ML17332A848

Qualitative Functional Diversity Assessment of UFSAR of Common Mode Failure of Digital Equipment Software

ML17332A848
Person / Time
Site:	Cook
Issue date:	12/04/1992
From:	AMERICAN ELECTRIC POWER SERVICE CORP.
To:
Shared Package
ML17332A849	List: ML17332A848 ML17332A850 ML17332A851 ML17334B552
References
QA-92-18, NUDOCS 9507180137
Download: ML17332A848 (87)

Text

egherfcan ".'tectrfc Power Service Corporation lear Safety And Ucenslng Section Catcttlation Covev Sheet NUC 15 91 99(R1 040glP2S Calculation No.

Subject CAVAyA0tl Sp ryte S

Safety-Related System Yes +

no Supersedes Gale. No.

cM c

pr ComPany Ty1A H 1d Calculated By R. 5 S

w Verified/Checked By Method OfVenficabon Approved By J/8w9'mbiem

==

Description:==

tan e.

~WAn4n ~

acrcsca4a

+c oko c4 cnt metr Ifcccrmnt. CH-I-tnu rnocct:) w Ioolnp cA +

cgcoclc44 Potttoofo $)eo. 2oo/s)ec 28o Pnrorco RhaC4nn'iC.g ~~~~~. ~<a.

HP,C. ~qW red, PSaPSt-4a, CaaV~ ~

m eke. ~~ur-(cortt:) ro( ~e.

2+dmsorrrr g-tt Yt~ ctriRtbk ot 'uor~

ezra.coco~~

ori o ~

o 6-MF sign Basis Or

References:

0phut'~

2.. ~ ~.~ ~~Mc mrcr ocrcyon~

rcpfrccc~

7Ylrnocgcocrc ta, c. coorto 'P~~

u~&

5 R&~t ~ccccrc>~i~en ~~ +~+ -o$ ta,C. dcrofoy]

4,(trof No.

Date Change Gale. By Checked By Date Approved By Date Superseded By Calculation No.

Reason:

'yt507180137 gf50707 PDR ADOCK 05000315 9

PDR Dated Page Of

7223(9.83)

ENGINEERING DEPT.

AMERICANELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COLUMSUS, OHIO C

OAT COMPANY SHEET 2

OF~

CK~52 G.O.

gU BJ pCg Qualitative Functional Diversi Assessment Table of Contents A,

Statement. of Purpose, and Executive Summary B.

Assumptions, C.. Analysis...

Page.Ho.

3.....,...

3 f

...3.

.D.

E.

F.

Verification.

Results, Discussion of Results 3

... 3..

. G.. References...,

H.

Table. 1.

Appendix A Appendix B.

I 3

~ 4 p

\\

5..

....1-48.

... 1-5..

~ v

~

'I

~

F

7223(9 S9)

FQR< oE4(cI ENQINQQRING DEPT.

AMERICANELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COLUMBUS, OHIO OAT COMPANY SHEET

+

OF B

GK G.G.

SU8JECT.

UA VE FUNCT ONA D

S SSM A.

State e t o Pu ose a

d Execut ve Summa See page 4/5 B.

C.

See Appendix A

~Aaa sis

~litative Evaluation given in Appendices A and B

D.

The evaluation was done based on U2 FSAR.

The reviewer checked Unit 1 FSAR for consistency.

@CAP 11902 and its supplement, RTP License

Report,

@CAP 12135, RTP Engineering Report, QCAP's

'12078 and 12901.

Input and Output Data, and Unit 2 cycle 8 RTSR were also used as a

basis for reviewing the evaluations.

Plant annunciator response procedures were used to review possible and px'obable alarms.

Discussions with HED personnel especially Z&C personnel resolved various issues such as which alarms were independent of the new digital equipment.

%here the reviewer felt it was appx'opriate or necessary, changes to the evaluation were proposed and resolved with the evaluator.

esu ts See Appendix A F.

D scuss on o e u ts See Appendix A G.

e erences See Appendix A 3/5

722%9.d3l ENGINEERING DEPT.

AMERICANELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COLUMBUS, OHIO COMPANY

.'LAN SHEET OF S

cx G.O.

$ugJp(,y Qualitative Functional Diversity Assessment ST T OF PURPO E AND EXECUTIVE SUMMAR On April 21,

1992, AEPSC representatives had a meeting with the NRC on the replacement of existing analog reactor protection process instrumentation with digital Foxboro Spec 200/Spec 200 Micro Eleceronics instrumentation.

During this

meeting, AEPSC was asked to assume a common mode failure (CMF) of the software of the new digital equipment during an accidene and then provide details as to whether operaeors could mitigate the consequences of the accident.

In response to this request, a functional diversity assessment of each updated FSAR (UFSAR) event assuming a

common mode failure of the software has been performed.

In this assessment, all the events for both Units 1 and 2 of the Cook Nuclear Plane given in ehe UFSAR were considered.

A review was performed to divide events into potentially affected and not affected.

Table-1 lists these events and indicates whether they would be poeeneially affected or noe affected, if a CMF were to occur.

The potentially affected transients were then individually evaluated qualitatively in light of the FSAR analysis as shown in the ateached Appendix A.

The transienes which are noe affected by the software failure are discussed in Appendix B.

~

The first column of the evaluations in the Appendix A contain th'e UFSAR transient number listed in Table-1.

The second column includes the name of the transient.

The third column depices the trip/safeguard

&mction for reactor trip.

This information was obtained from the UFSAR.

The fourth column includes the information on the impact of common mode failure on the reactor trip function.

If ehe trip function is processed outside of the new digital reaceor protection

~ys~em, then the trip is available, e.g., trip on nuclear instrumentation system high flux. If ehe trip is processed by a function that is a part of the new digital equipmene, then the trip/ESF function is assumed to be lose.

However, for some functions, alternate indicaeions and/or diverse alarms are available.

The alarm/alternate indications ehae are available to ehe operator to mieigate the transient are given in the next column.

The sixth column lists the pertinene diagram numbers.

The seventh column summarizes the consequences of the unavailability of diverse alazm.

The last column provides the evaluation of the event.

In this column, we have discussed ehe consequences of the operator's response on reactor safety.

Based on this evaluation, we have concluded that the CMF of the new digit 1 equipment has no sxgnxfxcant adverse impact on the public safeey.

Some reactor trips are noe affected by the installation of the new digital equipment-these trips aze neutron high flux and high race

trips, undervoltage and underfrequency trips and reaceor trip on turbine tzip.

However, for events protected by trips and aceuaeions affeceed by

CMF, should a

CMF occur, the operator willbe alerted to the evene by an alarm from a diverse system.

He vill then provide the appropriaee aceuaeions manually and enter the emergency operating procedures.

For some accidents, such as locked rotor, the consequences could be more severe than curzenely analyzed due eo the longer response eime for the required actuation.

However, our evaluation indicates that the affected unit can be brought to a safe condition and ehe current LOCA offsiee dose evaluation will remain bounding.

From these results, ie is believed that a CMF of the new digieal system would have no adverse effect on the health and safety of the public.

-4/5

1's

?22~(9.6>I ENGINEERING OEPT-AMERICANELECTRIC POWER SERVICE CORP.

1 RIVERSIDE PLAZA COLUMBUS, OHIO DAT COMPANY SHEET G.G.

SUBJECT UFSAR TRANSIENT 4 14 ~l. 1 14.1. 2 14.1.3 14.1.4 14e1.5 14.1.6 14.1.7 14.1.8 14.1.9 14.1. 10 14.1.11 14.1.12 14.1.13 ualitative Functional Diversit Assessment

~ab 1e-TRANSIENT nconcxolled RCCA Withdraval from a Subcxitical Condition ncontrolled RCCA Withdrawal at Power od Cluster Contxol Assembly Misalignment CCA Drop Chemical Volume and Control System Malfhnction ss of Reactor Coolant Flov Staxtup of an Inactive Reactor Coolant Loop Loss of Extexnal Electrical Load ss of Normal Feedvater Flov Excessive Heat Removal due to Feedwater:Sys'tern Malfunction Excessive Load Increase Incident ss of All A.C. Power to the Plant Auxiliaries uzbine-Generator Safety Analysis POTENTIALLY AFFECTED (A)/

NOT AFFECTED (NA)

A A

A A

A A

A A

A A

A A

A 14.2.1 14.2.2 14.2.3 14.2.4 14.2.5 14.2.6 14.2.7 14.2.8 Fuel Handling Accident ccidental Release of Radioactive Liquids ccidental Waste Gases Release Steam Generator Tube Rupture upcuxe of a Steam Pipe uptux'e of a Contxol Rod Drive MeBMI~ Housing (RCCA Ejection)

Secondary System Accidencs Dose Consequences

]ox Rupture of a Main Feedvacer Pipe A

A A

A A

A A

A 14.3. 1 14'.2 14.3.3 14.3.4 14.3.5 14.3.6 14.3.7 14.3.8 Large Break LOCA Analysis ss of Reactor Coolant from Small Ruptured Pipes or from Cracks in Large Pipes which Actuates the Emergency Core Cooling System Core and Internals Integrity Analysis Containmenc Integxicy Analysis Environmental Consequences of a Loss of Coolant Accident ydrogen in the Containment After a Loss of Coolant ccidenc Long Term Cooling itxogen Blanketing A

A NA A

A A

NA NA 14.4.2 14.4.3 14.4.4 14.4.5 14.4.6 14.4.7 14.4.8 14.4e9 14.4.10 14.4.11 S

D C

D C

P E

E Postulated Pipe Failure Analysis Outside Containment nalysis of Emergency Conditions tress Calculations escription of Pipe Whip Analysis ompartment Pressures and Temperatures escxiption of Jet Impingement Load Analysis ontainment Integrity lant Modifications nvironment lee trical Equipment Environmental Qualification NA NA NA NA NA NA NA NA NA A

APPENDlX A

~ UNII I and fsAR TRANSIENT N Lt. L.l IRANS I EN I Uncontrolled RCCA Sank Mlthdroual tron ~

Subcrltlcal Condition IRIP/SAfECUARD fUNCTION fOR RX TRIP (FEAR LN ~ L.i) 1.

Source range neutron flux trip-ectwtcd shen either of 2 Independent source range chNNtts IAdlcatcs ~ flUx

~bove 4 prcsclcctcd, 44NJILLy adjustable value.

2.

Intcrncdlete range neutron flux trfp actwtcd Uhcn ~lthcr of tuo I dependent Lntcrocdlate r4Agc channels indicates I flux above a prcselcctcd, auxuLLy ad)ustable value.

3.

Poucr range high neutron tlux trip llou setting)"

~ctuatcd eben tuo oUt 0'f C poker ch4NNLI IAdlcatc ~

flUx 4bove Ipproxioatcty 25X of fulL poucr tlux.

S.

Pouer range nCutron tlux level trip thigh setting)-

actuated uhcn 2 out ot S pacer range chancls Indicate

~ tlux LcvcL 4bova

~ preset sctpolnt.

5.

In addition, Rx trip froa PER high prcssure serves Is I hookup to tcnelnato the Incident before an ovcrprcssUro ccndltloA could occur IHPACT OF CO&0K NODE fAILURE LCNf) CN 'TRIP FUNCTION Iten Nos. I.S not affcctcd LNcno dated Sept 2, 1992 tress V. G. Sotos to V. D.

Vandcrgurg, 1/S Tabl ~ 3.3-I)

LOST LNcco dated Rcpt. 2, 1992 tron V..G. Sotos to V. 0.

Vandcrsurg)

ALARN/ALIERNAIE INDICATION STSTEN AVAILASLF Ad

~

cn AY bl Panel Indication Panel Recorder Plant Process Cooputcr IAdlcatloA Y

b Prcssur tcr Nigh Prcssure Dcvlatlon vl~

Control Systca.

four high prcssUre

~ Laros YI4~

ccntrol systca.

0 A ~

Ad cn Aud ble ndicat on of rod

~et ion.

DIACRAN S FD.2101 Sheet I/6 coxsfouENcEs 0F UNAVALLASLLLTTOF DIVERSE ALARN Not Affected None.

Tuo Diverse ALares are available.

EVALUATION Of EVENT This transient Is not sffcotcd by the rcploccncnt of N.line analog process protect lcn systcn by Foxboro SPEC 200 Ind SPEC 200 NICRO,

~Icroproccss based sgdutcs.

Trips I through S, Listed ln Colum 3, are not affected, since rwetcar Instnnentatlon for flux scasurcocnt ls no! replaced.

for Rx trip frcot prcssurltcr high

prcssure, tuo diverse

~ Lares are available.

In acklltfcn, pressurizer high prcssure trip Is a backup trip.

1

UNII I F SAR TCA<<SIENI 4 1(.1.2 TRANSIENT Uncontrolled SCCA Sank Vlthdra<<al et Pa<<cr TRIP/SAFECUARD FUNCTION fOR RX 1RIP (TSAR

) l( ~I,g,)

1.

Kualcar Pa<<cr range Instrlsacntstlon aatwtcs

~

reactor trip on high neutron tlux if 2/C channels exceed on overt<<war sctpolnt.

2.

Rx trip cn any t<<o out of four it ahalv>>ts exceed OIC'1 sctpolnt.

This catpolnt ls autaeattaatty varied <<lth

~xl~ L txwcr distribution coolant average tccpcrature

~rd pr ~scute to protect against DNS.

3.

Rx trip on t<<o out of four at channels cxaccd OPal satpotnt.

This sctpolnt Is auteaat laal ly varied

<<1 th coolant average teapcrature so that the allo<<abt ~ fueL parer rating Is not cxcccdcd.

C.

A high prcssure reactor trip, actuated fres any t<<a out of four prcssure channels ls sct at 4 fixed point.

S.

• high pressurizer wter level, aatwtcd frets any 2/C ahalv>>ts

~ Is sct at 4 fixed point.

IHPACI Of COHHON HCOE FAILINIE (CNf) ON TRIP FUNCTICH Not Affected Ota'f Rx Trip Lost (Ncaa dated 9/2/92 tres V.

0 Sotos to V D.

Vandcrgurg)

CPUT Rx trip Lost (Ncaa dated 9/2/92 fres V.

0. Sotos to V. D.

Vacdcrgurg)

Lost (Ncaa dated 9/2/92 fres V.

0. Rotc>> to V. D.

Vandcrgurg)

Lost (Nceo dated 9/2/92 fra4 V.

O. Sotos to V. D.

Vandcrgurg)

ALARH/ALTERNATE INDICATION STSTEN AVAILABLE NIS paver range ovcrpo<<er rod step at 103X ~tar>>.

Vt*range teapcrature recorders.

Vide range tccperature recorders.

nd 4

Av ab Panel Irdlcat on Panel recorder Plant Process aaaputcr lndtaat ton v

A ~

Ava jb Prcssurltcr Nigh Prcssure Dcv!ation via con'tI'oL systea Four Nigh prcssure

~ Lars>>

via control systea

~

Ava ab Panel lnd c4t on Panel rccordcr aacputcr IIdlaatlon v

4 Avs ab Prcssur zcr N gh Level Deviation via control systea Nigh level via control systea 0th a

4 ndtaa ans Audlbte ndicat Ion of rod nation DIACRAH S fD 2102 Sheet 3/C FD 2102'heet 3/C FD.2102 Sheet I/d FD 2101 Sheet 2/d co<<sEQUENcfs of UNAVAILABILIITOf DIVERSE ALARH Nuclear II>>truacntat lan cystca not changed.

five diverse alarc>>

available 1<<o diverse

~lars>>

~ vallabl ~.

Rx trip on high'prcssurtzcr <<ster lcvcl actuates ~al cr

~h either the O~i or high neutron flux trtp Auctions to deaanstrate this protect ton during prcssurtzcr filling scenarios (fSAR, page 1C.'I:2A C)

EVALUATION Of EVENt The Rx trip an MIS overpwcr setpolnt lc nat

~ffcatcd by the rcptaacsent of M.line analog process protection systea, since flux ecasureacnt Instruacntatlon ls not replaced.

2.

1he 0141 Rx trlP ls lost by N-line rcptaaeaant.

Thc Otal trip cnsurcs that DNS does not occur.

Ihe FSAR analysts of this event

~ssuaas that Rx trip on high prcssurlzcr <<ster level ls assusad available.

This trip actuates earlier than

~Ither the OTC'I or high neutron flux trip fu>>tlans to deaanstratc this protection during the sto<<cr prcssurlzcr filling scenarios (FSAR, page TC.T.2A.C).

1hc high pressurizer <<ster Level trip hss t<<o diverse high level atars>>,

therefore operator <<ould get indlaattons prior to Otit Rx trip for prcssurlzer fllL events.

Those scenario'c that do nat tcrsdnate on high NIS Ifux or high prcssurlzcr <<ster are tcratnatcd by Otal.

Ihcy terd to be Lo<<er reactivity lnsertfon sacnarlos or Lcwer pa<<cr scenarios.

Although narc tine fs available for response to these events, It cannot be stated <<lth certainty that fuel clad daoage <<tll nat occur.

Vcsttnghouse has reported fn VCAP.B330 that Ntntaus ONBR can bc achieved for ~ rod <<tthdra<<al at pa<<sr ATVAS atthough the parttaular case evaluated

<<as a

rapid rcaattvlty Inscrtlon case <<htah <<outd have tripped on MIS high flux.

Clad daaage Is an acceptable autaaee baause thc CHF lc a sad ttpte failure condition.

Na<<ever, as discussed

betou, rod <<lthdra<<at of @acr events are significantly nltlgatcd by the fulL pwcr base load operation of the Cook Units.

3.

The rcptaaeacnt of N.Line analog protection systea causes

~ loss of OPiT Rx trip.

thlc could result In fuel rod cladding failure.

