ML091400717

Final Safety Analysis Report (Fsar), Amendment 93, Section 15, Accident Analyses Through Table 15A-2

ML091400717
Person / Time
Site:	Watts Bar
Issue date:	04/30/2009
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML091400717 (533)

Text

WATTS BAR WBNP-76 TABLE OF CONTENTS Section Title Page 026_TVA_WB_FSAR_Section_15.pdf 15.0 ACCIDENT ANALYSES 15.1 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-1 15.1.1 Optimization of Control Systems 15.1-2 15.1.2 Initial Power Conditions Assumed In Accident Analyses 15.1-3 15.1.2.1 Power Rating 15.1-3 15.1.2.2 Initial Conditions 15.1-3 15.1.2.3 Power Distribution 15.1-4 15.1.3 Trip Points And Time Delays To Trip Assumed In Accident Analyses 15.1-4 15.1.4 Instrumentation Drift And Calorimetric Errors - Power Range Neutron Flux 15.1-5 15.1.5 Rod Cluster Control Assembly Insertion Characteristic 15.1-5 15.1.6 Reactivity Coefficients 15.1-6 15.1.7 Fission Product Inventories 15.1-7 15.1.7.1 Radioactivity in the Core 15.1-7 15.1.7.2 Radioactivity in the Fuel Pellet Clad Gap 15.1-8 15.1.8 Residual Decay Heat 15.1-9 15.1.8.1 Fission Product Decay Energy 15.1-9 15.1.8.2 Decay of U-238 Capture Products 15.1-10 15.1.8.3 Residual Fissions 15.1-11 15.1.8.4 Distribution of Decay Heat Following Loss of Coolant Accident 15.1-11 15.1.9 Computer Codes Utilized 15.1-11 15.1.9.1 FACTRAN 15.1-11 15.1.9.2 Deleted by Amendment 72. 15.1-12 15.1.9.3 MARVEL 15.1-12 15.1.9.4 LOFTRAN 15.1-13 15.1.9.5 LEOPARD 15.1-14 15.1.9.6 TURTLE 15.1-14 15.1.9.7 TWINKLE 15.1-14 15.1.9.8 Deleted by Amendment 80. 15.1-15 15.1.9.9 THINC 15.1-15 15.1.9.10 LOFTTR 15.1-15 15.2 CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-1 15.2.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical Condition 15.2-2 15.2.1.1 Identification of Causes and Accident Description 15.2-2 15.2.1.2 Analysis of Effects and Consequences 15.2-3 15.2.1.3 Conclusions 15.2-5 15.2.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITH-DRAWAL AT POWER 15.2-5 15.2.2.1 Identification of Causes and Accident Description 15.2-5 15.2.2.2 Analysis of Effects and Consequences 15.2-7 Table of Contents 15-i

WATTS BAR WBNP-76 TABLE OF CONTENTS Section Title Page 15.2.2.3 Conclusions 15.2-9 15.2.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT 15.2-9 15.2.3.1 Identification of Causes and Accident Description 15.2-9 15.2.3.2 Analysis of Effects and Consequences 15.2-11 15.2.3.3 Conclusions 15.2-13 15.2.4 UNCONTROLLED BORON DILUTION 15.2-13 15.2.4.1 Identification of Causes and Accident Description 15.2-13 15.2.4.2 Analysis of Effects and Consequences 15.2-14 15.2.4.3 Conclusions 15.2-16 15.2.5 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.2-17 15.2.5.1 Identification of Causes and Accident Description 15.2-17 15.2.5.2 Analysis of Effects and Consequences 15.2-18 15.2.5.3 Conclusions 15.2-19 15.2.6 Startup of an Inactive Reactor Coolant Loop 15.2-19 15.2.6.1 Identification of Causes and Accident Description 15.2-19 15.2.6.2 Analysis of Effects and Consequences 15.2-19 15.2.6.3 Conclusions 15.2-21 15.2.7 LOSS OF EXTERNAL ELECTRICAL LOAD AND/OR TURBINE TRIP 15.2-21 15.2.7.1 Identification of Causes and Accident Description 15.2-21 15.2.7.2 Analysis of Effects and Consequences 15.2-22 15.2.7.3 Conclusions 15.2-24 15.2.8 LOSS OF NORMAL FEEDWATER 15.2-24 15.2.8.1 Identification of Causes and Accident Description 15.2-24 15.2.8.2 Analysis of Effects and Consequences 15.2-25 15.2.8.3 Conclusions 15.2-28 15.2.9 COINCIDENT LOSS OF ONSITE AND EXTERNAL (OFFSITE) AC POWER TO THE STATION - LOSS OF OFFSITE POWER TO THE STATION AUXILIARIES 15.2-28 15.2.10 EXCESSIVE HEAT REMOVAL DUE TO FEEDWATER SYSTEM MALFUNC-TIONS 15.2-28 15.2.10.1 Analysis of Effects and Consequences 15.2-28 15.2.10.2 Conclusions 15.2-31 15.2.11 Excessive Load Increase Incident 15.2-31 15.2.11.1 Identification of Causes and Accident Description 15.2-31 15.2.11.2 Analysis of Effects and Consequences 15.2-32 15.2.11.3 Conclusions 15.2-33 15.2.12 ACCIDENTAL DEPRESSURIZATION OF THE REACTOR COOLANT SYS-TEM 15.2-33 15.2.12.1 Identification of Causes and Accident Description 15.2-33 15.2.12.2 Analysis of Effects and Consequences 15.2-33 15.2.12.3 Conclusions 15.2-34 15.2.13 ACCIDENTAL DEPRESSURIZATION OF THE MAIN STEAM SYSTEM 15.2-34 15.2.13.1 Identification of Causes and Accident Description 15.2-34 15-ii Table of Contents

WATTS BAR WBNP-76 TABLE OF CONTENTS Section Title Page 15.2.13.2 Analysis of Effects and Consequences 15.2-36 15.2.13.3 Conclusions 15.2-38 15.2.14 Inadvertent Operation of Emergency Core Cooling System 15.2-38 15.2.14.1 Identification of Causes and Accident Description 15.2-38 15.2.14.2 Analysis of Effects and Consequences 15.2-39 15.2.14.3 Conclusions 15.2-42 15.3 CONDITION III - INFREQUENT FAULTS 15.3-1 15.3.1 Loss of Reactor Coolant From Small Ruptured Pipes or From Cracks in Large Pipes Which Actuate the Emergency Core Cooling System 15.3-1 15.3.1.1 Identification of Causes and Accident Description 15.3-1 15.3.1.2 Analysis of Effects and Consequences 15.3-2 15.3.1.3 Reactor Coolant System Pipe Break Results 15.3-3 15.3.1.4 Conclusions - Thermal Analysis 15.3-4 15.3.2 Minor Secondary System Pipe Breaks 15.3-5 15.3.2.1 Identification of Causes and Accident Description 15.3-5 15.3.2.2 Analysis of Effects and Consequences 15.3-5 15.3.2.3 Conclusions 15.3-5 15.3.3 Inadvertent Loading of a Fuel Assembly Into an Improper Position 15.3-5 15.3.3.1 Identification of Causes and Accident Description 15.3-5 15.3.3.2 Analysis of Effects and Consequences 15.3-6 15.3.3.3 Conclusions 15.3-7 15.3.4 Complete Loss of Forced Reactor Coolant Flow 15.3-7 15.3.4.1 Identification of Causes and Accident Description 15.3-7 15.3.4.2 Analysis of Effects and Consequences 15.3-8 15.3.4.3 Conclusions 15.3-9 15.3.5 Waste Gas Decay Tank Rupture 15.3-9 15.3.5.1 Identification of Causes and Accident Description 15.3-9 15.3.5.2 Analysis of Effects and Consequences 15.3-10 15.3.6 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.3-10 15.3.6.1 Identification of Causes and Accident Description 15.3-10 15.3.6.2 Analysis of Effects and Consequences 15.3-11 15.3.6.3 Conclusions 15.3-11 15.4 CONDITION IV - LIMITING FAULTS 15.4-1 15.4.1 Major Reactor Coolant System Pipe Ruptures (Loss of Coolant Accident) 15.4-1 15.4.1.1 Thermal Analysis 15.4-3 15.4.1.2 Hydrogen Production and Accumulation 15.4-6 15.4.2 Major Secondary System Pipe Rupture 15.4-12 15.4.2.1 Major Rupture of a Main Steam Line 15.4-12 15.4.2.2 Major Rupture of a Main Feedwater Pipe 15.4-19 15.4.3 Steam Generator Tube Rupture 15.4-23 15.4.3.1 Identification of Causes and Accident Description 15.4-23 15.4.3.2 Analysis of Effects and Consequences 15.4-26 Table of Contents 15-iii

WATTS BAR WBNP-76 TABLE OF CONTENTS Section Title Page 15.4.3.3 Conclusions 15.4-32 15.4.4 Single Reactor Coolant Pump Locked Rotor 15.4-32 15.4.4.1 Identification of Causes and Accident Description 15.4-32 15.4.4.2 Analysis of Effects and Consequences 15.4-32 15.4.4.3 Conclusions 15.4-35 15.4.5 Fuel Handling Accident 15.4-35 15.4.5.1 Identification of Causes and Accident Description 15.4-35 15.4.5.2 Analysis of Effects and Consequences 15.4-35 15.4.6 Rupture of a Control Rod Drive Mechanism Housing (Rod Cluster Control Assembly Ejection) 15.4-35 15.4.6.1 Identification of Causes and Accident Description 15.4-35 15.4.6.2 Analysis of Effects and Consequences 15.4-39 15.4.6.3 Conclusions 15.4-43 15.5 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-1 15.5.1 Environmental Consequences of a Postulated Loss of AC Power to the Plant Auxil-iaries 15.5-1 15.5.2 Environmental Consequences of a Postulated Waste Gas Decay Tank Rupture 15.5-2 15.5.3 Environmental Consequences of a Postulated Loss of Coolant Accident 15.5-2 15.5.4 Environmental Consequences of a Postulated Steam Line Break 15.5-18 15.5.5 Environmental Consequences of a Postulated Steam Generator Tube Rupture 15.5-19 15.5.6 Environmental Consequences of a Postulated Fuel Handling Accident 15.5-20 15.5.7 Environmental Consequences of a Postulated Rod Ejection Accident 15.5-22 15-iv Table of Contents

WATTS BAR WBNP-76 LIST OF TABLES Section Title Table 15.1-1 Nuclear Steam Supply Power Ratings Table 15.1-2 Summary Of Initial Conditions And Computer Codes Used Table 15.1-3 Trip Points And Time Delays To Trip Assumed In Accident Analyses Table 15.1-4 Determination Of Maximum Overpower Trip Point Power Range Neu-tron Flux Channel - Based On Nominal Setpoint Considering Inherent Instrumentation Errors Deleted By Amendment 71 Table 15.1-5 Core And Gap Activities Based On Full Power Operation For 650 Daysfull Power: 3565 MWt Table 15.1-6 Core Temperature Distribution Table 15.2-1 Time Sequence Of Events For Condition Ii Events Table 15.2-2 Deleted by Amendment 63.

Table 15.2-3 Deleted by Amendment 80 Table 15.2-4 Deleted by Amendment 80 Table 15.2-5 Deleted by Amendment 80 Table 15.3-1 Small Break Loca Analysis Time Sequence Of Events Table 15.3-2 Small Break Loca Analysis Summary Of Results Table 15.3-3 Time Sequence Of Events For Condition Iii Events Table 15.4-1 Time Sequence Of Events For Condition Iv Events Table 15.4-2 Post-Accident Containment Temperature Transient Used In The Calcu-lation Of Aluminum And Zinc Corrosion Table 15.4-3 Parameters Used To Determine Hydrogen Generation Table 15.4-4 Core Fission Product Energy After 650 Full Power Days Table 15.4-5 Fission Product Decay Deposition In Sump Solution Table 15.4-6 Equipment Required Following A High Energy Line Break Table 15.4-7 Limiting Core Parameters Used In Steam Break DNB Analysis Table 15.4-8 Deleted by Amendment 80 Table 15.4-9 Time Sequence Of Events For Feedline Break Table 15.4-10 Summary Of Results For Locked Rotor Transients Table 15.4-11 Deleted by Amendment 80 Table 15.4-12 Parameters Used In The Analysis Of The Rod Cluster Control Assembly Ejection Accident Table 15.4-13 Parameters Recommended For Determining Radioactivity Releases For Rod Ejection Accident Table 15.4-14 Containment Data Required For Eccs Evaluation Ice Condenser Con-tainment Table 15.4-15 Major Characteristics Of Structural Heat Sinks Inside Containment Up-per Compartment Table 15.4-16a Mass And Energy Release Rates To Containment CD= 0.6 Min Si Downflow Barrel/Baffle Internals (Initial Design) (Page 1 of 2)

Table 15.4-16a Mass And Energy Release Rates To Containment CD = 0.6 Min Si (Cont'd) Upflow Barrel/Baffle Internals (Current Design After Modifi-cation) (Page 2 of 2)

Table 15.4-16b Mass And Energy Release Rates To Containment CD = 0.6 Max Si Downflow Barrel/Baffle Internals (Initial Design) (Page 1 of 2)

List of Tables 15-v

WATTS BAR WBNP-76 LIST OF TABLES Section Title Table 15.4-16b Mass And Energy Release Rates To Containment CD = 0.6 Max Si (Cont'd) Upflow Barrel/Baffle Internals (Current Design After Modifi-cation) (Page 2 of 2)

Table 15.4-17 Large Break LOCA Time Sequence Of Events Downflow Barrel/Baffle Internals (Initial Design)

Table 15.4-18 Large Break LOCA Fuel Cladding Data (Cont'd) Upflow Barrel/Baffle Internals (Current Design After Modification)

Table 15.4-19 Plant Parameters Used In All Loca Analysis Scenarios Table 15.4-20 Operator Action Times For Design-Basis Steam Generator Tube Rup-ture Analysis Table 15.4-21 Steam Generator Tube Rupture Analysis Sequence Of Events Table 15.4-22 Steam Generator Tube Rupture Analysis Mass Release Results Total Mass Flow (Pounds)

Table 15.4-23 Large Break Loss Of Coolant Accident Minimum Safeguards Eccs Flow Table 15.5-1 Parameters Used In Loss Of A. C. Power Analyses Table 15.5-2 Doses From Loss Of A. C. Power Table 15.5-3 Parameters Used In Waste Gas Decay Tank Rupture Analyses Table 15.5-4 Waste Gas Decay Tank Inventory (One Unit) (Regulatory Guide 1.24 Analysis)

Table 15.5-5 Doses From Gas Decay Tank Rupture Table 15.5-6 Parameters Used In Loca Analysis Table 15.5-7 Ice Condenser Elemental And Particulateiodine Removal Efficiency(1)

