LR-N17-0034, Salem Generating Station, Units 1 & 2, Revision 29 to Updated Final Safety Analysis Report, Section 15.3, Condition Iii - Infrequent Faults
Text
15.3 CONDITION III -INFREQUENT FAULTS By definition, Condition III occurrences are faults which may occur very infrequently during the life of the station. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the Reactor Coolant System (RCS) or containment barriers. For the purposes of this report the following faults have been grouped into this category: 1. Loss of reactor coolant, from small ruptured pipes or from cracks in large pipes, which actuates the Emergency Core Cooling System (ECCS) 2. Minor Secondary System pipe breaks 3. Inadvertent loading of a fuel assembly into an improper position 4. Complete loss of forced reactor coolant flow 5. Single rod cluster control assembly (RCCA) withdrawal at full power 6. Accidental release of waste gases 7. Accidental release of radioactive liquids The time sequence of events during applicable Condition III faults 1 and 4 above are shown in Tables 15.3-1, 15.3-1a and 15.3-4. 15.3-1 SGS-UFSAR Revision 24 May 11, 2009 15.3.1 Loss of Reactor Coolant from Small Ruptured Pipes or from Cracks in Large Pipes which Actuates the Emergency Core Cooling System 15.3.1.1 Identification of Causes and Accident Description A loss-of-coolant accident (LOCA) is defined as a rupture of the RCS piping or of any line connected to the system. Ruptures of small cross section will cause expulsion of the coolant at a rate which can he accommodated by the charging pumps which would maintain an operational water level in the pressurizer, permitting the operator to execute an orderly shutdown. The coolant which would be released to the containment contains the fission products existing in it. The maximum break size for which the normal makeup system can maintain the pressurizer level is obtained by comparing the calculated flow from the RCS through the postulated break against the charging pump makeup flow at normal RCS pressure, i.e. 2, 250 psia. A makeup flow rate from one centrifugal charging pump is typically adequate to sustain pressurizer level for a break through an 0.375-inch diameter hole at 2,250 psia. This break results in a loss of approximately 17.5 lh/sec. Should a larger break occur, depressurization of the RCS causes fluid to flow to the RCS from the pressurizer, resulting in a pressure and level decrease in the pressurizer. Reactor trip occurs when the pressurizer low pressure trip setpoint is reached. The Safety Injection System (SIS) is actuated when the appropriate setpoint is reached. The consequences of the accident are limited in two ways: 1. Reactor trip and borated water injection complement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay. 2. Injection of borated water insures sufficient flooding of the core to prevent excessive clad temperatures. 15.3-2 SGS-UFSAR Revision 16 January 31, 1998 Before the break occurs, the station is in an equilibrium condition, i.e., the heat generated in the core is being removed via the Secondary System. During blowdown, heat from decay, hot internals and the vessel continues to be transferred to the RCS. The heat transfer between the RCS and the Secondary System may be in either direction, depending on the relative temperatures. In the case of continued heat addition to the Secondary System, pressure increases and steam release through the Main Steam Safety Valves may occur. Makeup to the secondary side is automatically provided by the auxiliary feedwater pumps. The safety injection signal stops normal feedwater flow by closing the main feedwater line isolation valves and initiates emergency feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of RCS pressure. When the RCS depressurizes below the accumulator pressure, the accumulators begin to inject water into the reactor coolant loops. The reactor coolant pumps are assumed to be tripped at the initialization of the accident, and the effects of pump coastdown are included in the blowdown analyses. 15.3.1.2 Analysis of Effects and Consequences Method of Analysis For small breaks (less than 1.0 ft2) the NOTRUMP computer code (Reference 1) is employed to calculate the transient depressurization of the Reactor Coolant System as well as to describe the mass and energy of the fluid flow through the break. The NOTRUMP computer code is a state-of-the-art one-dimensional general network code incorporating a number of advanced features. Among these are calculation of thermal non-equilibrium conditions in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model (Reference 2) was developed to determine the RCS response to design basis small break LOCA's, and to address NRC concerns expressed in Reference 3. For Unit 2, this model has been updated to include the use of safety injection into the broken loop and the COSI condensation model, as described in Reference 15. 