Ha<<ever, the posslblLlttcs of thts to occur ls stl4.

First of aLL, this cvcnt wuld be tcralnated as soan as po<<er Is ~ 109X Rated Thereat Pa<<cr (Trtp Sctpolnt) by the NIS.

This Is at<<ays the llntttng trip for atntsus fccdbaak, rapid rcaatlvlty lnsertton evcntc.

for a>>xtcus fcccbaak, rapid reactivity tnscrtlan

events, the prcssure celtrot systea ts not expected to keep up thcrcby also producing

~

high pressure deviation clare.

Ihe stat reactivity Insertion events are expected to fill thc prcssurtzcr end pl'odua4 4 Lcvcl elena Ihc escalation of pwcr Inarcascs Tavg, and Vide Range RCS Teaperature Recorder Indications are 2

UNI'I I 2

fSAR TRANSIENT 0 IA.I.2 I cont'd)

IRANSIEHI

'IRIP/SAFECUARO fUNCIION FOR RX TRIP (/SAR I I.lr'f)

IHPACT OF CtseQN HCOE fAILURE ICHf) ON TRIP FQICTICH ALARH/ALTERNATE ILOICATION STSTEH AVAILARLE OIAGRAH 4 CONSEOUENCES OF UMAVAILASILIIT OF DIVERSE'LARH EVALUATION OF EVENI avallabl ~ to the pocrator IHeso dated p/2/p2 froa U.O. Sotos to V.O. Vandcrsurg),

prcssurlzcr Rx trip and hfoh prcssurlzcr wtcr Level Rx trip have Olvcrse Atares avallablc.

A.

the Cook Units are base loaded so that they operate prlaarlly at IOOX RTP <<Ith rods csscntlatly cosptetcty ulthdram.

The Lover pouer cases csscntl ~Ily address condltlona uhlch are transitory.

Ourin9 transltlon opcratlon, operators ulll give close attention to IndlcatlonP as they nanlpulate the narhlne.

Nate that poucrs VOX are used occaslonatty to stretch a cycle.

for these reasons this ls a Iou probablllty event.

.3.

UNIT 1 a 2

ISAR fRANSIENT 4 IC. 1.3 1C.I.C

'IRANS I ENI Rod Cluster Control Asscebly (RCCA)

NlcaL lgnacnt (IC.1.3)

RCCA Assccbly Drop (TC.I.C)

TRIP/SAFECUARD FUNCTION fOR RX TRIP (fSAR It(.I.3~

It(.l.tf Mo reactor trip on RCCA a(sal(gtvcent (FSAR 1C.1.3) for RCCA drop rod(s) event, the analysis docs not take credit for any direct reactor trip due to dropped rods (UCAP-TI39C, page I 2)

IHPACI Of CCHNOM HCOE FAILURE (CNF) ON TRIP FUNCTION ALARH/ALIERMATEINDICATIOM STSIBI AVAILARLE DIACRAN g CONSEOUENCES OF UNAVAI LAD I LITT Of DIVERSE'LARM EVALUATIONOF EVENT for RCCA elsallgfvaent event (fSAR IC.I 3), there ls no reactor trip.

The analysis for RCCA drop rod(s) cvcnt docs not take credit for any direct reactor trip due to dropped rods (Uchp-)139(,

page t-2).

Thus, the rcplaceeent of cxlstlng M-Llne analog process protection systen ullL not

~ffcct the fSAR results of these tuo events.

lhe fat tcuing dctectlon signals/slams are

~vallsble For the operator to respond to these transients (FSAR, Unit 2 pages 1C.1.3-1 and 1C.1.'3.2) t (I) Sudden drop ln core paver level as seen by the NIS (II) Asyrnctric pouer distribution as scen on out-of-core neutron detectors or core exit thernocouple, (III) Rod deviation ~ terat (Scf'point-Individual ral position dcvlatlon + 12 steps fraa deaand

canter, Procedure 2-ONP CORC.210 Drop 29),

(Iv) Rod position Indication.

In addition, for rod dropped event or dropped bank, thc fully Inscrtcd assccblles are Indicated by a rod at bottaa signai, uhich

~ctwtcs a control roaa anntnciator (sctpolnt 20 steps froa the bet taa, Procedure R.ONP CORC.210, Drop 22).

VNI'f I 1 2 fSAR TRANSIEN'I g IC<'I.S TRANS IENI Uncontroclcd Saran Ollu cion IRIP/SAF EGUARD fVNCIION fOR Rx TRIP(fsAR ici,l~ 5)

1) llfth reactor ln aats<at control snd no operator

~ctlon taken to tcralnate the transient, the FNwer ard

'cccpcra'cure >>ill cause the reactor to reach the overccsperature

<<I (oc<<T) trip sctpolnt resulting In ~

reactor trip (fSAR, Page 1(.1.$ 5)

IHPACI Of C(secGN HOOE fAILURE (CHF) ON TRIP fVNCTION OT<<1 reactor trip tost (acco dated 9/2/92 fras M

g. Sotos to V. D.

Vandergwg)

ALARH/ALTERNATE INDICATION STSIEH AVAILASLE h

~

<as I<dtca NIS pwcr range ovcrpo>>cr rod stop at 103X Pr(sary>>ster fto>>

deviation ~lara Roric and flew deviation clara>>lth rods in cute>>ac lac Rod bank D Lcw ~lara Rod bank D Iou-Lou alara Amllbl~ indication of rod aoclon DIAGRAN 4 fg.2102 Sheet 3/C CONSEQUENCES Of UNAVAILASILIITOf DIVERSE'LARH EVALUATION OF EVENT Ihe fSAR scctlcn IC.I.S has cxsafncd three phases of boron dilution accident, I.~. boron dilution during (I) refueling, (II) startlp, snd (ill)pouer operation.

for dllutlon during refueling, thcrc arc aors than 33 afr<<tcs available for operator action troa the tlae of Initiation of the event to loss of shucdwn asrgln (SX <<k/k) (fSAR, page 1(.1.5.$ ).

For refueling cade<

the cost Likely source of dilution, CVCS, ls tagged out.

for other aodcs thlc source ls not tagged out.

for dilution during startlp there are acre than 3S alnutcs available for the operator action frc<a the tlae ot Initiation of thc event to loss ot shucdoun aargln (1.3X ik/k) (fSAR, page IC.I.S.S) for Unit 2 <<d ES ala>>tea tor Unit 1.

Startup ls a transient operation.

Opcratofs >>lll give close attention to Irdlcatlons as they aanlpulate the aach\\ne.

Dilution accident at peer Includes the reactor In autoaatic control ol; aac<<a( control.

tilth the reactor in cute>>etio control, thc po>>er and tccperature Increase froa che boron dilution results ln Insertion of the controL rods <<d a decrease In the available shutdo<n aargln.

1hcre are acre than CS air+tea froa thc tlae of

~Lara (Lou Iou red Insertion (lait) to Loss of shutdo<<n aargln (1.3X <<k/k) (fSAR, page 1(.1.5

5) for Unit 2 and Cg af<v<tcs for Vnlt 1.

the Cook Units are operated >>lth rods in autasatlc untess there ls ~ cocpettlng reason to operate In aanual.

illth reactor In a<<smL control and no operator

~ctlcn taken to tcralnatc the transient, the pwer and tcapcraturc >>ould cause che reactor co reach DT<<T trip sctpolnc.

This trip >>ill be lost as ~ result of co<<>>n aoda failure ot the neu Foxboro digital systca.

The boron dilution tr<<>>lent In this case ic essentially equivalent to an cs>>ontroL(cd RCCA>>ithdrauaL at poucr (fSAR, page 1(.l.S-I).

There Is no control rosa clara frca the a'1 aystca for th'is event.

No>>ever, the increasing pwer and>>lde range tcoperature Indications>>auld indicate conSIclons to the operator.

This event ls s sto>> rcactlvicy addition event ~

~Ipca/sec<

.5.

UNII I a 2

ISAR IRANSIINI 4 lt 1.5 (con'I)

IRANSIENI

)RIP/SAFECUARD FUNCIION fOR RX IRIP (fSAR It(.t.r)

IHPACI Of COHHON HCOE fAILURE (CHf) ON IRIP IUNCIION ALARH/AL'IERNAIEILDICAIION SVSIEH AVAILASLE OIACRAH g CONSEOUENCES Of UNAVAILASILIIYOF 0 IVERSE ALARH EVALUAIION OF EVENF Fol loving the discuss lon on tneontrot lcd RCCA bank ulthdraval at power, the high prcssurlzcr uatcr level

~Lara ls assumed ave(labia, tblch has tuo diverse

~ Lanes (meso dated 9/2/92 from M. o. sotos to V. O. Vandergurg).

)his ls a stou trans(cnt, and ulth the prcssurhcr level, Nlde range tcoperaturc Indlsat lens, and other Indlcatlons, the operator should be able to trip thc reactor.

0 ll

UNIT 'I a 2

ISAR TRANSIENt N I(.).6.I TRANS IEN'I Loss of forced Reactor Coolant fla<<

TRIP/SASECUARO (UNCTION fOR RX TRIP (fSAR (II I g I) 1.

Rx trip on reactor coolant pap pwer slppiy tedcrvoltage or under Irccpcnay 2.

Rx trip on La<<reactor coolant loop f1o<<.

IHPACI Of COHHON HOOf IAILURE (CHf) ON IRII' UNCTION Not Affected Lo<< flo<<Rx trip Lost (for

~ LL four loops)

ALARH/ALTERNATE INDICATION STSTEH AVAILASLE Reactor Coolant Pulp underfrecpcnay and IJndcrvaltagt alafsl (Procedure I, 2-oxp, (02(,

107, 207)

I 4 Ion Avs Iab Panel Ind(cat Ion cooputcr ind Icat Ion vcr Alara Aval cbt a~h Press<<riser prcssure panel Indication Prcssurlzcr prcssure rcaordcr Prcssurltcr pressure cocpulcr Indication Prcssurlter level panel Indication Press<<riser levcL recorder Prcssurlter Level coeputcr Indication tilde range tccpcrature records Qhhr ~c Prcsswi ter high prcssure deviation vl~ control ayctcQ four high pressure

~Larsi via controL systoa Prcssurltcr high level deviation via cantrol cyst<<a Nigh level via control systua Acoustic Nanltor flou dctcatcd DIACRAN g ID 2101 Sheet 3

and (

CDNSECUEMCES Of UXAVAILASILIITOf DIVERSE ALARH If the Rx is at po<<cr 4t thc tine of tht

~aaldcnt, the imacdiatc effect of ~

loss of coolant fia<<

la ~ rapid Increase tn the coolant tcopcr4'turc <<blah Is

~ugnl fled by ~

positive HTC.

Ibis Increase could rcsutt ln DNS <<lth subsequent advcrsc cffccts to the fueL, if the Rx ls not tripped procptly.

((SAR, page I(.).6-1)

EVALUATION Of EVENT Ihc Rx trip an reactor coolant pulp pa<<cr slpply undcrvoltage and under frequency rcaa inc lalallcatcd by a aaaoon Node failure (cxf) of the ne<<digital Instrloentat ion.

The reactor trip on Loss of f(a<< ln ~ coolant loop ls lost on CHf for tach loop.

These are no Diverse Alarms avallablcl ha<<ever, panel Indite'tlon and cocputcr Indlca'tlon art 4vallablc for the La<< coolant loop flow.

T<<o cases of loss of flo<<are discussed ln fSAR (I( 1.6).

Ihe slcultsncous loss of peer to all C RCPs can occur due to either undcrfrcqucnoy or undervoltage,

<<hlch Is not lcpaatcd by CHF. 'Ibis situation Is highly mllkely, sino>> each Ixap Is carncctcd to a separate bus, <<blah ls stpp(lcd by anc of t<<o transfonacrs.

the consequences of the loss of flou Inaiufe an Increase In Tavg, pressurlter pressure, and prcssurlter <<ster lcvcl.

Vide range RCS tcapcrature recorders (neco dated 9/2/92 froa U.

C. Sotos to V. D. Vandergurg) are available to the operator to indicate an Increase In Tavg.

Thcrc Is no Rx trip on high Iavg.

Thc prcssurlter prcssure <<ill contltwe to rise untlL thc operator gets 4 high pressure deviation slane et 2325 pais (2.ONP (02(.200 Drop 7) for Unit 2 and 2175 psla for Unit 1.

the Rx trip on high presswe (cctpolnt <<2(00 pale) ls Lost due to CHf.

However, dlverst ~ Lares (octo dated 9/2/92 fran M. C. Sotoa to V. D. Vandergwg) are available.

It ls cvldent that the high prcssure deviation alarm <<ILL drau tha operator'a attention, and he <<ILL trip the Rx <<atua(Ly.

Thc operator <<IIL also be Likely to see the high level deviation ~Lare at SX above prograa.

Thc cansapcnocs of thlc Nanual Rx trip are dls cussed bc lou.

Crude cxtrapolat iona of DNSR for theat tvcnta suggest that IONSR could be reached <<lthln.16 to wig seconds for loss of fLo<< ln one loop.

Siai(ar extrapolations suggest that the high pressure deviation elena <<auld first be received W seconds into the transient

~Lthough the operation of pressurltcr sprays <<ILL Increase this cstlaate.

Allo<<tng ~ scaands for operation response It is clear that DNS could

.7.

0

UNIT I 2

ISAR IRANSIENT 8 It.t.6.1 (cont'd)

TRANSIENT TRIP/SAFEGUARD FUNCTION FOR RX TRIP(FEAR IHPACT Of COHHON HCOE fAILURE (CHf) ON TRIP fUNCTION ALARH/ALTERNATE INOICAllOI STSIEN AVAILARLE DIAGRAN g CONSEQUENCES OF UNAVAILASILITTOF DIVERSE ALARH EVALUATIOIOf EVENT occur resulting In clat danagc.

Since ~ nasstve

~ultlple failure la accused for this event, thfs lc belicvcd to be acceptable.

lllth ~ loss of flow tn one loop total core flow should rcnaln rooovlng the bulk of thc heat fran th<<

core, Ltatttng the deterioration of the core prior to cenual reactor trip.

The portion of the core that cxpcrtcnccs ONS ls expected to heat up tntlt the Doppler coctflcfcnt shuts It down.

Fuel Is not expected to sett but ctad burst and oxtdatlon are anticipated.

Lt should also be noted that this event was analyzed with a positive aedcratlon coefftctcnt (NIC) of eS paa/'F.

Ihls value ls nore Llatttng than the Tcchnlcat Spcctflcatton Licit at 100X RTP. It fs conservative and provides sMtantlat chargtn throughout nest of the Life. cthts causes power to Increase as the coolant tccperature Increases.

A nore rcallstlc asstnpttcn for beginning of cycle Ic

-(pcn/of.

A negative NIC wlLL tend to shutdown the core es tccpcraturc increases ntttgattng the cvcnt.

the HTC bcconcs sdstantt ~Lty nore negative as hurray progresses.

The Cook Units are base loaded and operate with control rods in the all out posltlcn at futt power.

There(orc, the posslblltty that cutcnatlc rod control night ulthdrau rods wILL have no lcpact because rods arc essentially fully wlthdram.

After reactor trip, the cecrgcncy operating procedures provide for nlttgatton activities to bring the cjachlne

'to e safe cordlttcn.

In the evaluation of the previous paragraph, an operator response tine of M seconds uas assuacd.

Mtthout e reactor trip, prcssurltcr assure anf levcL are expected to conttrwc to ncrcase after the first atoms are resolved.

Shen prcssure reaches 2250 Dalai 'the PORVic will open rcsultlng ln an acousttc eonttor ftou detected stars.

Extrapolating the analysis

curves, which do not cxdct prcssurltcr spray, this could occur before IINSR ls reached.

Therefore, it ls Likely that an ecctnutatlon of eterne wilt occur before 60 seconds have elapsed.

Therefore, the opcratorc response tice nay be less than 40 seconds for this event.

UNIT I 2

fSAR IRANSIENI I IS.T.S. I Icont'd)

TRANSIENT TRIP/SAfEQJAAO fUNCfION fOR RX TRIP (ISAR )tt.f.g.t)

INPAct 0F CQONNI NCOE FAILURE ICNF) ON TRIP fUNCTION ALARH/ALTERNATE INOICATION STSTEN AVAILABLE D IACRAN N CONSEQUENCES OF UNAYAILABILITTOF DIVERSE ALARM EVALUATION OF EVENT,,

The east Ilkcly cause of en event of this t)pc, ls a failure of the reactor coolant Ianp IRCp) or Its actor.

Thc operator ls provided ulth ~

slsnlf leant rasher of eterne to give hfn inforoatlon resardlnS thc RCP's and enters.

These

~ Taros Include RCP actor dlffcrcntlal trip, RCP actor overload trip, snd RCP aeter overheated.

Therefore, It Is likely that the operator Nlll have Inforaatlon available shish Nlll at lou hie to antlclpatc <<d, therefore, substantially nltlgate the event.

UNII I 2

fSAR TRANSIENT 4 IL.I.6. 2 IRANS I EN I Locked Rotor/She ft Brcak Accident TRIP/SAFECUAZO fUNCIIQI fOR RX IRIP (/SAR LLI, Lo f e 2)

Reactor trip on Lo<< flo<<

signal IHPACI Of CttetOH HCOE FAILURE (CHF) CH TRIP IUNCTION Lo<< fto<<reactor trip Lost (acao 9/2/92 acao frets V.