Table 15.5-8 Emergency Gas Treatment System Flow Rates Table 15.5-9 DOSES FROM LOSS-OF-COOLANT ACCIDENT 2-Hour Exclusion Area Boundary Dose (Rem)

Table 15.5-10 Deleted by Amendment 80 Table 15.5-11 Deleted by Amendment 80 Table 15.5-12 PARAMETERS USED IN ANALYSIS OF RECIRCULATION LOOP LEAKAGE FOLLOWING A LOCA Table 15.5-13 Doses From Recirculation Loop Leakage Following A LOCA Exclu-sion Area Boundary Dose (Rem)

Table 15.5-14 Atmospheric Dilution Factors At The Control Building Table 15.5-15 Control Room Personnel Doses For DBA LOCA Post-Accident Period Table 15.5-16 Parameters Used In Steam Line Break Analysis Table 15.5-17 Doses From Steam Line Break Table 15.5-18 Parameters Used In Steam Generator Tube Rupture Analysis Table 15.5-19 Doses From Steam Generator Tube Rupture Table 15.5-20 Parameters Used In Fuel Handling Accident Analysis Table 15.5-21 Nuclear Characteristics Of Highest Rated Discharged Assembly Used In The Analysis Table 15.5-22 Deleted by Amendment 80 Table 15.5-23 Doses From Fuel Handling Accident Regulatory Guide 1.25 Analysis 15-vi List of Tables

WATTS BAR WBNP-76 LIST OF TABLES Section Title Doses From A Fuel Handling Accident (FHA) (rem) FHA in Auxiliary Building Table 15.5-24 Deleted by Amendment 80 Table 15.5-25 Deleted by Amendment 80 List of Tables 15-vii

WATTS BAR WBNP-76 LIST OF TABLES Section Title 15-viii List of Tables

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.1-1 llustration of Overtemperature and Overpower T Protection Figure 15.1-2 RCCA Position Versus Time On Reactor Trip Figure 15.1-3 Normalized RCCA Reactivity Worth Versus Rod Insertion Fraction Figure 15.1-4 Normalized RCCA Bank Reactivity Worth Versus Time from Rod Re lease Figure 15.1-5 Doppler Power Coefficient Used In Accident Analysis Figure 15.1-6 Residual Decay Heat Figure 15.1-7 Minimum Moderator Density Coefficient Used in Analysis Figure 15.1-8 Fuel Rod Cross Section Figure 15.2-1 Uncontrolled RCCA Bank Withdrawal From Subcritical Figure 15.2-2 Uncontrolled Rod Withdrawal From a Subcritical Condition Heat Flux vs Time Figure 15.2-3 Uncontrolled Rod Withdrawal from a Subcritical Condition, Tempera-ture Versus Time, Reactivity Insertion Rate Fuel Average 75 x 10-5 k/sec Figure 15.2-3a Uncontrolled Rod Withdrawal from a Subcritical Condition, Clad Inner Temperature Versus Time, Reactivity Insertion Rate 75 x 10-5 k/sec Figure 15.2-4 Pressurizer Pressure Transient and Nuclear Power Transient for Uncon-trolled Rod Withdrawal from Full Power with Minimum Feedback and 80 PCM/SEC Withdrawal Rate Figure 15.2-5 Powerhouse Units 1 & 2 DNBR Transient and Vessel Tavg for Uncon-trolled Rod Withdrawal from Full Power with Minimum Feedback and 80 PCM/SEC Withdrawal Rate Figure 15.2-6 Pressurizer Pressure Transient and Nuclear Power Transient for Uncon-trolled Rod Withdrawal from Full Power with Minimum Feedback and 3 PCM/SEC Withdrawal Rate Figure 15.2-7 DNBR Transient and Vessel Average Temperature Transient for Un-controlled Rod Withdrawal from Full Power with Minimum Feedback and 3 PCM/SEC Withdrawal Rate Figure 15.2-8 Effect of Reactivity Insertion Rate on Minimum DNBR for Rod With-drawal Accident from 100% Power Figure 15.2-9 Effect of Reactivity Insertion Rate on Minimum DNBA for Rod With-drawal Accident from 60% Power Figure 15.2-10 Effect of Reactivity Insertion Rate on Minimum DNBR for Rod With-drawal Accident from 10% Power Figure 15.2-11 Pressurizer Pressure Transient, Nuclear Power, Core Average Temper-ature, and Core Heat Flux Transient for Dropped RCCA Assembly Figure 15.2-12 Reactor Vessel Flow Transient Four Pumps in Operation, One Pump Coasting Down List of Figures 15-ix

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.2-13 Loop Flow Transient Four Pumps In Operation One Pump Coasting Down Figure 15.2-14 Deleted by Amendment 89 Figure 15.2-15 Hot Channel Heat Flux Transient Four Pumps in Operation, One Pump Coasting Down Figure 15.2-16 Nuclear Power Transient Four Pumps In Operation One Pump Coasting Down Figure 15.2-17 DNBR Versus Time Four Pumps In Operation One Pump Coasting Down Figure 15.2-18a Startup Of An Inactive Reactor Coolant Loop Core Average Tempera-ture Figure 15.2-18b Startup Of An Inactive Reactor Coolant Loop Nuclear Power Figure 15.2-18c Startup Of An Inactive Reactor Coolant Loop DNBR Figure 15.2-18d Startup Of An Inactive Reactor Coolant Loop Pressurizer Pressure Figure 15.2-18e Startup Of An Inactive Reactor Coolant Loop Core Thermal Power Figure 15.2-19 Loss Of Load Accident With Pressurizer Spray and Power-Operated Re-lief Valves, End Of Life Figure 15.2-20 Loss Of Load Accident With Pressurizer Spray and Power-Operated Re-lief Valves, End-Of-Life Figure 15.2-21 Loss of Load Accident with Pressurizer Spray and Power-Operated Re-lief Valves, End-of-Life Figure 15.2-22 Loss of Load Accident with Pressurizer Spray and Power-Operated Re-lief Valves, End-of-Life Figure 15.2-23 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life Figure 15.2-24 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, Beginning-of-Life Figure 15.2-25 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life Figure 15.2-26 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life Figure 15.2-27a Nuclear Power Transient For Loss Of Normal Feedwater Figure 15.2-27b Core Heat Flux Transient for Loss of Normal Feedwater Figure 15.2-27c Flow Transient For Loss of Normal Feedwater Figure 15.2-27d Reactor Coolant System Temperature Transient for Loss of Normal Feedwater Figure 15.2-27e Deleted by Amendment 72 Figure 15.2-27f Pressurizer Pressure Transient for Loss of Normal Feedwater Figure 15.2-27g Pressurizer Water Volume Transient for Loss of Normal Feedwater Figure 15.2-27h Steam Generator Pressure Transient for Loss of Normal Feedwater Figure 15.2-27i Steam Generator Mass Transient for Loss of Normal Feedwater Figure 15.2-28a Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Nuclear Power Versus Time Figure 15.2-28b Single Feedwater Control Valve Malfunction, Excess Feedwater with 15-x List of Figures

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Automatic Rod Control - Core Heat Flux Versus Time Figure 15.2-28c Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control

- Core Average Temp Versus Time Figure 15.2-28d Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Pressurizer Pressure Versus Time Figure 15.2-28e Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -DNBR Versus Time Figure 15.2-28f Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -Nuclear Power Versus Time Figure 15.2-28g Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -Core Heat Flux Versus Time Figure 15.2-28h Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Core Average Temp Versus Time Figure 15.2-28i Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Pressurizer Pressure Versus Time Figure 15.2-28j Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -DNBR Versus Time Figure 15.2-29 Ten Percent Step Load Increase, Beginning of Life , Manual Reactor Control Figure 15.2-30 Ten Percent Step Load Increase, Beginning of Life, Manual Reactor Control Figure 15.2-31 Ten Percent Step Load Increase, End of Life, Manual Reactor Control Figure 15.2-32 Ten Percent Step Load Increase, End of Life, Manual Reactor Control Figure 15.2-33 Ten Percent Step Load Increase, Beginning of Life, Automatic Reactor Control Figure 15.2-34 Ten Percent Step Load Increase, Beginning of Life, Automatic Reactor Control Figure 15.2-35 Ten Percent Step Load Increase, End of Life, Automatic Reactor Con-trol Figure 15.2-36 Ten Percent Step Load Increase, End of Life, Automatic Reactor Con-trol Figure 15.2-37 Power Transient for Accidental Depressurization of the RCS Figure 15.2-38 Pressurizer Pressure Transient and Core Average Temperature for Accidental Depressurization of the RCS Figure 15.2-39 DNBR Transient for Accidental Depressurization of the RCS Figure 15.2-40 Variation of Keff with Core Temperature Figure 15.2-41 Transient Response for a Stearn Line Break Equivalent to 247 Ibs/second at 1100 psia with Outside Power Figure 15.2-42a Inadvertent Operation of Emergency Core Cooling System - Nuclear Power Response Figure 15.2-42b Inadvertent Operation of Emergency Core Cooling System - Pressurizer Pressure Figure 15.2-42c Inadvertent Operation of Emergency Core Cooling System - Pressurizer List of Figures 15-xi

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Water Volume Figure 15.2-42d Inadvertent Operation of Emergency Core Cooling System - Core Av-erage Temperature Figure 15.2-42e Inadvertent Operation of Emergency Core Response Cooling System -

DNB Ratio Figure 15.2-42f Inadvertent Operation of Emergency Core Cooling System - Steam Flow Response Figure 15.2-43a Deleted Figure 15.2-43b Deleted Figure 15.3-1 Code Interface Description for Small Break Model Figure 15.3-2 Pumped Safety Injection Flowrate vs. RCS Pressure Figure 15.3-3 Reactor Coolant System Pressure for the 4-Inch Break Figure 15.3-4 Core Mixture Level Transient for the 4-Inch Break Figure 15.3-5 Clad Temperature Transient at Peak Temperature Elevation for 4-Inch Break Figure 15.3-6 Core Outlet Steam Flow Rate for 4-Inch Break Figure 15.3-7 Clad Surface Heat Transfer Coefficient at Peak Temperature Elevation for 4-Inch Break Figure 15.3-8 Fluid Temperature at Peak Clad Temperature Elevation for 4-Inch Break Figure 15.3-8b Deleted by Amendment 89 Figure 15.3-8c Deleted by Amendment 89 Figure 15.3-8d Deleted by Amendment 89 Figure 15.3-8e Deleted by Amendment 89 Figure 15.3-8f Deleted by Amendment 89 Figure 15.3-8g Deleted by Amendment 89 Figure 15.3-8h Deleted by Amendment 89 Figure 15.3-8i Deleted by Amendment 89 Figure 15.3-8j Deleted by Amendment 89 Figure 15.3-8k Deleted by Amendment 89 Figure 15.3-8l Deleted by Amendment 89 Figure 15.3-8m Deleted by Amendment 89 Figure 15.3-8n Deleted by Amendment 89 Figure 15.3-9 Core Power Transient Figure 15.3-10 Hot Rod Axial Power Shape Figure 15.3-11 Reactor Coolant System Pressure for 3-Inch Break Figure 15.3-11a Core Mixture Level Transient for 3-inch Break Figure 15.3-11b Clad Temperature Transient at Peak Temperature Elevation for 3-Inch Break Figure 15.3-11c Core Outlet Steam Flow Rate for 3-Inch Break Figure 15.3-11d Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Ele-vation for 3-Inch Break Figure 15.3-11e Fluid Temperature at Peak Clad Temperature Elevation for 3-Inch Break 15-xii List of Figures

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.3-12 Reactor Coolant System Pressure for 6-Inch Break Figure 15.3-12a Core Mixture Level Transient for 6-Inch Break Figure 15.3-12b Clad Temperature Transient at Peak Temperature Elevation for 6-Inch Break Figure 15.3-12c Core Outlet Steam Flow Rate for 6-Inch Break Figure 15.3-12d Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Ele-vation for 6-Inch Break Figure 15.3-12e Fluid Temperature at Peak Clad Temperature Elevation for 6-Inch Break Figure 15.3-13a Deleted by Amendment 89 Figure 15.3-14a Deleted by Amendment 89 Figure 15.3-14b Deleted by Amendment 89 Figure 15.3-15 Interchange Between Region 1 and Region 3 Assembly Figure 15.3-16 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly Figure 15.3-17 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Transferred to the Region 1 Assembly Figure 15.3-18 Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position Figure 15.3-19 Loading a Region 2 Assembly into a Region 1 Position Near Core Pe-riphery Figure 15.3-20 Total RCS Flow-Complete Loss of Flow - Undervoltage Four Pumps in Operation, Four Pumps Coasting Down Figure 15.3-21 Deleted by Amendment 80 Figure 15.3-22 Loop 1 Flow Complete Loss of Flow - Undervoltage - Four Pumps in Operation, Four Pumps Coasting Down Figure 15.3-23 Hot Channel Heat Flux Transient; Four Pumps in Operation, Four Pumps Coasting Down Figure 15.3-24 Nuclear Power Transient; Four Pumps in Operation, Four Pumps Coast-ing Down Figure 15.3-25 DNBR Versus Time Four Pumps in Operation, Four Pumps Coasting Down Figure 15.3-26 Loss of Forced Reactor Coolant Flow (Partial and Complete) -Axial Power Shape Figure 15.4-1 Aluminum Corrosion in DBA Environment Figure 15.4-1a Zinc Corrosion in DBA Environment Figure 15.4-1b Comparison of ANS 5.1 Decay Energy Curve at 650 Days Irradiation +

20% to Decay Energy Values used for H2 Production Calculation Figure 15.4-2 Results of Westinghouse Irradiation Tests Figure 15.4-3 Hydrogen Production Rate -Westinghouse Model Figure 15.4-4 Hydrogen Generation Rates: NRC Basis Figure 15.4-5 Hydrogen Accumulation from All Sources -Westinghouse Model Figure 15.4-6 Hydrogen Accumulation from All Sources: NRC Basis Figure 15.4-7 Volume Percent of Hydrogen in Containment - Westinghouse Model List of Figures 15-xiii

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.4-8 Volume Percent of Hydrogen in Containment - NRC Model Figure 15.4-9 Variation of Reactivity with Power at Constant Core Average Temper-ature Figure 15.4-10 Deleted by Amendment 89 Figure 15.4-11 Transient Response to Steam Line Break with Safety Injection and Off-site Power (case a)

Figure 15.4-12 Transient Response to Steam Line Break with Safety Injection and Without Offsite Power (case b)