15.3-3 SGS-UFSAR Revision 24 May 11, 2009 I The reactor coolant system model is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly, while the intact loops are lumped into a second loop. Transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum. The multinode capability of the program enables explicit, detailed spatial representation of various system components which, among other capabilities, enables a proper calculation of the behavior of the loop seal during a loss-of-coolant accident. The reactor core is represented as heated control volumes with associated phase models to transient mixture calculations. Detailed descriptions of the NOTRUMP code and the evaluation model are provided in References 1 and 2. Peak clad temperature calculations are performed with the LOCTA-IV code (Reference 4) using the NOTRUMP calculated core pressure fuel rod power history, uncovered core steam flow and mixture heights as boundary conditions {see Figure 15.3-1). Figures 15.3-2 {Unit 1) and 15.3-2a (Unit 2} depict the hot rod axial power shape used to perform the small break LOCA analyses. These shapes were chosen because they represent a distribution with power concentrated in the upper regions of the core. Such a distribution is limiting for small-break LOCAs because it minimizes coolant level swell, while maximizing vapor superheating and fuel rod heat generation at the uncovered elevations. The small break LOCA analyses assume the core continues to operate at full power until the control rods are completely inserted. However, for conservatism, it is assumed that the most reactive RCCA does not insert. 15.3-4 SGS-UFSAR Revision 24 May 11, 2009 After the small break LOCA is initiated, reactor trip occurs due to a pressurizer low pressure reactor trip signal. For these analyses the safety injection actuation signal is generated due to a pressurizer low-pressure safety injection signal. Safety injection systems consist of gas pressurized accumulator tanks and pumped injection systems. The small break LOCA analyses assumed nominal accumulator water volume with an assumed cover gas consistent with the minimum pressure allowed by the Technical Specifications minus uncertainties. Minimum emergency core cooling system availability is assumed for the analyses, and pumped ECCS is conservatively assumed to be at the maximum RWST temperature. Assumed pumped safety injection characteristics as a function of RCS pressure used as boundary conditions in the analyses are shown in Figures 15.3-3 (Unit 1) and 15.3-3a (Unit 2}. The safety injection flow rates presented are based on pump performance curves degraded from the design head (7% for High Head Safety Injection (HHSI), 10% for Intermediate Head Safety Injection (IHSI)) and an assumed charging system branch line imbalance of 10.5 gpm for HHSI, 12 gpm for IHSI. The effect of flow from the RHR pumps is not considered in the small break LOCA analyses since the shutoff head is lower than the RCS pressure during the time portion of the transient considered here. Safety injection and reactor trip response times used in the analyses are consistent with Technical Specification requirements. On the secondary side, main feedwater isolation is assumed to be initiated by the low pressurizer pressure setpoint, with signal delay and valve closure times consistent with' the Technical Specifications. The auxiliary feedwater pumps (one turbine driven pump and two motor driven pumps) are assumed to indirectly start from the low pressurizer pressure signal and deliver full flow consistent with the Technical Specifications. The auxiliary feedwater enthalpy is assumed to be that of the main feedwater until all warmer main feedwater has been purged from the lines. The time sequence of events for the small break LOCA analyses are shown in Tables 15.3-1 (Unit 1} and 15.3-1a (Unit 2). Results This section presents results of the SBLOCA analysis in terms of highest peak clad temperature. Refer to Tables 15.3-2 (Unit 1) and 15.3-2a (Unit 2} for the input parameters used in the SBLOCA Analyses. The worst break size (small break) for Unit 1 is a 2-inch diameter break, with the high Tavg being the limiting reactor coolant system average temperature. The worst break size for Unit 2 is a 3-inch diameter break. 