C. Sotos to V. 0.

Vctdcrgwg)

ALARH/ALTERNATE INOICATICtt STSIEH AVAILABLE tdl eels Avcl ch Panel ndicat ion Cocputcr Indication v

A ra Avc CMc

~h~l~aens Pressurizer prcssure panel indi cat Ion Pressurizer prcssure recorder Pressurizer prcssure cocputcr Itdicatlon Pressurizer level panel (Cd(cation Prcssur izcr Level recorder Pressurizer level cocputcr ltdlcat Ion Vide range tccperature records gourd ol prcssurlzcr safety valves 9~he t~cc Pressurl ter high prcssure dcvlatlon via control systccl four high prcssure alarsa vie controL systcta Pressurizer h(gh Level deviation vie contcoi 4ystua Nigh lcvcL vs control 4ys tea Acoustic aonitor fLou detected 0IACRAH N f0.2101 Sheet 3 and 6 CONSEOUENCES Of UNAVAILABILIIIOF DIVERSE ALARH Lf the Rx ls at pater at thc tlae of

~ccldcnt, the Ictscdiatc effect of ~

loss. of fto<< (seizure of ~ RCP rotor) ls an increase In the coolant tccperature.

This Increase could result In ONB <<lth stftscqucnt adverse effects to fust, if the Rx Ic not tripped procptly (FSAR, Page IL.I.6.1)

EVALUATIONOf EVENT Thc fSAR analysis foc 'this cvcnt assuscs an

!nstentcncous seizure of ~ reactor coolant putp rotor.

For this event, the reactor trips on lo<<

fle<<signal.

'the cotcson aode failure (CHF) of the ne<<digital Instcttscntat Ion <<outd result In

~ loss of lo<< flo<<gx trip signal.

Ihc loss of fle<<<<ill Increase the coolant tccpcraturc atd an Increase In prcsswlzer prcssure due to ~ reduction ln beat rcaovat.

The <<lde range RCS tccpcraturc recorders (acco dated 9/2/92 free V. O. Sotos to V. 0.

Vatdergurg) arc available to thc operator.

The prcssurlzcr prcssure <<ill continue to rise, end tba operator <<ill gct ~ high prcssurlzcr deviation

~Iara at 2325 paid (Procedure 2-ONP (02(.200 Orop 7) for Unit 2 attd 2175 ps(a for Unit 1.

The reactor trip on high prcssure

(<<2(00 paid

) ls lost due to CHf.

No<<ever, high prcssure diverse

~Iarsts arc available (accto dated 9/2/92 froa V. O. Sotos to V. 0.

Vandergurg).

Therefore, the high prcssure deviation clara <<ill dra<< thc operator's attention to trip the reactor ttatstaiiy.

Ibis event ls very sztdt Like thc loss of forced reactor coolant fle<< in cne tocp.

No<<ever, lt ls core severe In that totaL core flat la cc4Kcd store rapidly 'to ~ Lo<<cc value, the total core flou ls reduced to 7OX <<Ith(n ~'2 accords.

As the coolant heats tp, a significant Irncase In prcssure occurs.

'Ihe peak analyzed prcssure for both mits la M90 psla.

Ibis peak occurred at 2 accords after the reactor trip at 1 accord.

Ibis prcssure Ic less than 110X of the design prcssure, I.~. 2750 psl ~.

No<<ever, lf reactor trip ls delayed 40 sccotds, it carrtot be stated <<lth certainty that this prcssure

<<outd not be exceeded.

No<<ever, the

~nalysls takes no credit for pressurizer spray or thc pressurizer PORVts.

Lt ls also the case as <<lth the Loss of forced reactor coolant fle<<

that tha analysis

<<44 pcrfoctacd <<lth 4 po4ltlva

~todcrator tccperature coefficient (KIC) of c5 pca/'f.

This value Is cora Ilaltlng than the

'Tcchnical Speclf Ication I\\alt at IOOX RIP.

Lt ls conservative and provides stftstsntfal aargln throughout tha core Life.

.10-

~ ~ ~"~~Q0t mh ct

~'tr>.<~ <

4...:" >~-..... I~,.""~ m.,impC~.)..."3 ~~ F. 't r

..a C

ONIT I 2

fSAR TRANSIENT N IS.IA.2 (ccn't)

TRANSIENI TRIP/SAFEQJARO fuKCTICN fOR RX TRIP (CESAR

( tf ~ t ~ g a 2)

INPACT Of CISOQN INIOE FAILURE ICNF) OI TRIP fOKCTION ALARM/ALIERNATE IKOICATION STSIEN AVAILASLE 0 IAGRAN g CONSEQUENCES OF LNAVAILASILITT Of 0IVERSE ALARN EVALUATIONOf EVENI Thcrctore, as Tavg Is fncreascd, powr Increases In the analysis.

As Indicated In the loss ot forced reactor coolant ftou, ~ sore rcatistlc beginning of cycle NTC, uould be

~-Spec/~F.

throughout core life the NTC uoutd decrease to thc 20pcn/'F.

The fccchack freak the NTC uoutd therefore tend to shut the reactor doun rather than Increase paver tn an actwl event.

Ihe Cook >nits arc base loaded and operate Kith control roCk In the atl out position at fulL poucr.

the possibility that autocotic rod control night utthdrau rods uttt have no tcpact because roCk sre essentially fullyutthdraw.

These considerations toad us to conclude that It ls tntlkety that prcssurltcr pressure uoutd exceed 2730 psla and virtually tcposslble to exceed 3200 pstIF, the ARNE Roller hand Prcssure Vessel Code Level C crlterlcn, uhlch uas used for ANSAC design.

In the analysts, ONS ts expected to occur.

In the event of a delay,.ot reactor trip by ~

seconds, this situation can only be exacerbated.

The operation of pressurltcr sprays and PORV's uhlch vere not sedated In the analysts uttt also result In an Increase In fucL rods ln DNS.

Nouever, It Is believed that the available ftou util prevent the core tron degrading to condition uhere It canrot be cooled after trip.

The portion of the core that cxpericnccs ONS ls expected to heat up tnttt the Oopplcr coefficient shuts tt doun.

Fwl ls not expected to nett but clad burst and oxidation are anticipated.

Qbstantta\\

core daoage Is

~cccptabte for thts cvcnt Khtch ls an ANS condltton IV cvcnt Kith suasive aulttpte failures.

In the evaluation ot the prcvlous tuo paragraphs, an operator response tine of ~

ceconds uas aksuaed.

Nowvcr, this cvcnt ls expected to be very dracetlc Several prcksurltcr atarkxt can be expected Nlthln seconds of the start of the event Including the acoustic cxnltor flou detected slane.

'the prcskurttcr cafcty valves can be <<xpectcd to Lift uhtch creates an tcprcsslve sound in the control rook.

Therefore, the operators response nay bs less than 40 seconds for this cvcnt.

J'

~

~

~

P 4

lt 4,

"tg q 'IA

~

~

~

~

~

~ I

\\

I 0 ~

I

~

~

I ~

~ I

~ ~

UNIT 'I 2

ISAR TRANSIENT

~

It.).7 TRANSIENT Start>@ of an Inactive Reactor Coolant Loop IR IP/SAF E GUARD FUNCTION FOR RX TRIP (<SAR It(. I. 2 )

Unit 1 and Unit 2 operation during startup and pover operation ulth less than four toops ls not pcrnlttcd (I/S 3/(.(.I) except for speal ~I testing as provided for In I/S 3/(.10.5 for Unit 1 and I/S 3.C.IO.S for Unit 2.

License ccndl tiara for both Units prohibit operation above P-7 ulth Less than four reactor coolant Fcnps ln operation.

Noucvcr, thc Ufs*R contains analytic of this event for both Units.

This inforoat ion la provided for Inforoatlon and because It bounds the test condltlcns Inslcatcd above.

!hase analyses result In reactor trips on nuclear Instruscntatfon hfgh f(ux.

INPACT Of COHHON HCOE fAILURE (CNF) ON TRIP FUNCTION ALARM/ALTERNATE INOICATICN STSTEII AVAILASLE DIAGRAM N CONSEOUENCES Of UNAVAILABILITTOf DIVERSE ALARN EVALUATIONOf EVENT In accordance ulth T/S 3/SA.T, operation during start~ and poucr operation ulth less than four loops ls not pernlt ted.

As such, this accident uas not analyzed for the VANTACE-5 fuel transition (Unit 2 FRAR, page I(.1.2-1) or for the Unit 1 reduced tccpcrature and pressure prograa (Unit I UFSAR, Page 1(.1.7-3).

Tbcrcfore, the cocnon node failure (CNF) of the ncu foxboro dlgltaL systns uould have no lcpact on this transient.

'- 13

0 V

UNI) I 2

ISAR TRANSIENT N I(~ 1.0 IRANSIENI Loss of External Elcctrlc Load or Turbine Trip (full Vantage.S Core)

TRIP/SAFECUARD FUNCTION fOR RX TRIP (FSAR

)CI

)

Reactor trips on fotlouing signals x

1. Nigh prcssurlzcr prcsswe signal

2. Nigh prcssurlzcr uatcr lcvcl

3. Ovcrtceperature at(OTit) signal Inphcf of cotcoN ncoE fAILURE (CNF) Ol TRIP fUNCTION Nigh prcsswe Rx trip lost Nigh prcssur1 ter uatcr lcvcL Rx trip lost 04T Rx trip lost ALARH/ALTERNATE IAOICATION STSTEN AVAILABLE Ic Ava ab

~ Panel ndlcat Ion

~ Panel recorder cocputac'Indlcacicn v r A ares Ava'I ablt

~ N gh Prcssure dcviaticn vl~. control systcca

~ Nigh prcssure via control systce (four ~lares>

~ Pressurizer PCRV discharge tccp high

~ Prcssurlzcr safety valve discharge Cccp hl (3

~Lares)

- Pressurizer relic( tank Cccp hi

~ Pressurizer relief tank pressure high or Lou

. Prcssurlzcr relief tank level high or lou

~ Acoustic eonltor (lou detected cd

~

Ave abl

~ Panel ted(cation

~ Panel rccordcr

-Cocputcr Indication a

va ebt setpolnt vie controL sysCeo

- Pressurizer level high froa controL systcca Vide range Rcs cccpcracure recorders OIAGRAH g FD 2101 Sheet I/d F0-2101 Sheet 2/0 FD 2IOI Sheet S

CONSEOUENCES Of UNAVAILABILITYOF DIVERSE ALARN EVALUATIONgf EVENT ocs o oad Twb no T I Thc cost I kcty source of a cocpt ~ ca Loss of load In NSSS Is a trip of the twblne-generator or ~ differential relay uhlch results In ~

turbine trip.

In Chic case, there ls ~ direct reactor trip signal (crclcss power ls betou

~pproxleatcly 1'lX povcr, I.e., betou P.T) dcrlvcd frees the turbine eacrgency trip fluid prcssure and turbine stop valws (FEAR, page T(.T.SS-I).

Ihercfore, the coccacn node falture (CNF) of the ncu digital systce has no Icpact on the reactor trip.

s of Load ulthou wbi I

Tuo Initiating scenarios sere considered for this events Cocptete loss of ~lcctrlcal Load,

~nd loss of condcnscr vaccxec.e I t o

ec r ca oad for this cvcnt the reactor trips on four trip fca>>tfcns.

For high pressurizer prcssure trip fcz>>cfcn, three alternate Irdlcatlons acd several dlvtrst ~Iares are available.

for high prcssurlzcr tater level trip, three alternate Irdfcatlons and tuo diverse clare available for Iou-Lou stean generator uater lcwl trip, three alternate Indications acd onc diverse

~lana are available.

These Irdlcttlons, stares,

~nd other tndlcatfons, especially thc scxsd of safety valves should provfde Icdlcatfons to the operator of abnonaal cltwtion and ht uouid trip the reactor eacxcaliy.

The (space of thc coccacn node failure (cNF) of the digital syscce uould result In ~ loss of Ofat reactor trip fcc>>Clan.

Tht Otit reactor trip ls tht only fcz>>tton for which the

~Iternate stares/lcdicatlcns are noC avallabl ~

the loss of reactor trip uould cause the RCS prcssure and tccperature to rise.

This uould result in an tncrcase of pressurizer uacer Lcwl. Prcssurlxtr pressure, prcssurlzcr Level

~nd ulde range tccperature Indications ara

~vallabl ~ co the operator to trip the reactor (eseo dated 9/2/92 frees U. 0 Sotos to V, 0, Vandergurg).

The high pressure deviation stare activafts at 232$ psia (proctdwe 2 DNP (02(.208

fSAR TRANSIENT g IL.I.O (ccn't)

IRANS IEN I TRIP/SAFEGUARD fUKCTION fOR RX TRIP (fSAR I f I 8)

4. Lou.fou stean gawrator uatcr level IKPACT Of COtOKNI HCOE fAILURE (CHf) OK TRIP fUxctIDN Lo-Lo Hater lcveL reactor trtp lost UHI'f I and I 2 ALARK/ALTERNATE IKOICAIIOH STSTEH AVAILASLE

~

Ava

~Puwt ndlcat on

~ Panel recorder

~ cocputer indication

~

va abl

'LcvcL deviation v ~

controL systoa th cct ons A area

~ Paver Range ovcrpoucr Rod Stop

~ Sourd of stean generator and prcssurltcr safeties.

~ Audible trdlection of control rod action.

OIACRAK g COKSECUEKCES Of UHAVAILASILITTOf DIVERSE ALARH EVALUATION OF EVENT~",

Drop y) for Unit 2 and 2175 for Unit 1.

This alcfn uouid drau operators attcn'Lion Prcssurltcr sprays uoutd begin to open at 2260 pslg and uould be fulL open at 2310 pslg (FSAR, Table 4.1.2) for Unit 2 and fran 2110 pslg to 2160 for Unit 1.

1he PORV NILI be full open at 2355 palg, snd safety valves open at 2405 pslg (fSAR, Table 4.1-2).

Assuslng thc availability of this control cquipacnt, thc prfeery prcssure should not cxce<<d 2750 pal a fn the ntnlsxaa reactivity fcehsck case.

1hc HTC for this case ic accused to be c5pca/'F and the Doppler cocfftclent ls

~sauced to be ~.6pcn/X.

Kore realistic

~ss options for beginning of cycle and Nip are HTCa -(pcn/X and Doppler

.Open/X.

these values util Increase thc tccperature fecchsck relative to the analyslc tending to reduce poucr and consequent ly prfnary prcssure.

In the aexlaxsa reactivity fcogwck, the reactor paver ard consequently prfaary prcssure ere reduced by thernal feedback.

OHSR ta not threatened In the aaxtcxaa reactivity fatback

case, Additional controL equi pncnt nay also operate to alt tgatc thlc cvcnt.

The poucr atsawtch channel for rod control can be cxpectcd to operate on a loss of Load driving rods into the core.

The tfcw ccnstant of first stage prcssure tc 40 scc.

Therefore, rods can be expected to insert tntit the operator Initiates protective actlcn. If Tavg fatlc constant on a cHF or falls high, rods Kill ccntfnue to insert after the paver nlsaatch signet has decayed.

'the stean &ay to cardcnser ucutd also Sperate Kith tavg constant or high provtdcd that condcnscr vacwa or offslte paver are not lost.

0 r V the loss of condcnscr vaaasa affects only the turbine and not the reactor protection systoa.

Therefore the turbine trip on ccndcnser vacua Kill result In ~ reactor trip since both rccwtn tawffccted by the cocoon axde fatlure of the ncu digital systce 15

'A P

UNLI I 2

F SAR 1RANSIENI g 1C.1.9 TRANSIENT Loss of Normal FCCdv4ICI'RIP/SAFECUARD FUNCTION fOR RX TRIP (F SAR Lti, I Q )

1. Reactor trip on Lou.tou uatcr lcvcl In any stcam generator

2. Reactor trip cn Lou tccduatcr tlou signal In any stcam generator (Ihlc signal ls 4ctually ~ stc<<4 flou fc<<heater mismatch In coincidence ulth lou wter lcvcL)

3. Tuo secor driven auxiliary fccduater Fcmps Ifclch are

~tartcd cnt

~. Lou-Lou lcvcl In eny stcam gcncratol'.

Trip of ~Ll mafn fccchcatcr

c. Any safety In)ection signal b.

C kv bus loss of voltage

~. Nanual actuation C

tufb'lno dflvcn 4uxILIary fccduatcr pufp ls started ont

a. Lou-Iou Level In any tuo stcam generators

b. Reactor coolant fxmp bw Ixvtcrvoitsge IHPACf OF CCNNCN NCOE FAllURE (CNF) ON TRIP fUNC'l ION (car lou level trip lost Lou fc<<AIatcr flou trip lost IOAFP star'ts (Outocotfc Initiation) on Lou-Lou stean generator levcL Ond safety in]ection from nnn-manual Initiation are Lost TDAfP start (autcmatlc Initiation) on Lou-Lou" stcam generator level Is lost ALARN/ALTERNATE INDICATION STSTOI AVAILASlE vcf 4 ~

Ava ab

~ stcam generator level deviation via ccntrol system AY4 ab 4

~ Panel nd cat on

~ Panel recorder

~ cocputcr Indication sane as above (for stcam generator lou.lou wtcr level) same as 4bova sama ca above h r A fata nd

~

~ Prcssurltcr high levcL deviation

~ Prcssurlter level high DIAGRAN g FD.2101 Shcct 5 CONSEQUENCES Of UNAVAILASILLTTOF DIVERSE ALARN EVALUATIDN OF EVENT The ccxonon mode failure (CNF) of the ncu digital cqulpmcnt results In 4 Loss of reactor trips on lou.tou uatcr level, and on Lou fccckatcr flou signal (stcam flou/fccdtlou mismatch In coincidence ulth lou uatcr Level).

goth the motor driven Ocaf turbine driven auxiliary fc<<heater Systccaa are also lost except In situation described betou.