Figure 15.4-13a Pressurizer Pressure and Water Volume Transients for Main Feedline Rupture With Offsite Power Figure 15.4-13b Reactor Coolant Temperature Transients for the Faulted and Intact Loops for Main Feedline Rupture With Offsite Power Figure 15.4-13c Steam Generator Pressure and 'Water Mass Transients for Main Feed-line Rupture With Offsite Power Figure 15.4-14a Pressurizer Pressure and Water Volume Transients for Main Feedline Rupture With Offsite Power Figure 15.4-14b Reactor Coolant Temperature Transients for the Faulted and Intact Loops for Main Feedline Rupture With Offsite Power Figure 15.4-14c Steam Generator Pressure and Water Mass Transients for Main Feedline Rupture With Offsite Power Figure 15.4-15 RCS Pressure Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-16 Deleted by Amendment 80 Figure 15.4-17 Reactor Vessel Flow Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-18 Loop Flow Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-19 Heat Flux Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-20 Nuclear Power Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-21 Clad Inner Temperature Transient; Four Pumps in Operation, One Locked Rotor Figure 15.4-22 Deleted by Amendment 80 Figure 15.4-23 Deleted by Amendment 80 Figure 15.4-24 Nuclear Power Transient; BOL HFP Rod Ejection Accident Figure 15.4-25 Hot Spot Fuel and Clad Temperature Versus Time; BOL HFP Rod Ejec-tion Accident Figure 15.4-26 Nuclear Power Transient; EOL HZP Rod Ejection Accident Figure 15.4-27 Hot Spot Fuel and Clad Temperature Versus Time; EOL HZP Rod Ejec-tion Accident Figure 15.4-28 Reactor Coolant System Integrated Break Flow Following a Rod Ejec-tion Accident Figure 15.4-29 Containment Lower Compartment Pressure, Minimum Safeguards Figure 15.4-30 Containment Temperatures, Minimum Safeguards Figure 15.4-31 Lower Compartment Structural Heat Removal Rate, Minimum Safe-guards Figure 15.4-32 Ice Bed Heat Removal Rate, Minimum Safeguards 15-xiv List of Figures

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.4-33 Heat Removal by Sump, Minimum Safeguards Figure 15.4-34 Heat Removal by Spray, Minimum Safeguards Figure 15.4-35 Containment Lower Compartment Pressure, Maximum Safeguards Figure 15.4-36 Containment Lower Compartment Pressure, Maximum Safeguards Figure 15.4-37 Lower Compartment Structural Heat Removal Rate, Maximum Safe-guards Figure 15.4-38 Ice Bed Heat Removal Rate, Maximum Safeguards Figure 15.4-39 Heat Removal by Sump, Maximum Safeguards Figure 15.4-40a Heat Removal by Spray, Maximum Safeguards Figure 15.4-40b Containment Lower Compartment Pressure, Minimum Safeguards, Up-flow Barrel/Baffle Region Figure 15.4-40c Compartment Temperatures, Minimum Safeguards, Upflow Barrel/Baf-fle Region Figure 15.4-40d Lower Compartment Structural Heat Removal Rate, Minimum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-40e Ice Bed Heat Removal Rate, Minimum Safeguards, Upflow Barrel/Baf-fle Region Figure 15.4-40f Heat Removal by Sump, Minimum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-40g Heat Removal by Spray, Minimum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-40h Containment Lower Compartment Pressure, Maximum Safeguards, Up-flow Barrel/Baffle Region Figure 15.4-40i Compartment Temperatures, Maximum Safeguards, Upflow Bar-rel/Baffle Region Figure 15.4-40j Lower Compartment Structural Heat Removal Rate, Maximum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-40k Ice Bed Heat Removal Rate, Maximum Safeguards, Upflow Barrel/Baf-fle Region Figure 15.4-40l Heat Removal by Sump, Maximum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-40m Heat Removal by Spray, Maximum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-41 Reactor Coolant System Pressure, DECLG, CD=O.4 Figure 15.4-42 Core Flowrate DECLG, CD=0.4 Figure 15.4-43 Accumulator Flow during Blowdown, DECLG, CD=0.4 Figure 15.4-44 Core Pressure Drop, DECLG, CD=0.4 Figure 15.4-45 Break Flow During Blowdown, DECLG, CD=0.4 Figure 15.4-46 Break Energy During Blowdown, DECLG, CD-=0.4 Figure 15.4-47 Core Power, DECLG, CD=0.4 Figure 15.4-48 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.4 Figure 15.4-49 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.4 Figure 15.4-50 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DEGLG, CD=0.4 List of Figures 15-xv

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.4-51 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.4 Figure 15.4-52 Rod Heat Transfer Coefficient at the Peak Temperature Location, DE-CLG, CD=0. 4 Figure 15.4-53 Fuel Rod Peak Clad Temperature, DECLG, CD=0.4 Figure 15.4-54 Clad Temperature at the Burst Node, DECLG, CD=0.4 Figure 15.4-55 Reactor Coolant System Pressure, DECLG, CD=0.6 Figure 15.4-56 Core Flowrate, DEGLG, CD=0.6 Figure 15.4-57 Accumulator Flow During Blowdown, DECLG, CD=0.6 Figure 15.4-58 Core Pressure Drop, DECLG, CD=0.6 Figure 15.4-59 Break Flow During Blowdown, DECLG, CD-O.6 Figure 15.4-60 Break Energy During Blowdown, DECLG, CD=0 .6 Figure 15.4-61 Core Power, DECLG, CD=0.6 Figure 15.4-62 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.6 Figure 15.4-63 Core Inlet Fluid Velocity for Rod Thermal Analysis DECLG, CD=0.6 Figure 15.4-64 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0. 6 Figure 15.4-65 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.6 Figure 15.4-66 Rod Heat Transfer Coefficient at the Peak Temperature Location, DE-CLG,CD=0. 6 Figure 15.4-67 Fuel Rod Peak Glad Temperature, DECLG, CD=0.6 Figure 15.4-68a Clad Temperature at the Burst Node, DECLG, CD=O.6 Figure 15.4-68b Reactor Coolant System Pressure, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68c Core Flowrate During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68d Accumulator Flow During Blowdown, CD=0.6, Minimum and Maxi-mum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68e Core Pressure Drop During Blowdown, CD=0.6, Minimum and Maxi-mum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68f Break Flow During Blowdown, CD=0.6, Minimum and Maximum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-68g Break Energy Flow During Blowdown, CD=0.6, Safeguards, Upflow Barrel/Baffle Region Minimum and Maximum Figure 15.4-68h Core Power During Blowdown, CD=0.6, Minimum and Maximum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-68i Core and Downcomer Liquid Levels During Reflood, CD=0.6, Mini-mum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68j Core Inlet Fluid Velocity During Reflood CD=0.6, Minimum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-68k Intact Loop Accumulator and Pumped SI During Reflood CD=0.6, Min-imum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-68l Mass Flux, CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Re-gion Figure 15.4-68m Fuel Rod Heat Transfer Coefficient, CD=0.6, Minimum Safeguards, 15-xvi List of Figures

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Upflow Barrel/Baffle Region Figure 15.4-68n Fuel Rod Peak Clad Temperature, CD=0.6, Minimum Safeguards, Up-flow Barrel/Baffle Region Figure 15.4-69 Reactor Coolant System Pressure, DECLG, CD=0.8 Figure 15.4-70 Core Flowrate During Blowdown, DECLG, CD=0.8 Figure 15.4-71 Accumulator Flow During Blowdown, DECLG, CD=0.8 Figure 15.4-72 Core Pressure Drop, DECLG, CD=0.8 Figure 15.4-73 Break Mass Flow During Blowdown, DECLG, CD=0.8 Figure 15.4-74 Break Energy Flow During Blowdown, DECLG, CD=0.8 Figure 15.4-75 Core Power, DECLG, CD=0.8 Figure 15.4-76 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.8 Figure 15.4-77 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.8 Figure 15.4-78 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0.8 Figure 15.4-79 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.8 Figure 15.4-80 Rod Heat Transfer Coefficient at the Peak Temperature Location, DE-CLG, CD=0. 8 Figure 15.4-81 Fuel Rod Peak Clad Temperature, DECLG, CD=0.8 Figure 15.4-82 Clad Temperature, at the Burst Node DECLG, CD=0.8 Figure 15.4-83 Reactor Coolant System Pressure, DECLG, CD=0.6, Max SI Figure 15.4-84 Core Flowrate DECLG, CD=0.6, Max SI Figure 15.4-85 Accumulator Flow During Blowdown, DECLG, CD=0.6, Max SI Figure 15.4-86 Core Pressure Drop DECLG, CD=0.6, Max SI Figure 15.4-87 Break Flow During Blowdown, DECLG, CD=0.6, Max SI Figure 15.4-88 Break Energy During Blowdown DECLG, CD=0.6, Max SI Figure 15.4-89 Core Powe, DECLG, CD=0.6, Max SI Figure 15.4-90 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.6, Max SI Figure 15.4-91 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.6, Max SI Figure 15.4-92 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0.6, Max SI Figure 15.4-93 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.6, Max SI Figure 15.4-94 Rod Heat Transfer Coefficient at the Peak Temperature Location, DE-CLG, CD=0.6, Max SI Figure 15.4-95 Fuel Rod Peak Clad Temperature, DECLG, CD=0.6. Max SI Figure 15.4-96a Clad Temperature at the Burst Node, DECLG. CD=0.6, Max SI Figure 15.4-96b Core and Downcomer Liquid Levels During Reflood, CD=0.6, Maxi-mum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-96c Core Inlet Fluid Velocity During Reflood, CD=0.6, Maximum Safe-guards, Upflow Barrel/Baffle Region Figure 15.4-96d Intact Loop Accumulator and Pumped SI During Reflood, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region List of Figures 15-xvii

WATTS BAR WBNP-91 LIST OF FIGURES Section Title Figure 15.4-96e Mass Flux, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Re-gion Figure 15.4-96f Fuel Rod Heat Transfer Coefficient, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region Figure 15.4-96g Fuel Rod Peak Clad Temperature, CD=0.6, Maximum Safeguards, Up-flow Barrel/Baffle Region Figure 15.4-97a SGTR Analysis -Pressurizer Level Figure 15.4-97b SGTR Analysis -RCS Pressure Figure 15.4-97c SGTR Analysis -Secondary Pressure Figure 15.4-97d SGTR Analysis -Intact Loop Hot and Cold Leg RCS Temperatures Figure 15.4-97e SGTR Analysis -Ruptured Loop Hot and Cold Leg RCS Temperatures Figure 15.4-97f SGTR Analysis - Differential Pressure Between RCS and Ruptured SG Figure 15.4-97g SGTR Analysis - Primary to Secondary Break Flow Rate Figure 15.4-97h SGTR Analysis - Ruptured SG Water Volume*

Figure 15.4-97i SGTR Analysis - Ruptured SG Water Mass Figure 15.4-97j SGTR Analysis - Ruptured SG Mass Release Rate to the Atmosphere Figure 15.4-97k SGTR Analysis - Intact SGs Mass Release Rate to the Atmosphere Figure 15.4-97l SGTR Analysis - Break Flow Flashing Fraction Figure 15.4-97m SGTR Analysis - SG Water Level Above Top of Tubes Figure 15.5-1 Schematic of Leakage Path Figure 15.5-2 Deleted by Amendment 80 Figure 15.5-3 Primary Pressure Versus Time Following Rod Ejection Accident Figure 15.5-4 Secondary System Pressure versus Time Following Rod Ejection Acci-dent 15-xviii List of Figures

WATTS BAR WBNP-80 026_TVA_WB_FSAR_Section_15.pdf 15.0 ACCIDENT ANALYSES The ANS classification of plant conditions divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

Condition I: Normal Operation and Operational Transients Condition II: Faults of Moderate Frequency Condition III: Infrequent Faults Condition IV: Limiting Faults The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, Reactor Trip System and engineered safeguards functioning is assumed to the extent allowed by considerations such as the single failure criterion, in fulfilling this principle.

In the evaluation of the radiological consequences associated with initiation of a spectrum of accident conditions numerous assumptions must be postulated. In many instances these assumptions are a product of extremely conservative judgments. This is due to the fact that many physical phenomena, in particular fission product transport under accident conditions, are presently not understood to the extent that accurate predictions can be made. Therefore, the set of assumptions postulated would predominantly determine the accident classification.

This chapter addresses the accident conditions listed in Table 15-1 of the NRC Standard Format and Content Guide, Regulatory Guide 1.70, Revision 2, which apply to WBN.

15.1 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Condition I occurrences occur frequently or regularly.

Therefore, they must be considered from the point of view of affecting the consequences of fault conditions (Condition II, III, and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to the most adverse set of conditions which can occur during Condition I operation.

Typical Condition I events are listed below:

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-1

WATTS BAR WBNP-80 (1) Steady-state and shutdown operations (a) Power operation (>5% to 100% of full power)

(b) Startup (critical, 0% to <5% of full power)

(c) Hot shutdown (subcritical, residual heat removal system isolated)

(d) Cold shutdown (subcritical, residual heat removal system in operation)

(e) Refueling (reactor vessel head open)

(2) Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes. These include:

(a) Operation with components or systems out of service (such as power operation with a reactor coolant pump out of service)

(b) Leakage from fuel with cladding defects (c) Radioactivity in the reactor coolant (i) Fission products (ii) Activation products (iii) Tritium (d) Operation with steam generator leaks up to the maximum allowed by the Technical Specifications (e) Testing as allowed by the Technical Specifications (3) Operational transients (a) Plant heatup and cooldown (up to 100°F/hour for the reactor coolant system; 200°F/hour for the pressurizer)

(b) Step load changes (up to +10%)

(c) Ramp load changes (up to 5%/minute)

(d) Load rejection up to and including design load rejection transient 15.1.1 Optimization of Control Systems A setpoint study was performed to simulate performance of the reactor control and protection systems. In this study, emphasis was placed on the development of a 15.1-2 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 control system to automatically maintain prescribed conditions in the plant even under the most conservative set of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints was determined. In areas where the resultant setpoints were different, compromises based on the optimum overall performance were made and verified. A consistent set of control system parameters was derived, satisfying plant operational requirements throughout the core life and for power levels between 15 and 100%.

The study was comprised of an analysis of the following control systems: rod cluster control assembly, steam dump, steam generator level, pressurizer pressure and pressurizer level.

15.1.2 Initial Power Conditions Assumed In Accident Analyses 15.1.2.1 Power Rating Table 15.1-1 lists the principle power rating values which are used in analyses performed in this section. Two ratings are given:

(1) The guaranteed Nuclear Steam Supply System thermal power output rating.

This power output includes the thermal power generated by the reactor coolant pumps.

(2) The Engineered Safety Features design rating. The Westinghouse supplied Engineered Safety Features are designed for thermal power higher than the guaranteed value in order not to preclude realization of future potential power capability. This higher thermal power value is designated as the Engineered Safety Features design rating. This power output includes the thermal power generated by the reactor coolant pumps.

Where initial power operating conditions are assumed in accident analyses, the "guaranteed Nuclear Steam Supply System thermal power output" plus allowance for errors in steady state power determination is assumed. Where demonstration of adequacy of the containment and Engineered Safety Features is concerned, the "Engineered Safety Features design rating" plus allowance for error is assumed. The thermal power values used for each transient analyzed are given in Table 15.1-2.