15.3-5 SGS-OFSAR Revision 24 May 11, 2009 I Refer to Table 15.3-3 (Unit 1) and 15.3-3a (Unit 2} for SBLOCA results. The depressurization transients for these breaks are shown in Figures 15.3-4 (Unit 1) and 15.3-4a (Unit 2). The extent to which the core is uncovered is shown on Figures 15.3-5 (Unit 1) and 15.3-5a (Unit 2). The maximum hot spot clad temperature calculated during the transient is 1580°F for Unit 1 and 987°F for Unit 2, including the effects of fuel densification as described in Reference 6. The peak clad temperature transients are shown on Figures 15.3-6 (Unit 1) and 15.3-6a (Unit 2) for the worst break size (2-inch for Unit 1 and 3-inch for Unit 2) i.e, the break with the highest peak clad temperature. The steam flow rates for the worst breaks are shown on Figures 15.3-7 (Unit 1) and 15.3-7a (Unit 2). When the mixture level drops below the top of the core, the steam flow computed in NOTRUMP provides cooling to the upper portion of the core. The rod film coefficients for this phase of the transients are given on Figures 15.3-8 (Unit 1) and 15.3-Ba (Unit 2). The hot spot fluid temperatures for the worst break are shown on Figures 15. 3-17 {Unit 1) and 15.3-17a (Unit 2). The cold leg break mass flows for the worst breaks are shown on Figures 15.3-18 (Unit 1) and 15.3-lBa (Unit 2). The ECCS pumped safety injection for the worst breaks are shown on Figures 15.3-19 (Unit 1) and 15.3-19a (Unit2). For Unit 1, identical plot sequences for the 4-, 3-, and 1.5-inch break cases at high Tavg are included in Figures 15.3-20 through 15.3-43. Additionally a 2-inch break case at low Tavg is included in Figures 15.3-44 through 15.3-51. For Unit 2, these same plots for the 4-and 2-inch break cases are included in Figures 15.3-53 through 15.3-68. The core power (dimensionless) transient following the accident (relative to reactor scram time) is shown on 15.3-52. The reactor shutdown time is equal to the reactor trip signal time plus rod insertion time. During this rod insertion period, the reactor is conservatively assumed to at rated power. 15.3.1.3 Conclusions The analyses presented in this section show that the combined high head portion of the ECCS provides sufficient core flooding to maintain the calculated peak clad temperature within the required limits of 10CFR50. 4 6. Hence, adequate protection is afforded by the ECCS in the event of a small break LOCA. 15.3-6 SGS-UFSAR Revision 24 May 11, 2009 15.3.2 Minor Secondary System Pipe Breaks 15.3.2.1 Identification of Causes and Accident Description Included in this grouping are ruptures of secondary system lines which would result in steam release rates equivalent to a 6-inch diameter break or smaller. 15.3.2.2 Analysis of Effects and Consequences Minor secondary system pipe breaks must be accommodated with the failure of only a small fraction of the fuel elements in the reactor. Since the results of analysis presented in Section 15.4. 2 for a major secondary system pipe rupture also meet this criteria, separate analysis for minor secondary system pipe breaks is not required. The analysis of the more probable accidental opening of a secondary system steam dump, relief or safety valve is presented in Section 15.2.13. The analysis is illustrative of a pipe break equivalent in size to a single valve opening. 15.3-7 SGS-UFSAR Revision 15 June 12, 1996 15.3.2.3 Conclusions The analysis presented in Section 15.4.2 demonstrates that the consequences of a minor secondary system break are acceptable since the calculated from nucleate boiling ratio ( DNBR) is greater than the design DNBR limit for a more critical major secondary system pipe break. 15.3.3 Inadvertent of a Fuel Assembly into an Position 15.3.3.1 The Inadvertent loading of one Event core misleading scenarios such as the or more fuel assemblies into or a fuel rod manufacture with one or more of the wrong enrichment. In addition to these scenarios, misleading events involving burnable absorbers are , scenarios such as the of a cluster of 20 burnable absorbers into a core location slated to have 24 burnable absorbers. All of these scenarios result in a core distribution that differs from the intended core result, the core power distribution and distribution. As a factors may differ from fically, misleading errors can lead to increased local power peaking at the location of the misleading if the misleading results in a local increase relative to the intended core If the mis results in a local decrease, power increases away from the location of the misleading are due to unintended power tilts. These kinds of increases, however, are distributed over a core volume and are small relative to those where the local react is increased. Fuel misloads are by the manufacturing controls to build the fuel and the core loading controls used to assemble the core. The controls include checks on fuel rod to confirm the uranium in the fuel active and passive gamma scans of individual fuel rods to confirm fuel enrichments, stack let types, and the absence of gaps fuel and bar of each fuel rod to confirm its proper placement in the fuel assembly. To reduce the probability of core loading errors during fuel loading, each fuel assembly and core component is marked with an