Diesel Generatos Room 18-B Air Intake Damper Yes Auxiliary Boiler Fuel Oil Pump A No Corridor Electric Heater 18 MK 47A376-68 No aAlternate Feeder
| |
| -c .
| |
| M A.2 41 L
| |
| | |
| 'l Table A.2-6 (continued)
| |
| Loads Fed from Diesel Auxiliary Board 182-B (4SN732-2) _.
| |
| , Equipment Safety Diesel Generator IB-B 480V Board Room Exhaust Fan MK 47A370-82 Yes
| |
| . Cooling Tower C Supply Isolation Valve 0-FCV-67-362 Yes Power Outlets .
| |
| No Diesel Generator 1B-B Air Canpressor 1 No Diesel Generator IB-B Room Heater B MK 47A376-69 No Diesel Generator 1B-B Battery Charger a yes Diesel . Generator IB-B Room Exhaust Fan E-B MK 47A370-Bl . Yes Diesel Generator IB-B Day Tank Fuel Oil Transfer Pump 2 .Yes Diesel Generator IB-B 480V Electric Board Room Electric Heater MK 47A376-29 rev "
| |
| Diesel Generator 18-B Engine 182 Water Heater Yes -
| |
| Diesel Generator 1B-B Engine 182 Lube Oil Circulation Pump Yes Emergency Diesel Engine Heat Exchanger Supply Valve from
| |
| ' Header B FCV-67-67 Yes Diesel Generator 1B-B Space Heater . No Diesel Generator 1B-B Room Heater A M4 47A376-69 No aNormal Feeder 4
| |
| P =
| |
| ~
| |
| 4 A.2-42 1
| |
| e i
| |
| W
| |
| | |
| power to 480V unit board 1A through transformer TRIA. USST 1A also provides power to the 6.9 kV unit board 1B which then feeds into 6.9 kV shutdown board 1A-A. Similarly, USST 1B provides power to 6.9 kV unit boards 1C and 1D. Unit board ID feeds 480V unit board 1B through transformer 18.
| |
| Pcwer from 6.9 kV unit board 1C feeds 6.9 kV shutdown board IB-B.
| |
| Shutdown board 1A-A (6.9 kV) feeds into 480V shutdown boards 1Al-A and 1A2-A. Shutdown board 1B-B (6.9 kV) powers 480V shutdown boards 181-B and 1B2-B.
| |
| All four 480V shutdown boards feed the rest of Unit l's low voltage Class 1E electric power system using similar configurations of boards, distribution panels, relays, breakers, and transformers.
| |
| During normal operations, Unit 2 feeds its designated 6.9 kV unit boards.
| |
| From the 6.9 kV unit boards, the operation of Unit 2 is identical to that of Unit 1.
| |
| The normal power supply of DC current to the 125V DC battery boards is from the battery charger in each ch&nnel. The charger supplies normal load demand on the battery board and maintains the battery in a charged state.
| |
| Following a 30-minute AC power outage, normal recharging of the battery can be accomplished in approximately 12 hours and after a 2-hour AC power outage, normal recharging takes approximately 36 hours. Two spare chargers are available for the four channels (one each for two channels). Each spare charger can be connected to either of its two assigned channels. It can substitute for or operate in parallel with the normal charger in that channel.
| |
| AC power for each charger is derived from two independent 480V shutdown boards. One 480V source is normally connected with the alternate source in a standby mode. The transfer between the two 480V feeders is manual and is interlocked to prevent paralleling the redundant power sources.
| |
| The normal power supply of the 120V AC vital instrument power boards is from the inverter in each channel. The inverter is supplied from the same channel's 480V shJtdown board source or from the battery board. Each inverter has an auctioneered solid state transfer switch between the 480V AC and 125V DC sources. An alternate supply for the 120V AC vital instrument A.2-43
| |
| | |
| v-power boards is available from the same channel's 120V AC instrument power distribution panel. The distribution panel also receives its power from the channel's'480V source. A make-before-break manual transfer between the output of the inverter and the 120V alternate supply is provided so that the inverter may be taken out of service for maintenance without interrupting power to the loads.
| |
| The Unit 1 and 2120V AC instrument power racks are normally powered from either of the units' two 120V AC. instrument power distribution panels.
| |
| ~
| |
| The 250V DC and 120V AC preferred power system is configured and operates in
| |
| -a manner similar to the 125V DC and 120V AC vital power systems. There are two 250V DC battery boards. Each is supplied by a dedicated battery charger with a third charger as a shared spare. Each charger has two 480V supplies; one normal and one alternate, with a manual transfer switch between them.
| |
| The 120V AC preferred power is supplied from an inverter that receives power from the 250V DC battery board or the 480V so.rce.
| |
| ' A.2.2.4.2 Event response.
| |
| L' A.2.2.4.2.1. Automatic. actions. During abnormal operations, the following switching takes place automatically for the USST 1A power train (the
| |
| - corresponding designation for the USST 1B power train components is shown in parentheses):
| |
| : 1. Breakers 1112 (1122) and 1114 (1124) open, disconnecting the 6.9 kV unit boards 1A (1C) and 1B (10) from USST 1A -(18).
| |
| : 2. Breakers 1522 (1524) and 1622 (1624) close and energize 6.9 kV unit boards 1A (1C) and 1B (1D), respectively, using offsite' power through start buses 1A and IB, respectively.
| |
| : 3. Shutdown board 1A-A (1B-B) is energized using 6.9 kV unit board 1B (1C) as the normal feeder.
| |
| : 4. Should breaker 1718 (1726) fail open, breaker 1716 (1728) closes and provides power to 6.9 kV shutdown board 1A-A (18-B) using 6.9 kV unit board 1A (10) as the alternate feeder.
| |
| '5. If the 6.9 kV shutdown boards are not energized tan indication of complete loss of the offsite power supply), the onsite power system is activated and connected to the 6.9 kV shutdown boards. Each 6.9 kV shutdown board has its own diesel generator. There is a spare diesel generator which can be manually connected to any one of the 6.9 kV shutdown boards.
| |
| A.2-44
| |
| | |
| t Specifically, during offsite power operation, power is fed into the plant L -
| |
| 'from'the 161 kV switchyard via three CSSTs rated 161 kV to 6.9 kV and via four 6.9 kV start buses.- CSST A, B, and C have two 6.9 kV secondary
| |
| _ windings. On CSSTs A and C, the two secondary windings are each connected
| |
| , ' as normal sources to separate 6.9 kV start buses. CSST B serves as a shared spare to'A or C and has its secondaries connected as alternate sources to the.four 6.9 kV start buses. Each start bus serves as the startup source and the' reserve running source to two of the four 6.9 kV unit boards for i
| |
| each unit. - Each of the two 6.9 kV shutdown boards for each unit has a normal feed from one tinit board and the alternate feed from another unit li . board; these two unit boards have alternate feeds from different start buses
| |
| - with automatic transfer from a normal to an alternate source. Thus, each-
| |
| ~ 6.9 kV shutdown board has automatic access to either of two CSSTs,-and both 6.9 kV shutdown boards for each unit can be energized from offsite power in spite of the loss of any one CSST, start bus, unit board, or supply cable from unit board to shutdown board.
| |
| ; Start bus 1A is the alternate feeder to 6.9 kV unit boards 1A and IC. Start bus 2A is the normal feeder to 6.9 kV common board A. Start bus 1B is the alternate feeder to 6.9 kV unit boards 1B and 10. Start bus 2B is the
| |
| . normal feeder to 6.9 kV common board B.
| |
| .Each 6.9 kV unit board can be selected fc manual or automatic transfer between the normal and alternate supply breakers.- Manual transfers are high .
| |
| speed (six-cycles or less) and can be made from the normal to the alternate supply or from the alternate to the normal supply. Automatic transfers can only be made from the nomal to the alternate supply. Automatic transfers initiated by loss of voltage on the unit board are delayed until the voltage decreases to 30% of normal, while those initiated by turbine trip signals are high speed transfers, and those initiated by a reactor trip are delayed 30 seconds before high speed transfer is initiated.
| |
| Feeders from the unit boards are the final link to the onsite (standby) power system (the 6.9 kV shutdown boards). Unit boards 1B and 1C are the normal supplies to 6.9 kV shutdown boards 1A-A and 18-B, respectively, while unit boards 1A and ID are the alternate supplies, respectively. All of
| |
| - these feeder breakers are nomally closed with all transfers between the normal and alter'iate feeders occurring at the 6.9 kV shutdown board.
| |
| A.2-45
| |
| | |
| A safety injection signal received in the absence of a sustained loss of
| |
| -voltage on the 6.9 kV shutdown board will start the diesel generators but not connect them to the shutdown board. When offsite power. fails completely, a sustained loss (longer than 1.5 seconds) of voltage on the 6.9 kV shutdown board starts the diesel generator and initiates (after an
| |
| . additional 5 seconds) logic that trips the normal or alternate feeder breaker, all 6.9 kV loads (except the 480V shutdown board transformers), and the major 480V loads. Table A.2-7 shows the loads that are automatically stripped. When the diesel generator has reached rated speed and voltage, the generator will be automatically connected to its 6.9 kV shutdown board bus. This return of voltage to the 6.9 kV shutoown bus initiates logic which connects the required loads in sequence. Table A.2-8 shows the order of applied loads. The standby (onsite) power system's automatic sequencing logic is designed to automatically connect the required loads in proper sequcnce should the logic receive an accident signal prior to, concurrent with, or following a loss of all nuclear unit and preferred (offsite) power.
| |
| The I&C power system remains in its normal operational mode except in the event of loss of all AC power. In response to a loss of all AC power, each I?5V DC board and 250V DC board is powered by a dedicated battery supply.
| |
| The battery supply is always connected to the battery board and when the normal charger power fails, the battery picks up the load with no interruption. The auctioneering circuits in the inverters make sure the DC power supply is carrying the load of the 120V AC vital instrument power boards.
| |
| r Distribution of power is accomplished without automatic transfers between redundant load groups and without automatic load stripping or sequencing.
| |
| If 480V AC power is available, then it will carry the load. If 480V AC
| |
| [
| |
| power is not available, then 125V DC battery power will carry the load.
| |
| i A.2.2.4.2.2 Hanual operator actions. All 480V shutdown boards and all motor control centers have alternate feeders to their respective board buses. There are no automatic transfces of board supplies between redundant power sources. Transfers between the normal and alternate feeders are manual.
| |
| A.2-46
| |
| | |
| Table A.2-7 UNIT 1 SHUTDOWN BOARD LOADS AUTOMATICALLY STRIPPED FOLLOWING A LOSS OF NUCLEAR UNIT AND PREFERRED (0FFSITE) POWER H or Power Train Equipment Name Quantity l'# 2B 2A 1B 1A Pressurizer Heaters . 2 485 x x Pressurizer Heaters 2 415 x x Containment Spray Pump 2 700 x x Centrifugal Charging Pump 2 600 x x Essential Raw Cooling Water Pump 4 700 xx xx Auxiliary Essential Raw Cooling Water Pu.np 2 600 x x Safety Injection Pump 2 400 x x Auxiliary Feedwater Pump 2 500 x x Residual Heat Removal Pump 2 400 x x Component Cooling System Pump 2 350- x x Component Cooling System Pump (Spare) 1 350 x Reciprocating Charging Pump 1 200 x Spent Fuel Pit Pump 1 100 x i Service Air Compressor 1 125 x x Fire Pump 2 200 x x Cooling Tower Fan 2 100 Turbine Turning Gear Oil Pump 1 75 x
| |
| . Containment and Auxiliary Buildings General Supply Fan 2 150 7. x Containment and Auxiliary Buildings General Exhaust Fan 2 125 x x Fuel Handling Area Exhaust Fan 1 100 x Containment and Auxiliary Buildings Vent Board 2 2 - x x Reactor Vent Board 2 -
| |
| x x aNameplate horsepower for motor loads is used and is converted to kVA by equating i horsepower to 1 kVA:
| |
| I hp = 746 watts /(.90 efficiency x .83 power factor) = 1 kVA
| |
| .e A.2-47
| |
| | |
| Table A.2-8 DIESEL GENERATOR LOAD SEQUENTIALLY APPLIED FOLLOWING A LOSS OF
| |
| ~
| |
| NUCLEAR UNIT AND PREFERRED (OFFSITE) POWER.
| |
| Load Applied
| |
| '"I Equipment Name' "a Seconds HP Load kVA Nonaccident Accident Condition Condition Miscellaneous Loads 0 1,110 5,132 Yes Yes Centrifugal Charging Pump and AHU 2. 680 4,079 Yes Yes Safety Injection Pump and AHU 5 410 2.632 No - Yes Residual Heat Removal Pump and AHU 10 425 2,499 No Yes Essential Raw Cooling Water Pump 15 700 3,788 Yes Yes Component Cooling System Pump 70 355b 1,870 Yes Yes Auxiliary Feedwater Pump 15 486 2,586 Yes Yes Containment Spray Pump and AHU l0 690 3,572 No Yes Pressurizer Heaters !O 485 kW 485 kW No No Fire Pump 1 ?O 200 865 Yes Yes Diesel Generating Rating: 4,000 kW cont'nuous or 4,400 kW for 2 hours.
| |
| 8Time is meatured from the time of closing of the breaker which connects the diesel generator to the power train. Values given are nominal times. Actual times are consistent with the glesel generator loading analyses and will be verified during preoperational testing.
| |
| Diesel generator 1A or 2B will have two component coolleg system pumps loaded
| |
| ' (see Table A.2-6).
| |
| JHU - Air Handling Unit Y
| |
| A.2-48
| |
| | |
| . ~ - . . .-. . - . _ . - . . .. -. . - ..
| |
| All transfers between the normal and alternate 480V supplies to the ISC power battery chargers are manual (see Table A.2-9). All transfers between the normal and alternate battery chargers to the battery boards are manual.
| |
| F 7
| |
| All. transfers between the normal inverter power supply and the maintenance
| |
| ; power supply to the 120V AC vital instrument power boards are manual. .
| |
| ~
| |
| : j. Two of the four channels' supply 125V DC control power to two manual breakers for operation ~of the shutdown board breakers; one breaker is the primary supply and the other is a standby supply. If the primary supply channel
| |
| . fails ti.en the switch to the standby supply channel has to be a manual
| |
| !- operator action.
| |
| 4-There are no automatic transfers of shutdown boards between diesel generator
| |
| . power supplies. Transfer to the spare diesel (C-S) is accomplished by disconnecting and reconnecting at the diesel generator control panels and the diesel generator annunciator distribution panels, and transferring power i at the transfer switch. Control and annunciator power must be deactivated while making the transfer connections. ;
| |
| Any diesel generator can be' started by manually operated emergency start switches located in the main and auxiliary control rooms. The engine also 4
| |
| has a local manual start switch as well as remote start from the main control room for test purposes. Automatic starting is from an accident signal or a loss of offsite power signal. All automatic and emergency start signals operate to deenergize a normally energized circuit. These signals
| |
| ; also operate'a lockout relay that removes all manually operated stop signals except emergency stop, and all protective relaying on the generator except generator differential. The lockout relay must be manually reset at the diesel generator relay panel in the diesel building. A local idle start switch is provided to start and run the engine at idle speed for durations of unloaded operation. . During this type of operation, any emergency signal will cause the engine to go to full speed and_ complete the emergency start circuit.
| |
| A.2.2.4.3 Potential for event initiator. Loss of offsite power is
| |
| ' considered an initiating event. Loss of IAC power to essential plant operating equipment could-lead to a turbine trip or reactor trip initiating event. Loss of I4C power itself as a direct initiator of an accident event ,
| |
| is considered negligible due to the reif ability of the IAC power source.
| |
| A.2-49
| |
| .ou 4,-...- . . . , , ,,..-4, , . . .er-, . - . . . . . , - , . , _..
| |
| | |
| e t
| |
| qt Table A.2-9 LOADS HAVING MANUAL TRANCFER BETWEEN POWER TRAINS -
| |
| ~
| |
| Load Normal. Supply Al ternate - Supply '
| |
| 125V Battery Charger I and Inverters 480V Shutdown Board 1Al-A 480V Shutdown Board IB1-B 125V Battery Charger II and Inverters 480V Shutdown Board 182-B 480V Shutdown Board 1A2-A 2= 125V Battery Charger III and Inverters . 480V Shutdown Board 2Al-A 480V Shutdown Board 281-B
| |
| .125V Battery Charger IV and Inverters 480V Shutdown Board 2B2-B 480V Shutdown Board'2A2-A-125V Spare Battery Charger 1 480V Shutdown Board 1A2-A 480V Shutdown Board IB1-B 125V Spare Battery Charger 2 480V Shutdown Board 2A2-A 480V Shutdown Board 281-B Component Cooling System Pump C-S 480V Shutdown Board 2B2-B 480V Shutdown Board 1A2-A Cooling Tower Fan B-S 480V Shutdown B'oard 2A2-A 480V Shutdown Board 2B1-B Cooling Tower Fan C-S 480V Shutdown Board 281-B 480V Shutdown Board 2A2-A AERCW System Heat Trace Transfer Diesel Auxiliary Board 2Al-A Diesel Auxiliary Board 281-B i
| |
| 4
| |
| ' =-
| |
| | |
| A.2.2.5 , Controls, Indicators, and Alarms. The EPS is the system with the largest number of controls, indicators, and alarms. All of the major controls,
| |
| - indicators, and alarms for the EPS are on the main control panel. on other control room panels, and on local panels according to Table A.2-10.
| |
| A.2.2.6 . Testing, Inspection, and Surveillance Requirements.
| |
| : 1. The circuits between the offsite transmission network and the onsite Class.1E distribution system (6.9 kV shutdown boards) are determined operable at least once per 7 days.
| |
| : 2. Based on the frequency specified in Table A.2-11 and on a staggered test schedule, the fuel levels in each day tank and in the 7-day tank are. verified. Also, based on the same schedule,
| |
| 'the fuel transfer pump is started and verified to transfer fuel from the 7-day tank to the day tanks.
| |
| ~
| |
| : 3. Based on the frequency specified in Table A.2-11, each diesel is started and verified to accelerate to 900 rpm in less than.or equal to 10 seconds; the generator voltage and frequency are verified to be 6,900V, plus oi minus 690 volts and 60 Hz plus or minus 12 Hz within 10 seconds after the start signal. The diesels are tested using each of the following four signals at least once per 124 days:
| |
| : a. Manual
| |
| : b. Simulated Loss of.0ffsite Power
| |
| : c. Simulated Loss of Offsite Power in Conjunction with an ESF Actuation Test Signal
| |
| : d. An ESF Actuation Test Signal
| |
| : 4. . Also based on the frequency specified .in Table A.2-11, each ' .
| |
| generator is synchronized, loaded to at least 4,000 kW in 60 seconds or less, and operated for at least 60 minutes. Each diesel generator is verified to be aligned to its associated
| |
| . shutdown board.
| |
| : 5. Fuel from the.7-day tank is sampled at least once every 92 days.
| |
| : 6. The following are some of the major inspections and verificatior.s made every 18 months during unit shutdown:
| |
| : a. Each diesel is inspected in accordance with its manufacturer's recommendations.
| |
| : b. Each diesel generator's capability to reject a load greater than or equal to 600 kW while maintaining voltage at 6,900V plus or minus 690 volts and frequency at 60 Hz plus or minus 1.2 Hz is verified.
| |
| : c. Also verified is each diesel generator's capabilit to reject a load of 4,000 kW without tripping while keeping the voltage from exceeding 7,866 voits.
| |
| A.2-51 l-
| |
| | |
| ~
| |
| u, ,
| |
| - .; ]
| |
| 1 Table A.2-10 .
| |
| -CONTROLS,: INDICATORS, AND ALARMS Main Control Room Equipment Parameter' Control / Display Ar.aunciation Breakers 1414, 1418, 1412,- Manual / Auto X 1614, 1416, 1612,1514, 1512- Control X Voltage, Current X
| |
| Start Buses 1A, IB,12A, 2B Fan Failure -
| |
| Transfer X Bus Failure or Undervoltage X Breakers '1634,1224,1222, Manual / Auto X 3,
| |
| g, 1534, 1632,'1214,.1212, 1532, Control 3, 1624, 1124,.1122,'1524, ha 1622, 1114, 1112, 1522
| |
| - 6.9 kV Unit Boards 1A, .1B,1C, Vol tage, . Current X X
| |
| ID, 2A, 2B, 2C, 20 Frequency _
| |
| X Transfer .
| |
| Board Failure or Undervoltage X Breakers 1828, 1826, 1818 Manual / Auto X 1816, 1728, 1726 1718, 1716 Control 6.9 kV Shutdown boa J. *.". A, ' Voltage, Current X IB-B, 2A-A, 28-B Board Failure or Undervoltage - X 480V. Shutdown Boards IAl-A, Voltage, X 1A2-A, 181-B, 182-B Board Failure or Undervoltage X 2Al-A, 2A2-A, 281-B, 2B2-B Undervoltage X 480V Motor Control Centers
| |
| | |
| Table A.2-10 (continued)
| |
| Parameter. Main Control Room Equipment Control / Display Annunciation Diesel Generators Voltage, Current X
| |
| - 1A-A, IB-B, 2A-A, 2B-B . Watts, VARS X 7 Phase Balance X
| |
| $ Reverse Power X Voltage Restrained Overcurrent X Overcurrent X Generator Differential X Loss of Field X Overspeed X Crankcase Pressure X Low Lube Oil Pressure X High Water Jacket Temperature X i
| |
| - -- _ _- .o
| |
| | |
| t
| |
| . Table A.2-11 SEQUOYAH ELECTRIC POWER SYSTEM DIESEL GENERATOR TEST SCHEDULE Number of Failures ig Test Frequency Last 100 Valid Tests 31 At least once per 31 days 2 At least once per 14 days 3 At least once per 7 days
| |
| .>4 At least once per 3 days aCriteria for determining number of failures and number of valid tests shall be in accordance with Regulatory Position C.2.e of Regulatory Guide 1.108,' Revision 1, August 1977, where the last 100 tests are determined on a per nuclear unit basis. For the purposes of this test schedule, only valid tests conducted after the
| |
| - operating license issuance date shall be included in the computation of the "last 100 valid tests". Entry into this test schedule snall be made at the 31-day test frequency. .
| |
| A.2-54
| |
| : d. A loss of offsite power n, simulated and deenergization of the shutdown boards and load shedding from the shutdown boards are verified, as well as the capability of each diesel to start on the " auto , start" signal.
| |
| : e. A test similar to the loss of offsite power simulator is performed using an ESF test signal (without loss of offsite power), and then another test is made using an ESF test signal in conjunction with a loss of offsite power simulation.
| |
| : f. Each diesel generator is verified to operate for at least i 24 hours.
| |
| : g. Al o verified are each diesel's capabilities to synchronize 5 the offsite power while the generator is loaded with its rgency loads upon a simulated restoration of offsite power j to transfer its loads to the offsite power source before ing shut down.
| |
| : h. A simulated safety injection signal is verified to override the test model by returning the diesel generator.to standby operation and automatically energizing the emergency loads with offsite power. For this procedure, the diesel generator is operated in a test node (connected to its bus).
| |
| : i. The automatic load sequence timers are verified to be operable within plus or minus 5% of their design setpoints.
| |
| A.2.2.7 Maintanance Requirements. Routine preventive maintenance performed on components of the electric power system, with the exception of the diesel generators, is generally scheduled for cold shutdown periods during which the electrical load is reduced and the technical specifications inoperability time
| |
| ' limitations are relaxed. These regularly scheduled preventive maintenance actions are included in Section A.2.2.6. Repairs of components made during unit operating periods must conform to the applicable technical specifications syster.;
| |
| operability criteria or the unit must be shut down until the failed components are returned to service. Most maintenance performed on individual 6.9 kV and 480V switchgear circuit breakers is done with the breaker removed from its cubicle. _During these periods, a spare breaker is normally installed and the associated buswork remains energized. Maintenance on other system components can also generally be performed without affecting the flow of power to the station loads through the use of the manual bus tie interconnections and installed reserve power supplies.
| |
| A.2-55 E
| |
| | |
| A.2.2.8~ Technical' Specifications. The technical specifications allow the following components of the electric power system to be inoperable during power operation:
| |
| e If a Class 1E 6.9 kV or 480V electrical bus becomes unavailable, it must be restored within 8 hours.
| |
| e Either an' offsite circuit or a diesel may be inoperable for 72 hours.
| |
| Both a diesel and an offsite circuit may be inoperable for e
| |
| 12 hours.
| |
| e Both offsite circuits may be inoperable for 24 hours.
| |
| e Both diesel generators may be inoperable for 2 hours.
| |
| In all cases waen a power source becomes inoperative, operability is verified on the remaining sources at a regular interval.
| |
| - Restoration must occur within the above guidelines or the unit is placed in hot standby within 6 hours and in cold shutdown within the following 30 hours.
| |
| A.2.3 System Logic Models A.2.3.1 Success State Output Definitions. The EPS consists of many separate but identical power distribution configurations. Therefore, there are many separate but identical output definitions. The electrical output of interest for both
| |
| . safety and availability is listed in Table A.2-12.
| |
| The success of an output.is defined as power available from a particular board or motor control center.
| |
| A.2.3.1.1 Analysis boundary conditions. The following are the boundary conditions and assumptions for the safety model:
| |
| o The EPS is in a normal operating configuration for both units prior to the initiation of an event sequence.
| |
| e For all initiating events except loss of offsite power, the preferred power source is offsite power to the CSSTs. The standby power sources are the diesel generators.
| |
| e For the loss of offsite power initiating event, the only source of power is the diesel generators.
| |
| A.2-56
| |
| | |
| Table A.2-12 i
| |
| EPS OUTPUT Model Output Safety Availability f
| |
| 6.9 kV Unit Board 1A X 6.9 kV Unit Board IB X 6.9 kV Unit Board 1C X 6.9 kV Unit Board 1D X 480V Unit Board 1A X 480V Unit Board IB X 480V Turbine M0V Board 1A X 480V Turbine MOV Board IB X 480V Turbine MOV Board 1C X 480V Turbine Building Vent Board 1A X 480V Turbine Building Vent Board IB X 6.9 kV Shutdown Board 1A-A X X 6.9 kV Shutdown Board 1B-B X X 6.9 kV Shutdown Board 2A-A X X 6.9 kV Shutdown Board 28-B X X
| |
| -480V Shutdown Board 1Al-A X X 480V Shutdown Board 1A2-A X X 480V Shutdown Board 1B1-B X X 480V Shutduwn Board 282-B X X 480V Containment and Auxiliary X X Building Vent Board 2Al-A 480V Containment and Auxiliary X X Building Vent Board 281-B 480V Reactor MOV Board 1Al-A X X 480V Reactor MOV Board 1A2-A X X 480V Reactor MOV Board 1B1-B X X 480V Reactor M0V Board 1B2-B X X 480V Reactor M0V Board 2A2-A X X 480V Reactor MOV Board 2B2-B X X 480V Reactor Vent Board 1A-A X 480V Reactor Vent Board IB-B X 480V ERCW MCC 1A-A X X 480V ERCW MCC 18-B X X 480V ERCW MCC 2A-A X X 480V ERCW MCC 2B-B X X A.2-57
| |
| | |
| b _ .
| |
| f:
| |
| Table A.2-12 (continued)
| |
| Model Output.
| |
| l.
| |
| F Safety Availability 6.9 kV Cooling Tower Board A X 6.9 kV Cooling Tower Board B X 480V Auxiliary Building X
| |
| . Common Board A 480V. Auxiliary Building X Common Board B 125V DC Battery Board I X X 125V DC Battery Board II X X
| |
| .125V DC Battery Board III X X
| |
| < 125V DC Battery Board IV X X 120V=AC Vital Instrument X X L Power Board 1-I
| |
| . 120V AC Vital Instrument X X Power Board 1-11 120V AC Vital Instrument X X
| |
| -Power Board 1-III 120V AC Vital Instrument X X Power Board 1-IV 250V DC Battery Board I X X
| |
| '250V DC Battery Board II X X 250V DC Turbine Building Board 1 X X 250V DC Turbine Building Board 2 X X 120V AC Preferred Power Board 1 X X A.2-58
| |
| | |
| e Electric power from the diesel auxiliary boards for operation of diesel auxiliaries and air conditioning equipment is available.
| |
| 's ERCW for the chilled water coolers and diesel generators is available.
| |
| e - The 480V power to the I&C system battery chargers is available.
| |
| e Power to the diesel auxiliary boards for operation of the diesel generators is available.
| |
| r
| |
| ! e The final output signals represent power availability on a l
| |
| ' board or bus. The circuit breakers and lines that feed individual loads are not included in this analysis, but are included in the individual system analysis in which they belong.
| |
| o Offsite power is defined as power supplied to the CSSTs.
| |
| e The system is analyzed for a 24-hour period following an initiating event, except for the diesel generators which are analyzed for a 6-hour period.
| |
| e No credit is taken for operator actions to recover failed equipment or to provide power from alternate sources over the period of this analysis. Recovery actions will be analyzed, as necessary, within the context of specific sequences
| |
| . identified in the overall safety model, o The EPS safety analysis is developed for the following three operability states:
| |
| --Offsite Power Available = 1.0
| |
| --Offsite Power Unavailable = 1.0
| |
| --Offsite Power Unavailable = 3.41 x 10-4 The following are the boundary conditions and assumptions for the availability model:
| |
| e All power supply boards and motor control centers necessary '
| |
| to support 100% power production from Unit 1 are modeled.
| |
| e Offsite power is available and defined as power supplied to the CSSTs, main transformer, and CCW transformers.
| |
| e . Credit is taken for all manual actions necessary for switching in all redundant components and alternate paths modeled.
| |
| e Credit is taken for all cooling and ventilation needs associated with the electrical rooms and equipment other than the Class 1E shutdown boards.
| |
| A.2-59 L ,,
| |
| | |
| e 480V power to the I&C system battery chargers is available, e The final output signals represent power availability on a board or bus but do not include the lines and circuit breakers that feed individual loads on that bus.
| |
| A.2.3.1.2 Interface with overall safety model. The EPS provides output to all safety systems included in the plant safety model. Its only dependency is cooling water from the ERCW system for the diesel generators and air conditioning.
| |
| A.2.3.2 G0 Models. The EPS safety analysis and availability analysis each have a separate GO model. The supertypes and the parts of the EPS they represent are listed in Table A.2-13. The signal generators used in the safety and availability GO models are listed in Table A.2-14. The supertypes are connected to form the EPS G0 models for safety and availability, shown in Figures A.2-7 and A.2-8.
| |
| The safety model (Figure A.2-7) is initiated by a type 5 operator which represents offsite power. This operator controls the availability of offsite power and can be set to either on or off. -The output of this operator also controls the availability of the 480V input to the I&C power system battery chargers. This assumes that when offsite power is available, 480V to the battery chargers is available. When offsite power is unavailable, the only sources of power for the 1&C power system are its own batteries. This is conservative because it does not take credit for the ability of the diesel generators to supply 480V power to the I&C power system battery chargers.
| |
| The type 5 offsite power initiator goes to a type 1 operator which contains the probability of offsite power failing during a safety sequence initiated by an event other than loss of of fsite power. The output of this operator goes to CSSTs A, B, and C which go to supertypes 190.
| |
| Supertype 190, shown in Figure A.2-9, represents the 6.9 kV start buses, unit boards, shutdown boards, and 480V ERCW MCCs. There are two supertype 190s, one for each unit. The input to the supertype comes from the CSSTs, diesel generators, air conditioning dependency, and control power dependency. The output are the start buses, the 6.9 kV shutdown boards, and the ERCW MCCs.
| |
| A.2-60
| |
| | |
| I-Table A.2-13 EPS MODEL SUPERTYPES Safety Model Supertype Description 150 125V DC Battery Board 170 125V DC and 120V AC I&C Power System 175 250V DC I&C Power System 180 480V Shutdown Boards and MCCs 190 Start Buses, 6.9 kV Unit and Shutdown Boards 205 480V Containment and Auxiliary Vent Boards 210 Common Boards 230 Board Room Chillers and Air / Conditioning System 240 ERCW to Diesel Generator C-S 250 ERCW to Diesel Generators 1A-A, IB-B, 2A-A, 28-B 260 Diesel Generator Availability Availability Model Supertype Description 150 125V DC Battery Board 170 125V DC and 120V AC IAC Power System 175 250V DC I&C Power System 200 CSSTs and Start Buses 210 Unit 2 Unit Boards and 6.9 V Shutdown Boards 220 Common Boards 230 Unit 1 "B" Train Unit Boards and 6.9 kV Shutdown Boards 235 Unit 1 "A" Train Unit Boards and 6.9 kV Shutdown Boards 240 Cooling Tower Boards 250 Unit 2 480V Shutdown Boards and MCCs 260 Unit 1480V Shutdown Boards and MCCs A.2-61
| |
| +
| |
| | |
| Table A.2-14 ELECTRIC POWER SYSTEM MODEL SIGNAL GENERATORS Safety Model Data Type Kind. Supertype Description Availability Unavailability 5 1 1.0 0 -
| |
| Perfect Initiator 5 116 1.0 0 -
| |
| Offsite Power State 5 65 .999504 4.96-4 170 125V DC Battery Power Supply I 5 66 .999504 4.96-4 170 125V DC Battery Power Supply II 5 67 .999504 4.96-4 170 125V DC Battery Power Supply IV 5 68 .999504 4.96-4 170 125V DC Battery Power Supply III 5 174 .999504 4.96-4 175 250V DC Battery Power Supply I 5 176 .999504 4.96-4 175 250V DC Battery Power Supply II 5 175 190 Diesel Generators Availability g,
| |
| ro 1 Availability Model Data Type Kind Supertype Description Availability Unavailability 5 1 1.0 0 200 Perfect Initiators 5 300 .60 .40 220 Unit 2 Generator Availability 5 65 .999775 2.25-4 170 125V DC Battery Power Supply I 5 66 .999775 2.25-4 170 125V DC Battery Power Supply II 5 67 .999775 2.25-4 170 125V DC Battery Power Supply IV 5 68 .999775 2.25-4 170 125V DC Battery Power Supply III 5 176 .999775 2.25-4 175 250V DC Battery Power Supply I 5 177 .999775 2.25-4 175 250V DC Battery Power Supply II NOTE: Exponential notation is indicated in abbreviated form; i.e., 4.96-4 = 4.96 x 10-4
| |
| | |
| .. . ~. . .
| |
| E E Slink , = =
| |
| h h M471AfD. b' I hh ss / ~
| |
| s
| |
| .: ., m,
| |
| .. m. , i., m. . :--:
| |
| r I"l''e.. . _
| |
| e
| |
| . 1"l"
| |
| .i
| |
| : m. . .. _m . E ~ " " F' o
| |
| * L ,. m. . .
| |
| .m.
| |
| as,-" =%g.
| |
| -;.w
| |
| -m e. ,,
| |
| - ,-;A,,,
| |
| A.3-.
| |
| - . .,,.1,-
| |
| ; g =gy=--. .
| |
| gc,7
| |
| . - m.. -.. ,
| |
| = = = ~ - - -
| |
| -a=~ :- m -m . ,, , ,,. ; -d- -=a= == '"=
| |
| i ,. ,,, i 5 5 4
| |
| 4 I i
| |
| & 4
| |
| ~
| |
| ..-- + s.,.
| |
| , - = d b. a=' s
| |
| ,.'=.a. .a=i-=.=.>.... .i -
| |
| =
| |
| m--i 3,,
| |
| m m ..
| |
| ,3 ,, ,,
| |
| . - , y m
| |
| ,. , , i. i.
| |
| ni = - , =
| |
| . i, u .. = =, =.m If it IP If , if if if if f if
| |
| ! ! ! ! ! s ;! !!!! !! !!! ! !;;! ! ! ! !
| |
| i i i I Iiil 1 i i i ! E i i i I tiiI I i ii af i I I g'g t 1 8 s a a i i i 131s 1IC a !!aA i i ,
| |
| y ! !
| |
| : = ! ! ;
| |
| * g g= a ! ! : : 3 5
| |
| 8 8
| |
| %.. 5. =- s9vi 8 !8 i f+Ff 5! 8e *
| |
| ,1 . - i ee8 e8e i, y e : a = - . - -- - -
| |
| a e Ji
| |
| = ~
| |
| g g e A - -
| |
| I ST m 51,
| |
| = m, I 63 1
| |
| .i-. is.
| |
| aos .ca 7.
| |
| .am u
| |
| mw.no ca.e,r.a.
| |
| 4 as i
| |
| Y k
| |
| i Figure A.2-7. Sequoyah Electric Power System GO Safety Model (Sheet 1 of 2) d i
| |
| | |
| 3 a k ~
| |
| 5o*
| |
| k 3 [ + j k D.G. AVAILA8!Liff 70 30.1A. A
| |
| * OId % El $f
| |
| , 3 m ,=
| |
| x 0... A,mAml1 ,0 ,0. ....
| |
| ~ga 3 w2d g = 8
| |
| ~
| |
| 3d
| |
| . d3 E*. 0.G. AVAILABILiff 70 80. #A. A
| |
| . 2 02
| |
| & g + gk [ 0.G. AVAILAs!Liff 70 80. 25-8
| |
| % 2d E g j S
| |
| ~ga 3 w2d E
| |
| h3 g E b 250v DC funelmt SLOG e0 t 2
| |
| d j = ISOV DC BAfftav 3011 9
| |
| _ g
| |
| ~
| |
| g
| |
| $ En A3 8 5
| |
| 2 V" V
| |
| E E
| |
| - 250V DC fuustht SLOG 801 ow g C E' ga w uo
| |
| *- 3*u j b 250V DC SAfftRY 80. I s,"a N ob
| |
| == 5 % . -O. Inst P0Wtt Ollt PAntL t$
| |
| 0 g 120V AC VifAL INST P0utt to 1.IV y -
| |
| E . en
| |
| ($~. [ f !!SV DC VifAL SAfftti 80 IV *
| |
| [
| |
| A 3
| |
| ~
| |
| g=2 u*
| |
| O. Itly DC VlfAL $Affttf $0 ll!
| |
| a8 S e.70 6.9av $HUTOOWN 00. l A. A
| |
| [ 120V AC VlfAL I41T P0 wit $11 111 g $
| |
| ~_,, R _-35 -
| |
| * W E _
| |
| j e 10 6.9af SMLtf00wn to. #A.A
| |
| ~ "" 2 ~
| |
| $ . O.70 6.$af $NUf 00w4 80,10 8 E.
| |
| l- _3 N
| |
| 3 , g 10V Ac VifAL Inti. P0 wit 801 11 g @ f0 6.taf $MUf 00W4 80. 28 8 g W $ n0. Illy DC VlfAL SAffit? 00 ll U ,2,,$k m-e.12SV DC VlfAL BAffitt 80 I F, 2 g u** E It0V AC VlfAL last. Powtt to 1 1
| |
| > n .
| |
| _ 3 y -.&. &
| |
| 2, ne. Inst Powth Olli PAntt I A l
| |
| A.2-64
| |
| | |
| c-I 4
| |
| 93 Il . .
| |
| IEm " -8 i..*,
| |
| _m
| |
| -- ! = -e w -: ]sj!,ajs;!,
| |
| ~-
| |
| 3 2 e* Q a* -* ' 8d8 g g,,ilje IW 8*
| |
| *- 2 m tw
| |
| - -=
| |
| Iam= -slajaj!!g,;l!
| |
| san 8 !!a
| |
| , . - - ;8 : * "2 6 * -8 t w w u r s 3 w wItz a g y, 5 ass 55ssus53 y e 88 s
| |
| a =s y J .sessammama
| |
| . .. . s
| |
| - 1I
| |
| = au. -a ,_w -n sd se s #
| |
| 5 -- 9 w -e w -m s,,,,'ve,,,,88 .
| |
| m a188sggs "g s- -c"
| |
| <w -m s s
| |
| ::": ii- - p ;>ii _ ,
| |
| W,i g)aisi, sg =
| |
| m -e 5 m -a e
| |
| -- y E$, _,
| |
| , _,5 ggiliggjj.iiigg 2
| |
| II $ 22:202m223t4mm au u g
| |
| B a
| |
| i e
| |
| l g
| |
| i
| |
| * sg m-p a u -o
| |
| - ' ~
| |
| nu -. 2 g
| |
| . 8E -
| |
| u"
| |
| $ w ,, _. m =c I lIwall 5 u ga g c
| |
| $= :: -'3
| |
| ; --33 i :!j :Ijli m-
| |
| = -
| |
| ,, . l ggu
| |
| ,, .s !I - ,. r ou
| |
| [ s -
| |
| ,a n -.
| |
| -- q ,, .
| |
| 13 :
| |
| l .
| |
| 58 tg
| |
| .c i
| |
| =
| |
| ii ma .i
| |
| (
| |
| i!!!!ii!Ilill8as gMS g---.... ==== c .c iI g
| |
| o BE * -s v
| |
| .- i = -c ,, _, @
| |
| t t-5 .-
| |
| s".
| |
| m, a 3
| |
| - -s
| |
| 'f N
| |
| j Il 88 l
| |
| 8
| |
| . . E
| |
| ~
| |
| e
| |
| _i_l . e. et1. i. n. . a 8 A= ,
| |
| 1 n -=
| |
| e 8.gsis.ati sis s
| |
| c
| |
| - i = 1 m -, l*s=ligsll le n i i r E
| |
| * a- - r i?isjvill!j!) 11
| |
| ._ 3 ,,,
| |
| 5 - -= !!!!slifillill yg = -s *
| |
| ,, ( cactseassessam aa A.2 65
| |
| | |
| I E C F%1R SUPPLY SYSTEM 5- 1 IRITIATOR 6
| |
| 125v DC BATTERIE5 125V DC BATTERIES S!rAAL # I & C P0ldt SYSTEM BOARDS 76 120V AC VITAL INST P0hiER 80.1-I 59 60 62 61 77 120V AC VITAL !aST POWER BD. 1-1I 78 120V AC VITAL IMST POWER DIST PANEL I-A 79 125V DC VITAL BATTERY BD. I 6 6 6 6 6 6 6 6 6 6 6 6 63 125V DC v!TAL BATTERY BD. II ll ll ll ll ll ll 64 120V AC VITAL IEST POWER 80. 1-IV
| |
| _~=,,e ~. -~m .. ~ = 65 120V AC VliAL IEST POWER BD. 1-III 22222222 22222222 66 120W AC VITAL 1RST POWER DIST PANEL 2-B 67 125V DC VITAL BATTERY 83. IV
| |
| .> ST IM ST IM 68 125V DC v!TAL BATTERY ED. III 7
| |
| m
| |
| . ~ . o = . ~ .
| |
| 2 2 2 2 ~
| |
| o BD 250V DC BATTERY 83. I
| |
| * 2 2 2 2 2 81 250V DC BATTERY BD. II 82 250V DC TUE814E 8tDG BD. 1 I I I I I I I I I I u 250V oC ruR8 =E stos eD. 2 76 77 73 79 63 64 65 66 67 68 84 250V DC ELEET ComTROL BD CIST PANEL 6 66 6 6 6 IIIIII
| |
| $o e o oo ST 175 8s23:
| |
| ~~~~~
| |
| liIII 80 El 82 83 84 Figure A.2-8 (continued)
| |
| (Sheet 2 of 2)
| |
| | |
| 4 s N, !;, . 15 i, !!1 in !;a-i !:,s i
| |
| ,, I 1.,
| |
| i 3
| |
| * e
| |
| * If f s
| |
| : i. . A ,,
| |
| , i:I :
| |
| 9 ii ! C-a i '
| |
| j 2:I 0?,ii ,
| |
| 0)n.e i
| |
| i :: r e, 5 s. :
| |
| ! i:I 2 $, t i :
| |
| :!l, ]! ,
| |
| (!)t! !I! (0i! ri! i
| |
| . . . . q j
| |
| . . . ~
| |
| /li
| |
| !! s'!! ! ! 's !!
| |
| ,k
| |
| ',s ,
| |
| ,. -=
| |
| 03' c), ,,
| |
| , ::=
| |
| g -
| |
| asll
| |
| :li:lin r se
| |
| : si l 1 0:15. ., is is
| |
| 'b e.
| |
| a el B
| |
| B B A.2 67
| |
| | |
| In Supertype 190, there are two breakers going to each 6.9 kV unit board. The 1-167 operator represents the breaker controlling the normal power supply from the USSTs. The 6-59 breakers represent the offsite power supply from the start buses. Prior to a safety event initiation. power is being supplied by the generator through the USSTs, which are represented by the perfect initiator, 5-1. When the generator trips due to a safety event initiation. the normal supply breakers (1-167) must open and the offsite powr supply breakers (6-59) must close for successful transfer. Hence, we have the AND gate used in the model for this situation. Following the model further, we have an OR gate which represents the configuration of one of two 6.9 kV unit boards supplying power to a 6.9 k/ shutdown board. Immediately following is another OR gate which includes the diesel generator power source. The diesel generator operator sequence starts with diesel generator availability, diesel generator failure (1-62), breaker operation (6-59), and the unit board supply breaker (1-167). The 1-167 operator does not reflect the actus) physical appearance of the configuration, but must be present in order to represent the unit board supply breaker failure to open logic. Then the 6.9 kV shutdown boards are represented with their dependencies.
| |
| Supertypes 210 (Figure A.2-10) represent the common board distribution system.
| |
| The 6.9 kV start buses from Unit 2 are the input and the 480V auxiliary building common boards are the output.
| |
| Supertypes 180 (Figure A.2-11) represent the 480V shutdown boards and sutsequent motor control centers. There are four of these supertypes representing rain A i and train B for each unit. Within each supertype, there are two 480V shutdown boards and the subsequent MCCs normally fed by these boards. The input is powered from the 6.9 kV shutdown boards and the control power dependency. The output is the 480V shutdown boards and reactor MOV boards. The spare 480V ,
| |
| transformer and the alternate power paths from the 480V shutdown boards to the various MCC boards are not modeled here. These alternate configurations are controlled by manual actions and are not included in this analysis.
| |
| Supertypes 205 (Figure A.2-11) represent the containment and auxiliary building vent boards for Unit 2. The input is from the Unit 2 480V shutdown boards.
| |
| The I AC power system is represented by suportypes 170 and 175 (Figures A.2-12 andA.2-13). There are two supertype 170s, one representing 125V DC and 120V AC char}nels I and !!, and the other representing 125V DC and 120V AC channels !!!
| |
| A.2 68
| |
| | |
| l SJitTf E 7 150 Ig pfpjT_5 101 EA!TE87 202 BATTEEY 80223 103 EATIf af ChARCEE 204 1% EATER
| |
| . 3 57 . 1-M E.C- Fil51 y, 88f 8d' 2 1-% l-60 1-57 BLS T ff t L C.
| |
| I" t-g 82E As1R 3 5y W
| |
| 2 C- ygg I-M I-57 Bef As FR 2.C.
| |
| FuSL n.C.
| |
| EstarIR
| |
| ?
| |
| m 5#f aT'FE 205; C ivi;T GUTPUT g.Pf UtPE 2!D 100 44n SnuTDC.4 200 44 7 CG%T &
| |
| B^
| |
| J JD 251-8 AG1 tf%T ED (2Al-A) 2BI-B (2Al-A, IM $!AAT BLS 21 (23) ZX) 4%T A.,4 810 CD9C4 ,e vn
| |
| $3 3;,5 A (3) 3-55 1-55 l-56 5.C. M.C. EL5
| |
| ' E rIR EEE AFIR l-55 1- % I-55 1-63 1-55 1-54 4.C. B;.5 m. C. af M 1. C. ClM EET.
| |
| BAT Af!R EAI AsIt E4
| |
| * SIR 1IMITI%
| |
| ofaC:ta Figure A.2-10. Safety Model Supertypes 150, 205, 210 l
| |
| | |
| i l
| |
| . .. g 2 811 44 lE g1" 1
| |
| *EE W-"
| |
| a .
| |
| 913' *fR "g i
| |
| 3E aa a. Wea.
| |
| .aa wu.
| |
| .~9?
| |
| Si g2"2 4 k" W " M M.2-~
| |
| *22 3. -~
| |
| Qu
| |
| ~ -
| |
| h h "*
| |
| b a $3 a 8
| |
| u - - -
| |
| sa S
| |
| : 5 m
| |
| $ .1 $ .1d -
| |
| A wr s4 a Mw's v e
| |
| 2 x
| |
| sa 0
| |
| - R
| |
| * R w N 4 $N -N 4 Qh , 5 b1.: .e
| |
| * m W
| |
| "d " ' C
| |
| $ uw
| |
| .N a: 9' A A mm , as.
| |
| g A- et e g 6.
| |
| "k E o
| |
| "M b Y
| |
| ! T si 8
| |
| -, ;4 u-8
| |
| # 2
| |
| = ja.X T .1 nw a a3 -- .
| |
| - sa g-D 8
| |
| l l
| |
| A.2-70
| |
| | |
| 5 9
| |
| . L *:
| |
| E
| |
| =' *% da ts -
| |
| W!f f v 8] hs ks] a ds7 Elis 55f8 555 EEE !$h i ; r. I r
| |
| !I I!
| |
| (!2 !
| |
| . ~
| |
| - 1 I I a 3 : I ci
| |
| ~I i 'i Du e v (0 i1 0l (0, a
| |
| m,,
| |
| l
| |
| (. '
| |
| ~
| |
| [_
| |
| ; 3
| |
| .! 2 _
| |
| (! s ''
| |
| f nn~ s _a it_
| |
| 22 (,[e g d "a] ,
| |
| 3[ ~ " "
| |
| !! 4 d
| |
| '' 1' 1 (1 3 3 3 fi c
| |
| [
| |
| / ,
| |
| :: t
| |
| /
| |
| h (I .
| |
| t i r :
| |
| 0 d
| |
| l el b
| |
| A.2-71
| |
| | |
| D i B 85 81 v5 81 El E! El E!
| |
| E R E E c)el 0)el 0)=i 0)el R
| |
| E I 2 C9Dg ,
| |
| >I /
| |
| a . :
| |
| G
| |
| \f,/ 4 OE
| |
| .I -
| |
| /Tt* f:3 II
| |
| \,f/
| |
| .i 3 7
| |
| I y m
| |
| N d
| |
| . . 4
| |
| : ;I a .I 3af sE i
| |
| g
| |
| . a 0)! OD:1 0)i 0)I ;;
| |
| d s 5i E 5N 3E px I H 5 9 3 5 IEEE 5D95 A.2-72
| |
| | |
| and IV. Supertype 175 represents 250V DC channels I ano 11. Tha input to suportype 170 is offsite power and the 125V DC batteries. The output is the 125V DC battery boards,120V AC vital instrument power boards, and 120V AC distribution panel. The input to supertype 175 is offsite power and the 250V DC l batteries. The output is the 250V DC battery boards and turbine building boards. Again, we have not included any spare components or alternate configurations that must be controlled by manual actions.
| |
| l Supertype 230 (Figure A.2-14) represents the air conditioning system dependency.
| |
| Offsite power controls a dependency on the system components to fail to start on demand. The system is in a normally operating state unless offsite power fails; then it is in a shutdown state from which all components must restart upon restoration of power. The offsite power dependency determines whether or,not the failure to start on demand is quantified. The output of the air conditioning system goes to the 6.9 kV shutdown boards for which they provide cooling.
| |
| Supertypes 240 and 250 (Figures A.2-15 and A.2-16) represent the inlet and outlet valving that controls the flow of cooling water to the diesel generators. The output of these supertypes all goes to supertype 260.
| |
| Supertype 260 (Figure A.2-17) generates the output of all five diesel generators. This output is dependent on cooling water and diesel generator availability. Diesel generator availability is controlled by a type 4 operator which is explained in Section A.2.4. The output of the diesel generators all go to the 6.9 kV shutdown boards they supply.
| |
| Figures A.2-18 through A.2-28 represent the supertypes used in the availability model of Figure A.2-8. The configurations represented in these models include redundant equipment, spare capacity, and alternate configurations that may be utilized to improve availability but are not included in the safety analysis.
| |
| All manual actions necessary to support operation of the alternate configurations are assumed available. All of the availability models represent the actual physical configuration more closely than the respective safety model, except supertype 200 (Figure A.2-21).
| |
| Supertype 200 is a situation in which the physical structure of the system does not represent the success logic needed for correct modeling. In this case, the main transformer is only physically connected to the unit station service transformers (USSTs) but is logically a single point failure to the entire A.2-73
| |
| | |
| w, M5
| |
| .o 31
| |
| , . . ..a..r Sin si. .sa.,
| |
| st-
| |
| .u.
| |
| i.=1 .em
| |
| .u = sr . , , , , , ,
| |
| #"" snuface WB . i
| |
| : y. 333 gag .
| |
| ::. V.a.
| |
| .=u.
| |
| C .
| |
| w,
| |
| . wt N. blat N
| |
| w #41t.110 51457
| |
| .. V. W9 u.,: .. m tr.a.on- i 96 Staaf Ob b. 4
| |
| "" .e 26-.
| |
| g ei i
| |
| bist yaa gg g gag f att.i.70
| |
| . . Staaf a s,.,rm .
| |
| A C
| |
| usr=
| |
| t "' *;,,
| |
| : n. - n.i-= cw.= .
| |
| Figure A.2-14. Safety Model Supertype 230 I
| |
| | |
| I 1-180 1-151 1-180 1-180 1-151 I8CW %43At CHECK M40AL MANUAL CHfCK val VE vat VI VAtVE VAtVE VA1VE \poo
| |
| .# 5I 2 1-154 2 2 Olutt 7
| |
| N MUV GINERATOR C-S l- 180 1-151 9 1-180 1-180 1-151 MANUAL CHECK FiANUAL MANUAL CHTCK VAtVE VAL E VAtVE VAtVE VALVE ALL MMUAL VALVES ARE NORMALLY OFEN Figure A.2-15. Safety Model Supertype 240
| |
| | |
| 6 i
| |
| 2 g -
| |
| N wm * !I.3
| |
| $$M ba- .
| |
| MWM w
| |
| * st o c w
| |
| et e e at O
| |
| N - *C N Q-w N
| |
| O to
| |
| - Mw o UU e c v> - wg 5, a i EY
| |
| - wm a x M
| |
| b Q
| |
| J h 2 $$ 8 "w
| |
| %> m 3
| |
| =g a 'd - A [g -
| |
| e V
| |
| O E
| |
| h a
| |
| N O to m
| |
| N k:"c 8
| |
| - s' w ~
| |
| ~
| |
| h2 1 ;)f 4 e
| |
| L 3
| |
| G e
| |
| E k N
| |
| o
| |
| - ww e u>
| |
| - - y O
| |
| E w I "4 1 er i
| |
| c -
| |
| W Y
| |
| J
| |
| *C 1E J
| |
| b A.2-76
| |
| | |
| s 3
| |
| D.G. IA-A 200 D.G AVAILAPILITY
| |
| - TO BOARD 1A A f
| |
| D.G. IB-B mb
| |
| - 10 --
| |
| b 2 201 D.G. AVAILABILITY
| |
| - TO BOARD IB-B ST In?
| |
| 250 0.G. C-$
| |
| 4-175 3 10 >
| |
| 100
| |
| $T 240 D G. PA A m 2E 0.G. AVAILABILITY
| |
| " TO BOARD 2A-A ST 250 0.G. 28 8 m 201 0.G. AVAIL ABI.!TY TO BOARD 28-B ST 250 4-115 D.G. AVAIL A8fLITY STATES 0=AVAILABLE 1* UNAVAILABLE lA-A 18-8 2A- A 28 8 C-5 PROBABILITY * $ TATE O O O O O 8.8/ ALL D.G. AVAIL ABLE O O O O 1 2.24 2 $ PARE UNAVAILABLE I O O O O 2.24-2 1A UNAVAILABLE - $ PARE AVAILABLE 0 1 0 0 0 2.24-2 IB UNAVAILAdLE - SPARE AVAILABLE O O 1 0 0 2.24 2 2A UNAVAILABLE - $ PARE AVAILABLE 0 0 0 1 0 2.24-2 2B LtdAVAILABLE - $ PARE AVAILABLE 1 0 0 0 1 I.56-4 1A UNAVAILABLE . SPARE UNAVAILABLE 0 1 0 ,0 1 1.56 4 IB UNAVAILABLE SPARE UNAVAILABLE
| |
| : 0 0 1 '0 1 1.56 4 2A UNAVAILABLE $ PARE UNAVAILABLE l
| |
| 0 0 0 1 1 1.56 4 28 UNAVAILABLE . $ PARE UNAVAILABLE ST 240 & 250 - EREW $UPPLY TO D.G.
| |
| * 2.24-2 = 2.24 a10-2 0.G.
| |
| * O!ESEL GENERATOR Figure A.2-17. Safety Model Supertype 260 A.2-77
| |
| | |
| T' M .
| |
| E
| |
| ( es se EA eS JO
| |
| $$m GaC 3* bD Ga-uit^
| |
| u---
| |
| .W5-v=-
| |
| .M
| |
| ===~
| |
| .e u---
| |
| .W5-REC 4 R:$2 C"~3- C~ 5- 2 3_2
| |
| --s
| |
| --a- -- -
| |
| ~ N e c .
| |
| R R R R R w -
| |
| 3, $. S. 9 i
| |
| - - m W
| |
| R 9 R 9 E A
| |
| * A ~
| |
| h N N O
| |
| W s u
| |
| , h O %
| |
| . .h. Y. .
| |
| 4 y a 4 -
| |
| Y Z e u h
| |
| a e a q)
| |
| U CL
| |
| . U. . = :3
| |
| -T W5 T U
| |
| E o
| |
| ~
| |
| M R. 9 : .
| |
| =
| |
| A =$ m c)
| |
| - = g o N . g *a C "
| |
| * N 2-R E 22 R R
| |
| , . S- E
| |
| - 3 :;;E D
| |
| @ m N @ W d O M N k
| |
| - n
| |
| . . .O.
| |
| b a to d F e
| |
| g ao g "
| |
| 5 g B - >
| |
| m . 4 e
| |
| 9 - m - *
| |
| *
| |
| * S U S 3 A g4 A g
| |
| ~
| |
| l N.
| |
| GJ L
| |
| r ma :s b$. .O N e'* N W w
| |
| C O
| |
| - N .
| |
| *
| |
| * 2 ; G C
| |
| S A
| |
| I 2 6 3 J Ee 3A A s r.
| |
| wm a =
| |
| W I ~ e 2 , #"
| |
| . 2 2 B. .o * -
| |
| : o. .
| |
| 2 2 2 4 gia g g
| |
| - - 42 33
| |
| ~~
| |
| 35a2" =~
| |
| 2 t-
| |
| ~
| |
| l M s.'e 4 e S
| |
| llt .~
| |
| ER
| |
| -~
| |
| A.2-78
| |
| | |
| 101
| |
| -57 N.C. BREAKER 2
| |
| i 1-57 1-60 N.C. BREAKfR FUSE 204 2 1-70 1-60 1-57 2 B'JS FUSE N.C. BREAKER n
| |
| b 103 1-57 1-60 202 N.C. BREAKER FUSE 1-60 1-57 FUSE N.C. BREAKER 101 SPARE BATTERY CHARGER 107 BATIFRY CilARGFR 103 BATTERY 207 BATIFRY BOARD 704 IN/ERTER Figure A.2-19. Availability Model Supertype 150
| |
| | |
| 200 '
| |
| SA -I ages ate EK IM b b e..so..s.ses 501 o _.
| |
| g
| |
| = b97 v v. 3 1- 1 78
| |
| - SEAKE CD.m S y .4 . d.
| |
| suwn g same
| |
| . a s.si vis e5aus m, ,
| |
| . "g -.
| |
| .s. __g :.
| |
| 'n -
| |
| taff Su a b pb "
| |
| -v Aus k OE IM ME 2
| |
| - n
| |
| .c.. , s., .
| |
| oe A
| |
| -- - -. ... -. I wu;-
| |
| c Mt 2509 .
| |
| SATT SD 3 Figure A.2-20. Availability Model Supertype 175 4
| |
| | |
| 200 M4!n TRMsFOMR 100 N. C.
| |
| sAEAtta 201 s7 ART sus 1A 100 I
| |
| I e5 krtR ff I-54 100 g,c, Cssi A "
| |
| 6-62 sREAKER t 203 srur sus rA 100 V
| |
| START sus 6-59 N.0 2A SRC KIR h
| |
| D cssi :
| |
| 10 53, Mint, h \ & 202 star sus is tot t
| |
| Q 743,,,, - 6-62 a.C.
| |
| START sus Is A 1 sRfAKER V-54 Css 7 C ini N.D.
| |
| 6-59 sREAKtt t 0 V
| |
| 206 START sus 2n p, c, s7A47 34 6-62 2s sREARER 205 UssT 14 vUss7 14 twurs O 206 ussi is 100 2s0V DC TURs eLDG si i 101 isor oc ras strc so. : usst is Figure A.2-21. Availability Model Supertype 200
| |
| | |
| 102 104 00 W UNIT BD.
| |
| 100- 56 1-55 5 2A (28)
| |
| N.C. UNIT BD N.C. XfMR BUS BREAKER 2A BREAKER BREAKER (2D) l-55 O 1-84 103 N. C. N.O. 195 BREAKER BREAKER
| |
| ?
| |
| ? r 1 r i f 101
| |
| [ 201 6.9KV SHUTDOWN BD 2A-A (28-B)
| |
| N.C. UNIT BD N.C. N.C. BUS BREAKER 2B BREAKER BREAKER (2C)
| |
| !!4 PUTS 100 START BUS 2A 101 START BUS 28 102 250V DC TURB BLDG BD. I 103 250V DC TURB BI DG BD. 2 104 250V DC VITAL BATTERY BD. 11 105 125V DC VITAL. BATTERY BD. til Figure A.2-22. Availability Model Supertype 210 e= ---
| |
| =
| |
| | |
| i i v
| |
| 4 I'
| |
| aev fuseler stas CGWOI 09. A off NI TWI OLOS 133 Capet 30 a 9-55 l-43 l-55 l-54 6-M l-55 l-se ",'gj,g, g
| |
| a0 10 3 g egg tagsta CN h 4 a C. 5 C. Gagiata 701 Cus447 eniana see n= =r e simisas to3 e i- 10 I S-d GE EfDs ggg g s CanD.
| |
| M '*
| |
| l 55 l 6[ 1-55 l 58 6- M l-55 l-55 '"""E' I-55 EWW E.C. BRf 4518 E. C.
| |
| Tune SLIIE 3 I eC Sene so
| |
| .M eniae . , ,,fi, N por SUPM.T KC 3
| |
| 345 l-63 l-55 6-M l 70 M
| |
| 43 a C. sem a C. sul sul 581AKER BALMER ,,, gg, gt,g 105 CDM B0 A 3-55 l 63 1-55 l-54 6-M 10 4 6 Out unt? 2 Crseas 30 g u C. - sine u. C. Cunagni tingfing ggs u waATOR SMMES Bat Ast A M ACTOR 2 56 105 480W AUI SLOG CON to e s
| |
| M l-55 9 43 1 55 l-58 6-%
| |
| N) 100 6-59 G C. Um N C. CURef MT Bu5 SMAKER 54 AKf 8 Lintilus GEACTOR 104 LYM IGl STAhl stb 2A 101 START 005 29 to2 U55f tt 10 3 2%0W DC fums GLOG 08. I 104 2509 BC TWS OL DE 80. 2 .
| |
| 105 125W OC VITAL BAlif tf 80. I Figure A.2-23. Availability Model Supertype 220
| |
| | |
| N . C.
| |
| BREAKER KER kKER 104 1r TB NOV 1B 6.9KV 203 480V 205 1-55 1-55 2 h b1-70 200 100 6-59 104 UNIT BD 107 UNIT B0 10 18 N. C. BUS N.C N. O.
| |
| BREAKER BREkKER BREAKER 2 6-56 1-55 1-63 1-55 6-56 1 5B TB VENT IB
| |
| ', bus N . C. XIMR N.C. BU5 CURRENT BREAKER BREAKER LIMITING 201 106 REACTOR 1 1 2 1- 70 -
| |
| N.C.
| |
| BREAKER r
| |
| V-55 N. C.
| |
| V-55 V 3 N. C. BUS 103 g6 59 BREAKER BREAKER
| |
| '? 1-55 Co 106
| |
| # 6.9KV 1-55 105 N.C. N.0.
| |
| UNIT BD BREAKERS 2 7 g IKER 2 6-56 1-55 6-56 "2
| |
| Bus N.C. N. C. 6.9KV 101- 0 59 BREAKER 5 SHUTDOWN BD N.O.
| |
| BREAKER MT5 0UTPUTS 100 5 TART BUS 18 200 TUR8INE BLOG MOV B0.18 101 START BUS 14 201 TUR81NE BLOG VENT BD. IB 102 480V TURBINE BLDG COPNON BD A 202 6.9KV SHUTDOWN BD IB-B 103 USST 18 203 6.9KV UNIT BD.10 104 250V DC TURBINE BtDG BD. 2 204 6.9KV UNIT BO. IC 105 250V DC TUR8thE BtDG BD. I 205 480V UNIT BD 18 106 125V DC VITAL BATTERY BD. I!
| |
| 107 125V DC VITAL BATTERY BD. I f
| |
| Figure A.2-24. Availability Model Supertype 230 1
| |
| l' s
| |
| . [
| |
| .a _ ____- - - _ . - - _ _ _ _ _ - _ _ _ _ _
| |
| | |
| N.C.
| |
| BREAKER EKER N.C. N.0. 1-84 1-55 1-84 BREAKERS qr TB MOV 1A
| |
| .03 205 O 1-55 2 1- 70 200 N . C. N.C- BUS BREAKER 8REAKER 6.9KV 100 6-59 104 UN!T 80 107 480V UN11 1A 801 A N. 0.
| |
| BREAKER 2 6-56 1-55 6-56 1-58 T8 VENT 1A
| |
| > 8US N.t. 106 ATMR N. C. BUS CURRENE
| |
| , j.55 1-55 2 201 BREAKER BREAKER G O 103 N.C. N. C. N.C. 8US
| |
| * 8REAKER l-55 6-59 BREAKER BREAKER 106 T8 MOV IC 6
| |
| 1-55 105 tb 80 BREAKERS ' 2 2 206 N. C. BUS 105 BREAKER 2 6-56 1-55 1-55 6-56 8US N.C. N.C. 6.9KV 101 6-59 BREAKERS SHUTOOWN 80 N. O.
| |
| BREAKER
| |
| ' OUTPUTS 100 START BUS 1A 101 START SUS 18 204 200 TUR8INE BLDG MOV BD. I A 102 480V TURBINE BLOG C090N BD. A 201 TUR8INE 8LDG VENT 80. I A 103 USSI 14 202 6.9KV SHUTDOWN BD. I A- A 104 250V DC TURBINE SLDG B0. I 203 6.9KV UNIT BD.14 105 250V DC TUR8INE 8tDG 80. 2 204 6.9KV UNIT B0.18 106 125V DC V!TAL BATTERV BD. I 205 480V UNIT BD.1A 107 250V DC 8ATTERV BD. I 206 TUR8f 4E BLDG MOV 80.1C
| |
| - Figure A.2-25. Availability Model Supertype 235
| |
| : n. -
| |
| e s
| |
| V 1- 55 1-63 0-5$
| |
| E C. anst a C.
| |
| SNE AKg g 701 SatAKER ,
| |
| CCW C0ty 3%
| |
| 1-41 l- M IM E EC l-ll CCW . CCW 101 Cwees 50 a 101 ctg Two 30
| |
| : v. U 1 179 CCu a
| |
| .v 0. C.
| |
| estante v.C - -
| |
| sat AaER v.SE C.
| |
| ME R
| |
| , >=.
| |
| , aat 03 Cn 100 CCW CCW 102 ctg Tha og 10F CIPMW to B O Vv O Q '
| |
| v .- w ' o s, i i r, Sur1CH v sf MR BUS
| |
| .v.
| |
| n C. e C. gu5 a0 S4 ARER CCu 5 Batatte SatasER
| |
| !?vn 100 914ft feaH5f 0e*ER 10l 2 DC 1.BInt SLE 50 ,1 in ,%vw. .C r i .im . .
| |
| Figure A.2-26. Availability Model Supertype 240
| |
| | |
| 480V SHUTOOWN 204 BD. 2Al-A (281-8)
| |
| REACTOR M)W 2 6-56 1-55 2 200 BD. 2A2-A (282-8)
| |
| N. C. XFMR N.C. .
| |
| I b SUS N.C. N.O. # 5 8US CEEAKER 1 SREAKER 101 BREAKER ' 8REAKER
| |
| )FMR ,
| |
| -59 N.O. BR kKER BRkKER CN.C.
| |
| CXFMR BRE AKE R 1-55 1-55 100 6-59
| |
| - Bi kKER it KER BR kKER Jf 1 f 1f O O O [h [6-56 1-55 O [\ O 201 CONT a AUr et0G BD. 2AI-A (281-8)
| |
| N. C. NIMR N.C. BU5 N.C. N.O. BUS BREAKER BREAKER BREAKER BREAKER 480V SHUTDOWN 202 BD. 2A2-A (282-8) 480V ERCW 203 MCC 1 A- A (18-8)
| |
| N.C. gIMit . N. C. 480V BREAKER BREAKER ERCW 4
| |
| MCC
| |
| _IMPUT S 100 6.9KV SHUTDOWN 80. 2A- A (28 8) 101 125V DC VITAL BATTERY BD. III Figure A.2-27. Availability Model Supertype 250
| |
| | |
| . ~
| |
| . ~.
| |
| >w
| |
| -. a- >w w
| |
| ~-
| |
| $<* E= W" 2. -. =
| |
| +1 as a o<
| |
| m 4' o
| |
| Ea e<
| |
| WT m<
| |
| * o<
| |
| ,- c- -- -- ,- ,-
| |
| Ed Md Md 8d
| |
| *. " .d W W. W. .. 8 "W
| |
| - ~ a *
| |
| * 8
| |
| ~ R R R R R o
| |
| ? $
| |
| o
| |
| ? 8 R*
| |
| - 9 ~
| |
| o D
| |
| ~ N a w M w M @
| |
| w M w W 4 a
| |
| .4 *
| |
| . d. -5 e =
| |
| . d. 5 JL >,
| |
| = E. o. am m. .n. u. m z .= m 9
| |
| : m. -
| |
| - == = -
| |
| .a um 's a
| |
| ag 'g T 43 a
| |
| - s 5w m g g< es es es y o
| |
| a mi a- "O e W O
| |
| # h es .4 2-
| |
| : e. u. m
| |
| = - - = >,
| |
| = m m m.
| |
| w w w 4
| |
| . w .a .* e .. "
| |
| i d. 5 i
| |
| - ==
| |
| "W -T "W
| |
| ==
| |
| 'I
| |
| . == . D JL <a di m.F
| |
| ' to o T $. <
| |
| o.- 3, 9
| |
| to N
| |
| e
| |
| \ @ -
| |
| ~j (~
| |
| L s
| |
| a W
| |
| a W
| |
| a W .o a
| |
| W a
| |
| W .o g
| |
| e . .. . .. .. m ..
| |
| o.
| |
| : o. v.a . o- e. o. m
| |
| =
| |
| o ,
| |
| : o. m a - u. aw #. u. am
| |
| == . m.
| |
| == == ,- ==
| |
| l a
| |
| a m = m
| |
| : m. x m.. =x e r . E -
| |
| 4 : A = ~.
| |
| .o.
| |
| I d s.
| |
| -E g m E .5 w w w o .-
| |
| =
| |
| ~
| |
| # .h e, . .n eh =
| |
| s.e 4 #. u. m . u. 2 .a.
| |
| : o. 2 E. M s
| |
| =
| |
| : o. Mw .* E.
| |
| * - E.
| |
| l
| |
| .I.:.#g E"
| |
| u>
| |
| U. @
| |
| N t.
| |
| l 83
| |
| ! 8 A.2-88
| |
| | |
| system. If the physical configuration were modeled as is, we could have the situation where the main transformer has failed but we still have successful operation of the plant through power supplied by the CSSTs. This is incorrect.
| |
| The 5-1 operator represents offsite power only. The Unit 1 generator is included in the secondary model and is also a single point failure.
| |
| A.2.4 ,Q uantification of System Unavailability The quantification of system unavailability is carried out by applying data to the GO models constructed in Section A.2.3 and obtaining the program results.
| |
| After the G0 models are constructed, the analyst prepares a list of all components used in the G0 model. The analyst then applies failure modes to his list of components according to the component function representation in the GO model. Next, the master data list is consulted to assign failure rates to the failure modes of particular components. The last step is to assign type and kind numbers to the component failure data.
| |
| The results of the safety quantification are shown in Tables A.2-15, A.2-16, A.2-17, and A.2-18. The EPS safety quantification is carried out for three separate offsite power states (Tables A.2-15 and A.2-16). The first two states show the unavailability of the EPS dependent upon availability of offsite power.
| |
| The third state shows the EPS results with probability of loss of offsite power during all other initiating events as equal to 3.41 x 10-4 These results include the I&C power system dependencies.
| |
| Tables A.2-17 and A.2-18 show the results of the I&C power system alone. These results are shown for two states which represent the availability of 480V supply power to the battery chargers.
| |
| The availability analysis results are shown in Table A.2-3 and represent power availability at the board specified.
| |
| The data used in quantifying the safety analysis results and availability analysis results are shown in Tables A.2-19 and A.2-20, respectively.
| |
| A.2.4.1 Hardware Failure Contribution.
| |
| A.2.4.1.1 Active components. The active components that contribute to unavailability are circuit breakers, batteries, water chillers, air handling units, valves, and diesel generators. Of these active components, the A.2-89
| |
| | |
| Table A.2-15 EPS CLASS 1E DISTRIBUTION BOARD UNAVAILABILITIES Offsite Power State Unavailability Bus in 24-Hour Available Unavailable (X = 0) (X = 1.0) Period (X = 3.41-4) 6.9'kV Shutdown Board 4.47-5 1.17-1 8.44-5
| |
| .480V Shutdown Board 8.63-5 1.17-1 1.26-4 480V ERCW MCC 8.63-5 1.17-1 1.26-4 480V RB MOV Board 1.09-4 1.17-1 1.49-4
| |
| '480V Containment and- 1.09-4 1.17-1 1.49-4 Auxiliary Building
| |
| . Vent Board 480V Auxiliary Building 7.81-5 1.00 4.19-4 Common Board
| |
| ' NOTE: Exponential notation is indicated in abbreviated form; i.e., 3.41-4 ='3.41 x 10-4
| |
| ,1 A.2-90 m __
| |
| | |
| 'r"T Table A.2-16 EPS 6.9 kV SHUTDOWil BOARD STATE UNAVAILABILITIES Offsite Power Configuration Unavailability State Available Unavailable in 24-Hour (K'= 0) (K = 1.0) Period (X = 3.41-4)
| |
| TK90 IB-B 2A-A 28-B 3.84-5 8.05-2 3.84-5 1A-A TER[ 2A-A 2B-B 3.84-5 8.05-2 3.84-5
| |
| , IA-A 1B-B 7K!K 2B-B 3.84-5 8.05-2 3.84-5 1A-A 1B-B 2A-A ZElf 3.84-5 8.05-2 3.84-5 Total Probability of Only 1.54-4 3.22-1 1.54-4 One Train Unavailable:
| |
| TXTK TUTE 2A-A 2B-B 1.50-9 1.07-2 1.50-9 1A-A 1B-B 7K90 7EZ[ 1.50-9 1.07-2 1.50-9 1A-A TElf 7K!K 2B-B 1.50-9 1.07-2 1.50-9 TK90 18-B 1A-A 7EE[ 1.50-9 1.07-2 1.50-9 TKaC IB-B YK90 28-B 1.01-6 1.07-2 1.01-6 1A-A IH!F 2A-A 7 Ear 1.01-6 1.07-2 1.01-6 Total Probability of Only 2.02-6 6.42-2 2.02-6 Two Trains Unavailable:
| |
| 1A-A TE E YK K 7BT < 1.0-10 1.42-3 < 1.0-10 TK K 18-B YK K 7B F < 1.0-10 1.42-3 < 1.0-10 IK K IB~lf ?A-A 2BT < 1.0-10 1.42-3 < 1.0-10 IKaC TB T YK K 28-8 < 1.0-10 1.42-3 < 1.0-10 Total Probability of Only <1.0-10 5.68-3 < 1.0-10 Three Trains Unavailable:
| |
| II E TB T 7KaC 7B-T 5.24-6 2.95-4 5.24-6 Total Probability of 1A-A 8.18-5 2.20-1 8.18-5 or 18-B Unavailable:
| |
| Total Probability of 1A-A 5.24-6 1.37-2 5.24-6 and 1B-B Unavailable:
| |
| NOTE: Exponential notation is indicated in abbreviated form; i.e., 3.41-4 = 3.41 x 10-4 A.2-91
| |
| | |
| F. .
| |
| L' l :'
| |
| Table A.2-17 I&C POWER SYSTEM BOARD UNAVAILABILITIES l
| |
| I l 480V Supply Power State l Bus-Available Unavailable 125V DC Vital Battery Board .2.30-5 5.29-4 120V AC Vital Instrument 2.03-5 1.37-3
| |
| -Power Board 120V AC Instrument Power 2.23-4 1.00 l
| |
| Distribution Panel
| |
| ?.50V DC Battery Board 2.30-5 5.29-4 L 250V DC Turbine Building' 2.30 5.29-4 l Board l~
| |
| !' . NOTE: Exponential notation is indicated.in abbreviated form; y 1.e., 2.30-5'= 2.30 x 10-5, I
| |
| L
| |
| ~
| |
| I l
| |
| t .,
| |
| l i-i:
| |
| L l
| |
| i.
| |
| p h
| |
| l- .
| |
| A.2-92 h L
| |
| .%, ..._,ia _v3_.- _ .. ...___,_ _m _ -_ _ ___,, ___._ r
| |
| | |
| Table A.2-18 EPS I&C POWER SYSTEM STATE UNAVAILABILITIES 480V Supply Power State Configuration State Available Unavailable 125V DC Channels T II III IV 2.30 5.15-4 I TT III IV 2.30-5 5.15-4 I II TIT IV 2.30-5 5.15-4 I II III W 2.30-5 5.15-4 Total probability of only 9.20-5 2.06-3 one channel unavailable:
| |
| Total probability of 4.60-5 1.03-3 channels I or II unavailable:
| |
| T TT III IV 5.00-10 2.68-7 I II Tff W 5.00-10 2.68-7 I TT TIT IV 5.00-10 2.68-7 T II III W 5.00-10 2.68-7 T II TIT IV 5.00-10 2.68-7 I TT III W 5.00-10 2.68-7 Total probability of only 3.00-9 1.60-6 two channels unavailable:
| |
| 250V DC Subsystems T II 1.25-5 5.15-4 I IT 1.25-5 5.15-4 T TT 2.00-10 2.68-7 Total probability of only 2.50-5 1.03-3 one channel unavailable:
| |
| T 2 2.02-5 5.15-4 1 F 2.02-5 5.15-4 T Y 4.00-10 2.68-7 Total probability of only 4.04-5 1.03-3 one channel unavailable:
| |
| NOTE: Exponential notation is ipdicated in abbreviated form; i.e., 2.30-5 = 2.30 x 10-3 A.2-93
| |
| | |
| r -- - - -
| |
| Table A.2-19 SAFETY ANALYSIS DATA Failure Rate St od Data Used Type-Kind Component Failure Mode ,
| |
| Transformer (C55T) Failure During Operation 2.85-6/ha 24 6.84-5 1-54 Transformer Failure During Operation 7.91-7/h 24 1.90-5 1-63 (6.9 kV/480V)
| |
| Transfomer Failure During Operation 8.23-6/h 24 1.98-4 1-64 )
| |
| (480V/120V)
| |
| Current Limiting Failure Ouring Operation 7.91-7/h 24 1.90-5 1-58 !
| |
| Reactor Inverter Failure During Operation 3.41-5/h 24 8.18-4 1-69 !
| |
| Bus Failure During Operation 5.06-7/h 24 1.21-5 1-56, 6 70 '
| |
| Battery Charger Failure Curing Operation 3.22-5/h 24 7.73-4 1-61 Fuse Failure During Operation 3.26-7/h 24 7.82-6 1-60 Circuit 8reater Transfer Open/ Closed 2.19-7/h 24 5.26-6 1-55
| |
| (>
| |
| ~
| |
| 480V) During Operation Failure to Open on Demand 7.88-4/d 7.88-4 1-167 Failure to Close on Demand 3.15-3/d 3.15-3 6-59 Circuit Breaker Transfer Open/ Closed 1.13-7/h 24 2.71-6 1 57 (a 480V) During Operation Failure to Open on Demand 8.38-4/d 8.38-4 1 168 Failure to Close on Demand 2.27-4/d 2.27-4 1-173 Diesel Generator Failure During Operation 1.47-2/h 6 8.62 2 1-63b Failure to Start on Demand 2.45-2/d 2.45-2 Battery Failure of Output During 2.25-6/h 24 5.40-5 5-176, 175b Operetton Fa11ure of Output on Demand 4.00-4/d 4.00-4 65,66,67,68 Water Chiller Failure During Operation 9.44-5/h 24 2.27-3 6 169 Failure to Start on Demand 8.07-3/d 8.07-3 1 172 Air Handling Unit Failure During Operation 8.85-6/h 24 2.12-4 6-170 Failure to Start on Demand 7.99-4/d 7.99-4 1-181 Temperature Control Failure During operation 7.82-7/h 24 1.88-5 1-171 Valve Manual Valve Transfer Open/ Shut During 3.36-8/h 384 1.29-5 1 180 Operation Motor-0perated Failure tr. , Demand 4.30-3/d 4.30-3 1-154 Valve Check Valve Failure to Cp - 2.98-4/d 2.98-4 1 151 Demand sh
| |
| * hour; d
| |
| * demand.
| |
| b80th failure modes are added together.
| |
| NOTE: Esponential notation is indicated in abcrc,iated form; i.e., 2.85-6
| |
| * 2.85 a 10-6, A.2-94
| |
| | |
| Table A.2-20 AVAILABILITY ANALYSIS DATA Component Failure Mode' Failure Rate , ," p Unavailability Type-Kind Transformer (CSST) Failure During Operation 2.85-6/ha 453 1.29 1-54 .
| |
| . Transformer Failure During Operation 7.91-7/h 45J 3.58-4 1-63
| |
| [6.9 kV/480V)
| |
| Transformer Failure During Operation 8.23-6/h 100 8.26-4 1-64 (480V/120V)
| |
| Current Limiting Failure During Operation 7.91-7/h 62 4.90-5 .1-58 Reactor
| |
| ~
| |
| Inverter Failure Daring Operation 3.41-5/h 72 2.45-3 1-69 !
| |
| 3 Bus Failure During Operation 5.06-7/h 5 2.53-6 1-70, 6-56 y Battery Charger Failure During Operation 3.22-5/h 72 2.31-3 1-61
| |
| ' $ Fuse Failure During Operation 3.26-7/h 5 '1.63-6 1-60 circuit Breaker Transfer open/ Closed 2.19-7/h 62 1.36-5 6-62, 1-55
| |
| (>
| |
| 480V) During Operation Failure to Open on Demand 7.88-4/d 62 4.66-2 -
| |
| Failure to Close on Demand 3.00-4/d 62 1.83-2 1-84, 6-59 Circuit Breaker Transfer Open/ Closed 1.13-7/h 15 1.70-6 1-57 i
| |
| (< 480V) During Operation Failure to Open on Demand 8.38-4/d 15 1.26-2 -
| |
| J Failure to Close on Demand 2.27-4/d 15 3.39-3 1-97 Battery Failure of Output During 2.?S-6/h 100 2.25-4 5-65, 66, Operation 67, 68, 176, 177 Automatic Switch Failure to Operate 1.00-6/h 8 8.00-6 1-178 Switch Failure to Operate 3.26-7/h 5 1.63-6 1-179 i
| |
| j ah = hour; d = demand.
| |
| NOTE: Exponential notation is indicated in abbreviated fore; f.e., 2.85-6 = 2.85 x 10-6, F
| |
| | |
| circuit breaker failure to close or open on demand and diesel generator failure are the highest contributors to unavailability.
| |
| The diesel generator unavailability is composed of two failure modes: fail to start on demand, and failure during operation. Each of these failure rates is derived from data and analysis of the diesel generator auxiliary systems. The fail to start on demand failure rate includes the failures of the diesel starting system and DC battery. The failure during operation
| |
| ~ failure rate includes the failure of fuel transfer pumps, fuel supplies, and diesel auxiliary power for operation.
| |
| The motor-operated valves fail to open on demand failure mode for the diesel generator cooling water is a high failure rate, but the valves are redundant with cooling water sources so their contribution to unavailability is reduced.
| |
| A.2.4.1.2 Passive components. The passive components consist of transfomers, buses, inverters, fuses, battery chargers, and current limiting reactors. The failure rates for these components are relatively low compared to the failure rates of the active components so their contribution to unavailability is small compared to the active components.
| |
| A.2,.4.2 Test and Inspection Contribution.
| |
| A.2.4.2.1 System unavailability during test and inspection. The two parts of the EPS that are subject to test and inspection are the offsite power sources and onsite power sources (diesel generators). The testing and inspection of the offsite power sources have no impact on the EPS availability. The test and inspection of the diesel generators can be done without affecting their availability because they are operational during the testing and inspection procedures. However, failures during tests and inspections can lead to maintenance unavailability that will be discussed in l Section A.2.4.3.
| |
| A.2.4.2.2 Human error during testing and inspection. Human error contribution that results in unavailability of EPS equipment from testing or inspection is not included in this analysis.
| |
| ii A.2-96 l
| |
| | |
| A.2.4.3 Maintenance Contribution.
| |
| A.2.4.3.1 System unavailability during maintenance. The maintenance unavailability contribution to the EPS is only considered for the diesel generators. Redundant components, alternate paths, and spares all contribute to reducing the maintenance unavailability contribution of all other components.
| |
| I The diesel generator maintenance contribution consists of the following three separate contributors:
| |
| e Testing Failures e Scheduled Maintenance e Unscheduled Maintenance Testing failures are a result of the normal diesel generator operability test that is performed once a month according to the technical specifications surveillance criteria. However, testing records from several operating plants indicate that diesel generators are actually tested much more frequently than this monthly minimum test interval, because they must be run to verify their operability during scheduled and unscheduled maintenance of other safety related systems. Based on this generic plant testing experience, it is assumed for this analysis that there is a 50%
| |
| probability that the diesel generators will each be tested once a month, and there is a 50% probability that the diesel generators will be tested as frequently as once every 2 weeks. The operability test does not directly contribute to diesel generator unavailability because the diesel is running and is loaded onto its bus throughout the test period. There is, however, the possibility that a diesel generator might not start or may malfunction during the test and would have to be removed from service for repair.
| |
| From the analysis of diesel generator failure data, the probability that a diesel generator fails to successfully complete a given test is the sum of its failure to start on demand (mean = 2.14 x 10-2/d) and its failure to operate for the 1-hour testing period (mean = 1.69 x 10-2/h). When this failure data is combined with the testing frequency discussed above, the frequency of diesel generator failures due to testing is calculated to be Mean: 7.98 x 10-5 failure / hour A.2-97
| |
| | |
| The repair times for these failures are assumed to follow the data derived in Section 4 for generic maintenance event duration. The mean repair time distribution from Section 4 (mean = 20.9 hours per event) is conservatively used to characterize repairs of these testing failures. This results in an unavailability of a diesel generator due to failures during regularly scheduled and nonroutine testing of Mean: 1.67 x 10-3 The scheduled maintenance which contributes to unavailability during noncold shutdown conditions is a yearly replacement of the diesel sleeve bearing oil and a yearly cleaning of the diesel generator rotor and stator components.
| |
| Since these preventive maintenance procedures are scheduled annually, it is assumed that they will be performed during unit operating periods. It is believed that the me!!n time necessary to conduct each of these maintenance actions is 3.5 hours.