15.1.2.2 Initial Conditions For accident evaluation, the initial conditions are obtained by adding the maximum steady state errors to rated values. The following steady state errors are considered:

1. Core power + 2% allowance for calorimetric error CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-3

WATTS BAR WBNP-80

2. Average reactor coolant + 6.5°F allowance for deadband and system temperature measurement error

3. Pressurizer pressure + 46 psi allowance for steady state fluctuations and measurement error For some accident evaluations, an additional 1.0°F is added to the average reactor coolant system temperature to account for steam generator fouling.

Initial values for core power, average reactor coolant system temperature and pressurizer pressure are selected to minimize the initial DNBR unless otherwise stated in the sections describing specific accidents.

15.1.2.3 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of control rods and operation instructions. The power distribution may be characterized by the radial factor FH and the total peaking factor Fq. The peaking factor limits are given in the Technical Specifications.

For transients which may be DNB-limited the radial peaking factor is of importance.

The radial peaking factor increases with decreasing power level due to rod insertion.

This increases in FH is included in the core limits illustrated in Figure 15.1-1. All transients that may be DNB limited are assumed to begin with a value of FH consistent with the initial power level defined in the Technical Specifications.

The axial power shape used in the DNB calculations is discussed in Section 4.4.3.2.2.

For transients which may be overpower-limited the total peaking factor Fq is of importance. The value of Fq may increase with decreasing power level such that full power hot spot heat flux is not exceeded (i.e., Fq x Power = design hot spot heat flux).

All transients that may be overpower-limited are assumed to begin with a value of Fq consistent with the initial power level as defined in the Technical Specifications.

The value of peak kW/ft can be directly related to fuel temperature as illustrated on Figures 4.4-1 and 4.4-2. For transients which are slow with respect to the fuel rod thermal time constant the fuel temperatures are illustrated on Figures 4.4-1 and 4.4-2.

For transients which are fast with respect to the fuel rod thermal time constant, for example, rod ejection, a detailed heat transfer calculation is made.

15.1.3 Trip Points And Time Delays To Trip Assumed In Accident Analyses A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the rod cluster control assemblies which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the 15.1-4 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.1.3. Reference is made in that table to overtemperature and overpower T trip shown in Figure 15.1-1.

Accident analyses which assume the steam generator low-low water level trip signal to initiate protection functions may be affected by the Trip Time Delay (TTD) (Reference

23) system, which was developed to reduce the incidence of unnecessary feedwater-related reactor trips.

The TTD imposes a system of pre-determined delays upon the steam generator low-low level reactor trip and auxiliary feedwater initiation. The values of these delays are based upon (1) the prevailing power level at the time the low-low level trip setpoint is reached, and by (2) the number of steam generators in which the low-low level trip setpoint is reached. The TTD delays the reactor trip and auxiliary feedwater actuation in order to provide time for corrective action by the operator or for natural stabilization of shrink/swell water level transients. The TTD is primarily designed for low power or startup operations.

The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and setpoint error.

During preoperational start-up tests, it is demonstrated that actual instrument errors and time delays are equal to or less than the assumed values. Additionally, protection system channels are calibrated and instrument response times determined periodically in accordance with the plant Technical Specifications.

15.1.4 Instrumentation Drift And Calorimetric Errors - Power Range Neutron Flux The instrumentation drift and calorimetric errors used in establishing the power range high neutron flux setpoint are presented in Reference [22].

The calorimetric error is the error assumed in the determination of core thermal power as obtained from secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet temperature to the steam generators and steam pressure. High accuracy instrumentation is provided for these measurements with accuracy tolerances much tighter than those which would be required to control feedwater flow.

15.1.5 Rod Cluster Control Assembly Insertion Characteristic The rate of negative reactivity insertion following a reactor trip is a function of the acceleration of the rod cluster control assemblies and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry or approximately 85% of the rod cluster travel.

The most limiting insertion time to dashpot entry used for accident analyses is 2.7 seconds. For the dropped rod cluster control assembly analysis (Section 15.2.3), a rod CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-5

WATTS BAR WBNP-80 insertion time of 3.3 seconds is assumed (consistent with Reference 21). The normalized rod cluster control assembly position versus time curve assumed in accident analyses is shown in Figure 15.1-2.

Figure 15.1-3 shows the fraction of total negative reactivity insertion for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution.

There is inherent conservatism in the use of this curve in that it is based on a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized rod cluster control assembly negative reactivity insertion versus time curve corresponding to an insertion time to dashpot entry of 2.7 seconds is shown in Figure 15.1-4. The curve shown in this figure was obtained from Figures 15.1-2 and 15.1-3. A total negative reactivity insertion following a trip of 4% k/k is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4.3-3.

The normalized rod cluster control assembly negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom (Figure 15.1-4) is the most limiting of those transient analyses for which a point kinetics core model is used.

Where special analyses require use of three dimensional or axial one dimensional core models, the negative reactivity insertion resulting from the reactor trip is calculated directly by the reactor kinetics code and is not separable from the other reactivity feedback effects. In this case, the rod cluster control assembly position versus time of Figure 15.1-2 is used as code input.

15.1.6 Reactivity Coefficients The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some analyses such as loss of reactor coolant from cracks or ruptures in the reactor coolant system do not depend on reactivity feedback effects. The values used are given in Table 15.1-2; reference is made in that table to Figure 15.1-5 which shows the upper and lower bound Doppler power coefficients as a function of power, used in the transient analysis. The justification for use of conservatively large versus small reactivity coefficient values are treated on an event by event basis. To facilitate comparison, individual sections in which justification for the use of large or small reactivity coefficient values is to be found are referenced below:

15.1-6 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 Condition II Events Section

1. Uncontrolled Rod Cluster Control Assembly Bank 5.2.1 Withdrawal From a Subcritical Condition

2. Uncontrolled Rod Cluster Control Assembly Bank 15.2.2 Withdrawal at Power

3. Rod Cluster Control Assembly Misalignment 15.2.3

4. Uncontrolled Boron Dilution 15.2.4

5. Partial Loss of Forced Reactor Coolant Flow 15.2.5

6. Startup of an Inactive Reactor Coolant Loop 15.2.6

7. Loss of External Electrical Load and/or Turbine Trip 15.2.7

8. Loss of Normal Feedwater 15.2.8

9. Loss of Offsite Power to the Station Auxiliaries 15.2.9 (Station Blackout)

10. Excessive Heat Removal Due to Feedwater System 15.2.10 Malfunctions

11. Excessive Load Increase Incident 15.2.11

12. Accidental Depressurization of the Reactor Coolant 15.2.12 System

13. Accidental Depressurization of the Main Steam 15.2.13 System

14. Inadvertent Operation of Emergency Core Cooling 15.2.14 System During Power Operation Condition III Events

1. Complete Loss of Forced Reactor Coolant Flow 15.3.4

2. Single Rod Cluster Control Assembly Withdrawal at 15.3.6 Full Power Condition IV Events

1. Major Rupture of a Main Steam Line 15.4.2.1

2. Major Rupture of a Main Feedwater Pipe 15.4.2.2

3. Steam Generator Tube Rupture 15.4.3

4. Single Reactor Coolant Pump Locked Rotor 15.4.4

5. Rupture of a Control Rod Drive Mechanism Housing 15.4.6 (Rod Cluster Control Assembly Ejection) 15.1.7 Fission Product Inventories 15.1.7.1 Radioactivity in the Core The calculation of the core iodine fission product-inventory is consistent with the inventories given in TID-14844[2]. The fission product inventories for other isotopes CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-7

WATTS BAR WBNP-80 which are important from a health hazard point of view are calculated using the data from APED-5398[3]. These inventories are given in Table 15.1-5. The isotopes included in Table 15.1-5 are the isotopes controlling from considerations of inhalation dose (iodines) and from direct dose due to immersion (noble gases).

The isotopic yields used in the calculations are from the data of APED-5398, utilizing the isotopic yield data for thermal fissioning of U-235 as the sole fissioning source. The change in fission product inventory resulting from the fissioning of other fissionable atoms has been reviewed. The results of this review indicated that inclusion of all fission source data would result in small (less than 10%) change in the isotopic inventories.

15.1.7.2 Radioactivity in the Fuel Pellet Clad Gap The computed gap activities (Table 15.1-5) are based on buildup in the fuel from the fission process and diffusion to the gap at rates dependent on the operating temperature. The temperature dependence is accounted for by determining the core fuel fraction operating within each of ten temperature regions (Table 15.1-6). The temperature dependence of the diffusion coefficient, D', for Xe and Kr in U02, follows the Arrhenius law:

E 1 1 D' ( T ) = D' ( 1673 ) exp - ---- --- - ------------

R t 1673 where:

D'(T) = Diffusion coefficient at temperature T, sec-1 E = activation energy, 82 kilocalories/mole D'(1673) = diffusion coefficient at 1673°K = 1 x 10-11 sec-1 T = temperature, °K R = gas constant, 1.99 x 10-3 kilocalories/mole-°K The above expression is valid for temperatures above 1100°C. Below 1100°C fission gas release occurs mainly by two temperature independent mechanisms, recoil and knock out, and is predicted by using D' at 1100°C. The value used for D' (1673°K),

based on data at burnups greater than 1019 fissions/cc, accounts for possible fission gas release by other mechanisms as well as pellet cracking during irradiation.

The diffusion coefficient for iodine isotopes was conservatively assumed to be the same as for Xe and Kr. Toner and Scott[4] observed that iodine diffuses in U02 at about the same rate as Xe and Kr and has about the same activation energy. Data reported by Belle[5] indicate that the iodine diffuses at slightly slower rates than Xe and Kr.

15.1-8 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 With the diffusion coefficient determined for the fuel temperature region of interest, the fraction of radioactive fission gas which crosses the fuel boundary into the fuel rod gap is found from:

D' D' f = 3 ----- Coth ----- - -----

D' where:

f = fraction of a given radioactive fission gas in fuel rod gap

= fission gas decay constant, sec-1 D' = diffusion coefficient, sec-1 The above expression is the steady state solution of the diffusion equation in spherical geometry as given by Booth[6].

The total activities as well as the percentages of the total core activities present in the gap for each pertinent isotope are listed in Table 15.1-5 based on the fuel temperature distribution given in Table 15.1-6.

The radioactivity in the reactor coolant as well as in the volume control tank, pressurizer, and waste gas decay tanks are given in Chapter 11 along with the data on which these computations are based.

15.1.8 Residual Decay Heat Residual heat in a subcritical core consists of:

(1) Fission product decay energy, (2) Decay of neutron capture products, and (3) Residual fissions due to the effect of delayed neutrons.

These constituents are discussed separately in the following paragraphs.

15.1.8.1 Fission Product Decay Energy For short times (103 seconds) after shutdown, data on yields of short half life isotopes is sparse. Very little experimental data is available for the X-ray contributions and even less for the -ray contribution. Several authors have compiled the available data into a conservative estimate of fission product decay energy for short times after shutdown, notably Shure[7] and Dudziak[8]. Of these two selections, Shure's curve is the highest, and it is based on the data of Stehn and Clancy[10] and Obenshain and Foderaro[11].

The fission product contribution to decay energy which has been assumed in the accident analyses is the curve of Shure increased by 20% for conservatism unless CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-9

WATTS BAR WBNP-80 otherwise stated in the sections describing specific accidents. This curve with the 20%

factor included is shown in Figure 15.1-6.

15.1.8.2 Decay of U-238 Capture Products Betas and gammas from the decay of U-239 (23.5 minute half-life) and Np-239 (2.35 day half-life) contribute significantly to the heat generation after shutdown. The cross section for production of these isotopes and their decay schemes is relatively well known. For long irradiation times their contribution can be written as:

E + E

-1 c ( 1 + ) e- 1 t watts/watt P 1 P 0 = -----------------------

1 200Mev E + E 2 -2 t -1 t ) -2 t 2

-2 c ( 1 + ) -----------------

P 2 P 0 = ----------------------- (e -e +e watts/watt 200Mev 1 - 2 where:

P1/P0 =the energy from U-239 decay P2/P0 =the energy from Np-239 decay t =the time after shutdown (seconds) c(1+) =the ratio of U-238 captures to total fissions = 0.6 (1 + 0.2) 1 =the decay constant for U-239 = 4.91 x 10-4 second-1 2 =the decay constant for Np-239 = 3.41 x 10-6 second-1 E 1 =total -ray energy from U-239 decay = 0.06 Mev E 2 =total -ray energy from Np-239 decay = 0.30 Mev E 1 =total -ray energy from U-239 decay = 1/3 x 1.18 Mev E 2 =total -ray energy from Np-239 decay = 1/3 x 0.43 Mev (Two-thirds of the potential -energy is assumed to escape by the accompanying neutrinos.)

This expression with a margin of 10% has been assumed in the accident analysis unless otherwise stated in the sections describing specific accidents and is shown in Figure 15.1-6. The 10% margin, compared to 20% for fission product decay, is justified by the availability of the basic data required for this analysis. The decay of other isotopes, produced by neutron reactions other than fission, is neglected.

15.1-10 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 15.1.8.3 Residual Fissions The time dependence of residual fission power after shutdown depends on core properties throughout a transient under consideration. Core average conditions are more conservative for the calculation of reactivity and power level than actual local conditions as they would exist in hot areas of the core. Thus, unless otherwise stated in the text, static power shapes were assumed in the analyses and these are factored by the time behavior of core average fission power calculated by a point model kinetics calculation with six delayed neutron groups.

For the purpose of illustration only a one delayed neutron group calculation, with a constant shutdown reactivity of negative 4% K is shown in Figure 15.1-6.

15.1.8.4 Distribution of Decay Heat Following Loss of Coolant Accident During a loss of coolant accident the core is rapidly shut down by void formation or rod cluster control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma-ray contribution. The steady state factor of 97.4% which represents the fraction of heat generated within the clad and pellet drops to 95% for the hot rod in a loss of coolant accident.

For example, consider the transient resulting from the postulated double-ended break of the largest reactor coolant system pipe; 1/2 second after the rupture about 30% of the heat generated in the fuel rods is from gamma-ray absorption. The gamma power shape is less peaked than the steady state fission power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conservative estimate of this effect is a reduction of 10% of the gamma-ray contribution or 3% of the total. Since the water density is considerably reduced at this time, an average of 98%

of the available heat is deposited in the fuel rods, the remaining 2% being absorbed by water, thimbles, sleeves and grids. The net effect is a factor of 0.95 rather than 0.974, to be applied to the heat production in the hot rod.

15.1.9 Computer Codes Utilized Summaries of some of the principal computer codes used in transient analyses are given below. Other codes, in particular, are very specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the reactor coolant system pipe rupture (Section 15.4), and which consequently have a direct bearing on the accident itself, are summarized or referenced in their respective accident analyses sections. The codes used in the analyses of each transient have been listed in Table 15.1-2.