identification number and loaded in accordance with a core loading diagram. During core the identification numbers are checked before each assembly is moved into the core. 15.3-8 SGS-UFSAR Revision 25 October 26, 2010 Serial numbers read during fuel movement are subsequently recorded on the as a further check on proper placement after the loading is These actions make the likelihood of core misloadings very small. The severity and detection probability of fuel misleads are influenced by several factors: the local reactivity perturbation relative to the intended core loading pattern, the core position of the misload, the local environment of the misloaded fuel assembly, and the number of operable incore detector locations and their proximity to the misload location. Should misloadings occur, the incore system of movable flux detectors, which is used to verify power distributions and throughout the operating cycle, is of enrichment errors or misloadings which would cause the kind of substantial power distribution perturbation that would be necessary to induce large numbers of fuel rod failures. In addition, and excore detectors can provide additional indications of power distribution anomalies. This instrumentation, along with the testing each ; make the detection of severe misloadings highly likely. 15.3.3.2 In Reference 16, a large number of misloads were evaluated us Reference 9 and 10 methods for representative core designs employing current fuel types and fuel features. The simulated misleads, involving one or two fuel assemblies, covered a wide range of local perturbations and core ions. A total of 2000 unique misload binary swap cases were evaluated for each core where the misleads were characterized by severity level. The range of core designs evaluated was sufficient to bound current and future cycle core designs for the Salem Units. Fuel misloads involving a single fuel rod or fuel pellet were not evaluated as part of Reference 16. Such misloads, in general, will not be detectable the incore detector system due to the very small power distribution perturbation. In terms of increased peaking factors, and reduced DNBR from Nucleate Boiling Ratio DNBR, from Chapter 4) values, however, the consequences of such misleads will be very small and limited to the affected fuel rod and the immediately acent fuel rods. The simulated misleads were assessed with to severity and of detection. The hot full power (HFP) FAH {enthalpy rise hot channel factor from Chapter 4) peaking factors can range from benign to very severe. 15.3-9 SGS-UFSAR Revision 25 October 26, 2010 Severe misloads with peaking factors that exceed the limit for DNB (Departure from Nucleate Boiling, from Chapter 4) at normal operation conditions have the potential for fuel failure if they remain undetected. For Level 1, the core peaking factors remained below their respective Technical cation Limit. For Severity Level 2, the core peaking factors may go above the Tech Limit but are not high enough to cause a leaking fuel rod. A second independent event or fault would have to occur to cause a fuel rod. For Level 3 events, the core exceeds the limit corresponding to DNB causing a fuel leaker(s). INCORE thimble deletion studies were corresponding to different levels of available thimbles corresponding to 100%, 95%, 85%, and 75 availabil . These thimble deletion studies were performed assuming different sets of flux map measured to predicted reaction rate and symmetric thimble reaction rate criteria to determine what fraction of the events would be detected for each mislead level. The flux map measured to predicted reaction rate and symmetric thimble reaction rates were set such that the likelihood of detecting a Category 3 misload (potential fuel failure) is greater than 99% and 100%, even the loss of incore thimbles. 15.3.3.3 This event is classified as a Condition III event. Condition III events are defined as those events that do not cause more than a small fraction of fuel rods to fail, although sufficient fuel damage might occur to preclude immediate resumption of . The acceptance criteria for this event are as follows: a. To meet the requirements of UFSAR Chapter 3 Des Criteria 12 (Instrumentation and Control) 1 operating include a requiring that reactor instrumentation be used to search for potential fuel loading errors after fueling operations. b. In the event the error is not detectable by the instrumentation SGS-UFSAR and fuel rod failure limits could be exceeded normal operation, the offsi te consequences are a small fraction of the 10 CFR Part 100 guidelines. 