The motor driven auxiliary fccduatcr temps are not affected by CNF If the Scope started on C kv bus loss of voltage or Loss of all main fceduatcr pcmps (1/S table 3.3.3, pago 3/C 3.

19).

The turbine driven auxiliary fccduater Fcmp ls also not sftccted by CNF If the pcmp ls started on reactor coolant Fxafp bus cedcrvoltage (1/S Table 3.3-3, page 3/C 3-2g).

ln caae Of the CNF of ncu digital equipment, 4'tc4al gcncfatol'evel deviation ~ Lacaa and ANsAC

~lena are avallabl ~ to the operator.

In

~ddltlon, three alternate Indlcatlcns aro ~Lso avail abl ~.

for the Loss of normal tc<<heater/ATUS transient, ATVS Nltlgatlng System Actuation Circuitry (ANSAC) ls available (memo dated 10/13/92 frcca V. 0. Sotos to V. 0. Vandergurg).

the ANSAC

~utccaatfcaLLy lnftlatcs ~ turbine trip and Initfatcs AFV flou to maintain the RCS prcssure bclou 3200 pslg (ASNE Roller and Prcssure Vessel Code Level C criterion).

At 100X RIP these fceotfona are initiated at 30 scc. of transtcnt signaL delay tlm4 ANSAC la OVallable 'to perform this fcectlon In thc event the CNF ot the ncu digital equipment occurs.

An JNSAC

~Ivxecfator ls initiated after ANSAC ls actuated (Proccdwo 2.ONP C02C.212 Drcp TC).

The tufbfne trip Is not affected by the CNF of the ncu digital cquipmcnt (memo dated 9/2/92 free V. 0.

Sotos to V. D. Vandcrgwg).

Therefore, the reactor uould bo tripped Igxnn turbine trip.

At aLL poucrs the stcam gcncratOr level deviation alarm, prcssurfzcr level high Level deviation and prcssurlxcr level high are

~vallable to alert thc operator to 4 Loss of normaL fccduatcr event.

In addltlcn, Ixaacrous

~terms describing thc status ot the condensate and tccduatcr systems and pcmps, such es ccedcnscr hotuct I level, booster mater trip, IS

~

U<<lf I 2

fSAR TRANSIE<<1 !

LL.I.9 (con't)

TRANSIENT TRIP/SAfEQlARD FUNCTION fOR RX 'TRIP (tSAR Lg.t.q)

IHPACT OF CCHHCH HODE fAILURE ICHF) ON TRIP FUNCTION ALARH/AL'IERNATE INDICATIOH STSTEH AVAILABLE DIACRAH 0 CONSEOUENCES Of UNAVAILABILIT'fOf DIVERSE ALARH EVAlUATIDHOF EVENt aaln feed<<ster Fcnp, ctc. <<ILL actfvate.

Relo<<

LOC rated theraal po<<cr, It Is expected that these alaras <<auld lead thc operator to trip the reactor a<<catty due to Lcu etcae Rcncretor lcvct In acfordance <<lth 2-ONP CD23.E-O.

Ue atso note that this event progresses rclatlvely stcuty so that the prcssurlzcr fills fn thc order of alrutcs not seconds.

The cvcnt

~s dcscrlbed In the UFSAR ls analyzed ustng AFU flea based on f1o<<rctentlon.

The operator

<<ILL be able to open the flo<<rctcntlon valves to substantfalty Increase fccdvatcr fto<<. It is also not constdercd necessary to assuee an AFU putp fall<<re In eddtt Ion to CHF.

Assuslno the

~vallabllfty of ~ LL three Aflffsaps also substsntf atty Increases thc flou of Afll. for all these reasons,

<<e belfcve 'fhe outcoae of this cvcnt <<ilt not be stzatanttatty dlffercnt frca the analyzed result.

UNIT I 2

ISAR TRANSIENT g L(.1.10.1 IC. I ~ 10.2 TRANSIENI Excessive Scat Rcaoval duc to fccduatcr Systca Halfcccotlons fccduater Systca Half lect lens causing and Increase ln fccdustcr flow TRIP/SAfECUARD IUNCTICN fOR RX TRIP (fSAR Lc( ~ I Io)

I. Nigh ncutrcn flux trip

2. Ovcrcccperature il (OI~I) trip Ovcrpoucr OT (OPil) Crlp

d. Sccaa generator uaccr Level high.high IHPACI Of COHHON HCOE fAILURE (CHf) ON TRIP fUNCT ION Not sf fasted ofil reactor trip Lost opal reactor tr'lp lost Lost ALARH/AL'TERNAIE INDICATION STSIDl AVAILASLE NIS pwcr range overpovcr rod stop ac 103X clara Mlde range tccpcraturc recorders Mlde range tccperacurc recorders ca cnc Avs labia

~ Pane(

ndlostfon

~ Panel recorder

~Cocletcr Irldlcatlon '

~

Aveltab

~ Level deviation via controL cyst ca DIACRAH S CCNSEOUENCES Of UNAVAILAS'ILI'I'IOf DIVERSE ALARH EVALUATION Of EVENI the reactor trip on NIS ovcrpcwer sctpolnt ls not affected by the coocaon aode failure (CHf) of the ncu dig(eel cqulpacnt.

Ihe OliT and opif reactor trips erc lost due to CNI of the ncu digital equi pacnt.

No altcrnatc afarca are available for these trip fcNotfons.

Noucvcr, Hide range hot and cold leg ccepcreture Indications are available.

Ihc cases of Iou prcssure or high prcssure fccduatcr heater bypass valve fully open'lng rcsu'lt ln transients very slallsr to those for cxccsslve Increase In secondary sccaa flou.

This transfcnt ls discussed In section 1(.1.11.

The Unit 2 fccchcatcr events arc bounded by the cxccsslve load increase.

Ihe Unit I cvcnts are also expected Co be bounded.

~

for an Increase ln fceduaccr flou In che absence ot CHf, che turbine uould trip on high-hfgh stcaa generator uatcr Lcvcl, uhlch weld tn turn trip thc reactor.

In case of CHf, this trip Is lost (T/5 Table 3.3-3).

At cero pwcr, steaa generator lcvcl ls under aanusl control.

Therefore, the operator uou(d be cxpcctcd to identify the event procptly and take corrcc)fve action.

Sciou P 10, the NIS high flux sctpolnt ac 2SX RTP and the NIS fntcracdiate range trips are also available.

Ac IOOX RTP, the sceaa gcncrator deviation clara (Procedure 2 ONP (02L.213 Drop 2) uould activate

~t SX above progrscacd level of (CX.

Three stcaa generator 1cwl indications erc available (acao dated 10/13/92 froa M. 0. Sotos to V. D.

Vandcrgurg).

In addition, pwcr range cwcrpoucr rod atop clara (Procedure 2-ONP (02(.210 Drop

19) uoucd actuate at 10)X paver, uhfch uould occur ac about 20 scc. Into the crsnslcnt (lCAp-12901 ~ fig 10.dlA)

Mlth the 5, 0, dcvlatlon clara and level Indications available, the operacor should be able to trip the turbine,

~Reich tn turn uoufd trip the reactor.

figurc 10.1dA of ICAP-12901 shous Chat, the pwer stablt lees at spproxlaatcly IOSX noainal (trip sctpolntel09X).

froa figure 10.29A of LCAP-12901, the steaa generator devlaclcn a(ala uould aotuace at about 0 scc. Into the transient.

Id

%. ~

Uxll I 11 t ISLA IRAH$IEHI It.l.Io.t leant'd}L ItaxSIExt I

IRIP/SASICUARD IUNCIION ICR RX IRIP(SCAR )LI.)~ LO)

IHPACI Of CCHHCW HCOE fAllURE CCHI} ON IRIP fUXCIIDI ALARNlALIESNAIEIHOICAIION SfSIEN AVAILARLE DIACRAN 4 coxSEOUExcf s of UMAVAILASIL111 Of'IVERSE ALARN EVALUAIIONOf EVENI

.Accusing the operator's respcnse tine to be 60 scc., the turb}no would trip at cpproxlactely 60 scc.'r the reactor trip tfoc ls approaloatcty 70 scc.

flSurcs IC.1.10A-t and 14.1.10A 6 of the Unit t UfSAR shou that the DkSR st this tice is approxfaatcty

$.6.

flsures 1C.1.10-t crvf IC.1.10-C shou Dxtt at this tice to be.l.O.

lhasa values are well above the DNSR safety Llalts for both Units.

Ihcrcfore, there would not be any fueL daoasc.

19

UNlf 'I a fSAR IRANSIENI g IL.I.I I IRANSIENT Excessive load Increase Incident IRIP/SAfEGUARD FUNCIIOH fOR RX TRIP (fSAR Itt I tt) l.

Ovcrpo<<er it (OPit) trip 2.

Overtccperature it (Olit) trip 3.

Paar range high neutron ftux L.

Lo<<prcssur Iacr prcssure trip IHPACT OF CO<<NOH HCOE FAILURE (CHF) ON TRIP IUNCTION OPit Rx Trip Lost

(<<ceo dated 10/13/92 fros M. 0. Sotos to V.

Vandergurg)

Otal Rx 1rlp Lost (<<ceo dated 10/13/92 fran M. 6.

Sotos to V. Vandergurg)

Not Affcctcd Los! (nano dated 10/13/92 fr<<s M. 0. Sotos to V.

Vandergurg)

ALARH/AL'TERNATE INDICATION SYSTEN AVAILASLE Mide range RCS tccperature recorder'ide range RCS tcepcreture recorder NIS paver range ovcrpo<<er rod stop ndl a

cna Aval abl

~ Panel Indication

~ Panel recorder

~ Cocputcr Irdlcat ion e Ala Ava lab

~Prcssurtscr Io<< prcssure deviation (turn on backup hcatcrs) via control systcs h

rve ndlca I

Aud bl~

ndicatlon of rod sation belo<<103X.

Prcssurtzer to<< level deviation

~tarn Press<<riser Io<< level

~tcrn DIAGRAN g f0.2101 Sheet I CONSEQUENCES Of UNAVAILARILITTOf DIVERSE ALARH EVALUAIIOH OF EVENT Iha cocoon code failure (CHF) of the nc<<digital cqulpscnt results ln ~ loss of OPiT trip, Otit trip and lo<<prcssurltcr prcssure trip.

The reactor trip on po<<cr range htgh neutron flux Is not affected by thc CHF of the reactor process equi psent.

Ihe FSAR section IG.I.II has ccnsldcrcd four cases to anatyzc this cvcnt (I) Reactor control In cjsnwt <<lth nlnissss soderator reactivity feedback; (II) Reactor control In nanuat <<lth naxlssss aodcrator reactivity feedback, ttll)

Reactor ccntrot in wtocattc <<lth <<In!cess aoderator reactivity fcccback; and (Iv) Reactor control In autoeatic <<tth saxlssss aNderator reactivity fccchsck.

Tha reactor trip and/or engineered cafcguard

~ctuatlcn sfgnal <<as not generated for thts event (fSAR, page IL.I.IIA.3). The FSAR

~nalysis ass<<ass that nonaat operating procedures

<<outd be folio<<cd to to<<cr po<<er.

In thc event that this event occurs concurrently

<<Ith ~ CNf of the ne<<digital reactor process equipaent, the operator <<outd be expected to bring the reactor to hot shutdo<<n consistent

<<lth T.S. 3.0.3 20-

1 w

~

~ '

~ ~

~ ~

~

~

\\

l ~ '

LNII I 2

fSAR TRANSIENI g TL.T.I2 (ccn'tl TRANSIENf TRIP/SAfECUARO FLNCTIOI fOR RX 1RIP tfSAR ltl,te lg)

INPACT OF COHHOI HCOE FAILURE (CKF) ON 'fRIP fUNCTION ALARH/ALTERNATE IIOICATION STSIEH AVAILABLE'IACRAHg CONSfOUENCFS OF LNAVAILASILIIT OF 0 IVERSE ALARH EVALUATIONOf EvfNI earlier Lhsn nodcted due to loss of voltage and RCP bus uodcrvoltsgc.

there are ~Iso several alternate eterne available to the operator.

Thc stean generator level deviation atarst ls available tor Iou-Iou stean generator uater level.

Nigh pressurizer prcssure devi ation and high pressure

~Taros arc also ave(labia.

Thercforc, there Is no adverse icyact of the CHF of the RPS on this event.

. 22

~

UNII I 2

ISAR IRAHSIEHI S IC.I.IS IRANSIEHI I whine. generator safety Analysis IRIPISAFECUARO FUNCIIOH FOR RX IRIP (F SAR ILI.I ~ )3)

IKPACE OF CCHHQH HOOE fAILURE CAlf) OH 1RIP fUHCTIOH ALARIMALIERHAIEINOICAIICH STSIEH AVAILASLE OIACRAH S CCHSECUEMCES Of LNAVAILABILIIVOf 0IVERSE ALARH EVALUAIIOHOf EVEHI Ibis cvcnt ls related to ncchanleal failure of the cain turbine-Scnerators.

1here ls no reactor trip assoclatcd ulth this analysis.

If there ucrc to be a fallur, one or nore turbine trips, uould be expected.

A reactor trip, toaf fccted by CHF, uould result tree the turbine trip.

Ihcre(ore, the cocoon code failure of the softuarc of the ncu digital systcct has no Ispact on this event.

UNIT I F SAR IRANSIENI N It.2. I TRANSIENT RadloIOQIcal consciences of fuel Rand l lny AccIdent IRIP/SAfECUARO fUNCIION fOR RX TRIP (fSAR )q.g.i)

IHPACT OF CCNHOI NCOE FAILURE ICNF) ON TRIP FUNCTION ALARM/ALTERNATEINOICATION STSIEN AVAILABLE DIABRArl s CONSEQUENCES OF UNAVAILABILITT OF OIVERSE ALARH EVALUATION OF EVENT Boundlns fuel conditions are selected for the

~nalys la of ~ hypothetlcaL dropped fuel assesbly for both Unjt 1 and Unit 2.

They are described In fSAR Sections Unit I, Tt.2.1 and Unit 2, IS.3.$ -3.

These analyses also assuae that the

~ccldent occurs IOO hours alter shutdoun.

Since the accident occurs shen the reactor ls ~lready tripped, the coseon node tallwe of the neu digital equipoent has no effect on this event.

UKII I 2

fSAR IRANSIENI 4 It.2.2 IRAKSIEKT Postulated Rcdloaotlvc Releases dkkc to Ll~ld.Containing Tanh failures IRIP/SAFEGUARD fUKCIION FOR RX TRIP (fSAR ltl,+D.)

IHPACT Of CCHHON HOOE FAILURE (CHF) OK TRIP IUNCT ION ALARH/AL'IERNAIEIKDICATION STSTEH AVAILASI.E DIAGRAH d COKSEOUEKCES Of UNAVAILABILITYOf DIVERSE ALARH EVALUATIONOF EVENI This event ls not affected by ~ reactor trip or safcswrds actwtlon.

Thcrclore, ihe coamon skodc failure of the softuare ot the ncu dlDltal cqullsacnt KILL not la@act the results of this even't

- 2S k

~ ~

k

UNIT

'I and 2

fSAR IRANSIENT ~

I(.2.3 TRANSIENT Accidental M4$te cas Release IRIP/SAfECUARO fUNCTION fOR RX TRIP (fSAR tg. X 3)

IHPACT Of COHHQN HCOE fAILURE (CHf) ON TRIP fUNCTION ALARH/ALTERNATE INOICATICH STSIEH AVAILASLE OIAGRAH S CONSEOUENCES Of UNAVAILASILIITOf DIVERSE ALARH EVALUATION Of EVENI This event Is not affected by ~ reactor trip or safcguards actuation.

Therefore, the cocaan

~

node failure of the softuare of the neu digital reactor protection systcn Hill not (epact thc results of this event.

In the event of a votuae control tank (VCT)

rtpture, VCT Iou lcvct ard VCT lou-lou Level

~Iarns uoutd be anticipated.

Various radiation 4(arne uoutd ~lso be anticipated Inc(udiny the tilt vent aiar44 A VCT Iou loll Level klLL result ln a refuel lnS Hater sequence uhlch Hill start the shutdoun of the reactor.

This cccblnatlon of slams and aut004tlc actions uou(d lead the operator to Isolate Ictdoun and proceed ulth an orderly shutdoun.

This scenario Is tnaffectcd by CHf of the ncuccqulpncnt.

,I l

'I i W'

UNlt I 2

ISAR TRANSIENT 4 I(.2.(

IRANSIENT Stcaa generator tlbc Rupture TRIP/SAFEGUARD FUNCTION FOR RX TRIP (CESAR Il(,q.t()

I.

Reactor trip on lou prcssurlter prcssure signal 2.

Safety Injection on prcssurltcr prcssure-lou IHPACt OF COHHON HCOE fAILURE (CHF) OI TRIP FUNCfION Reactor trip lost (ecao dated 10/13/92 free M.O.

Sotos to V.D. Vsndcrgurg)

Safety Injection lost (t/S Iable 3.3.3)

ALARH/ALTERNATE INDICATICN STSTEH AVAILABLE fKII ~

cn Avallabt Panel nd lection Panel recorder cocputcr Indication I

c A eral Avc tcb Lou prcssure dev ation (turn on backup heaters) via control systca Nigh radiation alara lnt Stcaa generator bioudoun Liquid Stcaa jet air ~Jcctor vent

~tflucnt radiation eonltor Steaa generator hfgh level deviation (In affected S.C.)

Pressurltcr Lou level devi ~sion via control systea Prcssurlzcr Lou level (block pressurttcr heaters) via control systca D IACRAH 0 fD.2101 CONSEOUENCES OF UNAVAILASILLTTOf DIVERSE ALARH EVALUA'IION Of EVENt lhe reactor trip accused for calculating the aass transfer fraa the reactor coolant systca through the broken tube In this event occurs cn Lou pressurltcr prcssure signal.