15.1.9.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross section of a metal clad U02 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-11

WATTS BAR WBNP-80 temperature, and density). The code uses a fuel model which exhibits the following features simultaneously:

(1) A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

(2) Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.

(3) The necessary calculations to handle post-DNB transients, film boiling heat transfer correlations, Zircaloy-water reaction and partial melting of the materials.

The gap heat transfer coefficient is calculated according to an elastic pellet model (refer to Figure 15.1-8). The thermal expansion of the pellet is calculated as the sum of the radial (one-dimensional) expansions of the rings. Each ring is assumed to expand freely. The cladding diameter is calculated based on thermal expansion and internal and external pressures.

If the outside radius of the expanded pellet is smaller than the inside radius of the expanded clad, there is no fuel-clad contact and the gap conductance is calculated on the basis of the thermal conductivity of the gas contained in the gap. If the pellet's outside radius so calculated is larger than the clad inside radius (negative gap), the pellet and the clad are pictured as exerting upon each other a pressure sufficiently important to reduce the gap to zero by elastic deformation of both. The contact pressure determines the gap heat transfer coefficient.

FACTRAN is further discussed in Reference [12].

15.1.9.2 Deleted by Amendment 72.

15.1.9.3 MARVEL MARVEL is used to determine the detailed transient behavior of multi-loop pressurized water reactor systems caused by prescribed initial perturbations in process parameters. The code is useful in predicting plant behavior when different conditions are present in the loops. For analytical purposes, the physical, thermal and hydraulic characteristics of a multi-loop plant are represented by two "equivalent" loops. The perturbation is considered to occur in one or more physical loops. The other equivalent loop thus represents in lumped form, the remaining loops in the plant.

The code simulates the coolant flow through the reactor vessel, hot leg, cold leg, steam generator plus the pressurizer surge line. Neutron kinetics, fuel-clad heat transfer and the rod control system characteristics are modeled. Simulation of the reactor trip system, engineered safety features (safety injection) and chemical and volume control system is provided.

MARVEL determines plant behavior following perturbations in any of the following parameters:

15.1-12 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-80 (1) Reactor coolant system loop isolation (2) Reactor coolant system loop flows (3) Core power (4) Reactivity (5) Feedwater enthalpies (6) Feedwater flow (7) Steamline isolation valves (8) Steam flow (9) Pressurizer auxiliary spray (10) Reactor trip (11) Steamline break (12) Feedwater line break (13) Reactor coolant system leak (14) Safety injection system (15) Steam dump MARVEL also has the capability of calculating the transient value of DNB ratio on the input from the core limits illustrated on Figure 15.1-1. The core limits represent the minimum value of DNBR as calculated for a typical or thimble cell.

MARVEL is further discussed in Reference [14].

15.1.9.4 LOFTRAN LOFTRAN is used for studies of transient response of a pressurized water reactor system to specified perturbations in process parameters. LOFTRAN simulates a multi-loop system by a lumped parameter single loop model containing reactor vessel, hot and cold leg piping, steam generator (tube and shell sides) and the pressurizer.

The pressurizer heaters, spray, relief and safety valves are also considered in the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron and rods are included. The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The reactor protection system is simulated to include reactor trips on neutron flux, overpower and overtemperature reactor coolant T, high and low pressure, low flow, and high pressurizer level. Control systems are also simulated including rod control, steam dump, feedwater control and pressurizer CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-13

WATTS BAR WBNP-89 pressure control. The safety injection system including the accumulators is also modeled.

LOFTRAN is suited to both accident evaluation and control studies as well as parameter sizing.

LOFTRAN also has the capability of calculating the transient value of DNB ratio based on the input from the core limits illustrated on Figure 15.1-1. The core limits represent the minimum value of DNBR as calculated for typical or thimble cell.

LOFTRAN is further discussed in Reference [15].

15.1.9.5 LEOPARD LEOPARD determines fast and thermal neutron spectra, using only basic geometry and temperature data. The code optionally computes fuel depletion effects for a dimensionless reactor and recomputes the spectra before each discrete burnup step.

LEOPARD is further described in Reference [16].

15.1.9.6 TURTLE TURTLE is a two-group, two-dimensional neutron diffusion code featuring a direct treatment of the nonlinear effects of xenon, enthalpy, and Doppler. Fuel depletion is allowed.

TURTLE was written for the study of azimuthal xenon oscillations, but the code is useful for general analysis. The input is simple, fuel management is handled directly, and a boron criticality search is allowed.

TURTLE is further described in Reference [17].

15.1.9.7 TWINKLE TWINKLE is a multi-dimensional spatial neutron kinetics code patterned after steady-state codes used for reactor core design. The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two and three dimensions. The code uses six delayed neutron groups and contains a detailed multi-region fuel-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 2000 spatial points, and performs its own steady state initialization. Aside from basic cross-section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits include channelwise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.

TWINKLE is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is further described in Reference [18].

15.1-14 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-89 15.1.9.8 Deleted by Amendment 80.

15.1.9.9 THINC THINC is described in Section 4.4.3.4.

15.1.9.10 LOFTTR The steam generator tube rupture (SGTR) analyses were performed for Watts Bar using the analysis methodology developed in WCAP-10698[24] and Supplement 1 to WCAP-10698.[25] The methodology was developed by the SGTR Subgroup of the Westinghouse Owners Group (WOG) and was approved by the NRC in Safety Evaluation Reports (SERs) dated December 17, 1985 and March 30, 1987. The LOFTTR2 program, an updated version of the LOFTTR1 program, was used to perform the SGTR analysis for Watts Bar. The LOFTTR1 program was developed as part of the revised SGTR analysis methodology and was used for the SGTR evaluations.[24][25] However, the LOFTTR1 program was subsequently modified to accomodate steam generator overfill and the revised program, designated as LOFTTR2, and was used for the evaluation of the consequences of overfill in WCAP-11002.[26] The LOFTTR2 program is identical to the LOFTTR1 program, with the exception that the LOFTTR2 program has the additional capability to represent the transition from two regions (steam and water) on the secondary side to a single water region if overfill occurs, and the transition back to two regions again depending upon the calculated secondary conditions. Since the LOFTTR2 program has been validated against the LOFTTR1 program, the LOFTTR2 program is also appropriate for performing licensing basis SGTR analyses. The specific Watts Bar LOFTTR2 analysis utilizing this methodology is described in 15.4.3.

REFERENCES (1) Deleted by Amendment 80.

(2) DiNunno, J. J., et al. "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, March 1962.

(3) Meek, M. E. and Rider, B. F., "Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum and 14 Mev Neutron Energies," APED-5398, March 1968.

(4) Toner, D. F. and Scott, J. S., "Fission-Product Release from UO", Nuc. Safety 3 No. 2, 15-20, December 1961.

(5) Belle, J., "Uranium Dioxide Properties and Nuclear Applications," Naval Reactors, Division of Reactor Development United States Atomic Energy Commission, 1961.

(6) Booth. A. H., "A Suggested Method for Calculating the Diffusion of Radioactive Rare Gas Fission Products From UO Fuel Elements," DCI-27, 1957.

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-15

WATTS BAR WBNP-89 (7) Shure, K., "Fission Product Decay Energy" in Bettis Technical Review, WAPD-BT-24, p. 1-17, December 1961.

(8) Shure, K. and Dudziak, D. J., "Calculating Energy Released by Fission Products," Trans. Am. Nucl. Soc. 4 (1) 30 (1961).

(9) Deleted by Amendment 65.

(10) Stehn, J.R. and Clancy, E. F., "Fission-Product Radioactivity and Heat Generation" and "Proceedings of the Second United Nations International Conference on the Peaceful Uses of Atomic Energy, Geneva, 1958," Volume 13, pp. 49-54, United Nations, Geneva, 1958.

(11) Obershain, F. E. and Foderaro, A. H., "Energy from Fission Product Decay,"

WAPD-P-652, 1955.

(12) Hargrove, H. G., "FACTRAN, a FORTRAN IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, December 1989.

(13) Deleted by Amendment 72.

(14) Geets, J. M., "MARVEL - A Digital Computer Code for Transient Analysis of a Multiloop PWR System," WCAP-7909, June 1972.

(15) Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary) April 1984.

(16) Barry, R. F., "LEOPARD, A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963.

(17) Barry, R. F. and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code,"

WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary),

January 1975.

(18) Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Non-Proprietary), January 1975.

(19) Deleted by Amendment 80.

(20) Deleted by Amendment 80.

(21) Morita, T., et. al., "Dropped Rod Methodology for Negative Flux Rate Trip Plants," WCAP-10297-P-A (Proprietary) and WCAP-10298-A (Non-Proprietary), June 1983.

(22) Reagan, J. R. and Tuley, C. R., "Westinghouse Setpoint Methodology for Protection Systems, Watts Bar Units 1 and 2, Eagle 21 Version," WCAP-12096, Rev. 5, May 1993 (Proprietary).

15.1-16 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-89 (23) Miranda, S., et.al., "Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater Related Trips," WCAP-11325-P-A, Revision 1, February 1988.

(24) Lewis, Huang, Behnke, Fittante, Gelman, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," WCAP-10698-P-A

[PROPRIETARY]/WCAP-10750-A [NON-PROPRIETARY], August 1987.

(25) Lewis, Huang, Rubin, "Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident," Supplement 1 to WCAP-10698-P-A

[PROPRIETARY]/Supplement 1 to WCAP-10750-A [NON-PROPRIETARY],

March 1986.

(26) Lewis, Huang, Rubin, Murray, Roidt, Hopkins, "Evaluation of Steam Generator Overfill Due to a Steam Generator Tube Rupture Accident,"

WCAP-11002 [PROPRIETARY]/WCAP-11003 [NON-PROPRIETARY],

February 1986.

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-17

WATTS BAR WBNP-89 Table 15.1-1 Nuclear Steam Supply Power Ratings Guaranteed Nuclear Steam Supply System thermal power 3425 MWt output The Engineered Safety (Features) Design Rating 3650 MWt (ESDR)(initial design maximum calculated turbine rating is 3579 MWt)

Thermal power generated by the 14 MWt reactor coolant pumps Guaranteed core thermal power 3411 MWt 15.1-18 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS WATTS BAR Table 15.1-2 Summary Of Initial Conditions And Computer Codes Used (Page 1 of 4)

REACTIVITY COEFFICIENTS INITIAL NSSS ASSUMED FOR: THERMAL POWER MODERATOR MODERATOR OUTPUT COMPUTER TEMPERATURE DENSITY ASSUMED1 FAULTS CODES UTILIZED (k/°F) (k/gm/cc) DOPPLER (MWt)

CONDITION II Uncontrolled RCC Assembly TWINKLE, FACTRAN, Refer to Section -- Least negative 3411 (critical @ 0.0 Bank Withdrawal from THINC 15.2.1.2 (Part 2) Doppler power fraction of Nominal Subcritical Condition coefficient- [FON])

Doppler defect

= -0.9% k/k Uncontrolled RCC Assembly LOFTRAN, FACTRAN, --- Figure 15.1-7 and lower and 3425 Bank Withdrawal at Power THINC 0.43 upper2 RCC Assembly Misalignment THINC, LOFTRAN --- Figure 15.1-7 upper2 3425 Uncontrolled Boron NA NA NA NA 0 and 3425 Dilution Partial Loss of Forced LOFTRAN, THINC, --- Figure 15.1-7 upper2 3425 Reactor Coolant Flow FACTRAN Startup of an Inactive MARVEL, THINC, --- 0.43 lower2 2397 Reactor Coolant Loop FACTRAN Loss of External Electrical LOFTRAN --- Figure 15.1-7 lower and 3425 Load and/or Turbine Trip and 0.43 upper2 Loss of Normal Feedwater/ LOFTRAN --- Figure 15.1-7 upper2 3425 Loss of Off-Site Power to the Station Auxiliaries CONDITION II (Cont'd)

WBNP-89 Excessive Heat Removal Due to LOFTRAN, THINC --- 0.43 lower2 3425 15.1-19 Feedwater System Malfunctions3

Table 15.1-2 Summary Of Initial Conditions And Computer Codes Used (Continued) 15.1-20 WATTS BAR (Page 2 of 4)

REACTIVITY COEFFICIENTS INITIAL NSSS ASSUMED FOR: THERMAL POWER MODERATOR MODERATOR OUTPUT COMPUTER TEMPERATURE DENSITY ASSUMED1 FAULTS CODES UTILIZED (k/°F) (k/gm/cc) DOPPLER (MWt)

Excessive Load Increase Incident LOFTRAN --- Figure 15.1-7 and lower2 3425 0.43 Accidental Depressurization of the LOFTRAN Figure 15.1-7 upper2 3425 Reactor Coolant System Accidental Depressurization of the LOFTRAN Function of Note 4 3425 (critical @ 0.0 Main Steam System moderator fraction of nominal density; see [FON])

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS Section 15.2.13 (Figure 15.2-40)

Inadvertent Operation of ECCS LOFTRAN --- Figure 15.1-7 and lower and 3425 During Power Operation 0.43 upper2 CONDITION III Loss of Reactor Coolant from NOTRUMP, LOCTA-IV 34115 Small Ruptured Pipes or from Cracks in Large Pipes which Actuates Emergency Core Cooling CONDITION III (Cont'd)

Inadvertent Loading of a Fuel LEOPARD, TURTLE --- Minimum NA 3425 Assembly into an Improper Position Complete Loss of Forced THINC, FACTRAN, --- Figure 15.1-7 upper2 3425 Reactor Coolant Flow LOFTRAN WBNP-89 Waste Gas Decay Tank NA --- NA NA 3579

Table 15.1-2 Summary Of Initial Conditions And Computer Codes Used (Continued)

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS WATTS BAR (Page 3 of 4)

REACTIVITY COEFFICIENTS INITIAL NSSS ASSUMED FOR: THERMAL POWER MODERATOR MODERATOR OUTPUT COMPUTER TEMPERATURE DENSITY ASSUMED1 FAULTS CODES UTILIZED (k/°F) (k/gm/cc) DOPPLER (MWt)

Single RCC Assembly Withdrawal TURTLE, THINC, --- NA NA 3425 at Full Power LEOPARD CONDITION IV Major Rupture of Pipes SATAN-VI, WREFLOOD, Calculated Calculated Calculated internally 34115 Containing Reactor Coolant Up to LOTIC 2, BASH, internally by internally by by SATAN code, and Including Double-ended LOCBART, FROTH SATAN code, SATAN code, Reference 3 Rupture of the Largest Pipe in the Reference 3 Reference 3 described in Section Reactor Coolant System (Loss of described in described in 15.4.1.1.2 Coolant Accident) Section 15.4.1.1.2 Section 15.4.1.1.2 CONDITION IV (Cont'd)

Major Rupture of a Steam Pipe LOFTRAN, THINC Function of Note 4 3425 (critical @ 0.0 moderator fraction of nominal density; see [FON]).