15.3-10 Revision 25 October 26, 2010 The incore movable detector system is used to search for potential fuel misleads at the start of each operating cycle. Following fuel loading and low power physics testing, an initial core power distribution measurement is made. The core power level of this initial flux map is between and of rated thermal power. This initial power distribution measurement is used to confirm that the measured power distribution is consistent with the cted power distribution. Observed flux map deviations in excess of the flux map review criteria of Reference 16 would prompt an investigation of a possible core . This satisfies the first design criteria given above. The probability of detection assessments of Reference 16 demonstrated that the incore detector system is very robust with to detection of misloads severe enough to fail fuel during normal operation. By a number of movable detector thimble patterns, the misload detection probability assessments considered the effect of inoperable movable detector thimbles. Even when the minimum number of operable detector locations allowed per the plant licensing bases was assumed, the incore detector was of reliably detecting misleads severe enough to fail fuel normal operation. Detection of fuel misleads is, in part, a function of the number of available incore detector locations. Reference 16 demonstrated that the flux map review criteria are effective in detect fuel misleads that could lead to fuel failures normal operation. To enhance the probabil that ficant misleads will be detected, t review criteria are when the number of available detector locations is reduced. The Reference 16 measured to reaction rate and symmetric thimble reaction rate review criteria will be used for startup and subsequent at-power flux maps. An invest to identify potential core anomalies shall result in the event that these review criteria are exceeded. The detection probability assessments of Reference 16 confirm that the movable detector system can reliably detect fuel misleads that could fail during normal when the Reference 16 review criteria are employed. fical1y, Reference 16 demonstrated that only a small fraction of 1 of misleads severe enough to fail fuel normal would be undetected at startup using these review criteria. Furthermore, it was judged that even these "undetected" misleads would very likely be detected if other attributes of the power distribution measurement (e.g. tilts and reaction rate error contours) were considered along with the results of low power physics testing. 15.3-11 SGS-UFSAR Revision 25 October 26, 2010 I Given that detection of >99% of rnisloads severe to fai fuel is using these review criteria, a consequences analysis is unnecessary. Failures in fresh fuel during would have deemed negl 1 consequences since there is a small fission inventory. Following st any fuel rod failures would occur and would be detected by coolant Since the number of fuel rod failures due to a core misload would be small and such failures would occur any coolant activi releases would initially be well within the cleanup trend in increased coolant activity would warrant further ion and evaluation. Therefore, the second acceptance criterion for this event would be satisfied since failures would be gradual, detectable, and the would be maintained within Technical fication coolant act guidelines. 15.3.3.4 Fuel misloads are by controls and core controls. In the unlikely event that a fuel misload should occur, the incore movable detector system is of reliably misloads that could fail fuel at normal operat conditions. the review criteria herein would initiate an inve ion to identify potential core anomalies. Any failures associated with an undetected fuel misload would be gradual, detectable, and the operations would be maintained within Technical fication coolant act lines. 15.3.4 Loss of Forced Reactor Coolant Flow (Text has been deleted) 5.3.4.1 A loss of forced reactor coolant flow may result from a simultaneous loss of electrical to all reactor coolant pumps. If reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow increase in the coolant This increase could result in from nucleate (DNB) with fuel if the reactor were not The necessary a loss-of-coolant flow accident: or buses SGS-UFSAR on reactor coolant pump power 15.3-lla Revision 25 October 26, 2010