Thlc trip ls lost because of coceon Node failure (cHF) of the neu digital cqulpacnt.

Thc safety injection ls also lost If CHF of the ncu digital cqulpacnt occurred.

1he stcaa generator tube rupture event uould result In ~ decrease tn the prcssurltcr prcssure

~nd level.

Thc prcssurlzcr pressure lou dcvlatlon ~ Lcra at 25 psig bclou controller'ctpolnt (noresL controller sctpolnt ls 2085 pslg for Unit 1 and 2235 pslg tor Unit 2)(Procedures 1,2 - ONP (02(.100,

.200 Drop 0)

~nd the pfcssurlzcr level deviation alara at SS bclou level prograas. (Procedures 1,2 - ONP 402(.108,

.208 Drop () uoutd actwte.

1hls

~ccidcnt can be Identified by thc operator by either a condenser air ~Jcctor radiation alara or a stcaa generator bloudovn radiation alara (FSAR, page T(.2.(-S and SD.DCC-NE 101).

Ihe stcaa generator high level deviation

~lara for the faulted stcaa generator ls ~lso availabl ~.

FOLLoulng these alsres, the operator actions are specified by plant procedure 01-ONP (023.E-3.

'this caergency procedure ulll guide the operator through eltlgatfon ot the event.

It Is anticipated that the lncrcecntaL ties for the operator to respond to the ~lares produced by thfs event, cvalwte the appropriate Indications, and actuate protection and safcgwrds factions viLL result ln a rcletlvcly saslL tncrcase in the transfer ot fluid troa the prfaary to the secondary systca.

The ERO gackground Docuacnt for E.3, SOIR Indicates on p 2d that although the level In the affected stcaa generator aay reach the top of the narrou range span, slgnlfleant voluae still exists before thc steaa generator fills ulth wter.

Procedure 12 TNP d020 LAS.122 provides the guidelines for actions taken based on stcaa generator prlaary to secondary leak.

2t-

~

~

~

~

~

t

~. '

I

V

UNIT I 2

fSAR TRANSIENT N IL.2.5 (cont'd)

TRANSIENT TRIP/SAFEGUARD fUNCTION fOR RX TRIP (fSAR )g. 2.g)

(II) Nigh stean flou coincident <<Ith Lo-Lo Tavg (III) Lou stean prcssure In tao loops (Unit 2)

Nigh stean flou coincident ulth Iou stean prcssure (Unit 1)

IHPACT OF CO%ON HCOE fAILURE (CHF) ON TRIP FUNCTION Lost Lost ALARH/ALTERNATE IHDICA'IIOH STSTEH AVAILASLE'd a

ons Ava abl recorders nd c va

~b e Panel nd lee't lan Cocputer Indication Stean fiou Indication frotcn on CHF (Unit 1) 0 her A ares rdlca I Lou prcssurl ter level deviation Lou prcssurlter level Stean generator high level deviation cents lnaent devpo Tnt nonI tor (ches'ked at least once per

~ lght hours)

Ica condenser Inlet doors open OIACRAH N CONSEQUENCES Of UNAVAILASILITYOF DIVERSE ALARH EVALUATIONOf EVENI or take nanuat action to trip thus.

Ihe Eaergcncy Operating procedures based cn Eoergency Response guideline f.-O (HP-Rcv.1$ )

provide recovery guidelines to the operator.

Slrple extrapolations suggest that, ulth added delays for operator response, the rctwn to pouer could be slgnlffcantly higher than calculated for the fSAR.

This could result In fuel clad daaage.

Kouevcr, It ls not believed that this Hill prevent the operator fron bringing the alt to a safe condition using thc Ecergency Operating Proccdurcs.

1he cnvlronaental (epact of fuel clad dosage ls discussed ln Section T(.2.7.

.29-V

\\I

~

F g

r

UNIT I and UN 2

fSAR IRANSIENI g I(.2.6

'!RANSIENt Rupture of Control Rod Drive Itcchenisn (CRDN)

Mousing (RCCA EJcctlon)

TRIP/SAFECUARD fUNCTION FOR RX TRIP (fSAR Itl~ 1.C) 1.

Reactor trip on high neutron flux (high and lou

$<<sting)

2. Reactor trip on high rate of neutron flux Increase IMPACT OF CONAN NODE fAILURE (CNf) ON TRIP fUNCT ION Not affected Not sffcctcd ALARH/ALTERNATE INDICATION STSTEN AVAILASLE DIACRAN 4 CONSEQUENCES OF UNAVAILASILITT Of DIVERSE ALARN EVALUATION Of EVENT -e for this event, the tuo reactor trips occur on NIS overpouer setpoint and the high rata of neutron flux Increase sctpolnt.

1hese tuo trip fact(one are not processed by the ncu dlgltaL cqulpacnt.

'therefore, the fSAR results of this event are not affected by thc cosnon sxde failure of the ncu dlgltal reactor protection systcn Ko radlologlcal dose asscssncnt Mas pcrforncdg but thc dose received

~I sl tc bolzx4ry and a Lou population zone uould be nlnlnaL (Unit 2 fSAR, page I(.3.5-5).

The asscssocnt prcvlously perforncd by Advanced Nuclear fuels, uhlch ls Included ln Tables IC.3.5-6 through 1$.3.5-9, shoo that the doses for this ace(dent are uelL belou IDCfR IDO guldel Ines.

.30-

UNIT I and fSAR TRANSIENT N N.2.7

'IRANSIfNI Secondary Systccu Accident Envlranacntat Consequences (this Section ol Unit 2 fSAR refers to Section IC.3.5 of Unit 2 fSAR)

TRIP/SAFECUARO fUNCTION fOR RX IRIP (fSAR Itf.2. t)

Loss of External Electric Load Loss of Narccl feed ster Loss of alL AC Power to Plant Auxiliaries fuel Handling Accident Locked Rotor Etc>a Generator tube Rupture Rupture of ~

Stcua Pipe RLpture of a Contral Rad Drive Hcchanlsu Assccbly Single RCCA Assccbty Mlthdrawai Incident LOCA IC.I.O 1C.1.9 IC.1.12 IC.2.1

'IC.1.6.2 IC.E.C N.2.5 1C.2.6 IC.3.1 1(.3.2 Table I Lists all cvcnts with dose consequences and Irdicatcs where thc protection/salcguards flActlone 4re found ~

TASlf I 0l S(USSICH

~OF VE~N IHPACT OF CCHHON HCOE FAILURE (CHF) ON IRIP FUNCtION Scc tASLE I ALARH/ALTERNATE INOICATION SYSTEH AVAILASLE See TASLE I OIAGRAH N CCWSEOUENCES Of UNAVAILABILITTOF 0IVERSE ALARH EVALUAtION OF EVENT Ibis section Includes the discussion of the cnvifanacntat consequences of ~ canaan axdc failure (CHF) of the digital Foxboro cqulpeent an several cvcnts.

Table Il Lists all events for which dose consequences will be found.

tASLE II EVENT Loss of fxtcrnaL Flcctrlc load Loss of Naruai Fccdwatcr Loss of All AC Power to Plant Auxiliaries, fueL Nardttng Accident Lacked Rotor Stean Ccncra'tor Tube Rapture Ruptwe of 4 stean Pipe Rupture of a Control Rod Orlvs Hcchanisu Housing Single RCCA Assccbly Ulthdrawal Incident LOCh RAO IOLOQ ICAL 0 IS(SISS ICH

~OF V~EN IC.2.'7 (this section)

IC.2.7 (this sectlcn)

'IC.2.7 (this section)

IC.2.1 N.1.6.2 1(.2.7 (this acct ten)

IC.2.7 (this section)

IC.2.6 IC.3.5 N.3.5 The cvatuatlans of thc Loss of External ELcctrlcal load (IC.I.S), loss of Norual Fccdwater flow (IC.1.9), and Loss of all AC Power to the Plant Auxiliaries (1C.1.12) did not Indicate that the autcoaes of these events would caeproatse any of this fission product barriers.

These evaluations sssuacd aiarsct frost control systces or other indications to alert the operator to the need far action. It was then accused that he would take procpt action in accordance with his eacrgcncy operating procedures to nasally actuate protection and safcguards factions as appropriate.

Since no caapruaise of the fission product barriers resulted frau the evaluations, the incident off site doses described

!n Scctlcn IC.2.7.2 reaatn valtd.

for the steau brcak event, the evaluation of scctlon IC.2.5 suggests a potcntlaL higher return to power when additlonaL tice ls

~lloc4ted for operator fcspaAse to swwxutty

- 31.

~

h

UN11 I <<XI 2

fSAR

'IRANSIENT g IC.2.7 (cent'd)

IRANSIENT TRIP/SAFECUACD fUNCTION fOR RX TRIP (fSAR tq. 2.q)

INPACT Of COeCON IKNE fAILURE ICHF) OH TRIP FUNCTION ALARH/ALTERNATE IIQICATIOH SYSTEII AVAILABLE OIAGRAH g CONSEOVENCES OF UNAVAILASILIIYOf 0IVERSE ALARH EVALUATIOIOf EVENt Initiate safecy Infection. It this tcuh to cled fatlure, thc inventory ot radlolsotopcs In the reactor coolant afccr tha event ulLI be larger than accused fn the IC.2.2 anatyslc.

Noucvcr, the anatysls for 1X failed fuel and \\0 gpa prlaary to scc<<vhry leak rate shous

~ 0.0 hr site txxndary thyroid dost ot C r<<a and a 0.3 rca site boundary ahois body dose.

These values arc tuo orders of aagnttude bclou thc 10 CfR 100 acceptance criteria of 300 rca and 2S rca for thyroid and uholc body doses respectively.

Since these values are a very saatt fraction of thc 10 CfR 100 crtterla, It appears that ctad fallwc ulll not causa these crltcrla to be

~xcccdcd An analysts to sapport atccrnati stean generator tube plugging crtterta for Unit 1 has been sdxattccd to the Ncc.

The analysts ta dcscrtbcd In UCAP-131ST. It Inchdcs

~ aethodology to ensure that thc offat ta dose Is Ital ted to 30 rca thyroid at the site boundary.

this analysfs

~sauces a 'IX fueL defects and ~ 120 gpa leak during ~ stean brcak.

At each outage uhcn the stean generators are cxcalncd for degraded

tubes,

~ ccnservatlve evaluation Nil I bc pcrtoracd to ensure that, In the cvcnt of a secant tne brcaL, the 120 gpa leak rate Is not cxcccdcd.

If ~ potcntlat return co poucr shoutd result In addltlcnal clad daaage above that accused In thts cvaluatlce, the 30 rca cricerlcn could be cxcccdcd.

Koucvcr, 30 rca Is snail cocparcd to 10 CFR 100 llalts.

Ne further observe that, In accusing culclpla failures ln safcguarch actuation, It is not also necessary to assuae other fallwcs as uett.

It ic ls accused that att rah insert, the very Large Fo associated utth the analyzed return co poucr util not be present.

These fn's can be

10. It Isiche porclon of the core associated ulth this poucr peak that ls expected to suffer cl<<t daaagc Fwthcraoreg Ihcn rods arc

inserted, the SOH util be dxktcd or nore accusing

~ stuck rod uorth greater than or ~

pea and excess SOH >COO pea.

Ic should also be

noted, as discussed In Section TC.2.S, that at taro poucr or lou poucrs, rxctcar Instruacntat ion trips frca tha source range and tntcracdlate range detectors and the poucr range high range lou sctpolnt are expected to protect agatnst paver excursion c ~

~

~

5 0

E J

N,'

~ '

UNIT 'I and 1

CESAR TRANSIENT g IC.2.7 (cont'd)

TRANSI TNT TRIP/SAFECUARO FLXICTION fOR RX TRIP (fSAR Iq

'2 '7)

I<<PACT Of CC<<NON HCOE fAILURE (CNF) ON IRIP FUNCTION ALARN/ALTERNATE INOICATION STSTEH AVAILABLE OIACRAN g CONSEOUENCES OF UNAVAILASILLTTOf OIVERSE ALARN EVALUATION OF EVENT F lnaLLy, <<e believe that ln the case of ~ large sudden stean brcak, there <<ILL be a safer

~udlbia Indication <<hlch <<auld proept the operator to carly action. If thc brcak <<cre to develop gradually, the various clams available

<<ill allo<< the operator to take action In a tine fraae that <<ill prevent any clad danage.

Therefore,

<<e conclude that a CHF in cocbinatlon

<<lth other failures could result ln releases larger than currently calculated but not in cxccss of 10 CFR 100 If<<its.

In ~ nore Likely scenario In <<hfch large core peaking factors are avoided, thc current calculations arc cxpcctcd to be maf fcctcd because Little or no clad dc<<age <<ould result.

Should CNF of the neu digital cquipxcnt occur for the stean generator tobe rtpture event, the operator has to trip thc reactor annually and Isolate the broken stean generator folio<<lng the guidelines given fn cncrgcncy operating procedures.

It has been assuacd in our evaluation that the operator's response tfae ls M seconds.

This one ninute tine Is on

~ddlticn to the 30 nlnutcs allotcd for operator

~stion after thc accident, ulthln <<hlch tine the pressure bct<<ccn the defective etc<<a generator and the prlaary systcn Is cquallzcd, and the defective stean generator lc Isolated.

Assuaing

~ I gpa prlsary-to-secondary leak rate Isaxlsxxa leak rate aLLo<<ed by T.S) prior to the tube

rupture, the 0-2 hour doses at site ixxxvfary are:

thyroid 1.7 re<<I <<hole bodya0.02 rcn.

These doses are euch lo<<cr than 10 CfR 100 guidelines of 300 rca thyroid and 25 rcn <<hole body, respectively IUnlt 1 fSAR page TC.2.7.6).

Thc doses at the cnd of 31 alnute of tine <<auld be nfnloaLIy lcf>>ctcd by the delay ln safeguards actuation h)potheslzcd for a CNF.

The release (or SCTR are expected to rcnafn ouch Less than 10 CFR 100 gufdcllnes even shen ~ CNF ls

~sauced

.33-

UN!I 2 CESAR IRACSI(ct S 1(.2.8 IRANSI(NI Hajor R~tufc of Hain Fccdvatcr Pipe (fcedllne greek)

TRIP/SAFECUARD FUNCTION fOR RX IRIP (fSAR LQ. 2..$ )

~ )

A reactor trip on any of the folioulng condltla>>t

1. High presswl ter prcssure

2. Overtccperaturc 4T

3. Lou-lou stcaa generator vatcr lcvcl fn any stean generator C. Safety injection slgnalc froo any of the folloulngt (I) Tuo out of three dlffcfcAtl~ L pfcsswc sfgnats bctvecn 4 stean LIAC 4Ad tho reaalnlng stcaot ines (ll) Lou stcua prcssure ln tvo of four Lfnes (lll) Tuo out of three high cental tvacnt pfcsslJf 4 Signets IHPACT OF CANON HODE fAILURE (CHF) ON TRIP fUNCTION Trip lost Trip lost Trip Lost Signal lost Signal lost Signal lost ALARH/ALIERXATEINDICATION STSIEH AYAILASLE Ad c4 on Ava ab

~ PancL lnslcatlon

~ Panel recorder

~ Cocputcr indication Iver e A ares Available control systcN

~ Nl prcssure (2325 psla) vi~ control systcct

~ Three high prcssure

~Lares at 2350 psla (occ>> dated 10/13/92 fres M.A, Sotos to V.D.

Vandcrgurg)

Mlde range RCS tccp recorders AdIce t I Ava ab

~ Panel Ind cation

~ Panel recorder

~ Cccputcr indication IV A afll!$ AV4 ab

'LCVCL devi ~t ion via controL systea (ceno dated 10/13/92 fraa M.C. Sotos to V.D.

Vandcrgwg)

Ad 4

Ave abl e Cofputcr Indication saoe as for dlffcrcntlal prcssure signal Ild at Va aht Cocputcr Indication A afcc Ava Upper cental rfacnt prcssure high or lou (tuo stare>>)

DIACRAH g FD -2101 Sheet I f0.2102 Shcct 3 FD 2101 Sheet 5

CONSEOUENCES OF UNAVAILASILITT OF DIVERSE ALARH EVALUATION Of EVENT This cvcnt uas onl'y cvaluatcd for Unit 2. It ls not In thc Unit I License basis.

A Unit I analysis Is provided ln the Unit I UfsAR for lnfofc>>tion cnly.

the FSAR anglysls for this event has been per forced at full pouer ulth OAS ulthout loss of offalte pouer.

This analysis assuacs that ~

reactor trip ls initiated Chen the Lou-Lou stean generator level trip sctpolnt In the ruptured stean generator ls reached.

Thc Lou-Lou steea generator uater level trip Is lost, If ~ coc>>on code failure (cHF) of the ncu digital cquipacnt occuf 4 All the reactor trlpc and safety Injection signals ullL be tost (Colum C)cahcn CHF of neu equlpacnt occurs.

goth the aeter driven and twblne driven auxiliary fecduater systcc>> are also lost except In situation descrlbcd betou.

Ihc a>>tor driven auxllfafy fccdvatcr Txnps are not affected by CHF If the pwps started on CCV tx>> Loss of voltage or loss of ~Ll Nein fccduatcr pwt>> (1/S Table 3.3-3, page 3/A 3-19).

Thc turbine driven auxiliary fecduatcr Fxap ls also not affcctcd by CHF lf the Ixup started on reactor coolant pwp bus tavfcrvoitage (I/S table 3.3-3, page 3/L 3-20).

tn case of CHF of the digital equipacnt, stean generator leveL devlatlcn clara, prcssurlzcr prcssure lou deviation clans, prcssurltcr lou level deviation ~lena, and prcssurltcr lou lcv<<L clara are available to the operator.