| |
| Because these maintenance procedures involve different disciplines and are performed on different parts of the diesel. generator, it is conservatively assumed that they will not be scheduled concurrently. The diesel generator unavailability resulting from scheduled preventive maintenance is
| |
| -Mean: 7.98 x 10-4 Diesel generators are also removed from service for unscheduled maintenance to repair minor lube oil leaks, fuel leaks, cooling water leaks, starting air system probicms, etc. Although these conditions may not be severe enough to cause failure of the diesel generator, they fall within the realm ~
| |
| of nuisance problems which could lead to degraded performance. Therefore, diesel generators are removed from service for unscheduled preventive maintenance to remedy these conditions before they become worse. The unavailability of a diesel generator resulting from these unscheduled preventive maintenance events is estimated from the frequency (mean = 2.19 x.10-4 event per hour) and duration (mean = 20.9 hours per event) presented in Section 4. The combination of these two distributions results in an unavailability of Mean: 4.62 x 10-3 A.2-98
| |
| | |
| This result is only applicable if the diesel generator is under a 72-hour limiting condition for operation constraint. If the diesel generator does not fall under this constraint, the mean repair time is 91 hours per event and results in an unavailability of Mean: 1.99 x 10-2 The sum of these three unavailability contributions for a diesel generator not under a 72-hour limiting condition for operation is Mean: 2.24 x 10-2 4
| |
| The sum of these three unavailability contributions for a diesel generator under a 72-hour constraint is Mean: 7.08 x 10-3 Considering the five diesel generators in the EPS design, we assume that they are all equal where maintenance unavailability is concerned. Since only four diesel generators are needed for operation, the failure of ont diesel generator is not under the 72-hour limiting condition for operation constraint and is assigned an unavailability of 2.24 x 10-2, Now if a second diesel generator were to fail while a diesel generator is already unavailable, it would be under a 72-hour constraint and its unavailability would be 7.08 x 10-3 The unavailability contribution due to two diesel generators unavailable would be the unavailability of the first diesel generator to fail (2.24 x 10-2) times the unavailability of the second diesel generator to fail (7.08 x 10-3) which equals 1.56 x 10-4 . With these two unavallabilities calculated, we construct the following state table and assign unavailabilities to each possible state.
| |
| Diesel Generator Unavailability 1A-A IB-B 2A-A 2B-B C-S 1 0 0 0 0 2.24 x 10-2 0 1 0 0 0 2.24 x 10-2 0 0 1 0 0 2.24 x 10-2 A.2-99 s
| |
| | |
| , , _ . - . _ . _ . ..- . ._ _ _ - - - - _ _ . _ _ . . . _ _ _ _ . . _ _ ~ _
| |
| [ Diesel Generator -
| |
| Unavailability 1A-A 18-B 2A-A 28-B C-S 0 0 'O 1 0 2.24 x 10-2 0 0 0 0 1 2.24 x 10-2 1 -0 0 0 1 1.56 x 10-4 0 1 0 0 1 1.56 x 10-4 0 0 1 0 1 1.56 x'10-4
| |
| - 0 0 0 1 1 1.56 x 10-4 0 0 0 0 0 8.87 x 10-1 1 NOTES:
| |
| : 1. 0 = Available.
| |
| : 2. 1 = Unavailable.
| |
| t For the two diesels down for maintenance states, we consider only.the combinations where the spare diesel is down for maintenance before one of the other diesels becomes unavailable due to maintenance. These-combinations are considered and all others are not considered because we assume that maintenance is performed on a rotating basis to prevent the likelihood of two diesel generators being unavailable at the same time.
| |
| Finally, this maintenance unavailability is implemented in supertype 260 by
| |
| . a type 4 operator.
| |
| A.2.4.3.2 Human error. Human error contribution during maintenance is not
| |
| . included in this analysis.
| |
| A.2.4.4 Human Action Contribution. No human action contribution other than testing and maintenance is included in this analysis.
| |
| A.2.4.5 Comon Cause. No common cause contribution is included in this analysis. , ,
| |
| l-
| |
| ~A.2-100
| |
| | |
| A.2.4.6 Offsite Power Contribution. When considering the unavailability of the EPS for initiating events other than loss of offsite power, the possibility that failure could result from a loss of offsite power subsequent to the initiating event must be considered. This could either occur immediately from grid instability induced by a Sequoyah unit trip or at some random time during the event sequence.
| |
| For the possibility of loss of offsite power due to a Sequoyah unit trip generic data were consulted and a frequency developed. A median value of 1 x 10-4 failures per unit trip is assigned for the conditional loss of offsite power. It is believed that this value is conservative for the Sequoyah site. The value of 1 x 10-3 (from WASH-1400) is conservatively assigned as the 95th percentile of an assumed lognormal distribution. From these parameters, a mean value of 2.66 x 10-4 failure per unit trip is assigned for the frequency of losing offsite power due to a Sequoyah unit trip.
| |
| Following initiating events other than loss of offsite power, the EPS is supplied by offsite power. The frequency of failure of offsite power regardless of unit status has been developed for the TVA grid and is determined to be 0.11 failure per site calendar year. Therefore, the frequency of loss of offsite power due to this event is 1.26 x 10-5 per hour. In this analysis, we are assuming a 6-hour study period for the probability of occurrence of this event. It is believed that the first 6 hours of an event sequence are the most significant; after that period, a loss of offsite power would be more tolerable. The unavilability due to this loss of offsite power is 7.53 x 10-5 ,
| |
| The total contribution to the loss of offsite power is determined by the following equation:
| |
| Total Unavailability = 2.66 x 10-4 + 7.53 x 10-5 (1 - 2.66 x 10-4)
| |
| Total Unavailability = 3.41 x 10-4 This value is used for the unavailability of offsite power for initiating events other than loss of offsite power.
| |
| A.2-101
| |
| | |
| A.3 ESSENTIAL RAW COOLING WATER SYSTEM A.3.1 Introduction A.3.1.1 System Definition.
| |
| A.3.1.1.1 Overview. Under normal and emergency conditions, the essential
| |
| ~
| |
| raw cooling water (ERCW) system provides an open-cycle, ultimate heat sink for dissipating the heat from essential plant equipment, room ventilation systems, and the component cooling system (CCS). Plant equipment cooled directly by the ERCW system include the reactor coolant pump (RCP) motor coolers and station air compressors. The ERCW system also provides direct cooling to the diesel generators and the containment spray heat exchangers under emergency conditions. In addition, the ERCW system provides an alternate source of water to the auxiliary feedwater system (AFWS) to remove post-trip residual heat from the core via the secondary cooling system.
| |
| This analysis is based on the current ERCW pumping station design serving both Units 1 and 2. This station draws water from the Chickamauga Reservoir via eight ERCW pumps, two in each of the four station wells. Prior to Unit 2 operation, the ERCW intake was in the CCW pumping station, using auxiliary essential raw cooling water (AERCW) pumps and AERCW cooling towers.
| |
| Sources of information used throughout this analysis of the ERCh system include the Sequoyah Final Safety Analysis Report (FSAR Section 9.2.2),
| |
| Section 3.7.1 of Sequoyah Final Design Report No. 72-200, the Sequoyah ERCW system mechanical flow diagrams (47W845-1 through 47W845-5), mechanical control diagrams (47W610-67-1 through 47W610-67-7), and mechanical logic diagrams (47W611-67-1 through 47W611-67-7). TVA drawing numbers are shown in parentheses. Other sources are Sequo n n Technical Specifications 1 and 2, Sequoyah Abnormal Operating Instruction A01-13, Sequoyah System Operating Instructions S01-67.1.
| |
| A.3.1.1.2 Purpose of analysis. The purpose of this analysis is to quantify the availability of the shared Unit 1/ Unit 2 essential raw cooling water system under normal and accident conditions. GO model methodology is applied in the system availability quantification. For normal operating conditions, an availability G0 model is developel to assess tne probability that the ERCW system (and subsjstems) will be operative (i.e., meeting the j system success criteria) at any time during full power operation. For A.3-1
| |
| | |
| initiating events, a safety GO model is developed to assess the probability that the ERCW system will function within the safety related success cr>:teria during a period of 24 hours following the initiating event. The availability and safety probabilities are dimensionless.
| |
| The ERCW system is analyzed based on the following bounda;y conditions and assumptions (specific boundary conditions are described further in Section A.3.3.1.1):
| |
| e Operator actions or common cause failures are not incl!ided in the analysis quantification.
| |
| e The failures of ERCW piping, relief valves, and manual valves are assumed to be insignificant contributors and are not considered.
| |
| e For initiating events:
| |
| A mission time of 24 hours is assumed.
| |
| - Station blackout (loss of all offsite power) is treated separately (all ERCW pumps stop running).
| |
| - One of each ERCW pump pair is assumed to be runni1g initially for all other initiating events. The other pump is available to start on a safety injection signal.
| |
| e Results are conditional on the availability of support systems such as electric power. All support systems are assumed available with a probability of 1.0 (see other safety and availability models for quantification of the availability of these support systems).
| |
| * Isolation valves of the user components of ERCW are included in the systems analyses of the user components and are not a part of this analysis.
| |
| 1 Separate availabilities are determined for the Unit 1/ Unit 2 shared CCS secondary water supply (heat exchangers A, B, and C), and for each ERCW header supply to other users in Units 1 and 2 (e.g., headers 1A and 1B in l Unit 1 and headers 2A and 2B in Unit 2). Analysis results are to be interpreted as probabilities of ERCW header supply to user components.
| |
| A.3.1.2 Systems Analysis Results.
| |
| A.3.1.2.1 Quantification of conditional failure states. The analysis separately quantifies unavailability during an event response of a single train (both headers) and the overall ERCW system (both trains). Because A.3-2
| |
| | |
| there is a series of isolation valves separating different user supply lines, the analysis also separately quantifies the ERCW supply unavailability to three sets of users.
| |
| : 1. The three CCS heat exchangers.
| |
| : 2. The four diesel generator heat exchangers.
| |
| : 3. All other essential component users.
| |
| Given the availability of electrical power and safety injection signals (one for each train), the overall system unreliability during initiating events, except station blackout, is 1.4 x 10-5 The unreliability of train A during these initiating events is 9.0 x 10-5 while train B unreliability is slightly higher, 9.6 x 10-5, due to additional FCVs in the train B headers. For station blackout, conditional train unreliabilities in the absence of any operator actions are significantly higher at 5.3 x 10-3 due to the failure of the pumps to restart.
| |
| During normal plant operation, the unavailability of the ERCW system with all headers is 1.4 x 10-4 Depending on the availability of components in systems supplied by the ERCW (such as the CCS heat exchangers), ERCW operation with one header failed miy or may not constitute a success state for the integrated plant availability model. The unavailability of both headers in train A and one header in train B is 3.3 x 10-5; the unavailability of both headers in train B and one header in train A is 2.6 x 10-5, A.3.1.2.2 Dominant contributors. For the ERCW safety model, the trash rcck at the ERCW pumping station water intake was found to be a dominant '
| |
| contributor (greater than 99.9%) to system unreliability. This rack is a single failure component of the entire ERCW system as modeled here. For station blackout only, ERCW pump failure is the dominant contributor.
| |
| If the trash rack failure (plugging) is not considered, system unreliability would decrease more than three orders of magnitude for nonblackout events.
| |
| It would then be dominated by combinations of strainer and flow control valve or pump failures occurring in different trains (see Section A.3.4.6 for fault cutsets). It would then become so reliable that failure modes such as piping leaks, neglected in the current model, may enter into consideration (see data section).
| |
| A.3-3
| |
| | |
| i The dominant contributors to ERCW train unreliability after an initiating event are single strainer or FCV failures. Other important contributors are trash rack failure and multiple failures of the ERCW and screenwash pumps.*
| |
| Results of the availability model show that single failure of the trash rack,' a FCV, or a strainer, or double failure of a screenwash and ERCW pumps contribute about equally to the unavailability of the ERCW system with all headers. The FCV and strainer failures are less important to the unavailability function because the ERCW system has header redundancy.
| |
| A.3.2- System Description A.3.2.1 Accident Mitigation Function. The ERCW system supplies Chickamauga
| |
| , reservoir water to various Unit 1 and 2 components or systems to remove component or system heat loads during normal operation and during loss of coolant accident (LOCA) conditions and other transient events.
| |
| The system is required to be available on demand for the following safety features dedicated to mitigating the consequences of accidents but not normally operating:
| |
| e High pressure fire protection system in the ERCW pumping station (alternate supply).
| |
| e Cooling water for diesel generator heat exchangers.
| |
| e Turbine-driven and motor-driven auxiliary feedwater pumps (seismically qualified alternate source of feedwater).
| |
| e Cooling water for containment spray heat exhangers.
| |
| A number of components or systems normally supplied by the ERCW during plant operation must also be supplied during certain transients. These are:
| |
| e Reactor coolant pump motor coolers.
| |
| e Auxiliary control air and station air compressors.
| |
| e Component cooling water emergency makeup surge tank.
| |
| *The screenwash pumps are not required to run continuously for success.
| |
| The model conservatively assumes that continuous operation is required.
| |
| A.3-4
| |
| | |
| 'e CCS heat exchangers (secondary side).
| |
| e Spent fuel pit pump space coolers.
| |
| e Thermal barrier booster pump cooling.
| |
| e Centrifugal charging pump oil cooler.
| |
| e Safety injection pump oil cooler.
| |
| e' Heating, ventilation, and air conditioning (HVAC) equipment.
| |
| e Reactor coolant pump motor air coolers.
| |
| Specific HVAC equipment serviced by the ERCW system during transients includes:
| |
| e Emergency gas treatment room cooler.
| |
| : e. Centrifugal charging pump room cooler.
| |
| ~
| |
| e Boric acid transfer pump and auxiliary feedwater punp space cooler.
| |
| o Safety injection pump room cooler.
| |
| e Containment spray pump room cooler.
| |
| e Residual neat removal pump room cooler.
| |
| e Penetration room cooler.
| |
| ! e Pipe chase cooler.
| |
| e Reciprocal charging pump room cooler.
| |
| 1 e Spent fuel pit pump space cooler.
| |
| e Instrument room water coolers.
| |
| : e. Upper containment ventilation coolers.
| |
| e Lower containment ventilation coolers.
| |
| e Shutdown board room air conditioner water chiller. i e Electric board room air conditioner water chiller.
| |
| e Main control room air conditioner water chiller.
| |
| e Control rod drive ventilation coolers.
| |
| Failure of the ERCW system to function during normal operation and events can impact safety in two ways:
| |
| o Certain rodes of failure during normal operatio, may trigger an initiating event.
| |
| A.3-5
| |
| | |
| e Failure to operate on demand in a safety event sequence may lead to more serious consequences.
| |
| As an example of the first impact, a loss of ERCW flow to the RCP motor coolers would lead to motor overheating and a subsequent transient. An important example of the second impact is the cooling of diesel generators during a loss of offsite power.
| |
| A.3.2.2 Success Criteria. The ERCW G0 model assumes two operating states for dual unit operation:
| |
| a Success. Adequate flow maintained to ERCW headers 1A, 1B, 2A, and 2B.
| |
| e Failure. Ir. sufficient flow to ERCW headers.
| |
| Table A.3-1 summarizes the minimum number of pumps and headers required to be operative within the success criteria for both the safety and availability models.
| |
| A.3.2.2.1 Availability related success criteria. During normal plant operation, the criterion for adequate ERCW pump flow is two out of four pumps operating on both trains (A and B). All three CCS heat exchangers are thereby automatically serviced (see Figure A.3-1) unless failure occurs within one of the dual headers of a train. The impact of such header failures on the CCS heat exchangers is as follows:
| |
| e Header 1A. No impact on the configuration shown in Figure A.3-1.
| |
| e Header 18. Flow to heat exchanger A lost.
| |
| e Header 2A. Flow to heat exchanger B lost, crossfeed from header 1B manually possible.
| |
| e Header 2B. Flow to heat exchanger C lost, crossfeed from header 1A manually possible.
| |
| At least two CCS heat exchangers are serviced by any three ERCW headers.
| |
| Since two operating CCS heat exchangers fulfill the success criterion for the CCS, three out of four ERCW headers operating is thus taken to be a success state. Certain combinations of two headers (1B and 2A or 1B and 2B) also meet the CCS success criterion. Separate header success states are therefore accounted for by the ERCW model.
| |
| A.3-6
| |
| | |
| 4 I
| |
| Table .t. 3-1 ERCW MINIMUM SUCCESS CRITERIA Train A Train B Nu er of Header 1A Header 2A Nu of Header IB Header 2B p
| |
| Y w
| |
| Availability 2 X 2 X 2 2 X Xa 2 b b 2 b b Safety 2. X X 0 0 2 X X aAssumes at least one ERCW discharge valve (FCS-67-151 or FCV-67-152) is open or opened (as assessed in the systems analysis of the CCS).
| |
| bAny combination of three out of four headers. If header 2A or header IB is inoperative, the assumption listed in note a applies.
| |
| | |
| M
| |
| : 1B=. ._.I oa is
| |
| .- -" .g1 .- '.c
| |
| ---l == [4 ,";l=,=.J 1+E.u)g
| |
| .sw w s4 ' o, os M = n. 4 C._ _ evs -.._ .p 3._.. u1 _ _ . . , . . ,= .
| |
| \.c.__.. m . ..lgg,,,,,,,* .l=. _ g
| |
| : i. _ . .m .c .
| |
| qf . =>r . r - .
| |
| 7
| |
| * gL '
| |
| ._ fa ;_. {
| |
| - = *
| |
| * 1. 2 E ."E.
| |
| ,,._ n. ,_ e. @e i/ T~ :/ "" d / ** / -+ ***""**' -- ~ +>-*'"
| |
| 38 # W Ei*'#dY' - 'T W
| |
| l ,s.a I...,ti.se.s 4 .--6.
| |
| />- p,_ "*to
| |
| :/;
| |
| m
| |
| . ie .== _ . = l;m ,,,,, ,,,, 'l . oc ,
| |
| I s
| |
| + .,.,,.,..,,.,,b
| |
| . . < - - a,. '....... .
| |
| on /d e I 1/"- *'
| |
| "O T- T- E a.
| |
| -j==}. --.
| |
| Q,_'ThL </.,~
| |
| M._ :-}_
| |
| _._ . . _ . _ . _ . 4 C.__ _ _ _ _ _
| |
| IN Figure A.3-1. Schematic Diagram of ERCW System
| |
| | |
| A.3.2.2.2 Safety related success criteria. Adequate ERCW flow following an initiating event is def,;1ed as the output of at least two operating ERCW pumps (22,000 gpm) on ef ther train A or B.
| |
| 3 The ERCW success criteria can be summarized for operating states as follows:
| |
| System Functiori Success Criteria Provide cooling to es u tial 1. Success. Two pumps on a single componentsfollowingdn train and both headers operating initiating event (one imit (24 hours).
| |
| tripped, the other on act standby). f 2. Failure. Inadequate flow from both ERCW trains.
| |
| Provide cooling during 1. Success. Two pumps operating on normal operation. both trains. Three out of four headers except for certain combinations with CCS heat exchangers.
| |
| : 2. Failure. Inadequate flow from both ERCW trains.
| |
| Loss of offsite power. 1. Success. Two pumps on both ERCW trains.
| |
| I
| |
| : 2. Failure. Inadequate flow from either train.
| |
| The minimum pump success criterion for an initiating event impacts the CCS heat exchanger supply in a variable fashion. If the two ERCW pumps are on train B, CCS heat exchangers A and C are automatically serviced (the latter Case assumes that the heat exchanger C discharge valves are open, or opened, as accessed in the analysis of the CCS). If the two ERCW pumps are on train A, only CCS heat exchanger B is automatically serviced except when train B electric power is lost, in which case the tieline to heat exchanger A is automatically opened. This crosstie can also be manually performed or alternate flow to heat exchanger C (open 1-FCV-67-147 and close 2-FCV-67-147) can be manually provided. The crosstie to heat exchanger A entails opening 1-FCV-67-223 and 2-FCV-67-223 and closing header 1B valve 1-FCV-67-424 to prevent backflow into train B.
| |
| In all cases, adequate flow is provided from one of the ERCW train headers to the single required CCS heat exchanger. However, to meet the diesel generator supply and other user demands, both headers are required for ERCW A.3-9
| |
| : w. .
| |
| ,A
| |
| - ' 1 3
| |
| success. Note that backup supply to diesel generators and other users are
| |
| .also thereby provided.
| |
| I.3.2.3 Configuration. The ERCW system is an open-loop system, which draws water from the Chickamauga reservoir, filters and supplies this raw water to various essential plant components; and returns it to the condenser circulating l[ - water (CCW) cold water channel. A schematic flow diagram of the ERCW design is i' pre'sented in Figure A.3-1 and the system is described in the following sections.
| |
| L A.3.1.3.1 Major components. Figure A.3-2 shows a schematic of the ERCW
| |
| ! pumping station. The water enters the pumping station through a trash rack.
| |
| below the minimum water level of the reservoir. It then passes through four sets of motor-driven traveling water screens. Four screen wash pumps wash the debris from the screens and into a trash slutce leading back to the reservoir. Each set of traveling screens and screen wash pumps is powered I ' from a separate 480V motor control center.
| |
| The eight ERCW system pumps shown in Figure A.3-1 draw suction from the screened reservoir water. These pumps are protected from the maximum flood
| |
| : levels as shown in Fi5ure A.3-2. Each pair of pumps is powered from a separate 6,900V shutdown board.
| |
| Figure A.3-1 depicts th'e ERCW pump redundancy. There are two trains (A and B) of four pumps each to supply both units. Each train has two water inlet paths, each through a traveling screen. The train output flow splits into two headers, one for each unit. Flow crossover is provided downstream of the pumps, to the headers. Check valves are provided at the outlet of each ERCW pump.
| |
| Each header downstream of the pump has an automatic backwashing strainer to
| |
| . filter the water. Each of the four strainers is powered from a separate 480V motor control center. Downstream of the strainers, there is a seasonal.
| |
| chemical treatment with sodium hypochlorite to inhibit clam infestation.
| |
| Downstream of the strainer in each header is a supply line to the diesel
| |
| . generator heat exchangers. Figure A.3-3 shows the interface of the ERCW supply headers with the diesel heat exchanger isolation valves. Valves (1FCV-67-66, 2FCV-67-66, IFCV-67-72, IFCV-67-67, and 2FCV-67-67) open automatically when their respective diesel generator starts. These valves A.3-10
| |
| _ _ _ _ _ _ _ _ _ _ _ . l
| |
| | |
| ,.2 3
| |
| ss ,g' are located on ERCW headers 1A and 1B. The alternate supplies from headers 2A and 2B require manual recovery actions (controlled by valves
| |
| . FCV-67-67 and FCV-67-68 of both units) which are not modeled here- The alternate supply lines are identified only for completeness.
| |
| Two discharge headers ( A and B) return the ERCW system water to the\CCW cold c water channel. Tables A.3-2 and A.3-3 list the ERCW header isulation valves. These are electric motor-operated butterfly valves powered'from this appropriate emergency buses. ' These valves fail in an "as is" position. The valves range in size from 36 to 24 inches.
| |
| m A.3.2.3.2 Supporting systems. The ERCW system is supported by the electric power system (EPS) and the engineered, safeguards features actuation system.
| |
| .The components in the ERCW system are jpowered from Class 1E buses as
| |
| ~
| |
| summarized in Table A.3-2. A safety injection signal initiates operation of the standby ERCW pumps in each pair supplied by each of the 6.9 kV shutdown boards.
| |
| A.3.2.3.3 Interfacing systems. The major systems that interface with ERCW usage are the CCS, the electric power system, and the containment spray heat exchangers.
| |
| s
| |
| ,~
| |
| .A.3.2.4 Operation.
| |
| .A.3.2.4.1 Normal operation. During normal operation, one pump in each of 6 the four pump trains feeding the two distribution headers is normally
| |
| ? running, and the other pump in that pair is in standby. The pumps are powered in pairs by a separate electric bus as indicated in Table A.3-3. In
| |
| ,5 this analysis, it is assumed, for modeling simplicity, that the two running pumps in each distribution header are both powered by. the same electrical supply bus. y m
| |
| M, C
| |
| ~
| |
| As shown in Figure A.3-1, supply headers 1B and 2A are' crosstied to provide
| |
| /
| |
| ERCW flow to CCS heat exchangers A and B. Normal clignment of the system
| |
| , has valve 1-FCV-67-424 open to supply water from header 18 to CCS heat exchanger A. Heat exchanger B is supplied via ERCW header 2A.
| |
| g g
| |
| A.3-11 -
| |
| 7_._.
| |
| | |
| a .u m s
| |
| Table A.3-2 ERCW ISOLATION VALVES-Header Subheader CCS Heat Exchanger Discharge.
| |
| Header Isolation Isolatign Supply Isolation Header Isolation Valves Valves Valves Valves Train A
| |
| ?" 1A 1-FCV-67-492 1-FCV-67-81 1-FCV-67-147 FCV-67-364
| |
| }[ 2A 2-FCV-67-492 2-FCV-67-81 None FCV-67-12 m
| |
| Train B 1B 1-FCV-67-489 . 1-FCV-67-82 1-FCV-67-424b FCV-67-365 28 2-FCV-67-489 2-FCV-67-82 2-FCV-67-147 FCV-67-14 aDownstream of diesel generator supply; isolates all other users, b Additional header 1B isolation is achieved by 1-FCV-67-478 acting together with 1-FCV-67-223 and 2-FCV-67-223.
| |
| | |
| Table A.3-3 ERCW ELECTRICAL DEPENDENCIES Components Electrical Board
| |
| * Traveling Screen and Screen Wash 480V ERCW MCC 1A-A Pump A-A Traveling Screen and Screen Wash 480V ERCW MCC 2A-A Pump D-A Traveling Screen and Screen Wash 480V ERCW MCC IB-B Pump B-B Traveling Screen and Screen Wash 480V ERCW MCC 28-B Pump C-B ERCW Pumps J-A and Q-Aa 6.9 kV SB 1A-A ERCW Pumps K-A and R-Aa 6.9 kV SB 2A-A ERCW Pumps L-B and N-Ba 6.9 kV SB 18-B ERCW Pumps M-B and P-Ba 6.9 kV SB 28-B Strainer A1A-A and Header 1A IVb 480V ERCW MCC 1A-A Strainer A2A-A and Header 2A IVb 480V ERCW MCC 2A-A Strainer BIB-B and Header 1B IVb 480V ERCW MCC 1B-B Strainer B28-B and Header 2B IVb 483V ERCW MCC 2B-B 1-FCV-67-81, 147, 223, 424 480V Reactor MOV 1A2-A 2-FCV-67-81, 147, 223 480V Reactor MOV 2A2-A 1-FCV-67-82 480V Reactor MOV 182-B 2-FCV-67-82 480V Reactor MOV 2B2-B
| |
| , aERCW pumps are paired, as shown with control logic to preclude feeding both pumps from a single diesel generator.
| |
| blV = ! solation valve: FCV-67-492 and FCV-67-489 for trains A and B, respectively.
| |
| A.3-13
| |
| | |
| 0 t '.
| |
| d
| |
| ( TRAVELING SCREEN f STAT @
| |
| (REMOVE FOR INSTALLATION MISSILE BARRIER ROOF OF STOPLOG)
| |
| / <
| |
| / l /
| |
| $ SCREEN WASH WALL EL 736.0
| |
| 'e ( ERCW PUMP PROBASLE MAXIMUM FLOOD WITH WAVE RUN-UP EL7244 _[ ,,
| |
| DECK EL 720.0
| |
| -m
| |
| - /r- l.' _
| |
| PROSA8LE MAXIMUM FLOOO -- 1 -- I- .- * * *
| |
| * WITH SURGE EL 719.0w-* N . --l 1 I ** t .n om .
| |
| .g gt 7:gg w w I'ia.57. ..
| |
| v
| |
| $ TRASH SLUICE (REMOVA8LE) <
| |
| d ', CABLE TRYX 4 IAC ANEL
| |
| /{
| |
| SECTION FOR REMOVAL OR h l&C PANEL { _
| |
| INSTALLATION OF STOPLOC) \ '- f , )l ELECT 2 STOPLOG STORAGE SLOT
| |
| / j[ W i MCC h
| |
| , /
| |
| F L EL 704.0 ROOMSi STOPLOG
| |
| /'-~_ .
| |
| STRAINER
| |
| .. .i I
| |
| D:
| |
| 888-1 db XFMR i '
| |
| l&C PANEL FOR Pl. ACING STOPLOG IN ,
| |
| 24" f
| |
| " =
| |
| )] s '
| |
| SLOT REMOVE TRAV ELING -
| |
| SCREEN (OR MOTOR HOUSING AND SLUtCE IF g
| |
| h=_ 1*
| |
| / FL EL 688.0 POSSIBLE) h, a ME---- /"[ h -. ~ ,*.
| |
| MAXIMUM NORMALF ,a~n
| |
| * NO l
| |
| . TOP OF PILE WATER E L 683.0 l UNOER PUMPtNG STATION g- g-
| |
| -gugp n M6.0 MINIMUM NORMAL WATER EL 675.0 ,, ,
| |
| LINES ( EL6774 OUPLEX SUMP 12" SCREEN WASH I UMPS l PUMP WE LL STOPLOG SLOT DURING NORMAL OPERATION l STOPLOG TO DE STORED l ,
| |
| IN STORAGE SLOT \ N TREMIE CONCRETE
| |
| ) e 42" ERCW PUMP WE LL t
| |
| I l STEEL L'NEO MINIMUM WATER s i INT AKE EL 635.8 -
| |
| ;ii o a
| |
| \
| |
| _,\
| |
| i
| |
| \ / EL 634.0 E t
| |
| TR ASH RACK o- p ; t" MOLLUSKICIOE ' p FEEO PIPE EL 625.0 FLOW
| |
| @~_.h Y y f .* ,. j
| |
| . . i., s $ . g EL 624.0 G EL 626'4" i
| |
| [dNd EM ~
| |
| | |
| I TI '
| |
| \PERTURE CARD
| |
| <Also Available On Aperture Card
| |
| ( ERCW Pi/MPlNG STATION E^ SSILE BARRIER WALL EL 736.0 E JA ( PB (RA
| |
| !(N8 i vear i i /
| |
| --x ' '
| |
| ~
| |
| i !
| |
| u
| |
| -- -- -- -- -- h, -~ --
| |
| EL 725.0
| |
| ' I I ' !
| |
| DECK EL 720.0 ,_
| |
| \ -
| |
| ,E _
| |
| ll ii
| |
| . rh I
| |
| ~ ' ~ ~
| |
| ,I''
| |
| it ij,' -
| |
| =
| |
| I CABLE T .
| |
| CAL EQUIPMENT l tL EL 704.0 MCC MCC MCC MCC
| |
| \ l I **
| |
| f -
| |
| l
| |
| ' ER(,W ~*
| |
| lROOMB CM K,HARGE PIPE % n l' ROOM i t l
| |
| 24" 24'' 3g TO STRA NER 24 24"
| |
| ~
| |
| DU PMEN ROOMS ,_
| |
| EADER _ k N --
| |
| (2Ay -
| |
| L E L 688.0 _.
| |
| g %ll, . __
| |
| ; :- -. + _ _ =. _ _ p. - _ . _ - _ _ 4 - _. --7_ _., -
| |
| EL 686.0
| |
| / ,
| |
| STRAINER A1 A-A STRAINER B1B B C 24" ERCW STRAINER l i I
| |
| STRAINER A2A-A TREMIE *l.
| |
| d y
| |
| CONCRETE
| |
| * TREMIE l CONCRETE
| |
| '' SElSMIC RESTR AINT l NATURAL SLOPE l
| |
| } ._
| |
| ~ ,
| |
| 42" ERCW STEEL LINE D ll.. ,,-J A ICAU EL 634 0
| |
| - ) '
| |
| } ;[
| |
| \ . 9 .
| |
| L 6M.0 I .
| |
| \ '' 1 -
| |
| -- 1 6 I 1
| |
| ' I .
| |
| q EL825.0 ,
| |
| kt s2i.Or'J *'
| |
| 6 0 6 to 15 SCALE IN FEET Figure A.3-2. ERCW Pumping Station I
| |
| J[ A.3-14 ,
| |
| \
| |
| o
| |
| | |
| iU h i-
| |
| : <> M 1-F CV4748 DG HX 1 A I
| |
| 1-FCV4746
| |
| * FN l
| |
| i
| |
| :< FN 2 -FCV 47 48' s H A Ef4 A \h DG HX 2A
| |
| \
| |
| ,, :xs : '
| |
| 2 FCV4740
| |
| 'W
| |
| [
| |
| 1-FCV47 72 *
| |
| 'W OG HX OA i
| |
| $ .. :5.e
| |
| ) 2-FCV47 73 s
| |
| l
| |
| :ws- : <>W 1 FCV4745 4
| |
| ! 2A
| |
| !\b DG HX 15 l<
| |
| 1-FCV 4747
| |
| , 5
| |
| > FN 2-FCV4747
| |
| * DGHX28
| |
| ' AUTOMATIC OPENINO VALVES !'
| |
| 2-FCV47 65 t
| |
| h
| |
| *NOT INCLUDED IN OUANTATIVE MODEL Figure A.3-3. Diagram of ERCW Header Supply to
| |
| . Diesel Generator Heat Exchangers A.3-15 4
| |
| 4 5
| |
| | |
| CCS heat exchanger C is operated intermittently, when required to supply water to the condensate demineralizer waste evaporator or when required as a
| |
| ' backup to CCS heat exchanger A or B. During these demand uses, CCS heat exchanger C is usually supplied with ERCW from header 2B through open valve 2-FCV-67-147, while the backup supply from header 1A through 1-FCV-67-147 remains closed. It is only necessary to open the (normally closed) discharge header valve (usually FCS-67-152, or alternately FCV-67-151). The operation of these discharge header valves is quantified in the analysis of the CCS; they are shown here for completeness.
| |
| The ERCW supply header isolation valves 1-FCV-67-81 (header 1A),1-FCV-67-82 (header IB), 2-FCV-67-81 (header 2A), and 2-FCV-67-82 (header 2B) are ,
| |
| normally open to supply all of the normal operational loads. Motor-operated FCVs on the ERCW system main supply headers associated with the ERCW system strainers (A1A-A, A2A-A, B18-B, and B2B-B) are all normally open. Al so ,
| |
| discharge header motor-controlled valves FCV-67-364 and FCV-67-12 (train A) and FCV-365 and FCV-14 (train B) are normally all open.
| |
| A.3.2.4.2 Event response. As stated in Section A.3.2.2.2, one train with a minimum of two pumps must be operating for successful event response (safety related success criteria). Both pumps cannot be fed from the same diesel generator during a station blackout. This is accounted for by the ERCW pump controls in the safety model and is important for the plant auxiliary systems model integration (interface between ERCW and diesel generator models).
| |
| A.3.2.4.2.1 Automatic action. Upon undervoltage or loss of offsite power, any operating ERCW system pumps stop. On a safety injection signal, diesel generators (an ERCW system cooling load) will start automatically, and if a blackout signal is present the load is sequenced to the ERCW system pumps for automatic restart 15 seconds after closing of the breaker which connects the diesel generator to the power train.
| |
| Upon receiving a diesel generator start signal, either manually or by an ESFAS safety injection signal, one set of normally closed isolation valves on the ERCW supply to each diesel generator heat exchanger (see Figure A.3-3) is automatically opened. Only those valves supplied by ERCW headers 1A and 1B are opened; the crosstie lines from the other unit headers remain closed.
| |
| A.3-16
| |
| | |
| A number of isolation valves on nonessential users of ERCW are automatically closed, as summarized in Table A.3-4, on a safety injection signal. This conserves ERCW supply to those users essential for the safety of the plant.
| |
| Loss of power from the 6,900V train B shutdown boards, or from the 480V motor control centers (MCC) train B boards will interrupt flow in the ERCW train B headers by halting the train B ERCW pumps or traveling screens. Since header 18 is the normal supply for CCS heat exchanger A (Figure A.3-1), this will affect essential service loads in Unit 1. Control circuitry for 1-FCV-67-223 and 2-FCV-67-223 causes these valves to be driven open while valve 1-FCV-67-424 is automatically closed. Thus, flow is restored to CSS heat exchanger A via ERCW header 2A. ERCW flow to CCS heat exchanger B would be unaffected.
| |
| Loss of corresponding train A power will interrupt flow in the ERCW train A headers. ERCW flow to CCS heat exchanger A would be unaffected. However, heat exchanger A supplies Unit 1 train A loads and is manually isolated on loss of train A power to avoid degrading flow to heat exchanger C, which supplies train B loads for both units. Ordinarily, FCV-67-152 will be cpen and there will be flow to CCS heat exchanger C.
| |
| A.3.2.4.3 Potential for event initiation. The ERCW system failure is not in itself an initiating event, but it can indirectly cause an initiating event such as loss of component cooling or loss of control air.
| |
| A.3.2.5 Controls, Indicators, and Alarms. With offsite power available, each ERCW pump is controlled by a four-position control switch in the control room.
| |
| In " pull-to-lock," the pump will not start automatically. This condition is annunciated at the safeguards panel (ERCW pumps out of service). The other three positions for the control switch are: Start - starts the pump if power is available; Stop - stops the pump; and Neutral. The control switch is spring-returned to neutral from the start and stop positions. In neutral, one pump in each pair will start automatically in response to a safety injection A.3-17
| |
| | |
| .n. - __ . _ _ _ _ _ . _ _ _ _ - _ . . _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| Table A.3-4 AUTOMATIC ACTIONS REGARDING ERCW SYSTEM COMPONENTS Safety Injection Signal Start All Spare ERCW Pumps, Where:
| |
| e Train A Starts Pumps J-A, Q-A, K-A, and R-A e Train B Starts Pumps L-B, N-B, M-B, and P-B Loss of Train B Power e Close ERCW Header 1B Valve 1-FCV-67-424 e Open Valves 1-FCV-67-223 and 2-FCV-67-223 Loss of Train A Power None i
| |
| A.3-18 km.
| |
| | |
| s signal. Note: the local-remote switch must be in the remote position to allow I automatic starting of an ERCW pump and operator control of a pump from the l
| |
| safeguards panel. If any pump local-remote switch is in local, an alarm is
| |
| - annunciated at the safeguards panel (ERCW pumps on local control).
| |
| Instruments for the ERCW system pumps are as follows:
| |
| e Local pressure gauges on pump' discharges.
| |
| $ e Pressure switches on pumps which cause an alarm in the control room if the pressure is less than 50 psig.
| |
| e Pump bearing temperature indication and alarm.
| |
| Various flow elements, temperature sensors, and pressure gauges are installed in the ERCW system to enable operator monitoring from the control room. ERCW header pressure is monitored and low pressure is alarmed in tt.e control room (ERCW header pressure low or ERCW pump auto start). This enables the operator to manually realign the ERCW header supply to the CCS heat exchangers as discussed in Section A.3.2.4.2.2.
| |
| For most ERCW heat loads, sensors are installed to throttle the flow of ERCW in order to obtain the proper temperatures. This flow throttling is outside the scope of the present ERCW system analysis. High temperature alarms are also provided on the components cooled. For the diesel generator heat exchangers, the operators can manually realign the crosstied ERCW supply lines based on readings from these sensors and alarms.
| |
| A.3.2.6 Testing. Inspection, and Surveillance Requirements. The following surveillance instructions apply to the ERCW system:
| |
| e S1-33. ERCW and auxiliary ERCW valves servicing safety related equipment (EPRI-531-DOC-32).
| |
| e SI-45. Essential raw cooling water pumps (EPRI-531-DOC-32).
| |
| e SI-119. ERCW auto actuation from an $1 signal (EPRI-531-000-32).
| |
| 4 Monthly inspections of ERCW valve positions are required by $1-33 in satisfaction of Part 1 of Technical Specification 3.7.4.1. For satisfaction of Part 2 of Technical Specification 3.7.4.1, Part A of SI-45 imposes quarterly tests of the ERCW spare pump start and outlet check valve stroke. Also, S1-119 requires 4
| |
| 1 A.3-19
| |
| | |
| testing of automatic actuation of the pumps every 18 months. Testing itself does not require the placing of any train on standby or out of service except for the latter 18-month test which can be performed during shutdown. Therefore, testing and surveillance requirements do not affect ERCW availability directly.
| |
| Indirectly, testing can theoretically affect ERCW availability by fixing the mean time to detection (MTTD). In practice, this is true only for a few valves, such as normally closed 1-FCV-67-147 and 1-FCV-67-223, or 2-FCV-67-223. (These valves are in the alternate supply lines to the CCS heat exchangers. Other valves would have to be in the wrong position in order for these alternate supply lines to pass flow which would be detected by the operator.) Also, the spare ERCW pumps are routinely rotated to distribute wear, so that any pump inoperability would be detected normally within a month.
| |
| A.3.2.7 Maintenance Requirements. Part B of 51-45 requires post-test maintenance on an ERCW pump if it fails Part A. A review was performed for similar units on pump out of service data. The mean probability of an ERCW pump being out of service for maintenance was determined in the review to be 2.3 x 10-3 If one assumes monthly pump rotation and the failure rate for failure during operation, this probability corresponds, as described below, to an estimated mean time to repair (MTTR) of 80 hours. Thus, the ERCW pump data used in this analysis include the probability of 2.3 x 10-3 that a spare pump is out of service (no repair in 24 hours). This treatment is slightly conservative since it neglects rapid restoration of pumps during an event.
| |
| The HTTR can be estimated from the probability of pump out of service for maintenance by the equation Probability pump in maintenance MfTR =
| |
| Ao + Ad
| |
| * frequency of start Here, An is the pump failure rate during operation, 2.62 x 10-5 hr"I,and A
| |
| q is the value for pump f ilure to start on demand, 2.12 x 10-3/ demand.
| |
| Since the pumps are rotated monthly (roughly), a 1-month startup demand frequency 1 demand 730 hours was assumed.
| |
| A.3-20
| |
| | |
| No special maintenance procedures are required for the other ERCW system components.
| |
| A.3.2.8 Technical Specification Effects. According to Technical Specification 3.7.4.1. both ERCW system trains shall be demonstrated ,
| |
| operable:
| |
| : 1. At least once per 31 days to verify that each valve (manual, power-operated, or automatic) servicing safety related equipment that is not locked, sealed, or otherwise secured in position is in the correct position.
| |
| : 2. At least once per 18 months during shutdown by:
| |
| : a. Verifying that each automatic valve servicing safety related equipment actuates to its correct position on a safety injection test signal,
| |
| : b. Verifying that each ERCW system pump starts automatically on a safety injection test signal.
| |
| If only one ERCW system train is operable, the other must be restored within 72 hours or a plant shutdown must begin. The surveillance requirements imposed to comply with these specifications are described in Section A.3.2.6.
| |
| A.3.3 System Logic Models This section describes the calculational models developed to analyze and quantify the ERCW system using the GO code methodology. The GO model for the ERCW system is developed so that it can be easily integrated with other plant systems to construct overall plant safety and availability models.
| |
| A.3.3.1 Failure State Top Event Definition.
| |
| A.3.3.1.1 Safety model boundary conditions. The following boundary conditions and assumptions are common to the analysis of the ERCW system under most of the scenarios evaluated in the plant event tree models.
| |
| Specific boundary conditions particular to certain exception scenarios (e.g., station blackout) are described in Section A.3.3.1.2.
| |
| : 1. The unit is considered to be at normal power operation prior to the occurrence of an initiating event. For each of the four pairs of ERCW pumps associated with each traveling screen, one is assumed to be operating; the other is in a standby mode. The probability that each standby pump may be out of service for maintenance is accounted for.
| |
| A.3-21
| |
| : 2. The system is assumed to be initially aligned in its normal configuration as indicated in Figures A.3-1 and A.3-2 (all four ERCW headers operable with CCS heat exchanger A operating on ERCW header IB, exchanger B operating on header 2A, and exchanger C operating on header 28).
| |
| : 3. The ERCW system quantification does not include the final supply line isolation valves at the user component location (these values are considered in the analyses for the user components).
| |
| : 4. The following operator actions are identified but not included in the present analysis:
| |
| : a. Manually initiate ERCW pump start (depress pushbutton).
| |
| : b. Manually change the system lineup from the control room, specifically and only for the CCS heat exchanger supply lines.
| |
| S. Any two of the four ERCW pumps in a single train (A or B) are assumed sufficient to respond to an initiating event. A single diesel can only feed one of the paired ERCW pumps which is modeled in the pump control logic.
| |
| : 6. No credit is taken for repair of failed components during the event response.
| |
| : 7. Two operability states are considered (success'and failure) for the following subsystem output:
| |
| : a. Main header supply (1A, 18, 1C, 10 headers).
| |
| : b. Diesel generator heat exchanger supply (to isolation valves).
| |
| : c. CCS heat exchanger supply ( A, B, and C).
| |
| : d. Other user supply in each header.
| |
| : e. ERCW train availability (A and B).
| |
| A.3.3.1.2 Interface with overall safety model. The ERCW system safety model is intended to be integrated into the plant auxiliary systems model.
| |
| The availability of the ERCW system to successfully respond to a variety of initiating events is a conditional input to the successful operation of several main line safety systems in the corresponding event trees.
| |
| The two operability states of the ERCW system (namely, success and failure)
| |
| ' define the availability of the system to support the main line systems.
| |
| Moreover, thi success state is further broken down into identification of A.3-22
| |
| | |
| the success trains or success headers since different (redundant) parts of the main line systems are often serviced by different ERCW trains or headers. A mission time of 24 hours is applied to each of these operability states to provide a bounding analysis of system unavailability for each of the given initiating events.
| |
| The initial condition of four pumps in operation when the initiating event occurs (Section A.3.3.1.1) applies for all events except those involving station blackout (loss of offsite power). Blackout events result in all pumps stopping from lack of AC power. In this case, startup of all pumps on emergency power restoration would be called for which increases the potential pump failure modes. This is considered in the GO medel described in Section A.3.3.2.
| |
| A.3.3.1.3 Availability model boundary conditions. The following boundary conditions and assumptions pertain to the ERCW availability model:
| |
| : 1. Two out of four pumps in each train are required for unrestricted operation. According to Technical Specification 3.7.4.1, up to 72 hours of operation with only one train are allowed.
| |
| : 2. Assumptions 1 through 4 of the ERCW safety model also apply to the availability model.
| |
| : 3. Two operability states (success or failure) are considered for the following subsystem output:
| |
| : a. Main header supply (all four headers).
| |
| : b. CCS heat exchanger supply (A B, and C).
| |
| : c. Other user supply in each header,
| |
| : d. ERCW train availability (A and B).
| |
| A.3.3.1.4 Interface with plant availability model_. The ERCW availability model is intended to be integrated into the plant auxiliary systems availability model. For this purpose, the operability states of ERCW subsystem output which interface with other systems are identified, as described under item 3 of Section A.3.3.1.3.
| |
| A.3.3.2 G0 Model. The ERCW system GO model diagram for the plant availability analysis is presented in Figure A.3-4. Components essential for the availability of the system are represented in the model. The train discharge header isolation A 3-23
| |
| | |
| s i .
| |
| E $
| |
| s sg 5 i
| |
| ' s, .
| |
| i s!
| |
| I I '
| |
| i n i !I i !! ! l A.
| |
| ' -l:j*3 -l: i: -
| |
| Oi! ,
| |
| g X-I l5 !!
| |
| - 5
| |
| !! l' !! -l* $$ s I-*I 1- .la g. ! ! !g I- -l:150 U gg g t- + git-. lug.! gy 1-*2 : r : #
| |
| 5 1-5 l!! -15 !! ls !! la!! 3 a
| |
| , a
| |
| ,8 - is. 8 la 14 ei 11t 6a+15 1l1 han 8 d 8 l I-> +e -l. j -l. j
| |
| : 1. e -1. e 1. e
| |
| . .e 1. e
| |
| .i
| |
| ,,, I- + l. E +l8 l
| |
| *l. I *l. E ' *l. I-
| |
| * 8 I- *l8 I *l.
| |
| e
| |
| +!!12 +lt1: +lt1: *l11: !
| |
| m i .I. j!: e + jj. i- .:. jj, e-..ll:
| |
| 1 - ,
| |
| J. J.
| |
| 'i 1 +11 .
| |
| 4" g j
| |
| ' [* ,!s {
| |
| lNi !!!!!!lll!.!! I !
| |
| A.3-0!
| |
| | |
| valves are shown for convenience at the junction of the train pump's outlet flow just upstream of the header branch points (rather than combine the header outlets into another train junction). Otherwise, the GO model starts with water uptake from the reservoir passing through a coanon trash rack, four sets of traveling screens ano backwash pumps, and two trains each with four merged ERCW pumps.
| |
| Each train flow splits into two headers, one for each unit. Each header has an isolation valve and strainer. Downstream of the dietel generator supply line in each header is another (subheader) isolation valve. Except for header 2A to CCS heat exchanger B, the CCS heat exchanger supply lines are isolated by another flow control valve.
| |
| The eight ERCW pumps are analyzed in pairs with each pair corresponding to a traveling screen. For one of the pumps in each pair, the unavailability failure mooe is assumed to be failure during (running) operations. This failure mode is combined with an HTTR of 80 hours. The unavailability of the second pump in each pair is the probability of that pump being out of service for maintenance.
| |
| Figure A.3-5 presents the G0 safety model for the ERCW system. A general control logic for the ERCW pumps is used which acconnodates station blackout as well as other initiating events. For the four pumps normally running, the dependent signals are electric power combined with ( AND gate) no station blackout or a pump start signal (af ter station blackout). For no station blackout, the failure mode is failure to continue running for 24 hours. For station blackout, the failure modes are failure of the pump to start and failure to operate for 24 hours.
| |
| Separate GO operators are used for the dual failure modes.
| |
| For the standby pumps, the dependent signals are:
| |
| o Pump Not Out of Service for liaintenance e Start Signal e Electric Power The pump controls are constrained to disallow two pumps out of service for maintenance in the same train at the same time, per maintenance procedures.
| |
| These signals are combined in an AND gate and are independent of the initiating event. The pump start signal is initiated by a safety injection signal (manual signal also possible). In the GO model, failure of the standby pump outlet check A.3-25
| |
| | |
| . - . - . . - -~ . . . . - .-
| |
| 1
| |
| - q s.
| |
| = - - _ . .
| |
| ~~'
| |
| E::- ::::-*
| |
| h ~
| |
| =__ _ . _
| |
| ~.
| |
| - . = . - - . .
| |
| ~
| |
| = _ .
| |
| g -
| |
| -e-
| |
| .m. .cv.
| |
| I'
| |
| - .. ~ --
| |
| ---- = - _ _ . .
| |
| --~. .~
| |
| j ::" ::
| |
| ;== =_..
| |
| l
| |
| .. g ___..
| |
| e=
| |
| l
| |
| :- :- =
| |
| g_
| |
| = .
| |
| y
| |
| = . . _ _ . .
| |
| . t. = = = = . .
| |
| Figure A.3-5. GO Model for ERCW Safety Analysis (Sheet 1.of 2) e
| |
| - - , , , . , c. -- , , - - - -
| |
| w-, - , , ,a a.- - - - . . < . - - --.-
| |
| | |
| zi. .*s 11..*a I.
| |
| l} ~
| |
| 8 m . .
| |
| t j ,~
| |
| .. glI ,
| |
| ~
| |
| .. .:I !i, i ii e ,,
| |
| , - g. v.
| |
| n 3
| |
| ; EI ' a l:
| |
| 2 1
| |
| I lI i#
| |
| d15kI ! l- f.
| |
| - 1.g 1 i.
| |
| y :, . I
| |
| !!! g.
| |
| .. .2 I . e.!
| |
| eg s18 ga 8t sia
| |
| ))
| |
| *t I. . *e 2l Aj
| |
| . "5
| |
| !! y,',
| |
| V .
| |
| .el. _e.ej e
| |
| ~
| |
| i
| |
| . ii e 3 ii i
| |
| i.g , ,
| |
| , i,
| |
| .' 3 1
| |
| =
| |
| 2
| |
| - i i'
| |
| l a [!= i i il i 211 i, .
| |
| ill i!! .iii i ii . _e.2I i 2 H ,l , '
| |
| i g'.''
| |
| A\ A\ !
| |
| A.3 27
| |
| | |
| valve to open on demand was accounted for in the safety model by appropriate kind data for these valves.
| |
| The_MOV control logic includes an electrical dependency only if a transfer open or closed is required on realignment of the headers to maintain flow to the CCS heat exchangers.
| |
| A list of ERCW system components and their failure modes is given in Table A.3-5. Components such as normally open manual gate or butterfly valves (such as those at the outlet of ERCW pumps) which were deemed to exert a negligible impact on system reliability were excluded from the G0 models. Pipe ruptures were also excluded for the same reason.
| |
| A.3.4 Quantification of System Unavailability Data for the reliability of ERCW system components for the mission time of 24 hours used in the safety model quantification are listed in Table A.3-5.
| |
| Electrical dependencies, reservoir water, and the arrival of train A and B safety injection signals were all assumed to be perfect. The results are, therefore, conditional on these given quantities. The station blackout signal was taken to be one or zero depending on the event ar.alyzed. Operator action signals (pump start or lineup changes to CCS heat exchangers) were not included. The train and system unreliabilities are summarized in Table A.3-6.
| |
| It is found that the failure probability to achieve flow in train A and train B with two or more train pumps operating is 9.0 x 10-5 and 9.6 x 10-5, respectively (no station blackout). Train flow means providing ERCW water up to the isolation valves of the component users. For station blackout, the train unreliability is 5.3 x 10~3 (either train). This higher value is attributable to a lack of ERCW pump redundancy without operator control of the diesel transfer switches and failure to restart mode of the pumps.
| |
| I The overall system (train A or B) unavailability is 4.2 x 10-5 after station bl'ackout and 1.4 x 10-5 for all other initiating events. The latter is due to the trash rack unavailability. The former also includes ERCW pump f ailure in different trains.
| |
| A.3-28
| |
| | |
| .i.
| |
| s Table A.3-5 ERCW SAFETY MODEL COMPONENT FAILURE MODES AND DATA G0 Operator: Failure _g Probability of Component Failure Mode Rate, Hour Failure in Type Kind or Per Demand 24 Hours
| |
| -ERCW pumps Failure to Start on Demand 1 97 2.12 x 10-3/d '2.12 x 10-3
| |
| . Failure to Operate 6 95 2.62 x 10-5/hr 6.3 x 10-4 w for 24 Hours b Failure to Start- 6 89 2.75 x 10-3/d 2.73 x 10-3 and Operate Butterfly Failure to Open/Close 7 253 '.4.3 x 10-3/d 4.3 x 10-3 MOV on Demand Spurious Transfer - 1 91 1.32 x 10-7/hr 3.17 x 10-6 Check Valves Failure to Operate 1 90 6.42 x 10-7/hr 1.54 x 10-5 Check Valves Failure to Operate 1 111- 2.98 x 10-4/d 2.98 x 10-4 on Demand Strainers Failure to Operate 6 92 5.7 x 10-7/hr 1.37 x 10-5 Traveling Plugging 6 88 5.7 x 10-7/hr 1.37 x 10-5 Screen Trash Rack Plugging 1 87 5.7 x 10-7/hr 1.37 x 10-5
| |
| | |
| Table A.3-6 ERCW SAFETY MODEL RESULTS Unavailability G0 M1 Description of Function Output No Station Station Signal Blackout Blackout
| |
| * Diesel Generator Heat Exchanger 1A and 2A Supply 200 6.7 x 10-5 5.3 x 10-3 ;
| |
| Diesel Generator Heat Exchanger 1B and 28 Supply 202 6.7 x 10-5 5.3 x 10-3
| |
| {
| |
| o Header IA Other Users Supply 204 7.0 x 10-5 5.3 x 10-3 Header 2A Other Users Supply 206 7.0 x 10-5 5.3 x 10-3 Header IS Other Users Supply 205 7.0 x 10-5 5.3 x 10-3 Header 2B Other Users Supply 207 7.0 x 10-5 5.3 x 10-3 CCS Heat Exchanger A Supply 208 7.3 x 10-5 5.3 x 10-3 CCS Heat Exchanger B Supply 204 7.0 x 10-5 5.3 x 10-3 CCS Heat Exchanger C Supply 209 7.3 x 10-5 5.3 x 10-3 ERCW Train A 9.0 x 10-5 5.3 x 10-3 ERCW Train B 9.6 x 10-5 5.3 x 10-3 ERCW System (train A or B) 1.4 x 10-5 4.2 x 10-5 l
| |
| | |
| Component data used for the availability model quantification are listed in Table A.3-7. Results are summart:ed in Table A.3-8. The unavailability of the ERCW system with all headers is 1.4 x 10-4 (both trains required). For both train B headers and one train A header, the system unavailability is 2.6 x 10-5 For both train A headers and one train B header, the system unavailability is 3.3 x 10-5 These last cases require consideration of the availability of components of the user systems supplied by the ERCW system in order to determine plant availability.
| |
| A.3.4.1 Hardware Contribution.
| |
| A.3.4.1.1 Active components. The strainers are active compor.ents since they feature an intermittent backwash or flushing cycle to prevent clogging. Strainer failure modes including body leaks due to corrosion as well as plugging contribute largely to the unavailability of each header supply.
| |
| The header and subheader flow control valves play a negligible role in system unavailability since they are passive except in the event of another failure. Because of their redundancy, the active isolation valves on the supply lines to the diesel generator heat exchangers are not significant contributors to diesel generator cooling unavailability.
| |
| Also, the redundancy of the ERCW pumps is sufficient to cause a small pump contribution to system unavailability. This applies for all events except station blackout.
| |
| A.3.4.1.2 Passive components. Data on piping failure rates are sufficiently low that piping water leaks should not measurably affect ERCW system unavailability during an event response. The data referred to consider actual ERCW leaks which have been experienced in past nuclear plant operations. Piping failures are not quantified in the.present analysis.
| |
| The trash rack on the ERCW intake is found to be an important safety model unavailability contributor based on application of the same failure rates as strainers (absence of direct data). While the trash rack is larger with much larger openings, it is not self-cleaning and it sees raw reservoir water. The trash rack numerical importance suggests supplemental A.3-31
| |
| | |
| ~
| |
| :1 Table A.3-7 ERCW AVAILABILITY MODEi. C0ff0NENT FAILURE MODES AND DATA GO Operator 1. Failure l MTTR Unavailability Component Failure Mode Rate Hour Hours (AMTTR)
| |
| Type Kind or Per Demand 2- ERCW Pusos Out of Service for 6 89 -- 80 2.3'x 10-3 w Maintenance g Failure During Operation 6 95 2.62 x 10-5/hr 80 2.1 x 10-3 Screen Pump Failure During Operation 1 86 2.62 x 10-5/hr 80 2.1 x 10-3 Butterfly Spurious Transfer 1 91 1.32 x 10-7/hr 32 4.22 x 10-6 MOY Check Valves Failure to Operate 1 90 6.42 x 10-7/hr 32 2.05 x 10-5 Strainers Failure to Operate 6 92 5 ? x 10-7 9 5.1 x 10-6 Traveling Plugging 6 88 5.7 x 10-7 9 5.1 x 10-6 Screens Trash Rack Plugging 1 87 5.7 x 10-7 30 1.7 x 10-5 1
| |
| | |
| Table A.3-8 ERCW AVAILABILITY MODEL RESULTS G0 Model Description of Function Output Unavailability Signal Header 1A Other Users Supply 200 6.1 x 10-5 Header 2A Other Uscrs Supply 201 6.1 x 10-5
| |
| - Header 1B Other Users Supply 202 6.1 x 10-5 Header 20 Other Users Supply 203 6.1 x 10-5 CCS Heat Exchanger A Supply 204 6.5 x 10-5 CCS Heat Exchanger B Supply 201 6.1 x 10-5 CCS Heat Exchanger C Supply 206 6.5 x 10-5 ERCW System (all headers) 213 1.4 x 10-4 ERCW System (one header train A) 211 5 ERCW System (one header train B) 212 2.6 xx 10-3.3 10 5 A.3-33
| |
| | |
| I 4
| |
| examination of the accuracy of the assumed data and plant specific aspects of the data. During normal plant operation, the trash rack does not appear as important
| |
| -as the results indicate.
| |
| A.3.4.2 Test and Inspection Contribution. None of the tests and inspections summarized in Section A.3.2.6 directly affect ERCW system unavailability since the tests are performed with the system in its normal operating configuration.
| |
| A.3.4.3 Maintenance Contribution.
| |
| A.3.4.3.1 System unavailability during maintenance. The impact of maintenance is reflected on spare ERCW pumps only. A probability that each of these may be out of service for maintenance is accounted for in the quantification. Considering the pump redundancy, maintenance has a small but noticeable (~ 10%) impact on system unavailability in the ERCW safety model but not in the availability model.
| |
| A.3.4.3.2 Human error. An operability test must be performed on any ERCW pump (including its discharge check valve) before it is returned to service af ter maintenance. This test will detect errors of inadequate repair, improper reassembly, valve misalignment, etc. Because of this flow test, the contribution to train unavailability from human errors during or following pump maintenance is negligible compared with the other causes quantified.
| |
| A.3.4.4 Human Action Contribution. Since the ERCW system is required to support normal plant operation, most operator errors that affect system operation will be annunciated or indicated in the control room within a short time after their occurrence. These actions include shifting pump control to local (annunciated in the control room), inadvertently securing a running pump (annunciated and alarmed in the control room), and mispositioning manual valves which control water flow to individual components or groups of components (annunciated or alarmed). i Because of these reasons and becaase the system is required to be in operation to support plant operation, these types of human errors do not contribute to failure to continue running following an initiating event.
| |
| Manual signals identified but not quantified include backup ERCW pump start signals and activation signals for opening crosstie or alternate flow paths to the CCS heat exchangers. The effect of these manual actions was scoped by a A 3-34 ,
| |
| | |
| special G0 model run with the manual signals included and assumed to be perfect.
| |
| CCS heat exchanger A and C supply unavailabilities changed from 7.2 x 10-5 to 1.4 x 10-5 Thus, operator action affects train B user component unavailability by a factor of 5 at the most (train A is unaffected).
| |
| A.3.4.5 Comcn Cause Contribution. Common cause failures which would affect ERCW system unavailability have not been considered.
| |
| A.3.4.6 Analysis Quantification Cause Table. Table A.3-9 presents a summary of ERCW unavailability during an event response, and the key components and causes of the unavailability. The table shows that the trash rack is a single failure component and a dominant unavailability contributor for both train and system failure, important contributors to train unavailability are single FCV or strainer failures or multiple pump failures. Maintenance on ERCW pumps is also significant.
| |
| A fault cutset sumary for ERCW unavailability during normal operation is shown in Table A.3-10. Near equal contributors are trash rack or FCV failures or combined screenwash and ERCW pump failures.
| |
| A.3-35
| |
| | |
| _m~
| |
| m Table A.3 ' 2 FAULT CUTSET Su m ARY FOR ERCW SAFETY MODEL-(System Success = Both Headers in One Train)
| |
| ; e - _
| |
| #. 9 1
| |
| . Probability of
| |
| , Fault Cutsets'- c Failure During -
| |
| 24 Hours o Single Train Failures
| |
| ~
| |
| --Single Failures e Strainers (1/2). 2.8 x 10-S 1
| |
| ? e Discharge header isolation valve (DHIV) 1.8 x 10-5 Y (1/2. or header FCV,1/4 in train A,1/6 in train B). (train A) ;
| |
| M ~ 2.4 x 10-5 (train B) s
| |
| --Double Failures e Screenwash pumps (2/2 in same train). 4.5 x 10-6 e Traveling screens (2/2 in same train). 2.0 x 10-10 e Screenwash p:sp ar2 iraveling screen in other 5.9 x 10-8 flow path (1/2). -
| |
| e Traveling screen or screenwash pamp in one flow path 1.4 x 10-5 and ERCW pump in other.
| |
| --Triple Failures. ERCW pumps (3/4 in same train). 1.2 x 10-8 s
| |
| 9 4
| |
| s
| |
| . _ _ _ _ _ ___m_ -
| |
| | |
| ,[ it;-
| |
| ~
| |
| 4
| |
| : p. <
| |
| 4
| |
| + 5, -
| |
| Table A.3-9 (continued)
| |
| Probability.of-Fault Cutsets Failure During c'4 Hours
| |
| . e ' System Failures 2
| |
| --Single Failures. Trash rack (1/1). 1.37 x 10-5
| |
| --Double Failures e DHIVs or header FCVs (2/14 in different trains). 2.2 x 10-10 o' Strainers in different trains (2/4). 7.8 x 10-10 e Strainer and DHIV or.FCV in other train (2/18). 1.2.x 10-9
| |
| --Triple. Failures. In train A, traveling screens or screenwash pump in one' flow path and ERCW pump.in other; in train B, DHIV or header FCV. 4.5 x 10-10
| |
| *^
| |
| V
| |
| _A.
| |
| | |
| c, A
| |
| 7 Table A.3-10 FAULT CUTSET SU MARY FOR ERCW' VAILABILITY MODEL
| |
| - (Train Failure = System Failure): -
| |
| = ,Q_
| |
| Faul+ Cutsets Unavailability e failure of at Least One Header in Train
| |
| , n
| |
| --Single Failures ,.
| |
| ~'
| |
| e Trash rack (l'/1). ,.
| |
| ~1.7-x 10-5 1.6 x 10-5
| |
| ~
| |
| .a FCV -e-train A (1/4)f
| |
| ~ e Strainer (1/2). - 2.3 x 10-5
| |
| " o Discharge neader isolation valve (1/2).
| |
| 1.0 x 10-5 3
| |
| co
| |
| --Double Failures e Screenwash pump and ERCW pump in other 1.8 x 10-5 flow path (one and 1/2 twice).
| |
| e Screenwash pumps (2/2). 4.4 x 10-6 e Traveling screen and ERCW pump in other 4.5 x 10-8 flow path (one and 1/2 twice).
| |
| e Traveling screen and screenwash pump in other 2.2 x 10-8 flow path (2/2 twice).
| |
| e Traveling screens (2/2). 2.6 x 10-11
| |
| --Triple Failures. Three ERCW pumps (3/4). 4.3 x 10-8
| |
| | |
| e 1
| |
| a t '
| |
| 4 Table A.3-10 (continued) .
| |
| Fault Cutsets Unavailability e Failure or Both Headers in Train
| |
| --As Above, Except for Single Failures 2 and 3 3 --Additional Double Failures L3 2, e FCVs - train'A (One and 1/2 twice). 6.1 x 10-11 e
| |
| e FCVs - train B (One and 1/3 thrice). 1.4 x 10-10
| |
| , e 5 trainers (2/2). 2.6 x.10-11 e Strainer and FCV 'in other header.
| |
| a
| |
| --Train A 8.0 x 10-11
| |
| .1 i
| |
| --Train B 1.2 x 10-10 ,
| |
| 1 w r . - _ - - - -
| |
| | |
| A.4 COMPONENT COOLING SYSTEM A.4.1 Introduction
| |
| 'A.4.1.1 System Definition.
| |
| A 4.1.1.1 Overview. The component cooling system (CCS) is a closed loop, intermediate cooling system which receives heat loads from components exposed to a radiation environment. The heat is transferred to the
| |
| -essential raw cooling water _(ERCW) system. Under normal conditions, it provides cooling to dissipate waste heat from various plant components in
| |
| ~
| |
| both units. In the event of a transient, the CCS is designed to provide cooling to those systems essential to_ the safe shutdown of the unit. At the same time, normal cooling of the nonaccident unit should continue. The systems served by the CCS are:
| |
| e Reactor Coolant System (RCS) e Residual Heat Removal (RHR) System o Chemical and Volume Control System (CVCS) e- Waste Disposal System (WDS) e Sampling System (SS) e Safety Injection System (SIS) e Spent Fuel Pit Cooling System (SFPCS) e Containment Spray (CS) Sys em A.4.1.1.2 Purpose of analysis. The analysis is performed to determine the probability of success of the CCS function during normal plant operation and for the duration of the mission time after an initiating event. G0-methodology is used to develop the CCS model. The success of the systems described in'the previous section depends on these headers. . Ties such as these between interfacing systems are made in the overall plant models.
| |
| A.4.1.2 Analysis Boundary Conditions / Initial Conditions. The CCS is analyzed
| |
| .under the following boundary conditions:
| |
| e Unit 1 is at full power at the time of the initiating event and Unit 2 is carrying all the shared CCS loads.
| |
| A.4-1
| |
| | |
| e Train IA is operating with one pump running and one on standby.
| |
| e Train 1B is in standby.
| |
| e Train 1A CCS pumps and thermal barrier booster pumps are restarted following loss of offsite power.
| |
| e For the CCS safety and availability models quantification, power and actuation signals to the CCS components are assumed available.
| |
| e The system is analyzed to the.first isolation valve of the headers that supply cooling water to the individual loads.
| |
| e Components such as surge tanks and makeup water lines which do not affect the function and availability of the system over long periods of time have been omitted from the model.
| |
| e No operator actions have been considered for recovery after an initiating event.
| |
| o Operator-actions have been considered for realignment of the heat exchangers to keep train 1A operating during normal unit operation. (This action is in accordance with Reference A.4-1.)
| |
| A.4.1.3 Systems- Analysis Results.
| |
| A.4.1.3.1 Quantification of conditional failure states. The analysis quantifies the availability of component cooling water to the following
| |
| -headers after an initiating event:
| |
| 4 e Safety Header 1A e Miscellaneous Equipment Header 1A e Reactor Building Header 1A e Reactor Coolant Pump Thermal Barriers e Safety Header 1B Assuming that actuation signals, power supplies, and essential raw cooling water are available to the CCS, the availability of component cooling water is quantified under the following station conditions; e Normal operation of the CCS continues, o CCS operation with safety injection on Unit 1.
| |
| e CCS operation with loss of offsite power. .
| |
| A.4-2
| |
| | |
| o -CCS operation with loss of offsite power and safety injection on Unit 1.
| |
| e Long term CCS availability on train 1A headers.
| |
| l A.4.1.3.2 Dominant contributors to unavailability. Table A.4-1 summarizes the availability of component cooling water at various Unit 1 headers under different unit conditions. The dominant contribution to the train 1A headers is from pumps required to start on demand (C-S pump on safety I
| |
| injection and all pumps after loss of offsite power). The valves in the train do not add significantly to the unavailability.
| |
| Upon loss of offsite power (LOSP) in conjunction with Unit i safety injection the thermal barrier booster pumps trip and are sequenced to restart 20 seconds after recovery of voltage to the supply board. The 20-second time delay does not apply if the LOSP event is not accompanied by a'' safety injection. Under a Phase B containment isolation signal, these booster pumps are tripped, and the containment isolation valves in these lines are closed. For modeling simplicity, no credit is taken for booster pump restart. Therefore, failure of the seal injection system at this time -
| |
| is assumed to lead directly to a seal LOCA.
| |
| Upon loss of offsite power, pump C-S trips and is designed to automatically restart. Normal valve alignments are indicated in Figure A.3-1. For
| |
| _ modeling convenience in this example, valve FCV-67-152, which is normally open, is assumed to be initially closed. Also, the model takes no credit for the automatic restart capability of pump C-S. Under these modeling assumptions, the dominant contributors to train IB unavailability are:
| |
| o Pump C-S fails to start on demand.
| |
| e Heat exchanger outlet valve FCV-67-152 fails to open on demand.
| |
| A.4-3
| |
| | |
| .m-
| |
| -[1 Table A.4-1 SEQUOYAH UNIT l' CCS '
| |
| Unavailability. of CCS Conditions- Safety Header-Miscellaneous Reactor Building RCP Thermal Safety Header E nt 1A e
| |
| Header Barriers 1B Following Initiating Event Events Requiring 4.46 x 10-5 4.54 x 10 4.62 x'10-5 6.60 x 10-5 1.0*
| |
| 3 Normal CCS Cooling Safety Injection 4.46 x 10-5 4.54 x 10-5 4.62 x 10-5 6.60 x 10-5 7.57 x 10-3 Station Blackout. 8.86 x 10-5 8.94 x 10-5 9.02 x 10-5 4.22 x 10-4 1.0*
| |
| Station Blackout ' 8.86 x 10-5 8.94 x 10-5 9.02 x 10-5 1.0* 1.0*
| |
| with Safety
| |
| . Injection Normal Plant 9.31 x 10-6 1,04 x 10-5 1.15 x 10-5 3.30 x 10-5 Operation
| |
| *These results reflect the modeling assumption of no credit taken for the automatic restart capability of pump C-S.
| |
| _ _ - _ . _ _ __-= .-. _
| |
| | |
| -A.4.2 System Description A.4.2.1 Accident Mitigation Function. The CCS supplies cooling water to the safety related equipment in the unit which is used to bring the reactor to a safe shutdown following an initiating event. The items of equipment supplied are the lubricating oil and mechanical seal coolers for the following pumps:
| |
| e Residual Heat Removal Pumps e Safety Injection Pumps e Centrifugal Charging Pumps e Containment Spray Pumps It also supplies cooling water.to the RHR heat exchangers which are used to achieve and maintain the unit in a hot or cold shutdown condition.
| |
| A.4.2.2 System Success Criteria. The system success criteria are derived from the heat removal requirements for normal operation and accident mitigation. The normal operation success criteria relate to the availability model, while the accident mitigation success criteria relate to the safety model.
| |
| A.4.2.2.1 Availability related success criteria. The CCS provides cooling water to the reactor coolant pump oil coolers and thermal barriers during normal unit operation. Loss of the CCS would result in overheated reactor coolant pump bearings and the reactor coolant pump would trip within 30 minutes. The availability of the CCS therefore affects the availability
| |
| -of the reactor coolant. pump and, thus, of the unit. The other normal cooling loads of the CCS do not impact availability since they can go without cooling water for periods over 24 hours, allowing sufficient time to restore cooling by making repairs or by providing cooling from the standby CCS train, t
| |
| For the purpose of this study, it is assumed that both units are operating at full power with the following CCS configuration:
| |
| i.
| |
| ! e For Unit 1, one CCS pump provides sufficient flow to all loads. Train 1A is supplied by one CCS pump and the second pump is on standby. Train IB is on standby.
| |
| A.4-5
| |
| | |
| e Two CCS pumps provide sufficient flow to Unit 2 which is supplying the spent fuel pit heat exchanger.
| |
| e One CCS heat exchanger is in operation for each unit to reject heat to the ERCW system.
| |
| e One thermal barrier booster pump to provide flow to the Unit 1 RCP thermal barriers.
| |
| A.4.2.2.2 Safety related success criteria. After an initiating event with a safety injection signal, the standby CCS pumps start automatically, providing additional cooling and redundancy. Using the assumption that the Unit 2 CCS carries all the cooling loads common to the two units, success of the CCS requires at least one pump on the affected unit to operate continually for the time required to shut down the unit. Thus the success criteria for safety are:
| |
| e Unit I with one pump and one CCS heat exchanger.
| |
| e Unit 2 with two pumps .ina one CCS heat exchanger.
| |
| For all other initiating events, assuming that standby train IB is not manually started, success of the system requires that train 1A continue to operate with one CCS pump and one CCS heat exchanger.*
| |
| A.4.2.3 System Configuration. The CCS is shared between Units 1 and 2. It consists of five CCS pumps, four booster pumps (two per unit) for the reactor coolant pump (RCP) thermal barriers, three CCS heat exchangers, two surge tanks, a CCS pump seal leakage collection unit, and associated piping, valves, and instrumentation. Normally, the system provides cooling water at a maximum temperature of 95'F. During unit cooldown, the temperature may approach 110*F.
| |
| The entire system is designed for 700*F and 150 psig except the supply and return lines inside the containment for RCP thermal barrier cooling. These are designed j to contain the pressure and temperature of the RCS in case of thermal barrier l tube rupture. Check valves protect the CCS supply line outside the containment from this pressure.
| |
| * Pump C-S is started automatically follwing a less of offsite power. Since this change does not inpact the demonstratica of GO methodology, this information was not accounted for in the logic model used for quantification.
| |
| A.4-6
| |
| | |
| .~
| |
| Each unit is serv d loads and
| |
| ~ domineralizertrain 8 servese by two trains (A a two Unit 1 waste CCS safety loads evaporator. nd B); train Asserve and the aligned trains.
| |
| both units.to train A pumps of eachTwo is a CCS Figure A.4-1 nonsafety r unit, and standbyand simplified one CCS schematicndensate There are pump C-S heat exchanger of the is aligned are generally discharge side several crossties to train 8 of initiating event a onwhich allow ty in flexibiliamong the headers tranferred unit at the CCS to the that is operation pump suction unaffected unit. carrying the and spentand fuel maintenance. After an A.4.2.3.1 pit load, this load i A.4.2.3.1.1 have a CCS pumps.
| |
| M. s capacity of 6,00 The five CCS Class 1E 480V AC power. 0 gpm IB-8, 2A-A at 190 horizontal, centrif fifth pump ,isand 28-B) is Each the feet four of head each.ugal assigned one ofnormally assigned puThe pump m a
| |
| from to either t standby of wo pump and e can b receive achieved manually assigned electric header pressure
| |
| . to either po a ns.alignedthe The four power tr load sequencer Onto The loss train Ay standb pum wer Power trains.
| |
| unit and powered on safety injection channel prevent overloadingof the pumpsautomatically are offsite power, on plowsupply starts tran Pump C-Ss areceiveA, ceives a andreceivespump a B-B reactuation, generators. restartedpump by the A-Athe die actuation for start signal start signal start signalFor each unit either unit. ,
| |
| from both The five pumps ESF channelsfrom on B. ESF channel fro room with theare safety injection space located in the coolers, 1A and 1Bauxiliary pumps. feedwater auxiliary building at air-operated on a signal valves 1 F The from - CV-67-162 room is and 1-FCVThe Elevation 690' a in ERCW supply to (see Figure A 4a temperature these cooled by two ERCW room. . -2). 164 coolers is One of sensor These open controlled by these space which monitors the automatically coolers is A.4.2.3.1.2 sufficientair to temperature pumps per Thermal cool the The booster pumpsunit mps. circulatebarrier booster pu provide thecooling water throughTwo thermal additional the RCP barrier booster head necessary tothermal barriers.
| |
| [ overcome high
| |
| .'_ A.4-7
| |
| ---~~''~
| |
| | |
| Each unit is served by two trains (A and B); train A serves nonsafety and safety loads and train B serves safety loads and the nonsafety related condensate demineralizer waste evaporator. Figure A.4-1 is a simplified schematic of the two Unit 1 CCS trains. Two CCS pumps and one CCS heat exchanger are generally aligned to train A of each unit, and standby pump C-S is aligned to train B of both units.
| |
| There are several crossties among the headers at the CCS pump suction and discharge side which allow flexibility in operation and maintenance. After an initiating event on a unit that is carrying the spent fuel pit load, this load is tranferred to the unaffected unit.
| |
| i A.4.2.3.1 Major components.
| |
| A.4.2.3.1.1 CCS pumps. The five CCS horizontal, centrifugal type pumps have a capacity of 6,000 gpm at 190 feet head each. The pump motors receive Class 1E 480V AC power. Each of the four normally assigned pumps (1A-A, IB-B, 2A-A, and 28-B) is assigned to one of the four power trains. The fifth pump is a standby pump and can be aligned to either unit and powered from either of two assigned electric power trains. Power supply transfer is achieved manually. The train A standby pump starts automatically on low header pressure. On loss of offsite power, the pumps are restarted by the load sequencer to prevent overloading the diesel generators. For each unit, on safety injection actuation, pump A-A receives a start signal from ESF channel A, and pump B-B receives a start signal from ESF channel B.
| |
| Pump C-S receives a start signal from both ESF channels on safety injection actuation for either unit.
| |
| The five pumps are located in the auxiliary building ot Elevation 690' in a room with the auxiliary feedwater pumps. The room is cooled by two ERCW space coolers, 1A and 18. The ERCW supply to these coolers is controlled by air-operated valves 1-FCV-67-162 and 1-FCV-67-164. These open automatically on a signal from a temperature sensor which monitors the air temperature (see Figure A.4-2). One of these space coolers is sufficient to cool the room.
| |
| A.4.2.3.1.2 Thermal barrier booster pumps. Two thermal barrier booster pumps per unit circulate cooling water through the RCP thermal barriers.
| |
| Tne booster pumps provide the additional head necessary to overcome high
| |
| ' '4
| |
| / i 7
| |
| "! A.4-7
| |
| | |
| r .
| |
| s
| |
| ..<. n f.&en .
| |
| 1
| |
| ,, (= g ;,'!,". '"" % ;
| |
| 4,r - J i m.<.
| |
| u ; '*
| |
| * e n a ., a l v m-ma a - AF - - -
| |
| ;' , i ." 1
| |
| . , L _ _ 4 , ,. - u_4 - _, -p ._.. ''a
| |
| * l
| |
| .c. , ,w. --
| |
| . . < . ,,<. o.- * -*+- =**,o.
| |
| 7 _ 4,,_ _
| |
| .,. +. ,
| |
| 1 7 y ,,
| |
| w rm y
| |
| -s. . 3 ,1_ . o. ,g**, *~ ;
| |
| <-s 2,
| |
| o, 1.A.,.4...,,
| |
| m l I
| |
| ,_.p_ 'I T
| |
| . . F l r <. : .s 2 -
| |
| ~ * -- -H , j (;w ,'g,
| |
| _ _ _ _ _ 2
| |
| '* s=,; ,,,, .
| |
| <, - fWI
| |
| :: ' : 4: *w ,
| |
| e- i'
| |
| .. - I r - 4
| |
| *s ,
| |
| . r
| |
| -s.r-
| |
| _-_-~
| |
| t .( A
| |
| -+
| |
| -+
| |
| 1,. m, ag -
| |
| Y.44 NB
| |
| . , , , 0,,,<.
| |
| 8' 4
| |
| , o,
| |
| * T o,,.. o ,o. T
| |
| , w. l ;
| |
| i - 1 IL*
| |
| . 2o
| |
| -. ., , , , , +
| |
| ,a .
| |
| gp,. S 'M y T
| |
| *''+2 g4,> { ;
| |
| .<.,, ,-,,, I
| |
| _ _ _ _____q
| |
| . -4 .v,----u--- *,,.2 ,..
| |
| l 1N (f, e soe
| |
| . 4 ' .< .- w s, _F-04 l--- .A, 7,8 t.w. , , , , sa tY s
| |
| E i
| |
| I
| |
| ( ($ E ,'NS
| |
| >m am-a sa.
| |
| 4,p (u) g *; *, ' * * ' *''
| |
| p..1 no, ,i,o.
| |
| L-_- ---3 ,N
| |
| ---A, / -
| |
| 1 >~~. . . .
| |
| h g, A. ,< ,
| |
| ,n s
| |
| >>o l ;
| |
| 90 ).
| |
| sCv I 8C V g4 W h- **
| |
| ,, W F. - ' - -- T
| |
| * L I ;. <I- -4.__4 ,o,,. __ y%. _ i 1,,, - , .
| |
| 1 1 . <. , . . .
| |
| m1r w % ecv - c ,:
| |
| !4 =
| |
| o so n 2
| |
| " I ' ,o ag,
| |
| , I'" I ~ ''
| |
| , '-n i c.w .< . . _ . <so .be se J m .. 1 1 1
| |
| ^
| |
| I---4 , t--d . - b ~ f(w o "
| |
| <.I
| |
| [
| |
| i so i m -. .. '
| |
| me. *>' yI
| |
| . 1 =.
| |
| ,_.s,,
| |
| ' 1 T
| |
| ,o
| |
| ' I
| |
| ! t u ye 'so"is .,
| |
| * I to e j _ _ _ -
| |
| L__. T'
| |
| __.- - g a p . q $_._ _
| |
| s - -- 4 L
| |
| .N ',o ,.
| |
| l h~~ ~~
| |
| ! c inn a
| |
| . m .o.. .A i
| |
| _"_p T K---- --- -
| |
| i i O
| |
| %1 b a u _ __ -. E 9
| |
| ..sw
| |
| $4 a i
| |
| , g g, g g % P'JMW %4 A -
| |
| iA 46 $T se g pstapr,
| |
| , gg ase 4 - 4 a% %
| |
| ..g a
| |
| | |
| =, , .. _ . , - .
| |
| '.. ,...,y .L'
| |
| =~ -. 8 , =. 4b_.
| |
| c , , , ,' ; - - . - .
| |
| w s' . . st
| |
| . . .' . f 5_ %
| |
| .b
| |
| :, , -i . . - 1 . + ._ 3 b,(' . ,_ , }.3 , . -
| |
| t.
| |
| .r , .. ' , j. ..
| |
| e.., . s'., _, :. - . . . * ..,;,
| |
| m.
| |
| . :. ;.. ? '
| |
| t .
| |
| . ,,. .. ...-. .- . . .9...
| |
| g .
| |
| ,,... .. ., . , . . -', . 3.%,.
| |
| y...-s 1
| |
| . . . s .n , . n .; . . , ,
| |
| " :. y. :,, . .
| |
| .,..,-=,; '
| |
| . t: 6 .*.-.-.
| |
| ..t._.- - -
| |
| ..w.n. ..
| |
| -.c...' .
| |
| , g 1- . ' .
| |
| .$1J - " .t
| |
| - ., ., . .e- -
| |
| ',4,
| |
| . ,.,.e .
| |
| f 4 , .. , > , . .
| |
| l
| |
| . . _ - _ _ _ . _ _ _ _ _ _ _ . ( .g ,7 > ' - -. .Jf
| |
| . . . ~ ,*.. . . ....
| |
| 4 - - . - . . . ,, - . - ,
| |
| e c '1 .A 4' , i 'l . ' , .,.f,
| |
| .., ,.s ,'
| |
| ', i 'i ~..',* ,.c
| |
| ______.__4}____ .o.,*a. ss- --{ H F--{ <} - ,
| |
| ' ' . - m'..u.
| |
| 4[.*
| |
| us a g
| |
| , I I sh ' ,. * , l } . g' . _ .
| |
| l I ;
| |
| l .e - r . p.. .
| |
| . i
| |
| . + . . . .
| |
| 2 ,* .
| |
| - "., y .
| |
| IM .s . d v w
| |
| - m 1
| |
| . ia ..
| |
| -.f-{ w }- , ;
| |
| . ' - , -- . A. A. . .#:- . -
| |
| 1.4 - . - .p
| |
| . s( .r . . .
| |
| l _-+ y 4 l ,
| |
| +
| |
| l l ..
| |
| . - . -*.,- ,f:
| |
| i z
| |
| ~~
| |
| ..w , . . .
| |
| h, n.r , t i
| |
| ...J 6 *
| |
| .+ ) . . ;
| |
| l
| |
| . .- ,j ,
| |
| i M *
| |
| - " " .- - . if
| |
| . s s.- . , , . ., :}
| |
| .~ l 1 -
| |
| ',,,, F_ . .*-.w __ 1 . - ..c-
| |
| -t . .
| |
| i
| |
| . . ..,.e i j .< . .. ..
| |
| j
| |
| ; j I .
| |
| 7 ,, . . ,
| |
| ; j ..
| |
| ,,,,y .a . = . - - g 1
| |
| : h. .t .y< ,. fu
| |
| .pj, - - .
| |
| ...- r . ~sp
| |
| . .,9
| |
| .s .
| |
| i .,+ ,
| |
| j t
| |
| 1
| |
| , .* -, - - s
| |
| ,. , , s p i ....s,
| |
| ..ou.*...m
| |
| -a a . * *,'a.. . - . , . ., , e7 -
| |
| L ** .:.. . - _ . , , . .
| |
| : u. *.
| |
| . _ _ _ _ s i
| |
| 3
| |
| , .=o se .v* - _
| |
| "1.h, I ..~ . .u s .,., n.
| |
| . - . 'am c
| |
| .- 3-
| |
| , ['d __
| |
| o* ae m e =
| |
| h., [' j' .
| |
| . , E '' I
| |
| [ 'm , '
| |
| " ' ' ' ' ' ' ' " 0:J ,t i, .'''