- 2. Low reactor coolant flow 3. Pump circuit breaker opening The reactor on reactor coolant pump bus is to protect against conditions which can cause a loss of to all reactor coolant pumps, i.e., loss of offsite power. This function is blocked below power (Permissive 7). The reactor on reactor coolant pump is to open the reactor coolant pump breakers and trip the reactor for an 15.3-llb SGS-UFSAR resulting from Revision 25 October 26, 2010 disturbances on the major power grid. The trip disengages the reactor coolant pumps from the power grid so that the pumps' kinetic energy is available for full coastdown. The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. It also serves as a backup to the undervoltage and underfrequency trips. This function is generated by two-out-of-three low flow signals per reactor coolant loop. Above 36 percent power (Permissive 8), low flow in any loop will actuate a reactor trip. Between 11 percent power {Permissive 7) and 36 percent power (Permissive 8), low flow in any two loops will actuate a reactor trip. A reactor trip from pump breaker position is provided as an anticipatory signal which serves as a backup to the low flow signals. Above Permissive 7, a breaker open signal from any two reactor coolant pumps will actuate a reactor trip. Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator. Each pump is on a separate bus. When generator trip occurs, the buses are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to supply coolant flow to the core. Following any turbine trip, where there are no electrical faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the generator, thus ensuring ..._., full flow for 30 seconds after the reactor trip before any transfer is made. 15.3.4.2 Method of Analysis The transient is analyzed by three digital computer codes. (12) code is used to calculate the loop and core flow 15.3-12 SGS-UFSAR First the LOFTRAN Revision 14 December 29, 1995 during the transient, the time of reactor trip, and the nuclear power transient following reactor trip. The FACTRAN (13) code is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN. Finally the THINC code is used to calculate the minimum DN8R during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DN8R transients presented represent the minimum of the typical or thimble cell for fuel assemblies with and without IFM's. Two cases are analyzed: 1. Complete loss of flow transient due to an undervoltage condition; and 2. Complete loss of flow transient due to an underfrequency condition. The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.2. 5, except that, following the loss of supply to all pumps at power, a reactor trip is actuated by the undervoltage or underfrequency signals. 15.3.4.3 Results Figures 15.3-14 and 15.3-15 illustrate the transient response for the complete loss of flow (undervol tage) for a loss of power to all four reactor coolant pumps with four loops in operation. Figure 15.3-15 shows that the DN8R remains above the limit value. The undervoltage complete loss of flow minimum DN8R is greater than the more limiting underfrequency event. Figures 15.3-16A and 15.3-168 illustrate the transient response to a complete loss of flow (underfrequency) with a frequency decay of all four reactor coolant pumps with four loops in operation. Figure 15. 3-168 shows that the DN8R remains above the limit value. The calculated sequence of events for both cases are shown in Table 15.3-4. 15.3-13 SGS-UFSAR Revision 28 May 22, 2015 15.3.4.4 Conclusions The analysis performed has demonstrated that for the complete loss of forced ...._... reactor coolant flow, the DNBR does not decrease below the design limit during the transient and thus no core safety limit is violated. 15.3.5 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.3.5.1 Accident Description No single electrical or mechanical failure in the Rod Control System could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in the control bank. This feature is necessary in order to retrieve an assembly should one be accidentally dropped. In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod pos.i tion indicators would indicate the relative positions of the assemblies in the bank. The urgent failure alarm also inh.ibi ts automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Each bank of RCCAs in the system .is divided into two groups of four mechanisms each (except Group 2 of Bank D which consists of five mechanisms). The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation and deactuation of the stationary gripper, movable gripper, and lift coils of the mechanism is required to withdraw the RCCA attached to the mechanism. Since the four stationary grippers, moveable gripper, and lift coils associated with the four RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group, or four RCCAs. Mechanical failures are either in the direction of insertion or immobility. 15.3-14 SGS-UFSAR Revision 16 January 31, 1998 In the unlikely event of multiple failures which result in continuous wi:hdrawal of a single RCCA, it is not possible, in all cases, to pro,;icie assurance of automatic reactor trip such that core safety limits are r:o:. violated. of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area "covered" by the RCCA. 15.3.5.2 Method of Analysis Power distributions within the core are calculated by the ANC Code (Reference 10) based on macroscopic cross sections generated by the PHOENIX-? Code (Reference 9). The peaking factors are then used by THINC to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from Bank D inserted at the insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to occur at beginning of life, since this results in the minimum value of the moderator density coefficient. This maximizes the power rise and minirni zes the tendency of increased moderator temperature to flatten the power distribution. 