In addition, three alternate Indications of the stcaa generator uater level, prcssurlter

prcssure, and prcssurfter level are available to the operator.

These clara>> end Indlcatlcns arc capes\\cd to cause the operator to Inttfaie protective and ssfeguards action relatively early In the event.

Using thc coergcncy operating procedures, the operator uoutd very Likely apply auxiliary fCCduater tO the!ntaet Steaa DCneratOra Carller than the 10 alnutcs after the Initiation assuacd in the analysis.

In addition, ue do not believe It Is necessary to assuae an AFM pwp failure ln aklltton to CHF.

In vleu of this and the fact that ~ conservatively soall fecduater flou of

.3C.

1

ISAR TRANSIENT g It.t.6 Ieontrd)

TRANSIENI TRIP/SxfECUARD FUNCTION fOR RX TRIP (FEAR 1'I > 9) b) AuxlIlary teeduater ll) 1uo actor driven auxiliary fcedvatcr purps uhlch are started ont

~

Lou Iou LcvcL IA eny stean gcAcrator

b. Trip ot aIL aaln fccduatcr

c. Any safety Injection signal

d. L kv bus loss of voltage

e. Hcrxlsl actuation III) turbine driven 4uxllfary fccdvatcr Fxnp ls started cnt 4 ~ Lou lou LcvcL In any Clio stean generators

b. Reactor coolant prp bus Ixdcrvoitage IHPACT Of COONH HCOE fAILURE ICHf) OH 'fRIP FUNCTION IOAfP starts Iwtoeetlc initiation) or Lou-Iou stean generator Level ard safety Infection tron non-ACISICI Initiation are lost IDAFP start Iwtoaatle fnitiaticn) on lou lou stean gcAcr4'tor lovEl Is Lost ALARH/ALTERNATE INOICATION STSTEH AVAILABLE Ad I

~ Pressurltcr pressure Lou deviation

~ Presswlzcr level lou devi at ton

~ Prcssurlzcr Iou level

~Prcssuritcr high level dcvlatlon

~Prcssurltcr high Lcvct OIACRAH g CONSEOUENCES OF UNAVAILABILITTOF 0 IVERSE ALARH EVALUATIOH Of EVENt 600 gpa ws accused to be SIBTILlcd to tha Intact steoa generatOra, a SIbetantlatty targcr

~uxlllary fceduatcr tlou can be expected to be supplied to the Intact Stean BCneratora.

Cn this basis, lt ls likely that the event not only uoutd not be uorse than the analytcd case, but could Likely be less severe.

At ~II poucrs, the stean gcncrator lcvcl devlatlon clara Is available.

In edfltion, Auserous slams describing the status of the condensate and fceduater systce ixnps and pressures, such as condensate hotwll Level, booster ootor trip, nein fecdvater fxnp, etc.

ulll activate.

Uhcn at least tuo channels of fccdvater are lost above AOX, thc AHSAC ttoer ulll also initiate. If the tlcgr Is attoued to tine out, ~ turbine trip and wxlllary fceductcr Ixnp start ulll be inltlatcd.

The turbine trip ulll result In ~ reactor trip uhlch Is Ixlaffccted by CHF.

~

P

UHII I an@

ISAR TRAMSIEMT 4 IC.3.1 TRAMSIEHT Large Brcak Loss of Coolant Accident TRIP/SAfECUARD fuMCTIOM IOR RX TRIP (fSAR L4. 3 ~ I) 1.

Reactor trip on lou prcssurlzcr pressure 2.

Safety Injection (Sl) on Icw prcssurlzcr prcssure 3.

Containacnt spray on hi ~

hl prcssure IMPACT Of (XZCQN HOOE IAILURE (CHf) OH TRIP IUMCTIOM Reactor trip lost safety Injection signal lost Hl hl pressure spray

~ctuatlon and ESF trip lost.

ALARH/ALTERMATE IMOICATIBM STSTEH AVAILABLE nd at Ava tabt

~ Panel Indlcat on

~ Panel recorder

~ Cccput sr Indication v

e 4 fas Avaitab Prcsswlzcr prcssure Lou deviation (turn on backup heaters) vie control systea (aeee dated 10/13/92 free U.C. Sotos to V.D. Vanderburg)

Panel Ifdlcation Coefwtcr lndlc4tloA vc A efec Avail abl Upper contalffacnt hl/Lo pfcssufc

~ Lares 4v41 lable via. ccntrol systca (oece date 10/13/92 froa U.G.

Sotos to V.O. Vanderburg).

0t h

~

Ad Ica t I Lowr containacnt radiation Monitors (isolated on phaseg).

Upper ccntalffaent arcs radiation aonltors.

Post accident high range con\\clffacnt afc4 aceltol'4 ~

Pressurizer Level lou deviation clara.

Prcssurl acr Lou Level

~lara.

Lowr contalnaent slap lcvcl high.

Conte I<<sent

~ Ir tccper4twe high Accusulator Level high or lou (ona al ~fa pcf'ccuaJI

~ter) ~

Acclaulator prcssure high or Lou (onc alara per

~ccloutator).

RCS hot leg pressure LOU RCP Seal 1 diff prcssure Lou (CAC clara pcf'CP) ~

OIACRAH g I0.2101 Sheet 1

COMSEOUEMCE'S Of UMAVAILABILIIY Of DIVERSE ALARM Diverse

~lara for Lo prcssure (turn cn backlp heaters) vie control syst<<a ls 4v4ILabtc Consequences of teaval tabll Ity of Sl systca is decreasing RCS Inventory resulting In an Increase of peak clad tccpcratUfc, Ihe only protective flection prior to operator action Mill ba ccclaulator injection.

Thc operator UIIL be lnutdatcd by ~Iafas for this event as indicated lsder the other Alafas/Ifdlcatfons heading.

Nevertheless, w

~ssuae M seconds for the operator response t lac.

Since tha outcoae of this event depends on proept safcguards actuation, 44 aodc lcd UAdef'pp<<dlx X rules,

~lcvatcd PCT and extensive fuel daaage Mould be expected to ba calcUla'tcd by <<l Appcfdlx K aodeI.

EVALUATIOH Of EVEMT Thc fSAR analysis of this event shous that a large brcak LOCA Uith discharge coefficient (cd) of 0.6 is the aust llaltlng casa for Unit 2 Ulth the RHR cross-ties open.

for Unit 1 ~ aax Sl case ls Llaltlng.

The fSAR analysis assuaes

~

reactor trip on lou pressurizer prcssure <<d subsequent lnltlatfon of safety Injection, and acclxulator Injection at 600 pale.

The Lou prcssurlzcr prcssure reactor trip and lou pressure safety Injection signals are lost, lf a cemxe aode failure (CHf) of thc ncu digital

!nstruaentatlon systca occurs.

1he Large brcak LOCA results In a rapid dcpressurl tat ion of the reactor coolant systca (RCS).

The Lou pressurizer prcssure deviation clara MILL actuate at 25 pslg below controller setpolnt of 2235 pslg (Proccduri 2.OHP C02C.200 Drop 0).

figure 1C.3.1-3a of Unit 2 fsAR shous that this alara Mould actuate ln less than cne scc<<d of transient.

Three alternate indications are available for the IOM pressurizer pfcssure.

The taper ccntelnacnt high prcssure aiafa Mill actuate at C0.2 pslg (Procedure 2.0HP C02C.105 Drop 31).

These <<d other alaras as frdicatcd under Other Alaras/indication effectively Harn the operator that ~ aajor accident ls occurring.

Accusing that the operator'a response tlac to altlgate the event ls 60 scc.,

the reactor Mould be trlppqd at about 61 seconds of transient <<d subsequently Initiate the safety Injection <<d accwulator Injection.

In our evaluation, w assuaed that the results given ln fSAR are delayed by about 60 secceds.

frca figure 1C.3.1-15a, the peak clad tccpcrature (PCT) of 21CO'f occurs at about 260 accord of transient.

LBLOCA ls a very coepllcatcd cvcnt to aodcL ~

Therefore, extrapolations of PCT are very leCcftaln, AttccptlAB to CXtfapolat4 flgUrCS N.3.1-154 for Unit 2 and IC.3.1-13I for Unit I by Inserting ~ delay of 60 accords for operator response tlae suggests PCT'4 as high as the 3000'f range.

HoueVCr, the rcaL situation ls In all likelihood such Less severe.

Best cstlaatc aodcls 4l' knoun to rccult ln slgotantf ~Ily Lover PCT's.

Houevcr, even If the App<<dlx X

~ 36-1

'I

+

u

~'

~

0 I

UNIT I and

<SAR

[RANSIENT N IL.3.I (cont'd)

TRANSIENT TRIP/SAFECUARD FUNCTION fOR RX TRIP (ESAR IMPACT Of COHHOM HCOE fAILURE (CHF) OM TRIP FUNCTION ALARM/ALTERNATE IMOICATIOM STSIEH AVAILABlE RCP Seal I leak off Iou (one clara per RCP).

Loop RCP trip or Lou fLou (one clara per RCP).

ice condenser Inlet doors open Contalnaent deupolnt conltor (checked at least once per ~ lght hours).

DIACRAH S CONSEOUEMCES Of UNAVAILASILITS OF DIVERSE ALARH EVALUATION Of EVEMI nodal ls conservative by as such as EOO~F g the acceptance crltcrla for IOCFRSO.AS cauld ctlll possibly be exceeded.

Although these estlnates of the ispact of a CHF on LSLOCA Is of concern, lt ls unlikely that such an event Mill occur cnd even nore unlikely that such an event Mill occur ln coincidence ulth CHF.

As indicated ln Section IL.3.3 of the Unit 2 UFSAR, p IL.3.3.4, pipe uhip rcstralnts and other protective cessures against the d)naaic eifqcts of ~ brcak ln the nein coolant piping arc not required because "Leak before break" can be attuned to allou for shutdoun of the Cook Units before an event as catastrophic

~s ~ LSLOCA occurs This arguaent also gives rcasonabl ~ assurance that such an event in conJtnct ion ulth ~ CHF Is extrcnely tnt Ikeiy.

1 P

0

'S

~

f t

UHI'f 1 2

fSAR TRANSIENT g 14.3.2 IRANSIENI Lost ol Rcoc'cor coolonc froa saall ruptwcd pipes or froa cracks ln Large pipes lhlch occuotc the Eacrgcncy Core Coating Systea (Brcak tice c).OILZ)

TRIP/SAFEQMRO fUNCTIN fOR RX TRIP (CESAR I I.3.2) 1.

Reactor trip on Lou RCS prcssure 2.

Safety InJcctlce (SI) on Lou RCS prcssure (auto Inltletion)

IHPACT OF CaeN HCOE FAILURE (CHF) ON 'IRIP FUHCTIN I.

Lo pressure Rx trip lost 2.

S I (auco Inlc Iat lcn) lost (aeao 9/2/92 free u.

0. Sotos to V D.

Vtndcrgury)

ALARH/ALTERNATE INDICATION STSTEll AVAILABLE 1.

Panel Indication Z.

Panel Recorder 3.

Cccputcr Indication vc Alora Avol obt

1. Prcttwlter pressure Iou dcv let Ion vl~ Control Systca (acao 9/2/9Z froa M. 0.

SOCos Co V. D yonder Bwg)

Other A(orat ndlce on Louer concalreent radlaclon cenicors (Isolated cn Fhttcg)

Upper Contalleenc area red(scion tenlcors.

'resswlccr Level lou deviation

~ Lara Pretsurlcer Lou Level alara Contalreent ~Inc aonltor (checked at Least once pcr ~ lght hours)

OIACRAH g fg 2101 Rcv. 00 sheet 1

COHSEQUEHCES OF UHAVAILABILITTOF DIVERSE ALARM Diverse Alara for Lo Presswc via Control Syttca Is available.

Consequence of cnavaitabilicy of Sl syscca la decrcaslny RCS Inventory resuttlny ln an Increate of peak clod tccpcraturc.

Ihe period of core cncovcry could be extended lf Sl tystca It noc occuoccd ln ~

Clesly aorecr.

(fSAR 14.3.2)

EVALUATIOH OF EVENT lhc saall brcak loss of coolant accident results ln dcprctturlcacicn of the reactor coolant tyscca.

The Llaitlny break (as deceralned by the highest calculated peak fuel rod cled cccperacure) for thc high head safety Infection cross*cia valves opened ls 4 Inches In disaster for Unlc 2 and 3 Inches In dlaaetcr for Unit I ~

A cold lcg brcak uos Initiated at RCS prcssure of 2100 psia and Tavg of 501.3 F for Unit 2.

The Unit I Initial Tavg uos SCT f. for the Unit 2 case, the Rx trip uas actuated at 1060 pals (fSAR, page IC.3.2.9).

In the Unit 2

anatysls, the tifccy Infection (Sl) signal

~ctuaced at ITIS psla ulth ~ Zy second tlac delay to acccxnt for diesel gcncrator scartup and caergency paver bus Loading In case of offslte pouer coincident ulth an accident.

Ihe aoxfcxlo fuel cladflny tccpcraturc sttalncd during the transient uas 1C26 f (Units 2 UfsAR, pose 'IC.3.2 12).

the canton cede failure (cHf) rcsulcs fn Loss of both Lo prcssure Rx trip and autoaatlc Sl.

Hovcvcr, for Lo pretcurlter prcssur>>,

three alternate lndlcacicns, and lou prcssure deviation via ccecrol syscca Diverse Alone are avallabl ~ for thc operator to trip thc reactor aueatly.

1he alara, PZR Prcssure Lou Deviation Backup Ilcaccrs Ce, ul(L activate at 2210 pslg (Z.OHP C024.200 Drop 0).

The corrcsPonding sccpolnt ls 2060 pslg for Unit 1.

SBLOCA lt s very cccpllcsted event to cade(a Therefore, extrapolations of pCT ere very entertain.

Attccpts to extrapolate flgurcs 1C.3.2-C for unit 2 and 1C.3.2-5 for Unit 1 by Inscrtlng an adflcfcna( 60 seconds of haec up tfte to accocnc for operator response cine In lieu of autceaclo actuation Led to lncrcaental Incrctte In PCI's o( ASOOF ald 200' respectively.

For Unit 2 there Is a aargln to accocedatc a 500'f Pcl Increase for the cross-t1 ~ open cosa.

Tha Incrcaental PCT uould Lead co only 1900of pcf. for Unit 1 such aorgln appears not to cxlct.

Roucver, the unit 1 SBLOCA analytic uat pcrforacd at 3560 INT for 15xlS fuel ulth the Intent of bounding both Units. If one attuacs the rul~ of ttxab, CSof for each IS of Dover, there ls CSO f of PCt aorgln due co chic contcrvaclsa.

Unit I

~ 30

l l

UMII I 2

fSAR IRAN1IENI N 14.3.2 leon'tl

'IRANSIENI IRIP/SAFECUARD fUMCIION FOR RX !RIP (fSAR I'4.g i)

IHPACI OF CONN IMOE fAILURE (Cxf) CSI IRIP f UMCI ION ALARM/ALIERMAIEIMDICATIOM SISIEN AVAILABLE DIAGRAII 0 CONSEQUENCES OF UNAVAILAeltllfOF DIVERSE ALARM EVALUAIION OF EVEMI 8E operates at 3250 Muf snd there ls no Intent to Increase this paver.

thus there efpcars to be substantial pcf nareln In the Appendix K sstocA sadcl for Unit I also.

lie further note that, as ln the case of LSLOCA, the Appendix K codel ls s bstantlatly ccnscrvatlve.

furthcrcorc, thc analyted events

~ssuacd the loss of a train of Sl Ixnps.

Such an asslrptfon, ln addit'lon to thc sultlple failures ot CMF, ls also ~ slbstsnti ~l conscrvatisn.

Ihcrcforc, It ls concluded that, even ufth additional operator response tines relative to autcoatlc actuatfon, IDCFR SD.S6 acceptance crltcrfa Mould Likely be aet for

- SSLOCA.

Ihe hleh head safety Infection cross-ties closed cases Mere not considered because the Cook Units

~re operated ulth these cross-tice open cxccpt for short periods of surveillance tcstfnS and nalntcnance.

~ 39-4

C t

k

UNIT I 2

fSAR TRANSIENT 8 IC.3.C TCANslENT Long Tera Cont ~ insent Integrity Analysis (Section LC.3.C of unit 2 refers to Unit 1 ufSAR Section IC.3.C)

TRIP/SAfECUARO fUNCIIOH fOR RX 1RIP (fSAR III Q.LL) 1.

Contslrrscnt SPfay on higrl high prcssure signal IHPACT Oi COHHON HCOE fAILURE (CHf) OH TRIP IUNCTIOH Lost ALARH/ALIERNAIEILOICATION STSTEH AVAILASLE

<ld cs ons Av4I able Panel Indlcat on Cocfuter Indication v r sr<<a Av I 4b Upper ccntairyscnt h /lo prcssure alaras available vl~ ccntroL systca (ccco dated 10/13/92 froa U.O.

Sotos to V.D. Vsndcr8urg) other Alar<<s Adl ti Prcssurlzcr prcssure lou dcvlstlcn (turn on backlp hcatcrs) vs control cysts<4 Lover coAt~ Inscnt radiation aonl tora (isolated OA phased).

Upper ccntal<vscnt arcs radiation sonltors.

Post accident high range contalr<scnt arcs aonitors.

Pressurizer lcveL Iou devi st Ion stars.

Prcssurlzcr (ou level slane.