| |
| Il t
| |
| ',, , ., , ./,'[ - [ .-
| |
| .v.,' ,; .;- -
| |
| + , n .- % e
| |
| '('
| |
| i 1
| |
| . ), s.-
| |
| Pos' e I , , , , , , ,
| |
| '' *',7 ' =8 -
| |
| +,^%g.1 ' -
| |
| l r' e f'.
| |
| '-~
| |
| , = c a. .e as ~~'-i ''..
| |
| ' s. . ?-
| |
| r g .
| |
| .t, - -
| |
| i I - > - - . 1t i
| |
| t y . . , . - -
| |
| 4 -
| |
| 1___.__)
| |
| ....... . r.-
| |
| 1 '
| |
| ,,,w s ,o a-a roene s. evw e s
| |
| .2.. *
| |
| . '. - j. .
| |
| ,l I A' , i row . < u 3 .
| |
| ..,..m.
| |
| . s I ,l s w s. . . .~
| |
| +
| |
| . . ,. g
| |
| . . . s,..
| |
| ... > -so.. .
| |
| l j l ,,
| |
| I < { i ;, 2 * .
| |
| - =s ,
| |
| h* .
| |
| [
| |
| p_ __l _l )
| |
| l
| |
| [ i ,j *. ~ ,.-,'-
| |
| l :
| |
| a- a a, - - ^Mr . . f ,. - ,.
| |
| ===. _.
| |
| l i
| |
| ee s .a l t
| |
| ...,+.(-..
| |
| a.
| |
| .i n 7+ . .. ! :
| |
| Y, ~
| |
| .)
| |
| - i .4,s .
| |
| 3 A
| |
| l I l A
| |
| ,*t,. $P .,A -. ,,-
| |
| "+ ,u l
| |
| l l G +-y
| |
| % j " , , .' ?
| |
| ^ ' f ,' . , ',
| |
| .. s
| |
| -_p 1
| |
| .v...-.....o
| |
| .. I - _p<......... . . m.,..o ,%, .
| |
| , . .s,. ., ,
| |
| i et sin v . a - ' . . . , ,
| |
| / *
| |
| * . - , . , '--l
| |
| * i - ,,, . - , f. . . . . ,
| |
| : s. .. . - .s
| |
| )
| |
| i 1
| |
| pr. ': ,. - - .~ .. .; .:
| |
| t
| |
| ,. . . . . :.. + e. . . .
| |
| -s.:, : a ,,
| |
| .4
| |
| ; i i ' .y < , ~ K.. $ y p , .,
| |
| I s'. s . 3 -
| |
| i y. -
| |
| __ i e n r g,.
| |
| _ _ , { , ,
| |
| .3.,.
| |
| , l , .. ,., t . ,. ., e. . ., , .
| |
| .g,,,,
| |
| =_.
| |
| __ __J ; 1I ,4 .
| |
| ,. - w -
| |
| __ _ . _ _ . _ _ _ _ _ . _ ______J !
| |
| , y. t= . ..i.4
| |
| , . - e ,
| |
| . .,. .s, ,
| |
| 9,,3: , 2,
| |
| (- // ; . .< ~ -- - <,.
| |
| ,r. ( o ,. ..-
| |
| ... 3 . . .
| |
| 2 .
| |
| .. n. .- ;. .
| |
| Fiqure A.4-1. Simp 1ified Component . M. . ,.. .. .L , .st '.- i 7( s-
| |
| : a. c Coolinq System :, - e 4 . g ; .
| |
| . ,* k .'
| |
| g, ..,,.d -
| |
| s * ' . . ' , ,. ' f u- pg/o090 M & & MGro.
| |
| )_q.. .',..,: , ,
| |
| p e- "s v,
| |
| k
| |
| -s .. .
| |
| ~
| |
| 6'..
| |
| .M., . .. .
| |
| . ,- v .
| |
| d m-W-y l .
| |
| | |
| l l
| |
| r ERCW .
| |
| ERCW SUPPLY RETURN HEADER HEADER '
| |
| 1A CCS PUM4 A AND AUX X [ ACE N 0-67 1-FCV COOLER O-67 M2A 67-162 1A Som ir SPENT FUEL PIT PUMP AND TB X BOOSTER PUMP X X 0 67 1-FCV SPACE COOLER 0-67 0-67 645A 67-213 1A 646A 647A 1r Figure A.4-2. Component Cooling Water System / Essential Raw Cooling Water Header Arrangement A.4-9
| |
| | |
| t head loss through the thermal barriers, allowing the CCS pumps to operate at a lower total head. The 100% capacity pumps are horizontal, centrifugal type powered by Class 1E power. One pump in each unit is normally operating and the other is in standby. The standby pump is started automatically on low header flow.
| |
| The thermal barrier pumps are located in the auxiliary building at Elevation 714' in a room with the spent fuel pit pumps and are cooled by ERCW space coolers 1A and 1B. The ERCW supply to these coolers is controlled by air-operated valves 1-FCV-67-213 and 1-FCV-67-215. These open automatically on a signal from a temperature sensor which monitors the air temperature (see Figure A.4-2). One of these space coolers is sufficient to cool the room.
| |
| A.4.2.3.1.3 CCS heat exchangers. .There are three shell and tube type heat exchangers in the CCS. ERCW circulates through the tubes cooling the component cooling water on the shell side.
| |
| A.4.2.3.1.4 Component cooling surge tanks. The surge tank accommodates changes in component cooling water volume. Each unit has one tank which has an internal baffle divider, providing two surge volumes, one for each train of the unit.
| |
| The surge tank level measurements are used to monitor and control the total amount of water in the system. In case of severe leakage into the system, the high level switch will annunciate the high level in the control room.
| |
| In case of leakage out of the system, the low level switch activates a level l control valve to open and provide demineralized water for makeup.
| |
| A.4.2.3.1.5 Seal leakage return unit. This unit consists of a tank to collect seal leakage from the CCS pumps and two pumps which return this water to the surge tanks.
| |
| A.4.2.3.1.6 Valves. Most of the valves in the system are motor-operated butterfly, fail-as-is type valves. They are used mainly to isolate sections of the system. All motor-operated valves are power trained with control switches, located locally and in both main and auxiliary control rooms. The air-operated valves for the surge tanks and the excess letdown heat A.4-10
| |
| | |
| exchanger are fail-closed type. The ERCW air-operated valves for the pump space coolers (CCS and thermal barrier booster pumps) are fail-open type.
| |
| A.4.2.3.2 Support systems. To keep the CCS in operation supplying normal and emergency cooling, the following systems are required:
| |
| e Electric power for pumps, valves, instrumentation, and controls.
| |
| e Control air supply to air-operated valves, e Demineralized water or ERCW supply for cooling water makeup.
| |
| e The ERCW system which cools the CCS pump rooms and to which the CCS rejects heat.
| |
| e The RPS which provides an automatic start signal for the standby pumps.
| |
| e Auxiliary building HVAC which provides CCS pump and thermal barrier booster pump ventilation cooling.
| |
| A list of the CCS components and their sources of power is presented in Table A.4-2.
| |
| A.4.2.3.3 Interfacing systems. Under normal plant operating conditions, the CCS provides cooling water to the following systems:
| |
| e Reactor Coolant e Chemical and Volume Control e Waste Disposal e Sampling e Spent Fuel Pit Cooling Under accident condition, the CCS supplies cooling to the nonnal systems as Well as the following safety systems:
| |
| o Containment Spray e Safety injection e Residual Heat Removal e Chemical and Volume Control A.4-11
| |
| | |
| +
| |
| Table A.4-2 POWER SUPPLY TO MAJOR CCS ELECTRICAL EQUIPMENT Component Power Supply Board CCS Pump 1A-A 480V Shutdown Board 1Al-A CCS Pump 1B-B 480V Shutdown Board 1B1-B CCS Pump C-S 480V Shutdown Board 2B2-B CCS Pump 2A-A 480V Shutdown Board 2Al-A*
| |
| CCS Pump 2B-B 480V Shutdown Board 2B1-B CCS Pumps A, B, and C-S Discharge Cross-Connect Valve FCV-70-26 RBMOV1B2-B CCS Pumps A, B, and C-S Discharge Cross-Connect Valve FCV-70-27 RBM0V182-B CCS Heat Exchangers A and C Inlet Cross-Connect Valve FCV-70-23 RBMOVIA2-A CCS Heat Exchangers A and C Inlet' Cross-Connect Valve FCV-70-13 RBMOV1B2-B CCS Heat Exchanger A Inlet Valve FCV-70-25 RBM0V1A2-A CCS Heat Exchanger C Inlet Valve FCV-70-22 RBMOV1B2-B CCS Heat Exchanger A Outlet Valve FCV-70-8 RBMOVIA2-A CCS Heat Exchanger C Outlet Valve FCV-70-12 RBMOV1B2-B CCS Heat Exchangers A and C Outlet Cross-Connect Valve FCV-70-9 RBMOV182-B CCS Heat Exchangers A and C Outlet Cross-Connect Valve FCV-70-10 RBM0V1A2-A CCS Train 1B Header Inlet Valve 1-FCV-70-3 RBMOV1B2-B CCS Trains 1B and 2B Cross-Connect Valve 1-FCV-70-207 RBM0V182-B Waste Evaporator Building Inlet Valve 0-FCV-70-208 RBM0V1A2-A Waste Evaporator Building Outlet Valve FCV-70-206 RBM0V182-B RHR Heat Exchanger B Outlet Valve 1-FCV-70-153 RBMOV182-B CCS Train 1A Safety Header Inlet Valve 1-FCV-70-2 RBMOV1A2-A CCS Train 1A Miscellaneous Loads Header Inlet Valve 1-FCV-70-4 RBM0V1A2-A Spent Fuel Pit Heat Exchanger Inlet ,
| |
| 1 Valve FCV-70-198 RBMOV182-B Spent Fuel Pit Heat Exchanger Inlet Valve FCV-70-197 RBMOVIA2- A RHR Heat Exchanger A Outlet Valve 1-FCV-70-156 RBMOVIA2-A Thermal Barrier Booster Pump 1A-A RBMOVIAl-A Thermal Barrier Booster Pump 18-B RBMOV1B1-B CCS Train IB Return Header Valve FCV-70-75 RBMOV182-B CCS Pumps A and B Suction Cross-Connect FCV-70-34 RBMOV182-B A.4-12
| |
| | |
| Table A.4-2 (continued)
| |
| Component Power Supply Board CCS Pumps A, B, and C-S Suction Cross-Connect FCV-70-64 RBMOV1B2-B CCS Pumps A, B, and C-S Suction Cross-Connect FCV-70-74 RBMOV1B2-B ERCW Inlet to CCS Heat Exchanger A 1-FCV-67-478 RBM0V182-B ERCW Outlet to CCS Heat Exchanger A 1-FCV-67-146 RBMOVIA2-A ERCW Outlet to CCS Heat Exchanger C FCV-67-151 RBM0VIA2-A ERCW Outlet to CCS Heat Exchanger C FCV-67-152 RBM0V2B2-B A.4-13
| |
| | |
| ~
| |
| The individual components served within each of these systems are listed in Table A.4-3 with cooling requirements given in gallons per minute.
| |
| A.4.2.4 System Operation.
| |
| A.4.2.4.1- Normal operation. During normal operation, the unit carrying the spent fuel pit load is operating with two CCS pumps and one heat exchanger; i f the unit loads can be adequately handled by one pump and one heat exchanger. Thus, three of the five pumps and two of the three heat exchangers are no'rmally utilized. The standby pump, C-S, and heat l exchanger C receive limited use (under normal conditions) .in conjunction -
| |
| with the condensate demineralizer waste evaporator. Standby CCS and thermal barrier booster pumps are automatically started on low system pressure, safety injection, or loss of offsite power.
| |
| A.4.2.4.2 Event response.'
| |
| A.4.2.4.2.1 Automatic actions. On loss of offsite-power, the CCS pumps and the. thermal barrier booster pumps are restarted by the diesel generator load sequencer. Since all the MOVs fail "as is"~ the' system continues to operate 5 after alternate power is supplied. ,
| |
| The safety injection signal also opens ERCW outlet valve FCV-67-152 (if not I already open).
| |
| -A.4.2.4.2.2 . Manual operator actions. Any manual actions which might be
| |
| .- taken to recover the system will not be considered in this analysis.
| |
| A.4.2.4.3 Potential for accident initiation. Failure of the CCS is an
| |
| ' initiating event for the unit. Loss of cooling to the. reactor coolant pump oil coolers and thermal barriers results in a reactor trip which is also an initiating event.
| |
| A.4.2.5 Controls, Indicators, and Alarms. The component cooling system, a safety related system which interfaces with the radioactive cooling loads, has instrumentation to monitor pressures, . temperatures, flow rates, and water levels at various points throughout the system. Electric power to the transducers in l' the instrumentation loops is-from the same train as the equipment being served.
| |
| A.4-14
| |
| | |
| .. . . - . . . - . . .- - -- . = . . .. . .__. - _. . -- - . .-
| |
| )
| |
| l h Table A.4-3 h
| |
| NORMAL AND POST-INITIATING EVENT'C00 LING LOADS OF A L COMPONENT COOLING SYSTEM TRAIN l
| |
| l' Component.
| |
| Equipment Cooling Water Flow Rate
| |
| . (gpa)
| |
| Nonessential Loads-Waste Gas Compressor Heat Exchanger _ .
| |
| 43 Gas Stripper.and Boric Acid Evaporator Package 1,896
| |
| . Auxiliary Waste Evaporator Package (Unit 1 only) 780 Waste Evaporator Package (Unit 1 only). 140 Reciprocating Charging Pump IC 011 Coolers 90
| |
| -Reciprocating Charging Pump 1C Seal. Water Heat Exchanger 215 Nonregenerative Letdown Heat Exchanger. 1,000 Sample Heat Exchangers .
| |
| 96 Gross Failed Fuel Detector 14 Excess Letdown Heat Exchanger- 275' RCP-Thermal Barrier 160 RCP Seal Oil Coolers 620 Spent Fuel Pit Heat Exchangers . 6,000
| |
| : Condensate Demineralized Waste Evaporator 1,600 Essential Loads Centrifugal Charging Pumps Mechanical ' Seal
| |
| -Heat Exchanger 45a Safety Injection Pump Mechanical Seal Heat Exchanger 25a RHR Pump Seal Water Heat Exchangers 15a Containment Spray Pump' Oil and Mechanical Seal Heat Exchanger 15a
| |
| .-RHR Heat Exchangers 5,000b aEquipment not in service normally, but cooling water is supplied.
| |
| bNormally isolated.
| |
| i i
| |
| A.4-15
| |
| | |
| N
| |
| ' Loss of a power train would result in loss of only instrumentation and control }
| |
| for equipment that is being served by that particular power train. !
| |
| i Flow measurements are taken at thc outlet of each heat exchanger group and are I displayed in the control' room.. In addition, flows entering the power trained
| |
| - headers 'are measured and displayed in the control room. Flows to the main supply headers are'also displayed in the auxiliary control room. The thermal barrier lines use flow to control isolation. Flow rates are measured in both the supply and return headers. The two are compared; should a mismatch occur due to inleakage, the line is isolated.
| |
| Local pressure indications are available for both suction and discharge of all pumps in the system. Local indication is also available for the main supply
| |
| : headers to various equipment. Pressure in the unit discharge header of the CCS
| |
| ^
| |
| pumps is displayed in the main control room and annunciated on the low pressure I
| |
| setting. Annunciation is also given when an abnormally high' pressure is sensed i
| |
| at the discharge of each CCS pump. ;
| |
| Temperature is measured at the outlet of every heat exchanger or heat exchanger j group. Temperatures are also taken on the main return headers to the pumps. All j temperatures are displayed in the main control room. Should temperatures at any
| |
| ! of the sensing points become excessive, annunciation will occur in the main f control room. All motor-operated valves have control switches located locally and in both the auxiliary and main control rooms.
| |
| i A.4.2.6 Testing, Inspection, and Surveillance Requirements.
| |
| A.4.2.6.1 Pumps (Reference A.4-2). The operability of the five CCS pumps
| |
| ( and their discharge valves is verified every 31 days on a staggered test i l
| |
| basis. The performance of a pump is tested by operating only one pump per
| |
| ! header at a time. If two pumps are needed for this header, the C-S pump is I
| |
| aligned to this header for the duration of the test. The pump inlet I
| |
| pressure, differential pressure, flow rate, vibration amplitude, and lubrication oil level are verified to be within the acceptable range. The static inlet pressure of a standby pump is checked before starting. The l
| |
| l static inlet pressure of an operating pump is not required. At the end of the test, the system is returned to its pretest lineup, f-I
| |
| '1 A.4-16
| |
| | |
| The C-S pump is tested without changing its existing alignment. If the pump cannot deliver more than half of its capacity on this lineup, then the outlet valve on one of the two RHR heat exchangers is opened to verify output of more than 3,000 gpm from the pump. At the end of the test, the CCS system is returned to normal lineup.
| |
| A.4.2.6.2 Valves (Reference A.4-1). On the same schedule as the CCS pumps, each valve (manual, power-operated, or automatic) which services the safety related equipment in the loop under test is verified to be in its correct position unless it is locked, sealed, or secured in position. A check list of more than 10 instruction items is provided for this surveillance procedure.
| |
| A.4.2.7 Maintenance Requirements. There are no regularly scheduled preventive maintenance requirements for the CCS pumps or valves. Maintenance and repairs are performed as required, keeping within the limits of the technical specifications. One of the five CCS pumps can be pulled out for maintenance for an indefinite period of time as long as two CCS loops are operable for each unit. If a second pump becomes inoperable at the same time or any other component of the safety related equipment (heat exchanger or a motor-operated valve) needs repairs or maintenance at the same time, this work must be completed within 72 hours or that unit must be shut down until the affected loop is returned to service.
| |
| If any repairs were carried out that might affect the performance of the pump, a post-maintenance test is required before it is put back into service. A post-maintenance test is similar to the test for a standby pump described in Section A.4.2.6.1 (Reference A.4-2).
| |
| Any maintenance work required on the motor-operated valves is carried out with the valve in the required position for operating the loop. Repair and maintenance on automatically actuated valves will be carried out at unit shutdown time.
| |
| A.4.2.8 Technical Specifications. The technical specifications require that two independent, safety related component cooling loops be operable, with each loop comprised of the following.
| |
| A.4-17
| |
| -)
| |
| | |
| e One operable CCS pump, e One operabl'e CCS heat exchanger.
| |
| e- An operable flow path to supply cooling water to all of the loads associated with that loop.
| |
| e An operable flow path to collect _the cooling water from the equipment and pump it back to the CCS heat exchanger.
| |
| With one CCS loop operable, the inoperable loop must be restored to operable status within 72 hours, or the unit must be in hot standby within the next 6 hours, and in cold shutdown within the following 30 hours.
| |
| A.4.3 System Logic Models A.4.3.1 Failure State Top Event Definition. The CCS is analyzed for two general initiating event conditions. For those events requiring safety injection, both trains are signaled to start by the safety injection signal.* For all other initiating events, the normally running CCS train must simply continue to supply its normal cooling loads. The GO model has been developed to quantify these two conditions for the failure of the CCS trains.
| |
| A.4.3.1.1 Analysis boundary conditions. Other assumptions and boundary conditions applied to this analysis include:
| |
| : 1. Unit 1 is at 100% power and has train A in operation with pump 1A-A running and pump 1B-B in standby. Unit 2 is supplying normal loads and the loads shared by the two units.
| |
| : 2. The CCS pumps and the CCS thermal barrier booster pumps depend on the space coolers for proper operation. It is assumed that one space cooler is normally operating in each room and the second one starts automatically from standby on failure of the first.
| |
| : 3. Train B is in standby.
| |
| : 4. If normal power to the running trains is lost, the pumps will trip and automatically restart from the diesel generator loss of power load sequencer. For this analysis, it is assumed that this restart operation is identical to starting the standby pumps.
| |
| * Pump C-S starts on loss of offsite power and on an SI. Pump C-S, as well as all other CCS pumps, automatically start following a loss of offsite power. Since this change does not impact the demonstration of GO methodology, this information was not accounted for in the logic model or quantification.
| |
| A.4-18
| |
| | |
| r, i.
| |
| : 5. -The system is analyzed to the last valves capable of isolating the loads from their CCS headers. On the ERCW side, the valves capable of isolating the' raw cooling water to the CCS heat exchanger from the ERCW header have been included.
| |
| : 6. Surge tanks and makeup water lines have been omitted from the analysis since the failure of their functions does not affect the unavailability of the system for a long period of time.
| |
| : 7. No operator actions are considered for recovery in case of failure of either train after an initiating event.
| |
| A.4.3.1.2 Interface with the overall safety model. The CCS is analyzed in the overall plant safety model for initiating events with sa.fety injection and initiating events without safety injection. In either case, failure of a CCS train is defined as failure to supply sufficient cooling water to the supply headers over an operating period of 24 hours after event initiation.
| |
| The length of the mission time is comparable to the mission time applied to the systems for which the CCS provides cooling.
| |
| A.4.3.2 The G0 Model. The safety GO model for Unit 1 is shown in Figure A.4-3.
| |
| Unit 2 has not been modeled. Though designed to be a shared system between the two units, the CCS is operated with train A dedicated to Unit 1, train 2A dedicated to Unit 2, and train B is shared. With two pumps aligned to train 2B, Unit 2 can continue with power generation, unaffected by the accident on Unit 1.
| |
| The GO model starts with a signal initiator for component cooling water availability at the pump, then flows through the three pumps to the two heat exchangers. Dependency on ERCW is added into an AND gate at this point. All components in the flow paths that could affect the availability of cooling water in the various h.aders have been included. Some of these are valves at the suction end of the CCS pumps and valves at the ends of return headers. Due to the fail-as-is status of all the motor-operated valves, electric power dependency of these valves is shown only where the valve is required to be actuated. All support signals such as power sources and actuation signals are labeled in the model.
| |
| The CCS and thermal barrier booster pumps depend on ERCW to keep their environment sufficiently cooled for proper operation of their control systems.
| |
| This dependency has been modeled. It is assumed that at least one space cooling unit is required for the operation of the pumps.
| |
| A.4-19
| |
| | |
| CCS OFFSI4 - EACW W ATE A 400 V $ HUT DOWN POWER HEADER 13 TRAf4 A SA 14 SOARDS1516 qp qp qp qp SAF ETv HEADER 37 10s 106 100 101 102 ' gg
| |
| # N
| |
| $ 500 Sl51GNAL$
| |
| CCS PUMP ESF A$ ThatN$
| |
| M M Sf fUS MISCELLANEOUS EQUIPMENT OFFSITE POWER IS 1A W 104 ERCW CC$ TRAIN
| |
| " " M 202 7 Sf t290 ,, ,, ,r OF.F$tTE PO Em
| |
| 'I 101 104 105 102 101 CCS IS S 20G &2 THERMAL RE TOR ER M r 1r 1r THf RMAL Sul@NG PUMPS 102 100 101 HEADER ST 1200 SARRIERS 107 103 103 CCS PUMPS gL jg jg SPACE COOLERS 200
| |
| [ $71001 16 21 16 Ab 8
| |
| ~'
| |
| 480 V 480V B3 t RE MOV RBMov O 1A1 A 1st s 1001Ce 1%
| |
| CCS T HE RMAL lf if IP BARRIER 34e Ig3 306 800$TE R PUMPS 20 CCS Maar CCS TRAIN 4 102 CS 200 P1 gg CO"OLER$
| |
| ST 1250 gy g295 ST 1101 400 V R3 MOV 18 tot 107104 7 108 db. JL JL SOA.RD 2n n a a OF FSITE 4 25 POWER 7 105 5 4 103 102 200 l SA,ETY 1 2 e 103 104 107 100 los "g n a a a a 14 1B OFF$lTE 3 4 17 8 17 ERCW POWER OTHER USERS
| |
| $1 SIGNAL $1 $3GNAL E RCW CCS 480V SHUTDOWN E SP AS TRAtN ESF AS TRAIN HEADE R WATER BOARD 14 gg 29 TR AIN 282 8 Figure A.4-3. CCS Safety Model (Sheet 1 of 8)
| |
| | |
| f l
| |
| )l\
| |
| 0 0 0 0 2 2 9
| |
| 2 0 5 A D7 2 B
| |
| 1 7 0 1 N
| |
| [1 1 15 7
| |
| 4 0 0 A 0 D5 0 B
| |
| 5 1 7 04 8 2 1 N
| |
| [1 7 1 15 1 2
| |
| 1 s E P
| |
| E Y P 7 T Y R T E R P )
| |
| E U d P S e U ) u S Y n A A-
| |
| * i)
| |
| A 1
| |
| 9 0
| |
| A 1
| |
| B D
| |
| N D6 0 t8 n
| |
| of P R 1 P A 1 Co SM T 1 (
| |
| M G 1
| |
| CU S G 2 U N CP P
| |
| S P EI L C
| |
| (
| |
| B -
| |
| N EI L C
| |
| ( 3 t
| |
| C 3 AO PO
| |
| ? 8 AO 04 4. ee C
| |
| 0 1 SC 4 0 1 PO SC 1 Ah P S G 1 M e(
| |
| N U r I
| |
| T P u g
| |
| A S i R C F E C P
| |
| O 0 0
| |
| - 2 U 1 1 Y
| |
| L L t A 1 2 M
| |
| N 0
| |
| 1 > 0 1
| |
| R E O P N N N DO W W NO OA OB SAT D- D-1 7
| |
| L T1 T 8 0 ITSL UA U1 D7 1
| |
| - ARI H1 H SD 1
| |
| FAA SD A B PTF 9 VR 2 MS0 V%
| |
| 0 2
| |
| 1 0 3 7
| |
| 0 0 A 8O 1
| |
| N UO
| |
| [1 PT 8O 4B 1
| |
| 15 4B
| |
| - A YA LN RE E
| |
| TE I
| |
| 0 S A 0 0
| |
| 0 1 S UR C T 1 W$
| |
| 1 5
| |
| lll
| |
| | |
| I li jll ! ,
| |
| ' l s
| |
| 0 0
| |
| 2 7
| |
| 2 1
| |
| )7 a5
| |
| - 35 1(
| |
| 5 0
| |
| 1
| |
| ) -
| |
| o 78 4
| |
| 1(
| |
| o 5 0
| |
| 5 2
| |
| 1 E )
| |
| P d Y e T u R n E i)
| |
| P t8 U n S of S- (
| |
| co C 3
| |
| _ P 3 M t U
| |
| P S
| |
| C C
| |
| 8 0
| |
| 1
| |
| -)w -
| |
| R E
| |
| W O
| |
| P
| |
| : 4. ee Ah e(
| |
| r S
| |
| Y B 4 0
| |
| 1(-'
| |
| mc
| |
| * E T
| |
| I S i u
| |
| g D 1 F F N s F A G o O T N I
| |
| i S L O
| |
| O C
| |
| W C 0 R 1 -
| |
| E 2 N LIN 0 W AA 1 -' 3 O NR 0 D-8 GT 1 T2 I
| |
| SF UB2
| |
| _ t SA H SE1 SD 2
| |
| 7 2
| |
| 1 j - o703 VR 0
| |
| 8O 4B A
| |
| 35 1
| |
| 1\
| |
| LIN-AA B NR R GT I
| |
| SF o EM ST7 tS8 o cA SE1 t cW$
| |
| =~
| |
| 1 1t (l l ,
| |
| 1t lll1
| |
| | |
| " , ,ll i 0
| |
| 0 2
| |
| . 2 9
| |
| 2 7 A 7 2 7 B 1
| |
| 6 34 1
| |
| - 6 34 1 06 1 46 1
| |
| 0 0 E 1
| |
| TR R R )
| |
| 0 E E 0 d E
| |
| I S E E E e C L 3 1
| |
| P FW 2 V 1 1 C L u Y FO0 2
| |
| 6 AO PO AO n 1 PO 1
| |
| T OP1 SCA i)
| |
| SC8 t8n R
| |
| E ' 3 > of P N co U AN (
| |
| 4 S .F O 3 0 3 3 S D 9 6 6 u
| |
| R S 9 V1 0 V1 t R
| |
| E E
| |
| C ET LR NA 1
| |
| C7 F6
| |
| - 1 1
| |
| C&
| |
| F6 4. e e L AO OTA M Ah O P SCSD E '' > > e(
| |
| S O r u
| |
| C g E i C 9 A 7 8 F A 2 7 6 2 2 7 6 2
| |
| -f 1 1 P 4 -
| |
| G6 4
| |
| G6 S 1 1 1 S 5 P ?
| |
| * M U
| |
| P S
| |
| C C
| |
| 0 1 0 0 _
| |
| 1 1 R
| |
| R E B E A H 1 H 1 T
| |
| T R R O' S E O *S E WR D WR D CE A CEA RSE RSE EUH EUH
| |
| >bk"
| |
| | |
| '6.+
| |
| CCS THERMAL BARRIER 900 STER PunePS SUPERTYPE 1200 61 OFF5ITE '
| |
| POWER 101 1 25 ' -
| |
| m $l5lGNAL ESF TRAIN IS 1
| |
| CW 671 FAIL $
| |
| TO OPEN ON 1-111 qr DEMAND 3
| |
| OFFS:TE POWER 3 tot 4a0 W RS 440V SPACE 1A1 A COOLING
| |
| " in cc, TRAsN 1A 100 10 312e 10 F108 1 106 1 120 REACTOR
| |
| . OutLOING teEADER sne re- e7se one BOOSTE
| |
| > Puw i.R.
| |
| 2 : 2m
| |
| = iO.
| |
| N b
| |
| cv n TRANSFE R$
| |
| CLOSEO 1-129 2 10 1-10e F10. F129
| |
| $73 A 103 db 10B T S. 676 A G77 A 800 STER PUMP 1A4 COO psG el.lo V. RBMOV 1 1-10 3 1525 0 106 58 54GNAL ESF TRAIN 1A JL Jh O TE St F107 C 2 C 101 q
| |
| ' PUMP FAILS TO START ANO CHECK WALVE $76 A PAILS TO OPEN Figure A.4-3 (continued)
| |
| (Sheet 5 of 8)
| |
| I
| |
| | |
| CCS THERMAL BARRIER BOOSTER PUMPS SPACE COOLERS SUPERTYPE 1101 ERCW - , .
| |
| OTHER 1129 1-99 6-110 1-129 1129 "
| |
| USERS' 100
| |
| ^
| |
| 0-67 1-FCV k 0-67 0 67 SPACE 645A 67-213 COOLER 646A 647A 1A 2
| |
| l
| |
| . OFFSITE /
| |
| 1-131 5-1 2 > 200 102 ui SPACE COOLER FAILS TO START ERCW OTHER > 1-128 1-133 1-130 1 128 1-128 i
| |
| USERS
| |
| * 101 HEADER 1B~
| |
| 0-67 1-FCV SPACE 0-67 0-67 6458 67 215 COOLER 1B 6468 647B Figure A.4-3 (continued)
| |
| (Sheet 6Of8) i 1
| |
| I
| |
| | |
| e CCS TRAIN 1A SUPERTYPE 1200 SAFETY 0800EL I
| |
| ERCW tog 200 SAFETY
| |
| } R Ft03 vs2e F103 pies
| |
| ,,C. , ,,C. ,C. ,.2 87-MS OSI A G7478 etre W $ HUT- 101 tes OFFSITE DOuMBOAm0 POUR R 1A &A 4129 9F if ir 470 set 803 v70 514 v120 CC5 PuesP 5804 REACTOR M 2 14s BulLDeNG 10 0 37 1276 y F103 2 to 3 103 dk HEADER JL 202 FCV CC5HE FCW yo 4 25 A MG vt03 v129 ;
| |
| p '03 1 m CCS ERCW v13 edesCELLANEOUS y $ PACE COOLsesG FCW 1 70 0
| |
| . 704 601
| |
| $ 103 4 70 tes SM CC5 PUhAP 184 5 120 sr i=0 tot 5-70 907 es0wSHUT- 102 z O.OWNe i >. SOAAO Figure A.4-3 (continued)
| |
| (Sheet 7 of 8) ,
| |
| t 4
| |
| | |
| . . . _ . - . . , -- . - -- , ~
| |
| 6-i.
| |
| -r CCS TRAIN IS SUPERTYPE 1296 SAFETY R40 DEL .
| |
| E los its 480 V RS neOV 292-8 $4S4GNAL l ESF TRAIN is
| |
| .50 16 if 103 ERCW 107
| |
| $3sgGNAL 04EADER O 1-127 l127 Slot j ESF TRA3M 1A IS
| |
| , 10s 102 $67 $47 FCV j $8 54GNAL ERCW 540C ts3 57-152
| |
| ? E$7 TRAsN 18 COOLING
| |
| *=
| |
| b N 1-127 l102 2 1-102 M !
| |
| 1P 1F 1F toa 102 10e OD 1F 1FCV 14CV 510A 763 7675 CCS CCS PueeP 3 ? 100 OS 200 1 102 2 1 08 10 1102 1-102 I-F CV a l I WATE R I TRAsN g ST 1200 5 100 103 105 FCV CCS FCV l Jk JL 7622 HM C ?SI2 i
| |
| ! 3.i27 1-10 s iO2
| |
| $NUTDOWN OF FSITE $70 2FCV 2-FW 4
| |
| MARD MWER 510e 763 76207 22-s =
| |
| is
| |
| .)
| |
| ; Figure A.4-3 (continued)
| |
| (Sheet 8 of 8) 4 i
| |
| i l
| |
| t
| |
| {
| |
| i 1
| |
| | |
| a The availability model shown in Figure A.4-4 includes operator actions to assure that train A keeps operating with at least one CCS pump and one CCS heat exchanger.
| |
| A.4.4 Quantification of System Unavailability A.4.4.1 Hardware Failure Contribution.
| |
| A.4.4.1.1 Active components. Table A.4-4 lists all the components and their associated failure modes. The probability of active components includes the failure of the components to operate on demand and failure during operation. These include pumps, motor-operated valves, check valves, and space cooling blowers.
| |
| A.4.4.1.2 Passive component's. Passive failures considered are valves transferring open/ closed during operation and heat exchanger rupture.
| |
| Piping and other structural failures have not been considered. Passive failures prior to event initiation have been considered under the assumption that the components in standby systems may fail between tests. The following test intervals have been used for components in standby systems:
| |
| e One month for CCS train 1B and pump 1B-B train.
| |
| e One-aad-one-half years for thermal barrier booster pump trains.
| |
| A.4.4.2 Test and Inspection Contribution.
| |
| A.4.4.2.1 System unavailability during test and inspection. Each CCS pump is tested once every 30 days. During this time, only the tested pump discharges into the header. The test lasts less than 30 minutes. If there is an initiating event at the time of the test, the failure of the second train A pump to start on demand under this condition (QM) is given by 30 OM " 30 x 60 x 24
| |
| * AD where 1 is the failure rate of a pump to start per demand = 2.12 x 10-3, 0
| |
| Qg = 1.47 x 10-6 A.4-28
| |
| | |
| . 4 0 v SMUTDOWN OARDS cc, ' i Ai. i. '
| |
| ERCW MTER EACW SUPPLY WACE De.E 1 ADE RlA COOLING ii . . ie is if 1F 1F if 1F' SAFETY ME ADER
| |
| : 10. NO 901 102 903 1A
| |
| : 20. ; 21 a.tsCELLAMOUS MEADER 00 - , we s.o L 3.: ; ::
| |
| oP.
| |
| 'a'--* "' Cc --.-
| |
| o,,,,, o,E , $
| |
| ERCW MEADER$ g cc= cc. .-L iA L-. ,0.
| |
| cc, ,,,,,,
| |
| - - . - m.Anaifas y,A,,, ,A ,, noosTE Puws T. ,
| |
| e.C.CooLEas
| |
| : mai : = 5Ti=0 .0 ;
| |
| REACTOR
| |
| > 2 ST N08 outLDeNG 100 I MEADER 107 103 Jh> 100 % e.on AL 10 e oP. " '
| |
| g 300 -o- ',.
| |
| G .02-. mi iO3-. io. e v n ov e v . ov
| |
| .OAA0 sal 4 .OA.RD t.1-907 10. 10. ISO 27 /
| |
| Jk db dL JL
| |
| : 3. 38 1. 12 20.
| |
| 40v e0V 40W
| |
| . ov . ov . ov E.ACW
| |
| .EAnta cos T.
| |
| : 2. .00ETER Pub.P$
| |
| .0AAO .0M wacac m as iA24 m
| |
| .OA.AD an.tO ST liet 100 101 JL JL 8 3 1A 1.
| |
| i ERCW OTDeE R USER 5' MEADERS Figure A.4-4. Availability Model (Sheet 1 of 6)
| |
| | |
| TRAIN A CCS PUMP SUPERTYPE 1275 480 V SHUTDOWN BOARD 1 Al-A (181-8) SPACE COOLING 101 104 t
| |
| 200 100 M 1-129 M 10 9 1-109 y 1 104 W 1-129 ; y R IN 1 A 1-70 CCS PUMP 1 70 1-70 503A (B) 1 A-A (1B-B) 504A (B) 505A(B)
| |
| Figure A.4-4 (continued)
| |
| (Sheet 2 Of 6)
| |
| | |
| 4
| |
| ?
| |
| I i
| |
| CCS PUMPS SPACE COOLER SUPERTYPE 1001 1
| |
| E RCW OTHER 100 i user $* --M 1-129 M 1-90 N 1-HO M 1-129 l l 047 FCV 4
| |
| ! y S 2A 87 163 SPACE COOLER A 6.67 3A 200 l b 2 4 l l O
| |
| j ERCW OTHER 101 ussRs- W 1-127 M i-100 W 1 130 W 1-127 j l
| |
| ' l l
| |
| 1 047 SPACE COOLER S 667 i i
| |
| = .FCV.2 7-i .=
| |
| i l
| |
| Figure A.4-4 (Continued)
| |
| (Sheet 3 of 6) i i
| |
| l j
| |
| 1 l !
| |
| i i
| |
| | |
| h
| |
| *'3
| |
| _\j'J 1
| |
| 1 _ .
| |
| [,
| |
| =
| |
| .N 2
| |
| i n
| |
| n
| |
| \_j .
| |
| m _ _
| |
| )
| |
| [, ,N d e
| |
| u
| |
| = h_
| |
| n i)
| |
| . t6
| |
| . n
| |
| .n .
| |
| \_ g, - _
| |
| L4
| |
| (
| |
| of co 4
| |
| n.
| |
| o o.
| |
| C A
| |
| P S 3 [ =
| |
| ,N ,.=.:7
| |
| : 4. e t
| |
| e 1
| |
| Ah S
| |
| e(
| |
| r
| |
| . u g
| |
| i F
| |
| = 7 1 ..
| |
| m.
| |
| ; h_
| |
| c
| |
| .. a
| |
| .]
| |
| c
| |
| \_ ,
| |
| n J
| |
| [* --
| |
| =,.M'*.
| |
| o rem
| |
| | |
| CCS THERMAL BARRIER BOOSTER Pus 0PS SPACE COOLERS SUPERTYPE 1101 zi i-32s l j -se H -iso H s 32s l ; s-12e l
| |
| oEn usens-7'A 667 i-rCv SPACE 467 667 645 A 67-2:3 COOLER M6A 647 A
| |
| > 2^
| |
| 200
| |
| % i 2 l b
| |
| son
| |
| % s-32s l j -iss H :-iso l l i2e H 3-ias }
| |
| EMausens-E's* *" 067 s-rCv SPACE 067 G67 ses a s7-2iG COOLER 646 8 "IE in Figure A.4-4 (continued)
| |
| (Sheet 5 of 6) i i
| |
| | |
| CCS TRAaBB 1A SUPERTVPE 13 tes 3 Tv s.c.w..
| |
| .a .= .u. >== .. s.e.<oa.
| |
| =
| |
| W .47 64CW ,CW M2
| |
| .S #C.M mi .m g.
| |
| W W SasuT.0 D.Dme00m 9 64 tim '
| |
| >=s
| |
| +im ccs - >= .
| |
| == m .=. m.u.cro.
| |
| W 3 41 3 - 3 Se 3. .a.3 3 db esE.MJhsuG OE.
| |
| ST 12=
| |
| - FCW / III d
| |
| FCW G. S 30E = +== *im :
| |
| f Ma - cia.=ous c.c.,n . ..c. ,,= *a, u''"*"'
| |
| ,cv >=
| |
| > gv sr.ca co==s = =>
| |
| , 4 - , , .
| |
| *=
| |
| <a ccs u
| |
| * --. $im ,c ,
| |
| "' = =*
| |
| 5n2= . = o. o. .=>
| |
| u >= ,c, G.7 p.23
| |
| ,c ,
| |
| s.o
| |
| : i. e
| |
| ,cW
| |
| == Wean- .. " ==
| |
| *"***** = .i ov .a ,,,
| |
| == =o . .=.
| |
| .o
| |
| & 827 8 3A j
| |
| .=
| |
| 3 SW 3 St.3 (X3 #CW b= MA C 4 32 W =
| |
| .82y E.ce nE.DE.
| |
| . =1 1 137
| |
| .o.un.OW
| |
| =
| |
| sea. .47 .47 FCW
| |
| *== ma e Figure A.4-4 (continued)
| |
| (Sheet 6 of 6)
| |
| | |
| . Table A.4-4 FAILURE DATA FOR CCS COMPONENTS
| |
| 'MTTR L Component Failure Mode Failure Ratea (hours) l l .CCS Pumps and Fail to Start 2.12 x 10-3/d 24
| |
| , Thermal Barrier Fail to Operate 2.62 x 10-5/h Booster Pumps Motor-0perated Valves Fail to Open on 4.30 x 10-3/d 32.3 Demand Transfer Closed 1.32 x 10-7/h
| |
| . Manual Valves Transfer Open/ 3.36 x 10-8/h 32.3 Closed Check Valves Fail to Open on 2.98 x 10-4/d 32.3 Demand Transfer closed 6.42 x 10-7/h Air-Operated Valve Transfers Closed 7.82 x 10-7/h 32.3 CCS Heat Exchanger Ruptures 6.69 x 10-7/h 160 Space Coolers-
| |
| - Coils Rupture 2.69 x 10-6/h 52
| |
| - Blower Fails to Start 7.99 x 10-4/d 48 on Demand Fails to Operate 8.85 x 10-6/h ah = per hour; d = per demand A.4-35
| |
| | |
| Qg is a small contribution compared with the failure rate of the CCS pumps.
| |
| There is no test contribution from the pump C-S as the test is carried out in its normal lineup.
| |
| A.4.4.3 Maintenance Contribution.
| |
| A.4.4.3.1 System unavailability during maintenance.
| |
| e (As described in Section A.4.2.7, one pump can be for maintenance for an indefinite period of time.) This pulledwill out be the standby pump on train 1A. The unavailability of the standby pump on train 1A is given by T
| |
| NS01A * *M M where 4M = the frequenay of repairs for CCS pump (1.26 x 10-4 events / hour).
| |
| TM = the duration of maintenance for components with no time limits (116 hours).
| |
| QSB1A = 1.47 x 10-2 e if a second pump fails during this time, at least one pump will be made operable within 72 hours. This will be the standby pump C-S since the two units will keep operating with the three functioning pumps. The unavailability of standby pump C-S is given by OSB " *MI000
| |
| * Ap 'MIT72 where
| |
| &g = the frequency of repairs for standby pumps (1.26 x 10-4).
| |
| QOD =2.12(the xfailure 10-3).of a pump to start on demand A
| |
| p
| |
| = the failure rate per hour of a pump to operate (2.62 x 10-5),
| |
| 7 72 = 20.9 hours.
| |
| QSB = 1.36 x 10-5 A.4-36
| |
| | |
| A.4.4.4 Common Cause Contribution. The only common cause considered for the CCS pumps and the thermal barrier booster pumps is the cooling requirement for the rooms in which they are located. There are two redundant ERCW space coolers, and the contribution from failure of these coolers to the overall unavailability of the system is small; less than 10~0 t
| |
| A.4.4.5 References.
| |
| A.4-1. Sequoyah Nuclear Plant, Surveillance Instruction SI-32, Component Cooling Water Valves (Position Verification), January 4,1982.
| |
| A.4-2. Sequoyah Nuclear Plant, Surveillance Instruction S1-46, Component Cooling Water Pumps, April 28, 1982.
| |
| A.4-37
| |
| | |
| I i
| |
| 0 E
| |
| F-l i
| |
| i 1
| |
| L k
| |
| l e
| |
| 7 i
| |
| I L
| |
| b t
| |
| I.
| |
| n I
| |
| e l
| |
| l i
| |
| l 1
| |
| l
| |
| | |
| A.5 COMPRESSED AIR SYSTEM A.S.1 Introduction and Summary A.5.1.1 System Definition.
| |
| A.5.1.1.1 Overview. The Sequoyah compressed air system (CAS) .is designed to supply high quality pressurized air for instrumentation and valve operations. It is a common system shared by Unit 1 and Unit 2 and is divided into three subsystems: the control air system, the service air system, and the auxiliary control air system. The system basically consists of air compressors to pressurize the air, receivers to store the air, and dryers to reduce the moisture and oil contamination level in the air.
| |
| Figure A.5-1 illustrates the compressed air system in a simplified block diagram.
| |
| During normal plant operation, the CAS is operational with all three subsystems pressurized. Of the four control air compressors, typically three out of four are running. In addition, all three control air dryers and both auxiliary control air dryers are working. Although designed for a standby mode during normal operation, the auxiliary compressors run constantly to meet the required air pressure of 84 psig.
| |
| A.5.1.1.2 Puroose. This analysis is performed to determine the probability of success of the CAS with respect to safety and availability. The system is modeled using the GO computer code for evaluation of both models.
| |
| Success of the availability model requires that three of the four control air compressors be operable and that compressed air flow not be prohibited from reaching the distribution headers. For the safety model, success is a supply of compressed air being delivered from either auxiliary train A or D. The model generates success probabilities at the system level based on probabilities at the component level.
| |
| A.5.1.2 Analysis Boundary Conditions. The CAS has both safety and availability functions. The models for both functions have the following boundary conditions (specific assumptions which may add further significance to the following boundary conditions are described in Section A.5.3.1.1):
| |
| e The analysis is based on the normal system operation, e The support systems (electric power, ambient air, and essential raw cooling water) are considered to be 100% available (variations A.5-1
| |
| | |
| i i
| |
| AUXILLARY CONTROL AIR m AUXILIARY i
| |
| COMPRESSOR B-B 7 RECEIVER B-B TRAIN AUXILIARY 4 DRYER i
| |
| TRAIN B-B i
| |
| SAFETY A RELATED CONTROL AIR COMNNENE COMPRESSOR A ^
| |
| TRAIN CONTROL AIR DRYER N -
| |
| " NORMAL OPE RATION RECElVER TRAlNA RELATED COMPONENTS I
| |
| TRAIN 1 TRAIN B
| |
| 'i' CONTROL AIR COMPRESSOR B TRAIN CONTROL AIR DRYER
| |
| < 4 RECEIVER > TRAIN C "' '
| |
| ! TRAIN 2 T
| |
| CONTROL AIR COMPRESSOR C TRARN SERVICE AIR DRYER NORMAL OPERATION RECEIVER 4 A TRAIN B > RELATED COMPONENTS TRAIN 3 TRAIN A 7
| |
| .l
| |
| ' RELATED CONTROL AIR COMPRESSOR D A COMPONENTS TRAIN TRAIN A 1 AUXILIARY j i r--> DRYER TRAIN A-A
| |
| ! AUXILIARY CONTROL AIR m AUXILIARY j COMPRESSOR A-A 7 RECEIVER A-A TRAIN i
| |
| l Figure A.5-1. Sequoyah Compressed Air System Simplified Block Diagram
| |
| /
| |
| 1
| |
| | |
| i 1
| |
| !~
| |
| in operability of different support systems and their impact on L other s models)ystems are handled in the plant availability and safety
| |
| . o Only automatic actions are included in this analysis. No credit i is taken for operator actions to recover failed equipment or to provide flow from an alternate source over the period of this analysis, o The system is modeled to the supply headers of the CAS and not to the actual conponents supplied, o Common cause failures are not modeled, o The operability of the service air subsystem (except for its isolation capability) is not quantified in the system model because it has an insignificant effect on safety or availability.
| |
| ~
| |
| Figure A.5-2 illustrates the system boundary conditions.
| |
| t
| |
| ' A.5.1.3 ' System Analysis Results.
| |
| t' l A.5.1.3.1 Quantification of conditional failure states. The probability of l
| |
| failure during a safety related action is 8.13 x 10-7 The computed unavailability is 1.89 x 10-3, i
| |
| These numbers are for the CAS with all support systems operable (the values i reflect GO_ computer code output). The quantification of system success probabilities under varying support system states is treated in the plant models for safety and availability.
| |
| , A.S.I.3.2 Dominant contributors to unavailability.
| |
| .A.5.1.3.2.1 Availability model. The major contributors to CAS unavailability are second order fault sets. Of these fault sets, 42 of the leading contributors are listed in Table A.5-1. The 42 fault sets are made up of various groupings of three component types and contribute about 99% of the system failure probability (or unavailability). Table A.5-2 illustrates
| |
| ; a ranking in order of importance of those three components. Importance is defined as the ratio of the sum of all fault set unavailabilities containing l
| |
| a particular component type to the total system unavailability. From the table, it is evident that the air compressors are the prime sources of unavailability.
| |
| A.5-3
| |
| | |
| S S T T N N E
| |
| DE E EN Y CI TO T VAP E RLM E EO F
| |
| A SRC S y
| |
| s
| |
| \ iIl l IIgIIil IIIIII
| |
| / n
| |
| \ / o i
| |
| \ / t i
| |
| d n
| |
| . J C o
| |
| - - y r
| |
| a
| |
| - d M
| |
| E Y - T N
| |
| n u
| |
| o E ST R A - E B
| |
| - C I Y VS I M E
| |
| a I B R m RR LI X TS - MI AA e
| |
| - EI SA U -
| |
| t s
| |
| A S y S
| |
| r
| |
| - i I A
| |
| - p d
| |
| . - s e
| |
| s
| |
| - e r
| |
| RY L - p E P WP - m o
| |
| OU PS - - C 1
| |
| - - t i
| |
| n
| |
| ~ U h
| |
| ~ - a y
| |
| - G o
| |
| - u S . YN q T .
| |
| M CIL e N N L E - NO S LIO DE - OS T . E OR A TEN G C ATOg RY TS a -
| |
| R E .
| |
| M RAP .
| |
| . EWT 2 R ELM NR OI - MAA 5 OPEO CA ERW NORC - - A e
| |
| - - r u
| |
| - - i g
| |
| F p %
| |
| / N
| |
| / / lIllIIgII! lI Iil\
| |
| \
| |
| * Ya
| |
| !!' )' lll ll
| |
| | |
| Table A.5-1 SEQUOYAH UNIT 1 CONTROL AIR SYSTEM AVAILABILITY MODEL LEADING CONTRIBUTOR FAULT SETS (All Support Systems Assumed Working)
| |
| Single Number Approximate Approximate Fault Sets Failure of Total Percent of Probability Combinations Failure Total Failure
| |
| , P robability - Probability
| |
| ; 'm in Air Compressors (two) - 2.35-4 6 1.41-3 72.8 Air Compressor, Air Compressor Maintenance - 2.81-5 12 3.37-4 17.4 Air Cogressor, Relief Valve - 1.20-5 12 1.44-4 7.4 Air Compressor Maintenance, Relief Valve 1.43-6 12 1.72-5 0.9 i
| |
| Total 42 1.91-3 98.6 NOTE: Exponential notation is indicated in abbreviated form; i.e., 2.35-4 = 2.35 x 10-4 l
| |
| i
| |
| | |
| . . = _ _ . _ - ... -
| |
| l Table A.5-2 SEQUOYAH CONTROL AIR SYSTEM AVAILABILITY COMPONENT IMPORTANCE LIST Approximate te Component Total Probability ^PP"
| |
| ,ta Ss Component Type Prob b ty o a ig '
| |
| c t"$'
| |
| i Component Air Compressors - 1.53-2 1.90-3 98.3
| |
| . Air Compressors' 1.83-3 3.52-4 18.3 Maintenance Relief Valves 7.84-4 1.65-4 8.5
| |
| ; NOTE: Exponential notation is indicated in abbreviated form; i.e.,
| |
| 1.53-2 = 1.53 x 10-Z.
| |
| i i
| |
| A.5-6 I
| |
| | |
| A.5.1.3.2.2 Safety Model. The major contributors to CAS failure in a safety mode are second order fault sets. The three leading contributors are listed in Table A.5-3, and consist of only two component types which contribute about 96% of the system failure probability (or unavailability).
| |
| Table A.5-4 shows the importance of those two components. From the table, it can be seen that the auxiliary dryers are the most important components.
| |
| A.S.2 System Description A.S.2.1 Accident Mitigation. The CAS is designed to maintain a continuous supply of high quality, moisture and oil free compressed air to pneumatic operators and equipment under all operating conditions. In the event of a loss of control air, the auxiliary control air system automatically supplies all essential loads.
| |
| The system is designed to operate in the range of 80 to 100 psig. If the pressure drops below 80 psig, service air will isolate from the system. The auxiliary control air system, which runs continuously in order to maintain the proper air pressure, will isolate from the control air system at 78 psig. Thus, the accident mitigation function of the CAS is to deliver a continuous supply of air to components needed to safely shut down the unit.
| |
| I A.S.2.2 Success Criteria. For plant availability, only the control air system is modeled. Neither service air nor auxiliary control air is necessary for !
| |
| normal plant operation. In the control air system,100% operation requires no pipe breaks in critical places, three out of four control air compressor /aftercooler trains operatinj, two* out of three functioning dryer l trains, and no plugging or blockage at critical points.
| |
| The safety model success criterion requires that one of the two auxiliary control air trains deliver compressed air for use by safety related equipment. This requires no combinations of pipe breaks or plugging at critical points, and sufficient air compressor capacity from either the control air or auxiliary control air compressors. Specifically, this requires one of two auxiliary air compressors and one dryer train or two of four control air compressor trains and two of three control air dryer trains, l
| |
| *The model was set up and quantified with only one of three dryer trains required. Since this does not impact the demonstration of GO methodology, it j was not included, j A.5-7
| |
| | |
| l l
| |
| l Table A.5-3 SEQUOYAH CONTROL AIR SYSTEM SAFETY M00EL LEADING CONTRIBUTOR FAULT SETSa (All Support Systems Assumed Working)
| |
| Approximate Approximate Single Number Total Pment of Fault Sets Failure of Failum Total Failum Probability Combinations Probability Probability p
| |
| T
| |
| * Dryers (2-ACAS) 7.64-7 1 7.64-7 95.3 Dryer (ACAS), Afterffiter (ACAS) 1.69-8 2 3.37-8 4.0 Total 3 7.98-7 95.5 aIn this table only, ACAS means auxiliary control air system. Also a number 2 in parentheses after a component name means the fault set contains two items.
| |
| NOTE: Exponential notation is indicated in abbreviated form; i.e., 7.64-7 = 7.64 x 10-7
| |
| | |
| Table A.5-4 SEQUOYAH CONTROL AIR SYSTEM SAFETY MODEL COWONENT IWORTANCE LISTa Approximate mximat Component Total Probability CongMment Type Failure of Fault Sets II3 Probability Containing
| |
| { CosqMment f ]'
| |
| 4 Dryer (ACAS) 8.74-4 8.97-7 99.9 Afterfilter (ACAS) 1.93-5 3.71-8 4.3 aIn this table only. ACAS means auxiliary control air system.
| |
| NOTE: Exponential notation is indicated in abbreviated form; i.e.,
| |
| 8.74-4 = 8.74 x 10-4
| |
| | |
| A.S.2.3 System Configuration. System configuration is shown in Figure A.5-3.
| |
| The control air system is supplied by four compressor trains taking their air supply from ambient sources and discharging into two redundant headers. Each of these two headers feeds a control air receiver which, in turn, supplies air through a comon header to the three dryers and to the service air system. The dryers supply two independent headers which serve nonessential reactor building loads and trains A and B of the auxiliary ccntrol air system.
| |
| Service air has its own receiver which is pressurized from the control air system. Service air is then piped from the receiver to service outlets and miscellaneous equipment throughout the plant.
| |
| The auxiliary control system is separated into two independent trains each I containing its own compressor, receivers, dryers, and filters. Each train's compressor is normally in operation. While the desired mode is to have the auxiliary compressors in a standby mode, plant conditions do not always allow this. When not already in operation, the auxiliary control air compressor starts if the control air system does not supply adequate compressed air. There is a check valve and an automatic flow control valve to isolate the auxiliary control air system from the control air in this event. The auxiliary control air system channels compressed air from either the control air system or its own compressor to a receiver and then through dryers. The compressed air is then supplied to train A or B of each unit's reactor building and auxiliary building essential air headers.
| |
| A.S.2.3.1 Mtjor components. The compressed air system model contains eight types of components: filters, compressors, receivers, accumulators, aftercoolers, valves, dryers, and instrumentation. Below are brief outlines of some of the major components, and Table A.5-5 lists all the major components used in the model, e Af tercoolers (control air system). The control air system
| |
| ~iiffUcoolers cool Ehe air after It has been compressed. They are located downstream of the compressor and there is one af tercooler for each compressor. They are the shell and tube type models which are cooled with water from the essential raw cooling water (ERCW) system. The shell side is made of carbon steel with a design pressure of 150 psig and a flow rate of 610 scfm (air). The tube side is made of admiralty with a design pressure of 150 psig. The design code is ASME VIl!.
| |
| A.5-10
| |
| | |
| I'
| |
| : n. .
| |
| ..t....s..
| |
| H J -
| |
| A O r-- ,
| |
| 4 .c .
| |
| L a v a m *
| |
| .w aa . . . . , .
| |
| .+: .*
| |
| l xm ... .. . . . _ , . . . m g
| |
| o [] %
| |
| 'v .* *""
| |
| n,.. .u
| |
| . = n ., . , , . , , , .
| |
| e n .= .n um a n. O ==
| |
| #.. l x%...3. ,...
| |
| -- o 6= ==. . . . . .
| |
| ., ==
| |
| .. X- 'l i-
| |
| .. u
| |
| -4+-04--
| |
| ==
| |
| m :j ' " "
| |
| .V . *
| |
| -D4-l X. ,
| |
| ={,
| |
| o
| |
| #:* l x.==>. ,.;.-
| |
| +
| |
| M -<!;.i -
| |
| +
| |
| .X W. .....
| |
| o
| |
| .=
| |
| X==
| |
| e eu
| |
| - J ;Jr jr %
| |
| .n
| |
| .n..,
| |
| .n. m a u
| |
| ^ y **""'
| |
| .v . ,
| |
| .P X. .
| |
| -E"H>o--
| |
| ==
| |
| .. om .. .= o .= .=
| |
| d'"'"
| |
| "" 0"*""
| |
| g =FI"H ; - E.,,,,,'a= o -
| |
| , x"
| |
| , = . -
| |
| ,a, u
| |
| *==
| |
| rO M-v' 3, - .
| |
| ;>,g ... .. . .,,
| |
| .h M .' AURIu.4T GWE01.s.
| |
| _[ ... ..
| |
| m m
| |
| sp -.
| |
| av N1. ..
| |
| == 1 Figure A.5-3. Sequoyah Compressed Air System Schematic
| |
| < A.5-11 m
| |
| | |
| I i
| |
| .7
| |
| ,. .. .. .. :==~- - -
| |
| q x.
| |
| e.
| |
| .~:. n --
| |
| o l
| |
| x- g 3_#
| |
| - ~
| |
| __o p-- _
| |
| v m ._.
| |
| -x m =r-
| |
| -x ~x - _ . - - ca__ r
| |
| : x. . -
| |
| m ._.
| |
| - - - -- O -
| |
| o p--
| |
| x x _ .>_ - - - -
| |
| APERTURE o -
| |
| C,ATID o
| |
| ~ ~ . . . -.
| |
| ==. ==. ,,-:1 @- .--
| |
| Also Available On j &. ._, Aperture Card n.... .m .v. . .D 8 ..
| |
| $ f/c o fd220 d f
| |
| | |
| Tabla A.5-5 l
| |
| MAJOR COMPONENTS USED IN THE COMPRESSED AIR SYSTEM MODEL i
| |
| 1 i (Sheet 1 of 4l l
| |
| Component g,
| |
| ,,,,"c, Function Failure Mode. Availability Model Failure Mode. Safety Model l
| |
| Accumulator. Auxillary A-A 4N648-1 Store Compressed Air --
| |
| Plug, Rupture Accumulator. Auxiliary 8-8 4N848-1 Store Compressed Air --
| |
| Plug. Rupture Aftercooler A 4N846-1 Cool Air from Compressor Plug, Rupture Plug,Ruptdre Aftercooler. 8 4N846-1 Cool Afr from Compressor Plug, Rupture Plug Rupture Aftercooler, C 4N846-1 Cool Air from Compressor Plug Rupture Plug, Rupture Aftercooler. D 47W846-2 Cool Af r from Compressor Plug, Rupture Plag. Rupture Aftercooler Assillary A-A 47W848-1 Cool Air from Compressor --
| |
| Plug. Rupture Aftercooler. Auxilfary 8-8 4N648-1 Cool Air from Compressor --
| |
| Plug. Rupture l Compressor. A 4N846-1 Provide Air Pressure and Flow Fati to Start and Operate Fatt to Start and Operate Compressor 8 4N846-1 Provide Air Pressure and Flow Fall to Start and Operate Fati to Start and Operate Compressor, C 4N846-1 Provide Air Pressure and Flow Fail to Start and Operate Fall to Start and Operate Compressor D 4N646-2 Provide Air Pressure and Flow Fall to Start and Operate Fall to Start and Operate Compressor. Auxiliary A-A 4N648-1 Provide Air Pressure and Flow -- Fall to Start and Operate Compressor. Auxiliary 8-8 47W848-1 Provide Air Pressure and Flow --
| |
| Fatt to Start and Operate 3=
| |
| , Dryer A 4N848-1 Dry Air to -40*F Dew Point Plug, Rupture Plug, Rupture
| |
| . Dryer, 8 47W848-1 Dry Air to -40*F Dew Point Plug, Rupture Plug. Rupture q Dryer. C 4N848-1 Dry Air to -40*F Dew Point Plug. Rupture Plug. Rupture Dryer. Auxiliary A-A 47W848-1 Dry Air to -40*F Dew Point --
| |
| Plug Rupture. Start Dryer. Auxfilary 8-8 4N848-1 Dry Air to -40*F Dew Point --
| |
| Plug, Rupture. Start Filter. Afterfilter A 4N648-1 Filter Air Plug Plug Filter. Afterfilter 8 4N848-1 Filter Air Plug Plug Filter. Af terfilter C 4N848-1 Filter Air Plug Plug Filter. Aux 111ary After- 4N848-1 Filter Air --
| |
| Plug filter A-A Filter, Aust11ary After- 4N848-1 Filter Air --
| |
| Plug filter 8-8 Filter. Inlet 4N848-1 Filter Af r --
| |
| Plug Auxiliary A.A F11ter. Inlet 4N648-1 Filter Afr --
| |
| Plug Auxiliary 8-8 Filter. Intde A 4N846-1 Filter Air Plug Plug Filter. Intd e B 47W846-1 Filter Air Plug Plug Filter. Inta e C 47W846-1 Filter Air Plug Plug Filter. Intd e D 4N846-2 Filter Air Plug Plug Filter. Intd e 47W848-1 Filter Air --
| |
| Plug Aust11ary A-A Filter. Intd e 47W848-1 Filter Af r --
| |
| Plug Aust11ary 8-8 Filter. Prefilter A 47W848-1 Filter Air Plug Plug Filter Prefilter 8 47W848-1 Filter Air Plug Plug Filter Prefilter C 47W848-1 Filter Air Plug Plug
| |
| | |
| i e
| |
| Table A.5-5 (continued)
| |
| -(Sheet 2 of 4)
| |
| ' Component. gNa Function Failure Mode Availability Model Failure Mode, Safety Model ne Instrumentation, 4N610-32-1 Compressor Function Control Fail to Operate Fall to Operate Compressor A
| |
| . Instrumentation, 4N610-32-1 Compressor Function Control Fall to Operate Fati to Operate Compressor B Instrumentation, 4N610-32-1 Compressor Function Control Fall to Operate Fall to Operate Compressor C Instrumentation, 47W610-32-3 Compressor Function Control Fail to Operate Fati to Operate Compressor D instrumentation, . 4N610-32-2 Compressor Function Control --
| |
| Fall to Operate Cospressor Auxiliary A-A Instrumentation, 47W610-32-2 Compressor Function Control --
| |
| Fall to Operate Compressor Auxiliary B-B Instrumentation. Dryer A 47W610-32-1 Dryer Sequence Control Fall to Operate Fall to Operate Instrumentation, Dryer B 47W610-32-1 Dryer Sequence Control Fail to Operate Fall to Operate Instrumentation, Dryer C 47W610-32-3 Dryer Sequence Control Fall to Operatt Fail to Operate Instrumentation, Dryer 4N610-32-2 Dryer Sequence Control --
| |
| Fall to Operate Auxiliary A-A Instrumentation, Dryer A 47W610-32-2 Dryer Sequence Control --
| |
| Fail to Operate
| |
| ? Auxiliary B-B c1 Instrumentation, 47W610-32-1 Isolation Valve Fati to Operate Fail to Operate i
| |
| w FCV 32-32 Instrumentation, 47W610-32-1 Isolation Valve Fall to Operate Fall to Operate FCV 32-37 .
| |
| Instrumentation, 47W610-32-1 Isolation Valve Fall to Operate Fall to Operate FCV 32-42 .
| |
| Instrumentation, 4N610-32-3 Isolation Valve --
| |
| Fail to Operate FCV 32-61 Instrumentation, 4N610-32-2 Isolation Valve -- Fail to Operate FCV 32-87 Instrumentation, 47W610-32-2 Isolation Valve Fail to Operate Fall to Operate FCV 32-137 Instrumentation, 47W610-32-1 Isolation Valve Fail to Operate Fail to Operate FCV 33-4 Instrumentation, Relay 47611-32-1 Sequences Compressor Fail to Operate, Fati on Demand Fall to Operate Receiver,1 - Control Air 47W610-32-1 Stores Compressed Air Rupture Receiver, 2 - Control Air Rupture 47W610-32-1 Stores Compressed Air Rupture Rupture Receiver, Auxiliary A-A 47W848-1 Stores Compressed Air --
| |
| Rupture Receiver, Auxiliary B-B 47W848-1 Stores Compressed Air --
| |
| Rupture Valve, Check, 0-32-249 47W848-1 Prevent Backflow Valve, Check, 0-32-262 Fall Closed 47W848-1 Prevent Backflow --
| |
| Fall Closed Valve, check. 0-32-264 47W848-1 Prevent Backflow Valve, Check. 0 32-312 47W848-1 Fall Closed Fail to Operate Prevent Backflow --
| |
| Fall Closed. Fall to Operate Valve, Check. 0-32-324 47W848-1 Prevent Backflow Valve, Check, 0-32-333 Fati Closed 47W848-1 Prevent Backflow --
| |
| Fail Closed
| |
| | |
| s
| |
| . Table A.5-5'(continued)
| |
| (Sheet 3 of 4)
| |
| Component gff,f,j, Function Failure Mode, Availability Model Failure Mode, Safety Model Valve, Flow Control 32-82 47W848-1 Isolation Valve -- Fall Closed, Fati to Operate
| |
| < Valve, Flow Control 32-85 4N848-1 Isolation Valve -- Fail Closed. Fail to Operate Valve, Gate. 0-32-515 4 N846-1 Isolation Valve Transfer Closed Plug Transfer Closed, Plug . '
| |
| Valve, Gate, 0-32-516 47W846-1 Isolation Valve Transfer Closed, Plug Transfer Closed. Plug Valve, Gate, 0-32-517 4N846-1 Isolation Valve Transfer Closed, Plug Transfer Closed Plug Valve, Gate. 0-32-518 47W846-1 Isolation Valve Transfer Closed, Plug Transfer Closed. Plug Valve, Gate. 0-32-519 4N846-1 Isolation Valve . Transfer Closed, Plug Transfer Closed. Plug Valve, Gate, 0-32-520 4N846-1 Is% tion Valve Transfer Closed, Plug Transfer Closed Plug Valve, Gate. 0-32-530 47W846-1 Isolation Valve Transfer Closed Plug Transfer Closed Plug Valve, sate. 0-32-531 47W846-1 Isolation valve Transfer Closed Plug Transfer Closed Plug Valve, Gate. 0-32-534 4N846-1 Isolation Valve Transfer Closed Plug Transfer Closed Plug Valve, Gate, 0-32-535 4N846-1 1 solation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate. 0-32-542 47W846-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug '
| |
| Valve, Gate. 0 32-543 4N846-1 Isolation Valve Transfer Closed Plug Transfer Closed Plug Valve, Gate. 0-32-545 47W846-1 Isolation Valve Transfer Closed Plug Transfer Closed. Plug Valve, Gate, 0-32 561 4N846-2 Isolation Valve Transfer Closed, Plug . Transfer Closed, Plug Valve, Gate. 0-32-562 4N846-2 Isolation Valve Transfer Closed Plug Transfer Closed, Plug Valve, Gate, 0-32-567 4N846-2 Isolation Valve Transfer Closed Plug Transfer Closed Plug
| |
| > Valve, Gate, 1-67-680 - 47W845-4 Isolation Valve -- Transfer Closed. Plug Valve, Gate, 1-67-683 4N845-4 Isolation Valve -- Transfer Closed, Plug ha Valve, Gate, 2-67-680 4N845-4 Isolation Valve -- Transfer Closed, Plug Isolation Valve Transfer Closed. Plug Z Valve, Gate, 2-67-683 Valve, Gate, 32-206 4N845-4 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Ple)
| |
| Valve, Gate, 32-207 4 N848-1 Isclation Valve Transfer Closed Plug Transfer Closed Plug Valve, Gate, 32-208 4N848-1 - Isolation Valve Transfer closed Plug Transfer. Closed Plug Valve, Gate, 32-212 47W848-1 Isolation Valve Transfer Closed. Plug Transfer Closed. Plug Valve, Gate, 32-213 47W848-1 Isolatio9 Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-214 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed Plug Valve, Gate, 32-221 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed Plug -
| |
| Valve, Gate, 32-223 47W848-1 Isolation Valve Transfer Closed. Plug Transfer Closed Plug Valve, Gate 32-225 4N848-1 Isolation Valve Transfer Closed Plug Transfer Closed. Plug
| |
| , Valve, Gate, 32-228 4N848-1 Isolation Valve Transfer closed, Plug Transfer Closed, Plug Valve, Gate, 32-229 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed. Plug Valve, Gate, 32 231 47W848-1 Isolation Valve Transfer Closed, Plug ~ Transfer Closed. Plug Valve, Gate, 32-236 4N848-1 Isolation Valve Transfer Closed. Plug Transfer Closed, Plug Valve, Gate, 32-237 47W848-1 Isolation Valve Transfer Closed. Plug Transfer Closed. Plug Valve, Gate, 32-239 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-247 4N848-1 Isolation Valve Transfer Closed, Plug Transfer Closed Plug Valve, Gate, 3*-248 4N848-1 Isolation Valve Transfer Closed Plug Transfer Closed, Plug Valve, Gate, 32-251 4N848-1 Isolation Valve -- Transfer Closed, Plug Valve, Gate, 32-310 47W848-1 Isolation Valve -- Transfer Closed, Plug Valve, Gate, 32-450 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-451 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-452 47W848-1 Isolation Valve Transfer Closed. Plug Transfer Closed. Plug Valve, Gate, P-454 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, W 56 47W848-1 Isolation Valve Transfer Closed Plug Transfer Closed. Plug
| |
| | |
| L Table A,5-5 (continued)
| |
| (Sheet 4 of 4)
| |
| Component , ,[, Function Failure Mode, Availability Model Failure Mode, Safety Model Valve, Gate, 32-459 4N848-1 Isolation Valve ' Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-460 47W848-1 Isolation Valve Transfer Closed. Plug Transfer Closed, Plug Valve, Gate, 32-461 4N848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-463 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 32-464 47W848-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 393 47W848-3 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 400 47W848-3 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 627A 47W848-2 Isolation Valve Transfer Closed Plug Transfer Closed, Plug Valve, Gate, 6278 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 627C 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 627D 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 636A 47W845-5 Isolation Valve Transfer Closec, Plug Transfer Closed, Plug Valve, Gate, 6368 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 636C 4N845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 6360 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Gate, 700 47W848-9 Isolation Valve Transfer Closed Plug Transfer Closed, Plug Valve, Gate, 707 47W848-9 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug
| |
| ,# Valve, Gate, 748 47W848-9 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug m Valve, Globe, A1 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug d., Valve, Globe, A2 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug m Valve, Globe, B1 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, B2 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, C1 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed Plug Valve, Globe, C2 47W610-32-1 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, D1 4N610-32-3 Isolation Valve Transfer Closed Plug Transfer Closed, Plug Valve, Globe, D2 47W610-32-3 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, 632A 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, 6328 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Globe, 632C 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed Plug Valve, Globe, 6320 47W845-5 Isolation Valve Transfer Closed, Plug Transfer Closed, Plug Valve, Pressure Control. 47W846-1 Isolation Valve Fail to Close Fail to Close 33-4 Valve Solenoid 32-32 47W610-32-1 Isolation Valve Fail to Open, Transfer Close11 Fall to Open. Transfer Closed.
| |
| Plug Plug Valve, Solenoid 32-37 47W610-32-1 Isolat hn Valve Fati to Open, Transfer Closed. Fall to Open, Transfer Closed Plug Plug Valve, Solenoid 32-42 47W610-32-1 Isolation Valve Fall to Open, Transfer Closed. Fall to Open, Transfer Closed Plug Plug Valve, Solenoid 32-137 47W610-32-3 Isolation Valve Fail to Open, Transfer Closed Fati to Open, Transfer Closed Valve, Relief A 47W610-32-1 Relieve Overpressure Premature Opening Premature Opening Valve, Relief 8 47W610-32-1 Relieve Overpressure Premature Opening Premature Opening Valve, Relief C 47W610-32-1 Relieve Overpressure Premature Opening Premature Opening Valve, Relief D 47W610-32-3 Relieve Overpressure Premature Opening Premature Opening
| |
| | |
| e--
| |
| o - Aftercoolers-(auxiliary control air system). The auxiliary controT air system aftercoolers cool tne air after it has been compressed. They are located downstream of the compressor and there is one aftercooler for each compressor.
| |
| They are the shell and tube type models which are cooled with
| |
| ' ERCW. - The shell side is designed to pass 3.5 gpm (water)
| |
| .with a discharge temperature of 105*F.
| |
| e Compressors (control air system). The control air system compressors use ambient, filtered air to supply the compressed air needs of the-system.- They are of the
| |
| - motor-driven, nonlubricated, two-stage, reciprocating type with a design pressure of 150 psig, a capacity of 610 scfm,
| |
| 'and a design discharge temperature of 270*F and pressure of 100 psig.
| |
| e Compressors (auxiliary control air system). The auxiliary control- air compressors use ambient air from a nonfiltered area to supply compressed air for the auxiliary system when required. : Each compressor can supply the loads for a single train, which is capable of bringing either unit to a safe, shutdown condition. They are of the motor-driven, nonlubricated, two-stage, reciprocating type with a capacity of 78 scfm and a design discharge temperature of 400*F and
| |
| ' pressure of 100 psig.
| |
| e Dryers. The air dryers are dual chamber units with a 6-minute operating cycle on each chamber. An automatic timer controlling the solenoid valves in the dryer unit allows one chamber to be aligned to the airflow path while moisture is removed from the air in the other chamber.
| |
| 4 e- Receivers.-- The air receivers serve as reservoirs to equalize ,
| |
| system response to sudden demands and to reduce the air compressor loading cycles during normal- operation. The one l service and two-control- air receivers each have a capacity of 266 cubic feet. Each of the auxiliary control air receivers has a capacity of 34 cubic feet.
| |
| ~
| |
| - A.S.2.3.2 Support systems. The compressed air system requires a supply of ambient air and two support systems to function. The two support systems are the essential raw cooling water system and the electric power system.
| |
| -Ambient air is supplied to the. system through six intake filters, essential raw cooling water provides cooling to all six compressors and aftercoolers, and the electical system' supplies power-to various components. Table A.5-6
| |
| - lists all major components and.their power sources.
| |
| ; , A.5-16
| |
| | |
| Table A.5-6 SEQUOYAH UNIT 1 COMP 0NENT ELECTRICAL POWER SUPPLY Component- Main Power Instrument Compressor, A 480V AC Shutdown Board 1A2-A 125V DC Vital Battery Component 3D Board II Compressor, B 480V AC Shutdown Board 181-B 125V DC Vital Battery Component 3D Board II Compressor, C 480V AC Auxiliary Building, 125V DC Vital Battery Common Board, Component 6D Board II Compressor, D 125V DC Vital Battery 480V AC Auxiliary Common BuildingED Board, Component Board II Compressor, 480V AC Containment and Auxiliary , 120V AC Vital Auxiliary A-A Building Vent Board 281-B Instrument Power Board 1-I Compressor, 480V AC Containment and Auxiliary 120V AC Vital Auxiliary B-B Building Vent Board 281-B Instrument Power Board 1-II Dryer, A 120V AC Distribution Panel 1-A Dryer, B 120V AC Distribution Panel 1-A Dryer, C 120V AC Distribution Panel 1-A Dryer, Auxiliary A-A 120V AC Instrument Power Board 1-I Dryer, Auxiliary B-B - 120V AC Instrument Power Board 1-II
| |
| ' Relay 125V DC Vital Battery Board II Valve Flow 120V AC Vital Instrument Power control 32-82 Board I-I Valve, Flow 120V AC Vital Instrument Power Control 32-85 Board I-II Valve, Pressure 33-4 120V AC, Instrument Power Panel 1-M-7, A Rack, Breaker 28 Valve, Solenoid 32-32 125V DC Vital Battery Board II Valve, Solenoid 32-37 125V DC Vital Battery Board II Valve, Solenoid 32 125V DC Vital Battery Board II Valve, Solenoid 32-61 120f AC Vital Board 1-1 Valve, Solenoid 32-87 120V AC Vital Board 1-II Valve, Solenoid 32-137 125V DC Vital Battery Board II (1.
| |
| A.5-17
| |
| , -. - - m
| |
| | |
| A.S.2.3.3 Interfacing systems. The compressed air system supplies air to hundreds of components throughout the plant and thus interfaces with many systems. The major piping heads it supplies are shown below.
| |
| 4 e Critical (necessary for safety but not for nonnal operation)
| |
| --Reactor Building 1, Train A Air Header
| |
| --Reactor Building 1, Train B Air Header
| |
| --Reactor Building 2, Train A Air Header
| |
| --Reactor Building 2, Train B Air Header
| |
| --Essential Auxiliary Building, Train A Air Header
| |
| --Essential Auxiliary Building, Train B Air Header .
| |
| (The critical loads include: the auxiliary feedwater level control valves, main steam atmospheric relief valves, auxiliary building gas treatment control and isolation dampers, emergency gas treatment system, and HVAC valves and dampers.)
| |
| e- Noncritical (necessary for nonnal operation only)
| |
| --Nonessential Reactor Building 1, Air Header
| |
| --Nonessential Reactor Building 2, Air Header
| |
| --Nonessential. Auxiliary Building Air Header e Service (not necessary for either safety or normal ,
| |
| operation). Service Air Header A.5.2.4 System Operation.
| |
| A.5.2.4.1 Normal operation. Under normal operating conditions, the CAS supplies air to those components requiring air for general power
| |
| . production. Typically, three of the four control air compressors are running, as are all three dryers.
| |
| The auxiliary control air system compressor and dryers are nonnally running
| |
| , while the plant is in nonnal operation. While this is not the desired mode of operation for the auxiliary control air system, plant conditions cause the system to typically function in this manner.
| |
| I A.5-18
| |
| | |
| A.5.2.4.2~ Event response.
| |
| A.5.2.4.2.1 Automatic actions. The compressed air system is designed to operate automatically. The primary automatic functions are listed as below, o The service air system is automatically isolated from the rest of the compressed air system when the pressure drops below 80 psig. This is done by closing valve 0-PCV-33-4.
| |
| e The control air compressors are designed to trip on high oil temperature or low oil pressure.
| |
| o The control air compressors load in a predetermined order based on the position of the sequence selector switch.
| |
| e Control air and auxiliary control air dryer trains are automatically operated as described in Section A.5.2.3.1 of this report.
| |
| e The auxiliary control air system compressor starts when the control air system pressure drops below 84 psig; the auxiliary system is-isolated from the control system when the pressure drops below 78 psig.
| |
| e The ERCW system isolates itself from the control air and auxiliary control air compressors automatically when not needed for cooling, e The system has built-in relief valves which automatically open when the pressure inside the system exceeds 115 psig.
| |
| The relief valves are located between each compressor and aftercooler, on each air receiver, on each dryer unit in the control air system, and on each receiver in the auxiliary system.
| |
| A.5.2.4.2.2 Manual operator actions. The CAS runs continuously and requires a minimal amount of operator action. In this study, operator actions were not included.
| |
| A.S.2.5 Controls, Indicators, and Alanns. The locations of major controls, indicators, and alarms for the CAS are shown in Table A.5-7.
| |
| A.5.2.6 Testing, Inspection, and Surveillance Requirements. There are no testing, inspection, or surveillance requirements.
| |
| A.S.2.7 Maintenance Requirements. The CAS compressors are routinely overhauled every 6 months as part of the preventive maintenance program. This maintenance usually requires about 8 hours per compressor.
| |
| A.5-19
| |
| | |
| Table A.5-7 SEQUOYAH UNIT 1 CONTROL AIR SYSTEM COMPONENT CONTROLS, INDICATORS, AND ALARMS Main Component Function Local Control Room Compressor, A Temperature Alarm X X Compressor, B Pressure Alarm X X ,
| |
| Compressor, C Hand Switch Control X Compressor, D l Compressor, Auxiliary A-A Temperature X Compressor, Auxiliary B-B Level (oil) Alarm X X Hand Switch X Dryer, A Pressure X Dryer, B Hand Switch X Dryer, C Flow X Dryer, Auxiliary A-A Pressure X Dryer, Auxiliary B-B Flow X Prefilter, A -Pressure X Prefilter, B Prefilter, C Receiver,1 (Control Air) Pressure X Receiver, 2 (Control Air)
| |
| Receiver, Arxiliary (Control Air A)
| |
| Receiver, Auxiliary (Control Air B)
| |
| - Receiver, Service Air, 3 Valve, Flow Control 32-82 Pressure X Valve, Flow Control 32-85 Hand Switch X Valve, Gate 32-236a Pressure X
| |
| . Valve, Gate 32-247a Flow X Moisture Alarm X Valve, Globe 32-266a Moisture Alarm X X Valve, Globe 32-331a Pressure Alann X X Valve, Pressure 33-4 Pressure X Hand Switch X Position Alarm X aIn the proximity of this component but not directly related to it.
| |
| A.5-20
| |
| | |
| A.S.2.8_ Technical Specifications Effect on Operation. There are no technical specifications that apply to the CAS.
| |
| A.S.3 System Logic Model A.S.3.1 Success Criteria Definition.
| |
| A.S.3.1.1 Analysis assumptions. The following assumptions were made in the evaluation of the CAS.
| |
| e The plant is operating at nonnal power for the availability model and is operating at normal . power just prior to any event in the safety model.
| |
| I e Electric power and ERCW are present with a probability of 1.0. Failure of these two systems will be dealt with in the
| |
| , plant availability and safety models.
| |
| e' Only the system's automatic actions are included in the analysis. No credit is taken for operator action to recover from any situation.
| |
| e Common cause is not evaluated.
| |
| e The probabilities of damage to pipes, taps for pressure indicators, drain valves, small bypass lines, and cross-connections that are normally closed or that could potentially be closed are not quantified since the values are relatively small.
| |
| e Three out of four control air compressors are necessary for the availability model. The safety model requires two out of four control air compressors or one out of two auxiliary control air compressors to be successful.
| |
| e Availability model-requires two out of three dryer trains.
| |
| Safety models require one out of three dryer trains (see Section A.S.2.2).
| |
| A.S.3.1.2 Interface with plant logic models. The control air system is necessary for plant operation and the failure of the system will cause an initiating event. This event could come in a number of forms because of the air system's interaction with so many other systems. One of the first effects of loss of air would probably be the closure of feedwater regulating valves. This would cause loss of feedwater, which would result in an initiating event. Thus, the availability of the plant is directly linked to the operability of the control air system.
| |
| A.5-21 o
| |
| | |
| The CAS is used in the safety model since it serves components necessary for safe shutdown of the unit. Some of these components are: the auxiliary feedwater level control valves, the main steam atmospheric relief valves, the auxiliary building gas treatment control and isolation dampers, the emergency gas treatment system, and the HVAC valves and dampers.
| |
| A.S.3.2 System G0 Model. The CAS safety and availability G0 models are shown in Figures A.5-4 and A.5-5, respectively. Figure A.5-6 contains the supertypes for both models. The component modeling chart for both GO models is shown in Table A.5-8.
| |
| Only the significant parts of the system were modeled in Figures A.5-4, A.5-5, and A.5-6. Taps for pressure indicators, drain valves, small bypass lines, and pipe breaks were not modeled because they would add significant model
| |
| . complication but only negligible quantitative value. In addition, manual cross-connections were not modeled. They were omitted because there are no technical specifications requiring them to be open and recovery actions are not
| |
| - explicitly quantified.
| |
| In viewing Figures A.5-4 and A.5-5 in comparison with the schematic in Figure A.5-3, it is obvious that in many instances the GO model cannot be a duplicate of a schematic. The workings, interactions, and requirements of a system mandate a much more in-depth analysis. One notable example is the interaction between the control air compressors and receivers.
| |
| l Most component success / failure data was inserted into the model by type 5 signal generators or type 1 two-state component models. A perfect type 5 operator initiates the system. The notable exception was for test and maintenance which )
| |
| used a type _4 multiple signal generator. This was necessary because testing and maintenance are performed only on one compressor train at a time and this restriction had to be put into the model.
| |
| Five supertypes were also used tio represent the control air compressor train, the auxiliary control air compressor train, the control air receiver train, the control air dryer train, and the auxiliary control air dryer train. The flow of both the availability and safety CAS models go from a perfect initiator, to the compressors, to the receivers, to the dryers, and finally to the distribution headers.
| |
| A.5-22
| |
| | |
| A
| |
| (
| |
| A 82 83 99 III to 102 103 104 101 201 3 2 COMPRESSOR N MAINTEN ANCE l l
| |
| .5 G G 032430 0 32 631 99 102 100 101 2 530 2 32 83 100 1II * -l
| |
| ;0 102 103 504 tot 201 3 2 .