15.3.5.3 Results Two cases have been considered as follows: l. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the failed RCCA. In terms of the overall SGS-UFSAR system response, this case is similar to those presented in Section 15.2.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on 15.3-15 Revision 18 April 26,2000
- 2. initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the would be expected to trip the shows that an upper limit for the number of rods with a DNBR less than the limit value is 5 percent. If the reactor is in automatic control mode, withdrawal of a s will result in the immobility of other RCCAs in the con troll RCCA bank. The transient will then in the same manner as Case 1 described above. For such cases as above, a trip will ultimately ensue, although not fast in all cases to a minimum DNBR in the core of less than the limit value. 15.3.5.4 Conclusions For the case of one RCCA withdrawn with the reactor in the automatic or manual control mode, and at full power with Bank D at the insertion limit, an upper bound of the number of fuel rods DNBR < the limit value is 5 percent of the total fuel rods in the core. For both cases discussed, the indicators and alarms mentioned would function to alert the to the malfunction before DNB could occur. For Case 2 discussed above, the insertion limit alarms (both low and low-low alarms) would also serve in this regard. 15.3.6 Accidental Release of Waste Gases 15.3.6.1 Gaseous which could be released in the event of tank will result in an offsite whole body and inhalation dose well below I 10CFR50.67 limits. The main sources of gaseous 15.3-16 SGS-UFSAR Revision 25 October 26, 2010
- *
- radioactivity are in the volume control tanks (VCT) and gas decay tanks. Activity levels are listed in Tables 11.1-11 and 11.1-12 . 15.3.6.2 Volume Control Tank Rupture Analysis In the event that a rupture should occur in a VCT caused by undetermined means, the worst-case 2-hour integrated whole body gamma dose at the site boundary during passage of the cloud of escaped gases would be less t-han* 0.1 rem TEDE. This dose is based on a release from the plant vent with the least favorable meteorological diffusion value as described in Table 2.3-21. The*calculations also assume 100 percent release of the noble gas isotopes, which .are Bhown in Table 11.1-11. The inhalation dose at the site boundary from this accident is negligible due to low concentrations and low volatility of the halogens and other nongaseous isotopes at the temperature and pH of the fluid in the VCT. The normal temperature is about 130°F. The calculations show that the general public will not be exposed to radiation hazards from this accident in excess of 10CFR50.67 limits . 15.3.6.3 Gas Decay Tank Rupture Analysis A sudden failure of a gas decay storage tank, or release of its contents by an unspecified mechanism, would yield a worst-case 2-hour integrated dose of less than 0.1 rem TEDE at the site boundary during passage of the cioud of escaped gases This dose is based on a release from the plant vent with the least favorable meteorological diffusion value as described in Table 2.3-21. The Gas Decay Tank activity released is shown in Table 11.1-12 . 15.3-17 SGS-UFSAR Revision 23 October 17, 2007 since there are no halogen& present in the gas decay tanka, the inhalation dose at the site boundary is negligible. 15.3.7 Accidental Release of Radioactive Liquids The inadvertent release of radioactive liquid wastes to the environment is not considered a credible accident. Any radioactive liquids must ultimately be diverted to the waste monitor, waste monitor-holdup, or holdup tanks prior to discharge. Liquids from these tanks are sampled and monitored for acceptable radioactive levels before being released to the river. Erroneous sampling and malfunction of the radiation monitor would have to occur sequentially to discharge radioactive liquid inadvertently, and this occurrence is not considered credible. Any spillage of radioactive fluid due to equipment leaks or ruptures would drain directly to either the sump tank or waste holdup tanks or would accumulate in the area sumps prior to being pumped to the waste holdup tanks. Radioactive liquids processed by the waste Disposal System are ultimately stored in the waste monitor or waste monitor-holdup tanks. 15.3-18 SGS-UFSAR Revision 16 January 31, 1998 ..._.....