Section 15.2.13 (Figure 15.2-40)

Major Rupture of a Main LOFTRAN --- Figure 15.1-7 upper2 3425 Feedwater Pipe Steam Generator Tube Rupture LOFTTR2 0 pcm/°F @ 100 Figure 15.1-7 upper2 3425 RTP Single Reactor Coolant Pump LOFTRAN, THINC, --- Figure 15.1-7 upper2 3425 Locked Rotor FACTRAN Fuel Handling Accident NA NA NA 3579 15.1-21 WBNP-89

Table 15.1-2 Summary Of Initial Conditions And Computer Codes Used (Continued) 15.1-22 WATTS BAR (Page 4 of 4)

REACTIVITY COEFFICIENTS INITIAL NSSS ASSUMED FOR: THERMAL POWER MODERATOR MODERATOR OUTPUT COMPUTER TEMPERATURE DENSITY ASSUMED1 FAULTS CODES UTILIZED (k/°F) (k/gm/cc) DOPPLER (MWt)

Rupture of a Control Rod Drive TWINKLE, FACTRAN Refer to --- Consistent 3411 (HZP 0)

Mechanism Housing (RCCA Section 15.4.6 with lower Ejection) limit shown on Figure 15.1-5 1

A minimum of 2% margin has to be applied.

2 Refer to Figure 15.1-5.

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 3

Refer to Figure 15.1-7.

4 Refer to Figure 15.4-9.

5 LOCA M/E based on Engineering Safety Design Rating (ESDR) of 3650 MWt.

WBNP-89

WATTS BAR WBNP-80 Table 15.1-3 Trip Points And Time Delays To Trip Assumed In Accident Analyses Limiting Trip Trip Point Assumed Time Delay Function in Analysis (Seconds)

Power Range High Neutron 118% 0.5 Flux, High Setting Power Range High Neutron 35% 0.5 Flux, Low Setting Overtemperature T Variable (see 7.0*

Figure 15.1-1)

Overpower T Variable (see 7.0*

Figure 15.1-1)

High Pressurizer Pressure 2445 psig 2.0 Low Pressurizer Pressure 1845 psig 2.0

• Total time delay (including RTD time response and trip circuit channel electronics delay) from the time the temperature difference in the coolant loops exceeds the trip setpoint until the rods are free to fall.

Low Reactor Coolant Flow 87% loop flow 1.2 (from loop flow detectors)

Undervoltage Trip 68% 1.5 Turbine Trip Not applicable 1.0 Low-Low Steam Generator 0% of narrow 2.0 + TTD*

Level range span High-High Steam Generator 89.7% of narrow range 2.5 Level, Turbine Trip, and level span Feedwater Isolation

• Trip Time Delay (TTD) is applicable only below 50% RTP.

CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-23

WATTS BAR WBNP-71 Table 15.1-4 Determination Of Maximum Overpower Trip Point Power Range Neutron Flux Channel - Based On Nominal Setpoint Considering Inherent Instrumentation Errors Deleted By Amendment 71 15.1-24 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-65 Table 15.1-5 Core And Gap Activities Based On Full Power Operation For 650 Daysfull Power: 3565 MWt Curies in Core Percent of Core Curies in Gap Isotope (x 107) Activity in Gap (x 105)

I-131 8.80 0.960 8.45 I-132 13.4 0.105 1.41 I-133 19.7 0.316 6.24 I-134 23.1 0.0652 1.50 I-135 17.9 0.180 3.22 Xe-131m 0.0668 1.17 0.0781 Xe-133 20.3 0.778 15.8 Xe-133m 0.516 0.510 0.263 Xe-135 5.55 0.210 1.17 Xe-135m 5.46 0.0355 0.194 Xe-138 17.9 0.0370 0.663 Kr-83m 1.64 0.0964 0.158 Kr-85 0.0999 18.3 1.83 Kr-85m 3.95 0.145 0.572 Kr-87 7.59 0.0783 0.594 Kr-88 10.8 0.116 1.25 Kr-89 14.0 0.0161 0.226 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS 15.1-25

WATTS BAR WBNP-80 Table 15.1-6 Core Temperature Distribution Fuel Volume Power of Fuel within Fuel Temperature within Given Given Temperature Range, °F Temperature Range, % Range, MWt 3600 - 3800 0.005 0.46 3400 - 3600 0.03 2.8 3200 - 3400 0.15 11.7 3000 - 3200 0.46 34.1 2800 - 3000 1.10 77.0 2600 - 2800 2.23 146.6 2400 - 2600 3.64 224.9 2200 - 2400 4.93 291.6 2000 - 2000 6.03 344.7

< 2000 81.43 2431.14 15.1-26 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

WATTS BAR WBNP-89 Figure 15.1-1 llustration of Overtemperature and Overpower T Protection Condition I - Normal Operation and Operational Transients 15.1-27

WATTS BAR WBNP-80 Figure 15.1-2 RCCA Position Versus Time On Reactor Trip 15.1-28 Condition I - Normal Operation and Operational Transients

WATTS BAR WBNP-80 Figure 15.1-3 Normalized RCCA Reactivity Worth Versus Rod Insertion Fraction Condition I - Normal Operation and Operational Transients 15.1-29

WATTS BAR 15.1-30 Condition I - Normal Operation and Operational Transients WBNP-80 Figure 15.1-4 Normalized RCCA Bank Reactivity Worth Versus Time from Rod Re lease

WATTS BAR WBNP-80 Figure 15.1-5 Doppler Power Coefficient Used In Accident Analysis Condition I - Normal Operation and Operational Transients 15.1-31

WATTS BAR WBNP-80 Figure 15.1-6 Residual Decay Heat 15.1-32 Condition I - Normal Operation and Operational Transients

WATTS BAR WBNP-80 Figure 15.1-7 Minimum Moderator Density Coefficient Used in Analysis Condition I - Normal Operation and Operational Transients 15.1-33

WATTS BAR WBNP-80 Figure 15.1-8 Fuel Rod Cross Section 15.1-34 Condition I - Normal Operation and Operational Transients

WATTS BAR WBNP-80 15.2 CONDITION II - FAULTS OF MODERATE FREQUENCY These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV category. In addition, Condition II events are not expected to result in fuel rod failures or reactor coolant system (RCS) overpressurization. For the purposes of this report, the following faults have been grouped into this category:

(1) Uncontrolled rod cluster control assembly bank withdrawal from a subcritical condition.

(2) Uncontrolled rod cluster control assembly bank withdrawal at power.

(3) Rod cluster control assembly misalignment.

(4) Uncontrolled boron dilution.

(5) Partial loss of forced reactor coolant flow.

(6) Startup of an inactive reactor coolant loop.

(7) Loss of external electrical load and/or turbine trip.

(8) Loss of normal feedwater.

(9) Loss of offsite power to the station auxiliaries (station blackout).

(10) Excessive heat removal due to feedwater system malfunctions.

(11) Excessive load increase incident.

(12) Accidental depressurization of the reactor coolant system.

(13) Accidental depressurization of the main steam system.

(14) Inadvertent operation of emergency core cooling system during power operation.

An evaluation of the reliability of the reactor protection system actuation following initiation of Condition II events is presented in Reference [l] for the relay protection logic. Standard reliability engineering techniques were used to assess likelihood of the trip failure due to random component failures. Common mode failures were also qualitatively investigated. It was concluded from the evaluation that the likelihood of no trip following initiation of Condition II events is extremely small (2 x 10-7 derived for random component failures).

The solid state protection system design has been evaluated by the same methods as used for the relay system and the same order of magnitude of reliability is provided.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-1

WATTS BAR WBNP-80 The worst common mode failure which is postulated to occur is the failure to scram the reactor after an anticipated transient has occurred. A series of generic studies, References [2] and [11], on anticipated transients without scram (ATWS) showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner. The effects of ATWS events are not considered as part of the design basis for transients analyzed in Chapter 15. The final NRC ATWS rule [12] requires that Westinghouse-designed plants install ATWS mitigation system circuitry (AMSAC) to initiate a turbine trip and actuate auxiliary feedwater flow independent of the reactor protection system. The Watts Bar AMSAC design is described in Section 7.7.1.12.

The time sequence of events during applicable Condition II events is shown in Table 15.2-1.

15.2.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical Condition 15.2.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCA's resulting in a power excursion. Such a transient could be caused by a malfunction of the reactor control or rod control systems. This could occur with the reactor either subcritical, hot zero power or at power. The "at power" case is discussed in Section 15.2.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution.

The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Section 15.2.4).

The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCA's from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and only in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient.

This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the reactor protection system:

15.2-2 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 (1) Source Range High Neutron Flux Reactor Trip - actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.

(2) Intermediate Range High Neutron Flux Reactor Trip - actuated when either of two independent intermediate range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two of the four power range channels are reading above approximately 10% of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

(3) Power Range High Neutron Flux Reactor Trip (Low Setting) - actuated when two out of the four power range channels indicate a power level above approximately 25% of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10% of full power and is automatically reinstated only after three of the four channels indicate a power level below this value.

(4) Power Range High Neutron Flux Reactor Trip (High Setting) - actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

(5) Power Range High Positive Neutron Flux Rate Trip - actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicate a rate above the preset setpoint. This trip function is always active.

In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent actuation of the intermediate range flux level trip and the power range flux level trip, respectively.

15.2.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages: first an average core nuclear power transient calculation, then an average core heat transfer calculation, and finally a DNBR calculation. The average core nuclear power calculation is performed using spatial neutron kinetics methods, TWINKLE[3], to determine the average power generation with time, including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.

The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN[4]. The average heat flux is next used in THINC (described in Section 4.4.3.4) for the transient DNBR calculation.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-3

WATTS BAR WBNP-80 In order to give conservative results for a startup accident, the following assumptions are made concerning the initial reactor conditions:

(1) Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservative values (low absolute magnitude) as a function of power are used. See Section 15.1.6 and Table 15.1-2.

(2) Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time.

However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A conservative value which is appropriate for beginning of core life at hot zero power, is used in the analysis to yield the maximum peak heat flux.

(3) The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.

(4) Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and rod cluster control assembly release, is taken into account. A 10% increase is assumed for the power range flux trip setpoint raising it from the nominal value of 25% to 35%.

Previous results, however, show that rise in the neutron flux is so rapid that the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.1.5 for RCCA insertion characteristics.

(5) The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute). Control rod drive mechanism design is discussed in Section 4.2.3.

(6) The initial power level was assumed to be below the power level expected for any shutdown condition. The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.

(7) The most limiting axial and radial power shapes, associated with having the two highest combined worth sequential control banks in their high worth position, are assumed in the DNB analysis.

15.2-4 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 (8) Two reactor coolant pumps are assumed to be in operation.

Results The calculated sequence of events for this accident is shown on Table 15.2-1.

Figures 15.2-1 through 15.2-3 show the transient behavior for the indicated reactivity insertion rate with the accident terminated by reactor trip at 35% nominal power. This insertion rate is greater than that for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region.

Figure 15.2-1 shows the nuclear power transient. The nuclear power overshoots the full power nominal value but this occurs for only a very short time period. Hence, the energy release and the fuel temperature increases are relatively small. The heat flux response, of interest for DNB considerations, is shown on Figure 15.2-2. The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux less than the peak nuclear power value. Figures 15.2-3 and 15.2-3a show the response of the hot spot average fuel and cladding temperatures. The average fuel temperature increases to a value lower than the nominal full power value. The minimum DNBR remains above the limiting value at all times.

15.2.1.3 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the reactor coolant system are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limiting value.

Thus, no cladding damage and no release of fission products to the reactor coolant system is predicted as a result of DNB.

15.2.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER 15.2.2.1 Identification of Causes and Accident Description Uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature.

Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise would eventually result in DNB. Therefore, in order to avert damage to the fuel clad the reactor protection system is designed to terminate any such transient before the DNBR falls below the limiting value.

The automatic features of the reactor protection system which prevent core damage following the postulated accident include the following:

(1) Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-5

WATTS BAR WBNP-89 (2) Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.

(3) Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint. This setpoint is automatically varied with axial power imbalance to ensure that the allowable heat generation rate (kW/ft) is not exceeded.

(4) A high pressurizer pressure reactor trip actuated from any two out of four pressure channels which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.

(5) A high pressurizer water level reactor trip actuated from any two out of three level channels which is set at a fixed point.

In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:

(1) High neutron flux (one out of four)

(2) Overpower T (two out of four)

(3) Overtemperature T (two out of four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of reactor coolant system conditions is described in Chapter 7. Figure 15.1-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as "protection lines" on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR is above the limiting value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limiting value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and overtemperature T (variable setpoints).

15.2-6 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 15.2.2.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by the LOFTRAN[5] Code. This code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. The core limits as illustrated in Figure 15.1-1 are used as input to LOFTRAN to determine the minimum DNBR during the transient. The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN[4]. The core limits are calculated by applying the "R" grid spacer factor to the W-3 DNB correlation, THINC Code[16,17].

In order to obtain conservative values of DNBR the following assumptions are made:

(1) Initial conditions of maximum core power and reactor coolant average temperature and minimum reactor coolant pressure, (pressurizer pressure

- 46 psi allowance for steady-state fluctuations and measurement error) resulting in the minimum initial margin to DNB.

(2) Reactivity Coefficients - Two cases are analyzed:

(a) Minimum Reactivity Feedback. A least negative moderator coefficient of reactivity is assumed corresponding to the beginning of core life. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed.

(b) Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.

(3) The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118% of nominal full power. The T trips include all adverse instrumentation and setpoint errors, while the delays for the trip signal actuation are assumed at their maximum values.

(4) The RCCA trip insertion characteristics are based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

(5) The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at maximum speed.

The effect of RCCA movement on the axial core power distribution is accounted for by causing a decrease in overtemperature and overpower T trip setpoints proportional to a decrease in margin to DNB.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-7

WATTS BAR WBNP-80 Results The calculated sequence of events for this accident is shown on Table 15.2-1.

Figures 15.2-4 and 15.2-5 show the response of neutron flux, pressurizer pressure, average coolant temperature, and DNBR to a rapid RCCA withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result and a large margin to DNB is maintained.

The response of neutron flux, pressure, average coolant temperature, and DNBR for a slow control rod assembly withdrawal from full power is shown in Figures 15.2-6 and 15.2-7. Reactor trip on overtemperature T occurs after a longer period of time than for the rapid RCCA withdrawal incident and the rise in temperature is consequently larger.

Following reactor trip, the plant approaches a stabilized condition at hot standby; normal plant operating procedures may then be followed. The operating procedures call for operator action to control RCS boron concentration and pressurizer level using the chemical and volume control system (CVCS), and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following reactor trip.

Figure 15.2-8 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for the minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature T trip channels. The minimum DNBR is never less than the limiting value.