| |
| 405 tos I i 10 CA5 85 I I AMalENT 39 RE LA y 85 AtR 5 ;
| |
| a GV 11 143 1 73 0 -
| |
| 10 0 32 631 3
| |
| ~
| |
| 82 83 101 3 2 545 lII
| |
| * cy 10210J 104 32451 5%8
| |
| ~
| |
| 101 2 01 7 2
| |
| - 10 1-73 ic IM 106 I
| |
| .I0 in50 e5 eV 032431 y,2430 GV 3
| |
| O N WF 02 03 102 COMPRE550R 10 l l l 102 103 104 UART SY 2 101 ing 201 1-235 2
| |
| $2 E RCW TR AIN A 105 i t0108 43 E RCW TRAIN O 10 84 120V AC DiST PANEL 1 A l l gy 03263, 55 125V M VITAL BATTERV B 36 31 86 120V AC VIT AL INST POWEP 43 SF 120V AC VIT AL INST POWE P 37 GV 48 480V AC 5DS 1 A2 A.COMPC' 120 0-32430 39 da0V AC SDe 1818. COMPO*-
| |
| 101 201 5 82 90 da0V AC AuxluARy SLOG
| |
| ] GW O'22 00I 91 480V AC AUMILIARY OLDG e
| |
| $7 AURILIARY TR AIN A ACTUd 98 AUXILIARY TRAIN 8 ACTUA
| |
| \'> ST SYSTE M 120 tNI T A TION 101 201 h e
| |
| i Figure A.5-4. Sequoyah Compressed Air System GO Safety Model i
| |
| i 1
| |
| )
| |
| ^ 5-2 7T/o o 76 zIo -h 1
| |
| | |
| P-b
| |
| /
| |
| M B l
| |
| .7 - 0 '''.02 -n 1 -83 n
| |
| d.ff0 io b 03 0 - .7 A
| |
| w l- GV GV GV GV GV 102 g'
| |
| 103- 87
| |
| ? 2' t.73 1 73 9-73 1 73 105 10e - 87 l.- .5: 1-73 32 247 32 248 400 707 748 GV 3--
| |
| '. s.73 2 10 gy 32 231 32464 i ^ 3g, - 42 2 ST GV 130 1 73 2 10 3
| |
| 32-463 ,
| |
| GV GV GV GW
| |
| , gi 103-M i 301 ; '2 1-73 5 73 j 1 73 l-73 10,hfo to.-M tL ... . m3, ,,, . - TI
| |
| \PERTURE
| |
| -- ,0. 2. , ,0 --
| |
| CATfD
| |
| ;;, ,03 -n n-,. ,,, ic7 -n a
| |
| l
| |
| ., Also Available On Aperture Card
| |
| ); ..
| |
| gag gg % . b
| |
| * nonno s e poano s.n
| |
| , 'lllf ?*r,t.->T."
| |
| Elef 30 I.4 lesT 3D DmIIsOed 80,ConAPO8sENT 60
| |
| [ +[ '''
| |
| ,"> ' ' #-- t
| |
| ~+
| |
| 4.'
| |
| DesnIO80 90.,C0asPO8stse7 to - > f Feose ssG8eAL J NOfe SeOfeAL [
| |
| ' ' f ,s, t4 ,
| |
| 524, * '
| |
| ( 't E
| |
| f
| |
| | |
| , , - . . . .~. -= .-, - . . _ .. ~. _ . . _
| |
| l t
| |
| 42M COMPRE$$QR
| |
| ' UAIN1ENANCE
| |
| (. :
| |
| i 38 102 i '100 101 A
| |
| 84 102 tot 20t 2 i
| |
| ST 130 -
| |
| GV 8 32"'
| |
| 84 1 73 l
| |
| 143 1 73 to tot 201 1 73 GV D' PCV GV -.
| |
| db n
| |
| 33 4 0 32 545 1 73 5 C-GV ,
| |
| l 2463 102 1
| |
| 10 - I 73 101 201 11* I-73 l 73 I-73 1 73 57 GV W j - 32450 gj3 GV cv GV GV 32 236 32 237 32 393 32 700 e
| |
| 11 2 E RCW TRA6N A 83 ERCW TRAIN 8 84 120V ACOIST PANEL i A 85 125V DC VITAL SATTERY 80ARO la 86 ' 120V AC VITAL INST POWER 80ARD 14 87 820V AC VI7 AL INST POWE R 80ARD t is 88 480V AC SDS 1 A2 A. COMPONENT 30 89 480V AC 5081818 COMPONE NT 3D '
| |
| 90 480V AC AUXILIARY 8 LOG COMMON 80. COMPONENT 60 91 480V AC AUXILIARY SLDG COMMON 80. COMPONENT 80 97 AUXtLIARY TR AIN A ACTUATION $1GN AL 98 AUXILIARY TRAIN 8 ACTUATION 5sGNAL
| |
| .'THIS DOESSEE QUANTIFIEO NOT Rf F LECT SECTION A 5 2 2THE MODEL Figure A.5-5. Sequoyah Compressed Air System G0 Availability Model A.5-24 M s e o to a to - og
| |
| | |
| ^* _ . . . _.
| |
| 42X y
| |
| 82 8J gg III 30 99 802 303 804 '
| |
| t=
| |
| tot 20, a 2
| |
| , 205 ,,
| |
| I I 10 45 gg C
| |
| 0 32 530 GV a 32 530 g
| |
| 5 82 82 83 tCO III to 102 103 104 tot 20t CAs -
| |
| 85 f to AMe:ENT 85 AIR RELAY 89 c
| |
| * 32 538 343 c
| |
| 82 83 101 3/4 G pcv III to 802toa804 8
| |
| tot 05 207 2 2 105 in I I 10 85 30 ov 542 0 32 531
| |
| ~25-n25., ,
| |
| 82 82 to, 52 OR 10 57 y 802 103 1
| |
| : g. ' #* *'
| |
| O 2 2 g[9 l0 85 ST 9t GV 0-32 53) to S4/2 GVV ogghkt 101 201 b 5 82 M gd GV O 32 567 QtfW g ST 120 tot 201 --
| |
| 3
| |
| . - - - , , ~ . , . - . - , . - - , , e- -,.-,---mw, ,,- y g v
| |
| | |
| - - _ _ . . _ - ~ - -
| |
| e surERn ,Etes to2 103 R.s? Te2 CORTItOL A4R SV87EM CDesftE.OR$ ,ERCW pgqut a g,,,,
| |
| ^
| |
| .8 O gy PRE)sLTER gy gy tot OR.ER 0 73 1 73 SM 2 0 73 9-71 8 73 t 73 to see A. C, 5 GLw 432 Sv 527 32 230 - A, E, a 32 221 32 223
| |
| ' FSw A. 3, C, D ' A, S. C. O- 3242 3244 32404 3 f 1 77 1 73 1 73
| |
| ' 323u5 A,9,,
| |
| MM 32 m
| |
| , y . St. Ct. Dt A2, 82. C2. 02 gy -
| |
| t-73 1-70 1-73 1-73 .
| |
| 632420 '
| |
| SUPERTYPE 130 32 229 , A, S 32 220 32 225 TROLMRORv8R5 tot 301 324st 324e0 3249e 471 10 IN 1-73 1 345 10 0 75 E-73 9 32 214 32 213 32 212 g
| |
| jb
| |
| .esT EYERaa g ' _ Ant .RE . .Gw32 . RELi.f
| |
| .A E f _A8 TE R.R - CV.
| |
| A80%
| |
| A,5 C,0 S32 6te A,8, C,0 A a. C. D e-32 een I surERYvet teo '83 COMPRE.BOR 6424 t p # #4 pCy e OssET AURE8ARV COesTROL AIR 0ftvERS POguE R 8'33888 p' ' anottvE -
| |
| bdOYevt e POeutR POU8ER AeR COMPREB90R gy gg qr pey cy d. y gag gag tes MAsseT E seAseC8 t-73 9-71 te set 1 232 1 73 3 2R - ERo.E 9 9. = = ERC,E =
| |
| . Aunt.ARvcO= TROL Ani 85v oy 32m sy os. AA . 324s 32 392 (J) A RAIR B COMPRE3 BORE A8eD RECEfvfR$ 04760 147483 32451 3242 32 284 q
| |
| 8 24780 24763 m ,n, 1. 9. ..,3 1.,, , 2 n
| |
| 102 3247 gggy AFTER 4est? tes
| |
| ,,Lg, AFTER ACCUtsuLATOft ' RE LIEF pgg, y PGL y pgg y pKTEft DRYER COnePREtsOR COOL ER COesPRE ssOR CW REC VER WALVE
| |
| $ 79 10 tes 9 239 E-79 9-122 1-79 1M ' '' ED I'N' " (
| |
| AA. ge AA, pg AA. 50 AA,0s 33423 ACARA ACAR A 32m 32m t 32 325 Se se sess? 32 369 ACARS ' ACAR S 32 2F9 32470 32 ass . AA AA POeuER esOffvf
| |
| : 1. .r.ogutR i SupERTVpf 120 COfgTROL AIR RECEfVERS RE lef f Ow RECEtvgR VALv5 GW
| |
| = Set En 97 U
| |
| G 32435 94243e V.CAR 4 0
| |
| U. V.
| |
| CAR-t CAR 2 632 643 632442 Figure A.5-6. Sequoyah Compressed Air System GO Supertypes
| |
| | |
| 4 O
| |
| Table A.5-8 y
| |
| n *
| |
| 'SEQUOYAH COMPRESSED AIR SYSTEM
| |
| }/f G0 COMPONENT MODELING CHART p
| |
| Type-Kind Component' Unavailability 5-1' System Initiation 0.00 1-71 Filter 1.93-5 1-72 Air Compressor .
| |
| 1.51-2 1-73 Valve, Gate or Globe 1.08-6 1-75 Aftercooler 3.48-5 1-76 Valve, Check 1.93-5
| |
| '1-77 Valve, Solenoid 4.70-6 1-78 Instrument, Relay 1.65-6 1-79 Accumulator, Receiver 7.98-7 1-80 Dryer (control air) 8.74-4 1-81 Valve, Flow Control 2.50-5 5-82 Valve, Gate 1.08-6 1-83 Valve, Pressure Control 3.40-3 1-84 ' Compressor (auxiliary) 1.51-2 1-121 Dryer (auxiliary) 8.74-4 1-122 Valve, Check 2.05-5 1-123 Solenoid (auxiliary) . 4.70-6 4-230_ Air Compressor Maintenance 1.83-3 1-2311 Aftercooler (auxiliary) -3.61-5 1-232 Check Valve 1.08-6 1-235 Compressor (start only) 1.02-3 1-245' Re1ief Valve 7.84-4 Others Electric, Start 0.00 Signals, Ambient Air, and ERCW Water Supply t
| |
| i NOTE: Exponential notation is indicated in abbreviated form; i.e., 1.93-5 = 1.93 x 10-5.-
| |
| 4 l
| |
| +
| |
| l 4
| |
| h.
| |
| A.5-26
| |
| | |
| A.5.4 Quantification of System Unavailability A.5.4.1 ' Hardware Failure Contribution.
| |
| A.5.4.1.1 Active components. Lists of all the components and their unavailability contributions are shown in Tables A.5-9 and A.5-10.
| |
| Table A.5-9 shows the availability model and Table A.5-10 shows the safety model. In both models, the probability of failure of the compressors to perform successfully is the sum of the probability of the compressors to fail to start on demand and failure during operation. For relief valves, dryers, and the instrument relay, the probability of failure is based on failure to operate; for the flow control valves, check valves, pressure valves, and the solenoid valves, the probability is based on failure to move I to the correct position and stay there.
| |
| A.S.4.1.2 Passive components. Passive system components such as open gate valves, accumulators, aftercoolers, filters, receivers, and globe valves which do not change position are modeled. They do not perform an active function, but there is the possibility that they could affect the system.
| |
| An example would be a nomally open gate valve transferring closed. This is a very unlikely case as is typical of most passive failures. These passive components are also included in Tables A.5-9 and A.5-10. No passive components such as piping, structures, or supports are considered in this analysis.
| |
| A.5.4.2 Test and Inspection Contribution. At the time of the analysis, no written instructions were available for testing or inspecting the CAS.
| |
| A.S.4.3 Maintenance Contribution. The unavailability for each control air compressor due to maintenance is about 1.83 x 10-3 (see Section A.5.2.7).
| |
| A.5.4.4 Safety and Unavailability Quantification. Based on contributions from the components and maintenance, the failure in a safety related function was calculated to be 1.69 x 10-0 and the unavailability during operation is 5.28 x 10-3, A.5-27
| |
| | |
| 4 -
| |
| Table A,5-9
| |
| [
| |
| .SEQUOYAH COMPONENT UNAVAILABILITY RATES (Availability Model) ;
| |
| (Sheet 1 of 4)
| |
| GO Failure Demand Failure HTTR Unava11a-Component Per Hour Per Hour (hour)
| |
| Type-Kind Per Demand bility-Accoulator Auxiliary A-A NA Accumulator, Auxiliary B-B NA 4 Aftercooler, A 1-75 6.69-7 52 3.48-5 Aftercooler, B 1-75 6.69-7 52 3.48-5 Aftercooler, C 1-75 .6.69-7 52 3.48-5 Af tercooler, 0 1-75 6.69-7 52 3.48-5 Aftercooler, AJxiliary A-A NA Af tercooler, Auxiliary B-B NA
| |
| * Compressor, A 1-72 2.90-4 52 1.51-2'
| |
| . Compressor, B - 1-72 2.90-4 52 1.51-2 Compressor, C 1-72 2.90-4 52 -1.51-2 Compressor, D ' 1-72 2.90-4 52 1.51-2 l Compressor Auxiliary A-A NA Compressor, Auxiliary B-B NA
| |
| - Compressor. 0 (start only) 1-235 4.70-4 1/ day 52 1.02-3
| |
| , Dryer, A 1-80 3.64-5 24 8.74-4 Dryer, B 1-80 3.64-5 24 8.74-4 Dryer, C 1-80 3.64-5 24 8.74-4 Dryer, Auxiliary A-A - NA Dryer, Auxiliary B-B . NA ;
| |
| 1 Filter, Afterfilter A 1-71 8.76-6 2.2 1.93-5
| |
| * Filter, Af terfilter. B 1 8.76-6 2.2 1.93-5 Filter, Afterfilter C . 1-71 8.76-6 2.2 1.93-5
| |
| ' Filter, Afterfilter Auxiliary A-A NA i Filter, Af terfilter Auxiliary B-B NA Filter, Inlet A-A NA' i .. Filter. Inlet B-B hA Filter, Intake A 1-71 8.76-6 2.2 1.93-5 Filter, Intake B 71 '8.76-6 2.2 - - 1.93-5 Filter Intake C 1-71 8.76-6 2.2 1.93-5 Filter, Intake D 1-71 8.76-6 2.2 1.93-5 Filter, Intake Auxiliary A-A NA Filter, Intake Auxiliary B-B . NA -
| |
| Filter, Prefilter A 1-71 8.76-6 2.2 1.93-5 Filter, Pref 11ter B . 1-71 8.76-6 2.2 1.93 5 Filter,- Prefilter C . 1-71 8.76-6 2.2 1.93-5~
| |
| Instrumentation, Relay. 1-78 3.11-7 5.3 1.65-6 j
| |
| Receiver,-1 1-79 -2.66-8 30 7.98-7 Receiver, 2 1-79 2.66-8 30 ~7.98-7 Receiver Auxiliary 1 NA Receiver, Auxiliary 2.- NA Receiver, Service. NA -
| |
| g Valve, Check. 0-32-249 NA Valve, Check, 32-264 - NA Valve, Check, 32-312 NA -
| |
| Valve, Check. 0-32-333 NA Valve, Check,-0-32-568 1-76 6.42-7 .30 1.93-5 Valve, Check, 0-32-569 1-76 6.42-7 30 1.93-5 Valve, Check. 0-32-570 .1-76 6.42-7 30 1.93-5 Valve, Check. 0-32-571 1-76 6.42-7 30 1.93-5 e
| |
| NOTE: Exponential notation is indicated in abbreviated form; i.e., 6.69-7
| |
| * 6.69 x 10-7 i.
| |
| A,5-28
| |
| | |
| Table A.5-9 (continued)
| |
| (Sheet 2 of 4)
| |
| Component GO Failure Demand Failure MTTR- Unavaila-Type-Kind Per Demand Per Hour Per Hour (hour) bility
| |
| ' Valve, Flow Control 32-82 - NA Valve, Flow Control 32-85 NA Valve, Gate 0-32-515 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-516 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-517 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-518 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-519 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-520 1-73 3.36-8 32 1.08-6 l' Valve, Gate 0-32-530- 5-82 3.36-8 32 1.08-6 Valve, Gate 0-32-531 5-82 3.36-8 32 1.08-6 l' Valve, Gate 0-32-534 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-535 1-73 3.36-8 32 1.08'-6 Valve, Gate 0-32-542 1-73 3.36-8 32.. 1.08-6 o Valve, Gate 0-32-543 1-73 3.36-8 - 32 1.08-6
| |
| (- Valve, Gate 0-32-514 1-73 3.36-8 32 1.08 6 Valve, Gate 0-32-545 1-73 3.36-8 32 1.08-6 Valve, Gate.0-32-561 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-567 5-82 3.36-8 32 1.08-6 Valve, Gate 0-32-500 Valve, Gate 0-32-501 NA .
| |
| Valve, Gate 0-32-606' NA Valve, Gate 1-67-680 NA Valve, Gate 1-67-683 NA Valve, Gate 2-67-680 NA Valve, Gate 2-67-683 NA
| |
| -Valve, Gate 32-206 1-73 3.36-8 32 1.08-6 Valve, Gate 32-207 1-73 3.36-8 32 1.08-6 Valve, Gate 32-208 1-73 3.36-8 32 1.08-6 Valve, Gate 32-212 1-73 3.36-8 32 1.08-6 Valve, Gate 32-213 1-73 '3.36-8 32 1.08-6 Valve, Gate 32-214 1-73 3.36-8 32 1.08-6 Valve, Gate 32-221 1-73 3.36-8 32 1.08-6
| |
| . Valve, Gate 32-223 1-73 3.36-8 32 1.08-6
| |
| . Valve, Gate 32-225- 1-73 3.36-8 32 1.08-6
| |
| -Valve, Gate 32-228 1-73 3.36-8 32 1.08-6 Valve, Gate 32-229 1-73 3.36-8 32 1.08-6 Valve, Gate 32-231 1-73 3.36-8 32 1.08-6 Valve, Gate 32-231 5-82 3.36-8 32 1.08-6 Valve, Gate 32 236- 1-73 3.36-8 32 1.08 Valve, Gate 32-237 73 3.36-8 32 1.08-6 Valve, Gate 32-239 1-73 3.36-8 32 1.08-6 Valve, Gate 32-247 NA Valve, Gate 32-248. NA Valve, Gate 32-251 1-73 -3.36-8 32 1.08-6 Valve, Gate 32-310 NA Valve, Gate 32-398 - NA Valve, Gate 32-450 5-82 3.36-8 32 . 1.08-6 Valve, Gate 32-451 1-73 3.36-8 32 1.08-6 Valve, Gate 32-452 1-73 3.36-8 32 1.08-6 Valve, Gate 32-454 1-73 3.36-8 32 1.08-6 Valve, Gate 32-456 1-73 3.36-8 32 1.08-6
| |
| ' Valve, Gate 32-459 1-73 3.36-8 32 1.08-6 Valve, Gate 32-460 1-73 3.36-8 32 - 1.08-6 Valve, Gate 32-461 1-73 3.36-8 32 1.08-6 Valve, Gate 32-463 1-73 3.36 32 1.08-6
| |
| ' Valve, Gate 32-464 1-73 3.36-8 32 1.08-6
| |
| .Yalve, Gate 32-393 1-73 3.36-8 32 1.08-6' NOTE: Exponential notation is indicated in abbreviated form; i.e., 3.36-8 = 3.36 x 10-8, A.5-29 a
| |
| | |
| Table A.5-9 (continued)
| |
| L5heet 3 of 4)
| |
| GO Failure Demand Failure MTTR Unavaila-omp nent Type-Kind Per Demand Per Hour Per Hour (hour) bility
| |
| -Valve, Gate 32-400 NA
| |
| - Valve, Gate 32-408 NA Valve, Gate 32 627A' 1-73 3.36-8 32 1.08-6 Valve, Gate 32-6278 1-73 3.36-8 32 1.08-6
| |
| * Valve, Gate 32-627C 1-73 3.36-8 32 1.08-6 Valve, Gate 32-627C 1-73 3.36-8 32 1.08-6
| |
| -Valve, Gate 32-636A 1-73 3.36-8 32 1.08-6 Valve, Gate 32-6368 1-73 3.36-8 32 1.08-o Valve, Gate 32-636C 1-73 3.36-8 32 1.08-6 Valve, Gate 32-6360 1-73 3.36-8 32 1.08-6 Valve, Gate 32-700 1-73 3.36-8 32 1.08-6 Valve, Gate 32-704 NA Valve, Gate 32-706 NA
| |
| . Valve, Gate 32-707 hA Valve, Gate 32-708 NA Valve, Gate 32-740 NA Valve, Gate 32-748 NA
| |
| . Valve, Gate 32-764 NA Valve, Gate 32 765 NA Valve, Gate 32 779 NA Valve, Gate 32 782 NA Valve, Gate 32-783 NA Valve, Globe Al 1-73 3.36-8 32 1.08 6 Valve, Globe A2 1-73 3.36-8 32 1.08-6 Valve, Globe 81 1-73 3.36-8 32 1.08-6 Valve, Globe 82 1-73 3.36-8 32 1.08-6 Valve, Globe C1 73 3.36-8 32 1.08-6 i 1.08-6 Valve, Globe C2 1-73 3.36-8 32 Valve, Globe 01 - 1-73 3.35-8 32 1.08-6 Valve, Globe D2 - 1-73 3.36-8 32 1.08-6 Valve, Globe 32-261 1-73 NA Valve, Globe 32-266 NA Valve, Globe 32-270 NA Valve, Globe 32-271 NA Valve, Globe 32-322 1 73 NA Valve, Globe 32-325 NA Valve, Globe 32-330 NA Valve, Globe 32-331 NA
| |
| - Valve, Globe 632A 1-73 3.36-8 32 1.08-6 Valve, Globe 6328 1-73 3.36-8 32 1.08-6 Valve, Globe 632C 1-73 3.36-8 32 1.08-6 Valve, Globe 6320 1-73 3.36-8 32 1.08-6 Valve, Pressure 33-4 1-83 3.40-3 1 per 32 4.14-6 Valve, Solenoid 32-32 1-77 1.47-7 32 4.70-6 Valve, Solenoid 32-37 1-77 1.47-7 32 4.70-6 Valve Solenoid 32-42 1 77 1.47-7 32 4.70-6 NA Valve. Solenoid 32-61 Valve, Solenoid 32-87 NA Valve, Solenoid 32-137 1-77 1.47-7 32 4.70-6 Valve, Relief A 1-245 2.45-5 32 7.84-4 Valve, Relief 8 1-245 2.45-5 7.84-4 Valve, Relief C 1-245 2.45-5 7.84-4 Valve Relief D 1-245 2.45-5 7.84-4 NOTE: Exponential notation is indicated in at,breviated form; f.e., 3.36-8 = 3.36 x 10-8, a8ase derived from availability analysis results of similar s Approximate unavailability (including human error) of 1 xand 10-grvice a valve air systems repair time ofevaluated 32 hours. by PLG.
| |
| A.5-30
| |
| | |
| Table A.5-9 (continued) i Sheet 4 of 4)
| |
| Component GO Failure Demand Failure MTTR Unavaila-Type-Kind Per Demand Per Hour Per Hour (hour) bility Valve, Relief Al NA Valve, Relief A2 NA Valve, Relief B1 NA Valve, Relief B2 NA Valve, Relief Cl NA Valve, Relief C2 NA Valve, Relief ACAR-A NA Valve, Relief ACAR-80 NA Valve, Relief CAR-1 NA Valve, Relief CAR-2 NA Valve, Relief SAR-3 NA A,5-31
| |
| | |
| Table A,5-10 SEQUOYAH COMPONENT UNAVAILABILITY RATES (Safety Model)
| |
| (Sheet 1 of 4)
| |
| Component GO Failure Demand Failure MTTR Unavail a-Type-Kind Per Demand Per Hour Per Hour (hour) bility Accumulator, Auxiliary A-A 1-79 2.66-8 30 7.98-7 Accumulator, Auxiliary B-B 1-73 2.66-8 30 7.98-7
| |
| -Aftercooler, A 1-75 6.69-7 52 3.48-5 Aftercooler, B 1-75 6.69-7 52 3.48-5 Aftercooler, C 1-75 6.69-7 52 3.48-5 Aftercooler, D 1-75 6.69-7 52 3.48-5 Aftercooler, Auxiliary A-A 1-231 6.69-7 54 3.61-5 Aftercooler, Auxiliary B-B 1 231 6.69-7 54 3.61-5 Compressor, A 1-72 2.90-4 52 1.51-2 Compressor, B 1-72 2.90-4 52 1.51-2 Compressor, C 1-72 2.90-4 52 1.51-2 Compressor, D 1-72 2.90-4 52 1.51 2 Compressor. Auxiliary A-A 1-84 2.90-4 52 1.51-2 Compressor, Auxiliary B-B 1-84 2.90-4 52 1.51-2 Dryer A 1-80 3.64-5 24 8.74-4
| |
| ' Dryer, B 1-80 3.64-5 24 8.74-4 Dryer, C 1-80 3.64-5 24 8.74-4 Dryer, Auxiliary A-A 1-121 3.64-5' 24 8.74-4 l Dryer, Auxiliary B-B 1 121 3.64-5 24 8.74-4 i Filter, Af terfilter A . 1-71 8.76-6 2.2 1.93-5 filter Af terfilter B 1-71 8.76-6 2.2 1.93-5 Filter, Af terfilter C 1-71 8.76-6 2.2 1.93-5 Filter, Af terfilter Auxiliary A-A 1 71. 8.76-6 2.2 1.93-5 Filter Afterfilter Auxiliary B-B 1-71 8.76-6 2.2 1.93-5 Filter, Inlet A-A 1-71 8.76-6 2.2 1.93-5 Filter, Inlet B-B 1-71 8.76-6 2.2 1.93-5 Filter, intake A 1-71 8.76 6 2.2 1.93-5 Fliter, Intake B 1-71 8.76-6 2.2 1.93-5 Filter, Intake C 1-71 8.76-6 2.2 1.93 5 Filter, Intake D 1 71 8.76-6 2.2 1.93 5 Filter, Intake Auxiliary A-A 1-71 8.76-6 2.2 1.33-5 Filter, intake Auxiliary B-B 1-71 8.76-6 2.2 1.93-5 Filter, Prefilter A 1-71 8.76-6 2.2 1.93-5 Filter, Prefilter B 1-71 8.76-6 2.2 ~ 1.93-5 Filter, Pref 11ter C 1-71 8.76-6 2.2 1.93-5 Instrumentation, Relay 1-78 3.11-7 5.3 1.65-6 Receiver, 1 1-79 2.66-8 30 7.98-7 Receiver, 2 1-79 2.66-8 30 7.98-7 Receiver Auxiliary 1 1-79 ^ 2.66-8 30 7.98-7 Receiver Auxiliary 2 1-79 2.66-8 30 7.98-7 Receiver, Service NA Valve, Check. 0-32-249 1-122 6.42-7 32 2.05 5 Valve, Check, 32-264 (lla 1-232 3.36-8 32 1.08-6 Valve, Check, 32-312 (lla 1 232 3.36-8 32 1.08-6 ,
| |
| Valve, Check. 0-32-333 1-122 6.42 7 ' 32 2.05 5 !
| |
| aThese components have two dissimilar failure modes. Each is modeled separately. (1) is the
| |
| . " transfer closed" failure mode and (2) is the " failure to isolate" mode.
| |
| ' NOTE: Exponential notation is indicated in abbreviated form; 1.e., 2.66-8 = 2.66 x 10-8, A.5-32
| |
| | |
| Table A,5-10 (continued)
| |
| (Sheet 2 of 4)
| |
| Component GO Failure Demand Failure MTTR Unavaila-
| |
| ' Type-Kind Per Oemand Per Hour Per Hour (hour) bility Valve, Check. 0-32 568 1-76 6.42-7 30 1.93-5
| |
| ; Valve, Check, 0-32-569 1-76 6.42-7 30 1.93-5 Valve, Check, 0-32-570 1-76 6.42-7 30 1.93-5 Valve, Check. 0-32-571 1-76 6.42-7 30 1.93-5 Valve, Flow Control 32-82 1-81 7.82-7 32 2.50-5 Valve, Flow Control 32-85 1-81 7.82-7 32 2.50-5 Valve, Gate 0 32-515 1-73 3.36-8 32 1.08-6 Valve, Gate 0 32-516 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-517 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-518 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-519 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-520 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-530 5-82 3.36-8 32 1.08-6 Valve, Gate 0-32-531 5 82 3.36-8 32 1.08-6 Valve, Gate 0-32-534 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-535 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-542 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-543 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-544 1-73 3.36 8 32 1.08 6 Valve, Gate 0-32-545 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-561 1-73 3.36-8 32 1.08-6 Valve, Gate 0-32-567 5-82 3.36-8 32 1.08-6 Valve, Gate 0-32-500 NA Valve, Gate 0-32-501 NA Valve, Gate 0-32-606 NA Valve, Gate 1-67-680 1-73 3.36 8 32 1.08-6 Valve, Cate 1-67-683 1-73 3.36-8 32 1.08-6 Valve, Gate 2-67-680 1 73 J.36-8 32 1.08-6 Valve, Gate 2-67-683 1 73 3.36-8 32 1.08-6 Valve, Gate 32 206 1-73 3.36-8 32 1.08-6 Valve, Gate 32-207 1-73 3.36-8 32 1.08-6 Valve, Gate 32-208 1 73 3.36-8 32 1.08-6 Valve, Gate 32-212 1-73 3.36-8 32 1.08-6 Valve, Gate 32-213 1-73 3.36-8 32 1.08-6 Valve, Gate 32 214 1-73 3.36-8 32 1.08-6 Valve, Gate 32-221 1-73 3.36-8 32 1.08-6 Valve, Gate 32-223 1-73 3.36-8 32 1.08-6 Valve, Gate 32 225 1-73 3.36-8 32 1.08-6 Valve, Gate 32-228 1-73 3.36-8 32 1.08-C Valve, Gate 32-229 1-73 3.36-8 32 1.08-6 Valve, Gate 32 231 1-73 3.36-8 32 1.08-6 Valve, Gate 32-231 5-82 3.36-8 32 1.08-6 Valve, Gate 32-236 1-73 3.36-8 32 1.08-6 Valve, Gate 32-237 1-73 3.36-8 32 1.08-6 Valve, Gate 32 239 1-73 3.36-8 32 1.08-6 Valve, Gate 32-247 1-73 3.36-8 32 1.08-6 Valve, Gate 32-248 1-73 3.36 8 32 1.08-6 Valve, Gate 32-251 1-73 3.36-8 32 1.08-6 Valve, Gate 32-310 1-73 3.36-8 32 1.08-6 Valve, Gate 32-398 NA NOTE: Exponential notation is indicated in abbreviated form; f.e., 6.42-7 = 6.42 x 10-7 A.5-33
| |
| | |
| Table A.5-10 (continued)
| |
| (Sheet 3 of 4)
| |
| Component GO Failure Demand Failure HTTR Unavalla.
| |
| Type-Ki nd Per Demand Per Hour Per Hour (hour) bility Valve, Gate 32-450 5-82 3.36-8 32 1.08-6 Valve, Gate 32-451 1-73 3.36-8 32 1.08-6 Valve, Gate 32-452 1-73 3.36-8 32 1.08-6 Valve, Gate 32-454 1-73 3.36-8 32 1.08-6 Valve, Gate 32-456 1-73 3.36-8 32 1.08-6 Valve, Gate 32-459 1-73 3.36-8 32 1.08-6 Valve, Gate 32-460 1-73 3.36-8 32 1.08-6 Valve, Gate 32 461 1-73 3.36-8 32 1.08-6 ,
| |
| Valve, Gate 32-463 1-73 3.36-8 32 1.08-6 Valve. Gate 32-464 1-73 3.36 8 32 1.08-6 Valve, Gate 32-393 1-73 3.36-8 32 1.08-6 '
| |
| Valve, Gate 32-400 1-73 3.36-8 32 1.08-6 Valve, Gate 32-408 NA ;
| |
| Valve, Gate 32-627A 1-73 3.36-8 32 1.08-6 i Valve, Gate 32-6278 1-73 3.36-8 32 1.08-6 Valve, Gate 32-627C 1 73 3.36-8 32 1.08-6 Valve, Gate 32-627C 1-73 3.36-8 32 1.08-6 Valve, Gate 32-636A 1-73 3.36-8 32 1.08 6 Valve, Gate 32-6368 1-73 3.36-8 32 1.0G-6 Valve, Gate 32-636C 1-73 3.36 8 32 1.08-6 Valve, Gate 32-6360 1-73 3.36-8 32 1.08-6 Valve, Gate 32-700 1-73 3.36-8 32 1.08-6 Valve, Gate 32 704 NA Valve, Gate 32-706 NA Valve, Gate 32-707 1-73 3.36-8 32 1.08-6 Valve, Gate 32-708 NA Valve, Gate 32-740 NA Valve, Gate 32-748 1-73 3.36-8 32 1.08-6 Valve, Gate 32-764 Na Valve, Gate 32-765 NA Valve, Gate 32-779 NA Valve, Gate 32-782 NA Valve, Gate 32-783 NA Valve, Globe Al 1-73 3.36-9 32 1.08-6 Valve, Globe A2 1-73 3.36-d 32 1.08-6 Valve, Globe 81 1-73 3.36-8 32 1.08-6 Valve, Globe 82 1-73 3.36-8 32 1.08-6 Valve, Globe C1 1-73 3.36-8 32 1.08-6 Valve, Globe C2 1-73 3.36-8 32 1.08-6 Valve, Globe D1 1-73 3.36-8 32 1.08-6 Valve, Globe D2 1 73 3.36-8 32 1.08-6 Valve, Globe 32-261 1-73 3.36-8 32 1.08-6 Valve, Globe 32-266 1 73 3.36-8 32 1.08-6 Valve, Globe 32-270 1-73 3.36-8 32 1.08-6 Valve, Globe 32-271 1-73 3.36-8 32 1.08-6 Valve, Globe 32-322 1-73 3.36-8 32 1.08 6 Valve, Globe 32-325 1-73 3.36-8 32 1.08-6 Valve, Globe 32-330 1-73 3.36-8 32 1.08-6 Valve, Globe 32-331 1-73 3.36-8 32 1.08-6 Valve, Globe 632A 1-73 3.36-8 32 1.08-6 Valve, Globe 6328 1-73 3.36-8 32 1.08-6 Valve, Globe 632C 1-73 3.36-8 32 1.08-6 Valve, Globe 6320 1-73 3.36-8 32 1.08-6 Valve, Pressure 33-4 1-83 3.40-3 one only 3.40-3 NOTE: Esponential notation is indicated in abbreviated form; f.e., 3.36-8 = 3.36 x 10-8, A.5-34
| |
| | |
| O-Table A.5-10 (continued)
| |
| ($heet 4 of 4)
| |
| Component GO Failure Demand Failure MTTR Unavaila-Type-Kind Per Demand Per Hour Per Hour (hour) bility Valve, Solenoid 32-32 1-77 1.47-7 32 4.70-6 Valve, Solenoid 32-37 1-77 1.47-7 32 4.70-6 Valve, Solenoid 32-42 1-77 1.47-7 32 5.70-6 Valve. Solenoid 32-51 1-123 1.47-7 32 4.70-6 Valve, Solenoid 32-87 1-123 1.47 7 32 4.70-6 Valve, Solenoid 32137 1-77 1.47 7 32 4.70-6 Valve, Relief A 1-245 2.45-5 32 7.84-4 Valve, Relief 8 1-245 2.45-5 7.84-4 Valve, Relief C 1-245 2.45-5 7.84-4 Valve, Relief D 1-245 2.45-5 7.84-4 Valve, Relief Al NA Valve, Relief A2 NA Valve, Relief 81 NA Valve, Relief 82 NA Valve, Relief C1 NA Valve, Relief C2 NA talve, Relief ACAR-A NA Valve, Relief ACAR-B NA Valve, Reitef CAR-1 NA Valve, Relief CAR-2 NA Valve, Relief SAR-3 NA NOTE: Exponential notation is indicated in abbreviated form; 1.e.,1.47-7 = 1,47 x 10-7 I
| |
| i i
| |
| A.5-35
| |
| | |
| A.6 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM A.6.1 Introduction A.6.1.1 System Definition.
| |
| A.6.1.1.1 Overview. The engineered safety features actuation system (ESFAS) is a key safety related logic and circuitry system. It detects
| |
| . accident situations in the primary or secondary systems and automatically initiates and controls the operation of engineered safety features (ESF) to mitigate the consequences of initiating events. Thpse ESFs provide emergency core cooling as well as containment isolation, cooling, and fission product removal. The ESFAS isolates and/or dumps main steam lines, isolates main feedwater supply, initiates auxiliary feedwater supply, provides backup reactor and turbine trips, starts the backup (diesel generator) power supply, starts spare emergency raw cooling water (ERCW) and component cooling system (CCS) pumps, and initiates emergency gas treatment and control room ventilation. Multiple and diverse instrument sensors and redundant process channels monitor plant conditions and enable prompt system activation during an initiating event. The ESFAS process parameters which are monitored are pressurizer pressure and water level, containment F
| |
| pressure, steam line gauge and differential pressures, steam flow rates, and reactor coolant average temperatures.
| |
| A.6.1.1.2 Purpose of analysis. This analysis was performed to determine the availability of the system to actuate individual ESF and auxiliary supporting system equipment given that an initiating event is present.
| |
| A.6.1.2 Analysis Boundary Conditions / Initial Conditions. .The system is analyzed starting at the instrument sensors and including all electrical and mechanical components through the slave relays which activate the equipment.
| |
| The following assumptions serve to further define the boundaries of this analysis:
| |
| e The ESFAS is operated and maintained in accordance with the plant technical specifications.
| |
| e An initiating event occurs with the plant at full power which requires equipment actuation in one or more ESFAS subsystems.
| |
| e- Operator actions to actuate the required ESFAS subsystems are identified but not quantified. Operator actions required to complete the semiautomatic switchover to the recirculation modes of the emergency core cooling system (ECCS) are identified and discussed in the ECCS analysis.
| |
| A.6-1
| |
| | |
| . - .~ . _- . . _ _ , . ~ . , -. - _ . = _ _ . - - .- -- ~ - .
| |
| 1: -
| |
| N *
| |
| =
| |
| ~
| |
| e Maintenance and testing will not be quantified in this analysis.
| |
| ; o AC and DC' electric power dependencies are considered and assumed perfect in this analysis. Realistic values for these dependencies
| |
| - ' . will be assigned in the integrated plant safety model.
| |
| ^
| |
| o . Interlock switches and data for proper switch positioning are considered.
| |
| ' o. Solid state. logic.is assumed to be perfect (since it consists of reliable printed circuit boards) and is not modeled.
| |
| .e . Midland data are used for component failure. rates. Individual .
| |
| mean time to repair (MTTR) values are used based on the specific mean detection time for each component. ,
| |
| h- A.6.1.3 Systems Analysis Results. The results presented in this section are p
| |
| based on the GO model quantification described in Section A.6.4 with supplemental _
| |
| ' hand calculations. The hand calculations sometimes included failure combinations
| |
| ;m of like components which were functionally redundant.' 'In these cases, while the
| |
| : redundant components function in a physically separate manner, their uncertainty e
| |
| ' distributions on the failure rate are interdependent. This data related
| |
| : interdependency was accounted for as described in Section A.6.4.-
| |
| l
| |
| : A.6.1.3.1" Quantificaision of conditional failure. states. The ~
| |
| 'unavailabilities of single trains and ESFAS subsystems during an event response were quantified in the analysis. References used in the analysis
| |
| ~
| |
| are summarized in Table A.6-1. Results are summarized in Table A.6-2.
| |
| : n. ,
| |
| w{'l- a p Given perfect DC power. and no operator actions, the mean unavailability of a:
| |
| u ,
| |
| safety injection (SI) train after an initiating event is 6.4 x 10-4
| |
| !. .Considering both SI trains,:the mean unavailability of any SI signal is I '- 1.6 -x 10-6, without operator actions. No credit was taken for manual
| |
| -. initiation of safety injection (or other ESFAS subsystems). -
| |
| h V
| |
| Unavailability of the safeguards sequence subsystem combines the unavailability of the SI signal-(as the sole process parameter)'with the sequencer-and .the equipment slave relay unavailabilities.* A mean train unavailability of 8.8 x 10-4 and a subsystem unavailability of -
| |
| 1
| |
| *Although the model includes the sequencer, the Sequoyah plant does not have a safeguards sequencer.
| |
| 1 ,
| |
| J
| |
| : A.6-2 P
| |
| m nu + ,mu + -- a - --- m- ee, ,, ,. -m,.:--xnr,c- --.-rt w.= w mv--,--- e n --- - .v, -- my y<- -
| |
| | |
| Table A.6-1 LIST OF REFERENCES Title Section Sequoyah FSAR 7.3 Sequoyah Final Design Report (No. 72-200) 3.5.4 Sequoyah Technica1 ' Speci fication s 2.2.2 3.4.3.2 3.3.4.6
| |
| ~
| |
| - Surveillance Instruction SI 247.699 -
| |
| (EPRI-531-DOC-32)
| |
| ' Westinghouse Functional Diagram 5655D26 -
| |
| (EPRI-531-DWG-05) l Westinghouse Report WCAP-7672 -
| |
| -g t a
| |
| 'f,-
| |
| A.6-3
| |
| | |
| 4 Table A.6-2 ESFAS QUANTIFICATION RESULTS (MEAN VALUES)
| |
| Subsystem Train Subsystem Unavailability Unavailability Safety Injection Signal 6.4-4' 1.6-6 Safeguards Sequence - Containment Isolation 8.8-4 3.8-6 Phase A, Emergency Gas Treatment,
| |
| ' Emergency Diesel Generator Start, ECC Injection, ERCW and CCS Spare Pump Start Containment Safeguards - Containment Spray, 6.7-4 2.9-5 Phase B Isolation and Air Return Fans Steam Line . Isolation / Dump 6.4-4 1.8-6 Balance 'of System Module - Containment Vent 6.4-4 1.8-6 Isolation, Control Room Intake Duct Isolation, Main Feedwater Pump Stop and Valve Isolation, Turbine Trip, Start of Turbine-Driven and Motor-Driven Auxiliary.Feedwater Pumps, Switch to ECC Recirculation, and Accumulator Isolation Note: Exponential notation is indicated in aboreviated form; i.e., 6.4-4 = 6.4 x 10-4 1
| |
| 4 F
| |
| A.6-4
| |
| | |
| 3.8 x 10-6 was calculated for each equipment actuation signal in the sequence '(containment isolation Phase A, emergency gas treatment, diesel gene;ator. start, ECC injection, and ERCW spare pump start).
| |
| - Unavailability of. steam line isolation / dump and the balance of system module are similar to t' ose h for the safety injection subsystem because of similar multiplicity of components and failure modes. The containment safeguards subsystem poses a special case in which multiple failures of the instruments or senscr chan'nels-significantly increase (about a factor of 20) the unavailability of this subsystem. This is attributable to a lack of diversity of automatic trip parameters and the adverse affect of single channel testing specifically for this subsystem (consisting of containment isolation Phase B, sprays, and air return fans).
| |
| A.6.1.3.2 Dominant contributors to unavailability. Summary results for ESFAS are shown in Table A.6-3. Failures in the electrical relays are the most'important contributors to the train and subsystem unavailabilities of the five ESFAS subsystems. For example, for the SI subsystem, failure of a master relay to actuate on demand and failure of the normally closed contacts of the reset relay contribute 76% of the train unavailability.
| |
| Relay failures in each train constitute about 90% of the SI signal unavailability.
| |
| Because of their redundancies, the input relays and their wiring in the train-logic channels have a negligible impact on the train and subsystem '
| |
| unavailabilities (estimated at 2 x 10-7 and 7 x 10-14, respectively, for the containment safeguards subsystem). The channel bistables, while not having train redundancy, are highly reliable on demand and therefore do not contribute noticeably to' subsystem unavailability.
| |
| Scheduled test and maintenance on the ESFAS does not cause train outage at a high enough frequency to contribute strongly to system unavailability.
| |
| Common cause failures are limited to instrument recalibration errors which, based on the analyses in the Zion (Reference'A.6-1) and Indian Point (Reference A.6-2) probabilistic safety studies, can be shown to make only a very small contribution to the system unavailability for subsystems with diverse process parameters. They can contribute to the containment safeguards subsystem unavailability to an unquantified extent.
| |
| A.6-5 i
| |
| | |
| Table A.6-3 SUl#4ARY OF RESULTS System Function Mean Safety Injection Signal-Multiple Hardware Failures 1.6 x 10-6 Containment Spray Actuation Multiple Hardware Failures 1.6 x 10-6 Instrumentation 2.7 x 10-5 Total 2.9 x 10-5 J
| |
| t e
| |
| A.6-6
| |
| =,
| |
| | |
| h A.6.1.4 Conclusions. The least reliable portion of the ESFAS is the containment safeguards subsystem whose mean unavailability during an initiating event is assessed at 2.74 x 10-5 While this unavailability may be acceptably low, it could be further improved by reducing the failure detection time on the containment pressure sensors and transmitters (say, to within 24 hours).
| |
| Other ESFAS subsystem unavailabilities are about an order of magnitude lower than the containment safeguards subsystem, due in large part to the multiplicity of sensor parameters. Multiple relay failures are the main contributors, with testing producing a noticeable but minor effect.
| |
| A.6.2 System Description A.6.2.1 Accident Mitigation Function. The function of the ESFAS is to determine whether predetermined reactor safety limits are being exceeded and, if they are, to actuate the set of ESF and auxiliary supporting system equipment whose operation effectively prevents or mitigates the progression of the accident. The function is based on analog sensing instrumentation and controls combined with a digital logic system and electric actuating relays.
| |
| The accident mitigation actions of the actuated equipment include the following:
| |
| e . Mitigate damage to the reactor by tripping the reactor and turbine and providing ECC.
| |
| e Isolate the containment in the event of a loss of the reactor coolant system (RCS) boundary or a failure of the main steam or feedwater piping.
| |
| e Isolate portions of the containment to prevent gaseous radioactivity from escaping to the environment.
| |
| e Actuate automatic containment cooling (start air return fans).
| |
| e Initiate containment spray to reduce containment pressure and temperature following a loss of coolant accident (LOCA) or steam line break and remove fission products and soluble gases liberated
| |
| . to the. containment abnosphere.
| |
| e Initiate automatic starting of the auxiliary feedwater system to provide secondary side reactor cooling.
| |
| e Initiate automatic isolation and recirculation of control room ventilation in the event of toxic airborne substances or high airborne radiation to meet control room occupancy requirements.
| |
| o Provide a backup electrical power supply by starting the emergency diesel generators.
| |
| A.6-7
| |
| | |
| l l
| |
| i e Provide full redundancy for ERCW and CCS cooling of components by starting spare ERCW and CCS pumps.
| |
| e - Prevent excessive blowdown of steam generators by isolating and dumping steam lines and/or isolating main feedwater lines.
| |
| e Close upper head injection (UHI) accumulator isolation valve on a low water signal from the accumulator, e Semi-automatic switchover of the residual heat removal (RHR) pump suction from the injection mode to the recirculation mode of operation.
| |
| o Actuate the emergency gas treatment system.
| |
| . The types of initiating event for which the ESFAS provides protective functions include:
| |
| e Loss of coolant.
| |
| e Steam generator tube rupture.
| |
| e Secondary steam pipe breaks or rupture, e Steam generator feedwater line break or rupture.
| |
| A detailed list of equipment actuated by the ESFAS is given in Tennessee Valley Authority (TVA) drawings 47W611-99-3 through 47W611-99-5. This list is lengthy and is not repeated here.
| |
| A.6.2.2 System Success Criteria. Two operating states are defined:
| |
| (1) successful automatic response to an initiating event, and (2) failure to automatically respond. Prompt or delayed manual initiation by the operator is ,
| |
| not considered in this analysis.
| |
| The criteria for the two operability states of each ESFAS subsystem '
| |
| (Seccion A.6.2.3) are as follows:
| |
| e Success State. Successful automatic trip signal in a subsystem train, consisting of instrument sensor trip signals in the channel coincidence logic required by Table A.6-4 'from at least one of the diverse process sensing parameters (no diversity for containment safeguards actuation) and extending through actuation of the master and slave relays.
| |
| e Failure State. Lack of an automatic trip signal in a train.
| |
| A.6.2.3 System Configuration. The ESFAS is analyzed as consisting of four element subsystems which, in general, are interrelated through shared or A.6-8
| |
| | |
| Table A.6-4 REQUIREENTS FOR PROCESS INSTRUMENTS PRODUCING ESFAS OUTPUT Sheet 1 of 2 ESFAS Function / Sensor '"' "" #
| |
| Se nt rro A. 11_ - - -
| |
| : 1. h nual Initiation 1:2 Channels
| |
| : 2. High containment Pressure 1 1.54 psig .16 psig 2:3 Channels
| |
| : 3. High Steam Line Pressure Difference i 100 psf /sec 12 psi 2:3a Loop APs in any combination
| |
| : 4. High Steam Line Flow in Conjunction 2:4b Loops (1 Ch/ Loop) with Low Pressure in Steam Line, 2:4 Loops (1 Ch/ Loop) or Low-Low TA yg in RCS (not P-12) 2:4 Loops (1 Ch/ Loop)
| |
| : 5. Low Pressum in Pressurizer Plus No 1,870 psig +10 2:3 Channels P-11 Interlock on Not Low Pressure -10 2:3 Channels p 8. Containment Spray
| |
| ? 1. High-High Containment Pressure 1 2.81 psig .16 psig 2:4 Channels e 2. h aual Initiation - - 2:4 Channels C. Steam Line Isolation
| |
| : 1. SI Signal - - See Section A.4
| |
| : 2. High-High Containment Pressure 1 2.81 psig .16 psig 2:4 Channels
| |
| : 3. k nual Initiation - -
| |
| 1:2 Channels DI. Trip Turbine and hin Feedwater Pumps I
| |
| : 1. SI Signal
| |
| : 2. High-High Steam Generator Water Level i75kNRIS 15 1:4 Loops (2:3 Ch/ Loop)
| |
| D2. Close Feedwater Isolation Valves
| |
| : 1. hin Feedwater Pump Trip and Reactor Trip
| |
| : 2. Low TA yg and Reactor Trip (later) (later) 2:4 Loops (1 Ch/ Loop)
| |
| Note: NRIS = narrow range of instrument scan.
| |
| aThis was modeled as 2:4. Since this does not impact the demonstration of GO methodology, this infomation was not accounted for in the logic model used for quantification.
| |
| bThis was modeled as 2:3. Since this does not impact the demonstration of GO methodology, this information was not accounted for in the logic model used for quantification.
| |
| I
| |
| | |
| Table A.6-4 (continued)
| |
| Sheet 2 of 2
| |
| "* " Coincidence Logic ESFAS Function / Sensor t E D3. Start TD AFW Pump
| |
| : 1. SI Signal - - -
| |
| : 2. Station Blackout - - -
| |
| : 3. Low-Low Steam Ger.erator Water Level -< 21% NRIS 11 2:4 Loops (2:3 Ch/ Loops)
| |
| : 4. Manual Initiation - - -
| |
| D4. Start MD AFJ Ptsnps 1 Main Feedwater Pump Trip - - -
| |
| : 2. Safeguards Sequence Signal - - -
| |
| : 3. Manual Initiation - - -
| |
| DS. Contairement Ventilation Isolation
| |
| : 1. SI Signal - - -
| |
| p 2. Contaf rument Rad Gas Monitor < 8.5 x 10-3 - 1:2 Channels
| |
| ~ uct/cc E 3. Contairement Air Particle Monitor < 1.5 x 10-5 - 1:2 Channels
| |
| ~ vCf/cc D6. Control Room Intake Duct Isolation
| |
| : 1. Control Room Area Monitor 2.5 ar/hr (later) 1:2 Channels
| |
| : 2. SI Signal - - - ,
| |
| D7. Switch from ECC Injection to Recirculation +
| |
| : 1. SI Signal - - -
| |
| : 2. Low RWST Water Level Coincident with 130 Inches (later) 2:4 Channels High Contairunent Sep Water Level From Tank Base 30 Inches (later) 2:4 Channels Above Elevation 680' D8. Close UHI Accmulator Isolation Valves
| |
| : 1. SI Signal - - -
| |
| : 2. Low Water Level in Core Flood Tank (later) (later) 2:4 Channels Note: NRSI = narrow range of instrument scan.
| |
| | |
| propagated process parameter signals as shown in Figure A.6-1. These subsystems or modules are:
| |
| .e Safety Injection Subsystem. This is an intermediate signal of high safety impact which provides an input actuaticn signal to a wide range of plant safety equipment. Four diverse process parameters and one manual action can produce an SI signal in either train.
| |
| e Containment Safeguards Subsystem. The only subsystem independent of an SI signal, this module actuates the containment safeguards; namely, containment sprays, containment isolation Phase B, and the air return fans (cooling). The sole automatic process parameter is high-high containment pressure (manual actuation also available).
| |
| o Steam Line Isolation and Dump Subsystem. This subsystem isolates individual or all steam lines on high-high containment pressure, by constituent process signals of SI or by manual action. Steam dumping via the condenser dump valves is allowed by control switches.
| |
| e Balance of System Module. This module actuates a group of equipment either on a SI signal or on one or more interfacing process parameter signals (accident monitoring instruments, etc.). In this module are:
| |
| --Reactor and Turbine Trip
| |
| --AFW Pump Start
| |
| --Containment Vent Isolation
| |
| --Control Room Intake Duct Isolation
| |
| --Main Feedwater Pump Stop and Valve Isolation (semiautomatic)
| |
| --Switchover from ECC Injection to Recirculation
| |
| --Closure of UHI Accumulator Valves Figure A.6-1 depicts the interrelated ESFA3 subsystems including the process parameter input and equipment actuation output. Table A.6-4 lists the channel coincidence logic and trip setpoints for the ESFAS process parameters.
| |
| A.6.2.3.1 Major components. Figure A.6-2 depicts the major constituents of a typical ESFAS subsystem (process sensors, analog protection racks, input A.6-11
| |
| | |
| l rs',_r}l.
| |
| :' r_:91 c
| |
| L)J:>.i! ll s
| |
| e _r
| |
| .n_
| |
| il r- e c, 19, .!I i
| |
| ! sllj;'a,fD- ill
| |
| ' -o 5:
| |
| * Ii i- -
| |
| -!= n c:- i,_
| |
| E Ep !g. 9 iMe :
| |
| s Laj 3 i s i 32 2 l.
| |
| :1 ,.:a o .e il. s iilI si i s t
| |
| .gi I
| |
| m E
| |
| S il 3 :> s 1 i'&(lr'~P,- ii '8I~lrt_3-*f ! 3
| |
| = '' is lgil:ir ii i
| |
| .s cg "a t- M c, glij>= s! $
| |
| ,-________________, jij;'y _o ji ;
| |
| i i 'a e si e
| |
| ' *I _3-*!j, :!ge 1
| |
| s all
| |
| .. El c ,'
| |
| 3 IH= lgilar c_ s 1
| |
| 8"
| |
| ]a lI!s,- E" w
| |
| l I is3:e S- "
| |
| 3-@- i 5
| |
| o I = _j'~ _ l -
| |
| l-*g4 !s i
| |
| .h 3 -y 1 i ,--- g I- r is SI
| |
| ' ';I"*.i,'H- 8 o s
| |
| 'y b
| |
| hl l g
| |
| ' -*!!!.g!i :< I.
| |
| ~ ~ ~
| |
| I s!I l t 'si- $ - u ilsa " !.
| |
| g .
| |
| l -}^ I : s lll i -- -
| |
| 8 ffl -ljggiis! lE 3
| |
| : i. :::. il l
| |
| o-ll,!
| |
| s i
| |
| l [3 ' - uf a
| |
| :o ,l'i = s i
| |
| i jlgi _ 21' I l- gi - .r_"L i !l
| |
| -*g!! , $
| |
| I - -
| |
| :)- -ii _ _, 3--j],l! E -a i 1
| |
| , ; <,:J sit le I- -3_ ,[g,a - al
| |
| ~6:1 I t.
| |
| ' i -
| |
| i a
| |
| lim 3~,1=
| |
| i _g, i i i r
| |
| ' L ._ _ _ _ _ _ _ _ _ _ _ _ _ _. _J A.6-12
| |
| | |
| . -. . -. ~..- . - . - - - - . - - - .
| |
| f.
| |
| L y PROCESS SENSORS OR TRANSMITTERS PENETRATION 3- , ,-, ,., q.. ASSEMBLY
| |
| } { " CONTAINMENT
| |
| ^"
| |
| o u s_2 s__,
| |
| AC1 AC-2 AC3 AC4-=- A4 POWER 1r 1r it it 1r P 1r r PROTECTION PROTECTION PROTECTION PROTECTION MACK NO.1 RACK NO. 2 PROTECTION RACK NO.3 RACK NO.4 CH NO.1 - RACKS CH NO.2 CH NO.3 CH NO.4 q__ q__ q__
| |
| 1 l
| |
| I I g j
| |
| :=$
| |
| l l l l l l L___q i ! L_____, i I L______, , i t ._ _
| |
| [
| |
| C W.
| |
| * w.
| |
| * y 1 --
| |
| h y a SOLID h --
| |
| h;
| |
| * T T --
| |
| STATE T T-bOAROS SAFEGUARDS LOGIC ' S AFEGUARDS LOGIC RACKS TRAIN A - 'O# ERLOCK RACKS TRAIN 8
| |
| $R R"$
| |
| NTROL M. --
| |
| M Power T O O "O T ONTROL POWER SOURCE 1 RL ~. "1 SOURCE 2 RESET RELAY O IL_ @! @ dam
| |
| _ J ()JR at ET RELAY lRI MASTER (R)
| |
| ACTUATING SLAVES RELAYS RELAYS SLAVES RELAYS
| |
| ==
| |
| ENERGl2E -- * -- ==
| |
| TO OPERATE SLAVE RELAY CONTACTS TO ACTUATE INDIVIDUAL COMPONENTS Figure A.6-2. ESFAS Basic Safeguards Actuation Diagram A.6-13
| |
| ./
| |
| | |
| logic relays, solid state logic trains, and master and slave output relays).
| |
| There are two discrete portions of circuitry:
| |
| o An analog portion consisting of redundant instrument sensors, measurement' reading transmitters, cable wiring, and redundant logic channels including bistables and input relays.
| |
| e A digital portion consisting of two redundant logic trains which receive input from the analog channels and perform the needed coincidence logic to actuate the equipment. This portion includes the solid state logic protection system, the master and slave relays and reset and interlock interfaces.
| |
| Each digital train is capable of actuating a redundant set of equipment required to meet the accident mitigation function. The design guideline was that any single failure within the ESFAS should not prevent system action when required.
| |
| The redundant concept is applied to both the analog and logic portions of the system. Separation of redundant analog channels begins at the process sensors and is maintained in the field wiring, containment vessel penetrations, and analog protection racks, terminating at the redundant groups of safeguards logic racks.
| |
| Instrument sensor signals enter the ESFAS through multiple redundant channels. Table A.6-4 (from Table 3.3-3 of Technical Specification 3.4.3.2) summarizes the minimum channel logic for actuation.
| |
| Instrument sensor signals are processed in the analog portion, resulting in a bistable input (120V or OV AC) to the solid state protection system.
| |
| Integrated circuit NAND gates assembled on printed circuit boards are used by the solid state protection system as the basic logic elements to produce an energized output (0V to 15V) to the equipment activation circuits. The solid state protection system is used to generate signals for the reactor trip system as well as for the ESFAS.
| |
| Each of the activation circuits consists of a master relay which drives slave relays for component activation as required. The logic, master, and slave relays are mounted in the solid state logic protection cabinets
| |
| . designated train A and train B. The slave relay circuits operate various A.6-14
| |
| | |
| pump and fan circuit breakers or starters, motor-operated valve contactors, solenoid-operated valves, emergency generator starting gear, and similar actuating equipment.
| |
| The master relays are general purpose relays which are actuated by a signal from safeguards output boards. In turn, each master relay controls from one to eight slave relays. Some of the slave relays have a reset coil which can be energized automatically or by manual reset (block) pushbuttons.
| |
| A list of ESFAS master and slave relays and the equipment they actuate is given in TVA technical drawings 47W611-99-3 through 47W611-99-5. This list is broken down by actuating train and testable versus nontestable actuations (see Section A.6.2.6).
| |
| A.6.2.3.2 Support systems. ESFAS relies on the 120V AC instrumentation and control power system. Each actuation train receives AC power from a separate vital instrument power board. AC power (120V) from the power inverter is used to energize and hold instrument channel trip relays in a ready position during plant operation. Loss of this AC power results-in
| |
| . equipment trip signals for all subsystems (deenergize to trip) except the containment safeguards subsystem, which is energized to trip. Power dependencies for the instrument channels are from 120V vital instrument power boards I through IV, as ind'cated in the GO model diagram (Figure A.6-3) for all subsystems The output relays will not energize upon
| |
| , the loss of an electric power train, thus making the safeguards equipment on that train inoperable. The power requirements for output relays are the
| |
| ; .following:
| |
| e Unit 1
| |
| --SSPS train A 120V AC VIPB 1-I.
| |
| --SSPS train B 120V AC VIPB 1-II.
| |
| o Unit 2
| |
| --SSPS train A 120V AC VIPB 2-111.
| |
| --SSPS train B 120V AC VIPB 2-IV.
| |
| HVAC is necessary to cool the rooms where the SSPS equipment is located.
| |
| A.6.2.3.3 Interfacing systems. ESFAS interfaces with practically every plant system. The ESF components and systems actuated by the ESFAS are A.6-15
| |
| , _ _ _ _ _ . . ._ _. . . _ _ ~ _ _ _ . _ _ - _ . . _ _
| |
| | |
| kj .n" !g" n" i.s -w "lE I @,*.n" -
| |
| '' "- . g g. ..u.- ''
| |
| I) a s" ."
| |
| si" ,-
| |
| l} *
| |
| * m"
| |
| =:s a = - s e e . m a - . [f]." =
| |
| o r 1 . . ar
| |
| .g E.
| |
| t, t, t, t, 8
| |
| 8, t, Sih as t, I
| |
| *- g g g g
| |
| .g - t, t,
| |
| , 'p t,,
| |
| t, t, T..m. 8-nzt, t, t, t,
| |
| .tr t, t, t,
| |
| ,. e 3 . ,.,
| |
| . . =, tac" .3, .
| |
| ._nos. . .
| |
| ST ,,, ET ,,, ST .3, ST ,,4
| |
| . . C ST .3, .
| |
| 33 3., 33 3., 303 3., 33 3., 33 3.,
| |
| I. x xa 3 3 . 3 3 . . 3, . 33 as, 3e3 ,, ,
| |
| P
| |
| " 3. -
| |
| L.O.CE
| |
| ,, xa 884ET .,9 .IseEST ,,6 W ,gy
| |
| [ [
| |
| ? / /
| |
| T / /
| |
| W / / *
| |
| # m A "a * **
| |
| * 0, po.,,g e .ses0C.LO.CK.
| |
| O . tanssu.L ..mA10A Y
| |
| ,, --.LO.CKO .
| |
| ..f.RTA 'OR 6 3,, 63. 4 31. 63,5 63 63 pOn.g 3 s l
| |
| TAase m ST ,e,s . Tea,e, .
| |
| ST
| |
| : 30. 3., 33 33 3.s 3G. 3e. 3c7 30. 30. 3., 303 303 Pos 30. 30. 307 30.
| |
| 3 3. 3,. 3,. 3,3 31 3,. 33. ate 33. 33, 333 333 33e 33. 33 333 33.
| |
| T iP tr 'P 'P il 9 1r 1P ir P T iP 'P P it ir sartTV ase ' ' sa,ETT aan , gy C.osefaa,sses.mf C,DsuYassoasEnf CTIOes C.ossTassee.esY C.ossTasisesaseT r ff gygg,,,g essa CYeose L 8.may .AETu.nse p,,
| |
| a .D.L.AT.aose
| |
| .. T.eaf am . e.a w.ess _ , , , , , - .e .0.a.AT.0se Taasse .
| |
| Ta.. .as T AAses .
| |
| _,,,,, .c.
| |
| .essM. SAL.
| |
| Temess . Tsaass. ET ! Tma.m.a MET _ 3 Ym.am .
| |
| : m. . e.
| |
| The a,CTOR Figure A.6-3. ESFAS GO Model (Sheet l'of 12)
| |
| | |
| .316 333 317 334 318 335 319 336 2 2 2 2 i
| |
| LOOP 1 LOOP 2 LOOP 3 LOOP 4 1
| |
| i.
| |
| 504 505 506 507 1
| |
| e b
| |
| 11 4/4 529 STEAMLINE ISOLATION i
| |
| Figure A.6-3 (continued) 1 (Sheet 2 of 12) l l
| |
| t
| |
| )
| |
| I
| |
| | |
| L E
| |
| N 0 N3 2 A 1 3
| |
| 3 H 8 2
| |
| C 3
| |
| 0 1 4 1 1 S 1 PI 2 V 3 0
| |
| 1 g
| |
| 0 7 1 3 1 2 7
| |
| 1 3
| |
| /
| |
| 0 2 0 2 1 0 B 2 N
| |
| {M R
| |
| T )
| |
| d 9 e L 1 u E n)
| |
| N i2 N2 t1 A 3 n
| |
| H 6 1 1 2 of C
| |
| 2 (
| |
| co 0 0 3 S 1 1 1 3
| |
| P I
| |
| 2 3 V 2 t 0 e 1
| |
| 3
| |
| : 6. e o 5 1 1 Ah t 2 S e(
| |
| 6 r 1 u g
| |
| 3
| |
| /
| |
| 0 2 1 i
| |
| 01 0 A F 2
| |
| i
| |
| , N I
| |
| t A
| |
| $ R T Y A T
| |
| UL P E L T N IR E O N N N1 8 1 C A 3 ' I H 1 1 2
| |
| G C O L
| |
| t o 2 L s t 8 1 E 2 N PI N V 1 A 0 H 1 5 1 C 8 3 0
| |
| "* 1 1 1 2 2 R
| |
| E 0 ^ 1 T 0 ' 1 E 1 1
| |
| e h
| |
| S'
| |
| ' T P A 0 S E R 0 RA 1 TP prW 4
| |
| * 6 i' t 4
| |
| P 8 O 0 1 1 1 2 3 V 10 4 O 4 2 l
| |
| L 1 to 2 9 ,
| |
| P 2 1 1 3 ,
| |
| I 8 2 1
| |
| V 9 8 0
| |
| 1 1 1 2 6 2
| |
| 3 P 6 8 O 8 1 1 2
| |
| l i 0 3 O 3 7 1 t 1 L 1 1 2 9 , 9 S 2 )
| |
| P I
| |
| 7 1 1 2
| |
| 3 ,
| |
| 2
| |
| ).
| |
| 2 2 d V 1 B 7
| |
| 0 2 N e 0 1 1 8
| |
| 4I A u 1
| |
| 2 R
| |
| n)
| |
| T i2 t1 n
| |
| of
| |
| (
| |
| co T- 4 O 3 N 5 t 2 2 e P
| |
| O
| |
| ' 1 8
| |
| 1 6. e 2 O 6 2 Ah l
| |
| t 0
| |
| 1 L 2 6 0 2
| |
| S S
| |
| 1 9 1 ,
| |
| e(
| |
| : 2M 2 3 PI 4 1 1 2
| |
| , i A
| |
| r V 1 0 u 0 5 8 2 N g 1 1 1 2 4 n l4I A i 2 R F T
| |
| T O
| |
| o y
| |
| 1 N ,
| |
| P 8 T 12 1
| |
| O 4 7 R i 0 1
| |
| O 1 5 9 2 O s1 L 1 1
| |
| , 1 e 9
| |
| PI 5 2 1 1 2
| |
| 3 ,
| |
| , c i
| |
| V 1 G O
| |
| o 3 8 L t R e 1 1 2 3 1 t E t 2 2 e 0 Lt s 0 Afl A 1
| |
| N 1
| |
| NO T S T e S O GO s T Y A i
| |
| RO OL G R $M l
| |
| ' U c V 4O5 P EL N OO LLT A N IR i
| |
| O c
| |
| >,7$
| |
| | |
| 4 P 0 O 2 1 0 V 04 O 4 1 2 8 I
| |
| - 1 L 0 1 1 1 Bl P 2 T I
| |
| 0 S V 1 1 0
| |
| 2 4 0
| |
| 0 1
| |
| 3 P :
| |
| O 0 2 2 i 3 O 2 0 2
| |
| 0 B l
| |
| l
| |
| - 0 L 3 0
| |
| 1 1
| |
| 7 2 N I B l1 1 1 2 A PI 1 T R 0 S T V 1 1
| |
| 0 2 :
| |
| 0 0
| |
| 1 )
| |
| 3 d
| |
| e u
| |
| n)
| |
| - 2 i2 P t1 O 0 2 4 1 n l 2 O 2 0 6 0 A of cO i
| |
| - 0 L 3 1 2 2 N 0 1 (
| |
| 8 1 1 1 2 5 Pl IA 3 1
| |
| 0 T R t VI S 1 T
| |
| 1 0 e 2 2 t 6. e 0 Ah 0 S 1
| |
| e(
| |
| r u
| |
| g i
| |
| 1 F P o O t 2
| |
| 0 1
| |
| 1 O 4 1 2 5
| |
| - 0 L 0 1 S 1 1 1
| |
| Pl 2 V
| |
| I 0 T 1 E
| |
| _ 1 1 S 0 R 1 2 1 U R 0 S O
| |
| 0 SS
| |
| - 1 EL RE
| |
| . 0 1
| |
| PV
| |
| . R GE R O S L E 0 8 RR T
| |
| E 1 0 4 OE FT 3
| |
| M 0 0 ,
| |
| C A P A 1 1 IW
| |
| - I R G D RA TP 4 1
| |
| 0 0
| |
| 0 1
| |
| 0 1
| |
| 4 1 " O LN E A
| |
| - C E
| |
| _ 1 2 NC 0 0 EN 1 1 D
| |
| I R E
| |
| 1 3 CE 1 INFF T OI S CD
| |
| ??8
| |
| ! i ! !I I ,(l' , I
| |
| | |
| I P 12 LO M8 HI LOLO INTE R- PRESSURE M1 SL CONT HI STE AM : LO SL TA ya LOCK gN PRES- PRESSURE HICONT OPE R ATOR OC PRESSURE FLOW PRESSURE IN RCS ' SLOCK SURIZE R OlFFER. PRESSURE PRESSES POmfR 18748) . (95 OR 983 (121 122) (241 OR 242) OF $3 . MANUAL (151 OR 152)(250 OR 200) (161 OR 162) RESE7
| |
| ~
| |
| 100 - 101 102 103 104 105 106 107 108 100 110 67OR. 96 OR 121 OR _ _ 241 OR 34 OR 151 OH 260 OR 161 OR gg 96 122 242 35 152 200 162
| |
| * 2 10 J
| |
| 20 l
| |
| D=~ 52
| |
| . . ,,5 m MASTE R 2 10 . w NOT RELAY 57 54 2
| |
| 100 -*- - W TER 16 214 RELAY LOOP 1 32 OR 43 m 55 M 28 y
| |
| e g ' _5 MANUAL SL N 68 -
| |
| ISOLATK)N LOOP 2
| |
| - 3 M 5 MANUAL SL RESET 6 46 15 44 218 218 ISOLATION DC 6 RELAY 216 25 g
| |
| [fv5,y -
| |
| 218 A
| |
| .2 3g A -
| |
| LOOe3 MANUALSL 20wicaRd''
| |
| RELAY DC "of ISOLATION 68 POWER 6 3 31 LN4 100 N MASTE R 3g 515 _
| |
| 2.
| |
| , MANUALSL , REMY M8N OELAy 68 80 . 41 ISOLATION g 62 SLAVE RELAY STAVE 218 218 218 218 RELAYS ST 141 TRAIN LOGIC FOR ACTIVATION CIRCUITS m 201 m 203 204 20s 20s m 20e ir .ir 1r ir ir ir. ir ir 3, PHASE S SPRAY . AIR LOOP LOOP LOOP' ' LOOP REACTOR SAFETY ISOLATION RETURN .3 2 3 .4 TRIP INKCTION FANS $3GNAL Figure A.6-3 (continued)
| |
| .(Sheet 6 of 12)
| |
| | |
| ! l L l :<
| |
| L E 6 N s 6 _
| |
| N 1 1 A 2 V H 4 8 I
| |
| C4 5 7 5 S r 0 PI V
| |
| 8 1
| |
| i[1 0 2
| |
| s 2
| |
| 6 1 1 1 2 L
| |
| E 5 N s 6 N 1 1 4 A 2 4 2/ B l
| |
| l H 3 7 O I
| |
| - C3 5 7 5 O N S r 1 rI P 7 1 2 1 1 A 1[0' R I
| |
| 1 V 1 T s 6 ; )
| |
| i 1 d 1
| |
| 2 e u
| |
| n) i2 t1 n
| |
| of
| |
| (
| |
| co 7
| |
| L 3 E 4 t N
| |
| N 1 s
| |
| 1 6
| |
| : 6. ee A 2 Ah S
| |
| l I
| |
| H 2 6 e(
| |
| S C2 5 7 5 r P
| |
| r 0 u 6 2 _, g M
| |
| 1[1; I
| |
| V 1 0 2 7 A i F
| |
| s 6 1
| |
| 0 N I
| |
| 1 1 2 rA 1
| |
| 1 E R R T m U S
| |
| S E
| |
| R P
| |
| T
| |
| - N O
| |
| L C E s I
| |
| . N 1 1 H-N 2 3 6
| |
| A IH 1 H l 5 R S
| |
| C1 E 7 5 O P r 0 F 5 2 C T
| |
| VI 1 1[1 ; s I
| |
| G O
| |
| N 1 1 G
| |
| L E 2 S AEC -
| |
| ME NR S MN -
| |
| I E E AU T Y TD S 1 SI T S UA I
| |
| HNE L P E YC iOR N R SN BI
| |
| - HCP I UO _
| |
| SC -
| |
| . *.i5
| |
| | |
| M 12 7
| |
| 1 2
| |
| 1.
| |
| e 4 S P O O 2 O
| |
| T L O 0 N 3 12 71 . 1a y
| |
| l En I
| |
| - 6 4 S 1 e 2
| |
| 7 P i I '
| |
| V 7
| |
| ., 3 =2 31 1 9 6 3
| |
| 0 s
| |
| i 2
| |
| a 2 9 N
| |
| - 1 3
| |
| . 5
| |
| , lVAIR P 0 )
| |
| O 2 T
| |
| _ d
| |
| ' O L _
| |
| . e u
| |
| n)
| |
| I 3 1 7 n 1
| |
| ., i2 2 2 t1 n
| |
| of
| |
| (
| |
| co T
| |
| 8 O 8 3
| |
| ~
| |
| N 7 ., 8 t 3 1 1 e 2 n 2
| |
| : 6. e 0 2 Ah 7 P O
| |
| 4
| |
| ' e(
| |
| S B O 2 5
| |
| A r 5 L N S 1 1 u PI 2 1 9 F AI 1 g V 3 7 7 n ., R i I 31 1 g T F e 2 2 g '
| |
| 0 e 5 1 5 4
| |
| W O
| |
| L
| |
| " 1 F
| |
| ~ 31 7
| |
| 1
| |
| ., 9 t S
| |
| 2 .
| |
| 7 2
| |
| R W t O O P 3 F L 8 C F O _ 2 I L O G S L O L
| |
| 7 M4 n ., 8 eE C
| |
| uN 172 1 1 2
| |
| EE TD T WA sI UL P E yC sN N ee IR uO sC
| |
| ? .y
| |
| | |
| 2* * - - .w- w..~a d
| |
| 9 0
| |
| 4 4
| |
| > 2 ela a .
| |
| .l! E n=
| |
| g
| |
| =
| |
| =}=ig i - - -
| |
| ., =
| |
| su ee
| |
| -l! .
| |
| ~
| |
| #~
| |
| a St c1
| |
| . b q = a
| |
| )-
| |
| .m y
| |
| ,I JL E O y
| |
| *l" :
| |
| ,h ah g. ,
| |
| 5- "
| |
| , l$
| |
| =!
| |
| =
| |
| l $n i!th!
| |
| St A 6-24
| |
| ___...-......_,_,_,_,____,r_. ._ . __m,,,.- ,,,,..
| |
| r , s.,- ,, -,.,.. , ,,-, .. , ,. . , _ . - .
| |
| | |
| '7
| |
| : f. EI I
| |
| I l
| |
| I
| |
| !~
| |
| l l
| |
| 5A8 ETV puECTIOss $tGseAL
| |
| = = n. = n. . . ==V AC 0 E.
| |
| : n. = n. n.
| |
| A A S & S gA S B A B .,,,,,
| |
| y,,,,
| |
| l s 9 9 9 9 9 9 9 t t Slavg 6 6
| |
| '87 '
| |
| 219 218 24 218 IIS 218 IIS 218 214 219 RELAYS .
| |
| 376 3F7 278 # 373 39B 381 523 524 512 513 TaAss a Tease s Taass A TSAme t Taast A trade S TRAN6A TRANs 3 TRAsse n traps t
| |
| * > - - a = a = 2 CDus? ItsERGEseCV EutnGENCT ECC FACw PARTICLE CONT itADs0
| |
| ( ISOLAftOse GAS TRE AT. DeEsEL sesJECTEOes PutsP tsOsesTOR gas esosHTOR pnASE A STanT STAaf
| |
| [ 2 II '4 I
| |
| CossTROL i ROOas AltEA l
| |
| 980se4704
| |
| $AFETV WLSCTon saGieAL SEChJEssCE 12
| |
| $AFETV LDLOSG ses se SG ,,
| |
| IssJECTION
| |
| , p mA TE R mATEg LO T
| |
| AVG I'6"AL g g LEVEL yyg, LEVE L yyg, g, g 8 e us W 4 m at N g u est sV A B SS 16 16 iT 9 19 16 16 11 18 5 h5 8 17 IS 3 3 3
| |
| . i e i y . I v I f f r SISTASLE Ss5T ABLE 217 217 217 toS ISt SSr 393 tSe eBS ISt 392 983 See 100 ott 992 SS3194
| |
| > SAFETV esaasuAL OC 8
| |
| * IssJE CTuOle asO AFW Iswuf y 9 9 peruf CFt seGNAL 57 139 PuesP si 131 .FOuta st 129 RELAT 298 218 218 RELAY A, s.uAL -1 = -1 =2 ,8 09 ,'=,,: - 07.. OC S . sam. OC 8 . OC =
| |
| 4 0,s TRAug E. } OTs.t.
| |
| TRAsse RE ACTO 81 } TaAHe SS Im RELAT st 298 2m asa$TER RELAY 33 33e 369 393 233 264 YneP 248 4 214 SLAVE RELAY
| |
| #ILAY 218 218 218 214 IIS
| |
| [ 9 ISS 900 182 183 998 SSE ISE ISP l 2 3 0 1
| |
| * 519 529 CONTAOL ROObs CONYWENT l 389 3gt 293 294 2gg IssTAKE OUCT ISOLATIOss l
| |
| SEOLATaOss 352 OTesta 354 319 OTufn TRAme OTHER OTHER TRAM OfteEm 'T R ANs CLOSES WALVES FOA LOOPS T ANO 3 inasse i, h TRAles TRAsse ir 9 Thape t CLOEES WALvfS FOlt LOOP 5 2 ANO 4 379 Sit stb 373 374 527 529 START STAAT CLOSE CLOSE 3 I I asO Ass asO AFw uAses se asAme f a ,
| |
| gg PuuP fuhr 850LATIORB iSOLAftoss i Taasss a TRAme S
| |
| = 526 VALVE S VALVES i
| |
| $7 Tair TRAsse A* Tmans s' A,AA,Tu- T.O TU.Sas.E T.ap
| |
| . ,u.esA.s.ie Figure A.6-3 (continued)
| |
| (Sheet 10 of 12) l
| |
| | |
| 1j 1lll ll T
| |
| g7 0 1
| |
| O R L E EY 0 4 TASL N AE
| |
| ' s aR sO eI lT 6
| |
| 0 A I A*
| |
| RLS R
| |
| O s o
| |
| 182 1
| |
| 2F EOE SSV T OI LWAL t
| |
| C AI ERtPm CFV RTp
| |
| ^,
| |
| . es S s sP AI 0 st C t 3 0 3 au F PP D 5 2 1 I R
| |
| 0 1 S RW N
| |
| IE F
| |
| E Y TF AW 1
| |
| VA RO R AL LE 3 E
| |
| s e )
| |
| TP Ev SR 0 s
| |
| _ TA 3 F P e d G s SL A
| |
| t t 1 RuIn e SR IEE HTVl S AE L et
| |
| .M SM E
| |
| 2(
| |
| TT u n) i 2 MWL t1 n
| |
| LPs . L of Ae 3 - 3 ^ T (
| |
| co UuY 0 J- PR
| |
| :_tIUTA NPR AO B I T kRS A l14
| |
| \ ^
| |
| ^
| |
| I O
| |
| PS R Y
| |
| A EY VA N
| |
| O 31 1
| |
| : 6. et W L AL I
| |
| '' - MM L SM 2 0
| |
| OP S T s I C a a s A Ae eS h
| |
| 2 UF r(
| |
| 6 lTRTP I
| |
| a 12 AWsT u 8
| |
| L 2 1 2 iW TF A f g E R SAu i V 2 0 EY m- - O F E TA GL S
| |
| 1 SL t s
| |
| R AE SO OE A RR OP F LT OA LW 2 162 3
| |
| w 1 t
| |
| t a f i
| |
| TR D R
| |
| AWU I
| |
| TPU E S
| |
| ~ TP L SAE
| |
| , m" T EY D O vA O s
| |
| N 5 N L e O
| |
| YI TT o t 4 1 hM T T
| |
| O G
| |
| C t E E
| |
| F EJ A G 2
| |
| 5v 1
| |
| W E
| |
| H SMS I F T T
| |
| R
| |
| [l ' R O
| |
| F T
| |
| C E
| |
| L AM0 L T3 01 "
| |
| F AS R e M UP NSO ' t T O
| |
| A IU G e s s ePQ A s A
| |
| e S
| |
| R E T O e-l O
| |
| I D T 5 s A 1 7
| |
| e M
| |
| T 5 T S *
| |
| .ekm
| |
| | |
| i T._._
| |
| : .C = = .
| |
| Eis an.
| |
| > 3 GF-.e.
| |
| GF _.
| |
| .3.
| |
| .et uv.
| |
| 3, Muv.
| |
| .gg W ,
| |
| = = =.
| |
| =-um. = mnn.
| |
| == a,m .. a um.
| |
| ** .=
| |
| .o ")"e .
| |
| . E ..
| |
| 3 .,.
| |
| c
| |
| == .,m. .sn C
| |
| . .Gy an 1
| |
| .e g
| |
| a.=
| |
| "U gy, m.
| |
| 3
| |
| = N r . e s s) ya /
| |
| is m pave.
| |
| a au. m
| |
| * a
| |
| , a
| |
| -==. ,
| |
| is. ,a. m ''o.
| |
| : c. N "'O 6 ~
| |
| ~ s 6 es.
| |
| 3.e e e 8.' l es e e- .G.OT.,g 49.
| |
| = = -. c.a u .c.
| |
| . -. m Cu .
| |
| - ..u . .
| |
| .3.
| |
| Ecy4sa M TCw4ta.,ATeres3 TCr4sa.s TCw49 . TCwe13 .TCw4u 1Cwee3.n M.4.
| |
| 3 TCwes3C TCW4:3EL TCw es34 10y433# D TCw482.ICW4tM TCw4:3a Figure A.6-3 (continued)
| |
| (Sheet 12 of 12)
| |
| | |
| listed in Section A.6.2.1 and Figure A.6-1. Other interfacing systems include the systems which are monitored by the process sensors; namely:
| |
| e The reactor coolant system, including the pressurizer, e The secondary coolant system, including the steam generators.
| |
| Also, other nonESFAS process parameters such as the accident monitoring instrumentation which are not part of the ESFAS are identified in the ESFAS system descriptions (Figure A.6-1) and included in the quantification models since they affect the quantification.
| |
| A.6.2.4 System Operation.
| |
| A.6.2.4.1 Normal operation. During plant operation, the monitored process variables do' not actuate ESFAS (Figure A.6-1). The ESFAS is periodically tested (Section A.6.2.6) during operation.
| |
| A.6.2.4.2 Event response.
| |
| A.6.2.4.2.1 Automatic actions. The process sensors monitor the primary and secondary coolant systems and the containment. Any sensor that receives an abnormal reading will automatically be processed in the SSPS and the appropriate ESFAS equipment will be actuated. The ESFAS responds to the following abnormal conditions:
| |
| o High Steam Line Flow in Conjunction with 1.ow Tavg or Low Steam Line Pressure. This condition is indicative of a steam break downstream of the main steam isolation valves (MSIV).
| |
| Indications of a Dreak in the general location are: high steam flow (to generate a signal, two of the four steam lines must indicate high steam flow) in conjunction withi
| |
| --Low Tavg in the RCS (two of four sensors).
| |
| --Low stean, line pressure (two of four sensors).
| |
| This signal initiates steam line isolation (closure of all four MSIVs) in addition to initiating an autoriatic safety injection signal.
| |
| e Steam Line Differential Pressur_e_. This condition indicates a steam break upstream of the HSIVs or a large feedwater line break. A break in this location results in the closure of the main steam check valve (located in each steam line).
| |
| Steam pressure downstream of the check valve th e decreases as the associated steam generator feeds the break directly.
| |
| A comparison network is used in which the steam pressure in the affected line is compared to the pressure in two of the three steam generators remaining intact. When the pressure A,6-28
| |
| | |
| in the steam generator feeding the break decreases to the set.
| |
| value below the other two steam generator pressures, an automatic safety injection signal is generated.
| |
| e Low Pressurizer Pressure. The pressurizer acts as a surge tank for the reactor coolant system. Pressurizer heaters maintain RCS pressure within a certain band. Leakage from
| |
| - the RCS in excess of the pressurizer heater and normal charging pump capability for pressure makeup results in a decrease.in pressurizer pressure and, consequently, RCS pressure. This signal serves to initiate automatic safety
| |
| ; injection to protect the core from damage for RCS breaks and excessive leaks. Three channels of pressurizer pressure are
| |
| ! monitored and an automatic safety injection signal is i generated if any two of the three channels indicate low I
| |
| . pressure. This trip .is manually blocked by operator action when RCS pressure is below 1,900 psi during a plant shutdown. This block is automatically removed when RCS pressure increases above 1,900. psi.
| |
| e High Containment Pressure. In the event of a break in the
| |
| , RCS (a steam line break Inside the containment building),
| |
| pressure inside the containment building would increase. The rate of the increase is dependent on the size of the break (and in some cases, the location of the break). High containment pressure is monitored by three pressure
| |
| , instrumentation channels.* When containment pressure exceeds i the setpoint value in two of the three transmitter channels, an automatic SI signal is generated.
| |
| l -i; e~
| |
| ~
| |
| Low-Low Steam Generator Water Level. This sensor reading l provides a parallel signal to an 51 or station blackout L signal to start the turbine-driven and motor-driven auxiliary l
| |
| feedwater pumps. If the main feedwater pumps are tripped and there is no station blackout, the motor-driven auxiliary
| |
| (. feedwater pumps will be started.
| |
| e High-High Steam Generator Water Level. This ESFAS sensor parameter provides a signal redundant to an SI signal to trip the turbine. .the main feedwater pumps. and close the main feedwater isolation valves.
| |
| NOTE: All bistables associated with the instrumentation discussed above are "deenergize to. trip." That is, loss of power to an instrument channel initiates a trip signal for that channel. The bistables associated with the instrument.ation below are " energize to trip."
| |
| e High-High Containment Pressure. High-High containment pressure is indicative of a large loss of coolant accident (LOCA) or a major steam line break inside the containment building. When containment pressure exceeds the high-high setpoint, a signal is developed which energizes the relays associated with that channel. Two out of four channels are required to initiate automatic containment spray actuation.
| |
| In addition, a main steam line isolation signal is sent to A.6-29 h1
| |
| | |
| . t
| |
| , 4 close the MSIVs,- containment spray actuation, containment isolation Phase B, and the containment air return fans are started.