Periodically, the contents of the waste holdup tanks and the laundry tanks are analyzed and, if the radioactive level is within discharge limits, the liquid is transferred to the waste monitor tanks. Before liquid from these tanks is discharged to the river, a sample is taken and analyzed. If the analysis indicates that the waste fluid can be released, a normally locked closed valve in the waste liquid discharge line is opened. Upstream of this valve a radiation monitor provides an additional safeguard. Should the radioactive level as monitored be above prescribed limits, an alarm sounds and the valve in the discharge line automatically closes, preventing accidental release of radioactive fluids. Distillate from the Chemical and Volume Control System boric acid evaporator is discharged to monitor tanks. The contents of these tanks are analyzed before being pumped to the primary water storage tanks. Occasionally, it may be necessary to dispose of some of the boric acid distillate for tritium control. If analysis of the contents of the monitor tank is within prescribed limits for discharge to the environment, the liquid is pumped directly to the waste liquid discharge line after the normally closed valve in this line is opened. The radiation monitor downstream prevents discharge of fluids above prescribed levels, as explained in the preceding paragraph. Therefore, to release radioactive liquid waste to the river inadvertently, samples of the fluid to be discharged must be analyzed incorrectly, the normally closed valve in the discharge line opened, and a malfunction of the radiation monitor or the valve in the discharge line must occur. This series of events is not considered credible. 15.3.8 References for Section 15.3 1. Meyer, P. E., "NOTRUMP -A Nodal Transient Small Break and General Network Code," WCAP-10079-P-A, (Proprietary}, August 1985. 2. Lee, N. et al., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," WCAP-10054-P-A, (Proprietary), August 1985. 3. ..Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse -Designed Operating Plants," NUREG-0611, January 1980. 15.3-19 SGS-UFSAR Revision 15 June 12, 1996
- 4. Bordelon, F. M., et al., "LOCTA-IV Program: Loss of Coolant Transien": Analysis", WCAP-8301, June 1974 {Proprietary) and WCAP-8305, June l974 (Non-Proprietary) . 5. "Supplement to the Status Report by the Directorate of Licensing in the Matter of Westinghouse Electric Company ECCS Evaluation Model Conformance to 10CFR50, Appendix K", November 1974. 6. Hellman. J. M., "Fuel Densification Experimental Results and Model for Reactor Application", WCAP-8218-P-A, March 1975 (Proprietary} and WCAP-8219-A, March 1975 (Non-Proprietary). 7. NTD -Nuclear Safety Department, "Analysis of Delayed Reactor Coolant Pump Trip During Small Loss of Coolant Accidents for Westinghouse Nuclear Steam Supply Systems," WCAP-9584, August 30, 1979. 8. NTD -Nuclear Safety Department, "Report on Small Break Accidents for Westinghouse NSSS System," WCAP-9600, June 1979. 9. Nguyen, T.Q., et.al., "Qualification of the PHOENIX-P/ANC Nuclear Design System for Pressurized Water Reactor Cores," WCAP-11596, June 1988. 10. Liu, Y.S., et.al., "ANC: A Westinghouse Advanced Nodal Computer Code," WCAP-10965, September 1986. 15.3-20 SGS-UFSAR Revision 18 April 26, 2000 ...._,.
- 11. F. M., "Calculation of Flow Coastdown After Loss of Reactor Coolant Pump (PHOENIX Code)," WCAP-7973, September 1972. 12. Burnett, T. W. T. et al, "LOFTRAN Code "WCAP-7907, April 1974. 13. Hargrove, H.G., "FACTRAN, A FORTRAN-IV Code for Thermal Transients in Fuel Rods," WCAP-7908, December 1989. 14. (This text was deleted) 15. Thompson, C. M., et al., \\Addendum to the Westinghouse Small Break ECCS Evaluation Model the NOTRUMP Code and Safety ection in the Broken and COSI Condensation Model," WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary) and WCAP-10081-NP, Revision (Non-Proprietary), July 1997. 16. WCAP-16676-NP, R.D. Ankney and J.L. Grover, Inadvertent Loading Event," March 2009. 15.3-21 SGS-UFSAR for the Revision 25 October 26, 2010