Figures 15.2-9 and 15.2-10 show the minimum DNBR as function of reactivity insertion rate for RCCA withdrawal incidents starting at 60% and 10% power, respectively. The results are similar to the 100% power case except, as the initial power is decreased, the range over which the overtemperature T trip is effective increases. In neither case does the DNBR fall below its minimum limit.

The shape of the curves of minimum DNB ratio versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 15.2-9, for example, it is noted that (1) For high reactivity insertion rates (i.e., between 4.0 x 10-4 k/k/sec and 8.0 x 10-4 k/k/sec) reactor trip is initiated by the high neutron flux trip. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate 15.2-8 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux; minimum DNB ratio during the transient thus decreases with decreasing insertion rate.

(2) The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeded a setpoint based on measured RCS average temperature and pressure. This trip circuit is described in detail in Chapter 7; however, it is important in this context to note that the average temperature contribution to the circuit is lead-lag compensated in order to decrease the effect of the thermal capacity of the RCS in response to power increases.

(3) With further decrease in reactivity insertion rate, the overtemperature T and high neutron flux trips become equally effective in terminating the transient (e.g., at approximately 4.0 x 10-4 k/k/sec reactivity insertion rate).

For reactivity insertion rates betperature T trip increases (in terms of increased minimum DNBR) due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower and the system lags and delays become less significant.

(4) For reactivity insertion rates less than approximately 5.0 x 10-5 k/k/sec, the rise in the reactor coolant temperature is sufficiently high so that the steam generator safety valve setpoint is reached prior to trip. Opening of these valves, which act as an additional heat load of the RCS, sharply decreases the rate of rise of RCS average temperature. This decrease in rate of rise of the average coolant system temperature during the transient is accentuated by the lead-lag compensation causing the overtemperature T trip setpoint to be reached later with resulting lower minimum DNBRs.

For transients initiated from higher power levels (for example, see Figure 15.2-8) this effect, described in Item 4 above, which results in the sharp peak in minimum DNBR at approximately 5 x 10-5 k/k/sec, does not occur since the steam generator safety valves are never actuated prior to trip.

Figures 15.2-8, 15.2-9, and 15.2-10 illustrate minimum DNBR calculated for minimum and maximum reactivity feedback.

15.2.2.3 Conclusions The high neutron flux and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the limiting value.

15.2.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT 15.2.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misalignment accidents include:

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-9

WATTS BAR WBNP-89 (1) One or more dropped RCCAs within the same group; (2) A dropped RCCA bank; (3) Statically misaligned RCCA Each RCCA has a position indicator channel located in the main control room which displays position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates a local alarm and a main control room annunciator.

Group demand position is also indicated. The assemblies are always moved in preselected banks and the banks are always moved in the same preselected sequence.

Each bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite sequence of actuation of the stationary gripper, movable gripper, and lift coils of a mechanism is required to withdraw or insert the RCCA attached to the mechanism.

Since the stationary gripper, movable gripper, and lift coils associated with the RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect just that one group. Mechanical failures are in the direction of insertions, or immobility.

A dropped RCCA or RCCA bank is detected by:

(1) Sudden drop in the core power level is seen by the nuclear instrumentation system; (2) Asymmetric power distribution as seen on out of core neutron detectors or core exit thermocouples; (3) Rod at bottom signal; (4) Rod deviation alarm (control banks only);

(5) Rod position indication.

Misaligned RCCAs are detected by:

(1) Asymmetric power distribution as seen on out of core neutron detectors or core exit thermocouples; (2) Rod deviation alarm (control banks only);

(3) Rod position indicators.

The resolution of the rod position indicator channel is + 5% of span (+ 7.2 inches).

Deviation of any RCCA from its group by twice this distance (10% of span, 14.4 inches) will not cause power distributions worse than the design limits. The deviation alarm 15.2-10 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 alerts the operator to rod deviation with respect to group demand position in excess of 5% of span. If the rod deviation alarm is not operable, the operator is required to take action as required by the Technical Specifications.

If one or more rod position indicator channels should be out of service, detailed operating instructions are followed to assure the alignment of the non-indicated RCCAs. The operator is also required to take action as required by the Technical Specifications. The operating instructions call for the use of moveable incore neutron detectors to confirm indication of assembly misalignment.

15.2.3.2 Analysis of Effects and Consequences Method of Analysis (a) One or More Dropped RCCAs from the Same Group For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN[5] code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the THINC code. The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Section 4.4.3.4.

(b) Statically Misaligned RCCS Steady state power distribution are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then used as input to the THINC code to calculate the DNBR.

Results (a) One or More Dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion which may be detected by the power range negative neutron flux rate trip circuitry. If detected, the reactor is tripped within approximately 2.5 seconds following the drop of the RCCAs. The core is not adversely affected during this period, since power is decreasing rapidly. Following reactor trip, normal shutdown procedures CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-11

WATTS BAR WBNP-80 are followed. The operator may manually retrieve the RCCA by following approved operating procedures.

For those dropped RCCAs which do not result in a reactor trip, power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figure 15.2-11 shows a typical transient response to a dropped RCCA (or RCCAs) in automatic control. Uncertainties in the initial condition are included in the DNB evaluation as described in Reference [13]. In all cases, the minimum DNBR remains above the limiting value.

(b) Dropped RCCA Bank A dropped RCCA bank typically results in a reactivity insertion greater than 500 pcm which will be detected by the power range negative neutron flux rate trip circuitry. The reactor is tripped within approximately 2.5 seconds following the drop of a RCCA bank. The core is not adversely affected during this period, since power is decreasing rapidly. Following reactor trip, normal shutdown procedures are followed to further cool down the plant. Any action required of the operator to maintain the plant in a stabilized condition is in a timeframe in excess of ten minutes following the incident.

(c) Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple-independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value.

The insertion limits in the Technical Specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that 15.2-12 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the limiting value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values including uncertainties but with the increased radial peaking factor associated with the misaligned RCCA.

DNB calculations have not been performed specifically for RCCAs missing from other banks; however, power shape calculations have been done as required for the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kW/ft situation is less severe than the bank D case discussed above assuming insertion limits on the other banks equivalent to a bank D full-in insertion limit.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limiting value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, including uncertainties but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.

15.2.3.3 Conclusions For cases of dropped RCCAs or dropped banks for which the reactor is tripped by the power range negative neutron flux rate trip, there is no reduction in the margin to core thermal limits; consequently, the DNB design basis is met. It is shown for all cases which do not result in reactor trip that the DNBR remains greater than the limiting value; therefore, the DNB design basis is met.

For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with a single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limiting value.

15.2.4 UNCONTROLLED BORON DILUTION 15.2.4.1 Identification of Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the RCS via the reactor makeup portion of the CVCS. Boron dilution is a manual operation under strict administrative controls with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the RCS. The CVCS is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which, after indication through alarms and CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-13

WATTS BAR WBNP-89 instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve provides makeup to the RCS which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the RCS at pressure, at least one charging pump must be running in addition to a primary makeup water pump.

The rate of addition of unborated makeup water to the RCS when it is not at pressure is limited by the capacity of the primary water makeup pumps. Normally, only one primary water supply pump is operating while the other is on standby. With the RCS at pressure, the maximum delivery rate is limited by the control valve.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board. In order to dilute, two separate operations are required:

(1) The operator must switch from the automatic makeup mode to the dilute or alternate dilute mode.

(2) The start handswitch must be actuated.

Omitting either step would prevent dilution.

Information on the status of the reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction. The signals initiating these alarms will also cause the closure of control valves terminating the addition to the RCS.

15.2.4.2 Analysis of Effects and Consequences 15.2.4.2.1 Method of Analysis Boron dilution during refueling, startup, and power operation is considered in this analysis. Table 15.2-1 contains the time sequence of events for this accident.

15.2.4.2.2 Dilution During Refueling An uncontrolled boron dilution accident cannot occur during refueling. This accident is prevented by administrative controls which isolate the RCS from the potential source of unborated water.

Various combinations of valves will be closed during refueling operations. These valves will block the flow paths which could allow unborated makeup to reach the RCS.

Any makeup which is required during refueling will be borated water supplied from the 15.2-14 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 refueling water storage tank (RWST) by the RHR pumps. The operating procedures specify the various valve combinations.

15.2.4.2.3 Dilution During Startup In this mode, the plant is being taken from one long-term mode of operation (hot standby) to another (power). Typically, the plant is maintained in the startup mode only for the purpose of startup testing at the beginning of each cycle. During this mode of operation, rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation. Conditions assumed for the analysis are as follows:

(1) At operating temperature and pressure, dilution flow is limited by the maximum delivery of three charging pumps, 235 gpm.

(2) A minimum RCS water volume of 8,514 ft3. This corresponds to the active RCS volume excluding the pressurizer and the reactor vessel upper head.

(3) The initial boron concentration is assumed to be 1,800 ppm, which is a conservative maximum value for the critical concentration at the condition of hot zero power, rods to insertion limits, and no xenon.

(4) The critical boron concentration following reactor trip is assumed to be 1,600 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no xenon condition. The 200 ppm change from the initial condition noted above is a conservative minimum value.

15.2.4.2.4 Dilution at Power In this mode, the plant may be operated in either automatic or manual rod control.

Conditions assumed for the analysis are as follows:

(1) At operating temperature and pressure, dilution flow is limited by the maximum delivery of three charging pumps, 235 gpm.

(2) A minimum RCS water volume of 8,514 ft3. This corresponds to the active RCS volume excluding the pressurizer and the reactor vessel upper head.

(3) The initial boron concentration is assumed to be 1,500 ppm, which is a conservative maximum value for the critical concentration at the condition of hot full power, rods to insertion limits, and no xenon.

(4) The critical boron concentration following reactor trip is assumed to be 1,250 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no xenon condition. The 250 ppm change from the initial conditions noted above is a conservative minimum value.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-15

WATTS BAR WBNP-89 15.2.4.3 Conclusions 15.2.4.3.1 For Dilution During Refueling Dilution during refueling cannot occur due to administrative controls (see Section 15.2.4.2). The operator has prompt and definite indication of any boron dilution from the audible count rate instrumentation. High count rate is alarmed in the reactor containment and the control room. In addition, a source range high flux level is alarmed in the control room. The count rate increase is proportional to the subcritical multiplication factor.

15.2.4.3.2 For Dilution During Startup This mode of operation is a transitory operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching criticality, thus assuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip after receiving P-6 from the intermediate range. The accidental dilution increase causes a more rapid power escalation such that insufficient time would be available following P-6 to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor.

Continued dilution decreases the shutdown margin such that criticality could eventually be regained.

For dilution during startup, there are more than 15 minutes available for operator action from the time of alarm (reactor trip on source range high flux) to loss of shutdown margin.

15.2.4.3.3 For Dilution Following Reactor Shutdown Following reactor shutdown, when in hot standby, hot shutdown, and subsequent cold shutdown condition, and once below the P-6 interlock setpoint, and 104 counts per second, the high flux at shutdown alarm setting will be automatically adjusted downward as the count rate reduces.

Surveillance testing will ensure that the alarm setpoint is operable. The operator does not depend entirely on this alarm setpoint but has audible indication of increasing neutron flux from the audible count rate drawer and visual indication from counts per second meters for each channel on the main control board and source range drawer.

15.2.4.3.4 For Dilution During Full Power Operation With the reactor in automatic rod control, the power and temperature increase from boron dilution results in insertion of the control rods and a decrease in the available 15.2-16 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 shutdown margin. The rod insertion limit alarms (LOW and LOW-LOW settings) alert the operator that a dilution event is in progress. There are more than 15 minutes available for operator action from the time of alarm (LOW-LOW rod insertion limit) to loss of shutdown margin.

With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the overtemperature T trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially the equivalent to an uncontrolled RCCA bank withdrawal at power. The reactivity insertion rate for a boron dilution accident is conservatively estimated to be about 0.6 pcm/sec, which yields the longest time to reach reactor trip.

There are more than 15 minutes available for operator action from the time of alarm (overtemperature T) to loss of shutdown margin.

For all cases, the reactor will be in a stable condition following termination of the dilution flow. The operator will then initiate reboration to recover the shutdown margin, using the CVCS. If the reactor has tripped, operating procedures call for operator action to control pressurizer level using the CVCS and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition are in a time frame in excess of ten minutes following reactor trip.

15.2.5 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.2.5.1 Identification of Causes and Accident Description A partial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the reactor coolant pumps is supplied through individual electrical boards from a transformer connected to the generator. When a generator trip occurs, the boards are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to provide forced coolant flow to the core. Following a turbine trip where there are no electrical faults or a thrust bearing failure which requires tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the generator thus ensuring full flow for approximately 30 seconds after the reactor trip before any transfer is made. Since each pump is on a separate board, a single board fault would not result in the loss of more than one pump.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip which is actuated by two out of three low flow signals in any reactor coolant loop.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-17

WATTS BAR WBNP-80 Above approximately 50% power (Permissive 8), low flow in any loop will actuate a reactor trip. Between approximately 10% power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

15.2.5.2 Analysis of Effects and Consequences Method of Analysis A partial loss of flow involving the loss of one pump with four loops in operation has been analyzed.

This transient is analyzed by three digital computer codes. First the LOFTRAN[5] Code is used to calculate the loop and core flow transients, the time of reactor trip based on the loop flow transient the nuclear power transient, and the primary system pressure and coolant temperature transients. The FACTRAN Code[4] is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN. Finally, the THINC Code (see Section 4.4.3.4) is used to calculate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transient presented represents the minimum of the typical or thimble cell.

Initial Conditions Initial operating conditions assumed are the most adverse with respect to the margin to DNB, i.e., maximum steady state power level, minimum steady state pressure, and maximum steady state coolant average temperature. See Section 15.1.2 for an explanation of initial conditions.

Reactivity Coefficients The least negative moderator temperature coefficient is assumed since this results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on high estimates of system pressure losses.

Results The calculated sequence of events for the case analyzed is shown on Table 15.2-1 for the two cases analyzed. Figures 15.2-12, 15.2-13, and 15.2-15 through 15.2-17 show the transient response for the loss of power to one reactor coolant pump with four loop operation. The DNBR never goes below the design basis limit.

Following reactor trip, the plant will come to a stabilized condition at hot standby with one or more reactor coolant pumps in operation. Normal operating procedures may then be followed. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam 15.2-18 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-86 generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.

15.2.5.3 Conclusions The analysis has demonstrated for the partial loss of forced reactor coolant flow that the DNBR will not decrease below the design basis limit at any time during the transient.

15.2.6 Startup of an Inactive Reactor Coolant Loop 15.2.6.1 Identification of Causes and Accident Description If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, there is a temperature drop across the steam generator in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

The plant is prohibited by Technical Specifications from operating with an inactive loop for extended periods of time. However, administrative procedures require that the unit be brought to a load of less than 25% of full power prior to starting the pump in an inactive loop in order to bring the inactive loop hot leg temperature closer to the core inlet temperature. Starting of an idle reactor coolant pump without bringing the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core which causes a rapid reactivity insertion and subsequent power increase.