Lover conte(<<sent swp level high, ccA'tal<vscnt ~Ir tccpereture high.

Accus<Later lcvcl high or Lou (cne alara per

~zeus<Later).

Accus<later prcssure high or (ou (CAC Clara pcr"

~ccus<Ictor).

RCS ho't lcg p<'cssufe lou RCP Scat 1 diff prcssure lou (cAC alcfa pcr'CP) ~

RCP Seal 1 leak oft lou tone alsra pcr RCP).

Loop RCP trip or Lou flou (one alara per RCP).

Ice condenser Inlet doors

OPCA, Contalnscnt dc<point acAIter (checked 4t lc4st once pcr eight hews)

OIACRAH 8 f0.2103 Sheet C

CONSEOUENCES Of UNAVAILASILITTOf DIVERSE ALARH EVALUATION Of EVENT cnly the long tera ccntalnsent prcssure analysis ls considered In this cvalwtlon.

The short tera prcssure analyses typically have peaks prior to thc actwtlon of any protective or ssfegusrds fIs<et lone and cre therefore not applicable to this evaluation.

'Ihe asss and energy release rates for stcasl inc breaks are considerably less than the RCS daRIIC-ended flop suction PIPe breaks (Unit I, FSAR, P. IC.3.C-18) and are, therefore, bauIdcd.

The ccntafnc<cnt tccpcrature effects of stcaa(fne breaks are ccnsldcrcd In Section 1C.3.C/N.3.11, Electrical Equlpscnt Envirovscntal Ousllticatlon Otsss and Energy Release Inside Contalnscnt and Outside Contalr<ocnt).

The fSAR analysis of this event shous that pressure peaks about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Idto thc event uhen the lce bed.colts out.

Thcrctorc< as long as additions( energy Is not added to the contalrvacnt 4$ 4 result of coo<son node failure (CHf) ot the new digital Instrusentatlon, the peak pressure should not change.

In large break LOCA, the reactor fs procpt(y shut doun by voids.

1hc long tera LOCA cooling analysis

~tsures that It does not bccoc<s critical again.

lt actuation of safegusrds Is delayed, PCT Hill be expected to rise above the analyzed value ICItlL the core ls quenched at a delayed tine and, thcrctorc, addition fuel daccge asy occur.

Houevcr< thc nct energy delivered to the ccntefr<scnt Is not lfpectcd by 4 fclatlvcly snail change of a alnutc or tuo In the re<Cove(

of thcraat energy froa thc core and delivery to the oontainscnt In the carly alnutcs ot thc event.

It ls concluded that ~ delay of a fcu airs<tea In the actuation ot safcguards Hill have no fcpsct on the analysis ot record.

fwthcrsore< since It I ~ not necessary to accuse that one train of safcgusrds falls ln addlticA to CHf, lt Is rcascnabie to believe that the operator can aaruaLLy activate tuo full trains of safcgusrds 44rly ln the event.

cn this basis, It ls Likely that the event not only uould Aot be Horse than thc analyzed case, but uould like'ly be less severe.

~ CO

~

1

, 'I

,> i

UNI'I I and 2

ISAR IRANSIENI g It.).t tccnt~d)

IRANSIENI IRIP/SAfECUARO fWCIION FOR RX IRIP (fSAR INPACI Of CONHON NODE fAILURE (CNf) ON IRIP FWCIION ALARN/ALIERNAIEINOICAIION SZSIEH AVAILARLE DIACRAN g CONSEOUENCES Of WAVAILARIL!Iy OF 0IVERSE ALARN EVALUAIIONOf EVENI Although the lapact of CNf on the containaent pressure analysis does not seen to be significant, the pressure analysis ls based on LRLOCA. It ls trdlkety that such an event ulll occur and even nore tnllkety that such an event

<<Ill occur ln coincidence ulth CNF.

As indicated In Section lt.3.3 of the Unit 2 UFSAR, p IS.3.3-t, of pipe uhip restraints and other protective neasurcs against the dynanic effects ot a break ln the nein coolant piping are not required because "leak-be(ore break" can be

~ssuaed to allou for shutdown of the Cook Units before an event as catastrophic os ~ LRLOCA occurs.

Ibis arguaent also gives reasonable assurance that such an event in conjunction ulth a CNF Is extrenety mlikety.

41

I'

UNIT I and 2

ISAR TRANSIENT I

'IC.3.5 TRANSIENT Rad Iolog Ica I Consequences of ~ Loss of Coolant Accident

~nd other Events Consideration ln Safety Analysis.

IRIP/SAFECUARD FUNCTION fOR RX TRIP (FSAR ftf ~ $,5)

Reactor trip/safcgwrd fcnctions arc Included in the cvatwtlcn of fSAR Event N.3.1.

INPACT Of CCHHON HCOE FAILURE (CHF) OI TRIP FUNCTION'cpaat of CHF ls discussed ln th<<cvalwtlon of cvcnt N.3.1 ALARHIALTERNATEINDICATION SYSTEH AVAILABLE Discussed In thc cvalwt ion of event IC.3.'I DIACRAH g CONSEOUENCES Of UNAVAILABILITTOF DIVERSE ALARH EVALUATIOIOF EVENT "

lhe Unit 2 UfSAR analysis of Radiological ccnsequenacs of ~ LOCA Includes analysea of several events for radiological ccnsequenaes cfclch uere perforned by Advanced Nuclear Fuels Corporation.

These events are rcvleued for the lcpact of ccccacn node failure ((Hf) In other sections of this evaluation.

Table I Ilats alL cvcnts for uhich dose <<cnsequcnccs have been anatyted for Cook Units I and 2 anf Indicates In Rich section of this revlcu a discussion of thc Ispact of ~ CHF an the radiological consequences ulll be found.

Section IC.3.5 of the Unit I UfSAR addresses only the Envlraccocntat consequences of e LOCA TABLE I DISISISS ION

~OF

'~EN Loss of Extcrnat Electric Load

'IC.2.7 Loss of Nonaal fccchcater TC.2.7 Loss of All AC Pouer to

. Plant Auxiliaries IC.2.7 Fuel Handling Accident

'IC.2.1 Locked Rotor IC ~ 1.6.2 Stean generator Tube Rcpturc TC.2.7 Rcpture of a stcacl Pipe 1(.2.7 Rupture of a Control Rad 1(.2.6 Drive Hcchanlse Nouslng Single RCCA Asseahty Mlthdrawt N.3.5 IncIdent (this section)

LOCA IC.3.5 (this section)

'tha single RCCA ulthdraual cvcnt uas analytcd for Untt 2 for cycle 6 operattan.

As ~ part of the transition to Ucstlnghause fuel In cycle d, AEP argued and the NRC concurred that this event uas not In the license basis for Donald C. Cook Nuclear Plant, Unit 2.

NRC concurrence ls docxsaented ln ~ Latter frees Joseph O. Clitter of tha NRC staff to H.P. Alcxlch, dated August 3c 1989 anl In the cycl~ d SER, dated August 27, 1990.

Therefore, no neu analysis of thfc event has been per foread.

For the Cook Units, slngl ~ RCCA ulthdrauaL Is

~ntlclpatcd to be an event <<lth niner conscquenacs.

The (nits are generally operated

~t fuLL paver and base Loaded.

In this aode of operation,'he RCCA's arc nearly fully C2-

t I'

I 8

g

UNIT I ard 2

ISAR IRANSIENT M I(.3.5 (cent'd)

TRANSIENT TRIP/SAFECUARO fUMCTION FOR RX TRIP /SAR ]q. 3 g)

IMPACT OF CONHON IKOE FAILURE (CHF) ON TRIP FUMCTIOH ALARH/ALTERMATE INDICATION SISTEN AVAILABLE OIACRAN g CONSEOUEMCES Of UNAVAILABILIITOf 0 IVERSE ALARN EVALUATIONOf EVENT ufthdrakA.

Therefore, ulthdraual of one RCCA a fcu steps has no Irpact. If a unit should be operating at ~ reduced poucr, an Increase In OMSR cksrgfn ls availablc.

The Units sre operated using thc constant axial offset control ckcthod so that the controlling bank ls scldtxa deeply Inserted.

In addltlcn, the rod deviation

~ Lane, uhlch ts maffcctcd by CNFk uould be expected to alert the operator to take appropriate action.

Thc evaluations of snail break LOCA (Event I(.3.2) and large brcak LOCA (Event T(.3.1) shou that the large break LOCA event ls bounding, as there uouid be significant clad failure, If coxson cede failure (CHF) of ncu digital instruacntat lan occurred, slcultancously ulth a LBLOCA.

Evaluation of the large brcak LOCA event (I(.3.1) shove that the CHF of thc ncu digital apipaent could result ln ~ peak cled tccpcrature of approxicatciy 3000'f on an Appendix K basis for both telts.

Thic tccperature exceeds the acceptance criterion of 2200 F, thug resulting in significant cled failure NKI rclcasc of fissicA products ~

The UFSAR analysis of thc radiotoglcal effects of LOCA for both Units fncludcs tuo cases.

In the first case, Identified as the design basis

~ccldcnt. It Is accused that the entire Inventory of volatile fission productc Eonti~

h Ict-add s

of all the fueL rods Is r<<leased during the tice the core Is being flooded by the ECCS.

Of the gap Inventory, SOX of the halogcns and 100X of the noble gases ara considered to bc released to the contalnacnt atskosphcre.

In the second case, ldcntlflcd as the SLaxlcua h)pothctlcal accident, it Is sssuscd that 50X of the ~or I~Oven EX of halogcns and IOOX of the ~or I yfnnooof noble gases are rclcascd to the contalrsaent auaosphcre.

tabl ~

T(.3.5.10 of the Unit 2 UFSAR and Table 1(.3.$.2 of the Unit I UfSAR display thc doses for both the design basis accident and the skSXicxxs hypothetical accident.

As discussed In section 1(.3.1, the delays rclatcd to stRkstituting operator rcspoAsc ticks for clcc'troAlc response slake COuld result ln substantially Increased

- 43

~

~

k

I

~

I I

~

~ <<<<

~

~ ~

I

~

UNIT I and fSAR

'TRANSIENT d IL.3.5 (cont'd)

IRANS I ENI TRIP/SAFECUARD FUNCTION fOR RX TRIP (fSAR Iq.3.y)

INPACT OF CCNNCN NQOE FAILURE (CNF) ON TRIP FUNCTION ALARN/ALTERNATE INOICAIION STSTEN AVAILABLE OIACRAN N CONSEOUENCES Of UNAVAILASILITT Of OIVERSE ALARN EVALUATION Of EVENT fuel dosage on an Appendix K basis.

No+ever, since the consequences of the coxlsus h)pothet Ical accident are based on core Invencory and since they acct the acceptance crltcrl~ of 'IOCFRIOO, ue conclude that the

~nalysls of this section ls tnaffcctcd by cNF.

Ue further note that the analysts of scccion IL.3.5, p.p. IL.3.5-3, S and 13 of the Unit 1 UFSAR, assuacs only cee train of safcguards Including only onc CEO (an operating.

Although noc explicitly stated, it Is clear that ccntainocnt prcssure ls NaxlsLIzcd by degradatlon of cafcguards Including ccntalnscnt spray.

Sce figure IS.3.5-3 of the Unit 1 UFSAR.

These failure acsuctpclons In addition to CNF are cxccsslve.

c As Indicated In the cvaluatlon of Section TL.3.1, there ls susbstantlal real aargln In the use of an Appendix K nodal to estlcote PCT.

IC ls also cnllkcly that ~ large brcak LOCA ulll occur and It Is cvcn sore txdlkely that cuch event ulll occur In coincidence ulth CNF.

As indicated ln Scctlon IS.3.3 of the Unit 1 UFSAR, p, IL.3.3-L, pipe ship restraints and other protccclve aeasurcs against the dynLslc effects of ~ brcak ln the Nein coolant piping are not rcqulrcd because

~leak before brcak" can be assuscd to allou for shutdoun of the Cook Units before an event as catastrofhic as a LSLOCA occurs.

This arguacnt also gives reascnabl ~

~ssurance that such an event In ccnJcnctlcn ulth a CNF ls excrccoly cnilkely.

~.D

~

'l%

',J

)

,1 P

e

~ 0 F

1

UNIT 1 and 2

ISAR TRANSIENT 0 14.3.6 TRANSIENT N)drogcn In the Contalnacnt After ~

Loss. of-Coolant Accident TRIP/SAFECUARD FUNCTION fOR RX TRIP (fSAR ILI g g)

Reactor tr Ip/safeguard fuv:tlons are Included In the evaluation of event It.3.1.

INPACT OF CCNNCH HCOE fAILURE ICNF) ON 1RIP FLWCTIOH Ispact of CNF Is discussed In 'thc cvslU4tloA of cvcAt It.3.1.

ALARH/ALTERNATE INDICATION SYSTEH AVAILASLE Dlscusscd in the evaluation of event IL.3.1.

DIACRAH g CONSEQUENCES OF UNAVAILASILITTOf DIVERSE ALARN EVALUATIONOf EVENT There arc tuo hydrogen analyses for the cook plant Iacoo dated 11/16/92 frua R.g. Rcmett to R.S. Sharoa).

The first analysis, Uhich ls ~

part of original design basis, ls given In TSAR IL.3.6.

the second analysis, Airh docs not appear In the fSAR Is 4 response to the Three Hllc Island accident Lace above referenced AUSO).

In this analysis, a very Large avant of hydrogen Is 4SSuacd to be gcACf4tCd by 4 scvcrely daeagcd core, cqulvalcnt to 73X tlrconlus - Uater reaction.

The hydrogen Ignitcrs vere installed to ensure the structural integrity of the containacnt building and survlvablllty ot cqulpocnt end Instrtsacnts Accdcd to stop the progression of thc accident.

The NRC rcvicu of this analysis ls not yct cocpicte.

II thc reactor safcguards Initiation systcn Ucre to fall for large brcak LOCA, the evaluation of Secticn TS.3.1 suggests hfgh POPS.

Nigh PCT's Uoutd be cxpectcd to increase the hydrogen productlcn.

KCUCVCr, the h)drogcn ignltcrs are expected to be turned on eavxally for large brcak LOCA conditions through the Status 1rccs.

Thc Eccrgcncy Operating Procedures fR-2.1 and IR.C.1 Uould be used by the operator In response to high high contairacnt prcssure cnd Inadequate core cooling, respectively, to ensure that the ignltors Uould be available.

IhUC

$UfflclcAt Instfuacntctlon and procedural guidance ls available to the operator to prcvcnt any adverse consequences of hydrogen coobust Ion In the event of CNF of thc ncu digital equlfxacnt.

In Section IS.3.1, It Uas conclufcd that, although the lcpact of 4 CNf on LSLOCA ls of concern, It ls tntlkciy that such an event Ulll occur and even nore LALIkctythat such an event Ulll occtx In coincidence ulth CNF.

As fndlcatcd ln Section IL.3.3 of the Unit 2 UfSAR, p IL.3.3.C, pipe ship restraints and other protective acasurcs against the dynantc effects of ~ brcak ln the Ualn coolant piping are not required because "lea'k be(ore brcak" can be

~ssuncd to ~Lieu for shutdoun of thc Cook Units before an event as catastrophic as ~ LRLOCA

occUrs, This artxncnt also gives rcasonabl ~

assurance that such an event In con]~tlon ulth CNF ls cxtrceety tnt lkeiy.

-AS-

i I

'l V

1

UNIT I 2

,'fSAR IRANSIENT N I 1(.3.(

N.(.II TRANS(EN(

Electrical Equ(paent Env lronsenc ~I Ouall Ileat IOn (Haaa SAd Encfgy Rclc4$ cs Inside Cents(nsent and outside conte(Asent)

TR(P/SAFEQlARD fUNCIION fOR RX TRIP (fSAR tw.

Safety Injection cn fo((ou(ng signa(st (I) Tuo out ol three Lou prcssurlccr prcssure signets (II) Iuo out of three dlffcfcA'clat prcssure signals becueen

~ stcs<< l(A4 <<d the re<<sining stcaallnes (III) Nigh stet<< f(ou (n Cuo Lines coincident ulth Iou-(ou Tavg In tuo loops or sce<<a prcssure Iou In tuo Loops (Cna analysis bounds both Units)

(Iv) TNO out of three high Cents(nsent prCSSure Signa(4 2.

Reactor trip (I) Ovcrpover reactor trips (neutron flux)

(II) OP 41 reactor trfp 3.

Reactor trip In conjlx>>ttcn Kith receipt of cht safety Injection (SI) a(gnat A.

Fccduatcr isolation on any safety Injection s(gnat 5.

Stcaa(lne lsotatlenl (I) N(gh.h(gh cents(lvsent PfCSSUf4 IHPACI Of COWOK HCOE FA(LURE (CNF) ON IRII'UNCflON Signet lost Signal Lost Signal lost signet lost NoC sfftcted Lost NOt affCCCed (KOveVCr, Sll

~uco<<at(c Sl actwtlons are Last.