| |
| e High Radiation Levels in Containment. High containment radioactivity indicates possible primary or secondary coolant s
| |
| l eakage. One of two channels will actuate isolation of the containment vencilation system, both for the air particle
| |
| ' monitor and the radioactivity gas monitor (interfacing
| |
| _ systems instrumentation). These actuation signals are redundant to an automatic SI signal to achieve the isolation function.
| |
| e High Radioactivity Levels in the Control Room Air Monitor.
| |
| This is a sensor signal from the accident monitoring instrumentation to isolate the control room intake ~ duct on high radioactivity. levels. It is redundant to an SI signal.
| |
| Table A.6-4 summarizes the sensor signals for the equipment a-tuated, their trip setpoints,_and the coincidence logic and automatic response times required by the technical specifications. There are several bypasses and
| |
| ' interlocks affecting the ESFAS, as follows:
| |
| e: 1.ow Pressure in Pressurizer Bypass (P-11). Safety injection signal Initiation by low pressure in the pressurizer 12 bypassed by the operator whenever the~ reactor.is to be depressurized. Bypassing is initiated manually for each train by separate momentary contact switches on the main control boards. This occurs when the reactor pressure is less than the manual bypass permit pressure, but still above
| |
| . the low RCS pressure trip setpoint. The bypass is automatically removed when reactor pressure exceeds the manual bypass permit values. Once a bypass has been initiated, the condition is indicated by an annunciator.
| |
| e RCS-Tavg Below Setpoint Bypass (P-12). Safety. injection signal initiation by high steam line flow combined with ,
| |
| low-low Tava is manually bypassed on reactor cooldown.
| |
| Bypassing is initiated manually by separate momentary contact switches on the main' control boards. This interlock also allows bypassing of steam dump. -
| |
| e' Prior Reactor Trip Interlock (P-4). In conjunction with a low T this interlock will permit closure of the main fMw,ater valves. A manual override is provided to close the feedwater isolation valves. It also allows the operator to manually ~ block ' automatic reactivation of safety injection after a reactor trip has occurred.
| |
| 1 ;
| |
| A.'6.2.4.2.2 Manual operator actions. This system analysis addresses the reliant 11ty of the ESFAS to respond automatically to an accident; manual actions are not quantified. However, manual operator actions have been identified for possible inclusion in the future. As illustrated in A.6-30 m
| |
| ,, . - . - . ~ ,
| |
| | |
| Figure A.6-1, the operator can generate a manual signal for safety injection as well as for a number of equipment actuations. The manual initiation of reactor trip, safety injection, containment isolation phase A, containment spray (along with containment isolation phase B and containment ventilation isolation), and diesel generator start are all accomplished on the system l evel . Manual initiation of both steam line isolation and switchover from injection to recirculation following a loss of primary coolant is performed only at the component level.
| |
| ; A.6.2.4.3 Potential for event initiation. The main steam stop valves are i included in the plant design to mitigate the consequences of steam line
| |
| ' breaks, and protection logic is provided in the plant design to automatically close the valves when necessary. The inadvertent manual closure of any stop valve or the simultaneous closure of all stop valves can create serious faults. If all valves are closed simultaneously when the plant is operating at full power, a loss of load initiating event will result from a consequent primary and secondary side pressure increase, reactor trip, and secondary side safety valve release. In the event that only one valve closes on inadvertent manual actuation when the plant is operating at full power, the steam flow in the other loops will increase in an attempt to restore full power steam flow. The nonsymmetric steam flow can cause an increase in reactor power due to the nonsymmetric loop temperature and the moderator temperature coefficient of reactivity.
| |
| Consequently, the heat transfer capability of the reactor core can be reduced.
| |
| Accidental manual or spurious automatic actuation of equipment started by ESFAS could result in a unit trip due to many possible causes.
| |
| A.6.2.5 Controls, Indicators, and Alarms.
| |
| A.6.2.5.1 Control room. There are four individual main steam stop valve momentary control switches (one per loop) mounted on the control board.
| |
| Each switch, when actuated, will isolate one of the main steam lines.
| |
| Therefore, the potential for manual simultaneous closure of all steam stop valves is physically restricted.
| |
| The sensors monitorirg the primary system are located as shown in the piping flow diagrams of the reactor coolant system (final safety analysis report A.6-31
| |
| | |
| (FSAR), Chapter 5). The secondary system sensor locations are shown on the steam system flow diagrams (FSAR, Chapter 10).
| |
| In the control room, the operator can quickly assess the status of the ESF systems by monitor lights on valve positions, warning annunciators, and readouts of process variable instrumentation on the main control board..
| |
| These data enable him to initiate manual actuation if needed. Interlocks are provided on certain automatic actions and/or sensor instrument readings to block or allow certain manual actions (see Table 3.3-3 of the FSAR).
| |
| A.6.2.5.2 Local panels. Locally, instrumentation is provided to verify ESF actuation as follows:
| |
| 1 e Residual heat- removal (RHR) pump discharge pressure (indication also provided in the control room).
| |
| e Residual heat exchanger exit temperatures (indication also provided in the control room).
| |
| e Containment spray test line total flow.
| |
| e Safety injection test line pressure and flow.
| |
| A.6.2.6 Testing, Inspection, and Surveillance. The ESFAS is tested completely from process signals to actuation relays prior to initial plant operation, during refueling outages, and during normal plant operation to provide assurance that it will _ operate as designed and will be available to function properly after an initiating event'. There are two major types of tests: channel tests and system tests.
| |
| Instrument channel tests and surveillance are controlled by the instrumentation technical specifications (Section A.6.2.8).- These consist of:
| |
| o Channel Calibration. Channel calibration is the adjustment, as necessary, of the channel output so that it responds with necessary range and accuracy to known values of the parameter which the channel monitors. Channel calibration encompasses the entire channel including the sensor and alarm and/or trip functions, and includes the channel functional test. Channel calibration may be performed 'uy any series of sequential, overlapping, or total channel steps such that the entire channel is calibrated. The calibrations are performed during refueling shutdowns.
| |
| e Channel Check. A channel check is the qualitative assessment of channel behavior during operation by observation. This determination includes, where possible, comparison of the channel indication and/or status with other indications and/or status A.6-32
| |
| | |
| derived from independent instrument channels measuring the same parameter. These checks are performed every shift and do not l affect channel redundancy.
| |
| e . Channel Functional Test. A channel functional test consists of theinjection of a simulated signal into the channel as close to the primary sensor as practical to verify its operability. This includes analog circuitry, bistables, input relays, and alarm and/or trip functions. These tests are perfonned quarterly. They I can affect channel redundancy and are performed at a rate of I several channels per hour, h
| |
| The key channel tests are the monthly functional tests performed from the ESFAS analog racks. Administrative control requires during bistable tests that the bistable output be placed in a trip condition by its trip switch which connects the proving lamp to the bistable and disconnects and thus deenergizes (operates) the bistable output relays in the train A and B cabinets. Of necessity, this is done on one channel at a time. Status lights and single channel trip alarms in the main control room verify that the bistable relays have been deenergized and the bistable output is in the trip mode. An exception to this is containment spray, which is energized to actuate two of four and reverts to two of three when one channel is in test.
| |
| After the individual channel analog testing is complete, the logic matrices and the SSPS are tested from the train A and B logic rack test panels. This step provides an overlap between the analog and logic portions of the test program and is the first of three system test steps. During this test, the logic input is actuated automatically in all combinations of trip and nontrip logic. A trip logic signal is not maintained long enough to permit master relay
| |
| . actuation--master relays are " pulsed" in order to check continuity. However, the testing, which is done on one train at a time, may engender shutdown of a portion of the train in test, provided the other train is operational. Complete logic testing of a single train is performed in 10 minutes and is scheduled monthly on f
| |
| a staggered testing basis; that is, train A is tested one month and train B is tested the next month.*
| |
| I Following the logic testing, the individual master relays are actuated electrically to test their mechanical operation. This is the second system test step. Actuation of the master relays during this test applies low voltage to the
| |
| *The system was modeled with quarterly testing. Since this does not afect the demonstration of GO methodology, it was not accounted for in the logic model used for quantification.
| |
| A.6-33
| |
| | |
| /
| |
| slave relay coil circuits' to allow continuity checking, but not slave relay actuation. In the third step, operation of. the slave relays and the devices controlled by their contacts is checked. For this procedure, control switches mounted on a safeguards . test cabinet panel'in the logic rack area are provided
| |
| .for each slave relay. These controls are of the type that require two deliberate actions.on the part of the operator to actuate a slave relay. By operation of
| |
| - these relays one at a time through the control switches, all devices that can be operated online are tested.
| |
| . During the second and third steps of the system testing, an automatic trip signal will override the. testing. Thus, these phases will not affect system availability.
| |
| For components that.'cannot be test actuated online, additional blocking relays
| |
| .are provided wnich allow operation of the slave relays without actuation of the '
| |
| associated ESF devices. . Interlocking prevents blocking the output of more than one slave relay at a time. The circuits provide for monitoring of the slave relay contacts, the devices' control circuit cabling, control voltage, and the devices'. actuating solenoids. Continuity testing associated with a blocked slave relay could take several minutes. This time is short compared to the 10 minutes of train logic test outage and is therefore neglected. A list of equipment which
| |
| .cannot be test actuated online is given in TVA drawings 47W611-99-3 through 47W611-99-5.
| |
| ~
| |
| 2> A.6;2.7 Maintenance Requirements. Maintenance checks (performed during
| |
| > regularly scheduled refuelir:3 outages) such as resistance to ground of signal cables in radiation environments are based on qualification test data. If any
| |
| - degradation of equipment operation is noted, either mechanically or electrically,=
| |
| remedial action is taken tc repair, replace, or readjust the equipment.
| |
| Typical maintenance procedures include the following:
| |
| o Check cleanliness of all exterior and interior surfaces.
| |
| e Check all fuses for corrosion.
| |
| e Inspect for loose or broken control knobs and burned out indicator lamps.
| |
| e Inspect for. rust, moisture, and condition of cables and wiring.
| |
| e Mechanically check all connectors and terminal boards for
| |
| -1ooseness, poor connection, or corrosion.
| |
| A.6-34 e--n.-.,. .-...p ,, ,,.e , ,n, - - - - - - - , 7--,
| |
| | |
| l e Inspect the components of each assembly for signs of overheating or component deterioration.
| |
| e Perform complete system operating check.
| |
| A.6.2.8 ~ Technical Specification Effects. The ESFAS instrumentation setpoints and operability and response requirements are governed by Technical Specifications 2.2.2 and 3.4.3.2. Associated surveillance requirements to comply with these specifications are summarized in Section A.6.2.6.
| |
| The required number of channels and minimum number of operable channels for the E'SFAS (and other) accident monitoring instrumentation are given by Technical
| |
| ' Specification 3.3.4.6 in Table 3.3-10. These are summarized in Table A.6-3.
| |
| Requirements for ESFAS interlocks and their setpoints are governed by Technical Specifications 2.2.3 and 3.4.3.3. These are summarized in Table A.6-4.
| |
| A.6.3 System Logic Models This section describes the calculational models developed to analyze and quantify ESFAS availability during an initiating event. The analysis uses the G0 code methodology. The ESFAS GO mocel was developed so that it can be integrated with other plant system models to construct an overall plant safety model.
| |
| A.6.3.1 F ailure State Top Event Definitions.
| |
| A.6.3.1.1 Analysis boundary conditions. The following general boundary conditions and ground rules are common to the analysis of ESFAS subsystems:
| |
| e Unit 1 is operating at 100% power prior to the initiating event.
| |
| e The availability of each ESFAS subsystem to automatically respond is quantified, conditional on the availability of electric power, using simple GO models which can be integrated into an overall plant safety model.
| |
| Translation of these ground rules into the logic model resulted in the following specific actions:
| |
| e Identify, but do not quantify, operator actuations.
| |
| e Include electric power dependencies as perfect.
| |
| e Consider interlock and selector switches and their probable positioning.
| |
| A.6-35
| |
| | |
| e Use generic data for component failure rates.
| |
| o Neglect component failure modes which can be shown by the data to be relatively insignificant (such as instrument inservice failures, wiring faults, etc.).
| |
| o Neglect solid state logic faults (high reliability printed circuit boards).
| |
| e Account for common cause instrument recalibration error by performing a calculation where the channel signals for each process parameter are adjusted by a factor less than unity.
| |
| o Quantify train success and failure states for each subsystem.
| |
| A.6.3.1.2 Interface with overall safety model. Because of its unique function and design, the ESFAS does not appear as a top event in the event sequence diagrams. Instead, failure of the channels of a particular subsystem'is included as a contributor to failure of the affected components.
| |
| The two operability states (success and failure) define the availability of the subsystems to support the main line systems. Moreover, the success state is broken down further into the identification of success trains since different (redundant) parts of the main line systems are serviced by different trains. A mission time of 24 hours is applied to each of these operability states to provide a bounding analysis of system unavailability for the initiating events.
| |
| ~
| |
| -A.6.3.2 G0 Model. The GO model constructed for the ESFAS subsystems is diagrammed in Figure A.6-3, sheets 1 through 12. Modeled are the trip sensor channel input, AC power dependencies, bistables, input relays, coincidence logic, master and slave relays, and switches and interlocks. Manual actuation of equipment is identified but not quantified.
| |
| The model considers'45 input signals consisting of 17 parameter trips, 6 electrical power dependencies (4 VIpB AC and 2 DC), and 22 manual actions, switch settings, interlocks, and input from interfacing systems. Table A.6-5 summarizes the input signals. This input is generally modeled with type 5 G0 operators.
| |
| -The DC power dependency is modeled for master relays since these are single failure components of each train. Master relays are thus modeled as type 6 G0 operators with actuation signal input and train DC power dependency. Input and l
| |
| A.6-36
| |
| | |
| Table A.6-5 ESFAS MODEL INPUT SIGNALS Go Operator Output Signal Input Signal Number i
| |
| Instrument Process Parameters 1 High-High Containment Pressure 2 High Steam Line Flow 3 Low Pressure in Steam Line 4- Low-Low TAVG in RCS 5 Low TAVG in RCS 6 Low Pressure in Pressurizer 7 Not Low Pressure in Pressurizer 8 High Steam Line Differential Pressure 9 High Containment Pressure 10 Low-Low Steam Generator Water Level 11 High-High Steam Generator Water Level 12 Control Room Air Monitor 13 Containment Air Particle Monitor 14 Containment Radio Activity Gas Monitor Low Water Level in Core Flood Tank Low Water Level in RWST High Water Level in Containment Sump Electrical Dependencies 15 120V AC Vital Instrument Power Board - I 16 120V AC Vital Instrument Power Board - II 17 120V AC Vita 1 ' Instrument Power Board - III 18 120V AC Vital Instrument Power Board - IV 19 Train A DC Power 20 Train B DC Power Switches, Interlocks, and Manual Activations
| |
| -23, 24 SI Block P-11. Trains A and B 25, 26 Steam Dump Interlock Selector Switch Setting, Trains A and B 27 Steam Dump Control Mode Selector Switch 28 to 31 Manual Steam Line Isolation, Loop 1-4 32, 43 Manual Safety Injection Signal, Trains A and B 33, 44 Operator Reset of SI, Trains A and B
| |
| -34, 35 P-12 Interlock on Tgg 36, 37. Manual Start of TD MW Pump, Trains A and B 38, 39 Manual Start of MD AFW Pumps,1 rains A and B 40, 41 Reactor Trip Signal From RTS, Trains A and B 42 Station Blackout Signal
| |
| ' NOTE: Channel electrical dependency (vital instrument power board number) denoted by Roman numerals.
| |
| A.6-37
| |
| | |
| 6 slave relays are modeled with a type 1 G0 operator. All relays are assumed to have the same failure mode and data; namely, failure to change position on -
| |
| demand. DC power is also modeled in the SSPS logic circuitry.
| |
| Bistables are modeled as type 3 GO operators to account for spurious operation, if desired (not quantified in present analysis), in addition to failure to operate on demand.* Table A.6-6 lists the bistables for trip parameters with two out of three' coincidence logic (e.g., in supertype 111 of the GO model) and the corresponding channel electrical dependencies.
| |
| Control switch' positioning is accounted for either by a type 5 G0 operator (input condition) or by a path splitter type 12 G0 operator (mutually exclusive
| |
| : conditions). Other GO operators used include type 2 (0R gate),10 (AND gate),11 (m-out-of-n gate),14 (linear combination), and 15 (NOT gate). These are used for system logic construction.
| |
| 4:
| |
| The ESFAS mddel consists of four supertypes, including one that is nested
| |
| ~
| |
| (supertype 131).
| |
| 4 e ST 111: ~ Two Out of Three Channel Logic e .ST 121: Coincidence Logic for TAVG e ST 131: Coincidence Logic for Steam Generator Pressure Difference and Water Levels e ST 141: Train Logic for Activation Circuits 4,"
| |
| There are also three subsystem parts (sheets 6, 7, and 8 of Figure A.6-3) which are not supertypes since they only appear once in the model. Supertypes can appear only once if desired.
| |
| =
| |
| The model produces 24 types of equipment actuation output as summarized in
| |
| ' Table A.6-7. Broken down by train, this results in up to 48 ESFAS train actuation signals. Because of train symmetry and duplication of-logic for
| |
| - different output types, a much smaller number of output is sufficient in the actual GO code runs.
| |
| T
| |
| ~
| |
| ! *Bistables could be modeled as type 1 GO operators.
| |
| J A.6-38
| |
| _ . . . - . _ _ - - _ - ~ . . _ _ . _ . _ _ _ - - _ , _ _ _ _ _ - _ _ . _ _ _ _ _
| |
| | |
| Table A.6-6 SUPERTYPE 111 BISTABLES AND ELECTRICAL DEPENDENCIES Parameter - Channel B stable
| |
| ]y Low Pressure in Pressurizer I PB-455D II PB-4560 III PB-4570 Not Low Pressure in Pressurizer I PB-455B II PB-456B III PB-457B High Containment Pressure IV PB-934B III PB-935B II PB-936B Steam Line Differential Generator Pressure Loop.1' IV PB-516C II ~PB-515A I PB-514A Loop 2 III PB-526C II PB-525A I FB-5148 Loop 3a I PB-534A III PB-5260 II PB-515B Loop 4' I P3-534B IV PB-516D II PB-525B Steam Generator Low-Low Water Level Loop 1 II LB-519B III LB-518B IV LB-517B Loop 2 I LB-529B III LB-528B IV LB-5278 Note: Channel electrical dependency (vital instrument power board number) denoted by Roman numerals, aNested supertype 131.
| |
| A.6-39
| |
| | |
| r Table A.6-6 (continued)
| |
| B able Parameter Channels ,,
| |
| Loop.3a I 'LB-539B III LB-538B IV .LB-537B Loop 4 II. LB-549B III LB-548 IV LB-547B Steam Generator High, High Water Level Loop 1 II LB-519A III LB-518A IV LB-517A Loop 2 I LB-529A III LB-528A IV LB-527A Loop 3 I LB-539A III LB-538A IV LB-537A Loop 4a II LB-549A III LB-548A IV LB-547A
| |
| ~ Note: Channel electrical dependency (vital instrument power board number) denoted by Roman numerals.
| |
| ' aNested supertype 131.
| |
| }.
| |
| A.6-40
| |
| | |
| Table A.6-7 ESFAS G0 MODEL OUTPUT Signa Number Output Function
| |
| :324, 338 Safety Injection Signal - Trains A and B Containment Safeguards Subsystem 308, 331 Containment Spray - Trains A and B 306, 330 Containment Isolation Phase B - Trains A and B 310, 332 Containment Annulus Air Return Fans - Trains A and B Steam Line Isolation / Dump 529 Steam Line Isolation, Loops 1 through 4 521 Open Loop 1 Condenser Dump Valves 522 Open All Condenser Dump Valves Safeguards Sequence Subsystem 376, 377 Containment Isolation Phase A - Trains A and B 378, 379 Emergency Gas Treatment - Trains A and B 380, 381 Emergency Diesel Generator Start - Trains A and B 523, 524 ECC Injection - Trains A and B 512, 513 ERCW and CCS Spare Pump Start - Trains A and B Balance of System 508 Reactor Trip - Trains A and B 525 Turbine Trip - Trains A and B G26 Trip Main Feedwater Pumps - Trains A and B 527, 528 Close Main Feedwater Isolation Valves -
| |
| Trains A and B 514 Start Turbine-Driven Au.tiliary Feedwater Pump Switch to ECC Recirculation - Trains A and B Close UHI Accumulator Isolation Valves
| |
| - Trains A and B 519 Control Room Intake Duct Isolation 520 Containment Vent Isolation 515, 516 Start MD AFW Pumps - Trains A and B A.6-41
| |
| | |
| A' list of ESFAS components and their failure modes is given in Table A.6-8.
| |
| Failure rate (A) data are also listed. Component unavailabilities (U) were calculated using the equation U = XT where T-is the mission time (24 hours) during the event or the mean time to restore, depending on the failure mode. That is. T = 24 hours for failure to operate over the mission time or T = MTTR for unavailability due to failure
| |
| . prior to the event (for long MTTR cases only).
| |
| In the latter category are two components worth noting; namely, control cable wiring faults and containment pressure sensor input. The containment pressure instruments and transmitters are calibrated during refueling outages and are routinely monitored every shift. However, under normal conditions, the containment pressure does not change significantly over the course of a single shift. Drift or malfunction in the transmitters might be detected from a small pressure buildup that occurs inside the containment over 1 to several days or, at the latest, during recalibration. Considering this range, an MTTR of 720 hours (30 days)* is assumed in this analysis for the containment pressure sensor signal.
| |
| Wiring faults are detected at worst during the morthly channel tests (Section A.6.2.6). Therefore, a one-half month MTTR of 370 hours was assumed in this analysis for wiring faults.
| |
| A.6.4 Quantification of System Unavailability Based on the G0.nodel- described in Section A.6.3, the failure data in Table A.6-8, and supplemental hand calculations, the ESFAS subsystem unavailabilities were quantified as summarized in Table A.6-2. These results are conditional on the availability of electric power (AC and DC) and the absence of manual actuations.
| |
| It was found that the mean unavailability of a single train in each subsystem is less than 1 in 1,000; namely, in a narrow band from 6.4 x 10-4 to
| |
| *An MTTR of 1,632 hours (68 days) was used. Since this does not impact the demonstration of GO methodology, this was not accounted for in the logic model used for quantification.
| |
| A.6-42
| |
| | |
| Table A.6-8 ESFAS COMPONENTS FAILURE DATA' Mean Component Failure Mode 7,9j p Rate
| |
| * Unavailability
| |
| )
| |
| i Bistables Failure to Operate on Demand 3.89-7/d -
| |
| 3.9-7 Spurious Operation 2.21-6/h 24 5.3-5 ,
| |
| Relays Failure to Operate on Demand 2.43-4/d -
| |
| 2.43-4 Signal Modifier Failure - High Output 6.62-7/h 24 1.6-5 Transmitters
| |
| - Coolant Pressure Failure to Operate 2.09-6/h 24 5.0-5
| |
| - Flow Failure to Operate 2.61-6/h 24 6.3-5 2 - Level Failure to Operate 3.2-6/h 24 7.7-5
| |
| 'cn - Containment Failure During Plant Operation 2.09-6/h 1,632 3.4-3 h Pressure Instruments
| |
| - Temperature Failure to Operate 5.7-6/h 24 1.4-4 Element
| |
| - Flow Element Failure to Operate 7.5-7/h 24 1.8-5
| |
| - Level Failure to Operate 4.25-6/h 24 1.0-4 Instrument
| |
| - Radiation Failure to Operate 2.4-5/h 24 5.8-4 Control Cable Open or Shorted During Plant 4.26-6/h 370 1.58-3 Operation Notes:
| |
| : 1. Exponential notation is indicated in abbreviated form; i.e., 3.89-7 = 3.89 x 10-7,
| |
| : 2. In the analysis, failure to operate denotes a component failure frequency during the mission time of the event. Failure during plant operation refers to time prior to the event.
| |
| *h = hour-1; d = demand-1
| |
| | |
| 8.8 x 10~4 _. With the exception of the containment safeguards subsystem, the mean unavailadilities of the ESFAS subsystems range from 1.8 x 10-6 to 3.8 x 10-6 A value about an order of magnitude higher was determined for the
| |
| - containment safeguards subsystem due to instrument sensor failures.
| |
| A.6.4.1 - Hardware Cc3tribution.
| |
| A.6.4.1.1 Active components. For all subsystem unavailabilities except the containment safeguards subsystem, multiple random failures of the electrical relays to actuate on demand are a dominant contributor. Because of the channel redundancy, the input relays do not contribute significantly.
| |
| 4 In some cases, the unavailability is dominated by failure of either the master or the slave relays in each train (one-out-of-two-twice). Since these relays have the.same failure probability distribution, the mean of the products is not the product of the mean but is given instead by Q =_N(U)"F where Q = mean unavailability for multiple failures.
| |
| U = mean unavailability for single failure, m = number of failures.
| |
| N = number of possible ccmbinations.
| |
| F = correction factor to acccunt for lack of independence in the probability distributions.
| |
| The factor. F can be expressed as 2
| |
| gm,
| |
| _F = g where U.5 is the median unavailability for a single failure.
| |
| .The ratio of mean-to-median single failure rate is 1.23 for wiring faults, 2.28 for sensor transmitters, and 2.56 for relays.
| |
| - Using the above equations, the contribution due to multiple relay failures
| |
| -is 90% for all _ subsystems except the containment safeguards subsystem. This
| |
| 'latter subsystem is dependent on only a single sensing parameter for A.6-44
| |
| | |
| automatic actuation; i.e., containment pressure. Failure of the transmitters (any three out of four) contributes 77% of the unavailability of this latter subsystem; multiple relay failures contribute about 6%.
| |
| A.6.4.1.2 Passive components. Control cable faults (wiring shorts, etc.)
| |
| contribute only to containment safeguards subsystem unavailability (because of the lack of diverse process parameters for this subsystem). A 16%
| |
| contribution to subsystem unavailability is calculated.
| |
| A.6.4.2 Test and Inspection Contribution. The test contribution mainly consists of the unavailability of a single ESFAS train during the system logic tests (10 minutes per month) as described in Section A.6.2.6. Single channel tests required monthly by technical specifications do not degrade sensor redundancies except for the containment safeguards subsystem. For the latter, the normal two out of four logic reverts to two out of three during channel testing. No contribution to system unavailability due to testing is included.
| |
| A.6.4.3 Maintenance Contribution.
| |
| A.6.4.3.1 System unavailability during maintenance. ESFAS maintenance is performed during refueling outages or when necessary during operation. No contribution to system unavailability from maintenance is ir.cluded.
| |
| A.6.4.3.2 Human error. There is a potential for common cause human error to miscalibrate all instrument sensors of a given process parameter during channel maintenance at schertuled refueling. Because of sufficient process parameter diversity in the Sequoyah ESFAS design, this is not a consideration except for the containment safeguards subsystem. However, little data exist to quantify this effect with proportionate precision. The effect is not quantified in the present analysis.
| |
| A.6.4.4 Human Action Contrib1 tion. The operator actions required for the operation of ESFAS are identified in Section A.6.2.4.2.2. Operator actions are identified but not evaluated in this analysis.
| |
| A.6.4.5 Common Cause Contribution. Connon cause human errors in miscalibration of instrumentation are discussed in Section A.6.4.3.2. A loss of HVAC to the rooms containing the SSPS equipment could result in equipment failure (spurious actuation) due to abnormally high temperatures. No other connon cause failures were identified.
| |
| A.6-45
| |
| | |
| .A.6.4.6 Analysis Quantification Cause Table. Table A.6-9 presents a summary of causes of ESFAS subsystem failures and the calculated unavailability due to each cause. Double random hardware failures (especially relay) disabling both trains are generally the dominant failure mode.
| |
| A special case is the containment safeguards subsystem where multiple channel instrument or transmitter failures dominate over relay failures and testing.
| |
| This is attributable to a lack.of diverse sensing parameters for this subsystem.
| |
| A.6.5 References A.6-1. Pickard, Lowe and Garrick,-Inc., Westinghouse Electric Corporation, and Fauske & Associates, Inc., " Zion Probabilistic Safety Study," prepared for the Commonwealth Edison Company, September 1981.
| |
| A.6-2. Pickard, Lowe and Garrick, Inc., Westinghouse Electric Corporation, and -
| |
| Fauske & Associates, Inc., " Indian Point Probabilistic Safety Study,"
| |
| prepared for the Power Authority of the State of New York and Consolidated Edison Company of New York, Inc., March 1982.
| |
| A.6-46
| |
| | |
| Table A.6-9 ESFAS SUBSYSTEM UNAVAILABILITY CAUSE
| |
| | |
| ==SUMMARY==
| |
| | |
| Train A. Key Train Single Failure Causes Unavailability.
| |
| : 1. Master o'r Slave Relay 2.43-4 Subsystem B. . Subsystem Fault Sets (number of failures) Unavailability Safety Injection Subsystem
| |
| : 1. One Master or Reset Relay in Each Train (Double)- 1.6-6
| |
| : 2. One Train Out for Test, Relay in other (Single) 1.5-7
| |
| . Safeguards Sequence Subsystem
| |
| : 1. SI Hardware / Test in Each Train (Single or Double) 1.8-6
| |
| : 2. SI Signal in One Train, Slave Relay in Other (Double) 2.0-6
| |
| : 3. SI Signal-in One Train, Sequences in Other (Double) 3.1-9
| |
| : 4. Slave Relay-in one Train, Sequences in Other (Double) 2.3-9
| |
| : 5. Sequence in Each Train (Double) 4.1-11 Containment Safeguards Subsystem
| |
| -1. Instruments (Three or Four Channels or Two or Three During Test) 2.74-5
| |
| '2. One Master or Slave Relay in Each Train (Double) 1.6-6
| |
| : 3. One Train Out for Test, Relay in other (Single) 1.5-7
| |
| ' Steam Line Isolation / Dump Subsystem
| |
| : 1. Test / relay Combinations as in Items Two and Three in Containment Safeguards Subsystem 1.8-6 Balance of System Module
| |
| : 1. Test / Relay Combinations as in Items Two and Three in Containment Safeguards St.bsystem 1.8-6
| |
| -NOTE: Exponential. notation is indicated in abbreviated form; i.e., 2.43-4 = 2.43 x 10 4 A.6-47
| |
| | |
| l A.7 REACTOR TRIP SYSTEM A.7.1. Introduction A.7.1.1 System Definition.
| |
| A.7.1.1.1 Overview. The reactor trip system (RTS) automatically keeps the 4-reactor within a safe region by shutting down the reactor whenever the limits of the region are approached. The safe operating region is defined by several considerations such as mechanical / hydraulic limitations on equipment and heat transfer phenomena. Therefore, the reactor trip system maintains surveillance on process variables which are directly related to .
| |
| equipment mechanical limitations such as pressure and pressurizer water level, and also on variables which directly affect the heat transfer
| |
| ! capability of the reactor such as flow and reactor coolant temperatures.
| |
| Still other parameters utilized in the reactor trip system _are calculated from various process variables. Whenever a process variable exceeds a setpoint, the. reactor trip system initiates shutdown of the reactor.
| |
| .A.7.1.1.2 Purpose of analysis. The reactor trip system is evaluated for
| |
| 'its availability to respond to signals from the process instrumentation
| |
| ; system and to generate a reactor trip signal and bring the unit to a hot shutdown level.
| |
| A.7.1.2 Analysis Boundary Conditions. The analysis is carried out under the following assumptions:
| |
| e The plant is in its normal operating mode prior to the initiating event.
| |
| e No operator actions are considered for any recovery actions in case of failures.
| |
| e The system is maintained and operated in accordance with the technical specifications.
| |
| A.7.1.3 System Analysis Results.
| |
| A.7.1.3.1 Quantification of conditional failure states. The analysis quantifies the unavailability of the reactor trip system for e . Initiating events with offsite power available.
| |
| e Initiating events with offsite power not available.
| |
| A.7-1
| |
| | |
| A.7.1.3.2 Dominant contributors to unavailability. With offsite power available, the failure frequency of a reactor trip from the G0 model described in this report is Q TRIP = 1.31 x 10-4 failures / demand. The largest contribution is from the two reactor trip breakers independently failing to open on demand. The second largest contribution is from the two
| |
| +
| |
| undervoltage coils remaining energized due to wiring shorts to power. In comparison to these two contributions, the contributions from the failure frequencies of two or more RCCAs not inserting into the core, SSPS train testing, and reactor trip breaker testing are negligible.
| |
| With loss of offsite power, the only contrib'ution to reactor trip unavailability is from insufficient RCCAs failing to insert into the core.
| |
| Q TRIP
| |
| = 9.90 x 10 demand The failure frequency of a signal to the SSPS train on reactor' trip is Q3 ;g = 1.10 x 10-2, dominated entirely by the' reactor trip breaker and the undervoltage coil of that train. A fact to note about these signals is that the SSPS may receive a signal indicating a successful reactor trip, but a reactor trip may fail to occur due to insufficient RCCAs inserting into the core. Such a failure is included in the analysis.
| |
| A.7.2 System Description A.7.2.1 Accident Mitigation Function. The reactor trip system automatically initiates reactor trip to prevent the following:
| |
| 'e Fuel cladding damage due to departure from nucleate boiling.
| |
| e Damage to the reactor coolant boundary due to high primary system pressure.
| |
| e Anticipated thermal transients caused by turbine trip or reactor coolant _ pump undervoltage or underfrequency.
| |
| A reactor trip is initiated whenever any of the measured variables listed in Table A.7-1 approaches its setpoint. Whenever reactor trip is initiated, the reactor trip system initiates a turbine trip signal to prevent excessive reactor cooldown and to avoid unnecessary actuation of the engineered safety features actuation system.
| |
| A.7-2
| |
| | |
| q
| |
| -l Table A.'7-1.
| |
| LIST OF REACTOR TRIPS Reactor Trip Interlocks C nts . Trip Setpoints
| |
| : 1. utgh' Neutron Flan ipower Two of Four Manual block of low setting High and low settings; Low setpoint - less than or equal to rangel permitted by P '0. manual 61r and auto- 251 of rated thermal power.
| |
| e.atic rese of low setting by c 10.
| |
| Nigh setpoint + 1ess than or equal to 1095 of rated thermal power.
| |
| : 2. Intermediate Range One of Two Manual blo6k peruf tted by Manual block and auto- Less than or equal to 255 of rated Neutron Flus P-10. satte reset. thermal power.
| |
| : 3. Sourse Range Neutron Flua One of Two Manual block perettted by Manwel block and auto- Less thao or equal to 105 counts P-6, f aterlocaed with P-10. matte reset. Automatic per second.
| |
| block above P-10.
| |
| : 4. Power Range Nigh Positive Two of Four No interlocks. Less than or equal to $1 of rated
| |
| ' Neutron Flua Rate thermal power with a time constant greater than er equal to 1 second.
| |
| N I
| |
| LJ
| |
| : 5. Power Ranee Nigh Negative Two of Four No interlocks. Less than or equal to 31 of rated Neutron Flus Rate thereal power with a time constant greater than or equal to 1 seCond.
| |
| : 6. Overtemperaturo AT Two of Four No f aterlocks. Less than program computed setpoint.
| |
| : 7. Overpower af Two of Four No interlocks. Less than program computed setpoint.
| |
| : 8. Pressurf aer Low Pressure Two of Four Interlocked with P.7. 81ocked below P-7. Greater than or equal to 1.970 pstg.
| |
| : g. Pressurf rer High Pressure Two of Fose No interlocks. Less than or equal to 2.385 psig.
| |
| : 10. Pressurtzer Nigh Two of Three Interlocked with P-7. Blocked below P-7. Less than er equal to g21 of Noter Level instrument span.
| |
| : 11. Low Reactor Coolant Flow Two of ihree laterlocked with P-T Low flow in one loop Less than or equal to 905 of destgn Per Loop and P-8. will cause a reactor flow per loop.*
| |
| trip when above P-8 and low flow la two loops will cause a reactor trip when above P-7 Blocked below P-7.
| |
| * Design flow is 31,400 gym per loop.
| |
| | |
| _~
| |
| r r . ; . f '-
| |
| I D N.. g y ,
| |
| ./
| |
| l Table A.7-1 (continued) .
| |
| ' Reactor Trip Interlocks Comments Trip setpoints
| |
| : 12. aeactor Coolant Pump Two of Four Interlocked with P-7. Low volta a on all Greater than or equal to 4.8.10V Uervoltage buses beim P-7. each bus.
| |
| : 13. Reactor Coolant Pop - Two of Four 1rterlocked with P-7. Underfrzeuency on two Greater than er equal to 56.0 H2 Underfrequency buses stil trip all each bus.
| |
| react s coolant pump brea'ers and cause ree' ter trip; reactor t'.p blocked below P-7.
| |
| 3a
| |
| : 14. Low Feedwater Flow One of Two to interlocks. Less than or equal to 401 -
| |
| 7 4
| |
| Per Loop
| |
| * of full steam flow at rated thermal power catacident with steam generator we'er level. Greater than or eque to 255 of narrow range instrument span--each steam generator.
| |
| : 15. Low-low Steam Gener. Two of Three lie f aterfocks. Greater than or equal to 211 ator Water Level Per Loop of narrow range instrument span--
| |
| each steam generator.
| |
| : 16. Safety Injection Signal Colacident No interlocks. Not applicable.
| |
| with Actua-tion of Safety Injection
| |
| : 17. Turbine Generator Trf y
| |
| : a. Low Auto $ top 01) Two of Three laterlocked eith P-9. Blocked below P-9. Greater than or equal to 45 psig.
| |
| Pressure
| |
| : b. Turbine Stop Valvo Four of Four Interlocked with P-9. Blocked below P-9. Greater than or equal to 15 open.
| |
| Close
| |
| : 18. Manual One of lus no lateriscks. Not appitcable.
| |
| *0ne of two steam /feedwater flow af smatch f a toincidence with one of two low steam generator water level.
| |
| | |
| The reactor trip system provides for manual initiation of reactor trip by operator action.
| |
| A.7.2.2 System Success Criteria. The success of the reactor trip system is defined as insertion of a sufficient number of rod cluster control assemblies into the active core to reduce the power of the reactor to a hot shutdown level.
| |
| A.7.2.3 System Configuration A.7.2.3.1 Major components. The reactor trip system (Figure A.7-1) is comprised of two redundant, identical trains ( A and B) that' are physically and electrically independent. Input to this system are derived from various sensors located both inside and outside of the plant containment. Most of these signals are processed in the analog protection system racks and result in bistable output (120 volts AC or zero volts AC) to the solid state protection system. Other signals are derived directly from the process sensor by way of contacts in the sensor (such as oil pressure switches on the turbine, auxiliary contacts on circuit breakers, and limit switches on valves). Four independent channels are generally used for the redundant process measurements although certain variable measurements entail only two or three redundant channels.
| |
| Contacts of the input relays enter the logic portion of the system where the coincidence logic (two of three, two of four, etc.) is perfonned. The parameters measured by the process instrumentation, their associated scram setpoints, and the required coincidence logic are presented in Table A.7-1.
| |
| Each of the instrumentation cnannels receives power from a different 120V AC instrument bus. Upon loss of power, an instrumentation channel is designed to fail in the mode that generates a trip signal.
| |
| Additional input relays enter the logic portion directly from the control board switches and pushbuttons. Undervoltage coils of the reactor trip breakers are supplied 48V DC electric power from the logic circuitry. Two series-connected reactor trip breakers carry power from the rod control motor generator sets to the full length rod control system which, in turn, distributes it to the rod drive mechanisms. Loss of power to the mechanisms releases the rods which drop into the core by gravity, resulting in a reactor trip. Similarly, loss of power to the reactor trip breaker undervoltage coil causes the reactor trip breakers to open resulting in a reactor trip.
| |
| 1 A.7-5
| |
| | |
| r 8 A S R R M K S 8 s I
| |
| N D
| |
| O A R
| |
| O g R T O oM p
| |
| E T
| |
| y T A RR ogS '
| |
| OoY OE S
| |
| ,CS A TN T E OE E PI CS R "K T8 R G G t S S
| |
| D E RI N N O XE T D X ER L I
| |
| R R R
| |
| TO R UN E A E
| |
| TSU A
| |
| MM U ,UT
| |
| 'PI E
| |
| L O
| |
| R D (T
| |
| )
| |
| N T"MB N^
| |
| O I
| |
| A TA U A NG A NG E N MN 8 TRI C C UI E UIE D O OO A NA N O TAF TAF I T CM C OOo CSM T CRA CRA A A ATS ATS : L "R L O
| |
| : m O ' a
| |
| : S I T S t r g
| |
| gs f i a .
| |
| D _
| |
| 1'[
| |
| " l l.
| |
| J.
| |
| k T8If
| |
| " s qJ pL.
| |
| c r o
| |
| " S - l
| |
| " - Y - B _
| |
| - T A -
| |
| L E
| |
| L - m N e C
| |
| I T
| |
| IR gLGC I g t s
| |
| ~
| |
| G O -
| |
| L
| |
| -O L -
| |
| - S y
| |
| E
| |
| ~E -
| |
| ,. - l
| |
| - T A --
| |
| {
| |
| - ~A T - T p
| |
| ~ ST -r
| |
| " D T g J SD -
| |
| l - IL i
| |
| T r
| |
| I R S "LO - - SO R S r E EY "S - - - E T
| |
| EY VA o T VA " - SDAt t SDAL - - AN Lk c AN LE " r MASD a MASR "
| |
| F N[
| |
| - /
| |
| f l r
| |
| R e
| |
| s, 8 .
| |
| e " ' < .
| |
| C T C T 1 T U I G
| |
| U -
| |
| U G I
| |
| P P 7
| |
| P O N O T T I L U U L O A O
| |
| r * , .
| |
| e
| |
| ' r N u O g I
| |
| i T
| |
| CM. M A F CEEN C E N ITT. e T
| |
| GOSA ORYR Gf O Y R AI LPST L T L S L S E O E A
| |
| O RDH 8 RDH N TR C
| |
| , TRCT T N M L L L L I
| |
| NAI A I
| |
| E E E E E S NAI A OOWR OOWR T S N N N H N E CBS T h
| |
| N h
| |
| CSS T Y N N N L A s MN
| |
| ,S A H
| |
| C A
| |
| H C
| |
| A H
| |
| C E H C
| |
| A T
| |
| EO T S i
| |
| ST s YA ST NN OES m
| |
| TI MT CUC E R A . -
| |
| T L TTSN L ONO RIC A
| |
| P W RD T GAL N OEE E LLI M ACF N NUR ANO I
| |
| A S$
| |
| T N CS O ON SR EO V
| |
| I 0
| |
| C REPS I
| |
| >,Y=
| |
| | |
| A bypass breaker in parallel with each reactor trip breaker allows online testing of the trip breakers. The train A protection system energizes the train A reactor trip breaker and the train B bypass breaker undervoltage i coils. The train B reactor trip breaker and train A bypass breaker
| |
| :un'dervoltage oils are energized by the train B protection system. When a
| |
| , reactor trip breaker is bypassed, the protection train associated with that t .
| |
| ; ' breaker is considered to be inoperative. The bypass' breakers are
| |
| ;- '. interlocked so that if an attempt is made to close a _second bypass breaker
| |
| !. ' while one is racked in and closed, both bypass breakers will trip open.
| |
| <. This prevents both trains from being and tested simultaneously. If either
| |
| , train is placed in test while the bypass breaker of the other train is racked in and closed, both the bypass breakers and both the reactor trip
| |
| . breakers will trip open. This prevents both trains from being bypassed simul taneously.'
| |
| The reactor trip breaker and the bypass breaker for a train are supplied 126Y DC control power from a batte_ry board separated from the other train (Figurs A.7-2 and Table A.7-2). DC power must be available and the undervoltage coils must be energized by the SSPS to close the breakers.
| |
| Loss of 125V DC control power does not necessarily result in' a reactor trip.
| |
| Power from the rod control motor generator set is supplied through the reactor trip breakers to the rod control systems. The rod control system convertis the power from AC to DC and distributes it to the individual control rod drive mechanisms. During normal operation, the control rods are
| |
| ' fully withdrawn from the reactor core and the stationary gripper coils are energized from the rod control panels. Upon loss of power, all coil
| |
| - assemblies are deenergized, the stationary gripper latches disengage from the control rod drive shaft, and the control rod drive shaft and rod control cluster assemblies drop into the_ active core region, thus shutting down the reactor.
| |
| 'A.7.2.3.2 Support systems. The reactor trip _ system requires 120V AC
| |
| ~
| |
| instrument power supply for the process instrumentation and 125V DC battery-power system for remote closure of the reactor trip breakers. Table A.7-2 shows the power supply boards for the instrumentation channels and the ,
| |
| reactor trip breakers.
| |
| ~
| |
| A.7-7
| |
| | |
| l INV DC SUPPLY SAT. 90. L SKA 210 IM76 th - GANN. *126V DC % eTAL , _ ,
| |
| ,,,,e SAT. 301 ASNORMAL 7
| |
| 1 4e seg leP
| |
| _ ll ::
| |
| 10A 10A
| |
| - 62A -
| |
| + RTA
| |
| ',.b N.N >
| |
| q IGNt'g @S2X"* 1
| |
| ' W ,' FARS i db i 40Pl I ux 1 .
| |
| TumelNE TRIP gus "A" '80 g 4 7 14 16 lt P ft RTI) E i
| |
| a '@) sygg TRAIN A REACTOR PROTECTION $v3 TEM HIGH
| |
| [
| |
| 3 l CWSE STEAM FLOW INTE RRUPT l
| |
| p < I,*Mk '""' TuneNE rinst Our ANN. g i F 7*
| |
| __l - n -u.. f: -' . MPUTER 14 P i 8 22 m TRAs4 A RE ACTOR PROTECTION l I 1l
| |
| '@23)
| |
| , SYSTEM FEEOWATER ISOLATION i l bJ e i'. ANO SAFETV INJECTION OLOCA LOGIC -
| |
| N 3 H H }-( H >
| |
| M FARg l7 824 3 3 (g A TRIP L --- -- J it? (M43 90502A , . TRA.N A REACTOR PROTICTION g V '
| |
| $YSTEM UNDERVOLTAGE TRIP ,q q'g p ,
| |
| B (B RT2) A W
| |
| (Mel
| |
| * $wlTCH LOCATED IN REACTOR TRIP SWITCH GE AR , q'g''
| |
| g ,
| |
| ' SunTCH LOCATED IM mad 4 CONTROL ROOM (B St All HS$191J ACTUATE (M4)
| |
| --< +-i 1-+A>-
| |
| 41 StA2)
| |
| MS41133A ACTUATE (M m Figure A.7-2. Reactor Trip Breaker RTA A.7-8 9
| |
| e
| |
| | |
| i
| |
| /
| |
| Table A.7-2 REACTOR TRIP SYSTEM POWER SUPPLY s
| |
| Component Description Suppi,v Board Power Reactor Trip Switchgear BYP Breaker BYA VBB1 125V DC Reactor Trip Switchgear Trip Breaker RTA VBB1 125V DC Reactor Trip Switchgear BYP Breaker BYB VBB2 125V DC Reactor Trip Switchgear Trip Breaker RTB VBB2 125V DC NIS Control Power Channel I VIPB1-1 120V AC NIS Control Power Channel II VIPB1-II 120V AC 4
| |
| NIS Control Power Channel III VIPB1-III 120V AC NIS Control Power Channel IV VIPB1-IV 120V AC
| |
| . NIS Instrument Power Channel I VIPB1-1 120V AC NIS Instrumesit Power Channel II VIPB1-II 120V AC NIS Instrument Power Channel III VIPB1-III 120V AC NIS Instrument Power Channel IV VIPB1-IV 120V AC SSPS Train A Channel I Input Relays VIPB1-1 120V AC SSPS Train A Channel II Input Relays VIPB1-II' 120V AC
| |
| , SSPS Train A Channel III Input Ral Ays VIPB1-III 120V AC SSPS Train A Channel IV Input Relays VIPB1-IV 120V AC SSPS Train B Channel I Input Relays .VIPB1-1 120V AC SSPS Train B Channel II Input Relays VIPB1-II 120V AC SSPS Train B Channel III Input Relays VIPB1-III 120V AC SSPS Train B Cnannel IV Input Relays VIPB1-IV 120V AC l
| |
| A.7-9 4
| |
| m
| |
| | |
| "' +
| |
| p
| |
| , ,q 33* }
| |
| ThE heating, ventilation,-and air conditioning (HVAC) system is required to keep all the irechanical equipment and the electrical circuitry within a
| |
| ~
| |
| ~
| |
| certain temperature range for them to function properly.
| |
| il ,
| |
| A'.7. 3.3 > Interfacing systems. ' The reactor trip system is a part of the '
| |
| reactor protection system. _ The solid state logic generates, in addition to -
| |
| the. reactor trip signal, signals to actuate engineered safety features (ESF)
| |
| ' equipment (see Engineered Safety Features Actuation System, Table A.6-1).
| |
| A.7.2.4 System Operation..
| |
| u
| |
| :A.7.2.4.1 Normal operation ~. During normal plant operation, the process 3 ' variables do not generate a signal to trip the reactor. The rod drive motor
| |
| -generator sets supply power to the rod control system, and the control rods
| |
| : '6re withdrawn from the core and held in position.
| |
| . A.7.2.4.2 Event response.
| |
| A.7.2.4.2.1 Automatic actions. During a transient, when one or more of the
| |
| . process variables monitored by'the reactor trip system reaches its setpoint, the bistables in the circuits change state and produce signals w~nich are
| |
| -input to the solid state logic system. If the coincidence logic 1 (Table A.7-1) is satisfied, the solid state logic deenergizes the undervoltage coils ~ and trips the react";r.
| |
| ! The :ranual safety injection and reactor trip signals cause an automatic trip and a shunt trip. .The shunt trip bypasses the solid state logic and energizes the trip coil directly.
| |
| l In conjunction with the reactor trip, the breaker auxiliary contacts send signals to trip the turbine, to the steam dump control,' and allow for manual
| |
| . - block of feedwater isolation, safety injection, and high steam flow interrupt functions.
| |
| A.7.2.4.2.2 Manu;l actions. No operator interaction is required for the reactor protection system to trip the reactor.
| |
| + ,
| |
| A.7.2.4.3 ~ Potential for event initiation. The failure of the reactor trip j system to interrupt the power supply to the control rods when a reactor trip
| |
| + A.7-10
| |
| | |
| is needed or failure of sufficient rods to insert will generally result in the core producing more heat than can be removed by the support systems.
| |
| The consequences depend on the initiating event, the ability of the primary and secondary systems and heat removal safety systems to remove heat from the core, and the number of rods that fail to insert.
| |
| A.7.2.5 Ccqtrols, Indicators, and Alarms. Control board selector switches and pushbuttons used for manual operation of the system are listed in Table A.7-3.
| |
| Indicator lamps showing the status (trip or nontrip) of all input and the status of automatic or manual blocks and permissives are displayed on the control board. Annunciators alert the operator to a change in status of an input or the actuation of an output.
| |
| A.7.2.6 Testing, Inspection, and Surveillance Requirements. Periodic surveillance of the reactor trip system is performed to ensure proper operation.
| |
| This surveillance consists of checks, calibraticns, and channel functional testing.
| |
| A.7.2.6.1 Checks. A check consists of a qualitative determination of acceptability by observation of channel behavior during operation. It includes comparison of the channel with other independent channels measuring the same variable. Failures such as blown instrument fuses or defective indicators can be easily recogr.ized by simple observation of the functioning of the instrument or system. Such checks are carried out each shift.
| |
| A.7.2.6.2 Calibration. A channel calibration consists of adjustment of channel output so that it responds, within acceptable range and accuracy, to known values of the parameter which the channel measures. Calibration encompasses the entire channel including alarm and/or trip, and includes the channel functional test discussed below. Calibration is carried out during refueling.
| |
| A.7.2.6.3 Channel functional test. Analog channel testing is performed at the analog instrumentation rack set by individually introducing dununy input signals into the instrumentation channels and observing the tripping of the appropriate output bistables. Process analog output to the logic circuitry is interrupted during individual channel tests by a test switch which, when thrown, deenergizes the asso:: tate 6 logic input and inserts a proving lamp in A.7-11
| |
| | |
| Table A.7-3 CONTROL BOARD SELECTOR SWITCHES AND PUSHBUTTONS FOR MANUAL OPERATION
| |
| : 1. Source Range Block-Reset Switch, Train A
| |
| : 2. Source Range Block-Reset Switch, Train B
| |
| : 3. Intermediate Range Block Switch, Train A
| |
| : 4. Intermediate Range Block Switch, Train B
| |
| : 5. Low Power Range Block Switch Train A
| |
| : 6. Low Power Range Block Switch, Train B
| |
| : 7. Manual Trip Switch 1
| |
| : 8. . Manual Trip Switch 2
| |
| : 9. Pressurizer Safety Injection Block-Reset Switch, Train A
| |
| : 10. Pressurizer Safety Injection Block-Reset Switch, Train B
| |
| : 11. Steam Line Safety Injection Block-Reset Switch, Train A
| |
| : 12. Steam Line Safety Injection Block-Reset Switch, Train 5
| |
| : 13. Safety Injection Actuation Switch 1
| |
| : 14. Safety Injection Actuation Switch 2
| |
| : 15. Containment Isolation Phase A - Containment Ventilation Isolation Actuation Switch 1
| |
| : 16. Containment Isolation Phase A - Containment Ventilation Isolation Actuation Switch 2
| |
| : 17. Spray Actuation, _ Containment Isolation Phase B, Containment Ventilation Isolation Switch 1
| |
| : 18. Spray Actuation, Containment Isolation Phase B, Containment Ventilation Isolation Switch 2
| |
| : 19. Safety Injection Manual Reset and Block Pushbutton, Train A
| |
| : 20. Safety Injection Manual Reset and Block Pushbutton, Train B s
| |
| A.7-12 ,
| |
| | |
| Table A.7-3 (continued) 21.. Spray Reset Pushbutton, Train A
| |
| : 22. . Spray Reset Pushbutton, Train B
| |
| : 23. Containment Isolation Phase A Reset Pushbutton, Train A
| |
| : 24. Containment Isolation Phase A Reset Pushbutton, Train B
| |
| : 25. Containment Isolation Phase 8 Reset Pushbutton, Train A
| |
| : 26. Containment Isolation Phase B Reset Pushbutton, Train B
| |
| : 27. Feedwater Isolation (due to low Tavg coincident with reactor trip) Reset Pushbutton, Train A
| |
| : 28. Feedwater Isolation -(due to low Ta vg coincident with reactor trip) Reset Pushbutton, Train B E
| |
| Y 2
| |
| i e
| |
| d 4
| |
| .A.7-13 L
| |
| - n y
| |
| | |
| the bistable output. Interruption of the bistable output to the logic circuitry causes that portion of the logic to be actuated (partial , trip),
| |
| accompanied by a partial trip alarm and channel status light actuation in the control room.
| |
| Channel functional tests are performed on each functional unit every mon.th except the source and intermediate range neutron flux, reactor trip interlocks, and turbine trip functional units. These are tested at or before startup.
| |
| A.7.2.6.4 Check of logic matrices. Logic matrices are checked monthly on a staggered basis * (i.e., train A, one month and train B the next month) one train at a time every quarter. Input relays are not operated during this portion of the test. Reactor trips from the train being tested are inhibited with the use of the input error inhibit switch on the semiautomatic test panel in the train. At the completion of the logic matrix tests, one bistable in each channel of process instrumentation er nuclear instrumt.ntation is tripped to check closure of the input error inhibit switch contacts.
| |
| The, logic test scheme uses pulse techniques to check the coincidence logic.
| |
| All possible trip and nontrip combinations are checked. Pulses from the tester are applied to the input of the universal logic card at the same terminals that connect to the input relay contacts. Thus, there is an overlap between the input relay check and the logic matrix check. Pulses are fed back from the reactor trip breaker undervoltage coil to the tester.
| |
| -The pulses are of such short duration that the reactor trip breaker undervoltage coil armature cannot respond mechanically.
| |
| The test indications previded are an annunciator in the control room, indicating that reactor trips from the tra,in have been blocked and that the train is being tested, and green and red lamps on the semiautomatic tester to indicate a good or bad logic matrix test. Protection capability provided during this portion of the test is from the train not being tested.
| |
| *The system was modeled with monthly tests. Since this does not impact the demonstration of GO methodology, it was not accounted for in the logic model used for quantification.
| |
| A.7-14
| |
| | |
| l The entire test for the logic of all the trip functions of_ a train has a i mean duration of 10 minutes.
| |
| A.7.2.6.5 Reactor trip breakers. The reactor trip breakers are tested each month on a staggered basis. The following procedure describes the method
| |
| .used for testing the trip breake,rs:
| |
| e With bypass breaker 52/BYA racked out, manually close and
| |
| . trip it to verify its operation.
| |
| e Rack in and close 52/BYA. Manually trip 52/RTA through a protection system logic matrix.
| |
| e Reset 52/RTA.
| |
| . e Trip and rack out 52/BYA.
| |
| e Repeat above steps to test trip breaker 52/RTB using bypass breaker 52/BYB..
| |
| A.7.2.6.6 Full length control assemblies. Any full length control assembly that is not fully inserted is tested every 31 days by moving it at least 10 steps in any one direction. The drop time is tested at least every 18 months or when any maintenance work is performed which might affect the drop time.
| |
| A.7.2.7 Maintenance Requirements. There are no scheduled maintenance requirements for the system components during power operation. Maintenance is carried out as the need arises. This may be when a component fails a scheduled test or when routine visual checks indicate any potential problems. Scheduled maintenance on the breakers is carried out at refueling every 18 months.
| |
| If maintenance is required on any breaker during power operation, the general procedure for performing this maintenance is to replace the breaker to be maintained with one of the bypass breakers. This is accomplished by closing the bypass breaker associated with the reactor trip breaker (e.g., for RTA, BYA is closed), racking out and removing the reactor trip breaker, installing and racking in the other bypass breaker, and opening the associated bypass breaker.
| |
| For RTA the sequence is: close BYA; rack out RTA; insert BYB in RTA cubicle; rack in and close BYB. This procedure ensures the system remains in the normal
| |
| . configuration and allows maintenance to be performed without affecting system operation. ,
| |
| A.7-15
| |
| | |
| A.7.2.8 Technical Specifications. The reactor trip system instrumentation setpoints must be consistent with the trip setpoint values in Sequoyah Unit 1 Technical Specifications, Table 2.2-1. If the setpoint is less conservative, the channel is declared inoperable and the action statements of Specification 3.3.1.1 are applied until the channel is restored to operable status.
| |
| The minimum number of channels and interlocks in Table 3.3-1 must be operable with response times as shown in Table 3.3-2; if not, then the action statements of Table 3.3-1 are applied. The operability criteria for the control rods and the action items in case of inoperable or misaligned control rods are described in Section 3.4.1.3 of the Sequoyah Unit 1 Technical Specifications.
| |
| A.7.3 System Logic Models A.7.3.1 Failure State Top Event Definition. The reactor trip system is analyzed under the assumption that a signal to trip the reactor exists and reaches the undervoltage coils of the reactor trip breakers. Af ter an initiating event, there will be a multiplicity of plant variables which approach their setpoints.
| |
| The instrumentation for these variables will send signals through the SSPS to trip the reactor.
| |
| A.7.3.1.1 Analysis boundary conditions. The boundary conditions used for modeling the reactor trip system are:
| |
| e Unit 1 is in its normal operating mode prior to the initiating event.
| |
| e No operator actions are considered for manual recovery after failure to trip the breakers.
| |
| e Signals for a reactor trip from SSPS trains A and B exist.
| |
| e Signals from one SSPS train are blocked during the logic matrix test of that train.
| |
| e During a reactor trip breaker test, when the bypass breaker is racked in and closed and the associated reactor trip breaker is not yet tripped, the reactor trip breaker and its bypass breaker are both required to trip for success of that train.
| |
| A.7.3.1.2 Interface with the overall safety n:odel. The reactor trip system is analyzed in the overall plant safety model for all initiating events.
| |
| The failure of the reactor trip system is defined as the failure to insert a sufficient number of RCCAs into the core to bring the reactor to a hot A.7-16
| |
| | |
| p shutdown level . The reactor trip system receives input signals from the SSPS to trip the reactor on demand and sends signals to the SSPS for turbine trip, steam dump control, and to the feedwater isolation and safety injection block logic.
| |
| A.7.3.2 The G0 Model. The system GO model-is shown in Figure A.7-3. The trip signals (loss of.48V DC power) from the SSPS trains reach the reactor trip breaker undervoltage coils unless the signals are blocked by an SSPS train test.
| |
| The signals are also input to the undervoltage coils of the bypass breakers which are required to be closed when their corresponding reactor trip breakers are undergoing tests. During this test, the reactor trip breaker and its bypass
| |
| . breaker are required to trip for success of that train. This is to account for the time when the bypass breaker is racked in and closed and the reactor trip
| |
| . breaker is not yet tripped.
| |
| Success of either train of the RTS results in a successful removal of power from the control rod drives (CRD).
| |
| Successful actuation of a train's reactor trip breaker or its bypass breaker results in a signal to the corresponding engineered safety features actuation system (ESFAS) train.
| |
| A type 4 signal generator develops signals for the tests of the SSPS trains and reactor trip breakers. The type 4 generator sequences the signals so that only one test signal is true at a time.
| |
| No power dependency has been modeled for signals from the SSPS trains because loss of power to the instrumentation or the SSPS results in a signal to trip the reactor.
| |
| The effect of loss of offsite power is modeled by the signal 103. On loss of offsite power, the RCCAs drop into the core and the tripping of the breakers is not essential.
| |
| The instrumentation channels-and the development of a reactor trip signal through the SSPS logic are not included in the GO model; however, the calculations given below show that the unavailability is negligible. For example, after an initiating event, various plant parameters approach their setpoints; for example, A.7-17
| |
| | |
| I e d 4
| |
| \
| |
| .' 1,,f k b
| |
| *.. m
| |
| '.} -.
| |
| : 65 33 iP 1r 1p .
| |
| 6tae Usspe%Taag COeL
| |
| .0,5 Team t g, g peacte# Te, .
| |
| SAtma54 4 set - gwpam - "
| |
| gasOE# wet TAGS com enta.nde -
| |
| ='
| |
| o . , , ,
| |
| v.aa .
| |
| 10 b13be t933 3 16 MN . Sep 3
| |
| - tb3 6939 inst v o
| |
| $ t-tm ses R,a see -
| |
| * rasi N - m.a convaot nos e .
| |
| ' estos ce P
| |
| .B 6150 &taba 3- It db tiesOEt wCLfaGE tvfa.B 2, g
| |
| . San A : . SeChatS EEtuGea?EO ST 4-1360 '
| |
| Cet g,
| |
| ..C,. ...
| |
| smaamen a avaEaestsfv to a vast 18 0 Test
| |
| *4 90.. . seO 3 me.3 eso 4
| |
| . , - . t . .
| |
| ' =>
| |
| - m'= .m
| |
| .u
| |
| =
| |
| ' Figure A,7-3. . Reactor Trip System - G0 Model
| |
| | |
| -af ter a loss of coolant accident (LOCA), the following functions will give trip
| |
| ' signals:
| |
| o Overtemperature AT-(two of four) e Pressurizer Low Pressure (two of four) l e Low Reactor Coolant Flow (two of three per loop) i l Each instrumentation channel has the following components which may fail at their associated failure rates. The following is an example for pressure instrumentation:
| |
| Component Failure Rate Sensor and Transmitter 2.09 x 10- per hour Bistable 3.89 x 10- per demand One Input Relay to Each SSPS Train 2.43 x 10- per demand Considering that the sensor or the transmitter failed in the interval between tests * (t = 340 hours) and is yet undetected, the unavailability of the channel is QCH = 2.43 x 10-4 + 3.89 x 10-7 + (2.09 x 10-6) x (340.0)
| |
| = 2.52 x 10-4 For a two of four logic, at least three channels are required to fail for the failure of one SSPS train to generate a trip signal; i.e.,
| |
| QTRAIN
| |
| * 4 9CH - 30 CH
| |
| = 6.38 x 10-11 This contribution rapidly becomes smaller when independent hardware failure is considere,d for failure of two groups of instrumentation to generate a reactor trip signal in either of the two SSPS logic trains. The solid state logic itself has a very small failure frequency, x 10-7/ hour. Since there are larger cont'ributors in the system (e.g., reactor trip breakers at 9.79 x 10-3 failures per demand), the instrumentation system has not been modeled.
| |
| * Tests to determine the operability of the sensors and transmitters are performed on a monthly basis. Since this does not impact the demonstration of GO methodology, it was not accounted for in the logic model used for quantification.
| |
| A.7-19
| |
| | |
| s b
| |
| s
| |
| .'A.7.4 Quantification of System Unava'ilability A.7.4.1. Hardware Failure Contribution _.
| |
| " Table A.7-4 lists all'the components of the RTS, their associated failure modes, and their failure rates per demand. These include all the undervoltage coils, reactor trip' breakers, bypass breakers, and RCCAs.
| |
| A.7.4.1.1 Active components. Active components considered are:
| |
| e -Reactor trip breakers and bypass trip bregkers fail closed.
| |
| The frequency of this event is 9.79 x 10-J/ demand.-
| |
| : e. The failure of the RCCAs to insert can be due .to misalignment between the RCCAs and the core.- The RCCAs are tested for their drop time every 18 months and every 31 days the full length assemblies not fully inserted are tested for free movement. The failure of an RCCA to insert fully due to random independent failure has a frequency of 8.49 x 10-5 failures per-hour. There are 53 RCCAs in the Sequoyah Unit I reactor core. Using the binomial probability theorem, the frequency of two or more RCCAs not to insert is given by QRCCA = 9.90 x 10-6
| |
| -A.7.4.1.2 : Passive components / passive failures. Passive failures of any electrical cables or contacts have been considered as those causing wiring shorts to power. Passive failures of instrumentation prior to event initiation have been considered to quantify the failure probability of input
| |
| . signals to the.SSPS.
| |
| Undervoltage coils may remain energized due to a wiring short to power. The frequency of wiring shorts to power is 3.32 x 10-6 per hour. Using half the test interval 'as the time to detect this fault, the unavailability of the coil-is Quy = 3.32 x 10-6 x 360 t
| |
| J a = 1.'16 x 10-3 A.7.4.2' Test and Inspection Contribution..
| |
| A.7.4.2.1 System unavailability during test and inspection. .
| |
| Instrumentation channels are tested once a month, a channel at a time for every function. - The channel under test has its bistable output to the logic A.7-20
| |
| | |
| Table A.7-4 COMPONENT FAILURE DATA FOR THE REACTOR TRIP SYSTEM Component Failure Mode Failure Rate Repres ntation Undervoltage Coils Fail to Deenergize 1.16-3/d 1-1351 Reactor Trip Breaker A Fails to Open 9.79-3/d 1-1353 on Demand Reactor Trip Breaker B Fails to Open 9.79-3/d 1-1353 on Demand Bypass Breaker A Fails to Open 9.79-3/d 1-1352 on Demand Bypass Breaker B Fails to Open 9.79-3/d 1-1352 on Demand Rod Control Cluster Two or More Fall 9.90-6/d 1-1354 Assemblies to Insert NOTES:
| |
| i 1. Exponential notation is indicated in abbreviated form; i.e., 1.16-3 = 1.16 x 10-3
| |
| ; 2. Per demand is indicated in abbreviated form by /d.
| |
| e O
| |
| A.7-21
| |
| | |
| l l
| |
| circuitry interrupted which results in a trip signal from that channel.
| |
| Therefore, no contribution has been considered for channel functional tests.
| |
| Logic matrices are tested each month on a staggered basis; i.e., train A is tested one month and train B the next month.* During this test, the output -
| |
| of the train is blocked and the RTS depends on the second train for trip signals. The test has a duration of 10 minutes, giving a train an unavailability of gTRAIN , 10 minutes = 2.31 x 10-4 3 months The reactor trip breakers are tested once a month on a staggered basis.
| |
| First, the bypass breaker is tested for its trip capability and then racked into position and closed. The reactor trip breaker is then tested by manual actuation of a trip switch. Assuming that there is an interval of 2 minutes when both the reactor trip breaker and its bypass are racked in and closed, the frequency of this configuration is
| |
| , , 2 minutes = 4.63 x 10-5 1 month During this interval, both these breakers must trip for the success of the train.
| |
| A.7.4.2.2 Human error during testing and maintenance. The design of the RTS is such that system failures due to human errors are minimized.
| |
| e Only one instrumentation channel can be tested and out of service at a time.
| |
| e The status of testing the channels is continuously displayed in the control room. Failure to restore a sensor channel to service at the completion of the test would be detected by the control room operators when the testing is reported as i complete.
| |
| e Only one logic train can be tested at a time, e The logic test is manually initiated. After all the logic schemes of all the functions have been tested, the logic train is restored to service.
| |
| *See Section A.7.2.6.4.
| |
| A.7-22
| |
| | |
| _ u _. J -
| |
| e Only one reactor trip breaker can be in test position at a time.
| |
| e An attempt made to bypass both the reactor trip breakers will result in a reactor trip.
| |
| Therefore, no unavailability due to human error during testing and maintenance is included in the quantification.
| |
| A.7.4.3 Maintenance Contribution.
| |
| A.7.4.3.1 System unavailability during maintenance. As discussed in Section A.7.2.7, maintenance on the reactor trip breakers is performed with
| |
| . the reactor trip system in a normal configuration except for the short time wher, changing breakers. This maintenance occurs infrequently (less than i once per year), making the contribution to unavailability insignificant compared to the test unavailability.
| |
| Checks are conducted on instrumentation channels at every shift and minor maintenance work is carried out at once. If a channel is removed from service for maintenance, it results in a trip signal input to the SSPS.
| |
| A.7.4.3.2 Human error. Human error after minor maintenance work on the instrumentation channels (such as restoring the channels to service) would be detected due to: (1) its status being continuously displayed in the control room, and (2) a channel check being carried out at every shift.
| |
| After maintenance on a reactor trip breaker, the bypass breaker may be lef t racked in and closed after both reactor trip breakers are in position. SSPS would be in a partial trip status. There are control room indicators on the position of the breakers which will alert the operators. Also, the design of the RTS is such that all four breakers receive trip signals from the two SSPS trains.
| |
| The sensor channel calibration tests are performed at least every 18 months. This testing requires the adjustment of the channel output so that it responds to known values of the parameters which the channel monitors. The human errors of miscalibration and improper restoration apply to the sensor channel calibration tests.
| |
| A.7-23
| |
| | |
| Miscalibration can occur as a result of errors in the calibration procedure, inaccuracies in the standard used to calibrate the sensor loop, or errors in the commission'of the procedure.
| |
| Errors in the calibration procedure could result in miscalibrated sensors for all sensors of a particular functional group. These errors would be detected during shift checks or startup when the output of a functional group is compared to the output of other instruments which monitor the same parameter. Errors in the procedure could also result in an instrument or functional group of instruments which are not properly restored to service or are damaged during the calibration procedure. These errors will also be detected by comparing the output of instruments with the output of other similar instruments monitoring the same parameters.
| |
| Inaccuracies in the standard used to calibrate a set of instruments result in miscalibrated instruments. A particular. standard may be used to calibrate all sensors of the same type and function. The need for large changes in instrumentation calibration in more than one channel or group should alert the operator that the standard may be inaccurate. In that case, the standard would be checked for proper operation and the instruments recalibrated.
| |
| Errors of omission or commission in the procedure could result in miscalibration or nonfunctional instrument loops. These will be detected only after calibration is completed. If only one channel is involved, the error would be detected by comparing with the output of the other channels.
| |
| Failure of the SSPS to generate a reactor trip signal would still require two or more functional groups to fail. Therefore, this contribution to unavailability has not been ir :1uded.
| |
| A.7.4.4 Human Action Contribution The RTS is entirely an automatic system and no human action is required for its functioning. Manual actuation of channel trips and reactor trip is possible in the design, but only leads to successful or inadvertent reactor trip.
| |
| A.7.4.5 Common Cause Contribution. Human errors and other common cause failures of hardware have not been quantified in this analysis.
| |
| A.7-24
| |
| | |
| A.8 AUXILIARY FEEDWATER SYSTEM A.8.1 Introduction and Su:amary A.8.1.1 System Definition.
| |
| A.8.1.1.1 Overview. The Sequoyah auxiliary feedwater system (AFWS) serves as an alternate or backup supply of feedwater to the secondary side of the steam generators. The AFWS basically consists of three pump trains (one turbine-driven and two motor-driven) which draw water from one of two sources and deliver it to the unit's steam generators. Figure A.8-1 illustrates a simplified block diagram of the AFWS.
| |
| During normal operation, the AFWS is in a standby mode. The system starts automatically (all three pumps) on loss of offsite power, a safety injection signal, a trip of both main feedwater pumps, or a trip of one main feedwater pump at greater than 80t of plant power output. In addition, the motor-driven pumps start on a low level signal from any steam generator and the turbine-driven pump start: on a low level signal from any two steam generators.
| |
| A.8.1.1.2 Purpose. This analysis is performed to determine the probability of the AFWS failing to provide adequate water to the steam generators.
| |
| Success requires the system to start upon receipt of an automatic actuation signal and provide rated flow from at least one pump to at least two steam generators for a minimum of 8 hours. The analysis utilizes the G0 computer code methodology to represent the system in the form of a mathematical model. The model generates success and failure probabilities at the system level based on input probabilities at the component level. In addition to hardware failures quantified by the model, test and maintenance unavailability was also included.
| |
| A.8.1.2 Analysis Boundary Conditions. The system is analyzed using the following boundary conditions and assumptions (specific boundary conditions are described further in Section A.8.3.1.1):
| |
| e The analysis is based on the system normal standby configuration before receipt of an actuation signal.
| |
| e Only the system's automatic actions are included in this analysis.
| |
| No credit is taken for operator actions to recover failed equipment or to provide flow from an alternate source over the period of this analysis.
| |
| A.8-1
| |
| | |
| I '
| |
| sG i PRIMARY
| |
| ' i
| |
| ,gg, < ' m
| |
| ' , I Eu^PPLv SG 2 I i m m I
| |
| AFW PUMP i r r I TRAIN SG 3 SECONDARY m m WATER r 1' AFW PUMP r I EUPPLY TRAIN SG 4 Figure A.8-1. Sequoyah Unit 1 Auxiliary Feedwater System Simplified Block Diagram A.8-2
| |
| | |
| .e Steam generator availability is not considered as part of this analysis. Steam for the turbine-driven pump is considered a support function.
| |
| e A mission time of 8 hours is assumed for successful AFWS operation.
| |
| e The computed availability of the AFWS over the specified mission time is conditional on the availability of support systems. All support systems are assumed available with a probability of 1.0.
| |
| The availability of support systems and their dependencies will be
| |
| . included in the auxiliary and. safety models (see Figure A.8-2).
| |
| A'.8.1.3 ' Systems ' Analysis Results.
| |
| A.8.1.3.lu Quantification of conditional failure states. The probability of the AFWS failing to provide the required level at secondary cooling given the success of all support systems outside the system boundary is 1 x 10-5, f
| |
| The quantification of system success probability under varying support system states will be quantified in the plant safety model.
| |
| A.8.1.3.2 Dominant contributors to unavailability. The major contributors to system unavailability are third order fault sets. Of these fault sets, 24 of the. leading contributor fault sets are listed in Table A.8-1. The 24 fault sets are made up of various groupings of only six component types and contribute over 77% of the system failure probability.
| |
| -A.8.2 System Description A.8.2.1 Accident Mitigation. The AFWS is designed to maintain the heat sink capabilities of the steam generators. It is classified as an engineered safeguards features' system (ESFS), and as such,'is directly relied on to prevent
| |
| : core damage.
| |
| [-
| |
| L .The AFWS is called upon for plant cooldown in the case of initiating events such as trip of both main feedwater pumps, secondary pipe ruptures, loss of electrical power (blackout),.or'a flood above plant grade. It can also be used to maintain i
| |
| steam generator water levels above minimum safe levels following a loss of coolant accident (LOCA) in the primary system.
| |
| A.8.2.2 System Success Criteria. The AFhS success criteria require that the system start on receipt of an automatic actuation signal and provide rated flow from at least one AFW pump to at least two steam generators. The AFWS must A.8-3 1
| |
| | |
| ,l l T L N O E R N T O N P O M )T N C OE Y CM R SL N A s RA O I L N n MLEMR IX R o
| |
| RI OI i OO O V UI T t RY OO N AA A i E P L R C (NE } gg SU d WP \ *- WT n OU i FC o AA PS g / C f
| |
| \ / o y
| |
| , r a
| |
| d
| |
| \ / n u
| |
| RY E L g / B o
| |
| T PP R l A U Y E a WS RT c AA M i
| |
| % ILW E s I
| |
| X DT y
| |
| ES n
| |
| % UEY AFS
| |
| # P m
| |
| e t
| |
| * s
| |
| % " y m- g" / S
| |
| - / t r
| |
| e .
| |
| a
| |
| - # d w
| |
| % e
| |
| - )
| |
| N - e
| |
| . )
| |
| R E
| |
| T A
| |
| ' O I
| |
| T C
| |
| F y
| |
| r M W NA a A G AR . i E
| |
| N MET l
| |
| - T S
| |
| I L
| |
| U HIN i
| |
| x
| |
| =
| |
| I O # u O A
| |
| - C
| |
| (
| |
| * 1
| |
| - p t
| |
| i
| |
| . n
| |
| -. / \ U
| |
| * h p
| |
| * a y
| |
| o
| |
| \
| |
| 'll ll m
| |
| lI
| |
| /
| |
| * u q
| |
| e h S g
| |
| 3r
| |
| " G . 2 S .
| |
| "p N 8
| |
| /
| |
| [ f[I!llg l[
| |
| -(x~.
| |
| \ N
| |
| \
| |
| A e
| |
| r u
| |
| g y i F
| |
| [ N
| |
| / \
| |
| /l l {\
| |
| 3 A l l;
| |
| | |
| Table A.8-1 SEQUOYAH UNIT I AUXILIARY FEEDWATER SYSTEM LEADING CONTRIBUTOR FAULT SETS (All Supports Systems Assumed Working)
| |
| Approximate Single Number Total
| |
| ##'" I Fault Sets Failure of Failure Probability Combinations Probability Pressure Control Turbine-Driven Pump Level Control Valve 5.03-7 4 2.01-6 20.1 valve Motor-Driven Pump Level Control Valve Turbine-Driven Pump 3.59 7 4 1.44-6 14.4 Testing and Maintenance Motor-Driven Pump Turbine-Driven Pump Level Control Valve 3.44-7 4 1.38 6 13.8 i
| |
| Motor-Driven Pump Pressure Control Turbine-Driven Pump 3.59-7 2 7.18-7 7.2 Testing and Valve Maintenance Motor-Driven Pump Pressure Control Turbine-Driven Pump 3.44-7 2 6.88-7 6.9 Valve Pressure Control Pressure control Turbine-Driven Pump 5.03-7 1 5.03-7 5.3 Valve Valve Motor-Driven Pump Motor-Driven Pump Turbine-Driven Pump 2.45-7 2 4.90-7 4.9 Testing and Maintenance Turbine-Driven Pressure Control Level Control Valve 6.12-8 4 2.45-7 2.5 Ptaip Testing and Valve Maintenance Motor-Driven Pump Motor-Driven Pump Turbine-Driven Pump 2.35-7 1 2.35-7 2.4 Total 24 7.71-6 77.5 NOTE: Values are presented in an abbreviated scientific notation; e.g., 5.03-7 = 5.03 x 10-7
| |
| | |
| -. ~
| |
| provide cooling for at least an 8-hour time period at which time the residual heat removal (RHR) system can be placed in operation.
| |
| A.8.2.3 System Configuration. The Unit 1 and Unit 2 AFW systems are basically independent but share the normal water source. The systems piping arrangement is shown in Figure A.8-3.
| |
| The AFWS has two water sources: the condensate storage tank, which is the normal water supply, and the essential raw cooling water (ERCW) system, which is the backup supply.
| |
| The motor-driven pumps receive their normal water supply from a common header and each receives its backup water source from a different ERCW system discharge header supply line. The turbine-driven pump receives its nonnal water supply from the same common header as the motor-driven pumps, but receives its backup water supply from either of two Unit 1 ERCW syste n main supply headers. The motor-driven pumps are powered from 6.9 kV shutdown boards 1A-A and 18-B and the turbine receives its steam for motive power from steam generator 1 with steam generator 4 as a backup.
| |
| When actuated, each motor-driven pump supplies two steam generators and the turbine-driven pump supplies all four steam generators. Between the pumps and prior to the steam generator inlets are level control valves which, based on the steam generator level indicators, regulate the flow of water to each steam generator. In addition, there are various other isolation valves and check valves to control the flow.
| |
| A.8.2.3.1 System components. The AFWS consists of: condensate storage tanks, motor-driven pumps, a turbine-driven pump, piping, flow control valves, check valves, gate valves, pressure control valves, level control valves, pressure switches, and pressure transmitters. Below are brief descriptions of some of the major components. Table A.8-2 lists all of the major components used in the model.
| |
| e Condensate Storage Tank (CST). The AFWS has two condensate storage tanks as a nonnal water supply. Eacn CST holds 385,000 gallons of water, of which 190,000 gallons are reserved for the AFWS. This reserve capacity is accomplished by means of a standpipe in the tank through which all other systems are supplied. The CST is the only part of the AFWS A.8-6
| |
| | |
| .4
| |
| -)
| |
| ECW 3 **e O
| |
| D v 3 .~.~
| |
| p NY N'
| |
| ;,; h 3., O gg few 3 922 X S eri gg ECW 3 373 LO CST -
| |
| 3 ens Q 3.. ..
| |
| jP gmyg g 3 T3 DU jb .W etat.6 Ff fDm4TER y, 3 431 ggg PCW 3 9144 Q N N E&2 LEG 5=O 353 t.7-, sea f 9
| |
| % Gatt WAtwE IE mec=c to tev 3*n **
| |
| f sutta ##tT WALW6 3 8E8 'I3 ION est AOie A W Stos.Co.eTROL watwE g, 338 N PuomesattT CLOS 400 33, 38 3 g.
| |
| ,o gg Isam FEEDWEATER
| |
| ','O','f*,','%'.'. '" ** S .32 O
| |
| : 3. 3 Eas
| |
| , o. nr. 'c FCv3tNo ,O caevias w ;; N--c>o- -
| |
| c;o aan Ortsatte LEwit N so. e ''
| |
| FCW &l26A LV L DB
| |
| = X 4 3 8E'
| |
| " g w- "e ' ''a5'"
| |
| 1''y... ::,, m. == ::,,
| |
| .... -- f I.ca CteECE WALVE P Os
| |
| *cv '=a n o '*SceemAGE aana
| |
| * ce ;", ,T.Lu.
| |
| 0 SYtaasGameE afut FCW 31388 qy j
| |
| O to 3 329 70 3 833 LO 3 437 .
| |
| M O c.a .oe=sare svoaaGa .
| |
| - N. -'
| |
| . (a '''
| |
| W LO
| |
| .O LO LCW 34M _ 3yy
| |
| .. . ~ , .
| |
| 3 u .
| |
| 2,o V .
| |
| . .. .= /.- '
| |
| FttDevAfte
| |
| ..c w sv T. .o.. ..
| |
| c,, , c,v.
| |
| Figure A.8-3. Auxiliary Feedwater System Simplified System Schematic
| |
| | |
| Table A.8-2 SEQUOVAH AUXILIARY FEEDWATER SYSTEM COMPONENTS.
| |
| Component
| |
| '9
| |
| * Function Failure Mode
| |
| ,f condensate Storage Tank 1 47W803 Stores Water Supply Fall to Contain Water Sup91 y, Plug Condensate Storage Tank 2 47W803-2 Stores Water Supply Fail to Contain Water Supply, Plug Motor-Driven Pump 1A-A 47W803-2 Pump Water Fail to Start, Fall to Operata Motor-Driven Pump 18-B 47W803-2 Ptamp Water Fall to Start Fail to Operate Turbine Pump 1A-Sa 47W803-2 Pump Water Fall to Start, Fail to Operate Butterfly Valve 1-67-520A 47WB45-2 Isola 130n Valve Transfer Closed, Plug Butterfly Valve 1-67-520B 47WB45-2 Inlation Valve Transfer Closed Plug Butterfly Valve 1-67-718A 47W845-2 1so?ation Valve Transfer Closed, Plug Butterfly Valve 1-67-718B 47WB454 Isolation Valve Transfer Closed. Plug Check Valve 3-508 47WrJ3-1 Prevent Backflow Fall Open, Reverse Leakage Check Valve 3-509 476803-1 Prevent Backflow Fail Open, Reverse Leakage Check Valve 3-510 ~ 474803-1 Prevent Backflow Fail Open, Reverse Leakage Check Valve 3-511 47.903-1 Prevent Backflow Fall Open, Reverse Leakage y Fail Closed
| |
| . Check Valve 3-805 47WbM-2 Prevent Backflow CD Check Valve 3-806 47WB03-c Pr vent Backflow Fail Closed co Check Valve 3-810 47WB03-2 Pr ent Backflow Fail Closed Check Valve 3-820 47WBC3-2 Pre t**' Fall Closed Check Valve 3-821 47W803-2 Pres *
| |
| +10w Fail Closed Check Valve 3-830 47WB03-2 Prew.n Bacut' low Fall Closed Check Valve 3-831 47WB03-2 Prevent Backflow Fail Closed Check Valve 3-832 47WB03-2 Prevent Backflow Fall Closed Check Valve 3-833 47W803-2 Prevent Backflow Fall Closed Check Valve 3-861 47WB03-2 Prevent Backflow Fati Closed Check Valve 3-862 47WB03-2 Prevent Backflow Fall Closed Check Valve 3-864 47WB03-2 Prevent BacLflow Fati Closed Check Valve 3-871 47W803-2 Prevent Backflow Fail Closed Check Valve 3-872 47WB03-2 Prevent Backflow Fail Closed Check Valve 3-873 47W803-2 Prevent Backflow Fail Closed Check Valve 3-874 47WB03-2 Prevent Backflow Fail closed Check Valve 3-891 47W803-2' Prevent Backflow Fail Closed Check Valve 3-892 47W803-2 Prevent Backflow Fail Closed Check Valve 3-921 47WB03-2 Prevent Backflow Fail Closed Check Valve 3-922 47WB03-2 Prevent Backflow Fall Closed Flow Control Valve 1-15 47W803-2 Isolation Valves Transfer Closed, Plug Flow Control Valve 1-16 47W803-2 Isolation Valves . Fall to Open, Transfer Closed, Plug Flow Control Valve 1-17 47W803-2 Isolation Valves Transfer Closed, Plug Flow Control Valve 1-18 47W803-2 Isolation Valves Transfer Closed, Plug Flow Control Valve 3-116A. 47WB03-2 Isolation Valves Fall to Open, Plug Flow Control Valve 3-116B 47W803-2 Isolation Valves Fail to Open Plug Flow Control Valve 3-126A 47W803-2 Isolation Valves Fail to Open, Plug
| |
| " Valves FCV 1-51 and FCV 1-52 are considered part of the turbine pump.
| |
| l I _ _ _ _ _ _ _
| |
| | |
| k 7c Table A.8-2 (continued) .
| |
| Component. Function . Failure Mode f
| |
| Flow Control Valve 3-1268 47W803 Isolation Valves Fail to Open Plug Flow Control Valve 3-136A 47W803-2 I,olation Valves Fall to Open, Plug Flow Control Valve 3-136B 47W803-2 Isolation Valves Fall to Open, Plug Flow Control Valve 3-179A 47W803-2 Isolation Valves Fail to Open, Plug-Flow Control Valve 3-179B 47W803-2 Isolation Valves Fail to Open, Plug Gate Valve 2-504 47W804-1 Isolation Valves Transfer Closed, Plug Gate. Valve 2-505 47WB04-1 Isolation Valves Transfer Closed Plug Gate Valve 3-800 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-803 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-804 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3409 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-826 47W803-2 Isolation Valves Transfer Closed, Plug Gate valve 3-827 47W803-2 Isolation Valves Transfer Closed. Plug Gate Valve 3-828 47W803-2 Isolatf ort Valves Transfer Closed, Plug Gate Valve 3-829 47W803-2 Isolation Valves Transfer Closed. Plug Gate Valve 3-833 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-835 47W803-2 Isolation Valves Transfer Closed Plug Gate Valve 3-836 47W803-2 Isolation Yalves Transfer Clo:ed Plug c3 Gate Valve 3-837 47W803-2 Isolation Valves Transfer Closed Plug 4 Gate Vaive 3-867 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-868 47W803-2 Isciation Valves - Transfer Closed, Plug Gate Valve 3-869 47W803-2 Isolation Valves Transfer Closed Plug Gate Valve 3-870 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-875 47W803-2 Isolation Valves ' Transfer Closed. Plug Gate Valve 3-876 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-877 47W803-2 Isolation Valves Transfer Closed, Plug Gate Valve 3-878 47W803-2 Isolation Valves Transfer Oosed, Plug Level Control Valve 3-148 47W803-2 Control Flow of Water Fail to Open, Plug Level Control Valve 3-156 47W803-2 . Control Flow of Water Fail to Open, Plug Level Control Valve 3-164 47W803-2 Control Flow of Water Fall to Open, Plug Level Control Valve 3-171 47W803-2 Control Flow of Water Fail to Open Plug Level Control valve 3-172 47W803-2 Conteol Flow of Water Fail to Open Plug Level Control valve 3-173 47W803-2 Control Flow of Water Fall to Open, Plug Level Control Valve 3-174 47W803-2 Control Flow of Water Fall to Open, Plug Level Control Valve 3-175 47W803-2 Control Flow of Water Fail to Open, Plug Pressure Control Valve 3-122 47W803-2 Ptap Discharge Fall to Open, Transfer Closed, Plug Pressure Control Pressure Control Valve 3-132 47WB03-2 Ptap Discharge Fall to Open, Transfer Closed, Plug Pressure Control Pressure Switch Sensors 47W611-3-3 Monitors Fall to Operate (several) 47W611-3-4
| |
| | |
| that is not designed to er.gineered safety feature standards; however it is backed up by the ERCW system which is designed to ESF standards.
| |
| o Motor-Driven Pump. The motor-driven pumps are rated at 440 gpm at 2,900 feet total developed head (TDH) and are powered from 6.9 KV shutdown boards 1A-A and 18-B. The pumps are self-cooling and do not depend on other water systems for cooling. Both pumps are located in the same room which is cooled by redundant room coolers.
| |
| e Turbine-Driven Pump. The turbine-driven pump is rated at 880 gpm at 2,600 feet TDH and is powered from steam generators 1 or 4. The turbine is normally driven by steam generator 1. If turbine-driven pump discharge pressure is low, the steam source is automatically switched to steam generator 4.
| |
| A.8.2.3.2 Support systems. The AFWS as modeled has six support systems:
| |
| the electrical system; the control air system; the ERCW system, which is the backup water source; room cooler for the motor-driven pump environment; the AFWS actuation signal; and the steam supply from the steam generators.
| |
| Table A.8-3 lists the details of the electrical and control air systems' support functions.
| |
| A.8.2.4 System Operation.
| |
| A.8.2.4.1 Normal operation. During normal plant operation, the AFWS is in a standby mode. It can be used for plant startup, shutdow. and hot standby conditions if necessary.
| |
| A.8.2.4.2 Event response.
| |
| A.8.2.4.2.1 Automatic actions. The AFWS is designed to start automatically if:
| |
| e Offsite power is lost.
| |
| e An safety injection system actuation signal is received.
| |
| e Both main feedwater pumps trip.
| |
| e One main feedwater pump trips at 807, or more power.
| |
| In addition, the motor-driven AFWS trains (motor-driven pump, pressure control valves, and level c ntrol valves) will be actuated if a low-low 1
| |
| level signal is received from any steam generator. The turbine-driven AFWS train (turbine-driven pump and level control valves) will be actuated if a A.8-10
| |
| | |
| i Table A.8-3 SEQUOYAH UNIT.1 AFWS ELECTRICAL SUPPORT
| |
| " trol Component f*f"r o Po e Remarks Motor-Driven Pump 1A-A 6.9 kV Shutdown Board 1A-A DC Battery Board I Manual transfer to battery board III.
| |
| Motor-Driven Pump 1B-B 6.9 kV Shutdown Board IB-B DC Battery Board II Manual transfer to battery board IV.
| |
| Turbine Pump 1A-S Steam from Steam Generator 1 DC Battery Board III Manual transfer to battery Alternate Supply from Steam or DC Battery board IV (operates flow Generator 4 Board IV and control valve 'l-51 and 120V AC VIP B1-III flow control valve 1-52).
| |
| or 120V AC VIP B1-IV 2-ko Flow Control Valve 1-15 480V Reactor MOV Board 1A2-A Flow control valves 1-15,
| |
| :: Flow Control Valve 1-16 480V Reactor M0V Board IA2-A 1-17, 1-18, all fail in Flow Control Valve 1-17 480V Reactor MOV Board 1A2-A positions which are Flow Control Valve 1-18 480V Reactor MOV Board IB2-B normally open. Power not Flow Control Valve 3-116A 480V Reactor MOV Board 1A2-A needed for successful Flow Control Valve 3-116B 480V Reactor MOV Board 1A2-A operation. Control power Flow Control Valve 3-126A 480V Reactor M0V Board 182-B is supplied through a Flow Control Valve 3-126B 480V Reactor MOV Board 182-B transformer from the main Flow Control Valve 3-136A 480V Reactor MOV Board 1A2-A power supply.
| |
| Flow Control Valve 3-136B 480V Reactor MOV Board 1A2-A Flow Control Valve 3-179A 480V Reactor MOV Board 1B2-B Flow Control Valve 3-179B 480V Reactor MOV Board 1B2-B Pressure Control Valve 3-122 480V Reactor MOV Board 1A2-A 120V AC VIPa B1-I Vital Instrument Power Pressure Control Valve 3-132 480V Reactor MOV Board 182-B 120V AC VIP B1-II Vital Instrument Power aVIP = vital instrument power.
| |
| | |
| , -- w
| |
| . - ;c
| |
| . Table A.8-3 (continued)
| |
| . 40
| |
| . -i?L Component f""r
| |
| , o r Remarks Level Control Valve 3-148 Control Air DC Battery Board II level control valves Level Control Valve 3-156 Control Air DC Battery Board I 3-148, 3-156,'3-164 Level Control Valve 3-164 Control Air DC Battery Board I 3-171, all fail'open..
| |
| 2 Level Control Valve 3-171 Control. Air DC Battery Board II Power not needed for ja successful operation.
| |
| Level Control Valve 3-172 Control Air DC Battery Board III Level control valves Level Control Valve 3-173 Control Air DC Battery Board IV 3-172, 3-173, 3-174, Level Control Valve 3-174 Control Air DC Battery Board IV 3-175 fail closed on Level Control Valve 3-175 Control Air DC Battery Board III loss of air.
| |
| Pressure 5 witch Sensors Power source is assumed l (several) to be the same as the I component for which it supplies a sensing function.
| |
| ! l i
| |
| I l
| |
| _a _m ---L___m.-- _ _ _ 'Laus
| |
| | |
| 5 low-low level signal is receised from any two steam generators. All three pumps are designed to deliver rated flow within 1 minute of receiving a start signal.
| |
| Once the system is actuated, many of its functions are also controlled automatically, e The ERCW system supply to the AFW pumps is automatically initiated on. a two-out-of-three low pressure signal on the CST suction lines to the AFW pumps, e The discharge pressure is monitored by a pressure transmitter located on the discharge leg' of each motor-driven pump. This signal is used to throttle a pressure control valve (PCV) and maintain constant pump discharge pressure.
| |
| e The level control valves (LCV) are controlled by level signals from each steam generator. Pressure switches are located downstream of the LCVs in the discharge lines from the turbine-driven pump to shut off the appropriate line automatically if a pipe break or severe leak occurs.
| |
| A.8.2.4.2.2 Manual operator actions. No manual operator actions were considered in this analysis.
| |
| A.8.2.5 Controls, Indicators, and Alarms. The location of major controls, indicators, and alarms for the auxiliary feedwater system are listed in Table A.8-4.
| |
| A.8.2.6 Testing, Inspections, and Surveillance Requirements. The following sununarizes the testing, inspection, and surveillance requirements for the AFWS which pertain to the system safety model:
| |
| : 1. SI-5, Auxiliary Feedwater Valves Position Verification (Revised February 10, 1981). This surveillance instruction procedure verifles visually that each manual, power-operated, and automatic valve in the AFWS main flow path is in the correct position. This test is performed once every 7 days.
| |
| : 2. SI-118, Motor-Driven Auxiliary Feedwater Pump and Valve Automatic Actuation (Revised November 2,1981). This surveillance instruction procedure verifies that the motor-driven pump trains are operable, but there is no flow test. This test is performed once every 18 months.
| |
| : 3. SI-118.1. Turbine-Driven Auxiliary Feedwater Pump and Valve Automatic Actuation (Revised October 16, 1981). This surveillance instruction procedure verifies that the turbine-driven pump train B is operable, but there is no flow test. This test is perfonned once every 18 months.
| |
| A.8-13
| |
| | |
| I Table A.8-4 CONTROLS, INDICATORS, AND ALARMS
| |
| , Location Main Component Functions Main Control Local Control A Room Condensate-Storage Tank 1 Level X X X Condensate Storage Tank 2 Motor-Driven Pump 1A-A Hand Switch / X X Motor-Driven Pump 18-B Position Voltage X Temperature X Suction Pressure X Discharge Pressure X Turbine-Driven Pump 1A-S Discharge Flow X Discharge Pressure X Suction Pressure X Hand Switch / X X Position Condensate Storage Tank Pressure X Piping Header Steam Generator Inlet Flow X X Piping Steam Generators Level X X X Flow Control Valves Hand Switch / X 1-15, 1-16, 1-17, 1-18 Position 3-126A, 3-126B, 3-116A, s 3-116B, 3-136A, 3-136B, 3-179A, 3-179B Pressure Control Motor-Driven Pump X X Valve 3-122 Discharge Pressure Pressure Control Valve 3-32 1
| |
| Level Control Valve Hand Switch / X i 3-148, 3-156, 3-164 Position 3-171, 3-172, 3-173 3-174, 3-175 A 8-14
| |
| | |
| ~
| |
| L >
| |
| '4. SI-130.1. Turbine-Driven Auxiliary Feedwater Pumps (Revised February TT}l32). This surveillance instruction procedure-2 veriffes that the turbine-driven pump is operable, but there -is no
| |
| > flow test. : This test is performed once every 31 days.
| |
| : 5. SI-130.2, Motor-Driven Auxiliary Feedwater Pumps (Revised December 12, 1981). This surveillance instruction procedure verifies that the motor-driven pumps are operable, but there is no flow test. This test is' performed once every 31 days.
| |
| : 6. 51-276, Auxiliary Feedwater Automatic Control Valves Operability (Revised April 27, 1982). This procedure ver1 Ties the operability of the AFWS automatic valves (LCVs and PCVs).- In the procedure is ;
| |
| included a flow test which indirectly veriffes other valve 4 positions. This procedure is performed once every 31 days.
| |
| A.8.2.7 Maintenance Requirements. Maintenance is performed on the auxiliary feedwater system as required. Generic maintenance data reflect a minimal
| |
| . preventive maintenance program on the motor-driven pumps but more frequent maintenance on the turbine-driven pump due to its complexity. (The corresponding unavailability values are given in Section A.8.4.3.1.)
| |
| A.8.2.8 Technical Specifications Effect on Operation. If one AFWS pump is found inoperable, it must be repaired within 72 hours or the unit must be in at least hot standby within the next 6 hours and in hot shutdown within the following 6 hours. With two pumps inoperable, the unit must be in hot standby within the next 6 hours and in hot shutdown within the following 6 hours. If-all pumps are inoperable, immediate action must be tr. ken to effect the operability on one pump. . The AFWS. normal water source (the CST) must be operable at all times.
| |
| With'the CST inoperable, within 4 hours either the CST must be restored or the unit must be in hot standby within the next 6 hours and in hot shutdown in the following 6 hours. As an alternative, the operability of the ERCW system backup supply to the AFW pumps may be demonstrated and the CST restored within 7 days or be in hot standby within the next 6 hours, and in hot shutdown within the following 6 hours.
| |
| A.8.3 System Logic Model A.8.3.1 - Success Criteria Definition.
| |
| -A.8.3.1.1 Analysis boundary conditions. The following boundary conditions and assumptions apply to the AFWS analysis:
| |
| e It is assumed that the unit is operating at full power prior to the occurrence of'an event that would initiate an AFWS actuation signal. Also, the AFWS is in its normal standby configuration.
| |
| A.8-15
| |
| | |
| e o Electric power and control air are assumed present with a probability of 1.0 for this analysis. Failure to provide electric power and control air for AFWS operation will be considered in the safety model.
| |
| e It is assumed that the condensate storage tanks contain the minimum level of water required by the technical specifications. Also, the ERCW system supply is assumed present with a probability of 1.0. Failure of the ERCW system to supply backup water will be quantified by the safety logic model.
| |
| e The AFWS actuation signals, train A and train B, are both assumed to be present with a probability of 1.0.
| |
| e The steam generators are not included in this analysis.
| |
| However, the steam supply from steam generators 1 and 4 is assumed present with a probability of 1.0.
| |
| e A mission time of 8 hours is assumed for this analysis.
| |
| e Only the system's automatic actions are included in this analysis. No credit is taken for operator actions to recover failed equipment or to provide an alternate flow source or configuration over the period of this analysis.
| |
| e Taps for pressure indicators, drain valves, and small bypass lines are omitted.
| |
| e Steam generator level control valve function is considered
| |
| * successful in the fail open position.
| |
| e Steam generator level control valve bypass lines and valves are not considered sufficient to supply adequate flow to the steam generators.
| |
| A.8.3.1.2 Interface with plant safety logic. In an accident sequence of events, the AFWS may be called upon to provide secondary cooling. For the small LOCA sequence, the AFWS secondary cooling function is called upon innediately after the high pressure injection function of the safety injection system (see event sequence diagrams). If AFWS secondary cooling fails then the event sequence proceeds to manual bleed and feed with the j power-operated relief valves (PORV).
| |
| In the reactor trip event sequence diagram, the AFWS secondary cooling function is called upon immediately after a reactor trip. If successful, the operator maintains stable conditions in a hot standby mode. If unsuccessful, the event sequence proceeds to manual feed and bleed using two PORVs and one charging pump or safety injection pump.
| |
| A.8-16
| |
| | |
| The AFWS secondary cooling function is included in the steam generator tube leak, loss of feedwater flow, turbine trip, spurious safety injection, steam loss inside containment, core power excursion, and anticipated transient without scram (ATWS) event sequences with the same success criteria as used in this model.
| |
| A.8.3.2 System G0 Model. The system GO model is shown in Figure A.8-4 and the component modeling chart is seen in Table A.8-5. System inputs are listed across the top of the figure with a summary of the components they supply. It should be noted that, due to the fail safe states of 1.CVs 3-148, 3-156, 3-164, 3-171, and FCVs 1-15,1-17, and 1-18, electric power is not needed for these valves to function successfully. Signal generators for testing and maintenance are represented by a type 4 operator with three dependent signals generated, one for each pump. The type 4 operator was used to permit only one pump at a time to be unavailable due to test and maintenance. Therefore, the unavailability of a pump due to testing and maintenance is dependent on the availability of the other two pumps. The type 4 operator is defined to handle this dependency.
| |
| The steam supply from steam generators 1 and 4 is initiated by signal generators 5-44 and 5-45, respectively.
| |
| There are four ERCW system supplies:
| |
| : 1. ERCW Discharge Header A
| |
| : 2. ERCW Discharge Header B
| |
| : 3. Main Supply Helder 1A
| |
| : 4. Main Supply Header 1B There are three supertype blocks which are used to produce output signals that supply various input to the model. These input and output signals are designated as numbers within squares. These supertypes are of pressure switches which supply activation signals to various components. The OR gate, with output 2, at the bottom of the diagram shows that either train A or train B of the AFWS actuation signal will start the turbine-driven pump.
| |
| The GO model starts with a signal initiator at the condensate storage tanks and flows through the pumps to the eight steam generator inlet valves, two for each steam generator. The two inlet valves that go to each steam generator are combined with an OR gate. This presents successful flow from either the motor A.8-17
| |
| | |
| g- .
| |
| .y 7,
| |
| .y '
| |
| ~
| |
| g.. g.g. .. ... . . . . . . .. g...
| |
| ~ ~' ~
| |
| ., . .- . =
| |
| * ,J
| |
| .. - ~.-
| |
| ',~,
| |
| .{ . . . gd ::: r--
| |
| p_ . .i i i i.i.i .
| |
| : e. .o
| |
| - . . ~ ,
| |
| . . . s -.
| |
| :c. ,, .
| |
| co .. . . . . .
| |
| 5 - - ' - .- . .::7 g ..n
| |
| .. .~
| |
| ,, . . (.
| |
| . = _ - . -
| |
| ,3 . . ... m,_
| |
| E -. . . . . . p.r ~
| |
| : g. .%
| |
| d ' - ~'~
| |
| w~
| |
| Figure A.8-4. Sequoyah Unit 1 Auxiliary Feedwater G0 Model (Sheet 1 of 2)
| |
| | |
| ~.
| |
| .. . . . LC. LC. & u. e.e
| |
| :a;;- te I1,3 si= LC .B. l.F3 sc .c . - m.
| |
| g -
| |
| tc. : .,.
| |
| LC I9,
| |
| - - - - ~ ~ -
| |
| . O
| |
| =
| |
| O 2 ...., . . . ...
| |
| c,o . - - .
| |
| : n. . ,_
| |
| e . . --
| |
| .~. - .
| |
| Figure A.8-4 (continued)
| |
| (Sheet 2 of 2)
| |
| | |
| Table A.8-5
| |
| -SEQUOYAH UNIT 1 AUXILIARY FEEDWATER SYSTEM COMPONENT MODELING CHART Type-Kind Actual Component Actual Failure Mode Model Component Model Failure Mode Unavailability
| |
| . 5-1 System Initiation None System Initiation None 0.00 1-146 Condensate Storage Tank Fall to Supply Water, Storage Tank Rupture During Operation 1.01-6 Rupture, Plug 1-148 Motor-Driven Pump Fall to Start, Fall Motor-Driven Fall to Start, tun 2.33-3 to Operate Pump 1-149 Turbine-Driven Pump Fall to Start Fall Turbine-Driven Fail to Start, Run 4.33-2 to Operate Pump 1-150 Butterfly Valve Transfer Closed, Plug Manual Valve- Transfer Closed 2.22-4 1-151 Check Valve Fall Closed Plug Check Valve Fall to Operate 2.98-4 1-152 Check Valve Fail Open, Reverse Check Valve Fail to Operate, Leak 3.03-4 Leakage +
| |
| co i
| |
| @ 1-153 Flow Control Valve Transfer Closed, Plug Motor-Operated Transfer Closed 5.33-5 Valve 1-154 Flow Control Valve Fails to Open, Motor-Operated Fail to Open Transfer 7.00-3 Transfer Closed Valve Closed 1-155 Gate Valve Transfer Closed, Plug Manual Valve Transfer Closed 1.36-5 1-156 Pressure Control Valve Fall to Open, Plug Electrohydraulic Fall to Open, Transfer 3.41-3 Valve Closed 1-157 Sensor Pressure Switch Fail to Operate Pressure Switch Fail to Operate 2.43-4 1-159 Level Control Valve Fall to Open, Plug Electrohydraulic Fall to Open Transfer 3.41-3 Valve Closed 4-160 Test and Maintenance MDP System Down for Test and Mainte- System Down for Maintenance 2.43-3 Maintenance nance 4-160 Test and Maintenance TDP System Down for Test and Mainte- System Down for Maintenance 5.26-3 Maintenance nance Others Electric, Actuation Signals, None (for the system Electric, Actu- None 0.00 and Other Support Type model only) ation Signals.
| |
| Signals and Other support Type Signals Note: Values are presented in an abbreviated scientific notation; e.g., 1.01-6 = 1.01 x 10-6,
| |
| | |
| driven pump or the turbine-driven pump. The four output to each steam generator are then combined with a two-out-of-four type 11 operator to represent success of the system. All components in the flow path that could affect perfonnance of the system have been included. - AND gates have been used where system dependencies occur.
| |
| A.8.4 Quantification of System Unavailability A.8.4.1 Hardware Failure Contribution.
| |
| A.8.4.1.1 Active components. Table A.8-6 lists all the components and their unavailability contributions. The probability of failure of the pumps to perform successfully is the sum of the probability of the pump to fail to start on demand and failure during operation. For motor-operated valves and air-operated valves, the total probability of failure is the sum of the probability of failure to operate on demand and transfer open/ closed during operation. Check valves either use the failure to open on demand or gross reverse leakage failure mode, depending on the critical function. The mean time to repair (MTTR) used in the unavailability calculation is based on the mission time.
| |
| A.8.4.1.2 Passive components. Passive system components such as locked open gate valves, open gate valves, the CST, and flow control valves, which do not change position, are modeled. They do not perfona an active function, but there is the possibility that they could effect the system.
| |
| An example would be a normally open gate valve transferring closed. This is a very unlikely case as is typical of most passive failures. These passive components ara also included in Table A.8-5. No passive components _ such as piping, structures, or supports are considered in this analysis. The MTTR used in the unavailability calculation is based on the effective test schedule discussed in Section A.8.4.2.1 and the actual component's mean repair time.
| |
| 'A.8.4.2 Test and Inspection Contribution.
| |
| A.8.4.2.1 System unavailibility during test and inspection. The technical specifications require testing of the pumps once every 31 days. During this test, the pumps must develop a minimum pressure in the recirculation mode.
| |
| Although the pumps are operating in the recirculation mode, they are considered unavailable for 30 minutes during the test. Only cne pump at a time may be unavailable for testing. The unavailability for test and A.8-21
| |
| | |
| 4 Table A.8-6
| |
| ;SEQUOYAH UNIT 1 AUXILIARY FEEDWATER SYSTEM COMPONENT UNAVAILABILITY RATES Component G0 Failure / Failure / MTTR Mean Type-Kind Demand Hour Unavailability Condensate Storage. Tank 1 1-146 2.66-8 38 1.01-6 Condensate Storage Tank 2 1-146 2.66-8 38 1.01-6 Motor-Driven Pump 1A-A 1-148 2.12-3 2.62-5 8 2.33-3 Motor-Driven Pump 1B-B 1-148 2.12-3 2.62-b 8 2.33-?
| |
| Turbine-Driven Pump 1A-S 1-149 4.00-2 4.10-4 8 4.33 2
| |
| . Pressure Switch Sensor 1-157 2.40-4 3.40-7 8 2.43-4 Butterfly Valve 1-67-520A 1-150 3.36-8 6,607 2.22-4
| |
| >= Butterfly Valve 1-67-520B 1-150 3.36-8 6,607 2.22-4 bo Butterfly Valve 1-67-718A 1-150 3.36-8 6,607 2.22-4 dg Butterfly Valve 1-67-718B 1-150 3.36-8 6,607 2.22-4 Check Valve 3-508 1-152 2.98-4 6.42-7 8 3.03-4 Check Valve 3-509 1-152 2.98-4 6.42-7 8 3.03-4 Check Valve 3-510 1-152 2.98-4 6.42-7 8 3.03-4 Check Valve 3-511 1-152 2.98-4 6.42-7 8 3.03-4 Check Valve 3-805 1-151 2.98-4 2.98-4 Check Valve 3-806 1-151 2.98-4 2.98-4 Check Valve 3-810 1-151 2.98-4 2.98-4
| |
| ' Check Valve 3-820 1-151 2.98-4 2.98-4 Check Valve 3-821 1-151 2.98-4 2.98-4 Check Valve 3-830 1-151 2.98-4 2.98-4 Check Valve 3-831 1-151 2.98-4 2.98-4 >
| |
| Check Valve 3-832 1-151 '2.98-4 2.98-4 Check Valve 3-833 1-151 2.98-4 2.98 Check Valve'3-861 1-151 2.98-4 2.98-4 i Check Valve 3-862 1-151 2.98-4 2.98-4 NOTE: Values are presented in ag abbreviated scientific notation; e.g., 2.66-8 = 2.66 x 10-
| |
| | |
| t
| |
| : b. k ,~
| |
| ~
| |
| LTable.A.8-6'-(continued) [
| |
| - Component G0 Failure / ' Failure / MTTR Mean-Type-Kind ., Demand. Hour Unavailability
| |
| . Check Valve 3-864 : 1-151 2.98-4 2.98-4 Check Valve'3-871 1-151 2.98-4 2.98-4' Check Valve 3-872- 1-151 2.98-4 2.98 Check Valve 3-873 _1-151 2.98-4 2.98-4 Check Valve 3-874 1-151 2.98-4 2.98-4 Check Valve 3-891 1-151 2.98 2.98-4
| |
| . Check Valve 3-892 1-151 2.98-4 2.98-4 Check. Valve 3-921 1-151' 2.98-4, 2.98-4 Check Valve 3-922 'l-151 2.98 2.98-4 Flow Control Valve 1-15 1-153 1.32-7 404 5.33-5 2- Flow Control Valve 1-16 1-154. 7.00 1.32-7 8- 7.00-3 ,
| |
| - bo . Flow Control Valve'l-17 1-153 1.32-7 404 5.33-5 *
| |
| ' A> '
| |
| Flow Control Valve ~1-18 1-153' 1.32-7 404 5.33-5 Flow Control Valve 3-116A 1-154 7.00-3 1.32-7 8 7.00-3 ,
| |
| Flow Control Valve 3-116B 1-154 7.00-3 1.32-7. 8 7.00-3 Flow Control Valve 3-126A 'l-154 7.00-3' 1.32-7 :8 7.00-3 Flow' Control Valve 3-1268 1-154: 7.00-3 1.32-7 8 7.00-3 FlowtControl Valve 3-136A 1-154' 7.00-3 1.32-7 8 7.00-3 Flow Control Valve'3-136B 1-154 7.00-3 1.32-7 8: 7.00-3 Flow Control Valve 3-179A 1-154 7.00-3 1.32-7 8 7.00-3 Flow Control Valve 3-1798 1-154 7.00-3 1.32-7 8 7.00-3 Gate Valve 2-504 1-155 3.36-8 404 1.36-5 Gate Valve 2-505 'l-155 3.36-8 404 -1.36-5 Gate Valve 3-800 - 1-155 3.36-8 404 1.36-5 I Gate Valve 3-803 1-155 3.36 404 1.36-5 !
| |
| Gate Valve 3-804 1-155 3.36-8 404 1.36-5 Gate Valve 3-809 '
| |
| 1-155 3.35-8 404 1.36-5 t Gate Valve 3-826 1-155 3.36-8 404 1.36-5 NOTE: e.g.,
| |
| Values are presented in ag abbreviated scientific notation; 2.98-4 = E.98 x 10 .
| |
| | |
| , r:
| |
| t 1
| |
| :i, t .
| |
| Table A.8-6.(continued) -
| |
| Component G0 .
| |
| Failure / Failure /- N
| |
| 'Mean - '
| |
| Unavailability Type-Kind Demand. . Hour =
| |
| Gate. Valve 3-827 1-155 3.36-8 404 1.36-5 Gate Valve 3-828 1-155 3.36-8 1.36-5:
| |
| 404 Gate Valve 3-829 1-155- 3.36-8 .404 1.36-5 Gate Valve 3-834 1-155 3.36-8 .404 '1.36-5 Gate Valve 3-835 1-155 3.36-8 404. 1.36-5 Gate Valve 3-836 1-155 3.36-8 404 1.36-5 Gate Valve.3-837 1-155- 3.36-8 404 1.36-5 Gate Valve 3-867 '1-155 3.36-8 404- 1.36-5 Gate Valve 3-868 1-155 3.36-8 404 1.36-5 Gate Valve 3-869 1-155 3.36-8 404 1.36-5 Gate Valve 3-870 1-155 3.36 404 1.36-5
| |
| ?" Gate Valve 3-875 1-155 3.36-8 404 1.36-5 9' Gate Valve 3-876 1-155- 3.36-8 404 1.36-5 2: Gate Valve 3-877 1-155 3.36-8 404 1.36-5 Gate Valve 3-878 1-155 3.36-8 404 1.36-5 Level Control Valve 3-148 1-159 3.40-3 7.82-7 ~8 3.41-3 Level Control Valve-3-156 1-159 3.40-3 7.82-7. 8 3.41-3 Level Control Valve 3-164 1-159 3.40 7.82-7 8 3.41-3 Level Control Valve 3-171 1-159 3.40-3 7.82-7 8 3.41-3 Level Control Valve 3-172 1-159 3.40-3 7.82-7 8 3.41-3 Level Control Valve 3-173 1-159 3.40-3 7.82-7 8 3.41-3' Level Control Valve 3-174 1-159 .3.40-3 7.82-7 8 3.41-3 Level Control Valve 3-175 1-159 3.40-3 7.82-7 8 3.41-3 Pressure Control Valve 3-122 1-156 3.40-3 7.82-7 8 3.41-3 Pressure Control Valve 3-132 1-156 3.40-3 7.82-7 8 3.41-3 NOTE: Values are presented in ap abbreviated scientific notation; e.g., 3.36-8 = 3.36 x 10-o.
| |
| | |
| j j Bp, h g- #-44. -1.---, - 2 - - -- w-- ---
| |
| m maintenance for each tra'in has been assigned to the corresponding pump for ease of modeling.
| |
| The procedures for system surveillance outlined in Section A.8.2.6 have been quantified in Table A.8-7. The " Scheduled Testing" column denotes components t' hat were specifically tested in a procedure (the procedure reference is in parentheses). The " Indirect Testing" column identifies those components which were verified operable as a result of a procedure
| |
| ~
| |
| 4 even though they may not be specifically identified in that procedure. The final column, " Effective Test Schedule," gives the period of time between tests.- You may detect what seems to be an inconsistency between the last c'lumn'and o the first. For.. example, a component may be tested weekly, monthly, and yearly and the effective test schedule may be monthly. - The reason for this difference is that some procedures do not test the component
| |
| . ,for necessary safety failure modes.
| |
| ; y A.8.4.2.2 Human error during test'and inspection. Human error during test and-inspection has not been considered in this analysis.
| |
| ~
| |
| . A.8.4.3 Maintenance Contribution.-
| |
| -A.8.4.3.1 System unavailability during maintenance. There are no regularly
| |
| : scheduled preventive maintenance activities which affect the system Javailability during unit operation.'
| |
| Unscheduled maintenance resulting from conditions found as a result of p : testing or. inspection do contribute to unavailability. The unavailability data for these events.have been developed from generic industry experience.
| |
| ; ~ Maintenance unavailability of this kind has been assigned only to the
| |
| . pumps. -(All incidents that effect the train cause the pump to be inoperable.)
| |
| The maintenance data for pumps are given below.
| |
| ^
| |
| Mean Mean Mean Component Frequency -Duration Unavailability Motor-Driven Pump 8.42 'x 10-5 ~ Events / Hour 20.9 Hours / Event 1.76 x 10-3 Turbine-Driven Pump 2.19-4 Events / Hour 20.9 Hours / Event 4.59 x 10-3 A.8-25 J
| |
| .- , , , + - - , - - - - - + - - ~ - --1 - -
| |
| - , , , , . -- - - - - - e
| |
| | |
| Table A.8-7 SEQUOYAH' UNIT 1 COMPONENT TESTING FREQUENCIES-Component Scheduled Testing a Indirect Testing a Effective Safety Model Test .
| |
| (procedures) (procedures) Schedule Condensate Storage Tank 1 (2),(3),(8) (4),(6) 8 Hours Condensate Storage Tank 2 . (2 ),(3 ),(7 ) (4),(6) 8 Hours Motor-Driven 1A-A (2),(3) (6) 744 Hours (31 days)
| |
| Motor-Driven 18-B (2),(5) (6) 744 Hours (31 days)
| |
| Turbine-Driven 1 A-S (3),(4) (6) 744 Hours (31 days)
| |
| Butterfly Valve 167-520A (1) (3) 13,149 Hours (18 months)
| |
| Butterfly Valve 167-5208 (1) (3) 13,149 Hours (18 months)
| |
| Butterfly Velve 167-718A (1) (2) 13,149 Hours (18 months)
| |
| Butterfly Valve 167-718B (1) (2) 13,149 Hours (18 months)
| |
| Check Valve 3-508' (7h 1,753 Hours Check Valve 3-509 (7? 1,753 Hours y Check Valve 3-510 (71 1,753 Hours
| |
| . Check Valve 3-511 (71 1,753 Hours
| |
| ?
| |
| N Check Valve 3-805 Check Valve 3-806 (2),(5),(6)
| |
| (2),(5),(6) 744 Hours (31 days) 744 Hours (31 days)
| |
| * Check' Valve 3-810 (3),(4),(6) 744 Hours (31 days)
| |
| Check Valve 3-820 (6) 744 Hours (31 days)
| |
| Check Valve 3-821 (6) 744 Hours (31 days)
| |
| Check Valve 3-830 (6) 744 Hours (31 days)-
| |
| Check Valve 3-831 (6) 744 Hours (31 days)
| |
| Check Valve 3-832 (6) 744 Hours'(31 days)
| |
| - Check Valve 3-833 (6) 744 Hours (31 days)
| |
| Check Valve 3-861 (6) 744 Hours (31 days)
| |
| Check Valve 3-862 (6) 744 Hours.(31 days)
| |
| Check Valve 3-864 (6) 744 Hours (31 days)
| |
| Check Valve 3-871 (6) 744 Hours (31 days)
| |
| Check Valve 3-872 (6) 744 Hours (31 days)
| |
| NOTE: The numbers in parentheses correspond to the tests noted in Section A.8.2.6.
| |
| aThe following is a cross-reference of the surveillance instructions.
| |
| (1) SI-5.
| |
| (2) SI-118.
| |
| [ (3) SI-118.1.
| |
| (4) SI-130.1.
| |
| l (5) SI-130.2.
| |
| l (6) SI-276.
| |
| l (7) Plant trips (based on past experience assumed five per year).
| |
| (8) The CST is needed all the time and is monitored at least once per 8-hour shift.
| |
| | |
| t.
| |
| : Table' A.8-7. '(continued)
| |
| Component Scheduled Testinga . Indirect Testinga Effective Safety Model Test (procedures) (procedures) Schedule Check Valve'3-873 '(6) 744' Hours (31 days)
| |
| Check Valve 3-874 (6) 744 Hours (31 days)
| |
| . Check Valve 3-891 (33,(4) 744 Hours (31 days) '
| |
| Check Valve 3-892 (61 Never (assume 40 year life)
| |
| Check Valve 3-921. '
| |
| .'(6? 744 Hours (31 days)
| |
| . Check Valve 3-922 (6j 744 Hours (31 days)
| |
| Flow Control Valve 1-15 ' - (1 ),(4 ) (6) 744 Hours (31 days) l Flow Contml Valve 1-16 (1) Never Flow Control Valve 1-17 .(1),(4) (6) 744 Hours (31 days)
| |
| Flow Control Valve 1-18 (1),(4). (6) 744 Hours (31 days) l Flow Control Valve 3-116A (1),(2) 13,149 Hours (18 months)
| |
| Flow Control Valve 3-1168 (1),(2) 13,149 Hours (18 months)
| |
| Flow Control Valve 3-126A (1),(2) 13,149 Hours (18 months)
| |
| Flow Control Valve 3-1268 (1),(2) 13,149 Hours (18 months)
| |
| . Flow Control Valve 3-136A (1),(3) 13,149 Hours (18 months) i Flow Control Valve 3-1368 (1) (3 '13,149 Hours (18 months) l > +
| |
| Flow Control Valve 3-179A (1 ) ,(3)) 13,149 Hours (18 months)
| |
| . (1 ),,(3)
| |
| 'o c Flow Control Valve 3-1798 13,149 Hours (18 months) e y Gate Valve 2-504 (1) (2),(3),(4),(5),(6) 744 Hours (31 days)
| |
| Gate Valve 2-505 (1) (2),(3),(4),(5),(6) 744 Hours (31 days)
| |
| Gate Valve 3-800 (1) (2),(3),(4),(5),(6) 744 Hours (31 days)
| |
| Gate Valve 3-803 (1) (2),(6) 744 Hours (31 days).
| |
| Gate Valve 3-804 (1) (2),(6) 744 Hours (31 days)
| |
| Gate Valve 3-809 (1) (3),(4),(6) 744 Hours (31 days)
| |
| Gate Valve 3-826* (1) (6) 744 Hours (31 days) .
| |
| Gate Valve 3-827 (1) (6) 744 Hours (31 days)
| |
| Gate Valve 3-828 (1) (6) 744 Hours (31 days)
| |
| Gate Valve 3-829 (1) (6) 744 Hours (31 days) ~
| |
| Gate Valve 3-834 (1),(2) (6) 744 Hours (31 days)
| |
| Gate Valve 3-835 (1),(2) (6) 744 Hours (31 days)
| |
| Gate Valve.3-836 (1),(2) (6) 744 Hours (31 days)
| |
| NOTE: The ntabers in parentheses correspond to the tests noted in Section A.8.2.6.
| |
| aThe following is a cross-reference of the surveillance instructions.
| |
| (1) SI-5.
| |
| (2) SI-118.
| |
| (3) ' SI-118.1.
| |
| (4) SI-130.1.
| |
| (5) SI-130.2.
| |
| (6) SI-276.
| |
| (7) Plant Trips (based on past experience asstened five per year). l (8) The CST is needed all the time and is monitored at least once per 8-hour shift.
| |
| | |
| m ,.
| |
| 4
| |
| : Table A.8-7, (continued)
| |
| Component- Scheduled Testinga Indirect Testing a. Effective Safety Model Test (Procedures) .(Procedures) . Schedule.
| |
| Gate Valve 3-837- (1),(2) (6) 744 Hours (31 days) ' .
| |
| Gate Valve 3-867 (1) (6) 744 Hours (31 days) '
| |
| Gate Valve 3-868 - (1) (6) 744 Hours (31 days)
| |
| Gate Valve 3-869 (1) (6) 744 Hours (31 days)
| |
| Gate Valve 3-870 (1 ) (6) 744 Hours (31' days)
| |
| Gate Valve 3-875 (1),(3) (6) 744 Hours (31 days)
| |
| Gate Valve 3-876 (1),(3) (6) 744 Hours (31 days)
| |
| Gate Valve 3-877 (1),(3) (6) 744 Hours (31 days)
| |
| Gate Valve 3-878 (1),(3) (6). 744 Hours (31 days)
| |
| Pressure Control *(1),(6) 744 Hours (31 days)
| |
| Valve 3-122
| |
| ? - Pressure Control (1),(6) 744 Hours (31 days)
| |
| ? Valve 3-132
| |
| $ Level Coatrol Valve 3-148 (1),(2),(5),(6) 744 Hours (31 days)
| |
| Level Control Valve 3-156 (1), ,(5),(6) 744 Hours.(31 days) .
| |
| Level Control Valve 3-164 (1), ,(5),(6) 744 Hours (31 days)
| |
| Level Control Valve 3-171 (1), ,(5),(6) 744 Hours (31 days)
| |
| Level Control Valve 3-172 (1), ,(5),(6) 744 Hours (31 days)
| |
| Level Control Valve 3-173 (1),(2),(5),(6) 744 Hours (31 days) '
| |
| Level Control Valve 3-174 (1),(2),(5),(6) 744 Hours (31 days)
| |
| Level Control Valve 3-175 (1),(2),(5),(6) 744 Hours (31 days)
| |
| NOTE: The numbers in parentheses correspond to the tests noted in Section A.8.2.6.
| |
| aThe following is a cross-reference of the surveillance instructions.
| |
| (1) SI-5.
| |
| (2) SI-118.
| |
| SI-118.1.
| |
| (3))
| |
| (4 SI-130.1.
| |
| (5) SI-130.2.
| |
| (6) SI-276.
| |
| (7) Plant Trips (based on past experience assumed five per year).
| |
| (8) The CST is needed all the time and is monitored at least once per 8-hour shift.
| |
| | |
| This maintenance unavailability is added to the testing and inspection unavailability for quantification in the model. This procedure assumes that only one pump at a time can be unavailable due to maintenance.
| |
| Comoining the testing and maintenance unavailability assumes that no two pumps can be inoperable at the same time for either testing or maintenance.
| |
| A.8.4.3.2 Human error during maintenance. Human error during maintenance has not been considered in this analysis.
| |
| A.8.4.4 Human Action Contribution. No human action contribution has been considered in this anlysis.
| |
| A.8.4.5 Common Cause Contribution. No common cause contribution has been included in this analysis pending future analysis, i
| |
| l A.8-29
| |
| | |
| , . . . . ~ - _ . . - _ - _ - . .
| |
| m, c
| |
| r u-A.9 EMERGENCY CORE COOLING SYSTEM A.9.1: Introduction A.9.1.1 ' System Definition.
| |
| A.9.1.1.1 Overview. The emergency core cooling system (ECCS) consists of
| |
| , three s'ubsystems: (1) the' chemical and ~ volume control system (CVCS),
| |
| . (2) the safety' injection (SI) system, and.(3) the residual heat removal (RHR) system. The' CVCS consists of two centrifugal charging pump trains
| |
| . pumping through'one boron injection tank which discharges to four reactor coolant system cold legs. .The SI system consists of four accumulator tanks 4
| |
| each of which discharges to a RCS cold leg, and two SI pumps which can discharge to 'all four-(RCS) cold legs, two (RCS) hot legs, four (RCS) hot
| |
| : . legs,. or all ' hot and cold-legs. The SI system also contains an upper head '
| |
| [ . injection (UHI) accumlator which injects directly into the reactor vessel-head. The UHI system is not . included in this' analysis. The RHR system has two trains -'ea'ch consisting of a RHR pump and heat exchanger. These two
| |
| , , trains can pump to two RCS cold legs, four' RCS' cold legs, two RCS hot legs,
| |
| , or to the suction side of the CVCs and SI pumps.
| |
| l The ECCS'h'as two modes of operation, injection and recirculation, at two ranges of pressure. The CVCS and SI pumps operate at high pressure and the '
| |
| _ :RHR pumps operate at low pressure.- In the injection mode of operation,: all
| |
| " ~
| |
| C
| |
| . pumps draw water from the refueling water storage tank (RWST) and inject
| |
| ;into the RCS according to the pressure of the RCS. When there is water in the containment sump, the RHR pumps can take suction from the-sump to i
| |
| provide low pressure recirculation or provide high pressure recirculation through the CVCS or SI pumps. The RHR pumps also provide normal closed. loop
| |
| . recirculation cooling of the RCS.by taking suction from one RCS hot leg and providing low pressure flow to the RCS cold legs.-
| |
| .-During normal operation, the ECCS is in a standby configuration and responds M . automatically to an engineered safety features actuation system (ESFAS)
| |
| . signal. The system is designed to mitigate all ranges of.RCS loss of.
| |
| coolant accidents (LOCA) and RCS and secondary system transients. Redundant -
| |
| CVCS, SI, and RHR pump trains ' allow the ECCS to successfully perform its mitigating functions ~ under the single failure criterion.
| |
| .A.9.1.1.2 Purpose of analysis. "The purpose of the analysis is to analyze l the probability of success of the ECCS in response to the initiating events
| |
| , 'A.9-1
| |
| | |
| l discussed in Section 4. In order to model the ECCS response, we divide the system into the following functions:
| |
| e High Pressure Injection (HPI) e RCS Cold Leg Accumulators e Low Pressure Injection (LPI) e- High Pressure Recirculation (HPR) e Low Pressure Recirculation (LPR) e Low Pressure Hot Leg Recirculation (LPHLR) e Bleed and Feed e Closed Loop RHR (CLRHR)
| |
| Each of the above models provides an accident mitiga' ting function for one or more iritiating event sequences according to the event sequence diagrams of Section 4.
| |
| The GO modeling method is used to develop the ECCS models. The unavailability contributors of each model are quantified, ranked, and the dominant contributors identified.
| |
| A.9.1.2 Analysis Boundary Conditions. The ECCS analysis includes all piping, valves, and components from the RWST, the sump, and the RHR suction from RCS hot
| |
| . leg' number four to the last check valve in the RCS injection lines. The analysis does not include the RWST or the sump as_ they are separate top events in the event sequence diagrams.
| |
| The ECCS is analyzed considering that all auxiliary support systems are
| |
| * available; however, the ECCS response under degraded auxiliary systems states is also quantified.
| |
| LThe ECCS is analyzed under the following initial conditions; e The ECCS is in its normal standby configuration as described in Section A.9.2.3, prior to the initiation of an event sequence, except as modified by plant testing or maintenance.
| |
| e The RWST and sump are assumed available.
| |
| A.9-2
| |
| | |
| l
| |
| \
| |
| l e Both CVCS charging pumps are assumed in standby and must start on initiation of an event sequence.
| |
| e The CVCS reciprocating charging pump is not considered in this analysis.
| |
| The analysis also includes the following boundary conditions: j e No credit is given for operator actions to recover failed equipment.
| |
| , o Pipes with ~a diameter equal to or less than 1 inch are not considered to affect the ECCS availability due to their relatively small flow capacity.
| |
| e All valves which could isolate interfacing systems from ECCS are included in the ECCS logic models. This includes the component cooling water and essential raw cooling water inlet and outlet valves for pumps, heat exchangers, and room coolers.
| |
| o All components which receive electric power for operation include the components circuit breaker and all component electrical controls.
| |
| A.9.1.3 Systems Analysis Results.
| |
| A.9.1.3.1 Quantification of conditional failure states. The quantification of the ECCS function models are conditional on two dependencies. The quantificatich is carried out given that the auxiliary support dependencies are successful and the ECCS functional dependencies are successful (see Section A.9.3.1.1).
| |
| The quantification consists of hardware failures of all components (mostly active failures) and maintenance failures of the pumps. No human interaction or common cause failures are included (see Section A.9.3.1.1).
| |
| t The results of the conditional quantification of all ECCS functional models are shown in Table A.9-1. Also shown are the independent pump train contributions of each model along with the overall system unavailability.
| |
| .A.9.1.3.2 Dominant contributors to unavailability. The dominant contributor fault sets are shown in Table A.9-2 along with their percentage contribution to the overall system unavailability shown in Table A.9-1. The HPI, HPR, and LPR unavailabilities are composed of A.9-3
| |
| | |
| Table A.9-1 ANALYSIS RESULTS Hodel Unavailability HPI HP! HPR HPR Small Medium BF1 BF2 ! GRHR1 RRHR2 OR Acumd aton UHLR (18 hours) (23 hours)
| |
| LOCA LOCA System 2.82-7 2.06-5 6.81 6.79-3 2.75-4 2.75-4 3.30-4 8.68-3 8.73-3 1.88-4 9.0-4 4.37-3 f Train A Pumps 4
| |
| CVCS 7.93-3 7.93-3 8.06-3 1.67-4 1.52-3 1.65-3 -- -- -- --
| |
| SI 1.13-2 1.13-2 1.15-3 1.74-4 '1.53-3 1.67-3 -- - -- --
| |
| RHR -- -- -- -- 1.64-2 1.64-2 3.22-3 1.86-2 2.06-2 1.36-2 Train 8 Pumps CVCS 7.93-3 7.93 3 3.06-3 1.67-4 1.52-3 1.65-3 -- -- -- --
| |
| 51 1.13-2 1.13-2 1.15-3 1.74-4 1.53-3 1.67-3 -- -- -- --
| |
| RHR -- -- -- -- 1.64-2 1.64-2 3.22-3 1.86-2 2.06-2 1.36-2 I
| |
| Note: Exponential notation is indicated in abbreviated form; f.e.. 2.82-7 = 2.82 x 10-7 l
| |
| i i
| |
| l l
| |
| i I
| |
| l l
| |
| l I
| |
| | |
| 1 Table A.9-2
| |
| ' LEADING CONTRIBUTOR FAULT SETS g Sheet 1 of 3 Unavailability ' "*
| |
| ECCS Model . Leading Contributor Fault Sets HPI - Small LOCA CV62-504 and CV63-510 8.88-8 31.5 CV63-581 and CV63-510 8.88-8 31.5
| |
| ' HPI - Medium LOCA CV62-504'and SI Pump'A Maintenance 1.54-6 7.5 ;
| |
| CV62-504 and SI Pump B Maintent.nce 1.54-6 7.5 CV63-581 and SI Pump A Maintenance 1.54-6 7.5 CV63-581 and SI Pump B Maintenance 1.54-6 7.5 CV63-510 and CVCS P o p A Maintenance 1.54-6 7.5 CV63-510 and CVCS Pump B Maintenance 1.54-6 7.5 CV62-504 and FCV67-182 1.01-6' 4.9 CV62-504 and FCV67-176 -1.01-6 4.9
| |
| , CV62-581 and FCV67-182' 1.01-6 4.9 CV62-581 and FCV67-182 1.01-6 4.9 CV63 581 and SI Pump A Failure 6.37-7 3.1 CV63-581 and SI Pump B Failure- 6.37-7 3.1 CV62-504 and SI Pep A Failure 6.37-7 3.1 CV62-504 and SI Pump B Failure 6.37-7 3.1 CV63-510 and CVCS Fump A Failure 6.37-7 3.1 CV63-510 and CVCS Pump B Failure 6.37-7 3.1 CV63-581 and CV63-526 8.88-8 .4 CV63-581 and CV63-528 8.88-8 .4 CV63-504 and CV63-526 8.88-8 .4 CV63-510 and CV62-532- 8.80-8 .4 CV63-510 and CV62-525 8.88-8 .4 Bleed and Feed PCV68-334. 3.4-3 49.9 1 and 2 PCV68-340A 3.4-3 49.9 HPR FCV63-72 and FCV63-73 1.85-5 6.7 FCV63-72 and FCV63-11 1.85-5 6.7 FCV63-72 and FCV70-153 1.85-5 6.7 FCV63-8 and FCV63-73 1.85-5 6.7 FCV63-8 and FCV63-11 1.85-5 6.7 FCV63-8 and FCV70-153 1.85-5 . 6.7 FCV70-156 and FCV63-73 1.85-5 6.7 FCV70-156 and FCV63-11 1.85-5 6.7 FCV70-156 and FCV70-153 1.85-5 6.7 FCV63-72 and Pep B Failure 1.18-5 4.3 FCV63-8 and Pump B Failure 1.18-5 4.3 FCV70-156 and Pop B Failure 1.18-5 4.3 Pump A Failure and FCV63-73 1.18-5 4.3 Pump A Failure and FCV63-11 1.18-5 4.3 Pump A Failure and FCV70-153 1.18-5 4.3 Pop A Failure and Pump 8 Failure - 7.56-6 2.7 FCV63-72 and Room Cooler Fan B 4.34-6 1.6 FCV63-8 and Room Cooler Fan B 4.34-6 1.6 Note: Exponential notation is indicated in abbreviated form; i.e., 8.88-8 = 8.88 x 10-8, 4 .
| |
| 4 A.9-5
| |
| | |
| . . _ . _ . __ _ _ _ _ _ .~
| |
| . 'i s c 1
| |
| s,>
| |
| Table A.9-2 (continued)'
| |
| Sheet 2 of 3 IECCSModel. -. Leading Contributor Fault Sets Unavailability ,
| |
| FCV70-156 and Room Cooler Fan B 4.34-6 1.6 Room Cooler Fan A and FCV63-73 4.34-6 1.6
| |
| - JRoom Cooler Fan A and FCV63-11 4.34-6. 1.6 Room Cooler Fan A and FCV70-153 - 4.34-6 1.6
| |
| . Room Cooler Fan A and Pump B Failure .2.78-6 1.0 .
| |
| Room Cooler Fan 9 and Pump A Failure 2.78-6 1.0 ,
| |
| LPI CV63-502 2.98-4 90.3 FCV63 1.11-5 3.4 FCV63-93 .
| |
| 1.11 3.4 Pump A Failure and Pump B Failure 4.58-6 1.4 LPRt FCV63-72 and FCV63-73' 1.85-5 9.8 i- . FCV70-156 and FCV70-153 ' 1.85-5 9.8
| |
| . FCV63-72 and FCV70-153 - 1.85 9.8 i '
| |
| FCV70-156 and FCV63-73 1.85-5 9.8
| |
| , FCV63-72 and FCV67-190 1.46-5' 7.8 FCV67-188 and FCV63-731 1.46-5 7.8 3
| |
| FCV70-156 and FCV67-190 1.46-5 7.8 -
| |
| . .FCV67-188 and FCV70-153 1.46-5 7.8
| |
| ! FCV67-188 and FCV67-190 1.16-5 6.2 FCV63-72 and Room Cooler Fan B 4.30-6 2.3 Rooss Cooler Fan A and FCV63 4.30-6 2.3~
| |
| FCV70-156 and Room Cooler Fan B 4.30-6 2.3 Room Cooler Fan A and FCV70-153 .4.30-6: 2.3 4 FCV67-188 and Room Cooler Fan B 3.40-6 :1.8 Room Cooler Fan A and FCV67-190 ~
| |
| 3.40-6 1.8 FCV63-93 -
| |
| 3.04-5 1.6 FCV63-72 and Pump B Failure ,2.59-6 1.4 Pump A Failure and FCV63-73 2.59-6 1.4 FCV70-156 and Pimp 8 Failure 2.59-6 1.4 Pump A Failure and FCV70-153 2.59 ~1.4 Pump A Failure and FCV67-190 =2.05-6 1.0 -
| |
| FCV67-188 and Pump B Failure 2.05-6 1.0 '
| |
| CLRHR 1 and 2 -FCV74 4.30-3 49.5 FCV74-2 4.30-3 49.5 Accumulators CV63-622 2.98-4 33.0
| |
| : CV63-623 2.98-4 33.0 CV63-624 2.98-4 33.0 r-Note: ' Exponential notation is indicated in abbreviated form; 1.e..' 1.18-5 = 1.18 x 10-5,
| |
| (. ,
| |
| 11 h''a k
| |
| K
| |
| +
| |
| A.9-6 3-
| |
| , _. ;.. , . . . - . 2- . - - , _ . . .
| |
| .- _ _ _ . - - - . - ~ , . - . ~ .
| |
| | |
| ~
| |
| : 7. .
| |
| i9 n ~ Table A.9-2 (continued) 3."- 'y7 Sheet 3 of 3
| |
| -F *
| |
| 'ECCS Model _ Leading Contributor Fault Sets Unavailability w
| |
| -LPHLR FCV63-172 4.30-3 98.4 FCV53-93 and FCV63-94 1.85-5 .4 FCV63-93 and FCV63-94 1.85-5 .4
| |
| , FCV74-33 and FCV74-35 1.85-5 .4 FCV74-33 and FCV74-35 1.85-5 .4
| |
| ' Note'
| |
| : . Exponential notation is indicated in abbreviated form; f.e., 2.98-4 = 2.98 x 10-4 s
| |
| c a
| |
| d i;
| |
| B
| |
| )
| |
| e u- I
| |
| }-
| |
| 9 A.9-7.
| |
| | |
| l 1
| |
| l l
| |
| double order and higher order
| |
| * ault sets. The bleed and feed, LPI, CLRHR, accumulators, and LPHLR are dominated by single-order fault sets with second order and higher fault sets as minor contributors.
| |
| The HPI small LOCA model is dominated by two combinations of check valve failure to open on demand fault sets. The remaining contribution consists of hundreds of third-order fault sets of which each carries a small contribution.
| |
| The HPI' medium LOCA model is dominated by second order fault sets of which check valve failure to open on demand and pump maintenance unavailability combinations rank the highest. Check valve and the room cooler air-operated valve failure to open on demand combinations rank second. Check valve and pump failure combinations rank third with check valve and check valve combinations rank fourth. The two check valves on the CVCS inlet and outlet with the check valve on the SI system inlet are the important contributors in all of these fault sets.
| |
| The bleed and feed model _is dominated by the two air-operated relief valves' failure to open on demand single-order fault sets.
| |
| The HPR and LPR leading contributors consist mainly of the same type of
| |
| - fault sets due to the fact that the HPR model is dominated by the RHR pump trains which appear in both models. These are all second-order fault sets of which MOV failure to open on demand combinations rank first. All other fault sets are combinations of MOVs, pumps, room cooler air-operated valves, and room cooler fans.
| |
| The LPI leading contributors consist of three single-order fault sets.
| |
| The M0V transfer closed during operation and check valve failure to open on demand for the RWST suction line are two contributors. Because of the modeling success criteria of the two out of three injection paths, the third single-order fault set is either FCV63-93 or FCV63-94 (M0V transfer closed during operation). The second-order fault set of both pumps failing h a small contributor.
| |
| The CLRHR unavailability is dominated by the'two single-order fault sets of the hot leg suction MOVs' failure to open on demand. The A.9-8
| |
| | |
| accumulators' unavailability is dominated by three single-order check valve failure to open on demand fault sets. The LPHLR unavailability is dominated by one single-order MOV failure to open on demand ar:d four second-order MOV failure to open on demand fault sets.
| |
| A.9.2 System Description A.9.2.1 Accident Mitigation Function. The emergency core cooling system is designed _ to remove the stored and fission product decay heat from the reactor core following an accident. In addition, the ECCS provides core cooling and shutdown capabilities during the following accident conditions:
| |
| e Loss of coolant accident including a pipe break or a spurious relief or safety valve opening in the reactor coolant system, which would result in a discharge larger than that which could be made up by the normal makeup system.
| |
| o Rupture of a control rod drive mechanism causing a rod cluster control assembly (RCCA) ejection accident.
| |
| e Transient events including a steam or feedwater system break. For example, a pipe break or a spurious relief or safety valve opening in the secondary steam system, resulting in an uncontrolled steam release or a loss of feedwater.
| |
| e A steam generator tube rupture.
| |
| e An anticipated transient without scram (ATWS).
| |
| A number of different operation modes are provided by the ECCS over a range of pressures. In terms of injecting water into the reactor coolant system, the following systems operate at different, decreasing levels of pressure to perform the operations discussed below and in further detail in later sections.
| |
| e Chemical and Volume Control System e Safety Injection System o Accumulators e Residual Heat Removal System A.9.2.1.1 High pressure injection. High pressure injection provides a source of cooling and makeup water and shutdown capability to the core for events where the RCS remains at high pressure, above the operating pressure of the safety injection accumulators and the residual heat removal pumps.
| |
| A.9-9 a- . _ _ _, .-
| |
| | |
| 4 iA.9.2.'1.2._ High pressure recirculation. Following HPI, when the refueling water storage tank water level drops to the low-low setpoint, long term cooling is initiated by recirculating the water collected in the containment
| |
| - sump through' the core using the charging and safety injection pumps.' The
| |
| - RHR pumps are used to pump the sump water to the suction of the charging and safety injection pumps.
| |
| . A.9.2.1.3 -. Low pressure injection. Low pressure injection provides a source.
| |
| of cooling and makeup water and shutdown capability to the core for events where the RCS pressure decreases below the shutoff pressure of the RHR pumps.
| |
| A.9.2.1.4 Low pressure recirculation. Following the injection phase, after J ~ the RWST level reaches the low-low setpoint and RCS pressure drops below the residual heat removal pump shutoff pressure, long term core cooldown is
| |
| ~ initiated by circulating containment sump water through the core using the RHR pumps ~. Normally, recirculation flow will be directed to the RCS cold
| |
| . legs. If a very large break occurs in the cold legs, hot leg recirculation is required in the long-long term.
| |
| - A.9.2.1.5 - Accumulators. When RCS pressure drops below the accumulator discharge pressure, the water in the four accumulators discharges into the
| |
| - RCS cold legs and provides vessel reflood and additional core cooling and shutdown capacity.-
| |
| ~
| |
| A.9.2.1.6 Water sources. The RWST serves as a water source for RCS makeup,
| |
| ~
| |
| core reflooding, core cooling, and additional shutdown capacity. After HPI or LPI, valve realignment is performed and the containment recirculation
| |
| -sump is used as the water source during the recirculation phase. Although the RWST and the sump are not part of the ECCS, they will be analyzed-along.
| |
| with the ECCS due to their close functional relationship.
| |
| ' A.9.2.1.7 RHR shutdown cooling. Although RHR shutdown cooling is not considered an ECCS function, it is analyzed as a means of providing a long
| |
| ' " term cooling capability.- In this mode, the system transfers heat from the reactor coolant system to the component cooling system by taking suction from the hot leg of one reactor coolant loop, through two RHR pumps and heat exchangers, and discharging to the cold legs of each loop.
| |
| 4 A.9-10
| |
| | |
| A.9.2.2 System Success Criteria. The HPI success criterion for a transient or small LOCA during injection phase is one SI or CVCS pump (centrifugal charging pump) delivering water to at least one cold leg for 1 hour.
| |
| The HPI success criterion for a medium LOCA is any two of the four SI and CVCS pumps delivering water to at least two cold legs for 1 hour.
| |
| The LPI success criterion for a medium or large LOCA is at least one RHR pump delivering cooling water to at least two cold legs for 1 hour. For a large LOCA, three of the accumulators are required for 1 hour for accumulator system success. The other accumulator is assumed to discharge into the ruptured leg and is therefore unavailable.
| |
| The HPR success criterion for a transient or small LOCA is one RHR pump and one CVCS or SI pump delivering cooling water to at least two RCS cold legs for 18 hours.
| |
| The LPR success criterion for a medium or large LOCA is at least one RHR pump delivering cooling water to at least two cold legs for 23 hours. For hot leg recirculation during a large LOCA, one pump (RHR) is required to supply flow to one hot leg for an additional 4 hours.
| |
| The RHR shutdown cooling success criterion for a transient or small LOCA is at least one RHR pump delivering cooling water to at least two cold legs for 24 hours.
| |
| Since the system is designed to satisfy the single active failure criterion, two injection. paths are assumed to be sufficient to deliver a full rated flow from any one pump. - One suction path is considered sufficient to supply two high pressure pumps. The bases for the mission times are as follows. Examining ECCS and containment spray flow requirements for injection, based on the RWST volume available, yields a value for how long the associated pumps need to operate to exhaust the RWST. For all LOCAs, it is assumed the containment spray pumps are injecting; therefore, the mission times for all LOCA injection functions are less than 1 hour, in which cases a 1-hour mission time is assumed. The LOCA success criteria also applies to a steam loss inside containment initiating event in which case the containment spray would also be actuated. For the steam generator A.9-11
| |
| | |
| tube rupture initiating event, containment spray would not be actuated; therefore, the mission time of the high pressure injection function would be 6 hours for the same success criteria established previously.
| |
| l The bleed and feed function requires the same success criteria as the small LOCA high pressure injection with the additional operation of two of the power-operated relief valves (PORV) and a mission time of 6 hours. Usually, reactor coolant flow to the pressurizer relief tank within the containment can only be sustained for a short period of time before the tank rupture discs release which relieves steam to the containment and causes the containment spray system to inject water. However, if _ containment spray does not drain the RWST, we must have a longer mission time for bleed and feed. Hence, 6 hours is used making th'e analysis conservative.
| |
| Overall,' it is desirable to achieve 24 hours of ECCS operability in order to guarantee that the system has stabilized and there is time available to perform other activities. Therefore, the recirculation phase is required to"be operable from the end of the injection phase to 24 hours after the start of the initiating event.
| |
| A.9.2.3 System Configuration. A P&ID of the ECCS is presented in Figure A.9-1.
| |
| Instrumentation and piping with a diameter less than 1-1/2 inches are not shown in the diagram. This diagram is based on P& ids 47W810-1 (Revision 11), 47W811-1 (Revision 20), and 47WA12-1 (Revision 11). In the following, various parts of the system are described in more detail,
| |
| : e. Cold Leg Injection Accumulators. The low pressure cold leg injection accumulator part of the ECCS consists of four separate accumulators, each directly connected to a reactor cold leg
| |
| , injection line. Each injection line contains two check valves and one motor-operated isolation valve in series. Figure A.9-2 shows the simplified flow diagram.
| |
| e Safety Injection Pump Trains. There are two identical SI pump trains which are normally aligned for injection. They take suction from the RWST through normally open motor-operated flow control valve FCV63-5.
| |
| The pumps discharge to a common 4-inch header and then to the cold legs through four 2-inch branch lines. Flow through the 2-inch branch lines is adjusted and equalized by throttling valves. Each SI train consists of a pump and several flow control valves, manual valves, and check valves. A minimum flow circuit is provided for each pump to protect the pump in case it is started A.9-12
| |
| | |
| , i .
| |
| [ I p=,==---.--------]
| |
| l ,,,- )9(:
| |
| I9 --+
| |
| l - -
| |
| <sre =v rwm j I
| |
| l
| |
| =. [ _
| |
| = l 2d L_______________a i
| |
| _ .-1
| |
| . ( =,- p I ~ ~
| |
| =""
| |
| p,,,,,,,------------1 A
| |
| (=.- @
| |
| (2~
| |
| l @Y= l (EFI ' ., H.} I dEFIl E" l t _ _ _ _' __7_ _ i J t' .
| |
| ( =._ p.t - i n..=-----_------ , @ 4 v
| |
| (=
| |
| l E ll @~~~
| |
| j <srU e s-::Kari j 3C}
| |
| ; g s l l
| |
| - - * = l ._g I L_
| |
| i'. d ~~ l ' +-___J
| |
| ,___. ___ i
| |
| _. 1
| |
| [
| |
| g
| |
| $ ( ,,.,- p ll l p==---.--------I e
| |
| 11l i
| |
| I i
| |
| @ @c i 1, <are ud e wary i
| |
| r-=
| |
| i 1 l'! l l .. l l .--
| |
| (hX lll i
| |
| i
| |
| @ t _ _ _ _ _ _ _ _ _ , g _ _ __ a r J I
| |
| ( g,. p I I
| |
| l I
| |
| l
| |
| ...----. h ""
| |
| e l L% 1
| |
| ='
| |
| <=.
| |
| 1 C-1 l e8_
| |
| , @T #. r== :--
| |
| ::_ j i(sre__7s %sr
| |
| ~~*
| |
| .l- -
| |
| 9._
| |
| ~-~
| |
| i l
| |
| (-
| |
| i ._ . -
| |
| g --- p,I l -- 1 + - - - I + - -
| |
| l _,_ ,
| |
| <= % l I
| |
| _ _ ,'$ ).'
| |
| v i-L ___________
| |
| bg
| |
| _ _ _ _l
| |
| .,_ %- i . '
| |
| :- E. - ( 7p @ i(sri r ----4 l4]9
| |
| ( =:- gi %' g iW :
| |
| s =a % srii cq- - ._
| |
| ,j _
| |
| i I i
| |
| i _.
| |
| .i I
| |
| l= @c__*
| |
| l ! __g ;
| |
| "I
| |
| , , _4g L____ _ _ __ __J g i t= )
| |
| -t - :. .
| |
| ! q _,f i- s v - - .
| |
| l, ' jg'
| |
| ==:- .
| |
| 1 I I h- I L. J
| |
| %w Figure A.9-1. ECCS Simplified P&ID Ch D
| |
| L e Q .-
| |
| >f 1
| |
| D'
| |
| !f a 8L 4 ,
| |
| E d h=="
| |
| l o'. - E l
| |
| | |
| .. ._ e
| |
| ' PT PT PT PT PT PT PT PT
| |
| # LT LT LT LT LT LT LT LT 4 9 2 NO 3 NO &
| |
| %f %.) %) QJ 98 80 4?
| |
| 1 83422 63 623 63424 63426 FROM St A+4 \ FROM $1 A+8 \ FROM $1 A+8 \ FROM $1 A+8 \
| |
| 4 ANO RHR 8 /- AND RHR A / AND RHR A / AND RHR 8 /
| |
| 83 580 ~ 63 661 63562 63-563
| |
| ,, , ,, u COLD LEG COLD LEO COLD LEG COLD LEG LOOP 1 LOOP 2 LOOP 3 LOOP 4 Figure A.9-2. Sequoyah Lower Head Cold Leg Accumulators Simplified P&lD A.9-14 1
| |
| ...4 . ._ M
| |
| | |
| while the RCS is at a pressure above the discharge pressure of the SI pump. The SI pumps can inject the coolant into the core -
| |
| through both the cold legs and the hot legs. For hot leg recirculation, normally closed valves FCV63-157 or FCV63-156 have to be opened.
| |
| e CYCS Charging Pump Trains. During normal operation, the two CVCS 4 charging pump trains are aligned as backup for the reciprocating ;
| |
| charging pump for maintaining the reactor coolant system pressure
| |
| -and boron concentration. For this function, however, only one CVCS pump is needed.
| |
| In the injection mode, the charging paths are isolated and the pump trains take suction from the RWST through two parallel motor-operated valves, LCV 62-135 and LCV 62-136. These valves are normally closed, but open upon receipt of an SI signal. The SI signal also closes the valves in the charging pump normal suction line from the volume control tank, opens two boron injection tank (BIT) inlet insolation motor-operated valves, FCV63-39 and FCV63-40; two BIT outlet isolation valves, FCV63-25 and FCV63-26; and closes the valves in the boron injection tank recirculation line (valves FCV63-38, FCV63-41, and FCVG3-42).
| |
| The flow from the charging pumps passes through the BIT, forcing the concentrated boric acid solution from the tank. It then passes through two parallel isolation valves, FCV63-2S and FCV63-26, which are also opened by the SI signal.
| |
| The water then flows through check valve 63-581 into the containment where the line branches off into four 1-1/2-inch lines which deliver the water to the cold legs. Each line is provided with a throttling valve to equalize the injection flow and a check valve to prevent backflow from the RCS to the charging pumps.
| |
| o Residual Heat Removal Pump Trains. The RHR system consists of two trains that are cross-connected at several points. Each RHR train consists of a pump, a heat exchanger, several check valves, manual valves, and flow control valves. The RHR system can take suction from several sources. There is only one path connecting the suctie. headers of both trains and the RCS hot leg (loop 4).
| |
| There are two isolation valves, FCV74-1 and FCV74-2, on this line that protect the system from overpressurization during the power generation phase of plant operations. Inadvertent opening of these valves would lead to an interfacing LOCA. There is also a comon suction path for both trains from the RWST. RWST isolation valve FCV63-1 is normally open and is closed only during refueling outages when the refueling canal water is transferred back to the RWST. Each train has a separate connection to the containment sump.
| |
| The two trains are cross-connected downstream of the pumps and upstream of the heat exchangers. This inner cross-connect is normally isolated by the two hand control valves, 74-36 and 74-37. The two trains are also cross-connected downstream of the heat exchangers and prior to penetrating the containment building. This outer cross-connect is normally open. Each train branches into the discharge headers after penetrating the missile barrier and is connected to the cold legs of the four loops.
| |
| A.9-15
| |
| | |
| 1 The two cross-connects are also connected by a pipe that is normally isolated by flow control valve 74-32. A normally closed inject! ion header branches off from the outer cross-connect and branches .into the two discharge headers between the missile barrier and the containment wall. These two headers are connected to hot legs of loops 1 and 3. Each RHR train downstream of the heat exchangers branches into two normally isolated pipes. One of
| |
| .these two lines leads to the RHR spray headers and the other one leads to the suction side of the high pressure pump, (the charging pumps and safety injection pumps for train A and safety injection pumps for train B).
| |
| From RHR train A via FCV63-8 (normally closed), the flow can 'be connected to the suction side of either the safety injection pumps or the charging pumps. The path to the charging pumps beyond FCV63-8 is open. For the SI pumps, one of the two parallel valves, FCV63-6 or FCV63-7, has to be opened. From train B via FCV63-11 (normally closed), the RHR flow can be connected to the suction side of the SI pumps. These connections are used during the recirculation phase of core cooling after a LOCA when high pressure recirculation is needed.
| |
| The component cooling system (CCS) connections are also shown in Figure A.9-1. The CCS valves immediately adjacent to the RHR heat exchangers and pump heat exchangers are included as part of this system. Failures in these valves would only lead to the failure of the related component and would have little impact on CCS availability.
| |
| A.9.2.3.1 Major components. The major components of the ECCS are two CVCS pumps, two SI pumps, two RHR pumps, two RHR heat exchangers, the BIT, RHR containment spray headers, and several flow control valves, manual valves, and check valves as well as the RWST, and cold leg accumulators. The major components are described in the following: ,
| |
| e CVCS Charging Pumps. These pumps are located,in separate rooms at Elevation 669' in the auxiliary building. Each is a multistage, diffuser design, barrel-;ype casing with vertical suction and discharge nozzles. Each pump is capable of a maximum flow rate of 550 gpm. The design temperature and pressure are 300*F and 2,800 psig, respectively. The CVCS pumps are motor-driven, have self-contained lubrication and mechanical seal cooling systems that are cooled by component cooling water. The pumps are protected from dead-heading by a minimum flow bypass line.
| |
| e Safety Injection Pumps. These pumps are located in separate rooms at Elevation 66r in the auxiliary building. Each has a 650 gpm maximum flow rate and a design temperature and pressure of 300*F and 1,700 psig, respectively. Each pump is a multistage, centrifugal, motor-driven pump with a self-contained lubrication system and mechanical seal cooling system cooled by component cooling water. There is a minimum flow bypass line from each pump discharge to the RWST to A.9-16
| |
| | |
| protect the pump if it is started and the normal flow path is
| |
| ' blocked or the RCS pressure is greater than the design discharge pressure of the pumps, o RHR Pumps. - The two RHR pumps are designated as IA-A and IB-B and are located in separate rooas in the auxiliary building at Elevation 653'. These are identical, motor-driven pumps with 3,000 gpm capacity at 160 psig. The RHR pumps are single-stage, centrifugal, and are positioned vertically.
| |
| The motor-pump shafts are one integral unit.~ Each pump has a self-contained mechanical seal cooling system with a heat exchanger cooled by the component cooling system. A safety injection signal would start both pumps. The pumps are protected from dead-heading by a minimum flow bypass line (see Figure A.9-1).
| |
| e RHR Heat Exchangers. The two heat exchangers are of conventional vertical shell and U-tube' design and are cooled by. the component cooling system. The heat exchangers are located at Elevation 690' extending to Elevation 714' in the auxiliary building.
| |
| e Boron Injection Tank. The boron injection tank has a capacity of 900 gallons of concentrated (21,000 ppm) boric acid solution. The operating temperature is 150 to 180*F.
| |
| The design pressure of the tank is 2,735 psig.
| |
| During normal operation, the tank contents are recirculated 4
| |
| using the boric acid transfer pump to prevent cold spots and stratification within the tank. Electrical heaters are provided to ensure that the temperature of the solution is maintained above the solubility limit of 135*F.
| |
| e Cold Leg Accumulators. The four cold leg injection accumulators are filled with borated water and pressurized with nitrogen gas. Each accumulator has a total volume of 1,350 cubic feet. Approximately two-thirds of the vessel volume, 925 cubic feet, is occupied by borated water at a nominal concentration of 1,900 ppm boron. The remainder of the vessel is filled with nitrogen gas at a normal operating pressure between 385 and 447 psig. The pressurized nitrogen provides the driving force for the injection of borated water into the reactor vessel.
| |
| e Valves. Various numbers of valves of different kinds are ured in the ECCS. All critical valves'are shown in Figure A.9-1 and listed in Table A.9-3. The table also shows the main source of power and control for each valve.
| |
| ~ A.9.2.3.2 ; Support systems. The following systems supply support functions
| |
| , - needed for successful operation of the ECCS:
| |
| e Electric Power. Electric power is needed for operating the motor-operated valves and pumps. The power sources for their components are listed in Table A.9-3. The air-operated valves are included in the list along with the DC power source for the corresponding solenoid valves.
| |
| A.9-17
| |
| | |
| Table A.9-3 ELECTRIC POWER BUSES NEEDED FOR ECCS SYSTEM COMPONENTS Sheet 1 of 2 Component Main Power Control Power RHR Pumps 1A-A 6.9 KV Shutdown Board 1A-A 1B-B 6.9 KV Shutdown Board 1B-B SI Pumps
| |
| -1A-A 6.9 KV Shutdown Board 1A-A IB-B 6.9 KV Shutdown Board 18-B Charging Pumps 1A-A 6.9 KV Shutdown Board 1A-A 1B-B 6.9 KV Shutdown Board IB-B Electric Motor-Operated Valves ,
| |
| FCV63-1 480V Reactor M0V Board 1Al-A
| |
| -FCV63-6 480V Reactor MOV Board 1B1-B FCV63-7 480V Reactor M0V Board 1Al-A FCV63-8' 480V Reactor MOV Board 1Al-A FCV63-11 480V Reactor MOV Board 181-B FCV63-22 480V Reactor MOV Board 181-B FCV63-25 480V Reactor MOV Board 1B1-B FCV53-26 480V Reactor MOV Board 1Al-A FCV63-39 480V Reactor MOV Board 1Al-A FCV63-40 480V Reactor MOV Board 1B1-B FCV63-47 480V Reactor MOV Board 1Al-A FCV63-48 480V Reactor MOV Board 181-B FCV63-67 480V Reactor MOV Board 1Al-A
| |
| ~FCV63-72 480V Reactor MOV Board 1Al- A FCV63-73 480V Reactor MOV Board 181-B FCV63-80 480V Reactor MOV Board 1B1-B FCV63-93 480V Reactor MOV Board 1Al-A FCV63-5 480V Reactor MOV Board 1B1-B FCV63-4 480V Reactor MOV Board 1B1-B FCV63-3 480V Reactor MOV Board 1Al-A FCV63-175 480V Reactor MOV Board 181-B LCV62-135 480V Reactor MOV Board 1Al-A LCV62-136 480V Reactor MOV Board 181-B FCV62-90 480V Reactor MOV Board 1Al-A FCV62-91 480V Reactor M0V Board IB1-B FCV62-93 480V Reactor MOV Board 1Al-A FCV62-98 480V Reactor MOV Board 1Al-A FCV62-99 480V Reactor M0V Board 1B1-B A.9-18
| |
| | |
| l l
| |
| Table A.9-3 (continued)
| |
| Sheet 2 of 2 Component _ Main Power Control Power FCV63-94 480V Reactor M0V Board 181-B FCV63-98 480V Reactor MOV Board 1Al-A FCV63-118 480V Reactor MOV Board IB1-B FCV63-152 480V Reactor MOV Board 1Al-A FCY63-153 480V Reactor M0V Board 181-B FCV63-156 480V Reactor MOV Board 1Al-A FCV63-157 480V Reactor M0V Board 181-B FCV63-172' 480V Reactor MOV Board 1B1-B FCV72-40 480V Reactor MOV Board 1Al-A FCV72-41 480V Reactor M0V Board 181-B
| |
| -FCV74-1 480V keactor MOV Board 1Al-A FCV74-2 480V Reactor MOV Board IB1-B FCV74-3 480V Reactor MOV Board 1Al-A FCV74-12 480V Reactor MOV Board 1Al-A FCV74-21 480V Reactor MOV Board 1B1-B FCV74-24 480V Reactor MOV Board 181-B FCV74-33 480V Reactor M0V Board 1Al-A FCV74-35 480V Reactor MOV Board IB1-B FCV70-156 480V Reactor MOV Board 1A2-A FCV70-153 480V Reactor MOV Board 182-8 Diaphragm-Operated Valves FCV74-16' Air Battery Board I(NOR),II( ALT)
| |
| FCV74-28 Air Battery Board III(NOR),IV(ALT)
| |
| FCV74-32 Air Battery Board I(NOR),II( ALT)
| |
| FCV63-38 Air Battery Board II
| |
| 'FCV63-41 Air Battery Board I
| |
| 'FCV63-42 Air Battery Board II Hand Control Valves HCV74-36 None None HCV74-37 None None A.9-19
| |
| | |
| > a I
| |
| e Engineered Safety Features Actuation System (ESFAS). The safeguards actuation signals are needed to activate the injection modes of the ECCS. For high pressure injection, an SI signal starts the safety injection and charging pumps, closes the valves in the charging pump miniflow and discharge s
| |
| line to the normal charging line, closes the boron injection recirculation line valves, opens the motor-operated valves on the suction line from the RWST, closes the volume control
| |
| - tank (VCT) supply valves, and opens the BIT inlet and outlet motor-operated valves.
| |
| The cold leg accumulators do not. require an SI signal to discharge because the check valves open automatically when
| |
| - the reactor vessel pressure drops below between 385 and 447 psig.. The MOV isolation valves are normally open.
| |
| For low pressure injection. an SI signal starts the RHR pumps and sends an open signal to valves 63-1, 70-153, 70-158, 74-3, 74-21. 74-16, 74-28, 63-93, and 63-96. It sends a close signal to FCV74-1, FCV74-2, FCV63-8, and FCV63-11.
| |
| For automatic switchover from the injection mode to the recirculation mode, ESFAS supplies a close signal to RHR suction valves 74-3 and 74-21 and an open signal to sump valves 63-72 and 63-73.
| |
| e Component Cooling System. The RHR, SI, and charging pumps
| |
| .have self-contained mechanical seal cooling systems. The' heat from these six pumps is dissipated in heat exchangers connected to the component cooling system. The CCS flow rate through each of these heat exchangers is 5 gpm. Pump failure would occur within 5 minutes if the flow of CCS water stops.
| |
| The shell side of the RHR heat exchangers is also connected to the component cooling system. Isolation MOVs 70-153 and 70-156 are normally closed and are opened by manual operator action. -The CCS flow rate through these heat exchangers is 5,000 gpm.
| |
| e Essential Raw Cooling Wate< System. The CVCS and SI pumps all have oil coolers which are cooled by essential raw cooling water. The pumps caroo+. operate without water to cool the oil coolers. - The CVb, SI, and RHR pump rooms all hive separate room coolers. These room coolers require essential raw cooling water for heat removal. The pumps can operate in the short term without room cooler heat removal but it is assumed that they cannot operate in the long tern without the room coolers functioning. Normally closed
| |
| : air-operated valves (FCV67-176 and FCV67-182) to the SI pumps and (FCV67-188 and FCV67-190) to the RHR pumps are opened by an Si signal or pump activation. The valves to the CVCS pumps (FCV67-168 and FCV67-170) are normally open.
| |
| e RWST/ Containment Sump. The ECCS depends on the RWST during the injection phase and the containment sump during the recirculation phase. The RWST has a separate path to the CVCS pumps, SI pumps, and RHR pumps. The sump has two separate paths, one to each intake of the RHR pumps.
| |
| A.9-20
| |
| _ _ - - _ _ - - _ _ - - - _ - _ _ _ _ _ _ _ - - - - _ _ _ _ _ _ - - _ - _ - _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ ~
| |
| | |
| The electric power, ESFAS, ERCW, and CCS support functions are all supplied by separate trains (A and B) which go to the corresponding ECCS trains. For example, train A electric power, train A CCS water, train A ECRW, and the train A ESFAS actuation signal are supplied to all train A pumps.
| |
| A.9.2.3.3 Interfacing systems. The ECCS as analyzed in this study interfaces with the containment spray system. The containment spray system requires flow from the containment sump in the recirculation mode. This flow must come from sump isolation valves 63-72 and 63-73 which are included in the ECCS analysis.
| |
| The ECCS also interfaces with the reactor coolant system. All injection and
| |
| ; recirculation functions inject into the reactor coolant system.
| |
| A.9.2.4 System Operation.
| |
| A 9.2.4.1 Normal operation. During normal power operation, the cold leg accumulators are aligned in the standby injection mode of operation. In this mode, the boron concentration is maintained between 1,90t' ppm and 2,100 ppm, and the accumulator volume is maintained between 7,857 and 8,071 gallons. The nitrogen pressure-is maintained between 385 and 447 psig. The motor-operated valves are deenergized in the open position and check valves are closed due to the pressure differential between the RCS and the accumulators.
| |
| The centrifugal charging pumps are part of the chemical and volume control system in normal plant operation. One of three pumps (two centrifugal charging pumps and one reciprocating charging pump) may be-needed for normal charging because they serve as backup for the reciprocating charging pump.
| |
| A safety injection signal would realign the centrifugal charging pumps for safety injection function.
| |
| The safety injection pumps are specifically provided for the high pressure injection and recirculation modes of ECCS operation and, as such, perform no i
| |
| !- function during normal operation.
| |
| The RHR pumps and heat exchangers, under normal conditions, are aligned for the low pressure injection mode of the ECCS. The normal shutdown RHR mode A.9-21
| |
| | |
| of operation is included in this system analysis and modeled as closed loop
| |
| (
| |
| RHR.
| |
| A.9.2.4.2 Event response.- Following a LOCA, the operation of the ECCS is disided into two distinct modes as discussed in the following:
| |
| e Injection Mode. In this mode,- the ECCS prevents core
| |
| .uncovery in the initial phase of the accident by providing coolant at propt.c pressure to the primary system. For small to medium LOCAs, the emergency cooling is provided by high -
| |
| . pressure injection pumps (CVCS and SI pumps) and the upper
| |
| *' head injection accumulators.-
| |
| .For a large LOCA, where the reactor coolantrpressure drops rapidly, the high flow rate needed to prevent core uncovery is provided first by the discharge from upper head injection accumulators and then the cold leg accumulators. This it followed by the charging pumps, safety injection pumps and, primarily, the RHR pumps, delivering water.to the primary.
| |
| system. .
| |
| Pump suction in the entire injection phase is taken from the RWST..
| |
| e .- Recirculation Mode. Following the injection mode, when the RWST water level reaches the low level alarm point, the system is realigned for recirculation cooling. The RHR pumps take suction from the containment sump.and the coolant.
| |
| temperature is lowered in the RHR heat exchangers. From the RHR heat exchangers, flow can be routed in different directions. The core and containment conditions determine-which flow path should be chosen. The path for low pressure cold -leg injection'is normally open.' -If the RCS pressure is above;the shutoff head of the RHR pumps, the flow can be
| |
| . directed tward the suction side of the high pressure pumps
| |
| -(SI pumps for train B and~ centrifugal charging and SI pumps
| |
| . for train A). Isolation valves FCV63-8 or FCV63-11 are opened to establish the flow to the high pressure pumps.
| |
| The RHR pumps 'can also be 'used for additional containment spray. This is done in the recirculation mode by opening one isolation valve (FCV72-40 and FCV72-41) for each train. .The hot leg injection paths at the RHR side and SI side can be opened for hot and cold leg recirculation after the recirculation cooling is established.
| |
| A.9.2.4.2.1 - Automatic actions. The ECCS in the injection mode is designed
| |
| . to function automatically upon receipt of an SI signal. The SI signal actuates the engineered safety feature equipment automatically, starting the charging pumps, safety injection pumps, and RHR pumps. It also sends an -
| |
| open signal to several valves in the system and closes certain other valves
| |
| '(see Section A.9.2.3.2).
| |
| A.9-22
| |
| | |
| m The cold leg accumulators are self-contained and discharge directly into the RCS cold legs when a LOCA reduces the reactor coolant pressure to between 385 and 447 psig. The four normally open motor-operated valves also receive
| |
| . SI signals to ensure that they are fully open.
| |
| Accumulator operation is of short duration and ceases when the accumulator vessels _ are empty, which may take up to several hundred seconds depending on the size of the LOCA. The injection response of accumulators will depend on the reduction rate of RCS pressure. The check valves in the injection lines open, admitting borated water to the core through the cold legs of the reactor vessel.
| |
| The injection paase is continued until the RWST reaches the low level alarm point (120,00 gallons) and containment sump water reaches a depth of about 13 feet. When these two conditions are met, the engineered safety features actuation system realigns the RHR valves for sump water suction and establishes the recirculation cooling mode. This requires two out of four sump high water level and two out of four RWST low level signals. Only two
| |
| , functions are performed automatically; RHR block valves FCV74-3 and FCV74-21 are closed, and sump isolation valves FCV63-72 and FCV63-73 are opened (Sequoyah FSAR, Chapter 6, Table 6.3-3). The balance of the functions are performed manually. The RHR pumps are not stopped because it has been determined that the pumps would not be dangerously starved from suction flow daring the changeover.