(here(ore, this sfgnal ls fix>>t(ontt on

<<<<<<4( sl Initiation only)

Nat af (ected (Kouevcr,

~II auto<<at(a Sl actwt(ons are lost.

thcrcforc, this signal Is fix>>C(ona( on

<<<<ssa(

Sl (n(C(at(CA cn(y)

Lost ALACK/ALIERKATEINDICATION STSTEH AVAILASLE Panel lnd(cation P<<>>l recorder Ccopuccr Indication I f t A efe>>

va(teb(C Lo prcssure deviation (turn on backup heaters) vs control systea Ice lon Ava able Panct lrdlcat on Coepuctr IAd(cactoA nd

~ lon Avel abl Sat>> 4$ for d tfcrcAcl~I prcssure sfgnat Stc<<s flou Ifdlcat(on frotcn on CHF nd(

a I Ava blc P<<ltl Indi c4c(CA Cotputer Ild(cat(on I

A Ave b

Upper ceACS AsCAC prcssure high or lou (Cuo 4(af<<s) v A ~

va b

Poucr range over paucr rad SCop (fide range RCS tccpcrature recorders Panel ffdlcat(on Cosputcf tldlcatloA r

4 Ava tMe Upper canes(ra>>nt prcssure DIACIAHg CONSEOUEKCES OF UNAVQILASIL('lTOF DIVERSE ALARH EVALUAt(ON OF EVEKt

'this event Is divided Into Cuo parts, Hass and Energy (HCE) Release Ins(de conte(lvsenc and HLE Release Outs fde Conte(le>>nc.

The Contalnsent Integrity analysis for the double ended (xop suction RCS break case bounds Che <<aln steaa(lne brcak cont ~insent prcssure response.

(UCAP 11902, Slpp(ec>>nt I, p S-3.(-

2).

Rcvlcu of the pressure curves in IJCAP 11902 Supp. I suggests chat there Is sufficient <<argin so that this Kill re<<aln the case even if

$4fCgusfd$ 4ctU4CIOA$ 4fe dc(eyed tF/ I co 2

<<inutes.

If this jldge<<ent shautd be opt(<<lst(c and one of the steaa((ne HIE Release events Should cause the santa(nsent prcssure to exceed 12 pslg, It Is noted that the NRC In ~ letter fra<< Steven A. Verge of thc NRE staff to Hr.

)ohn Dolan of Indiana and H(eh(San Electric Coepsny accepted 36 ps(g as the cence(nsent ultl<<ate strength.

Thcrcfore, thtc!ssue util not be considered further.

the tceperature prof((ca (n IICAP 11902 Slpp I for the Hain Stcaal(ne greek (HSLS) Cents(lvsent Integrity uere rcv(cued for this evaluation.

Tuo Ll<<(ting transients are discussed.

'fhey are 6.6 sqft daub(e cndcd rapture (DER) at 102X RTP and ~ 0.05 ft split brcak at 102X RTP.

Doth of these Include sfnglc fallurts, <<@In stca<<

Isolation failure for the DER and wxlllsry fcedvatcr EFxlp rlxvxlt protection failure for the split Ic ls Ao'C Accessary co assuse

'these failures fn ackl(tton to the cocnon <<ode failure (CHF) of the neu digital lnstrusentatlon.

Thc tetperaturc ard prcssure peaks of the DER oecUI' c 6,( sccoAds <<d 1(,01 SccoAds respectively.

'Ihts ls Nell be(ore the first safeguafds of steaallne Isolation at 10.5 ascends hut near and after reactor trip at i6 seconds.

Thcrcfare, It I~ tstl<<ated that the Icpact of the CHF uou(d be retatlvely <<odest.

thc tccperature afd prcssure peaks of the split occur later at 50.72 ascends.

Ihe tccperatwe

<<d prcssure trajectories are on the rise at the tice of thc peaks.

the risc ls tcf<<(nated by cents(nsenc spl'4'y (CtS) 4ccU4cioA, Ic 4ppe4rs that the tecperature could exceed che 330'F to (6

UNIT I 2

ISAR TRANSIENT N T(.3.(

cnd TL.L.II (cont'd)

'fRANSIENI TRIP/SAfECUARD FUNCTION FOR RX IRIP (FSAR L'I 3 9+

lit cl'l (II) Nigh stcaa flou coincident ulth Lo'Lo Tavg (III) Nigh stc<<a flou coincident uith Lou stcaa prcsswe (One analysis boc<<ds both Units)

IMPACT OF CONNOM H(OE FAILURE (CNF)

OH TRIP fUNCTION Lost ALARM/ALTERNATE INDICATION STSTEN AVAILABLE cxlic onc Avcl ab c llide range RCS tccperature recorders Panel IAdlcatloA Cocputer Indication Stc4a (lou IAdlcatioA frolcn on CNF 0 h r A erat Adica ion Lou pressurl ter leveL deviation Lou prcssurltcr lcveL Steaa generator high lcvcl dcvi4t ioA Icc condenser Inlet doors OPCA Ccntaincent dclpotnt acnltor (checked at least once pcr ~ lght hours).

DIAGRAM y CONSEOUENCES OF UNAVAILABILITTOF DIVERSE ALARN EVALUATION Of EVENf lhlch contalraent cqulpaent ls qualified lf the actuation ot CTS ucrc detayed by I to 2 alnutcs.

Novever, transalttcrs are tested to

<00'F and are encased fn thick cast iron cases.

It ls expected that the thersaL Lay of these cases can accoccaodatc one or tuo alnutcs of delay.

CIS actuation ls step 13 of Eaergcncy Operating Proccdwc E.O and ls expected soon after entry Into the procedure.

Mhcn CTS Is actuated, It Is expected that both trains uculd be available and that the spray Mould rapidly condense the stcaa and cool the cnvlronacnt to tccperatwea uelL belou that calculated in thc analysis of record uhfch assuaes only one train of CIS.

This Is expected ulth approxlaatciy one Minute delay relative to thc analysis of record.

4 Ihe ability of lhe operator to respond to available aiaras ard Irdlcatlons and enter thc caergcncy operatiny procedures ls discussed In Section I(.2.5. It fs expected that the delay ln actuaticn of safeguards and protective fc<<ot lone Mould be I alice.

Based on this and the discussion above, It ls concluded that a NLE rclcase of the aaynitude of the Llaltlng cases ulth a CNF Mould result fn acceptable consequences, The NLE rclcasa outside of contalrcaent Is analyxcd to ensure survivability of InstrMaents and cquipacnt In the aain ate<<a enclosures.

Ihe toLloulng cvalu4'lion Is b4scd CA ~ a<<so dated 11-20-92 froa R.B. gannett to R.S. Sharaa "Cook Nuclear Plant, Failure of Reactor Protection Syst<<a Icpact of steaallne Brcak inside and Outside of Ccntafnacntc.

In thlc event,

~ large steaa flou eventually txlcovcrs the stcaa generator tubcsi 4LLCNIAg tha cxltlng atcaa to bcccae Scpcrhcated fn passing across the tubes.

Superheat ls the priaary concern tor this cvcnt.

Prcssure affects are over ln ~ f<<c seconds, so the reactor protection and safcguerds actuation cyst<<c does not 'ccoe Into play for prcssure effects.

The analysis perforsxNf shous that< for the llaltlny breaks (1.0.1.2 ftc), thc reactor trip occurred at 108 seconds or greater based on

UNIT I and 2

ISAR

'IRANSIENI g L(.3.(

hand LL.L.II (cont'd)

'IRANSIENI TRIP/SAF ECUARO FUNCTION fOR RX TRIP (fSAR IN.

IHPACT Of CCHHON HCOE fAILURE (CKF) ON TRIP (UNCT ION ALARHJALTERNATE INDICAIION STSIEH AVAILAIL.E OIACRAH N CONS(<<UKNCES OF UNAVAILASILITT OF DIVERSE ALARH EVALUATION OF EVENI

'J Lo<<<<stcaa generator level.

Significant Levels of s<<pcrhcat occurred ainutcs later.

Since the ctc<<a generator level alar<<<<s uould be reached

<<such earlier than the conservatively calculated stc<<a gcncrato<<'evel sctpolnt, the effects of

<<Cain steaaline brcak on cqulpacnt 3<<auld be ulthln the analyzed bourvfs.

lhe only plausible fast acting break is L.C ft2,

<<hlch predicts

~ reactor trip at 8 seconds on either Lou stcaollne prcssure (Unit 2) or Lou stca<<CIIne pressure colncldcnt ulth high stc<<a f(ou (Unit I).

The reactor trip at 60 sccgnds delay (operators response tioe) for I.A ftx~(88 sec<<<<vff) should still be bo<<xvfcd by the analyzed 1.2 (t~ brcak ulth trip at 108 seconds.

for the c>>st recent aass and energy rclcasc outside ccntainocnt <<>>Lysis a calculation of the heat up of the cast Iron cases uas pcrfor<<acd.

Therefore, part of the wargln represented ln the thcroeL lsg due to tha cast Iron cases has been used.

Noucvcr, tha fact that the transolttcrs have been tested to 400'F does apply to these transolttcrs and provides assurance that thc Instruocnts are Likely to f<<x3ctlon cvcn If the tcspcrature briefly cxcccdcd the qua'Liflcatlon tccpcrature.

In

~dSItlon, in the very uorst sccnarlo, only the Instruacntction assoolstcd ulth rIJPturcd stcac<<

Line end or>> other stcax Line uouid be dac>>gcd.

This ls the case because the ates<<s enclosures for stc<<a Lines one and four exit cental<<vacnt on one atda and the stc<<a enclosures for Linea tuo hand three exit IEO'uay on the opposite aide of the cental<<vacnt.

Therefore tuo stcaa (inca 3<<1th f<<C3ctloning Instruacntation are available to controL the cysts<<a <<x3til lt can be placed bn RNR ln this Horst case scenario.

Sated on this and the discussion above, It ls ccncludcd that a HLE release of the s>>Snit<<xfe of the LI<<siting cases ulth a CHF uould result In acceptable cense<<ptnccs

~

- (8-

APPENDIX B

OT A L CABLE EV S

FSAR Section 14 3

3 This section addresses the me'chanical forces from LOCA, Design Basis Earthquake (DBE), and combined LOCA/DBE.

The Unit 2 FSAR documents the applicabili.ty of leak before break to Cook.

The most recene analyses of this type are described in WCAP 11902 and the Unit 2, Cycle 8 RTSR.

These evenes consider approximately the first second of ehe transient and are not impacted by protection or safeguards actuation.

FSAR Section 14 3 7 This section addresses the overpressuriration of the vessel after cooldown.

The UFSAR material from 1982 appears not to address the ERG based EOP's.

The current maeerial is the ERG background material.

The ERG material is symptom based. Actions required of the operator are based on the results of an analysis based on a step temperature change in the cold leg.

The initial temperature was chosen to be a conservatively high 550 F.

The actions are then based on the observed temperature during ehe course of the implementaeion of ehe EOP's.

The eemperature and pressure are moni,tored continuously throughoue the application of the EOP's by staeus tree F-0.4, Integrity. (If one exceeds curve A of the staeus cree criterion, a

soak time is required).

See p.p.

4, 8 of F-0.4 background and p.

5 of FR-P.1 background.

Based on the nature of the ERG

analysis, this event is noe believed eo be impacted by a common mode failure of the new digital equipment.

This opinion was discussed with Satyan-Sharma on Hov. 13, 1992.

He concurred.

FSAR ection 4

3 8

This section describes an analysis to show that the RCS will not depressurize below the Nz injection point from the accumulators prior to the time when S.G.

cooling is no longer needed for SBLOCA.

Cases with and without operator action are considered.

This material is superseded, or at least modified, in view of the ERG based EOP's.

Operator action is provided as required for any event to ensure isolation of the accumulators prior to the injection of nitrogen into the reactor coolant system.

At least the following events were addressed.

(The step numbers are ERG numbers not EOP numbers).

LBLOCA SBLOCA Loss of Sump Recirculation Steam Break/4 Loop Inadequate Core Cooling Degraded Core Cooling E-1 ES-1.2 ECA-1.1 ECA-2.1.

ECA-3.1 ECA-3 '

FR-C.1 Step 28 Step 23 Step 12

Response

to ICC FR-C.2

Response

to DCC Step 12 Loss of Rx or Secondary Step 1S Coolant Post LOCA Cooldown and Step 23 Depressurization Loss of Emergency Steps 23, 31 Coolant Recirculation Uncontrolled Steps 10, 38 Depressurization of all S.G.'s Recovery Modes 1't should be noticed that the issue is more broadly addressed in the ERG's than in the UFSAR.

The UFSAR cases with no operator response are irrelevant to this evaluation because operator response must be achieved on the loss of nearly all protection and safeguards actuations to achieve a satisfactory outcome.

The operator action cases are superseded by the ERG analyses.

The ERG decision to isolate the accumulators is based on observable parameters and is not impacted by an additional delay of =1 minute.

The ERG analyses in suppor~ of SBLOCA's (1" break) show that the accumulators will be isolated on subcooling not on low primary pressure.

For larger breaks, those for which primary pressure stabilizes at or belo~

approximately 300 psig, the accumulators are isolated after the accumulators have injected.

See response not obtained for step 15 of E-l.

In conclusion, the ERG's address the issue in Section 14.3.8 more currently than the FSAR.

The ERG's are symptom based and address a wide range of contingencies.

They are not directly affected by an additional delay of ~1 minute in obtaining a protection or safeguards action.

They are designed in sufficient depth to provide assurance that a unit can be brought to a safe and stable condition following any accident.

FS Sect on 14 4 This section is a general description of the analysis of high energy line breaks outside of containment.

The material in this section is further elaborated in sections 14.4.3 through 14.4.11.

A high energy line is a line with normal service temperature above 200 F, a normal operating pressure above 275 psig, and a nominal diameter greater than 1 inch.

Five systems were determined to include high energy lines.

They are:

1)

Main Steam 2)

Feedwater 3)

CVCS 4)

S.G.

Blowdown 5)

Steam to TDAFP Breaks in high energy lines were examined for:

1)

Pipe Whip 2)

Jet Impingement 3)

Jet Erosion of Concrete 4)

Compartment Pressure

- Loading Stress 5)

Structural Resistance to Loading 6)

Equipment E.Q.

Item 3 was determined not to be a problem in general.

Breaks were analyzed for criteria 1, 2, 4, 5, and 6.

Cracks were analyzed for 1, 2, and 6.

An ESW flood incident is also included in this section.

No impact of the postulated freeze" of the Foxboro digital software on these analyses or those of Sections 14.4.3 through 14.4.11 was identifiqd except as indicated in the following comments.

FS Section 14;4 3

This section addresses, in a general way, the ability to bring the reactor to a safe condition following the events evaluated for high energy line breaks.

As indicated on p 14.4.3-1 of the Unit 1 UFSAR, they are general because "it is deemed appropriate to allow for assessment of the incident prior toiultimately bringing the reactor to cold shutdown".

Main steamline breaks'(MSLB) are discussed in section 14.2.5 from the point of view of core response and in section 14.2.7 from the point of view of offsite dose effects.

MSLB outside of containment from the point of view of equipment qualification (EQ) is addressed in UFSAR sections 14.4.6, 14.4.10, and 14.4.11.

The evaluation of the impact of common mode failure (CMF) of the new digital equipment on MSLB EQ has been placed in section 14.4.11.

Feed water line break was analyzed from the core response point of view in section 14.2.8.

The NK release from a feedline break is believed to be similar with or without CMF.

Unit 2 UFSAR Figure 14.2.8-4 suggests that the affected S.G. blowdown for a feedwater line break takes

=200 sec.

By this time, it is believed that the operator will be well into his immediate actions.

Steamline isolation is step 12 of E-0.

The operator willcertainly be well into immediate actions, if there is a turbine trip. If there is no turbine trip, the turbine is a significant competitor for steam from the intact steam generators.

Failure of a steam generator stop valve would also not be assumed in addition to the multiple failures of the CMF.

Therefore, blowdown of the mainsteam lines would not occur after manual initiation of mainsteamline isolation.

CVCS line break assumes operator action.

The alarms assumed continue to be available from the control system,.

and therefore, are not affected.

This description is not affected.

Both the turbine driven auxiliary feedwater pump and steam generator blowdown line rupture are considered to be small steamline ruptures according to the UFSAR.

Therefore, their effects would be expected to be bounded by MSLB and feedwater line break.

No impact of the postulated "freeze" of the Foxboro digital software on events other than MSLB was identified.

Since MSLB will be discussed under section 14.4.11, the section is classified as NA.

PSAR Sect on 4 4 4

This section provides the quantitative results of stress calculations for high energy line breaks.

See the discussion of Section 14.4.2 above.

FSAR Section 14.4.5 This section provides some further elaboration on the pipe whip analysis.

See the discussion of Section 14.4.'2.

Note that this analysis uses the maximum operating pressure for conservatism.

FSAR Sect on 14.4 6

the pressure

~ analysis outside The pressure peaks appear in the an increase in time until reactor this section is classified as not This section provides further details on containment due to a high energy line break.

first second or two and cannot be impacted by trip.

Therefore, the pressure peak aspect of applicable.

Temperature peaks are

=5 minutes into the event presumably due to heat sinks.

The impact of steam generator superheat from a MSLB outside containment on equipment qualification is addressed in this section.

Without automatic safeguards functions, the environmental conditions could potentially be worse.

The equipment qualification aspect of this section is combined with Section 14.4.11 where event+

which impact environmental conditions and which are mi~iga~ed by protection and safeguards actuations are discussed.

These events are mass and energy release inside and outside containment.

FSAR Section 14 4 7 This section provides some further elaboration on the jet impingement analysis.

It also uses the maximum operating pressure.

See the discussion of Section 14.4.2.

FS ect on 14 4 8 This section describes the impact of high energy line breaks on the containment exterior.

See the discussion of Section 14.4.2.

~ ~ -

FSAR Section 14 4 9

This section describes the modifications required by the high energy line analysis.

It will not be affected by the Foxboro "freeze".

F AR Section 4 4 0

This section describes the steps taken to'nsure that the'dverse environmental conditions that result from HELB do not inhibit the ability to bring the reactor to cold shutdown.

Without automatic safeguard functions, the emrironmental conditions could potentially be worse.

This section is combined with Section 14.4.11'here events which impact environmental conditions and which are mitigated by protection and safeguards actuations are discussed.

These events are mass and energy release inside and outside containment.