| |
| These actions automatically establish low pressure recirculation cooling if RCS pressure is lower than the RHR discharge head. If high pressure recirculation is necessary, manual actions must be taken for proper valving arrangement.
| |
| . A.9.2.4.2.2 Manual operator actions. In all modes of ECCS operation (i.e.,
| |
| HPI, LPI, and recirculation cooling) _ the operators can interface with system operation. However, as was mentioned in the previous section, the injection mode is activated automatically. If the ESFAS fails to activate the system, the operators can align the valves and start the pumps. In case the reactor has failed to trip following an initiating event requiring a trip, but heat removal is available through the steam generators, the HPIS can be manually actuated to provide a sufficient negative reactivity addition to achieve and maintain core subcriticality.
| |
| A.9-23
| |
| | |
| In the recirculation phase, the control room operators complete the switchover after verifying that the automatic
| |
| * actions for realigning RHR valves have been initiated. The operators are prompted by the RWST low
| |
| - level alarm and by sump elevel indicators. The following listing of the
| |
| - manual actions for injection to recirculation changeover is adopted from the'Sequoyah FSAR, Chapter-6, Table 6.3-3:
| |
| : 1. Close the two valves in the crossover line downstream of the
| |
| - RHR teat exchangers (FCV74-33, FCV74-35).
| |
| :2. Open the component cooling water isolation valve to each RHR heat exchanger (FCV70-153, FCV70-156).
| |
| : 3. Verify SI pump flow to the RCS,(e.g., large break case) and close the three safety injection pump miniflow valves (FCV63-3,FCV63-4,FCV63-175).
| |
| : 4. Trip the reciprocating charging pump if it is still running.
| |
| : 5. Verify that FCV63-72 and FCV63-73 are fully open to make up permissive logic, then open the valve in the line from the train A RHR pump discharge to the charging pump suction (FCV63-8) and the valve in the line from the train B RHR pump discharge to the safety injection pump suction (FCV63-11).
| |
| : 6. - Verify that the automatic valve realignments above have been
| |
| -completed.
| |
| : 7. Open the'two parallel valves in the common suction line between the charging pump suction and the safety injection pump suction (FCV63-6 and FCV63-7).
| |
| : 8. Close the valve in the line from the RWST to tu safety injection pump suction (FCV63-5).
| |
| : 9. Reset the SI system actuation signal at the system level and close the two parallel valves in the line from the RWST to the charging pump suction (FCV62-135, and FCV62-136).
| |
| : 10. Close valve FCV63-1 in the common line from the RWST to both RHR pumps when the valve power lockout can be removed as time l'
| |
| permits or after the containment spray pumps are aligned.
| |
| Containment spray recirculation is established after these 10 steps. If the RHR pumps and the containment spray pumps continue to take suction from the RWST'at full capacity, the level in that tank would reach about 50,000 gallons (the low-low alarm point) at this stage. The operators would then realign the recirculation mode of the containment spray system.
| |
| ' If the containment spray recirculation system is not available and containment pressure is high, RHR containment spray recirculation can be A.9-24 m ..
| |
| | |
| e ; -
| |
| 5 ._ ,
| |
| A "
| |
| l c_
| |
| y, '
| |
| established by closing-RHR cold = leg isolation valve FCV74-16 (or FCV74-28) 1 and then opening RHR ' spray isolation valve FCV72-40 (or FCV72-41). The
| |
| " injection line is isolated to prevent pump runout. The operators would a'lign only one train for spray to maintain the other train for core
| |
| ' cooling.- "If. only one RHR train ~is avai_lable, the operators would switch to -
| |
| ' high pressure recirculation before aligning the available train to RHR
| |
| ;contillnoent spray.
| |
| s H0 If the need arises,.the recirculation system can be manually realigned for.
| |
| S hot and cold ~ leg recirculation. The following-listing of the manual actions is _ adopted from Table 6.3-3 of the Sequoyah FSAR:
| |
| .. e Stop both safety injection pumps.
| |
| .e Close the safety injection pump discharge crossover valves t(FCV63-152 and FCV63-153).
| |
| .e Close the. safety injection pump cold leg injection valve
| |
| -x (FCV63-22).-
| |
| ;e 0 pen the safety injection pump hot leg injection valves (FCV63-156 and FCV63-157).
| |
| e Start both safety injection pumps.
| |
| If. RHR hot leg ' injection is desired:
| |
| 4
| |
| -e ; Close the train A'(train B) cold leg injection valve (FCV63-93) (FCV63-94).
| |
| e 0)en the RHR crossover valve -(FCV74-33), (FCV63-94).
| |
| e - Ope'n-the RHR hot leg injection valve (FCV63-172), (FCV74-35).
| |
| ~
| |
| A.9.2.4.3 ' Potential for event initiation. Since the ECCS is connected to the RCS, certain pipe or' valve-failures may lead to a perturbation in .
| |
| reactor and plant stability. -
| |
| Gross-leakage through 'two' check valves in series in the cold. leg injection
| |
| , y headers or in the hot leg injection headers would lead to pipe rupture in the RHR or SI parts of the system. 'It is very likely that this rupture s
| |
| would occur inside the containment because the design pressure of the piping
| |
| 'is 1,700 and 600 psig for SI an'd RHR systems,1respectively, upstream of the first check valves. Similarly, if the two.dropline isolation valves
| |
| . . (FCV74-1'and FCV74-2) inadvertently open, the piping upstream of the ficst valve may rupture because the piping is designed for 600 psig pressure.
| |
| A.9 J
| |
| If=Ithe pipe rupture occurs inside the containment, it would cause a LOCA.
| |
| However.nif the rupture occurs outside the containment, an interfacing LOCA
| |
| ~ outside the containment would result and could not be isolated. -
| |
| The charging system is high pressure; therefore, any _ leakage through the
| |
| : isolating check valves would not lead to severe consequences. However, if centrifugal charging inadvertently starts, cold water could be injected into
| |
| .the RCS, thus creating a perturbation in the reactor and plant stability.
| |
| l A.9.2.5 - Controls, Indicators, and Alarms. The following is a. description of
| |
| : ECCS interlocks.
| |
| e . The three SI system miniflow isolation valves (FCV63-4, FCV63-175, and FCV63-3) are interlocked to prevent opening unless the RHR to
| |
| .CVCS and SI discharge valves (FCV63-8 and FCV63-11) are closed.
| |
| . This interlock prevents flow of contaminated recirculation water to the RWST.- The . interlock can be bypassed manually.
| |
| e_ The RHR valves to the CVCS and'SI system (FCV63-8 and FCV63-11) will'not open unless both miniflow valves (FCV63-175 and FCV63-4) are closed or- the comon miniflow valve (FCV63-3) is closed in conjunction with the corresponding sump valves in each train (FCV63-72 or FCV63-73) being open.
| |
| e Upon receipt of an ESFAS open signal the sump valves (FCV63-72 and
| |
| ;FCV63-73) start to open. .The RHR to RWST suction valves (FCV74-3 and FCV74-21) are interlocked with the same train sump valve to start closing when the sump valves ~ start to open. When the RHR suction valves are fully closed, they interlock the corresponding -
| |
| sump valve to remain open.
| |
| e The RHR suction valves (FCV74-3 and FCV74-21) cannot be opened unless the corresponding train sump' valves (FCV63-72 ,
| |
| and FCV63-73), RHR discharge to CVCS, and SI valves (FCV72-40 and FCV72-41), respectively,' are closed.- This interlock prevents
| |
| - recirculation backflow to the RWST through a leaky check valve or possible cavitation of RHR pumps due to low RWST inventory.
| |
| e ' The RHR hot leg 4 suction valves (FCV74-1 and FCV74-2) cannot open
| |
| :unless the corresponding train sump valve (FCV63-72 and FCV63-73) is closed, the RWST~ discharge valve (FCV63-1) is closed, and the RCS pressure is less than a specified setpoint. The valves are also interlocked to close .if the RCS pressure goes above the
| |
| -setpoint.- .
| |
| 'e The RHR miniflow bypass isolation valves (FCV74-12 and FCV74-24)
| |
| :are interlocked by a flow element in each of the RHR discharge lines which opens and closes the bypass valves according to the
| |
| :RHR minimum flow setpoint.
| |
| -e The RHR heat exchanger bypass valve (FCV74-32) is interlocked with
| |
| - both RHR train discharge valves (FCV74-16 and FCV74-28) to control the RHR temperature by bypassing the RHR heat exchangers.
| |
| A.9-26
| |
| | |
| T'he major equipment controls, indicators, and alarms are tabulated in Table A.9-4. Normally open valves FCV63-1 and FCV63-5 have limit switches that are alarmed if the valves are closed. All other control valves (MOV and air-operated) have hand control switches and red / green position indicator lights in the main control room.
| |
| A.9.2.6 Testing, Inspection, and Surveillance Requiremer.Ls. The major periodic tests, inspections and surveillances of the ECCS are listed in Table A.9-5.
| |
| In addition to those tests listed in Table A.9-5, ECCS pumps and valves are subject to inservice testing according to ASME specifications. These tests include quarterly pump performance testing using the test lines and the stroking of valves every 31 months. Valves which are subject to RCS pressure are stroked every refueling cycle while the valves on the RCS hot legs to the RHR lines, on
| |
| , the RHR cold leg injection lines, and on the accumulator injection lines are stroked every cold shutdown.
| |
| A.9.2.7 Maintenance Requirements. There are no regularly scheduled preventive maintenance activities for the ECCS. Maintenance is performed as required.
| |
| Repairs of failed or degraded components during unit operating periods must conform with the applicable limiting conditions for operation criteria referenced in the technical specifications discussed-below. Failure to perform the repair in the allotted time means the unit must be shut down until the failed components are returned to service.
| |
| Since most of the ECCS major components are independent and redundant, maintenance on one component will not require a unit shutdown unless the maintenance period exceeds 72 hours.
| |
| A.9.2.8 Technical Specification Effects. The Sequoyah technical specifications require the following conditions to be met for continuing plant operation:
| |
| e A single operable ECCS subsystem is comprised of: one operable CVCS pump one SI pump and one RHR pump; one RHR heat exchanger and a flow path capable of taking suction from the RWST on an ESFAS signal and transferring suction to the sump during the recirculation phase.
| |
| With one ECCS subsystem inoperable for 72 hours, the unit should change to hot shutdown within 12 hours unless both subsystems are operable.
| |
| e The BIT is considered operable when it contains a minimum of 900 gallons of solution with a boron concentraton between 20,000 and 22,500 ppm and a minimum temperature of 145*F. With the BIT. inoperable for more than 1 hour, the unit shall be in hot standby and borated to a A.9-27
| |
| | |
| Table A.9-4 CONTROLS, INDICATORS, AND ALARMS Sheet 1 of 2 Function Component Main Control Room Local Electrical Indicator Discharge Pressure CVCS Pump Hand Switch Indicatora Bearing Temperature Hand Switch Discharge Flow Electrical Indicator Indicatora Suction Pressure Indicatcr CCS Flow Indicatora CCS Flow Alarma SI Pump' Electrical Indicator Suction Pressure Indicator Hand Switch Hand Switch Bearing Temperature RWST Miniflow Indicator Discharge Flow Indicatora Discharge Pressure Indicatora CCS Flow Indicatora CCS Flow Alarma RHR Pump Electrical Indicator Hand Switch Discharge Flow / Discharge Pressure Pressure Alarma Indicator Hand Switch Suction Pressure Indicator Seal Water Temperature Seal Water Temperature Alarm Flow Indicator Discharge Pressure Indicatora CCS Flow Indicatora CCS Flow Alarma
| |
| .RHR Heat Exchanger. Temperature Recorder Temperature Indicator CCS Flow Indicatora CCS Temperature Indicator CCS Flow Alarma Outlet Flow Indicatora Outlet Temperature Indicator Refueling Water Level Indicatora Storage Tank Level Alarma Temperature Indicator alnstrument power is indicated for these instruments.
| |
| A.9-28
| |
| | |
| F: ,
| |
| i Table A.9-4 (continued)
| |
| ;. Sheet 2 of 2 o
| |
| l Function Component Main Control Room Local Boron Injection Temperature Indicator Tank Temperature Alarm Discharge Pressure Indicatora i Discharge Pressure Alarma Containment Sump Level Alarm Accumulator Pressure Alarma Pressure Indicatora Level Alarma Level Indicatora RHR Letdown Line Pipe Rupture Indicator from RCS . Temperature Alann Hot Leg 4 aInstrument power. is indicated for these instruments.
| |
| i A.9-29 L.-
| |
| | |
| Table A.9-5 TESTS AND SURVEILLANCE REQUIREMENTS Sheet 1 of 2 Time Periods Component
| |
| < 12 Hours < 24 Hours < 7 Days i 30 Days 1 18 Months Accumulators Borated Water Volume - -- -- Boron Solution Isolation valve opens Visual Concentration - Test when RCS pressure exceeds pressure block Nitrogen Pressure - -- -- No Power Available to of Si setpoint.
| |
| Visual Isolation Valve -
| |
| Removal of Breaker Isolation valve opens Isolation Valve Open - -- upon s test signal.
| |
| Visual -- Water Level and Pressure Level Water level and pressure Channel - Channel level channel - channel !
| |
| Functional Test calibration. 1
| |
| $1 and RHR Hot Legs Valves Are in Required -- --
| |
| 3= Injection Valves Positions with Power 6a Renave d y All Nonlocked Valves -- -- Valves Are in Correct Position Containment Area No loose debris which can block sump is present - visual inspection prior to establishing primary containment integrity.
| |
| Hot leg to RHR ! solation -- -- -- -- Automat {C isolation and Valves interlock for RCS pressure > 750 psig.
| |
| All Automatic Valves -- -- -- -- Actuates to correct position on s test signal.
| |
| SI, RHR, CVCS Pumps -- -- -- -- Starts automatically upon receipt of test signal.
| |
| Develop the required pressure and flow when operating in recirculation mode (quarterly) .
| |
| During shutdown following modifications, verify injection lines and pump flaw rate reaches the requirement when a single
| |
| ' pump operates.
| |
| | |
| Table A.9-5 (continued)
| |
| Sheet 2 of 2 Time Periods 1 12 Hours < 24 Hours e 7 Days < 30 Days 1 81 Months 23 Throttling Valves To Cold --
| |
| , and Hot Legs Verify correct position ca of position stop.
| |
| Within 4 hours follwing valve stroking or maintenance operation when ECCS required to be operable.4 BIT --
| |
| Water Temperawre Borated Water Volume -- --
| |
| and Concentration BIT Heat Tracing --
| |
| Measure Tank and -- Engineering Heat --
| |
| Flow Path Temperature Tracing Channel RWST --
| |
| Borated Water Borated Water Volume -- --
| |
| Temperature Boron Concentration
| |
| | |
| I shutdown margin equivalent to 1% delta K/K at 200*F within 6 hours. If the BIT remains inoperable for 7 more days, the unit must be in hot shutdown within the next 12 hours.
| |
| e A minimum of two heat tracing channels shall be operable for the BIT and for the heat traced portions of the associated flow paths. With only'one heat tracing channel operating, the unit may continue to operate for 30 days if the BIT and flow path temperature is kept equal to or above 145'F and verified every 8 hours. Beyond this period, the unit shall be in hot standby within the next 6 hours and in hot shutdown within the following 6 hours.
| |
| e The RWST is considered operable when it contains between 370,000 and
| |
| '375,000 gallons, with a boron concentration between 2,000 and 2,100 ppm and a minimum water temperature of 65'F and maximum of 105'F. With the RWST inoperable beyond I hour, the unit shall be in hot standby within 6 hours and in cold shutdown within the next 30 hours.
| |
| e An accumulator is considered operable when it contains between 7,857 and 8,071 gallons of water, its isolation valve is open, the boron concentration is between 1,900 and 2,100 ppm, and the nitrogen cover pressure is between 385 and 447 psig. With one accumulator inoperable due to a closed isolation valve, either the isolation valve must be reopened or the plant must be placed in at least hot standby within 1 hour and be in hot shutdown within the following 12 hours. If the accumulator is inoperable except due to a closed isolation valve, the accum;1ator must be restored to operable status within 1 hour or the plant must be placed in at least hot standby within the next 6 hours and in het shutdown within the following 6 hours.
| |
| A.9.3 System Logic Models A.9.3.1 ' Evvit Sequence Top Event Definitions. The ECCS top event definitions (and the corresponding ECCS function models) for each event sequence diagram are shown in Table A.9-6. The order in which the top events appear within each event sequence is shown starting from top to bottom. For example, in event sequence 1 (large LOCA) LPI, LPR, and LPHLR appear in that order. The order in which each top event appears within each event sequence determines the modeling success criteria and boundary conditions given in the following sections.
| |
| A.9.3.1.1 Analysis boundary conditions. The ECCS GO models are developed separately for each ECCS function in Table A.9-6. Subsystems needed for each ECCS function are grouped together to represent that particular function model. For example, the HPI model consists of a model of the CVCS pump trains with their injection paths and the SI pump trains with their injection paths combined to represent the appropriate HPI success criterion preytbusly defined. Each ECCS function model is quantified separately given that all dependencies are successful. This implies that all support i
| |
| A.9-32
| |
| | |
| j S
| |
| W 4 T 1 X X X A
| |
| n o
| |
| e r
| |
| 3 r 1 X X o
| |
| c x
| |
| E t
| |
| een masin dm essi 2 tota 1 X X X Slut On o
| |
| C t
| |
| n m eme asdn esii 1 tosa 1 X X X SLnt I n o
| |
| C r
| |
| o tp s
| |
| * ci 0 X X e ar 1 c eT n R e
| |
| u q n S
| |
| T N
| |
| S t
| |
| e 1
| |
| S(
| |
| U
| |
| #'c 9 X X E n M e v
| |
| P" 3 ,
| |
| E E $ 3 R
| |
| I g U n e 6 i n
| |
| - Q t ip bi 8 9 E a X X rr R i t uT A i T T n e N I f oma l E b V se 7 X X a E st o
| |
| T L P
| |
| O r T fe ot S s C s 6 X X C
| |
| E Le F
| |
| s w sfSo ooCl 5 X X L RF r
| |
| mt o er aaeu erbt 4 X X X X t eup SnTu e R G
| |
| l lA aC 3 X X X X X X mO SL m
| |
| u iA dC 2 X X X eO ML e
| |
| gA rC 1 X X X X aO LL s
| |
| r o
| |
| t d np a n oo l a iT) u t t m d R R ScDn u ed F L CnSe c 1 ee R 1 R R H C uE v c P l e P P L P P EF(E A H BF H L C L L
| |
| =
| |
| 2*e d IflI' ,ll l
| |
| | |
| dependencies are successful as well as dependencies on other ECCS functions. The dependencies that exist among ECCS functions are handled in p ;two different ways.outside of the ECCS analysis. First, the dependencies among top ' event function failures are handled in the event sequence Ediagrams. . For example, if LPI were to fail in an event sequence, we would
| |
| ; not ask~ for successful LPR because of the dependency on the same system equipment. 'Second, the dependencies that exist on a subsystem or trainwise basis are handled in .the-integration'of the overall safety model. For example, the successful operation of RHR pump train A in the LPI model would
| |
| ~
| |
| be hardwired to RHR pump train A in the LPR model such that if pump train A lin the LPI model were to fail, it would not be available in the'LPR model.
| |
| In-the following sections, boundary conditions that apply to all the ECCS function models-are defined as well as the boundary conditions that pertain to the individual models.
| |
| A.9.3.1.1.1 General boundary conditions. The following boundary conditions apply to all the subsystems.
| |
| e ' The unit is considered to be operating at normal power prior to the occurrence of the initiating events. It is assumed for this analysis that one charging pump is providing normal i
| |
| ^
| |
| reactor coolant pump seal injection flow (in quantification, the pump is treated as having to start and then run). All other ECCS pumps are in the standby mode as described in Section A.9.2.4.1. Valve alignment is assumed to be in the normal plant operating mode as described in Section A.9.2.4.1 except as modified by plant testing.
| |
| e Since the system is designed to ' satisfy the single active failure criterion, two injection paths are assumed to be sufficient to deliver a full rated flow from any one pump.
| |
| One' suction path is considered sufficient to supply two high pressure pumps.
| |
| e No credit is given for operator actions to recover failed-equipment. Recovery actions are analyzed as necessary within the context of specific failure sequences identified in the plant event sequences.
| |
| e All human interaction with the ECCS is not considered in this analysis and therefore is not quantified in any of the logic models.
| |
| e Pipes with a diameter less than 1-1/2 inches are not considered to affect ECCS availability due to their relatively small flow capacity.
| |
| A.9-34
| |
| | |
| e All' valves which ~could isolate interfacing systems from ECCS are included in the ECCS logic models. This includes the SI, CVCS, and RHR pumps' component cooling water and ERCW inlet i
| |
| _ and outlet valves, the pump room coolers, and RHR heat
| |
| ' exchangers inlet and outlet valves.
| |
| .e During the recirculation mode, failure of the RWST outlet valve (FCV63-1) to close will not fail low pressure recirculation. This is because the check valve (63-502) downstream of the outlet valve chould close once suction is supplied by the sump due to the pressure difference created.
| |
| Failure of this check valve to close would result in flow to the RWST thereby incapacitiating this ECCS function.
| |
| Quantitatively, the contribution to unavailability resulting from this valve failing is insignificant and, therefore, the RWST outlet valve is not included explicitly in the logic.
| |
| e Failure to close the RWST outlet valves to SI and CVCS (FCV63-5, FCV63-135, and FCV63-136) will not fai_1 high pressure recirculation of the respective system. The downstream check valves provide an alternate means of isolation (as discussed in the preceding item).
| |
| e- Unavailability of the electrical power supply to the valves affects only those valves which need to change their positions using that power supply, o Piping sections and their failures are not explicitly modeled.
| |
| e Failure of testing (miniflow) lines in the form of pipe breaks would incapacitate the associated pump for the RHR systems but CVCS and SI system pumps have a small miniflow recirculation flow'so that a pipe break could only divert a limited amount and, therefore, these are not explicitly included in.the quantification. The RHR system mintflow piping failures are not included in the quantification.
| |
| e ERCW and component cooling water is required for the high pressure pumps during injection and recirculation and for low pressure pumps during recirculation. The low pressure pumps only require component cooling water. ERCW for all pump room coolers is required only during the recirculation phase due to the short length of the injection phase.
| |
| e The organization of the event sequences is such that questions about the suction ~ sources (RWST and containment
| |
| ~
| |
| recirculation sumps) are asked independently. Only if the appropriate suction source is available are the unavailabilities of the systems considered. Therefore, all the ECCS modes have their logic determined given the availability of the suction sources, electric power, component cooling water, ERCW, and ESFAS.
| |
| A.9.3.1.1.2 CVCS. The following boundary conditions apply to the CVCS only:
| |
| o Charging pump injection to the reactor coolant pump seal line does not affect ECCS cperation due to the low overall flow A.9-35
| |
| | |
| W capacity of this line. Each reactor-coolant pump requires 8 gpa for seal injection. _ Of this flow,-a major portion is diverted to the reactor coolant system by the pump seals while the remainder serves to cool the seals. Therefore,
| |
| .little charging pump flow is prevented from reaching the RCS.
| |
| e' . Flow through the CVCS miniflow lines has no effect on safety
| |
| _ for system operation for the injection or recirculation modes.
| |
| 4 s e . Flow through the BIT recirculation path during ECCS operation does not affect ECCS availability as there are air-operated valves which close upon an SI signal to provide isolation of the recirculation path. If these valves fail, there are -
| |
| check valves to provide alternative isolation. These valve combinations quantitatively contribute insignificant 1y to unavailability and therefore are not explicitly modeled.
| |
| - A.9.3.1.1.3 SI system. ~ The following boundary. condition applies to the SI system only: flow through the SI system miniflow lines will not affect ECCS operation during the injection' or recirculation modes, but slightly degraded
| |
| ; flow will result.
| |
| ;A.9.3.1.1.4 RHR System. The .following boundary conditions apply to the RHR
| |
| . system only:
| |
| e e Flow through the RHR miniflow lines will not affect ECCS operation during the injection or recirculation modes. Thi s 1 flow is required for the small and medium LOCA and transient scenarios.
| |
| : e. The heat exchangers are required to perform their heat transfer function only during the recirculation phase of ,
| |
| accident recovery. ' For injection, the heat exchangers only provide a flow path. In general, since most heat exchanger J failures are ruptures of the tubes, this unavailability value is utilized for both failure modes.
| |
| e During low pressure injection, the flow path is through the heat exchangers; however, if the valve on the bypass line were to fail by transferring open, it would not constitute a failure since heat exchanger operability is not required for success.
| |
| - A.9.3.1.2 ' Interface with the overall safety model. The ECCS function models provide direct input to the event sequence models of each initiating event. This classifies the ECCS as a " main line" system providing direct.
| |
| accident mitigation functions. .
| |
| The ECCS models also interface directly with the auxiliary model. The auxiliary model provides direct support function input to the ECCS (main A.9-36
| |
| | |
| "y. -
| |
| r
| |
| ?
| |
| ) I line systems) models. Therefore, the auxiliary model provides accident mitigation indirectly through the ECCS models. The auxiliary support
| |
| . dependencies are shown in Table A.9-7.
| |
| The irdividual ECCS function models also interace with each other to account for dependencies among functions as explained in the boundary conditions of '
| |
| Section A.9.3.1.1. - The function model dependencies are shown in Table A.9-8.
| |
| A.9.3.2 G0 Mo'dels. There are 10 GO models developed for the 8 ECCS functions needed to satisfy all the top event definitions as shown in Table A.9-8. This means there are two versions of the bleed and feed, CLRHR, and LPR models. For
| |
| -all other ECCS functions, only one model was necessary to satisfy all top event definitions. The initial conditions, modeling criteria, sequence, trainwise dependencies, and the ESDs in which they appear are also given in Table A.9-8.
| |
| All . support systems dependencies are shown at the top of each figure for each
| |
| : model or supertype.
| |
| A.9.3.2.1 High pressure injection model. The HPI model is shown in Figure 4.9-3. This model consists of the CVCS pumps and injection paths (ST1930 and ST1931) along with the SI pumps and injection paths (ST1920 and
| |
| .ST1911).- The model is designed to provide the appropriate success logic for
| |
| -small LOCA and medium LOCA requirements. This is possible because the subsystem responses (CVCS and SI) are the same for both cases. Only the i combining of subsystem success criteria is altered as shown (refer to Figure A.9-3). The pump maintenance unavailability is modeled using a
| |
| : l. type 4 operator which produces output to all four HPI pumps. This operator allows maintenance unavailability to be contributed to only one pump at a time as shown in the type 4 data of Table A.9-9.
| |
| For the high pressure pumps, only combinations of one pump being unavailable are modeled which precludes the possibility of both pumps of the same train j' .being unavailable at the same time. The probability of this state is
| |
| ( -negligible due to the 72-hour technical specification limitation. However, the low pressure (RHR) pumps are modeled separately which does allow
| |
| [
| |
| combinations of low and high pressure pump maintenance. Although some of these combinations (specifically, train A with train B) are not allowed, this'is done for modeling convenience and the error is on the conservative side and judged to be insignificant.
| |
| j .A 9-37 L-l L
| |
| | |
| 1
| |
| - ~
| |
| ^
| |
| _ l b Table A.9-7 AUXILIARY SUPPORT DEPENDENCIES Auxiliary Support input 480V Containment 6.9kV Shutdown CCS ERCW .ESFAS ~ 120V AC Vital Control ECCS Model 480V Reactor MOV Boards Boards . Water Water SI Recirculation Instrument Power Air (Function) B dn Bo s 1Al-A 1B1 1Al-A 18-8 A 8 1A 18 A B .A B- 1-1 1-1
| |
| ,p 1Al-A 181-8 1A2-A 182-8 e -X X X X X y HP1 X- .X X ? X X- X X X X X X X- X Bleed and Feed X X HPR X X X X- X X X X- X X X X X X LPI X X' -X X X X CLRHR X X X X .X X X X X X X X X X X X X LPR X X X X X X X X X X X X X X X 'X X X X X X LPHLR Note: Accumulators do not require any auxiliary support to function.
| |
| s
| |
| - . . -visimumsemam.--s-,.- - -
| |
| | |
| f Table A.9-8 ECCS FUNCTION MODEL DEPENDEhCIES ECCS Function Model Sequence Dependency - Trainwise Dependency HPI .
| |
| Start and Run 1 Hour (6 hours)a .. __
| |
| Bleed and Feed 1 Start and Run 6 Hours - --
| |
| Bleed and Feed 2 Continue to Run 6 Hours Given Success of HPI CVCS, SI HPR RHR Start and Run 23 Hours .. -- --
| |
| $1 and CVCS Must Continue to Run 23 Hours Given Success of HPI, Bleed and Feed 1 CVCS, SI
| |
| .> LPI Start and Run 1 Hour or Bleed and Feed 2 -
| |
| CLRHR 1- Start and Run 23 Hours -- --
| |
| ? CLRHR 2 Continue to Run 23 Hours Given Success of HPR or LPI RHR g LPR Continue to Run 23 Hours Given Success of LPI or CLRHR 1 RHR LPHLR Valves Must Change Position Given Success of LPR --
| |
| Accumulators -- -- --
| |
| ESD ECCS Function Models Used 1 LPI, LPR, LPHLR, Accumulators 2 HPI, LPI, LPR .
| |
| 3 HPI Bleed and Feed 2, HPR, LPI, CLRHR1, CLRHR2, LPR 4, 11, 12 HPI, Bleed and Feed 2. HPR, CLRHR 1 5, 6, 7, 8, 9, 10, 13 Bleed and Feed 1. HPR 14 HPI, Bleed and Feed 1. HPR aIf containment spray does not drain the RWST, the HPI mission time is 6 hours.
| |
| | |
| w (006I IS) tapoW IdH *E-6*V a. ins u SHIVd NOi13m OL D310103 IS SHIVJ WL $ 10C Shive we g 00e
| |
| , Os v301NnlO3M
| |
| $dH COC Oc S nd is -
| |
| SdRndE/C 400- LOC 8>- 164 OL 0664 1S 8>= ML SdnndZ/t g ODE
| |
| =
| |
| mtttt wi ici =6 .t4mt t t.
| |
| SHIVd NOI133rNt - C3 y
| |
| 08 0310103 mas a
| |
| SH1VJ 9/L $ LOC. '
| |
| LCSL 15 y
| |
| 01 04 SHIVE WE y 00E V = t-1CL t
| |
| OCA t.
| |
| Ett t
| |
| LLL ~
| |
| : 0. ' S ndS3A3 e>- Sit V30111vnS g ,, MMT N' OESS 15 -
| |
| ida iOc S ndm g 0. . .- in
| |
| .-On
| |
| = -t.t t t t t-t t- -
| |
| .8 4 ict Oct m => m m 161 ML tli . Slt.
| |
| l ttt s CEt 1Et =t ' Ett Ltt 191 09L SSL .8L -
| |
| t- t t: -t2 Y .. . V .t. t- t , t- -t Y Ym t.
| |
| . .t V ivt
| |
| ,S m3 . vi .. . YL - .
| |
| . NIVM1 - 1VNDtS NO1133rNI OUVOS OWWOS AOst A18100VltVAVNn - W30V3H SW3Sn W3H10 23h3 W31VM S33 A13dVSSVdS3 = . NmOO1nHS Att WO13v3s Acet 33NVN31NtVn dsend c..
| |
| .F
| |
| ; 'f i;;9. ' , ,
| |
| | |
| ~
| |
| '+ .
| |
| .o Table A.9-9a
| |
| 'HIGH PRESSURE'PUW MAINTENANCE UNAVAILABILITY OPERATOR -
| |
| Statea Unavailability Description SI Pump A' SI Pump B. CVCS Pump A. CVCS Pump B 0 0 0 1- 5.16-3 CVCS Pump B Unavailable
| |
| '0 0 1 0 '5.16-3 CVCS Pump A Unavailable 0 0 1 5.16-3 SI Pump B Unavailable 1 0 0 0 5.16-3 SI Pump A Unavailable 0 0 0 0 .9735- All Pumps Available Note: Exponential notation is indicated in abbreviated form;.i.e., 5.16-3 = .5.16 x 10-3,
| |
| [
| |
| . a0 = Available; 1 = Unavailable b -
| |
| Table A.9-9b LOW PRESSURE PUMP MAINTENANCE UNAVAILABILITY OPERATOR Statea
| |
| , Unavailability Description RHR Pump A RHR Pump B 0 1 3.8-4 RHR Pump B Unavailable 1 0 3.8-4 RHR Pump A Unavailable 0 0 .99924 Both Pumps Available Note: Exponential notation is indicated in abbreviated form; i.e.,-3.8-4 = 3.8 x 10-4 a0 = Available; 1 = Unavailable
| |
| | |
| Figures A.9-4 through A.9-7 represent supertypes 1930, 1931, 1910, and 1920, respectively. Table A.9-10 shows the type-kind data that represent the unavailability contribution of each components failure mode (s) represented in the model. Since the inspection interval for correct valve position is 7 days, a mean time between inspection for discovery that a valve has transferred open/close is 3-1/2 days (84 hours). This represents the unavailability of valves due to incorrect position. The mission time of 1 hour for these valves is negligible compared to the 84-hour period. The boron injection tank is under surveillance during every shift and any failures would be alarmed and would require plant shutdown. Thus, the tank's mission time is only 1 hour. The pumps' unavailability is failure to start on demand and run for 1 hour plus the maintenance contribution discussed in the previous paragraph. Several closed MOVs are required to open on demand along with the two air-operated valves that control ERCW to the SI pump oil coolers. Room coolers are not required for injection success due to the short mission time of 1 hour. -
| |
| If the containment spray pumps did not drain the RWST, HP1 would require a longer mission time (6 hours) in order to fill the sump for recirculation.
| |
| In the event sequences for which this occurs, an additional operation is added to the HP1 model to account for the additional 5-hour operation of the HPI pumps given that HP1 is successful for 1 hour. This modeling assumption precludes the possibility of valve failure during this additional 5-hour period. However, pump failure dominates the contribution of unavailability during this 5-hour period and the valve contribution is negligible.
| |
| A.9.3.2.2 Bleed and feed model. The bleed and feed function is modeled for two types of event sequences shown in Figure A.9-8. Where bleed and feed appears alone in an event sequence, the system must start and run for 6 hours; this is modeled in Figures A.9-9 through A.9-13 and designated BF1. Where bleed and feed appears after an HPI top event, bleed and feed must continue to run for 6 hours given that HP1 was successful. This model is shown in Figures A.9-14 through A.9-18 and designated BF2. BF1 and BF2 both use 1/4 pumps and 1/4 injection paths success criteria with a mission time of 6 hours. The mission time is conservative because the containment spray system may drain the RWST in which case the mission time would be less than 1 hour.
| |
| A.9-42
| |
| | |
| ..P ' " ' ' - -...:"""
| |
| (0E61 IS) tapoW IdH aof tua2sisqnS S3A3 *t-6'V aanStj omi as W 31003180 dand W 310C31v38lv3tNVM39m vtSt-te vtot 19 v50t-te WEBC-te ytte ytte vent vtOf vt95 AD AS AD AD AD AD AD ' AD AD Mt CDC 6 E005 M4 tatt CN 4 COC t COC t EM S M1 NL SCL LES CS SES-te y vt 303-33 AD A3 . duend 33 q, AD E8'E9 El ill A31 COC 4 E00t 9006 04 CDC 4 tot-t et LOC OS 909 29 UCA" N 526 A3 133dM3d 20C 8 8 41 f*)
| |
| SCB CS Y III 00t 2 St9 C9 AD Etl CS A3 8 88 dand 33 01929 AD A31 [ .
| |
| LOC 8 04 <
| |
| COCL COCS 90s & 04 EOCl trt til 8994 19 StGE-19 990t-19 Sted 49 III 980s Sitt SC95 Siet 5296 AD AD AQ AD ggg , AD AD AD AD AD LSL COC-1 CCC L C001 E004 COC & COC L E008 COC & CK R 851 b d1003110 dand u 31003143$ lv3NvH3Bn M31003 W31003 W31003 u31003 v31003 us1003 lv38 lv35 150 180 160 140 "I II I"O 9dand vdand 3dnnd y drsqd e duend yannd 8dand vdand gennd vdand A31 A31 til $d4 AS4 SSE 494 054 ega OEL LZ4 K4 R&L Lil LC8 Ott t
| |
| t v ..
| |
| i f vi t
| |
| t
| |
| : v. .t, t v.
| |
| t t
| |
| Y,.
| |
| t t
| |
| v-iv. .t.i m t
| |
| AIM 48W1tvAvNA Nfvg1 M3Ov3H SW 3Sn 33Ov3H1u]Sn OWTOS - Osv00AOn 1vesDr$ NOs133rms 330sv431Niva degnd W 31vm 333 g3M1080W3 MBH108043 OsmOQinMS A4 9 WO13v3M A000 A13dv5 Sv.853 I
| |
| .f q.; -
| |
| *i
| |
| | |
| F S+ . ,
| |
| L L
| |
| .j, 9 P
| |
| ' 400V REACTOR ESFAS SAFETY MOV90ARD lNJECT60N SIGNAL 1 Al-A 1814 A B 111 ' 112 130 131 FCV FCV FCV FCV D30 6240 63-39 6240 FCV FCV FCV FCV G25 . G26 63-25 63 26 112 131 112 130
| |
| /
| |
| 6>$82 CV 10 1001 10 1-301 0 506 .l FCV FCV y $240 6>m ,,,,, , .x , n at
| |
| .w @
| |
| 2 0
| |
| 2 ,
| |
| . PERFECT , M 200 INITIATOR I I# (fp n5e4 Cv 1401 1401 N
| |
| 10 10 -
| |
| FCV / FCV 111 130 6339 111 131 6325 yg ,g 6>585 CV 6>see ST 1931 Figure A.9-5. CVCS Injection Paths for HPI Model (ST 1931).
| |
| | |
| e 0.9kV SHUTDOWN ESFAS SAFETY ERCW OTHER CCS WATER PUMP MAINTENANCE BOARD INJECTION $1GNAL USER $ HEADER TRAIN UNAVAILABILITV 1A4 18 4 A 8 1A 18 1A 18 A B
| |
| ' 122 127 110 131 150 151 ISO 100 196 197 PUMP A PUP'S PUMP A PUMPS PUMP A PUMPS PUMP A PUMPS PUMP A PUMP 8
| |
| , OIL OfL SEAL SEAL CDOLER COOLER COOLER COOLER PUMP OIL COOLER MECHANICAL SEAL COOLE R 151 1-305 1003 1 303 1 010 1403 1003 1-303 1403 1403 1403 198 FCV GV GV GV GV I3I GV GV GV GV GV 87 182, 87-7078 . 67,7003 67-7005 874048 127 562B 5808 713B 7128 550s 1r 1-300 10 1410 1002 1403 1400 D FCV SI PUMP CV CV FCV
| |
| * $348 184 63426 G527 G153 2 200 l g 197 l
| |
| 51 5-306 1402
| |
| % PERFECT, INITIATOR GS G510 to N 1 300 to 1-310 1402 1403 1-30s ,
| |
| FCV db Sa PUMP CV GV FCV 8347 126 IM S3 524 G525 G152 f i
| |
| -130 "
| |
| 150 1,305 1J03 1403 1 303 1J03 1J03 1J03 1403 1003 1403 19e FCV GV GV , GV GV GV GV GV GV. GV 87-176 87107A 47-700A 87-700A - 87404A 562A SelM 713A 712A S5GA I
| |
| PUMP OsL COOLER MECMANICAL SEAL COOLER m ST 1910 i
| |
| Figure A.9-6. SI Subsystem for HPI Model (ST 1910) j
| |
| | |
| ._= _ _ - . = _ _ - - . - _ = . .
| |
| 5 w
| |
| 1 300 1302 1 302 GV CV CV 63 556 63-557 63 563 1 308 1302 1 302
| |
| \ GV CV CV 11 m M 201 63 554 63-555 63 562 130J FCV PERFECT.
| |
| 63 22 1 302 1 302 INITIATOR . 1-308 GV -CV CV 63 552 63-553 63-561 1 308 1 302 1 302 GV CV CV 63-550 63-551 63-560 Figure A.9-7. SI Paths for HPI Model (ST 1920)
| |
| A.9-46
| |
| | |
| ==
| |
| Table A.9-10 HIGH PRESSdRE INJECTION FDDEL DATA Component Failure Failure Mode (s) Type-Kind Ratea MTTRb ~ Unavailability Manual Valve Transfer Open/Close During Operation 1-303, 1-308 3.36-8/h 84 2.82-6 Motor-Operated Valve Failure. to Operate on Demand 1-301 4.30-3/d 4.30-3 Transfer Open/Close During Operatien 1-309 1.32-7/h 84 1.11-5
| |
| ( Air-Operated Valve Failure to Operate on Demand 1-305 3.10-3/d 3.40-3 k Check Valve Failure to Operate on Demand 1-302 2.98-4/d 2.98-4 Pump Failure to Start on Demand 1-304, 1-310- 2.12-3/d 2.12-3 Failure to Run 1-304, 1-310 2.62-5/h 1 2.62-5 Boron Injection Tank Rupture During Operation 1-306 2.66-8/h 1 2.66-8 Pump Maintenance Out of Service 4-320 1.26-4/h 41 5.16-3 Note: Exponential notation is indicated in abbreviated forw; f.e., 3.36-8 = 3.36 x 10-8 ah = hour; d = demand.
| |
| b MTTR = mean time to repair or mean time between inspections or mission time.
| |
| | |
| ~
| |
| 1 l
| |
| l l
| |
| v LED AND ST 1901 201 > ST 1905 200 > E i 1
| |
| BLEED AND FEED MUST START AND RUN 6 HOURS.
| |
| BLE D AND ST 1902 201 > ST 1eos 200 >
| |
| BLEED AND FEED MUST CONTINUE TO RUN 6 HOURS.
| |
| Figure A.9-8. Bleed and Feed Models fN A.9-48
| |
| | |
| e 1
| |
| l 1
| |
| 48ov REACTOR - > 6.9kV SHUTDOWN CCS WATER ERCW OTHEr, PUMP MAINTENANCE i MOVBOARD BOARD TRAIN USERS HEADER UNAVAILABILITY 1A14 1814 1A A 18-8 1A 1B 1A IS CVCS SI
| |
| .k .
| |
| ill I
| |
| 112 I
| |
| 126 I
| |
| 127.
| |
| 'I ISS I
| |
| ISO I
| |
| 150 I
| |
| 151 hI h$
| |
| 175 173 196 197 111 112 126 127 198 190 1II4 44 to 1so -+
| |
| - 151 -
| |
| * ST 1932 mo % in RUMPS 10 A 2 2o, - g,,
| |
| lI!O Cvc5 PUMPS l
| |
| 4o M
| |
| t 111 112 4 A a 5""'
| |
| 2oi s ,ATHS CVCS COLD LEG 30
| |
| ' 1NJECTION PATHS 150 151 198 199 126 127 1444 44 i96 -+ aco E in PUMPS
| |
| . ST 1911
| |
| . 97
| |
| - SIPUMPS .
| |
| 1 201 k 1/4 PATHS l.
| |
| SI COLD LEG INJECTION PATHS ST 1901 Figure A.9-9. High Pressure Subsystem of Bleed and Feed 1 Model (ST 1901)
| |
| ,r-s k
| |
| f 4
| |
| A.9-49
| |
| | |
| .~ - - - - - - . . . . -
| |
| h cc 400v RE ACTOR 6.9kV SHUTDOWN ERCW OTHER CC5 WATER PUMP MAINTENANCE
| |
| . MOVBOARD BOARD USERS HEADER TRAIN UNAVAILABILITY .
| |
| 1Al A 1815 1A-A lb 8 1A 18 1A IS 1 A-A 18 8
| |
| '126 127 150 151 . 195 180 175 173 111 112 PUMP A . PUMP 3 PUMP A PUMP 3 ' - PUMP A PUMP 3 PUMP A PUMPS-LCV LCV
| |
| . OIL OIL . SEAL SEAL 62 135 62-136 COOLER . COOLER COOLER COOLER MECHANICAL SE AL COOLE R ' PUMP OIL COOLER 1-703 1-703 1-703 1703 151 198 1703 1703 1703 1-703 1-703 127 gy . gy gy gy GV ' GV GV GV . GV 5528 7078 7098 SM?B 5678 67-7648 67-7058 67-7048 67-7658 112 ,,
| |
| 1-703 10 1-704 1-702 1-703 GV CC PUMP - CV GV e LCV 62 510 18 8 62-532 62-533 2 200 e I73 trl 62 136 O :
| |
| i 51 ,2 1-702 CV 975 PERFECT 62504 INITIATOR 1-703 10 1704 1 702 1-703 LCV 111 / 62 135 GV ''
| |
| CC PUMP CV GV 62-527 62-509 1A A 62-525 126 ,
| |
| 1-703 1-703 1-703 1703 1-703 150 198 1-703 1-703 1-703 1-703 2 GV GV GV GV' GV GV GV GV GV 552A 707A 700A 553A 557A 67-766A 67-705A 67 7u4A 67-767A MECH ANICAL SE AL COOLE R PUMP OIL COOLE R ST 1932 Figure A.9-10. CVCS Subsystem for Bleed and Feed 1 Model (ST 1932)
| |
| | |
| n . x 4
| |
| i 'r ,.
| |
| 1 4e0V REACTOR - '
| |
| MOVAOARD i 1A14 1814 .
| |
| I 111 112 ,
| |
| FCV FCv suo suo FCV FW G25 G2s 112 1 708 1-702 112 assa Cv 10 1-701 10 1-701 Ones FCV FCV M O 26 I 1 708 702
| |
| > 8Y8 i
| |
| (' '
| |
| [T '
| |
| TR 1708 1-702 4
| |
| suas Cv 10 1 701 10 1-701 til 111 2s g,yg ,,yg u ses Cv osse .
| |
| ST 1933 Figure A.9-11. CVCS Injection Paths for Bleed and Feed.1 Model (ST 1933)
| |
| - _ _ - - - - J
| |
| | |
| l 1
| |
| c1 )
| |
| i f
| |
| 1 R
| |
| ! a g
| |
| O
| |
| =
| |
| 5-a e
| |
| ~
| |
| >m og 8 E
| |
| >sa5 CE m
| |
| 9 1E
| |
| . _-=
| |
| -+e m
| |
| 5 Ia :e
| |
| -o s a as
| |
| -o m
| |
| 5 t;
| |
| 3 g gg gg 2 g ,g 3 -
| |
| E3 5 2 on 5 as 5
| |
| g!5 4_,3 I' !
| |
| 5
| |
| /@
| |
| \- B02
| |
| @ 80t 5 E
| |
| -l -
| |
| i e al a 3g s E
| |
| E Bj d' aa!(EBl ~
| |
| ~
| |
| as = >s v 2 os g
| |
| . :-*sggg
| |
| : 5. ,.
| |
| 4 .-
| |
| II E $. 1
| |
| =
| |
| EE E I-*sgll -
| |
| 8 s a 8
| |
| !$ E n R $
| |
| -s 5)!]
| |
| I~ gi ~
| |
| R
| |
| .s -
| |
| < .a
| |
| !!e-*Egsg Esl 9 si a
| |
| a ,, - -
| |
| 8:= I4 w -a vs E 8Ed e 6@ 8 -
| |
| a >l .
| |
| = ,3 2 * . E s. y
| |
| . 5 g g.
| |
| - " m E
| |
| * I-*E g
| |
| - be s, >l ..
| |
| 3
| |
| .fo- o
| |
| " e f,
| |
| $. 0 e
| |
| - $. 0..
| |
| O s 39 2 -i s B:
| |
| 2 -s
| |
| -().
| |
| . E !
| |
| A.9-52 a
| |
| | |
| a, 1-708 1702 1-702 GV CV CV 63-556 63-557 63 563 1 708 1 702 1 702 GV CV CV 11 201 5-1 1 709 63-554 63 555 63-562 1 PERFECT FCV 63 22 INITIATOR ,1 708 1-702 1 702 GV CV CV 63 552 63 553 63 561 1 708 j702 1 702 Gv Cv Cv 63-550 63-551 63-560 ST 1921 I
| |
| Figure A.9-13. SI Paths for Bleed and Feed 1 Model (ST 1921)
| |
| A.9-53
| |
| | |
| ~. . . .- . = , -
| |
| - l l
| |
| 6.9kV SHUTDOWN CCS WATER ERCW OTHER BOARD TRAIN USERS HEADER 1A A .154 1A 18 1A 13 I 1M 127 198 190 150 151 126 127 tot 19e to h
| |
| ST 1934 to #1 : HP1 -
| |
| 151 %
| |
| . CVG PUMPS 40 50 201 k 1/4 PATHS CVCS COLD LEG 80 INJECTION PATHS
| |
| , 150 151 100 199 126 127 I444 44 STig12
| |
| 'aa "+'"'u"'S StPUMPS 201 k 1/4 PATHS SI COLD LEG INJECT 10N PATHS T 1902 Figure A.9-14. .High Pressure Subsystem of Bleed and Feed 2 Model (ST1902) i' 1
| |
| A.9-54 i
| |
| .~. - , - ~ . - - , . . - - - - -.. . , _ . , - ,. , , . ,-, , - - , , - -
| |
| | |
| 6 9kV SHUTDOWN ERCW OTHER CCS WATER -
| |
| BOARD USER $ HEADER TRAIN 1A A 18 8 1A la IA 18 126 127 150 '151 198 190 PUMP A PUMPS PUMP A PUMPS PUMP A PUMPB OIL OIL SEAL SEAL COOLER COOLER COOLER - COOLER MECHANICAL SE AL COOLE R PUMP OIL COOLE R 199 1403 1 803 1403 1403 1403 1 803 1403 1403 1 803 151 GV GV GV GV GV 127 GV GV GV GV 5529 7078 7098 5538 5578 67-7648 67 7058 . 67-7048 67-765B 1P 1 803 10 1 804 1-802 1 803 1-809 GV CC PUMP CV GV LCV 62 510 18 8 62 532 62-533 2 200 y 62 136 51 2 1802 u,
| |
| U1 PERFECT CV INITIATOR 62 504 1 803 10 1 804 1402 1403
| |
| ~2 LCV 62 135 GV 'b CC PUMP CV GV 62-509 1A A 62 525 62 527 126 198 1803 1403 1 803 1 803 1403 1803 1-803 1 803 1403 150 GV GV GV GV GV GV GV GV GV 552A 707A 709A 553A 557A 67-786A 67-705A 67-704A 67-767A M ECHANICAL SE AL COOLE R PUMP Oil COOLE R ST 1934 Figure A.9-15. CVCS Subsystem for Bleed and Feed 2 Model-(ST 1934)
| |
| | |
| E~
| |
| 1-808 1-802 63-582 CV 1409 1-809 OE FCV FCV 6340 63-26 1 808 1-802 (f) p PERFECT 1 1408 1-802
| |
| * INITIATOR 63 584 CV 1409 N 1409 1408 1-802 63-585 CV 63-589 ST 1935 Figure A.9-16. CVCS Injection Paths For Bleed and Feed 2 Model (ST 1935)
| |
| | |
| p_ w 6.9kV SHUTDOWN ERCW OTHER . CCS WATER BOARD USERS HE AOER TRAIN 1A A 18-8 1A 18 1A 18 -
| |
| 126 127 150 151 198 100 PUMP A 'PUMPB PUMP A PUMPB PUMP A PUMP B OIL ' OIL SEAL SEAL COOLER COOLER. COOLER COOLER PUMP Oil COOLER MECHANICAL SEAL COOLE R 1 803 1403 1-803 1 803 1-803 1 803 188 151 1805 1 803 1 803 1 803 FCV GV GV GV GV GV GV GV GV GV 67-182 67-7078 67-7088 67-7098 674048 127 5628 5608 7138 7128 5688 1409 10 1 810 1402 1803 1409 FCV St PUMP 'CV CV FCV 33 61153 2 200
| |
| * 6348 18-8 63426 6SS27 U1 N 51 1809 1402 PERFECT INITIATOR OS 510 1809 10 1-810 1 802 1803 1 809 FCV SI PUMP CV GV FCV 6347 126 1A A 63 524 6}525 61152 150 1805 1403 1403 1403 16,4 1403 1 803 1 803 1403 1403 ISS FCV GV GV GV GV GV GV GV GV GV 67176 67-707A 67-708A 67-709A 67404A 562A 580A 713A 712A 550A PUMP OIL COOLER ST 1912 MECHANICAL SEAL COOLE R Figure A.9-17. SI Subsystem for Bleed and Feed 2 Model (ST 1912)
| |
| | |
| 1408 1 802 1402 GV CV CV 63-556 63-557 63 563 1408 1-802 1402 GV CV CV 11 201 63 554 63-555 63-562 5 1409
| |
| /-1 PERFECT
| |
| \
| |
| fV 22 INITIATOR 1408 1402 1 802 GV- CV CV 63 552 63-553 63-561 1408 1-802 1402 GV CV CV 63-550 63-551 63-560 ST 1922 Figure A.9-18. SI Paths for Bleed and Feed 2 Model (ST 1922)
| |
| A.9-58 1
| |
| ,r - -
| |
| --e --. - , , - - - e
| |
| | |
| .z .-
| |
| The bleed and feed models consist of the same structure of the HPI model for small LOCA with the additional mission time and PORY model (see Figure A.9-19). The PORV models of supertypes 1905 and 1906 are exactly the same_(see Figure A.9-20). Both POR\ s are air-operated valves that fail closed upon loss of control air or 120V AC power. Both control air and 120V AC power are required for successful operation. The difference between the BF1 and BF2 models is in the co:nponent failure modes and associated data as shown in Tables A.9-11 and A.9-12. BF1 includes M0V failure to open on demand'and pump failure to start modes where the BF2 model is given these functions'are successful in HPI.
| |
| A.9.3.2.3 High pressure recirculation model. The HPR model consists of both low pressure and high pressure-subsystems shown in Figure A.9-21. The RHR pumps take suction from the sump and discharge to the intake of the CYCS and SI pump trains (ST 1950). The CYCS pumps (ST 1960) and SI pumps JST 1970) supply high pressure flow to the RCS cold legs. Supertype 1960 includes the CVCS injection paths where the S1 injection paths are in supertype 1910.
| |
| The HPR function requires 23 hours of recirculation given that the HPI or bleed and feed functions are successful. Since the bleed and feed mission time is 6-bours and the HPI mission time is 1 hour or 6 hours, the HPR mission time is 18 hours. For these sequences where HPR follow an HPI function of 1 hour, an extra operator is added to account for the extra
| |
| - 5 hours of running time of the high pressure pumps." This is handled in the same way in th'e HP1 model previously discussed. The low pressure RHR pump trains, Figure A.9-22, are required to start and run along with the successful switchover the sump recirculation. The mission time of the RHR pumps is 24 hours becase the pumps start at the beginniag of the sequence and must run on miniflow (pump recirculation) until they are required for HPR. _ The high pressure sections of HPR are shown in Figures A.9-23 through A.9-25.
| |
| The data used in the HPR model are shown in Table A.9-13. The data used for the RHR system (ST 1950) are different than that of the high pressure sections (ST 1960 and 1970) because the high pressure sections are dependent upon successful HP1 or bleed and feed whereas the RHR system is not.
| |
| A.9-59
| |
| | |
| 1 i
| |
| t.
| |
| FCV PCV 68-333 68-334 Sa VM l FC
| |
| .i ,
| |
| * ; PR R ER PRESSURIZER 332 pE g A
| |
| " S, FC Figure A.9-19. ~PORY Configuration-i 4
| |
| e r-k A.9-60 i'
| |
| y.
| |
| | |
| CONTROL AIR SUPPLY 120V AC VITAL INSTRUMENT POWER BOARD
| |
| *' h 1-l 1-11 145 174 176 145 i,
| |
| ~
| |
| 1-709 10 1-705 FCV PCV IM 68-333 68 334 200 g
| |
| ' 1709 10 1-105
| |
| 'b FCV PCV E 332 145 68-340A I##
| |
| ST 1905 176 145 1r 1409 to 1-811 FCV PCV 100 68-333 68-334 10 :
| |
| ;. 1409 10 1811 FCV PCV 68-332 145 68 340A 174 ST 1906 Figure A.9-20. PORV Models for Bleed and Feed 1 and 2 Models (STs 1905 and 1906)
| |
| A.9-61
| |
| | |
| 480VCONTAINMENT AND 6.9 kV SHUTDOWN 480V REACTOR ' CCS WATER ERCW OTHE R ESF AS $1GNAL AUXILIARY BUILDING BOARDS MOV 80ARDS - TRAIN . USE RS HEADER RECIRCULATION BOARD #
| |
| 1 A-A 18 8 1 A l-A 181-B 1 A2 A 182 8 '1 A 1B 1A 18 A 8 1A14 181-B h h h -h h h h 'h h h h '
| |
| 126 127- 111 112 - 113 114- 198 199 ~ 150 151 161 162 140 141
| |
| ' 140 141 126 127 150 151 198 199 h hhh hh W 100 ST 1960 200 j 126 122 111 112 113 114 198 199 CVCS PUMP TRAINS 3*
| |
| g 4 g g g g g -4 AND COLD LEG
| |
| * 140
| |
| * INJECTION PATHS e
| |
| i i-. 200 4
| |
| rg 150-+
| |
| HIGH PRESSURE -
| |
| ST i9S0 2 151 --* .
| |
| RECtRCULATION 161 - 9 201 140 141 126 127 150 151 198 199 RHR PUMP TRAINS 4'4 g g 4 gg4
| |
| -~~D 100 ST 1970 200 W 100 ST 1910 200 St PUMP TRAINS COLD LEG INJECTION PATHS -
| |
| Figure A.9-21. High Pressure Recirculation Model (ST 1500) i
| |
| | |
| - . - .. . . x - - . m- . . . - < , * - ,
| |
| '} .?
| |
| 400V CONTAINetENT . . -
| |
| AND AUXILIARY S$kVSHUTDOWN ERCW OTHER . ' CC5 WATER , ESF AS SAFETY tNJECTION -
| |
| ' 400V REACTOR hCV SOARD SulLDING BOARD BOARD USER $ HEADER TRANd RECIRCULATION 51GNA.
| |
| 1A1 A 1814 - 1A2-A 1924 ,1A1 A 181 4 - 1A-4 18 0 1A I 14 19 A e 111 d'.'h 112
| |
| 'h 113 h
| |
| 114 I'
| |
| : 140 h.
| |
| 141 .
| |
| ~h 138
| |
| 'h
| |
| - 127 h
| |
| 150 .
| |
| ' 18h 151 h
| |
| Its h.
| |
| 19e h
| |
| . tot
| |
| ~h
| |
| . se2 FCV FCV FCV FCV FAN A -FANO PURAP A PuedP S ROOne . ROOes . Pumar A . PuesP 3 pgy FCV G72 ' 03 73 76158 10153 ' COOtER COOLER. SEAL SEAL g372 n?2 834 G11 A- 3 COOLER COOLER - ,
| |
| , HX A HK3 AIECHANoCAL SEAL COMPONENY COOLING WATE R "
| |
| ROOne COOLER COOLER TO RHR HEAT EXCHANGER m 141 10 1 1510 1 1907 1-1512 6-1512 1 1512 1-1512 tee , 1-1512 1 1512 1-1500 13e FAN 8 ' FCV GV GV GV GV BV BV FCV III
| |
| $7-190 674088 74 5648 74 5003 745675 5458 Sees' 70153 .
| |
| III '
| |
| It4 112 16 -
| |
| 10 1 1501 . 10 1-153D 1-1519 1 1512 1-1512 10 1 1560 10 4 1501 ; 2 201 112 M FCV ' RHR CV GV GV ' HEAT FCV db
| |
| * - g3 73 ' 74 515 74 525 74 521 EXCHANGER ' S3 3I ..
| |
| . Puns.P i.- .
| |
| m ir El 41575 2 1-1512 2 PERFECT PUteP $
| |
| GV INITIATOR RAAINTENANCE S3 531 tr 10 1-1501 10 1 1530 1-1519 1 1512 1-1512 to 1-1560 t to 1 1501
| |
| : 3. ni sii 0(2 200 FCV G172 RHR CV GV GV HEAT FCV
| |
| '111 161 PUesp 74 514 74520 74 52411 EXCHANGER III 634 140 126 1A A ' A 10 1 1510 1 1507 1 1512 1-1512 1-1512 11512 1st 1-1512 11512 l 1501 138 150 F AN A FCV GV GV - GV GV BV SV FCV
| |
| $7-138 6740EA 74-bG4A 74 508A 74567A 545A . 54GA 76154 ROOR4 COOLER teECHANICAL SEAL COesPONENT COOLING WATE R COOLE R TO RHR HEAT EXCHANGER SUPERTYPE 1950 Figure A.9-22. RHR Subsystem For hPR Model (ST 1950)
| |
| | |
| '',t,, ^
| |
| .. N A.I e +
| |
| 480VCONTAtletBENT AND AUXtLIARY eutt OING $9kVSMUTOOWee E RCW OTHE R . CC$ WATER SOARD BOARD . USE R$ HE ADE R TRAIN 1Al A ISI B lA A 18 8 " 1A IS 1A . 18 140 141 . 126 127 150 .~ 151 let . ISS
| |
| ' F AN A FANO PUMP A PuesP S ROOld ROOAS ' PUMP A PuesP S COOLER A COOLE R S SEAL $EAL OIL COOLER 01 COO ER 151 O COOL R GV GV GV FCV , FAN 8.. GV GV GV GV
| |
| $74025 674018 874003 67 170 ' 67-7838 87 7058 87 7040 , 677678 I 1902 I M02 1 202 1-1502 1-1902 198 3 1502 1 1520 asECHMOL SE AL COOLE R GV GV GV GV GV GV CV .
| |
| tet 127
| |
| $228 7078 7000 6F38 . 5578 63582 63588 1 1502 10 I 1540 1 1520 1 1502 1 1503 1 1903 1 1502 t 1520 ,
| |
| GV CC PuesP CV GW FCV FCV GV CV 82 510 IS S 82 532 62 533 6338 6325 63543 63507 -
| |
| 50 0
| |
| Ch 200 A 2 2 1 ISOS 2 1 1520 ft 100 - t set CV .1
| |
| .3 =i
| |
| : 1. .. 5 0 1. 20 . to i im i tm i n02 1 n20 GV CC PUMP . CV GW FCV FCV GV CV
| |
| $2 508 1A A S2 525 42 527 4340 8326 63 534 63 5e8
| |
| .0 in 1 1502 198 1 M02 1 1520 GV GV GV GV' GV GV CV 552A 707A 70BA 553A 547A $3 505 63 589
| |
| " %'iER GV GV GV FCV FAN A GV GV GV GV
| |
| .7.nA 7 0iA 7 00A 7= .7 7 A .7 =A .7 70.A .7 37A SUPERTYPE 1900 Figure A.9-23. CVCS Subsystem for HPR Model (ST 1960)
| |
| | |
| '1
| |
| - 1
| |
| ; . t.
| |
| I 480V CONTAINMENT AND AUXILIARY SUILDING 6.9kV SHUTDOWN ERCW OTHER CCS WATE R 80ARD BOARD. USE RS HEADER TRAIN 1Al-A 181-8 ~ 1 A-A 18 8 1A 18 1A 18 140 141 126 127 150 151 - 198 199 F AN A FAN 8 PUMP A PUMP 8 ROOM ROOM PUMP A PUMP 8 COOLER A COOLER 8 GEAL SEAL-OIL OIL COOLER . COOLER .
| |
| COOLEh A COOLER D 151 1-1510 1-1507 1-1502 11502 1 1502 11502 1 1502 1-1502 1 1502 1-1502 1-1502 1Cd i
| |
| FAN FCV GV GV GV GV GV - GV GV O' G's 67 182 67 7078 . 67-7088 67-7098 674048 127 5628 5608 7138 . 71 M88 OIL COOLER AND ROOM COOLE R 141 10 1 1570 1 1500 1 1503 1-1520 1 1502 1-1503 1 1503 -
| |
| SI PL'MP CV FCV CV GV FCV- FCV
| |
| [ 18-8 63 530 63-175 63 526 61527 63153 61157 m.
| |
| m, u
| |
| iOO - 2 200 10 1 1570 1 1520 1-1503 1 1520 1 1502 1 1503 1-1503 140 SI PUMP CV FCV CV GV FCV FCV 1A-A 61528 634 63524 63 525 63152 63 156 150 1 1510 1-1507 1-1502 1 1502 1-1502 1-1502 1 1502 1-1502 11'42 1 1502 1 1502 198 FAN FCV GV GV GV GV GV GV GV GV GV 67 176 67-707A 67 708A 67-709A 67-604A 562A 560A 713A 712A 558A OIL COOLER AND ROOM COOLER M;CH ANICAL SEAL COOLER Figure A.9-24. SI Subsystem for HPR Model (ST 1970)
| |
| | |
| l 11502 1 1520 1-1520 GV CV CV 61556 6} 557 63-563 1 1502 1 1520 1 1520 GV CV CV
| |
| '63-554 63-555 63-562
| |
| - 100 1 1503
| |
| )
| |
| FCV 11 200 G22 1 1502 1 1520 1 1520 1 4
| |
| GV CV CV 6} 552 6}553 63-561 1 1502 1 1520 1 1520 GV CV CV 6} 550 63-551 63-560 Figure A.9-25. SI Paths for HPR Model (ST 1910)
| |
| A.9-66
| |
| | |
| y 1
| |
| -)
| |
| Table A.9-11 BLEED AND FEED MODEL DATA - (START AND RUN 6 HOURS).
| |
| , Component MTTRb' Failure Mode (s) , Type-Kind a" Unavailability Marual Valve Transfer Open/Close During Operation 1-703, 1-708 3.36-8/h 84 2.82-6 Motor Operated Valve Failure to Operate on Demand 1-701 4.30-3/d 4.30-3 3 Transfer Open/Close During Operation 1-709 1.32-7/h 84 1.11-5
| |
| ? Air Operated Valve Failure to Operate on Demand 1-705 3.40-3/d 3.40-3 Check Valve Failure to Operate on Demand 1-702 2.98-4/d 2.98-4 ,
| |
| Pump' Failure to Start on Demand 1-704, 1-710 Failure to Run 2.12-3/d 2.12-3 1-704, 1-710 2.62-5/h 6 1.57-4 Boron Injection Tank Rupture During Operation 1-706 2.66-8/h 6 1.62-7 Pump Maintenance Out of Service 4-720 1.26-4/h 41 5.16-3 Note: Exponential notation is indicated in abbreviated form; i.e., 3.36-8 = 3.36 x 10-8, ah = hour; d = demand.
| |
| b MTTR = mean time to repair or mean time between inspections or mission time.
| |
| | |
| t Table A.9-12 BLEED AND FEED MODEL DATA - (CONTINUE TO RUN 6' HOURS)
| |
| F Iu,e Component Failure Mode (s) Type-Kind ge MTTRb .. Unavailability Manual Valve Transfer Open/Close During Operation 1-803, 1-808 3.36-8/h 6 2.02-7 3 Motor-0perated Valve Transfer Open/Close During Operation 1-809 1.32-7/h 6 7.92-7 y Air-Operated Valve Failure to Operate on Demand - 1-811 3.40-3/d cn Transfer Open/Close During Operation 1-805 7.82-7/h 6 4.69-6 co Check Valve Reverse Leakage During Operation 1-802 6.42-7/h 6 3.85-6 Pump Failure to Run 1-804, 1-810 2.62-5/h 6 1.57-4 Boron Injection Tank Rupture During Operation 1-806 2.66-8/h 6 1.62-7 Note: Exponential notation is indicated in abbreviated form; .1.e., 3.36-8 = 3.36 x 10-8
| |
| . ah = hour; d = demand, b
| |
| MTTR = mean time to repair or mean time between inspections or mission time.
| |
| j i
| |
| e e
| |
| | |
| s' ,
| |
| i l
| |
| 1 1
| |
| -)
| |
| Table'A.9-13 HIGH PRESSURE RECIRCULATION MODEL DATA Component -Type-Kind "in' Unavailability Failure Mode (s) e '
| |
| i MTTRb Manual Valve Transfer Open/Close During Operation 1-1502 3.36-8/h 18 6.05-7 Transfer Open/Close During Operation 1-1512 3.36-8/h 108 3.63-6 Motor-Operated Valve Failure to Operate on Demand 1-1501 4.30-3/d 4.30-3 Transfer Open/Close During Operation 1-1503 1.32-7/h 18 2.38-6 Air-Operated Valve Failure to Operate on Demand 1-1507 3.40-3/d 3.40-3 3>
| |
| , Check Valve Failure to Operate on Demand 1-1519 2.98-4/d - 2.98-4 g Reverse Leakage During Operation 1-1520 6.42-7/h 18 1.16-5 Pump Failure to Start on Demand 1-1530 2.12-3/d 2.12-3 Failure to Run 1-1540, 1-1570 2.62-5/h 18 4.72-4 Failure to kan 1-1530 2.62-5/h 24 6.29-4 Boron Injection Tank Rupture During Operation 1-1506 2.66-8/h 18 4.79-7 Heat Exchanger Rupture / Excessive Leakage During Operation 1-1550 6.69-7/h 24 1.61-5 Fan Room Cooler Failure to Start 1-1510' 7.99-4/d 7.99-4 Failure During Operation 1-1510 8.85-6/h 24 2.12-4 Pump Maintenance Out of Service 4-1575 1.82-5/h 21 3.80-4 Note: Exponential notation is indicated in abbreviated form; i.e., 3.36-8 = 3.36 x 10-8, ah = hour; d = demand, b
| |
| MTTR = mean time to repair or mean time between inspections or mission time, li l
| |
| | |
| At the end of the RHR system model (see Figure A.9-22) are valves FCV63-6
| |
| ~
| |
| and FCV63-7. If either one of these valves opens successfully, they allow the RHR pump discharges to be cross-connected to either the SI or CVCS pumps. The procedures direct the operator to open these valves. Since operator error is not included, we assume the procedures are followed. If either of these valves do not open, the discharges of RHR pump A and B only 90 to the intake of the CVCS pumps and SI pumps, respectively.
| |
| 4 Room coolers are required for all pumps during recirculation due to the long missior. time. Room coolers require ERCW along with electric power for fan operation. In some cases, ERCW is controlled by an air-operated valve that is normally closed and must open on demand. These valves fail open upon loss of actuatir.g power so these dependencies are not required. The fan is required to start and run and these failure modes are included in the model.
| |
| A.9.3.2.4 ~ Low pressure injection model. The LPI model is shown in Figure A.9-26. It consists of the RHR pump trains taking suction from the RW3T and injecting into the RCS cold legs. The mission time is 1 hour which
| |
| ~
| |
| assumes' the containment spray system drains the RWST. In the case of a large LOCA, this assumption can be made. Only three cold leg injection paths are shown because the fourth is assumed to have the break. Therefore, the success criterion is one out of two pumps to two out of three injection paths.
| |
| The data used for the LPI'model are shown in Table A.9-14. The data contain pump maintenance and the appropriate mean time between inspection interval
| |
| - used.for the unavailability of valves.
| |
| A.9.3.2.5 Closed loop residual heat removal model. There are two types of CLRHR models needed to satisfy the requirements of the event sequence top events. In the small LOCA sequence (ESD 3), CLRHR is required to start and run with no dependence and is required to continue to run dependent upon successful LPI. In ESDs 4,11 and 12, CLRHR is required to start and run with no dependence. Since there is only one sequence in which CLRHR is required to continue to run following LPI, we have developed only one model
| |
| , to use in all sequences. The model, shown in Figure A.9-27, requires CLRHR to start and run for 23 hours with no dependence except where it follows LPI in the small LOCA sequence. In this case, the purp start failure is not A.9-70
| |
| | |
| ,w - - - - - - - - - - - - - . _ _ _ _ - _ . _ _ _ _ _ _ _ _ _ _ , _ _ _ _ _ _ _ _ _ _ ____
| |
| w d
| |
| NIM
| |
| - 8 ,
| |
| (! el ! al ! al
| |
| !n e e3 o
| |
| s O
| |
| M h
| |
| to v
| |
| P"*
| |
| 4) e E
| |
| < , 8-+3gIU ]
| |
| E E E h. c Ej "
| |
| O
| |
| ' g >z #sE 3 32 3 3 f*!f 3 5 *2 3 21 .-
| |
| C
| |
| ~
| |
| E Dh 8 a>
| |
| : =2 m . 5 a, g
| |
| tl .-
| |
| , e.
| |
| 3
| |
| * m
| |
| >5 e4Rl E$3 E g$ $
| |
| E" - : u 15 Q-gb <
| |
| 2 3I <-+ E 2l
| |
| - *- g e 32 R 1 o
| |
| : D,-
| |
| * 7 D7-J D
| |
| D
| |
| ~s1~: e p; v e
| |
| I 3*51 .s C .R
| |
| - as a o
| |
| " I L DE <
| |
| 5
| |
| $k k*!f Y 8
| |
| " 33 2
| |
| 2 E $R B 2.
| |
| 8 5 5 $8R s n " -t
| |
| : g *+
| |
| .L
| |
| , JE
| |
| > g Da o-
| |
| =g g oa - ), gg
| |
| , >i e a
| |
| *8 3 . >
| |
| : =g ~ 332 3 8 5 En a t8 3 E!
| |
| rg A.9-71
| |
| -W
| |
| | |
| e t ~? >
| |
| - ( tz_ )
| |
| '( N 4 g yr a
| |
| 1 5,
| |
| - 400V CONTAJNMENT AND
| |
| . 6.9hWSHUTDOWN ' ERCW OTHER ESFAS StGNAL ~ CCSWATER '
| |
| AUXILLARY OUILDING BOARD BOARD USERS HEADER RECIRCULATION TRAIN de0V REACTOR MOV 00ARD 1A14 1814 1A A 18 5 1A IS A 8 1A 1B 1A1A 181 8 1A2 A - 1828 T 138 127 100 151 161 142 ' 190 tot 111 112 . 113 114 140 141 PUMP A PUMPS ' ROOM ROOM 'FCV FCV HX A HXS FCV FCV FCV . FCV F AN A FANS COOLER A COOLER B S3 72 63 73 PUMI' A PUMPS 741 ' 74 2 1019s . .70163 SEAL SEAL COOLER COOLER
| |
| . MECHANICAL SEAL COMPONENT COOLING COOLER ROOM COOLER WATER TO RHR HEAT EXCHANGER 1 905 1 910 151 1 902 1 902 1 901 196 199 1 902 1902 1 902 1-902
| |
| -GV GV FCV FANS gV SV ' FCV GV GV 54W M Ma 1 920 765888 70 5678 8N 87 M 1420 745648 34, .
| |
| 114 CV CV 6 6M l'330 1 920 1 902 1 902 10 1 960 1 904 1 903 1 903 10 HX FCv FCV
| |
| > FCV rump cv GV GV 15-8 7429 0 94 74 21 'S g 74415 74621 74 625 ,,g ,gg ggy
| |
| : h. CV CV 102
| |
| , a*= asa il
| |
| .1 to 140, i 90, 4 97 101 d' 2 FCV FCV 4 PERFECT 74-1 74 2 PUMP IE INITIATOR 112 MAINTENA6CE cV CV 62 1430 1420 1 802 1902 10 1460 1404 1 803 1-903 to CV GV GV MX FCV FCV FCV 74 3 P'JMP 1 A-A 74414 74620 74-534 113 1M 741e sm 140 Cv CV 195 83432 83-561 1 902 1 005 1410 150 1402 1 902 1-902 198 1 902 1 902 1402 OV FCV FANA WV EV FCV GV GV GW G7 M 546A 94GA 19196 70564A - 704esA 70 947A G740GA MECHUd1CALSEAL' ROOM COOLER COeMVNENT COOLING WATER COOLER TO RHR HEAT EXCHANGER ST 1730 CLOSED LOOP RHR Figure A.9-27. Closed Loop Residual Heat Removal Model (ST 1700)
| |
| | |
| = - - . -
| |
| n 1
| |
| I e
| |
| 1.
| |
| Table.A.9-14
| |
| -LOW PRESSURE INJECTION MODEL DATA Component failure Mode (s)' Type-Kind te MTTRb Unavail-bility Manual Valve Transfer Open/Close During Operation 1-1102 3.36-8/h- 84 2.82-6 Motor-Operated Valve Transfer Open/Close During Operation- 1-1103 1.32-7/h 84 1.11-5~
| |
| Afr-Operated Valve Transfer Open/Close During Operation 1-1104 7.82-7/h 84 6.57 p Check Valve Failure to Operate on Demand- 1-1120 2.98-4/d 2.98-4
| |
| ? Pump Failure to Start on Demand 1-1131 2.12-3/d 2.12-3 y Failure to Run 1-1131 2.62-5/h 1 2.62-5
| |
| * Heat Exchanger Rupture / Excessive Leakage During 1-1151 6.69-7/h 1 6.69-7 Operation Pump Maintenance Out of, Service ~ 4-1141 1.82-5/h 21 3.80-4 Note: Exponential notation is indicated in a'bbreviated form; i.e., 3.36-8 = 3.36 x 10-8, ah = hour; d.= demand.
| |
| b MTR = mean time to repair or mean time between .'nspectiuns or mission time.
| |
| | |
| ~
| |
| a:
| |
| ~
| |
| x
| |
| .+
| |
| ' included. .Use of this model in the small LOCA sequence following LPI causes the quantification to be conservative due to overlapping unavailability in
| |
| .the LPI and CLRHR models. The valve's unavailability is the only area where there is' overlap and this contfibution is deemed small- compared to the pump
| |
| . contribution which is modeled correctly.
| |
| I"
| |
| . Room coolers are required for CLRHR success and the injection path success
| |
| ' criterion:is two out of four because CLRHR is not used in large break sequences. The data used in the rodel are shown in Table A.9-15.
| |
| A.9.3.2.6 Low pressure recirculation 'scdel. The LPR model is-shown in Figure' A.9-28. The LPR model is very similar to the RHR subsystem (ST 1950) of the HPR model except that the pumps inject directly to the cold legs. ,
| |
| The LPR model .is dependent on successful operation of LFI and has a mission i
| |
| ~
| |
| time of. 23 hours. . The model also requires one out.of two pumps to two out of three cold legs to be consistent with LPI. Room coolers are required as tin the HPR model. The data used in the LPR model are shown in Table A.9-16. +
| |
| A.9.3.2.7 Low pressure hot leg recirculation model. The LPHLR model is dependent upon ' successful operation of LPR for 23 hours. The LPR model s . .. ,
| |
| contains all the contribution of system failure except for the valve !
| |
| realignment which must be accomplished for successful LPHLR. The LPHLR 4
| |
| . valve realignment which must be accomplished is modeled in Figure A.9-29.
| |
| In order to. accomplish realignment, FCV63-94 must be closed and FCV74-35
| |
| - opened for train B or FCV63-93 closed and FCV74-33 opened for train A. In-y_ both cases, FCV63-172 must be opened. FCV74-35 and FCV74-33 are assumed close'dbecause the. procedures ~ for completing sump recirculation-require the
| |
| -operator to close these valves. Power sources are required for operation of
| |
| ; ,these valves and the MOV failure to operate on demand failure is used. The data used in the LPR model are shown in Table A.9-17.
| |
| A.9.3.2.8 Accumulators model. The accumulators model is shown in Figures A.9-30 and A.9-31. Figure A.9-30 shows the model of one accumuletor while Figure A.9-31 shows the entirc system. Success is defined as three
| |
| [ out of three accumulators because one accumulatcr is assumed to dump into' t the cold leg with;;a break. . The valve position on the accumulators is
| |
| = ,
| |
| 1 checked every shift therefore the_ mean time between inspection of MOVs is
| |
| - small. ; All MOVs are normally opened with power removed. The check valves y A.9-74 ;
| |
| 71 4.-
| |
| e , , - - - - --., n . - , , , , - - - . , . , , --.-...w
| |
| | |
| Table A.9-15' CLOSED LOOP RHR MODEL DATA a" Unavailability Component Failure Mode (s) Type-Kind . MTTRb -
| |
| Manual Valve Transfer Open/Close During Operation 1-902 3.36-8/h- 84 2.82-6 Motor-Operated Valve Failure to Operate on Demand 1-901. 4.30-3/d 4.30-3 i Transfer Open/Close During Operation .1-903 1.32-7/h 84 '1.11-5 l Air-Operated Valve Failure to Operate on Demand 1-905' 3.40-3/d 3.40-3 Transfer Open/Close During Operation .1 004 7.82-7/h 84 6.57-5 l > . .
| |
| b Check Valve Failure to Operate on Demand 1-920 2.98-4/d 2.98-4 4 4 Failure to run- 1-930 2.62-5/h 23 6.02-4 Pump -Failure to Start on Demand 1-930 2.12-3/d 23 2.12-3 Failure to run 11-930- 2.62-5/h 6.02-4 Heat Exchanger Rupture / Excessive Leakage During .1-950 6.69-7/h- 23 1.54-5 j Operation Fan Room Cooler Failure to Start 1-910 7.99-4/d 7.99-4 Failure During Operation 'l-910 8.85-6/h .23 2.03-4 i
| |
| Pump Maintenance Out of Service 4-941 1.82-5/h 20.9 3.80-4 i
| |
| Note: Exponential notation is indicated in abbreviated form; f.e.. 3.36-8 = 3.36 x 10-8,'
| |
| ah = hour; d = demand.
| |
| bMTTR = mean time to repair or mean time between inspections or mission time.
| |
| | |
| = -
| |
| --L .
| |
| m c ,
| |
| 1
| |
| ;i:.
| |
| Y'
| |
| _ pi:
| |
| 4 Table A.9-16' LOW PRESSURE'RECIFCULATION MODEL DATA Compone1t Failure Mode (s) Type-Kind NTTRb Unavailability
| |
| ~ Manual Valve Transfer Open/Close During Operation 1-1402. 3.36-8/h 23 - 7.73-7 Motor Operated Valve Failure to Operate on Demand ;-1401. .' 4.30-3/d .
| |
| A.30-3 Transfer Open/Close During Operation 1 1403 1.32-7/h 23 3.04-6s Air Operated Valve. Failure to Operate on Demand 1-1405 3.40-3/d '3.40-3
| |
| -? Transfer Open/Close During Operation 1-1404 7.82-7/h 23 1.80-5 Check Valve Reverse Leakage During Operation 1-1420 6.42-7/h 23 -1.48-5 Pump Failure to Run 1-1430 2.62-5/h 23 6.03-4 Heat Exchanger Rupture / Excessive Leakage During
| |
| .- Operation ' 1-1450 6.69-7/h 23 1.54 Fan Room Cooler Failure to Start 1-1410 7.99-4/d 7.99-4 Failure During Operation 1-1410 28.85-6/h . 23 ' 2.03-4 .
| |
| Note: Exponential notation is indicated in abbreviated form; i.e., 3.36-8 = 3.36 x 10-8, ah = hour; d = demand.
| |
| b MTTR = mean time to repair or mean time between inspections or mission time.
| |
| | |
| - _ s . .~ ~_ - .,. .. ._ ,
| |
| ..7
| |
| \ -. .- .
| |
| s.
| |
| 8
| |
| )
| |
| tr .f Table A.9-17
| |
| ' LOW PRESSURE liOT LEG RECIRCULATION MODEL DATA' Component Failure Mode (s) Type-Kind' . Unavailability lfda" ~ MTTRb Motor-Operated Valve Failure to Oper;te on Demand 1-601 4.30-3/d 4.30-3 e ' Transfers closed During Operation 1.32-7/h 84 1.11-5 Note: Exponential notation is indicated in abbreviate <1 form; i.e., 4.30-3 = 4.30 x 10-3 ah = hour; d = demand, b
| |
| MTTR = mean time to repair or mean time between inspections or mission time.
| |
| *s r-
| |
| | |
| '4 480V CONTAINMENT ANO . .
| |
| . AUXILIARY SUILDING 69kVSdUTDOWN . ERCW OTHER ESFAS SIGNAL . CCS WATER 480V REACTOR MOV BOAF , _ _ BOARD BOARD USERS HEADER RECIRCULATION TRABN '
| |
| 1 Al-A 181 8 1A2-A 1 t- 1Al-A 1814 1A A 18-8 1A 18 . A. 8. 1A 18
| |
| .111 112 113 114 140 - 141 126 127, 150 150 161 ' 182 198. 188 FCV FCV'. FCV - ..FCV FAN A . F AN 8 '
| |
| PUMP A PUMP 8 ROOM ROOM FCV -FCV HX A HX8 6172 6173 70156 74153 COOLER A COOLER 18 63 72 63-73 PUMP A PUMP 8 SEAL ' SEAL MECHANICALSEAL - COMPONENT COOLING COOLER COOLER COOLER' ROOM COOLER WATER TO RHR HEAT ETCHANGER 198 1-1402 1-1402 1 1402 1 1402 1 1405 1-1410 161 1 1402 1 1402 1-1401 188 GV GV GV 6V FCV FAN 8 BV BV FCV m705648 745668 745678 14i 674088 67-190 5458 5468 74153 112 114 10 . 1-1401 10 1-1430 1 1420 1 1402 1-1402 10 1 1450 1 1404 1-1403 1 1420 1-1420 FCV PUMP CV GV GV HX FCV FCV CV CV 6173 is a . 74 515 74-521 74 525 18-8 74-28 63 63436 63 563 27 C i, M 51 2 11 PERhECT ''
| |
| + 2 INITIATOR 161 3
| |
| 126 11420 1 1420 CV CV 10 1 1401 10 1-1430 1-1420 1-1402 1 1402 10 1-1450 1-1404 *14C3 FCV PUMP CV GV GV HX FCV FCV UI 63 72 74-514 74-620 74-524 113 1A A 6183 3 A. A 74-16 140 1 1420 1-1420 l CV CV 198 11402 1-1402 1-1402 1-1402 1 1405 1 1410 150 1-1402 1-1402 1-1401 188 2 M1 l
| |
| GV GV GV GV FCV FAN A BV BV FCV 74564A 74566A 74567A 67406A 67-188 545A - 546A 74156 MECHANICAL SEAL ROOM COOLER COMPONENT CO%ING WATER COOLER TO RHR HEAT LXCHANGER 1
| |
| ; Figure A.9-28. Low Pressure Recirculation Model (ST 1400) i
| |
| | |
| 480V REACTOR MOV BOARD 1Al-A 181-B l
| |
| u t 111 112 FCV 63 93 FCV 63-94 FCV 74-33 FCV 74-35 FCV 63-172 111 10 1-601 1-601 112
| |
| > FCV FCV 5-1 2 10 1-601 RHR HOT LEG RECIRCULATION a
| |
| FCV PERFECT 63-172 INITIATOR 10 1-601 1-601 FCV FCV 112 63-94 74-35 a
| |
| ST 1800 RHR HOT LEG RECIRCULATION Figure A.9-29. Low Pressure Hot Leg Recirculation Model (ST 1800)
| |
| | |
| 2 6 PRESSURE LEVEL TRANSMITTERS TRANSMITTERS 12 1-2 1-3 13 3 4
| |
| . 5-1 2 3 2 4 1
| |
| UNDETECTED V UNDETECTED PRESSURE LEVEL FAILURE 5 ' ' 9 FAILURE 10 10 1-4 ACCUMULATOR VESSEL 11 FCV 63-98,6340 15 63 67,63-118 12 CV CV 1-6 63422, 63423 CV CV 63424, 63425 ST 100 ACCUMULATOR 200 V
| |
| Figure A.9-30. Single Accumulator (ST 100)
| |
| A.9-80
| |
| | |
| ST100 ST100 ST100 200 200 200 2 3 4 v
| |
| 10 I V
| |
| 5 Figure A.9-31. Accumulator Model A.9-81
| |
| | |
| a are quantified with the failure to open on demand failure rate. The data used in the accumulator model are shown in Table A.9-18.
| |
| A.9.4 Quantification of System Unavailability A.9.4.1 Hardware Failure Contribution. Table A.9-2 shows the leading contributor fault sets for each of the ECCS models. These fault sets are composed of hardware failure unavailability and maintenance unavailability. The
| |
| : hardware unavailability contribution dominates the overall contribution.
| |
| The hardware unavailability contribution is composed primarily of active component failures which are dominated by check valve failure to open on demand, M0V and air-operated valve failure to operate on demand, pump failure, and room cooler fan failure.
| |
| A.9.4.2 Test and Inspection Contribution. Each RHR, SI, and charging pump is tested once every 3 months. The test lasts less than 1 hour. Since the systems are tested while aligned for their safety function, testing does not contribute to unavailability.
| |
| 'A.9.4.3 Maintenance Contribution.
| |
| A.9.4.3.1 System unavailability during maintenance. Maintenance unavailability was only quantified for the ECCS pumps.
| |
| A.9.4.3.1.1 RHR pump maintenance. As discussed in Section A.9.2, an RHR pump may be taken out for 72 hours is the other pump is functional. Using the following data for RHR pump maintenance frequency and mean maintenance doration, which are developed based on 72-hour inoperability time limit, Maintenance Frequency = 1.82 x 10-5 events / hour Mean Duration = 20.9 hours we obtain the following RHR pump maintenance unavailability Q(RHR)pm = 3.80 x 10-4 A.9.4.3.1.2 SI and Charging Pump Maintenance. As discussed in Section A.9.2, an SI or cha ging pump may be taken out for 72 hours if the other pump in the' system is functional. Using the following data for A.9-82
| |
| | |
| Table A.9-18 ACCUMULATOR MODEL DATA Component Failure Mode (s) Type-Kial te a' MTTRb Unavailability Pressure Transmitter Fails During Operation 1-2 7.60-6/h 4 3.04-5 3= Level Transmitter Fails During Operation 1-3 1.57-5/h 4 6.28-5 Accumulator Ruptures During Operation 1-4 2.66-8/h 1 2.66-8 Motor-Operated Valve Transfer Closed During Operation 1-5 1.32-7/h 4 5.28-7 Check Valve Fafis to Open on Demand 1-6 2.98-4/d 2.98-4 I
| |
| Note: Exponential notation is indicated in abbreviated form; 1.e., 7.60-6 = 7.60 x 10-6, ah = hour; d = demand, b
| |
| MTTR = mean time to repair or mean time between inspections or mission time.
| |
| | |
| s frequency and du?ation of maintenance developed consistant with the 72-hour inoperability 1.imit, Maintenance Frequency = 1.26 x' 10-4 events / hour
| |
| - Mean Duration = 40.8 hours we obtain the following pump maintenance unavailability Q(SI/CH)pm = 5.16 x 10-3
| |
| +
| |
| f 2
| |
| e T
| |
| e
| |
| +
| |
| i A.9-84
| |
| | |
| p A.10 CONTAINMENT SPRAY SYSTEM A.10.1 Introduction A.10.1.11 System Definition.
| |
| A.10.1.1.1 Overview. The containment spray system (CSS) consists of two pump trains which each supply water to its own spray header within the containment. Each train .is capable of reducing and maintaining the pressure within the containment to prevent containment failure due to overpressurization.- Each train consists of inlet valves, motor-driven pump, outlet valves, heat exchanger, and spray nozzles.
| |
| The CSS has two modes of operation, injection and recirculation. In the injection mode the pumps draw borated water from the refueling water storage tank (RWST) and inject to the containment through the spray header nozzles.
| |
| :In this mode the heat exchangers are not required to remove heat. When the RWST reaches a low level, the pumps are realigned to draw water from the containment sump. This is the recirculation mode in which the heat exchangers are required to remove heat. In this mode the water within the containment flows to the sump which is recirculated through the CSS pumps and heat exchangers and back to the containment through the spray nozzles.
| |
| !~
| |
| Dur.ng nomal operation the CSS is in a standby configuration in which the pumps. e aligned to the RWST and ready to start. Upon a containment high p..'ssure s!qnal from the engineered safety features, actuation system (ESFAi, the pu'os will start automatically and inject water to the containment The realignment to containment sump recirculation is accomplished mar' ally 'v the operator.
| |
| A.10.1.1.2 Purpose of . *s i. The purpose of this analysis is to model and quantify the CSS remnse u An accident situation. The system analysis results will show the system's capau!Mty to successfully perform its function in all plant accident scenarios wsidered in this study.
| |
| A.10.1.2 Analysis Boundary Conditions / Initial Conditions. The CSS analysis
| |
| - includes all components from suction valves FCV72-20, FCV72-21, FCV72-22,
| |
| :and FCV72-23 to containment spray headers A and B. The analysis also includes the essential raw cooling water and component cooling water isolation valves to the heat exchangers, room coolers, and pumps.
| |
| A.10-1
| |
| | |
| The CSS is analyzed given that all auxiliary support funtions, the RWST, and the containment sump are available. The system is considered initially in its normal standby state prior to the initiation of an accident sequence. Pipes less than 1-1/2 inches in diameter are not included due to their relatively small flow capacity. No credit is given for operator actions to recover failed equipment.
| |
| A.10.1.3 Systems Analysis Results.
| |
| A.10.1.3.1 Quantification of conditional failure states. The CSS is quantified for two functions, injection and recirculation. The i quantification for both functions is carried out given that the auxiliary ,
| |
| support dependencies are successful.
| |
| ' The quantification for the injection function is performed given the RWST is available. The quantification of the recirculation mode is performed given the injection function was successful and the containment sump is available.
| |
| The results of the conditional quantification of these two functions are shown in Table A.10-1. Also shown are the independent pump train contributions of'each model.
| |
| A.10.1.3.2 Dominant contributors to unavailability. The dominant contributor fault sets are shown in Table A.10-2 along with their percentage contribution to the overall system unavailability. The injection and recirculation models both consist of second order and higher order fault
| |
| -sets with the second order fault sets dominating the unavailability contributica.
| |
| The injection model is dominated by combinations of pump maintenance i unavailability and motor-operated valve (MOV) failure to operate on demand fault combinations. M0V and M0V combinations are second with pump maintenance and failure-to-start combinations third.
| |
| The recirculation model is dominated by combinations of MOV failure to open on demand fault sets.
| |
| A.10-2
| |
| | |
| f Table A.10-1 ANALYSIS RESULTS Unavailability Injection Recirulation Model Model System -1.36-4 5.95-4 Train A 1.27-2 2.44-2 Train B 1.27-2 2.44-2 NOTE: Exponential notation is indicated in abbreviated
| |
| -form; i.e., 1.36-4 = 1.36 x 10 4
| |
| 'A.10-3
| |
| -._.a
| |
| | |
| V
| |
| , Table A.10-2 LEADING CONTRIBUTOR FAULT SETS CSS Model. -Leading Contributor Fault Sets Unavailability Co tr bu on Containment Pump A Maintenance and FCV72-2 2.22-5 16.3 Spray Pump B Maintenance and FCV72-39 2.22-5 16.3 Injection FCV72-39 and FCV72-2 1.85-5 13.6 Pump A Maintenance and Pump B Failure 1.11-5 8.2 Pump A Failure and Pump B Maintenance 1.11-5 8.2 Pump A Failure and FCV72-2 9.25-6 6.8 FCV72-39 and Pump B Failure 9.25-6 6.8 Pump A Failure and Pump B Failure 4.62-6 3.4 Pump A Maintenance and CV72-507 1.54-6 1.1 Pump A Maintenance and CV72-529 1.54-6 1.1 Pump A Maintenance and CV72-548 1.54-6 1.1 CV72-506 and Pump B Maintenance 1.54-6 1.1 CV72-528 and Pump B Maintenance 1.54-6 1.1 CV72-547 and Pump B Maintenance 1.54-6 1.1 Containment FCV72-20 and FCV72-23 1.85-5 3.1 Spray FCV72-20 and FCV67-126 1.85-5 3.1 Recircula- FCV72-20 and FCV67-125 1.85-5 3.1 tion FCV67-124 and FCV72-23 1.85-5 3.1 FCV67-124 and FCV67-126 1.85-5 3.1 FCV67-124 and FCV67-125 1.85-5 3.1 FCV67-123 and FCV72-23 1.85-5 3.1 FCV67-123 and FCV67-126 1.85-5 3.1 FCV67-123 and FCV67-125 1.85-5 3.1 FCV72-20 and FCV67-184 1.46-5 2.5 FCV67-124 and FCV67-184 1.46-5 2.5 FCV67-123 and FCV67-184 1.46-5 2.5 FCV67-186 and FCV72-23 1.46-5 2.5 FCV67-186 and FCV67-126 1.46-5 2.5 FCV67-186 and FCV67-125 1.46-5 2.5 FCV72-20 and Pump A Failure 1.17-5 2.0 FCV67-124 and Pump A Failure 1.17-5 2.0 FCV67-123 and Pump.A Failure 1.17-5 2.0 Pump B Failure and FCV72-23 1.17-5 2.0 Pump B Failure and FCV67-126 1.17-5 2.0 Pump B Failure and FCV67-125 1.17-5 2.0 FCV67-186 and FCV67-184 1.15-5 2.0 Pump B Failure and FCV67-184 9.25-6 1.6 FCV67-186 and Pump A Failure 9.25-6 1.6 Pump B Failure and Pump A Failure 7.40-6 1.2 NOTE: Exponential notation is indicated in abbreviated form; i.e., 2.22-5 = 2.22 x 10-5, A.10-4
| |
| | |
| (-
| |
| 'A.10.2 System Description
| |
| ~A.10.2.1 Nomal Operating Function. During normal plant operation, the containment spray system' (CSS) equipment is in standby and the associated isolation valves are closed. The.' system function during normal operation is to be in an operable standby state as required by the technical specifications.
| |
| 'A.10.2.2 J Accident Mltigation Function.
| |
| A.10.2.2.1 . Design bases. There are two containment heat removal spray systems: one is the CSS and the other is the residual heat removal spray system which is a portion of the residual heat removal system.
| |
| The primary design basis for the heat removal spray systems is to spray cool, borated water into the containment atmosphere when appropriate in the event of a loss of coolart accident (LOCA) and thereby ensure that the containment pressure cannot exceed the containment shell design pressure of 12.0 psig at 250*F. This protection is afforded for all pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of the reactor coolant loop with unobstructed flow from both pipe ends. The containment spray system supplements the ice condenser uncil all the ice is melted (approximately 3,600 seconds after the loss of coolant accident) at which time it and the residual heat removal spray system become the sole systems for removing energy directly from the containment. The containment heat removal systems are designed to provide a means of removing containment heat without loss of functional performance in the post-accident containment environment and to operate without benefit and maintenance for the duration of time to restore and maintain containment conditions at atmospheric pressure. Although the water in the core after a LOCA is quickly subcooled by the emergency core cooling system (Section A.9), the heat removel design capability of each containment heat removal system is based on the conservative assumption that the core residual heat is released to the containment as steam which eventually melts all ice in the ice condenser.
| |
| The secondary design basis for the containment heat removal spray systems is the suppression of steam partial pressure in the upper volume due to operating deck leakage from a small break before a full LOCA. The requirement is that the containment spray systems are able to absorb the steam leakage through the operating deck at the maximum long-term deck A.10-5
| |
| | |
| v ;
| |
| differential pressure of 1 pound per square foot, which -is equivalent to the ice condenser door. opening and differential pressure in the upper compartment due to deck leakage in the " double accident" situation. The
| |
| " double accident" is a small break followed by a large break up to a
| |
| ~
| |
| double-ended severance of the largest pipe in the reactor coolant system.
| |
| A.10.2.2.2 Success criteria. During the initial period following a lar;:
| |
| :LOCA, the containment spray system is actuated (in conjunction with the ice condenser system and the air return fan system) to spray a portion of the
| |
| ~ contents of the refueling water storage tank into the containment atmosphere using the containment spray pumps. This is known as the injection phase of operation. System success in this phase requires at-least one out of two CSS trains to start and run for-I hour.
| |
| - After the refueling water storage tank (RWST) has reached a low-low level (but while there is still ice remaining in the ice condenser), suction of the spray pumps is switched to the containment recirculation sump. Water drawn from the sump is cooled by the containment spray heat exchangers and then sprayed back to the containment. This is known as the recirculation phase of operation. System success during this recirculation phase requires at least one out of two CSS trains to operate for an additional 23 hours.
| |
| Diverse' operation of a portion of the recirculation flow by the residual heat removal pumps to the additional spray header. occurs in the event that the containment pressure starts to rise after the ice condenser has been depleted. This is discussed separately in' the emergency core cooling system (Section A.9).
| |
| i A.10.2.3 System Configuration.
| |
| A.10.2.3.1 Physical arrangement. The CSS consists of two independent, fully redundant heat removal trains (except for common
| |
| - RWST and test return line). Figure A.10-1 shows the simplified piping and ir.strumentation diegram (PalD).
| |
| A.10-6
| |
| | |
| (
| |
| CSPUMP TO F ACW a . ROOM COJLER CONTAINMENT _ ,,, y ,g SOUNDApy FCV u FCV . 67 6 RWST ERCW 87-106
| |
| . 47-124 II 67 5378 % - FCV i 5729 Fev 7,.
| |
| , .T T N 12DN _
| |
| .. . ;_ ,, . l O. ,
| |
| . ,2 N. _
| |
| FCV 72 520 20 IN' 9 72-2 ' 72 534 G 8:n , ,2 n - is e " n s07 FCv ' "
| |
| , P'M OIL AND SEAL 20IN. 72 21 CONTAihMENT SPRAY Hi ADER 1VLC S 8 IN- 24 EN.
| |
| JL 72 546 72
| |
| . LC504jg1y ~ A 5698 1P FCV
| |
| 'I IN-fg'y 2 en.
| |
| g gg, TO '
| |
| 72 20 ir 72-13 % CHARGING n
| |
| g FROM PUMP CONTAINMENT SUMP
| |
| > 2IM m2
| |
| $-e
| |
| {g" 8 EN.
| |
| o , n s02 N FROM 12 IN. 18 IN. ,,20 IN. TO RHR
| |
| : PUMP 2 tN. CONTAINMENT SUMP -
| |
| l I '' gig SUCTION g 1PLC LC 1F v, JL72 645 72 603JL FCV 571A 1 FCV qr 72-34A 572A Fev JL 72 23 TO SIS 12 gg PUMPS S IN. 2 IN.
| |
| (
| |
| 72 547 1A , 12fM m 20IN, 1-A 7 ,
| |
| ! LO.
| |
| n 508 FCV 72 528 ' "
| |
| + 1 n as a n 533 G 1 A. A 208%
| |
| 9 1
| |
| ' ^ PUMP OIL AND SE AL 72 22 67 25 CONTAINMENT SPRAY HEADER
| |
| +
| |
| 67 26 II FROM ERCW w, A
| |
| 'r FCV 676CSA TO ERCW $7-134 ROOM COOLER Figure A.10-1. Containment Spray Simplified P&ID Diagram
| |
| ~ m _
| |
| | |
| L Based on the analysis boundary, the CSS is composed of the CSS pumps, heat exchangers, spray headers with nozzles, associated valves, piping, and instrumentation and controls.
| |
| Both' CSS pumps (1A-A/1B-B) primarily take suction from the RWST through a 12-inch common pipe. The containment sump is a backup water supply source. The common pipe from the RWST branches into two separated CSS trains; each train has an isolation valve
| |
| '(FCV 72-21/FCV 72-22) and a check valve (72-506/72-507) located
| |
| . upstream of its associated pump. These isolation valves are normally open to permit rapid system startup. However, each CSS train has its independent suction line from the containment sump associated with normally closed isolation valves s (FCV 72-20/FCV 72-23).
| |
| The two CSS' pumps are a centrifugal type and are located in individual rooms on Elevation 653' of the auxiliary building.
| |
| Either of the two pump trains is independently capable of delivering the design flow of 4,750 gpm at a design head of 370 feet. The discharge of each train passes through a check valve (72-528/72-529) and a locked open gate valve (72-533/72-534) and then into the tube side of the heat exchanger (1A/1B). The containment spray heat exchangers are the vertical shell and U-tube type. The shell side is provided with cooling water from the essential raw cooling water (ERCW) system. The ERCW inlet isolation valves (FCV 67-125/FCV 67-123) and outlet isolation valves (FCV 67-124/FCV 67-126) are normally closed;'as such, they are required to be opened manually on demand. These four isolation valves and two butterfly valves
| |
| -(67-537A/67-5378) are included in this analysis.
| |
| Upon system activation during a LOCA, CSS water will flow through
| |
| . the containment isolation valves (FCV 72-39/FCV 72-2) and the last
| |
| . check valve (72-547/72-548) into the containment spray headers.
| |
| Each containment ring header provides 4,750 gpm and contains 312 hollow cone ramp bottom nozzles, each of which is capable of a design flow of 15.2 gpm with a 40 psi differential pressure.
| |
| To protect the pumps from low flow conditions, a minimum flow recirculation line is provided to allow pump discharge to be A.10-8
| |
| | |
| , , , - . . . . -- .. . .. - ~ . = ~ _ - - - , . .
| |
| n : 4., l l
| |
| - circulated back into the pump intake. This line is opened by a motor-operated valve when flow in the discharge line drops below that required for pump protection or.if, upon starting, flow is not achieved in the spray header within a preset time interval.
| |
| . An 8-inch containment test ifne with locked closed gate valves
| |
| : (72-503/72-504) is provided for each train downstream of the heat exchangers, and'is confluent back to the RWST through a locked closed gate valve (72-502).
| |
| All spray headers and spray nozzles are located inside, the containment in the upper: compartment. The-remainder of the system with the exception of
| |
| ; ~ the RWST, which includes' all active components, -is located in the auxiliary building.
| |
| 1 A.10.2.3.2 Support system.
| |
| ) e Power Supply. The containment spray system is dependent upon the-electric power system for the operation of pumps and motor-operated valves and upon control power for equipment
| |
| , ' control and for monitoring and indication of system
| |
| ; - parameters. The system is powered by at least two redundant t
| |
| channels, each with access to preferred and standby power sources. Table A.10-3 presents the power supplies to the various components.
| |
| e Refueling Water Storage Tank. This is the preferred water l source for CSS suction.
| |
| -e Containment Recirculation Sump. As a backup water source, it provides containment spray pumps and residual heat removal pumps te operate as long term recirculation during the extent of a post-accident environment.
| |
| . e- : Engineered Safeguards Features Actuation System (ESFAS)(see
| |
| }'
| |
| Section A.6). The injection phase of the containment spray
| |
| _ system 1s automatically activated by a high-high containment
| |
| - pressure signal.
| |
| e Essential Raw Cooling Water. This is required to remove heat from the system heat exchanger during the. recirculation phase of operation. The auxiliary building cooler unit which is
| |
| , cooled by the ERCW system provides room cooling for the CSS pump and equipment. The valves (67-605A/B, FCV 67-184/FCV-67-186) and cooler units (IA, IB) of the pump room cooling unit are also included in this analysis.
| |
| o Component Cooling Water (see Section A.4). This provides cooling to the containment spray pump oil and mechanical seal heat exchanger to maintain the CSS pump for long term A.10-9
| |
| | |
| Table A.10-3
| |
| - CONTAINMENT SPRAY SYSTEM POWER SUPPLIES Component _ Voltage Power Supply Spray Pumps 1A-A 6.9 kV Shutdown Board 1A-A 1A-B- 6.9 kV Shutdown Board 1B-B Motor-0perated Valves FCV72-2 .480V Reactor MOV Board 181-B FCV72-20 480V Reactor MOV Board 1B1-B FCV72-21 480V Reactor MOV Board 1B1-B FCV72-22 480V Reactor MOV Board 1Al-A FCV72-23 480V Reactor MOV Board 1Al-A FCV72-39 480V Reactor MOV Board 1Al-A FCV72-34 480V Reactor M0V Board 1Al-A FCV72-13 480V Reactor M0V Board 1B1-B FCV67-123 480V Reactor M0Y Board 182-B FCV67-124 480V Reactor MOV Board 1B2-B FCV67-125 480V Reactor MOV Board 1A2-A FCV67-126 480V Reactor MOV Board 1A2-A A.10-10
| |
| . . . . . . . . . . . . . . . ... .. . . . _ . .J
| |
| | |
| operation. The normally open CCS valves (569A/B, FBV-571A/B, 572A/B) are _ included in this analysis.
| |
| :A.10.2.3.3' Interfacing system. The CSS shares physical and functional interfaces with the emergency core cooling system. These interfaces are the common suction piping from the RWST'and the containment recirculation sump.
| |
| A.10.2.4. System Operation. '
| |
| A.10.2.4.1 - Nomal operation. During ncmal plant operation, the CSS is in standby status. The status of the major CSd aquipment and its support systems whicn are discussed in this analysis is s;own in Figure A.10-1. The standby alignment is such that the system is ready to respond to an automatic actuation. signal, taking suction from the RWST.
| |
| A.10.2.4.2 Event response. The containment spray system operates in two phases during a transient: (1) the injection phase, during which water is supplied from the RWST; and (2) the recirculation phase, during which water is taken from the sump and pumped through the heat exchangers and spray nozzles.
| |
| A.10.2.4.2.1 Automatic actions. The injection phase of the containment spray system is automatically actuated on a two-out-of-four coincident high-high containment pressure signa from the ESFAS (18 psig). This automatic actuation results-in the following:
| |
| e .Both coritainment spray pumps start.
| |
| e Both motor-operated spray isolation valves (FCV 72-39/FCV
| |
| ~72-2) open, e Suction 1s taken through the nomally open valves (FCV 72-22 and FCV 72-21) from the RWST.
| |
| The recirculation phase of operation has no automatic actions.
| |
| A.10.2.4.2.2 Manual operator actions. During injection, the operator ha's no required actions for operation of the containment spray system other than monitoring the system's performance. The operator may, however, manually initiate either train A or train B, or the entire system, from the centrol room.
| |
| A.10-11
| |
| | |
| i Upon receipt of the kWST low-low level alarm (50,000 gallons), the operator realigns the containment spray system into the recirculation phase of operation.
| |
| During the recirculation phase, the operator must perform the following manual actions:
| |
| e Stop the containment spray pumps (1A-A and IB-B) by " pull to lock in stop" to preclude the possibility of pump restart while realigning the suction valves.
| |
| e Close the spray pump /RWST suction valves (FCV 72-21 and FCV 72-22).
| |
| e Open the essential raw cooling water isolation valves to the containment spray heat exchangers (FCV 67-123, FCV 67-124, FCV 67-125, and FCV 67-126).
| |
| e .Open the sump isolation valves at the suction of the containment spray pumps (FCV 72-33 and FCV 72-20).
| |
| o Verify that the valve realignments of the above steps have been completed.
| |
| e Restart the containment spray pumps (1A-A and 18-B).
| |
| A.10.2.4.3 Potential for accident actions. The containment spray system has no pot.ential as an initiator for any of the events analyzed in this study.
| |
| A.10.2.5 Controls, Indicators, and Alarm.
| |
| A.10.2.5.1 Control room. The containment spray system will be actuated either manually or automatically from the control roc,m.
| |
| The operation of the CSS is verified by instrument readout in the control room. Pump motor breakers energize indicator lights on the control panel to show power is being supplied te the pump motor. Pump discharge is indicated by flow meters on the main control panel. Status lights on the main control panel indicate valve position and are energized independently of the valve actuation signal. The closing circuits of nomally closed motor-operated valves will be deenergized by torque switches on the valve, operator to assure a tight fitting.
| |
| A.10-12
| |
| | |
| y .
| |
| The flow element in each discharge line monitors the flow rate and provides the flow signal for control of the minimum flow recirculation valve and the l
| |
| control room flow indicator. !
| |
| 'A.10.2.5.2 Local panels. The CSS can also be actuated from the local auxiliary control room. Locally mounted instruments monitor the following
| |
| - conditions:
| |
| o Containment Heat Removal Spray Pump Suction and Discharge Pressure e Heat Exch- 1er Inlet and Outlet Temperature e Heat Ext .ger Inlet and Outlet Pressure e Pressure Differential Across Filters In the event of a main control room evacuation, the necessary control functions are transferable to the auxiliary control room in order to assure that the system can be aligned and locked to prevent inadvertent operation and to manually initiate system operation if necessary. These functions will include the spray pumps and other critical power-operated components in the !ystem.
| |
| A.10.2.6 Testing, Inspection, and Surveillance Requirements.
| |
| -e Pump Test (per Surveillance Instruction SI-37). Both pumps and check valves will be tested once per quarter. The pump s operability is verified by starting each pump and verifying that the pump inlet pressure, differential pressure, vibration, and the lubrication oil level are within acceptable range.
| |
| Do not run this surveillance instruction on a CSS pump if the other pump is inoperable while in Modes 1, 2, 3, or 4.
| |
| Do not perfonn this instruction simultaneously with a Phase B containment isolation signal or if a high-high containment pressure signal exists. -
| |
| An auxiliary operator (AUO) will be stationed near the recirculation line valves (72-502, 72-503, 72-504). Immediate access to these valves is required in case a LOCA occurs during the test so that the recirculation line may be isolated.
| |
| e Valve Position Verification (per Surveillance Instruction SI-34).
| |
| Each containment spray system shall be demonstrated operable at least once per 31 days by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, cealed, or otherwise secured in position, is in its correct A.10-13
| |
| | |
| i position and operable for pump to take suction from RWST on a containment spray signal.
| |
| e Function Test (per Surveillance Instruction SI-68). At least once per 18 months during refueling, both CSS systems will demonstrate that each automatic valve in the CSS flow path will actuate to its correct position and that each spray pump starts automatically on a containment pressure--high-high test signal.
| |
| Table A.10-4 lists a summary of the CSS availability and risk impacts due to the above testing, inspection, and surveillance requirements.
| |
| A.10.2.7 Maintenance Requirements. Periodic maintenance is performed as required. Repairs of failed or degraded components during unit operation must confonn to the applicable technical specifications or system operability criteria; otherwise, the unit must be shut down until the failed components are returned to service.
| |
| Maintenance instruction (MI-6.8) describes the procedure for the inspection and repair of the containment spray pumps. This pump maintenance has a direct impact on CSS unavailability.
| |
| Instrument maintenance instruction (IMI-72) states that at least once in 18 months, a calibration of the CSS instrumentation or instrument loops is performed per Appendix A of this instruction. CSS availability is not adversely affected by these maintenance instructions because this maintenance is performed during unit refueling outage.
| |
| In addition, surveillance instruction (SI-37) part 8 provides a CSS pump post-maintenance testing requirements to verify pump's operability and generate new baseline values after maintenance has been completed on a pump which could affect its performance.
| |
| A.10.2.8 Technical Specifications' Effects upon Operation. If one containment spray train is inoperable, it must be restored to operable status within 48 hours or the unit must be in at least hot standby within the next 6 hours. The inoperable system must be returned to operable status within the next 36 hours or be in cold shutdown within the next 30 hours.
| |
| A.10.3 System Logic Models A.10.3.1 Event Sequence Top Event Definitions. The CSS top event functions are containment spray injection and containment spray recirculation. The injection A.10-14
| |
| | |
| - Table A.10-4
| |
| ' IMPACTS.0F TESTING, INSPECTION,~-AND SURVEILLANCE REQUIREMENTS Ia : -
| |
| Avai ab lity Number Description : ~ Frequency gp Impact SI CSS Pump Test 1/ quarter Yes,~since the Yes, if the operator recirculation line fails to isolate the
| |
| -- is open during test, recirculation line, -
| |
| immediate access to CSS train on system
| |
| . isolate this line may be failed.
| |
| is required in case a LOCA occurred.
| |
| SI-34 CSS Valve 1/ month' None, because of None.
| |
| -Position visual inspections Verification only.
| |
| 'SI-68 Function Test .1/ Refueling None, due to test None, of CSS Pumps being performed and Valves during plant shutdown.
| |
| i ml A.10-15
| |
| | |
| im
| |
| ;m ,
| |
| 'l L
| |
| ' function is required in all sequences where the containment pressure is excessive. This includes all LOCAs, steam loss inside containment, and ' sequences which require primary coolant inventory blowdown through the pressurizer relief valves. .
| |
| A.10.3.'1'.1' Analysis boundary conditions. The quantification boundary conditions are as follows:
| |
| 3 e The CSS is considered in its nonnal standby configuration ,
| |
| . prior to actuation of the injection function except as modified by plant testing or maintenance.
| |
| o All human interaction with the CSS is not considered in this analysis and therefore is not. included in the quantification.
| |
| e No credit is given~ for operator actions to recover failed equipment.
| |
| e Based on the RWST volume, the injection mode mission time is
| |
| -a maximum of 1 hour while the recirculation mode mission time is 23 hours.
| |
| -e Pipes with a diameter less than 1-1/2 inches are not considered to affect CSS availability due to their relatively small flow capacity, e All valves which isolate interfacing systems from the CSS are included in the CSS logic models. This includes the ERCW isolation valves for the pumproom coolers and heat exchangers and the component cooling water isolation valves for the pump oil and mechanical seal coolers.
| |
| e The RWST and containment sump water sources are not included in the analysis.
| |
| ' i: o Piping sections and their failures are not explicity modeled.
| |
| e ERCW is required for the recirculation mode only whereas component cooling water is required for both modes. An ESFAS injection signal is required for automatic injection.
| |
| e Pump failures include the motor circuit breaker and all motor control s. .
| |
| A.10.3.1.2 Interface with the overall safety model. The CSS models interface with the auxiliary support system and the event sequence models in which the system is called upon. The CSS injection model interfaces with the CSS' recirculation model by supplying the pump train dependencies needed for successful recirculation. The recirculation model also requires two
| |
| ' independent sump signals from ECCS valves FCV63-72 and FCV63-73.
| |
| A.10-16
| |
| ,s
| |
| | |
| x A.10.3.2 G0 Models..
| |
| A.10.3'.2.1 CSS injection model. Figure A.10-? shows the CSS injection model. The model consists of two complete pump trains each consisting of
| |
| -inlet valves pumps, outlet valves,' heat exchanters, and a spray header. The pumps require component cooling water so those isolation valves are included. A type 4 operator is used to quantify pump maintenance unavailability for only one pump at a time according to the technical specification requirements.~ - FCV72-2 and FCV72-39 are normally closed MOVs and require electric power and an actuation signal to operate.- The normally closed recirculation testing valves are modeled in the correct failure combination required to fail a pump train by diverting the water to recirculation instead of injection. Only one out of two pump trains is
| |
| ' required for success. The data used for the injection model are shown is Table A.10-5.
| |
| A.10.3.2.2 CSS recirculation model. Figure A.10-3 shows the CSS recirculation model. This model starts with either the check valves (CV72-504 and CV72-506) or the RWST isolation valves (FCV72-21 and FCV72-22) closing. Then the sump water source valves FCV72-20 and FCV72-23 must open. Power is required for all of these MOVs. The pumps require component cooling water and ERCW for the pumproom coolers. The ERCW isolation valve is nonnally closed and must open on demand. The pumproom cooler fan must also operate and requires electric power to do so. The heat exchangers require ERCW and isolation valves FCV67-123, FCV67-124, FCV63-125, and FCV63-126 must all open on demand. Again one out of two pump trains with its appropriate sump water source is required for success. The data used for the recirculation model are shown in Table A.10-6.
| |
| A.10.4' Quantification of System. Unavailability A.10.4.1 Hardware Contribution. Table A.9-2 shows the leading contributors to unavailability. These fault sets are composed of hardware failure and maintenance unavailability:
| |
| For the injection model, the MOV failure to open on demand and pump failure to start are the leading hardware failure contributors. For the recirculation model MOV failure to operate on demand is the leading hardware failure. '
| |
| A.10-17
| |
| | |
| = i o
| |
| e .:
| |
| : !! : !E 0)e! 0)e! -
| |
| r
| |
| .-i iil i e l .-.1:1 . G)!: , 1 0)l: 3 i, , y i . . ! g a+5 EE a $
| |
| 0)e! 0)e! *
| |
| . i si :1 -
| |
| bb l I
| |
| l :: 0):1 G):!! l ! si
| |
| ''I i "
| |
| =
| |
| s! G)n 6)u !!
| |
| lli s :-sia
| |
| ~
| |
| i@Y
| |
| ~
| |
| _f.
| |
| , Ok, ' =
| |
| 8
| |
| , = e til 0)!s Q>! :! Q:! C: die ;!
| |
| ~'
| |
| 0)! 2h (Del '! .
| |
| . ni . i
| |
| !,2 lI i
| |
| !y l'
| |
| *i i ,
| |
| l 1
| |
| - I I
| |
| lo l
| |
| I A.10-18 l
| |
| | |
| ~
| |
| .... ~ .Om m .crom m .c,o .
| |
| .J.8m.mc,A.Of e eso. 3.mO esO. O.80 CCS Ym.es. **E
| |
| .0.mo
| |
| . ... .2. .. ........ .. .. .. ..
| |
| t i t i i t t t t m.-.mO
| |
| .tn . .
| |
| .u . . - . . . .e...
| |
| .c .. .a. .c
| |
| ...n .c....
| |
| .C. n n ..C.,2n n .n .C. n n . .vou.mo .
| |
| : m. m,
| |
| .C . . .,..c....>.
| |
| .C....
| |
| CQOkte COOLim 6 u noon
| |
| .v .
| |
| moon Coot.sm Coot.s *
| |
| . tan, ont .nso EE.L COOtte moons COosta m . .m .u, . .m . .m m c . .m .
| |
| .o,.a. .o,.,.
| |
| ur . .o .
| |
| ,. . .m . .m 2 . , = .
| |
| . .m . .m . .m
| |
| - . . _ . . .. . .. .. _.,2
| |
| .. n n2 m... n u. n u.
| |
| . 2,2 2 . 30. S 52,2 . 120. g .25, 12 c .c. .c.
| |
| 3, ne ,c.
| |
| us . , .u. , . 2. .se r2 2s n 2,
| |
| . m
| |
| ?
| |
| @ 2 49 9 92,2
| |
| : m. F2 mesisFOm CT H2 i m 2 s Jo. . 21 2 , . 30. 1.
| |
| . c .. c .c. ,c.
| |
| n .2 .a .> u ,. >= nn nn
| |
| ' .1, ir
| |
| . .m ,,n, . .m . .m . .m .u. . .m 2 .. .
| |
| m.. .o.m .c. - . c c. c
| |
| .. c ..
| |
| 72 F2 3. 92 m. 72 23 72 2. . . . 72 0.
| |
| 'E #0048 COOL f n
| |
| .Uns. Det .esO SE .4 COOL f a
| |
| -O,,m O . ,m ..n, .,m . .m .. .
| |
| V.2n c . .m .
| |
| : n. , . .e . . . .c mfCancut.Tsos.es00E ComT.essestasi pm.V 5 5,648 Figure A.10-3. Containment Spray Recirculation Model
| |
| | |
| Table A.10-5 CONTAINMENT SPRAY SYSTEM INJECTION MODEL Component Failure Mode (s) Type-Kind Failure MTTRb Unavailability Ratea Manual Valve Transfer Open/Close 1-1203 3.36-8/h 1,096 3.68-5 During Operation Motor-Operated Failure to Operate on 1-1205 4.30-3/d 4.30-3 Valve Demand Transfer Close During 1-1200 1.32-7/h 1,096 1.45-4 Operation Check Valve Failure to Operate on 1-1201 2.98-4/d 3.40-4
| |
| . Demand E
| |
| 4 Pump Failure to Start on 1-1202 2.12-3/d 2.13-3 Demand Failure to Run 1-1202 2.62-5/h 1 2.62-5 Heat Exchanger Rupture / Excessive 1-1204 6.69-7/h 1,096 7.33-4 Leakage During Operation i
| |
| Spray Header Plug During Operation 1-1206 7.06-8/h 1 7.00-8 Pump Out of Service 4-320 1.26-4/h 41 5.16-3 Maintenance NOTE: Exponential notation is indicated in abbreviated fons; i.e., 3.36-8 = 3.36 x 10-8 ah = hour; d = demand.
| |
| bMTTR = mean time to repair or mean time between inspections or mission time.
| |
| l
| |
| | |
| Table A.10-6 CONTAIN".ENT SPRAY SYSTEM RECIRCULATION MODEL Component Failure Mode (s) Type-Kind Failure MTTRb Unavailability Raten Manual Valve Transfer Open/Close 1-1212 3.36-8/h 23 7.73-7 During Operation Motor-Operated Failure to Operate on 1-1209, 4.30-3/d 4.30-3 Valve Demand 1-1207 Transfer Open/Close 1-1209, 1.32-7/h 23 3.04-6 During Operation 1-1214 Check Valve Reverse Leakage During 1-1208, 6.42-7/h 23 1.48-5 Operation 1-1211
| |
| ;g Air-Operated Failure to Operate on 1-1217 3.40-3/d 3.40-3 4 Valye Demand Failure During Operation 7.82-7/h 23 1.80-5 Pump Failure to Start on- 1-1210 2.12-3/d 2.12-3 Demand Failure to Run 1-1210 2.62-5/h 23 6.03-4 Spray Header Plug During Operation 1-1215 7.06-8/h 23 1.62-6 Fan Roon Cooler Failure to Start 1-1216 7.99-4/d 7.99-4 Failure During Operation 1-1216 8.85-6/h 23 2.04-4 l Heat Exchanger Rupture / Excessive 1-1213 6.69-7/h 23 1.54-5 i Leakage During Operation NOTE: Exponential notation is indicated in abbreviated form; i.e., 3.36-8 = 3.36 x 10-8, an = hour; d = demand.
| |
| bMTTR = mean time to repair or mean time between inspections or mission time.
| |
| I
| |
| | |
| i A.10.4.2 Test and Inspection Contribution. Pumps are tested in the .
| |
| recirculation mode once per quarter. The pumps are tested only one at a time.
| |
| During the test the pump is considered unavailable. The test is considered to
| |
| - -last 30 minutes so pump unavailability during testing is 2.28 x 10~4 This unavailability is included in the type 4 pump maintenance unavailability operator i of the injection model and is small compared to the pump maintenance unavailability contribution.
| |
| l A.10.4.3 Maintenance Contribution. The CSS pump maintenance contribution is:
| |
| Maintenance Frequency = 1.26 x 10-4 events / hour Mean Duration = 40.8 hours
| |
| * Unavailability = 5.16 x 10-3 The pump maintenance contribution is applied to the injection model using a ,
| |
| type 4 operator which quantifies pump maintenance unavailability for only one pump at a time. Pump maintenance unavailability is the leading dominant contributor to the fault sets of the injection model shown in Table A.10-2.
| |
| L F
| |
| L i
| |
| i
| |
| *The value used for duration is ir. correct. It is for a 7-day out-of-service limit, not a 2-day out-of-service limit. Since this does not affect the demonstration of GO methodology, it was not accounted for in the logic model used for quantification.
| |
| i I
| |
| i A.10-22 1
| |
| - - - - _ _ _ _ _ _ . _ _ . - ~ _ _ _ , - . . , _ - _ , _ _ _ .
| |
| | |
| A.11 AUXILIARY SYSTEMS SAFETY ANALYSIS A.11.1 Introduction A.11.1.1 System Definition.
| |
| A.11.1.1.1 Overview. The auxiliary systems analysis is a combination of five systems that supply auxiliary support functions to the main line safety systems (i.e., auxiliary feedwater system, emergency core cooling system, etc.). The five systems are: (1) the electric power system (EPS),
| |
| (2) the essential raw cooling water (ERCW) system, (3) the component cooling system (CCS), (4) the compressed air system (CAS), and (5) the engineered safety features actuation system (ESFAS). These systems are defined as auxiliary support because they do not supply any direct mitigating functions for safety event sequences. They supply support (indirect) functions essential to the operation of the main line systems.
| |
| The a'uxiliary system is a two-unit system modeled for its impact on Unit 1 only. ERCW, CCS, and CAS are shared between both units and require electric po er from both units; therefore, both Unit 1 and Unit 2 electric power systems are modeled. ESFAS has two separate systems, one for each unit; only Unit 1 ESFAS is modeled here.
| |
| A.11.1.1l2 Purposes of analysis. There are two purposes of the auxiliary systems analysis. The first purpose is to identify system interdependencies within the auxiliary systems and to account for these dependencies within
| |
| 'he t auxiliary model. In this manner, the auxiliary systems interactions are identified. The second purpose is to analyze the interdependencies between the auxiliary support systems and the main line systems. In this manner, the relationship between the auxiliary support systems and the main line systems can be identified and analyzed in greater detail.
| |
| A.11.1.2 Analysi_s Doundary Conditions / Initial Conditions. The auxiliary systems analysis boundary conditions and initial conditions are the same as those specified for each individual system that belongs to the auxiliary system.
| |
| A.11.1.3 System Analysis Results. The auxiliary model analysis results are shown in Table A.11-1. Due to the symmetrical nature of the electric power system, the resultant unavailabilities of similar power boards are identical as expected. This is also exhibited in the ESFAS and ERCW output but not in the CCS output.
| |
| A.11-1
| |
| | |
| L Table A.11-1 SEQUOYAH SAFETY AUXILIARY MODEL Signal DeJcription Unavailability Electric Power System 34, 35, 44, 45 6.9 kV Shutdown Board 1.55-4 6, 7, 11, 12, 16, 17, 480V Shutdown Board 1.96-4 21, 22 8, 9. 13, 14, 18, 19, 480V Reactor Building 2.19-4 23, 24 MOV Board 54, 55 480V Containment and 2.42-4 Auxiliary Vent Board 84, 85 480V Auxiliary Building 8.59-4 Common Board 38, 39, 48, 49 125V DC Vital Battery 2.30-5 Board 31, 33, 41, 43 120V AC Vital Instrument 2.03-5 Power Board 32, 42 250V DC Battery Board 2.29-5 37, 47 250V Oc Turbine Building 3.26-5 Board Component Cooling System 71 Safety Supply Header 1A 3.99-4 75 Safety Supply lleader 10 8.28-3 Essential Raw Cooling Titer 5./ stem 66, 67, 68, 69 Diesel Generator Supply 3.67-4 Header 50, 51, 52, 53 Other Users Supply Header 3.70-4 64 Component Cooling System 3.63-4 Heat Exchanger A NOTE: Exponential notation is indicated in abbreviated form; i.e.,
| |
| 1.55-4 = 1.55 x 10-4 A.11-2
| |
| | |
| m Table A.11-1 (continued) i Signal Description Unavailable 65 Component Cooling System 3.73-4 Heat Exchanger C l' Control Air System l 70 Control Air Supply 5.87-5 l
| |
| l Engineered Safety l Features Actuation System 109, 110 Reactor Trip 5.09-4 111, 112 ERCW Pump Activation 5.09-4 118 Turbine Trip 5.04-8 123, 124 Safety Injection 2.65'4 NOTE: Exponential notation is indicated in abbreviated form; i.e.,
| |
| 3.73-4 = 3.73 x 10-4 l
| |
| A.11-3 I
| |
| | |
| T f
| |
| The CCS safety supply header IB has a higher unavailability than the 1A header ,
| |
| because the 1A header is supplied during nomal operation, whereas the IB header is not. To be successful, this requires a pump to start and valves to open on demand for 18,'which causes a higher unavailability.
| |
| A.11.2 . System Description A.11.2.1 Accident Mitigation Function. The auxiliary system function is to !
| |
| supply all of the required support functions of the main line systems listed below:
| |
| e Auxiliary Feedwater System (AFWS) e Emergency Core Cooling System (ECCS) l e Containment Spray System (CSS) e Reactor Trip System (RTS)
| |
| The support requirements are fulf t11ed by the five auxiliary systems output functions listed below:
| |
| e Electric Power e Essential Raw Cooling Water ;
| |
| s e Component Cooling Water e Compressed Air t
| |
| e Engineered Safety Features Actuation Signal A.11.2.2 System Success Criteria. The success criteria of the auxiliary model [
| |
| are composed of two parts: (1) the success criteria within each individual system, and (2) the success criteria between each of the systems. The success ;
| |
| criteria within each system are defined in Sections A.2 through A.6 and remain i
| |
| the same for the auxiliary system model. The success criteria between systems consist of the essential system interdependencies defined in the next section.
| |
| These essential interdependencies are required for successful operation of the ;
| |
| auxiliary support functions.
| |
| t I
| |
| p i
| |
| A.11-4 I
| |
| i
| |
| _______,_)
| |
| | |
| A.11.2.3 System Configuration.
| |
| A.11.2.3.1 Major components. The major constituents of the auxiliary system are the five systems listed below:
| |
| e Electric Power System (see Section A.2.2.3.1) e Essential Raw Cooling Water System (see Section A.3.2.3.1) e Component Cooling System (see Section A.4.2.3.1) e Compressed Air System (see Section A.5.2.3.1) e Engineered Safety Features Actuation (see Section A.6.2.3.1)
| |
| These systems are treated as the major components of the auxiliary model.
| |
| For information concerning the major components of these systems, please refer to the appropriate section above. A simplified block diagram of the auxiliary system is shown in Figure A.11-1. The arrows portray the essential interdependencies and output of the auxiliary systems. The essential dependencies are listed in Table A.11-2. The classification of essential and nonessential dependencies is discussed below:
| |
| e Electric Power System Dependencies. The EPS requires ERCW for cooling of the diesel generators and shutdown board room coolers. These dependencies are considered essential while all other ERCW cooling functions for the EPS are considered nonessential. The ERCW system analysis (see Section A.3) can be referenced for a listing of EPS cooling loads supplied by ERCW. Most of these loads are space cooling requirements which are considered nonessential because of the short duration of the safety study period (24 hours). These loads are considered not to have a significant effect over a 24-hour period.
| |
| The EPS also has a nonessential dependency on ESFAS for actuation of the diesel generators during an event sequence.
| |
| This is considered nonessential because the diesel generators can also be activated by signals within the EPS which are considered essential.
| |
| e JEn incered Safety Features Actuation System. ESFAS requires only elec[i tc power for operaffon. The electric power dependencies are on 125V DC vital battery boards ! and !!,
| |
| and 120V AC vital instrument power boards 1-1, 1-11, 1-!!!,
| |
| and 1-IV, e Essential Raw Cooling Water System. The ERCW system is
| |
| ~ dependent upon elec[rfc power and ESFAS. Electric power is needed from all four (Units 1 and 2) 6.9 kV shutdown boards for pump operation. Power is also required from all four 480V ERCW motor control centers (HCC) for traveling screens, A-11-5
| |
| | |
| I I
| |
| OFFSITE POWER ELECTRIC POWER SYSTEM
| |
| ; AC POWER DC POWER CONTROL AND INSTRUMENTATION POWER J
| |
| I 1P 1r U 1r 7 ENGINEERED f os ESSENTIAL RAW COMPONENT COMPRESSED AIR SAFETY j COOLING WATER 4- -> COOLING 4- -> SYSTEM 9- FEATURES ,
| |
| ; SYSTEM WATER SYSTEM ACTUATION SYSTEM i l I
| |
| ! I I I 1
| |
| 1 1
| |
| 1r 1P If lf 1r ELECTRIC ESSENTIAL COMPONENT COMPRESSED ENGINEERED POWER RAW COOLING AIR SAFETY COOLING WATER FEATURES WATER ACTUATION I
| |
| s Figure A.11-1. Simplified Auxiliary Systems Diagram l
| |
| i
| |
| | |
| -p l
| |
| . Table A.11-2 l AUXILIARY SYSTEMS DEPENDENCIES Page 1 ef 4
| |
| * Aust11ary Systems Main Line Systems Aa 11tary Support Engineered t
| |
| Output Electric Conoonent Compressed Safety Auxilfary CY Power y
| |
| ,,j g Cooling Air Features Reactor Trip Feessater $ Containment SP '*J Actuation Cooling Electric Penser Systen 6.9 kV SNteswa Board 1A-A X X X X 6.5 kV Shut &3ws Board 18-8 I X X X 5.9 kV 5%tdows Board 2A-A X 6.9 kV Shutsows Board 25-8 X 480V EROW MCC 1A-A I 2=
| |
| , 480V EROW MCC 13-8 X
| |
| ~
| |
| 4 480V ERCW MCC 2A-A X 480V ER0d MCC 25-8 X 480V Shutdown Board 1Al-A I 490V Shut & nam Board 1A2-A X 480V Shutdows Board 151-8 X X 48CV Shutd)wm Board 2B2-8 X 4aCV Reactor Sutiding MCV X X X Board 1Al-A 48CV Reactor Buf1 ding WV X X X X Board IA2-A 43CV Reactor Ba11 ding MCV I X X Soard 151-8 480V Reactor Batiding ICV X X X Soard 182-8 SM Reactor Building POV X Soard 2A2-A
| |
| | |
| Table A.11-2 (continued)
| |
| Page 2 of 4 Auxiliary Systems Main Line Systems Austif ary Support Engineered Output Electric Power
| |
| ,I,7, ,
| |
| Component Cooling Compmssed Air Safety Features Reactor Trip Auxiliary Feeevater f,"C# Containment Spray y,97 Cooling Actuation 480V Reactor Building ICV X Soird 232-8 4 SOY Containment and Auxiliary L X X Building Vent Board 1Al-A 48CV Containnent and Auxiliary X Building Vent Board 2Al-A 480V Containment and Aux 111ary I X X Su11 ding Vent Board 181-8 480V Containment and Auxiliary X Ballding Veet Board 291-8 3=
| |
| * 480V Auxiliary Building Commen 1 C Board A 480V Auxiliary Butiding Comon X Board 8 125V DC Vital Battery Board 1 I X X 125V DC Vital Battery Board Il X X X X X 125V DC Vital Battery Board III I 120V AC Vital Instrument X I X Power Board 1-1 120V AC Vital Instrument X X X Power Board 1-II 120V AC Vital Instrument X X Power Board 1-111 120V AC Vital Instrument X X Power Board 1-IV 120V AC Of stribution Panel 1-A X i
| |
| | |
| s 1 4
| |
| Table A.11-2 { continued)
| |
| Page 3 of 4 Aust11ary Systems Main Line Systems Aguillary Support Engineered Output Electric ,Ea Coo ng Component Compressed Safety Reactor Auxiliary ,]"CY Containment ,
| |
| Power ooMag Air Features Trip h eter 3P#8#
| |
| Water Actuation Cooling Essential Ram Cooling Water System Diesel Generator Supply X Header IA Diesel Generator Supply X Iteader 2A Diesel Generator Supply X
| |
| * Header 18 Diesel Generator Supply X
| |
| , Hender 29 e.*
| |
| 7 Cther Users Supply 1A X X X X e
| |
| Other Users Supply 15 X X X X Componest Cooling Heat X Exchanger A Component Cooling Heat X Exchanger C +
| |
| Component Cooling System Safety Header IA X X Safety Header 18 e X X Auxilf ary Feeesater Pumproom Cooling X*
| |
| Compressed Air System Control Air Supply X '
| |
| Engineered Safety Features Actuation System Reactor Trip A X
| |
| *The consonent cooline and austitary feeesater pumps are in the same pumproom and utfitze the same pugroom coolers. Therefore, pumproom cooling is modered only in thf Cagement cooling system and the dependency carried over the AFW system.
| |
| | |
| 1 4
| |
| . f o t n
| |
| 4 e m#
| |
| e g
| |
| n*
| |
| i' a aP P tS n
| |
| o C
| |
| y c g n n s ei m l X X e o t
| |
| s o
| |
| C y E S
| |
| e n yr i
| |
| L re at n ia l w X X X ia id M xe ue AF r
| |
| o tp ci X ar eT R m d
| |
| e ryeo sn etri eeut
| |
| ) nft a iaau d gSet e E n Fc A
| |
| u n
| |
| i d
| |
| t e n s s
| |
| o er c ri
| |
| ( pA m
| |
| o 2 s C
| |
| - e e
| |
| 1 t 1 s t ng y
| |
| A S en '
| |
| ni y ol s X X e r po l
| |
| a mo i oC b l C a i x
| |
| T u A 9 II 7 C,
| |
| 3 X X y
| |
| Ea g i
| |
| c rr te cw eo lP E
| |
| p A B m
| |
| u p p P m u m uP A 8 W
| |
| F P A B t
| |
| -- n n A W F
| |
| W F A B n n i i
| |
| :- i i n A A a a
| |
| :- a a e n ni r r
| |
| :- r r v n n ia a T T
| |
| --.t T T ir e e Cup v v r rT n o on o on n D i i T yt 8 - r r i i ru p i i te 0 n D n no o
| |
| t c c t
| |
| aO t a a r i i e e i i i r l r v v b o ot t t c
| |
| j j n n a oM oM jej e c i T i i r t x t t I i u r A o c Ac T A n n y y t t t t I I t t c
| |
| a C W W r a
| |
| r a
| |
| r a
| |
| e f e
| |
| e R C t t C C C f
| |
| a a R t C R E E S S S E E S S 2 8
| |
| | |
| E ,
| |
| wash pumps, and other requirements. 480V reactor building
| |
| ~
| |
| motor-operated valve (MOV) boards 1A2-A and 2A2-A are required for. essential valve operations. - The ESFAS system is required for automatic starting of pumps during a loss of offsite power condition in an event sequence.-
| |
| e Component Cooling System. The component cooling system is dependent upon the EP5, ESFAS, and ERCW systems. The pumps require power from the 480V shutdown boards and the MOVs require power from the 480V reactor building MOV boards. The
| |
| .ERCW system supplies cooling water for the CCS heat exchangers and pumproom coolers. The ESFAS system supplies safety injection signals required for automatic pump start and valve alignment of the safety system loads.
| |
| e Compressed Air System. The compressed air system requires electric power for operation of air compressors and instrumentation and ERCW for cooling requirements.
| |
| 'A.11.2.3.2 Support systems. The auxiliary system depends only upon offsite power for support. The electric power system requires offsite power for operation when both units are not generating power.
| |
| A.11.2.3.3 Interfacing systems. The auxiliary system interfaces directly with the main line systems (reactor trip system, auxiliary feedwater system, emergency core cooling system, and containment spray system). The support requirements of the main line systems are detailed in Sections A.7 through A.10 and shown in Table A.11-2. There is one exception where the auxiliary
| |
| .feedwater. system is dependent upon the component cooling system for pumproom cooling requirements. This is because the component cooling pumps and motor-driven auxiliary feedwater pumps occupy the same pumproom and rely upon the same pumproom coolers. Therefore, the pumproom coolers are modeled in the component cooling system with the auxiliary feedwater pumps dependent upon successful room cooling within the component cooling system model.
| |
| A.11.3 System Logic Models A.11.3.1 Failure State Top Event Definition.
| |
| A.11.3.1.1 Analysis boundary coaditions. The failure state top event definition is failure to supply adequate support for successful operation of the main line safety system functions. The support requirements may vary for each initiating event sequence model but the success definition applies to all event sequence models.
| |
| A.11-11
| |
| | |
| l i
| |
| l The auxiliary model is set up to be quantified for two boundary conditions although only one is used in the event sequence quantifications. Tne
| |
| , auxiliary system is not quantified for a loss of offsite power initiating event and quantified for all other initiating events. The loss of offsite power initiating event is not included in this study's initiating event sequence models, therefore is not quantified.
| |
| A.11.3.2 G0 Model. The auxiliary system G0 model is shown in Figure A.11-2.
| |
| Each block represents a supertype which has a number and is described in Table A.11-3. Table A.11-3 also identifies the system the supertype belongs to and can be referenced for explanation of the GO model structure within a supertype. The auxiliary model is only concerned with the structure between the supertypes and not within the supertypes and therefore will only talk about' the structure within a supertype where it is necessary to explain the structure of the auxiliary model.
| |
| Of all the supertypes in Table A.11-3, only one (supertype 185) was created for use in the auxiliary model and will not appear in any system analysis.
| |
| Supertypes 240, 250, and 260 do appear in the electric power system analysis but were slightly modified for use in the auxiliary system model. Supertypes 400 and 401 are the ERCW system model split in half for modeling convenience. All the rest of the supertypes remain exactly as they appear in the systems analyses.
| |
| Each supertype block has signals coming in and going out. These signals are connected to particular parts within the supertype itself that are designated by dummy input / output numbers within the boundary of the supertype block (see Figure A.11-2). These dummy numbers represent input if the dummy number is
| |
| < 200 and represent output if the dummy number is > 200. For example, supertype 170 has four input (101,103,106,107) and five output (202, 204, 207, 209,210) numbers. The structure of the auxiliary model is such that in general input is shown on the tops and sides of the supertype blocks and output is shown on the bottom of the supertype blocks with the signal flow going from the top to the bottom of the diagram. Each supertype 205 has only one input on top and one output at the bottom.
| |
| The signal numbers that connect each block and represent a system function output are listed in Table A.11-4. The signal numbers that are not in Table A.11-4 are only used within the auxiliary model and their function will be explained below.
| |
| A.11-12
| |
| | |
| 5
| |
| .s. 3
| |
| . , .. ~- -
| |
| "I l !
| |
| !l lI*
| |
| a m m
| |
| :=,- ss - --s
| |
| .I. .i .l .6 .I .i. .i .1 6 .I .i .I .i. .i.
| |
| _ t .
| |
| 1 e ..
| |
| 1IIIII e n
| |
| -s. s 33.- - .-
| |
| I .i. .i.
| |
| . -i I i. .i .i .i.. .i .i i .i.... .i .i .4
| |
| ._ a a _ _ .
| |
| l
| |
| ,,, m --
| |
| ~* ~
| |
| m -
| |
| 3 . . . . . . . .
| |
| I ,
| |
| 1
| |
| . - --. IIIIi!fliIIII L - --~~-- ,
| |
| w ,, g .- ~.~.~.~. -
| |
| l[i ij. .
| |
| !1 q. .
| |
| q -
| |
| , i i ii, . ....
| |
| ~~~~
| |
| II i fI
| |
| -m, 4
| |
| .m-- -
| |
| = l l = . .. ..
| |
| - 2 -m"* i
| |
| *m- 2
| |
| ~
| |
| fIIIIIifIffI l . .
| |
| I I I i 1
| |
| _ u. e ma -
| |
| sass a. s s ssss s so. s
| |
| . .i . .i . .i. .i. l .i. .i. .. .
| |
| i l l
| |
| ~ l
| |
| - [.g
| |
| , s.s-
| |
| =
| |
| 8, I l
| |
| . .i. .i .i. .l .i. .i. . .
| |
| l Figure A.11-2. Auxiliary Systems GO Model
| |
| | |
| -2 Table A.11-3 AUXILIARY MODEL SUPERTYPES Supertype ~ System Description 150 EPS_ 125V DC Battery Board 170- EPS 125V DC and 120V AC I&C Power System
| |
| -175 EPS 250V DC I&C Power System 180 EPS 480V Shutdown Boards and MCCs 185- -* .ERCW and Electrical Dependency 190 EPS Start Buses, 6.9'kV Unit and Shutdown Boc.rds 205 EPS 480V Containment and Auxiliary Vent Boards 210 -EPS Common Boards 230 EPS Board Room Chillers and A/C System 240 EPS** ERCW to Diesel Generator C-S 250 EPS** ERCW to Diesel Generators 1A-A, IB-B, 2A-A, 2B-B
| |
| '260 EPS** Diesel Generator Availability 300 CAS Control Air System 400 ERCW** ERCW System to Diesel Generator Supply 401 ERCW** ERCW to CCS Heat Exchangers and Other Supply 500 CCS CCS 600 ESFAS ESFAS
| |
| *Supertype model created for use in the auxiliary system model only.
| |
| **Supertype models modified for use in the auxiliary system model.
| |
| A.11-14
| |
| | |
| c
| |
| ? -.
| |
| - Table A.11-4
| |
| . AUXILIARY MODEL SIGNAL DESIGNATIONS System Signal.
| |
| Electric Power 6.9 kV Shutdown Board 1A-A 34 6.9 kV Shutdown Board 1B-B 35 6.9 kV Shutdown Board 2A-A 44
| |
| '6.9 kV Shutdown Board 2B-B 45 480V Shutdown Board 1Al-A 6 480V Shutdown Board 1 A2-A 7 L 480V Shutdown Board 181-B 11 480V Shutdown Board 1B2-B 12 480V Shutdown Board 2Al-A 16 480V Shutdown Board 2A2-A 17 480V Shutdown Board 2B1-B 21 480V Shutdown Board 2B2-B 22 480V Reactor MOV Board 1Al-A 8 480V Reactor MOV Board 1A2-A 9 480V Reactor MOV Board 1B1-B 13 480V Reactor MOV Board 182-B 14 480V Reactor MOV Board 2Al-A 18 480V Reactor MOV Board 2A2-A 19 480V Reactor M0V Board 2B1-B 23 480V Reactor MOV Board 2B2-B 24 A.11-15
| |
| | |
| y
| |
| .x..
| |
| Table A.11-4 '(continued) b system signal
| |
| ' Electric' Power 480V Containment and Auxiliary 98 Vent Board 2Al-A ,,
| |
| s
| |
| '480V Containment and Auxiliary 54 -
| |
| Vent Board 2Al-A 480V Containment and Auxiliary 99 Vent Board 181-B 480V Containment and Auxiliary 55
| |
| - Vent Board 281-B 480V Auxiliary Building Common 85 Board A 480V Auxiliary Building Common. 84 Board B 125V DC Vital Battery Board I 38 125V DC Vital Battery Board II 39
| |
| - 125V DC Vital Battery Board III 49 125V DC Vital Battery Board IV 48 120V AC. Vital Instrument Power 31 Board 1-1 120V AC Vital Instrument Power 33 Board 1-11 120V AC Vital Instrument Fower 43 Board 1-III -
| |
| 120V AC Vital Instrument Power 41 Board 1-IV 120V AC Distribution Panel 1-A 36 120V AC Distribution Panel 2-G 46 250V DC Battery Board I 32 A.11-16
| |
| | |
| E
| |
| )
| |
| l 1
| |
| l Table A.11-4 (continued)
| |
| System Signal Electric Power 250V DC Battery Board II 42 250V DC Turbine Building Board 1 37 250V DC Turbine Building Board 2 47 ESFAS (Supertype 600)
| |
| Reactor Trip A 109 Reactor Trip B 110 ERCW Train A 111 ERCW Train B 112 Start Turbine-Driven Auxiliary 113 Feedwater Pump Start Motor-Driven Auxiliary 114 Feedwater Pump Train A Start Motor-Driven Auxiliary 115 Feedwater Pump Train B ECC Injection Train A 116 ECC Injection Train B 117 Turbine Trip 118 Trip Main Feedwater Pumps 119 Close Main Feedwater Isolation Valves 120 Train A Close Main Feedwater Isolation Valves 121 Train B Steamline Isolation 122 Safety Injection Train A 123 A.11-17
| |
| | |
| Table A.11-4 -(continued)
| |
| System Signal ESFAS (Supertype 600)
| |
| Safety Injection Train B 124 Con.ponent Cooling (Supertype 500)
| |
| Safety 1A 71 Safety 1B 75 i
| |
| 72 AFW and Pump)
| |
| IB Space Coolers (Pumps 1A l Miscellaneous Header 73 Reactor Building Header 74 Thermal . Barrier Booster Pumps 76 ERCW (Supertype 400 and 401)
| |
| Diesel Generator Supply Header 1A 66 Diesel Generator Supply Header 2A 67 Diesel Generator Supply Header 1B 68 Diesel Generator Supply Header 2B 69 Other Users Supply 1A 50 Other Users Supply 1B 51 Other Users Supply 2A 52 Other Users Supply 2B 53 CCS Heat Exchanger A 64 CCS Heat Exchanger C 65 i
| |
| Control Air (Supertype 300) 70 A.11-18
| |
| | |
| The electric power system and ERCW system are shown on the left side of Figure A.11-2. The dependency between the EPS and ERCW system requires these systems to be integrated. On the right side of the same figure, starting from top to bottom, is the instrumentation and control (I&C) power portion of the EPS (supertypes 170 and 175), the ESFAS model (supertype 600), the CCS model (supertype 500), and the CAS model (supertype 300).
| |
| The auxiliary model starts at the top left side with signal generator 5-116 and output signal 1 that represents offsite power. The ERCW system (supertype 400),
| |
| CCS (supertype 500), and I&C power (supertypes 170 and 175) all are dependent on signal 1. ERCW and ESFAS require signal 1 in order to account for the pumps' failure to restart subsequent to a loss of offsite power event. The I&C power system receives its normal source of power from the 480V shutdown boards (supertypes 180). The I&C power system output is needed for control of the EPS.
| |
| In order to model this loop dependency it is assumed the normal source of power for the I&C power system is available for all cases except for loss of offsite power. For the loss of offsite power case, only the I&C batteries are available, which makes the analysis conservative because of the exclusion of the diesel generators as an alternate source of power to the normal supply (480V shutdown boards). This is explained in greater detail in the EPS analysis.
| |
| The output of signal generator 5-116, representing offsite power, goes to a 1-177 operator which represents the unavailability of offsite power subsequent to another initiating event. Representing offsite power in two cperators allows the model to be quantified for a loss of offsite power initiating event or all other .
| |
| initiating events with the possibility of loss of offsite power subsequent to any of these initiating events.
| |
| Continuing down the model, we come to three 1-63 operators which represent the comon station service transformers. The output of these three transformers goes to both supertypes 190. Each supertype 190 represents the 6.9 kV portion of each unit's EPS. Supertypes 240, 260, and 230 provide input to both supertypes 190 along with the I&C power dependencies explained previously. Supertype 230 represents the room cooling requirement of the 6.9 kV shutdown boardrooms. Since the room coolers are dependent upon ERCW and 480V power, it is assumed these are present in order to model this loop dependency. The room coolers also are dependent upon offsite power (signal 1) which controls the restart of the room coolers if loss of offsite power occurs. Supertypes 240 and 260 represent the A.11-19
| |
| | |
| l availability of the diesel generators. Supertype 260 is shown in Figure A.11-3
| |
| .which includes the diesel generator availability states quantified.
| |
| Supertype 240 represents the ERCW dependency for the spare diesel generator.
| |
| Since the spare diesel can be lined up to either unit and can be supplied ERCW from either unit train A or train B ERCW supplies, we assume the ERCW supply is present. ' The output of supertype 240 is input into an "AND" gate at the output of the spare diesel generator signal shown in Figure A.11-3. The four output of supertype 260 90 to all four 6.9 kV shutdown boards within supertypes 190.
| |
| The output of supertypes 190 are the 6.9 kV shutdown boards (signals 2, 3, 4, and 5) and the ERCW 480V motor control centers (signals 10, 15, 20, and 25).
| |
| Signals 02 and 83 of Unit 2 supertype 190 go to the common boards of supertypes 210. The 6.9 kV shutdown board output go to both supertype 400 (ERCW pumps) and supertype 185 while the ERCW 480V motor control centers go to
| |
| 'supertype 400 only. The output of supertype 400 are the four ERCW headers which supply cooling water to the diesel generators. Each diesel generator has a set of ERCW supply valves, represented in supertypes 250 (Figure A.11-4), each of which receives water from two ERCW supply headers. The output of each supertype 250 goes to a supertype 185 which contains the logic needed to represent the ERCW water for diegel generator cooling dependency.
| |
| The logic for supertypes 185 is shown in Figure A.11-5. To explain how the logic
| |
| - works, we portray the dependency in a simplified manner in Figure A.11-6 with a rimplified model shown in Figure A.11-7. For 6.9 kV shutdown board 1A-A, signals 101 and 2 would be coming from supertype 190 (Unit 1). Signal 101 represents the normal offsite power supply to the shutdown board and signal 2 represents the output of the'6.9 kV shutdown board without the ERCW dependency.
| |
| Signal 2 is input to supertype 400 (ERCW pumps) which goes to supertype 250 (ERCW valves) which gives signal 86 outplit. Supertype 185 (Figure A.11-5) takes 1 signals 86,101, and 2 and uses the logic shown to include the ERCW dependency.
| |
| The logic of the simplified model (Figure A.11-7) shows that if the offsite power supply is supplying the 6.9 kV shutdown board, signal 101 is successful. If signal 101 is successful at the "0R" gate input, signal 86 is not required; therefore the ERCW dependency is not included. If signal 101 is failed and signal 2 is successful, the diesel generator is supplying power to the 6.9 kV shutdown board. Signal 2 supplies power to the ERCW system which supplies water for the diesel generator at signals 86. The "0R" that combines signals 86 and 101 can only be successful if 85 is successful since 101 has failed. Therefore, A.11-20 1
| |
| | |
| D.G.1 A 2 D.G. AVAILABILITY TO BOARD 1 A-A D.G.18
| |
| ; 2 D.G. AVAILABILITY TO BOARD 18 B
| |
| ~
| |
| 4 17 ; 10 100 ST 240 D.G* 2A 202
| |
| ; 2 D.G. AVAILABILITY TO BOARD 2A-A
| |
| ; 2 D.G. AVAILABILITY TO BOARD 28 B 4175 D.G. AVAILABILITY STATES BLE SPARE 1A IB 2A 2B C-S PROBABILITY
| |
| * STATE O O O O O .887376 ALL D.G. AVAILABLE O O O O 1 2.24-2 SPARE UNAVAILABLE 1 0 0 0 0 2.24-2 1 A UNAVAILABLE - SPARE AVAILABLE O 1 0 0 0 2.24-2 IB UNAVAILABLE -SPARE AVAILABLE O O 1 0 0 2.24-2 2A UNAVAILABLE - SPARE AVAILABLE O O O 1 0 2.24-2 28 UNAVAILABLE - SPARE AVAILABLE 1 0 0 0 1 1.56-4 1A UNAVAILABLE - SPARE UNAVAILABLE O 1 0 0 1 1.56-4 IB UNAVAILABLE - SPARE UNAVAILABLE O O 1 0 1 1.56-4 2A UNAVAILABLE - SPARE UNAVAILABLE O O O 1 1 1.56-4 2B UNAVAILABLE - SPARE UNAVAILABLE ST 240 AND 250 - ERCW SUPPLY TO D.G.
| |
| *2.24-2 = 2.24 x 10-2 D.G. = DIESEL GENERATOR Figure A.11-3. Supertype 260 - Diesel Generator Availability A.11-21
| |
| | |
| 100 1 154 1 151 1 180 1-180 1 151 MOV CHECK MANUAL MANUAL CHECK VALVE VALVE VALVE VALVE 2 2 2 7
| |
| 101
| |
| ,r' 1 154 1 151 1 180 1 180 1 151 MOV CHECK MANUAL MANUAL- CHECK VALVE VALVE VALVE VALVE I
| |
| Figure A.11-4. Supertype 250 - ERCW Valving for Diesel Generators
| |
| | |
| I 6.9kV SHUTDOWN BOARD . 6.9kV SHUTDOWN BOARD ERCW DEPENDENCY 101 100 ERCW DEPENDENCY .
| |
| FOP. DIESEL GENERATOR 3 FOR DIESEL GENERATOR -
| |
| r 102 37_
| |
| ? 2 10 '10 2
| |
| ; = J U 105 ,.
| |
| 9g NORMAL FEEDER FROM V 9F NORMAL FEEDER FROM i2 6.9kV UNIT BOARDS 201 6.9kV UNIT BOARDS 200 I
| |
| 6.9kV SHUTDOWN BOARD 6.9kV SHUTDOWN BOARD TO LOADS .TO LOADS Figure A.11-5. Supertype 185 - Diesel Generator, ERCW Dependency Logic g
| |
| ./
| |
| I t
| |
| | |
| 4 e
| |
| l'
| |
| -H^ > COOLING WATER FOR DIESCL ERGV GENERATORS PljMP NORMAL n OFFSITE POWER m OTHER LOADS
| |
| * DIESEL ^
| |
| GENERATOR n 6.9 kV BUS COOLING WATER FROM 4 ERCW Figure A.11-6. Simplified Diagram of Diesel Generator - ERCW Dependency A.11-24
| |
| | |
| '1 c
| |
| 'N ERCW SYSTEM WATER SUPPLY 86 TO DIESEL GENERATOR ST 400 AND ST 250 NORMAL V
| |
| OFFSITE 101 m [
| |
| "(2
| |
| ~
| |
| POWER SUPPLY BREAKER y U 34 6.9 kV 2
| |
| 1 ? [10 --> POWE R C2 JL d-6.9 kV TO LOADS 3 DIESEL BUS
| |
| - GENERATOR -
| |
| U POWER BREAKER ST 190 SUPPLIES COOLING DIESEL SUPPLIES POWER m ELECTRIC SUPPLIES POWER m ERCW WATER m DIESEL GENERATORS POWER BUSES PUMPS " GENERATORS Figure A.11-7. Sirnplified G0 Model Of Diesel Generator - ERCW Dependency
| |
| | |
| ' signal 34 can only be successful if, and only if, signal 2 and signal 86 are successful. There is one simplifying assumption made in order to model this loop dependency; that is, the ERCW pumps can be supplied 6.9 kV power without the ERCW dependency.
| |
| The 6.9 kV shutdown board output of supertypes 185 goes to the 480V shutdown boards of supertypes 180. Supertypes 205 are the 480V auxiliary and. containment vent boards. Supertype 401 represents the remaining ERCW valving necessary to supply water for the rest of the ERCW load,. This valving receives water from output 66, 67, 68, and 69 of supertype 400 along with EPS output for valve operation. Supertype 401 output represents water for the CCS heat exchangers and other users.
| |
| Supertype 600 represents the ESFAS model and receives input from I&C power for operation. ESFAS output goes to the systems which require activation signals.
| |
| Supertype 500 represents the CCS model. The CCS model requires electric power, ERCW, and ESFAS for operation. Supertype 300 represents the CAS model. The CAS model also requires electric power and ERCW for operation.
| |
| A.11-26
| |
| | |
| Appendix B EVENT SEQUENCE DIAGRAM (ESD) AND G0 MODELS Figures B-1 through B-13 give the ESD safety logic for the following 13 initiating events:
| |
| ESD- Initiating Event 1 Large Loss of Coolant Accident (LOCA) 2 Medium LOCA 3 Small LOCA 4 Steam Generator Tube Leak 5 Loss of Reactor Coolant System (RCS) Flow 6 Loss of Feedwater Flow 7 Total Loss of Steam Flow 6 Turbine -Trip 9 Spurious Safety Injection 10 Reactor Trip 11 Steam Loss Inside Containment 12 Steam Loss Outside Containment 13 Core Power Excursion Figure B-14, which is labeled ESD 14 for easy identification, is an event tree for anticipated transient without scram (ATWS). Figures B-15 through B-23 are GO models for the logic models in Figures B-1 through B-14. Table B-1 identifies the ways in which the 9 GO models cover the 14 ESD and event tree logic models.
| |
| All of these models were developed using the same techniques as illustrated in Section 4.4 for ESL- 1 and 7 and their corresponding GO models.
| |
| i I
| |
| l l
| |
| B-1
| |
| | |
| :}
| |
| M l LOWERHO. SUMP AND COLD LARGE (p LOCA
| |
| - RWST -
| |
| ACCUMu- - LPI -
| |
| VL/LL -
| |
| LPR ggg [
| |
| s SHUTDOWN j LATORS ORAINS \
| |
| .e .
| |
| COOLING ULPCER~l
| |
| - CSR - - NOT q CONTIN- H BLOCKED c.m (U_EST_J N i
| |
| ! \DE. -
| |
| LOSS OF RHR HE AT EXCHANGER rRADE#
| |
| DUE TO CCS LOSS.
| |
| ** ALL OTHE R LPR F AILURES.
| |
| *** INCLUDES ERCW TO CONTAINMENT SPRAY HEAT EXCHANGE R.
| |
| ACCORDING TO THE SUCCESS CRITERIA LISTED FOR TVE LPR, LPHLR, ANO LPCLR FUNCTBONS, THE TOTAL COOLING DURATION TO BE 01 PROVIDED BY LPHLR ANO/OR LPCLR l$ $ HOURS THIS PUMP RUNNING TIME HAS BEEN ADDED TO THAT REOUIRED FOR THE LPR FUNCTION WHICH MEANS THAT THE GO MODEL WILL ACCOUNT FOR ALL PUMP RUN F AILUMES ASSOCIATED WITH THE LPHLR ANO LPCLR FUNCTIONS IN CONJUNCTION WITH PUMP RUN FAILURES FOR THE LPR FUNCTON. THE SUCCESS CRITERIA ALSO STATE THAT INJECTION REALIGNMENT F ALLURES DURANG LPHLR ARE OF TWO TYPES: (1) EITHER NO HL PATHS ARE ALIGNED AND ALL CL PATHS ESTABLISHED PREVOUSLY REMAIN. OR (2) ONE HL PATH l$ ALIGNED AND AT MOST ONLY ONE CL PATH IS ISOLATED. THEY ALSO STATE THAT LPCLR ACCEPTSWHATEVER INJECTION PATHS ARE AVAILABLE FOLLOWING THE ATTEMPTED LPHLR OPERATION. THIS LEAVES LPCLR AS A DO-NOTHING SLDCsC. AS SUCH,IT IS SHOWN DASHED HERE AND l$ NOT EXPLDCITLY IDENTIFIED IN THE GO MODEL Figure B-1. Large LOCA ESD 1
| |
| | |
| I I MEDIUM SUMP &
| |
| - RWST - HPI -
| |
| LPI -
| |
| UL/LL LPR COLD LOCA -
| |
| DRAINS
| |
| \ SHUTDOWN
| |
| - CSR -
| |
| In d3
| |
| \DE-GRADED
| |
| [ STATE LOSS OF RHR HEAT EXCHANGER DUE TO CCS ALL OTHER LPR FAILURES
| |
| *** INCLUDES ERCW TO CONTAINMENT SPRAY HEAT EXCHANGER Figure B-2. Medium LOCA ESD 2
| |
| | |
| RWST - -
| |
| CS - RM HPl - AFW X hRIP hMAND X=A I- ::. ;;;
| |
| BLEED B -
| |
| AND C ATWS> FEED RWST EMPTIES IN
| |
| * 3/4 R - - 700 SHORT FOR HOU.C;IT ALSO LEAVES OD \DE.
| |
| GRADED THE OPERATOR ONLY '
| |
| * 1 HOUR TO ALIGN FOR [ STATE HPR.
| |
| *** GUARANTEES CSR FAILURE.
| |
| A OP.DEP.
| |
| AND OP ISO.
| |
| . CLOSED LOOP
| |
| [ COLD SHUTDOWN COOL _ UNI RHR \
| |
| par-~
| |
| @ SUMP AND AFW OP- UULL LPR 8 -
| |
| _' ' LPs - - - - -
| |
| RECVR DRAINS GR g - -
| |
| C I SUMP.
| |
| UULL HPR
| |
| @i DRAINS CSR
| |
| \DE.GRADED STATE
| |
| @ RHR HL SUCTION VALVES FAIL, N.B.-- SINCE THE CS DEMAND RATE MAY BE INF LUENCED BY THE OCCURRENCE
| |
| @ ALL OTHER RHR FAILURES. OR NONOCCURRENCE OF BLEED AND FEED, THE POstTIONING OF CS DEMAND MAY
| |
| @ LOS$ OF RHR HEAT EXCHANGER YlELD CONSERVATIVE RESULTS.
| |
| DUE TO CCS LOSS.
| |
| @ ALL OTHE R LPR/HPR FAILURES
| |
| @ INCLUDES ERCW TO CONTAINMENT
| |
| $ PRAY HEAT EXCHANGE R.
| |
| Figure B-3. Small LOCA ESD 3
| |
| | |
| l STM. GEN.
| |
| TUSE LEAK
| |
| + RWST -
| |
| RX TRIP NPI ~ SG SV REW h AF" OP. DEPRESS.
| |
| AND COOL A
| |
| I ATWS -
| |
| BLEED CS OP AND - -
| |
| CS -
| |
| TE RM S FEED DEMAND CS AFW - A PREE W kDEGRADED h / STATE A ISO. ! COLD \ *** 6 HOUR RUN TIME (CONSERVATIVE FOR SOME SCENARIOS).
| |
| UH4 RHR \ SHUTDOWN / RWST EMPTIES IN - 3/4 HOUR. LE AVING THE OPE RATOR ONLY ~ 1 HOUR TO ALIGN FCR HPR.
| |
| h INCLUDES CASE THAT STE AM GENER ATOR SAFETY VALVES OPE R ATOR RECOVERS
| |
| @ DO WT MELY.
| |
| FOR CORE &ENDIRECT AT ALLPATH OUTSIDE CONTAINMENT
| |
| @ MELT ASSUMED, YlELDING CONSERVATIVE, BOUNDING h
| |
| Suw AND @ ANALYSIS.
| |
| ESSENTIALY UNLIMITED TIME TO REACH COLD SHUT-DOWN (s.o., VE RY LOW CHANCE OF F AlLUREl. POSSIBLE B UL/LL - HPR ~
| |
| TO RE ACH IT USING ONLY STE AM GENER ATORS AND DRAINS STE AM DUMPS TO M AIN CONDE NSER. HOLDING V ACUUM WITH HOGGE RS. THis REPRESENTATION IS CONSE RVATIVE.
| |
| (PRO 8 ABLY NOT QUANTITATIVELY IMPORTANT TO SHOW
| |
| \ DEGRADED
| |
| / STATE Figure B-4. Steam Generator Tube Leak ESD 4
| |
| | |
| N f
| |
| W D E E O D T D AA T T U S H
| |
| S
| |
| [
| |
| 8 D
| |
| N g A
| |
| P'y M ,
| |
| U S
| |
| ll 5
| |
| D ll S
| |
| . E 1
| |
| P.
| |
| O w
| |
| o l
| |
| F S
| |
| C R
| |
| f O
| |
| o Y N s 8 A s TD M o MNA L T
| |
| S
| |
| [ D 5
| |
| E D E E B L
| |
| Sf E W F
| |
| A R
| |
| O e
| |
| [
| |
| ll S. N T r
| |
| , P E A g u
| |
| p R 3
| |
| M V tE E U RH P P i
| |
| F
| |
| [
| |
| CT O W W -R E F E F A OIV H A TR T E
| |
| E OD G R M O N v
| |
| a H OT I
| |
| VR.
| |
| S T WE AP M F TL EH
| |
| !l O FS L. R 8
| |
| E OAJ LP RO RI P N RIM UF UR O EA U ON TT Y HV P HG (g N TA W 4/L I
| |
| \/ A ES S
| |
| I SIF 3A E E MA ~O P RI RAN IEE NT MRI IR RT U QSt Q UTV R SU E
| |
| IO E EO R RNC S S(E TH P 1 M
| |
| S S E *
| |
| .N SI E~
| |
| W C r PS TY F C e MR SL OO L U r
| |
| UU WN SF S
| |
| S 9PT RO OS L C
| |
| (
| |
| R h@
| |
| * 7 o,
| |
| | |
| ~
| |
| LOSS OF RX _ YURS gpg _
| |
| W
| |
| ( FW FLOW TRIP TRIP m- --
| |
| STAND 8V
| |
| - MSly -
| |
| 6
| |
| - AF W SLEED OP. $ygp AND
| |
| \ # -" ~ ~ ~ ~~
| |
| HE MAND SHU WN f ED AfNS --
| |
| ~
| |
| T
| |
| \ DE-
| |
| [ GRADED STATE h SUCCESS REOutRES ANY ONE OF THREE AFW PUMPS. SAME LOGIC AS ESD 6.
| |
| @ SUCCESS REOutRES EITHER OF TWO MOTOR DRIVEN AFW PUMPS. (NO STEAM t$ AVAfLASLE TO DRIVE THE TURSINE DRIVEN AFW PUMPJ
| |
| * RWST EMPTIES IN- 3/4 HOUR, LEAVING THE OPERATOR
| |
| ~ ONLY- 1 HOUR TO ALIGN FOR HPR.
| |
| Figure B-6. Loss of Feedwater Flow ESD 6
| |
| | |
| /
| |
| D L
| |
| O C
| |
| " E E DT R AA O
| |
| [k ERT DGS T A
| |
| \[ R E
| |
| P O
| |
| E H .
| |
| TR G PH N
| |
| IR V O D A F E
| |
| N S LN A N ,G P I RI L M A U U OA S HO 7 4 T
| |
| /
| |
| D 3RU S E
| |
| -O NH w l I1 S o lE P.
| |
| I
| |
| . E~
| |
| I TY PL l
| |
| F m
| |
| O MN a EO e t
| |
| ll TH S T S
| |
| WI f RW o s
| |
| s o
| |
| L
| |
| -. l D a t
| |
| N o A T Y M TD B gED 7 ON -
| |
| HA B T ll e S
| |
| r
| |
| !g u D g E D i E E F LNE B^
| |
| W
| |
| ^
| |
| )*
| |
| ^
| |
| P I
| |
| XR RT J
| |
| W O
| |
| F L OF S
| |
| SM OA LE T
| |
| S
| |
| | |
| I P)
| |
| \f T U
| |
| Y A 8 E TD H ON G HA T NI S W A O H
| |
| / S F
| |
| O 1l D
| |
| A E
| |
| E F
| |
| A T
| |
| S N
| |
| DM L
| |
| OT I
| |
| ( CU ig L H D E
| |
| S E E
| |
| D . D OS [ T AA G MC EE T
| |
| ERT DGS VF S
| |
| IF TE l \[
| |
| W AD T R A VN R P E
| |
| L H SC 8 Il NB l P OO D xRI CT S RT D E N
| |
| I h A PL i p
| |
| M r U
| |
| - l S T
| |
| - e
| |
| - n
| |
| ,%//.
| |
| E UN
| |
| - M i
| |
| b r
| |
| _ NU u
| |
| .TR _
| |
| I .R l
| |
| - P T OT
| |
| .. NO
| |
| . OT _ -
| |
| C
| |
| ,8 t -
| |
| 8
| |
| - R -
| |
| ,e'J S O
| |
| ~ - C T B A
| |
| - R e
| |
| ~ 1
| |
| - pKJ_
| |
| 3 3
| |
| E P r
| |
| ~
| |
| ~
| |
| E
| |
| - IA NC BB
| |
| _- 1 D
| |
| S E D O
| |
| E H . i u
| |
| g RN N TR
| |
| ,lI UU L
| |
| l_ E N
| |
| AP R M
| |
| O 5E A
| |
| M GP NH tR v
| |
| F R
| |
| a_ rTR3 BIR5 R
| |
| UT 9 E cD A O E F N
| |
| ._O 3yiiL T I F L. G
| |
| _ y_ U P
| |
| RU U
| |
| M D OA gu g
| |
| (
| |
| 1 E
| |
| E D
| |
| HO 4 T
| |
| ~ tN /
| |
| 3R 8 U O
| |
| ,R Ng/ NH II S
| |
| E
| |
| _ WIO OS _ E-I TY PL
| |
| _ PR EU _ A MN RC EO
| |
| _ OX _ TH
| |
| .CE ( S WIT
| |
| ,f%s
| |
| * RW yD
| |
| | |
| L ~ -
| |
| +
| |
| v e
| |
| k b~ bo I
| |
| 98 or 85 jQ
| |
| /%
| |
| i TZ d
| |
| s, a s< m O
| |
| S $^
| |
| m w
| |
| -- Y c W ' r o
| |
| . j
| |
| ~ '$8 5 U d 8
| |
| $ 2
| |
| ~
| |
| 8 A w a ! a E$ 05 s u 2
| |
| %/ I h eo a O
| |
| -~ 6 30E -
| |
| ~~ O E t5 4 k=
| |
| l.!! i L
| |
| T 4 i :s .
| |
| RR ? $
| |
| a i IE !s I s ^ : he 1~ T E 3!.!b.sts !]E ea i wI
| |
| -s i !! d C
| |
| 252 iO
| |
| -- *E3 E 8B . e.g ps
| |
| .et
| |
| !!f.:ki E g24 is e
| |
| v$51 OO -
| |
| B-10
| |
| | |
| y i, .
| |
| A f\
| |
| 1I r
| |
| A oM t
| |
| oT cU q W O E E
| |
| - / oT AA ERT DGS
| |
| ,\l S ] \/
| |
| -WT A
| |
| - R P
| |
| - - H 0 r 1 D
| |
| 7 ,J rag ,.lL [-
| |
| o S
| |
| E r:L N A p P L}}
| |