15.2.6.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by three digital computer codes. The MARVEL[8] Code is used to calculate the responses of the active and inactive loops following the startup of an idle pump. The FACTRAN[4] Code is used to calculate the heat flux transient based on the nuclear power and flow from MARVEL. Finally, the THINC[15] Code is then used to calculate the DNBR during the transient based on system conditions (pressure, temperature, and flow) calculated by MARVEL.

Assumptions (1) Initial conditions of maximum core power and reactor coolant average temperatures and minimum reactor coolant pressure resulting in minimum initial margin to DNB. These values are consistent with maximum steady state power level allowed with three, loops in operation. The high initial power gives the greatest temperature difference between the core inlet temperature and the inactive loop hot leg temperature.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-19

WATTS BAR WBNP-89 (2) Following the startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value in 20 seconds.

(3) A conservatively large moderator density coefficient associated with the end-of-life.

(4) A conservatively low (absolute value) negative Doppler power coefficient.

(5) The initial reactor coolant loop flows are at the appropriate values for one pump out of service.

In the analysis reactor trip is conservatively assumed to be actuated by the high neutron flux reactor trip. The trip setpoint was assumed to be 118% of nominal full power. In practice, however, reactor trip would be expected to occur for single loop low flow when the power range neutron flux exceeds the Permissive 8 setpoint assuming the setpoint is reached before the flow in the inactive loop exceeds 90% of its nominal value. This would be the case in this analysis where a conservatively large moderator density coefficient is used.

Results The results following the startup of an idle pump with the above listed assumptions are shown in Figures 15.2-18a through 15.2-18e. Figure 15.2-18a shows the change in core average temperature from the initial core average temperature. During the first part of the transient, the increase in core flow with cooler water results in an increase in nuclear power (Figure 15.2-18b) and a decrease in core average temperature. The minimum DNBR during the transient is shown to never be less than the limiting value (Figure 15.2-18c). The calculated sequence of events for the accident is shown on Table 15.2-1. Reactivity addition, for the inactive loop startup accident case is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the colder water entering the core from the hot leg side (colder temperature side prior to the start of the transient) of the steam generator in the inactive loop. Pressurizer pressure during the transient is shown in Figure 15.2-18d.

Thus, the reactivity insertion rate for this transient changes with time; the resultant core nuclear power transient, computed with consideration of both moderator and Doppler reactivity feedback effects, is shown on Figure 15.2-18e.

Following reactor trip, the plant will approach a stabilized condition at hot standby; normal plant operating procedures may then be followed. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.

15.2-20 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 15.2.6.3 Conclusions The transient results show that the core is not adversely affected, i.e., the limiting DNBR has considerable margin above the limiting value.

15.2.7 LOSS OF EXTERNAL ELECTRICAL LOAD AND/OR TURBINE TRIP 15.2.7.1 Identification of Causes and Accident Description Major load loss on the plant can result from loss of external electrical load or from a turbine trip. For either case offsite power is available for the continued operation of plant components such as the reactor coolant pumps. This analysis, along with the Loss of Normal Feedwater (Section 15.2.8) and Complete Loss of Forced Reactor Coolant Flow (Section 15.4.3) addresses the case of loss of offsite power to the station auxiliaries (Section 15.2.9).

For a turbine trip, the reactor will be tripped directly (unless below approximately 50%

power) from a signal derived from the turbine autostop oil pressure or turbine throttle valve position. The automatic steam dump system will accommodate the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser is not available, the excess steam generation will be dumped to the atmosphere. Additionally, main feedwater flow will be lost if the turbine condenser is not available. For this situation feedwater flow will be maintained by the auxiliary feedwater system.

For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. A continued steam load of approximately 5% would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.

Onsite power supplies plant auxiliaries during plant operation, e.g., the reactor coolant pumps. Safeguards loads are supplied from offsite power or, alternatively, from emergency diesels. Reactor protection system equipment is supplied from the 120V AC vital instrument power supply system, which in turn is supplied from the vital inverters; the inverters are supplied from a DC bus energized from vital batteries or rectified AC from safeguards buses. Thus, for postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition is not seen by safety related pump motors, reactor protection system equipment, or other safeguards loads. Any increased frequency to the reactor coolant pump motors will result in slightly increased flowrate and subsequent additional margin to safety limits.

Should a safety limit be approached, protection would be provided by high pressurizer pressure and overtemperature T trip. Power and frequency relays associated with the reactor coolant pump provide no additional safety function for this event. Following a complete loss of load the maximum turbine overspeed would be approximately 8%

to 9%, resulting in an overfrequency of less than 6 Hz. This resulting overfrequency is not expected to damage the sensors (non-NSSS) in any way. However, it is noted that frequent testing of this equipment is required by the Technical Specifications. Any degradation in their performance could be ascertained at that time.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-21

WATTS BAR WBNP-89 In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, the overtemperature T signal or the low-low steam generator water level signal. The sudden reduction in steam flow will result in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced causing the reactor coolant temperature to rise, which causes coolant expansion, pressurizer insurge, and RCS pressure rise. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valves, automatic rod cluster control assembly control nor direct reactor trip on turbine trip.

The steam generator safety valve capacity is sized to remove the steam flow at the Engineer Safety Features Rating (105% of steam flow at rated power) from the steam generator without exceeding 110% of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The pressurizer safety valves are then able to maintain the RCS pressure within 110% of the RCS design pressure without direct or immediate reactor trip action.

A more complete discussion of overpressure protection can be found in Reference [9].

15.2.7.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from 102% of full power without direct reactor trip primarily to show the adequacy of the pressure relieving devices and also to demonstrate core protection margins.

The total loss of load transients are analyzed by employing the detailed digital computer program LOFTRAN[5], which is described in Section 15.1. The program simulates the neutron kinetics, RCS, presssurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and variables including temperatures, pressures, and power level.

Typical assumptions are:

(1) Initial Operating Conditions - the initial reactor power and RCS temperatures are assumed at their maximum values consistent with the steady state full power operation including allowances for calibration and instrument errors.

The initial RCS pressure is assumed at a minimum value (pressurizer pressure -46 psi allowance for steady-state fluctuations and measurement error) consistent with steady-state full-power operation including allowances for calibration and instrument errors. This results in the maximum power difference for the load loss, and the minimum margin to core protection limits at the initiation of the accident.

15.2-22 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 (2) Moderator and Doppler Coefficients of Reactivity - the total loss of load is analyzed for both the beginning-of-life and end-of-life conditions. The least negative moderator temperature coefficients at beginning-of-life and a large (absolute value) negative value at end-of-life are used. A conservatively large (absolute value) Doppler power coefficient is used for all cases.

(3) Reactor Control - from the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control.

(4) Steam Release - no credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoints where steam release through safety valves occurs to limit the secondary steam pressure.

(5) Pressurizer Spray and Power-Operated Relief Valves - two cases for both the beginning and end-of-life are analyzed:

(a) Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

(b) No credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

(6) Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of loss of external electrical load.

Reactor trip is actuated by the first reactor protection system trip setpoint reached with no credit taken for the direct reactor trip on turbine trip.

Results The transient responses for a total loss of load from 102% of full power operation are shown for four cases; two cases for the beginning of core life and two cases for the end of core life, in Figures 15.2-19 through 15.2-26. The calculated sequence of events for the accident is shown in Table 15.2-1.

Figures 15.2-19 and 15.2-20 show the transient responses for the total loss of steam load at beginning-of-life with a least negative moderator temperature coefficient assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure signal trip channel. The minimum DNBR is well above the limiting value.

Figures 15.2-21 and 15.2-22 show the responses for the total loss of load at end-of-life assuming a large (absolute value) negative moderator temperature coefficient. All other plant parameters are the same as the above. The DNBR increases throughout the transient and never drops below its initial value. The reactor is tripped by the low-low steam generator water level signal.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-23

WATTS BAR WBNP-80 The pressurizer safety valves are not actuated in the transients shown in Figures 15.2-21 and 15.2-22.

The total loss of load accident was also studied assuming the plant to be initially operating at 102% of full power with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam dump. The reactor is tripped on the high pressurizer pressure signal. Figures 15.2-23 and 15.2-24 show the beginning-of-life transients with a least negative moderator coefficient. The neutron flux remains constant at 102% of the full power until the reactor is tripped. The DNBR increases throughout the transient. In this case the pressurizer safety valves are actuated.

Figures 15.2-25 and 15.2-26 are the transients at the end-of-life with the other assumptions being the same as in Figure 15.2-23 and 15.2-24. Again, the DNBR increases throughout the transient and the pressurizer safety valves are actuated.

Reference [9] presents additional results of analysis for a complete loss of heat sink including loss of main feedwater. This analysis shows the overpressure protection that is afforded by the pressurizer and steam generator safety valves.

15.2.7.3 Conclusions Results of the analyses, including those in Reference [9], show that the plant design is such that a total loss of external electrical load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.

The integrity of the core is maintained by operation of the reactor protection system, i.e., the DNBR will be maintained above the limiting value.

15.2.8 LOSS OF NORMAL FEEDWATER 15.2.8.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If the reactor were not tripped during this accident, core damage would possibly occur from a sudden loss of heat sink. If an alternative supply of feedwater were not supplied to the plant, residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer occurs. Significant loss of water from the RCS could conceivably lead to core damage. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The following provides the necessary protection against a loss of normal feedwater:

(1) Reactor trip on low-low water level in any steam generator.

15.2-24 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 (2) Two motor driven auxiliary feedwater pumps which are started on:

(a) Low-low level in any steam generator (b) Trip of both turbine driven main feedwater pumps (c) Any safety injection signal (d) Loss of offsite power (e) Manual actuation (3) One turbine driven auxiliary feedwater pump is started on:

(a) Low-low level in any two steam generators (b) Trip of both turbine driven main feedwater pumps (c) Any safety injection signal (d) Loss of offsite power (e) Manual actuation Refer to Section 10.4.9 for the design of the auxiliary feedwater system.

The motor driven auxiliary feedwater pumps are supplied by the emergency diesel generators if a loss of offsite power occurs and the turbine-driven pump utilizes steam from the secondary system. Both type pumps are designed to start and deliver full flow within one minute even if a loss of all ac power occurs simultaneously with loss of normal feedwater. The turbine exhausts the secondary steam to the atmosphere. The auxiliary feedwater pumps take suction from the condensate storage tank for delivery to the steam generators.

The analysis shows that, following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core.

15.2.8.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the LOFTRAN[5] Code is performed in order to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

Two cases are examined for a loss of normal feedwater event. The first is the case where offsite ac power is maintained, and the second is the case where offsite ac CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-25

WATTS BAR WBNP-89 power is lost, which results in reactor coolant pump coastdown as described in Section 15.2.5.2.

The case where offsite ac power is lost is limiting with respect to over-pressurization of the RCS and loss of water from the reactor core due to the decreased capability of the reactor coolant pump to aid in residual core heat removal as a result of the reactor coolant pump coastdown.

Assumptions (1) The initial steam generator water level (in all steam generators) at the time of reactor trip is at a conservatively low level.

(2) The plant is initially operating at 102% of the Nuclear Steam Supply System design rating. The heat added to the RCS by the reactor coolant pumps is assumed.

(3) The core residual heat generation is based on the 1979 version of ANS 5.1[14]

based upon long term operation at the initial power level. The decay of U-238 capture products is included as an integral part of this expression.

(4) A heat transfer coefficient in the steam generator associated with RCS natural circulation.

(5) Two motor-driven auxiliary feedwater pumps are available one minute after the accident. (Failure of the turbine-driven auxiliary feedwater pump is assumed since this failure provides minimum auxiliary feedwater flow.)

(6) Constant auxiliary feedwater flow equal to 820 gpm from the two motor-driven auxiliary feedwater pumps is delivered to four steam generators.

(7) Auxiliary feedwater temperature is 120°F.

(8) Secondary system steam relief is achieved through the self-actuated safety valves. Note that steam relief will, in fact, be through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater. However, for the sake of analysis these have been assumed unavailable.

(9) The initial reactor coolant average temperature is set conservatively higher than the nominal value since this results in a greater expansion of the RCS from pump and decay heat during the transient and, subsequently, a higher water level in the pressurizer.

(10) The initial pressurizer pressure is 46 psi higher than nominal. This 46 psi allowance is for steady-state fluctuations and measurement error.

(11) The low-low steam generator level trip setpoint is conservatively assumed to be 0.0% of narrow range span.

15.2-26 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing long term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

One such assumption is the loss of external (offsite) ac power. This assumption results in coolant flow decay down to natural circulation conditions reducing the steam generator heat transfer coefficient. Following a loss of offsite ac power, the first few seconds of a loss of normal feedwater transient will be virtually identical to the transient response (including DNBR and neutron flux versus time) presented in Section 15.3.4 for the complete loss of forced reactor coolant flow incident.

An additional assumption made for the loss of normal feedwater evaluation is that the pressurizer power-operated relief valves are assumed to function normally. If these valves were assumed not to function, the coolant system pressure during the transient would rise to the actuation point of the pressurizer safety valves (nominally 2500 psia).

The increased RCS pressure, however, results in less expansion of the coolant and hence more margin to the point where water relief from the pressurizer would occur.

Results Figures 15.2-27a through 15.2-27i show the significant plant parameter transients following a loss of normal feedwater where offsite power is lost. The calculated sequence of events for this accident are listed in Table 15.2-1.

Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. One minute following the initiation of the low-low level trip, both of the motor-driven auxiliary feedwater pumps are automatically started and are at full speed, reducing the rate of water level decrease.

The capacity of the auxiliary feedwater pumps is such that the water level in the steam generators does not recede below the lowest level at which sufficient heat transfer area is available to dissipate core residual heat without water relief from the RCS relief or safety valves.

From Figure 15.2-27g, it can be seen that at no time is there water relief from the pressurizer. If the auxiliary feed delivered is greater than that of two motor-driven pumps, if the initial reactor power is less than 102% of the NSSS design rating, or if the steam generator water level in one or more steam generators is above the low-low level trip point at the time of trip, then the results of this transient will be bounded by the analysis presented.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-27

WATTS BAR WBNP-89 The plant will slowly approach a stabilized condition at hot standby with auxiliary feedwater removing decay heat. The plant may be maintained at hot standby or further cooled through manual control of the auxiliary feed flow. The operating procedures also call for operator action to control RCS boron concentration and pressurizer level using the CVCS and to maintain steam generator level through control of the auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following reactor trip.

15.2.8.3 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system since the auxiliary feedwater capacity is such that the reactor coolant water is not relieved from the pressurizer relief or safety valves, and the water level in the steam generators receiving feedwater is maintained above the tubesheets.

15.2.9 COINCIDENT LOSS OF ONSITE AND EXTERNAL (OFFSITE) AC POWER TO THE STATION - LOSS OF OFFSITE POWER TO THE STATION AUXILIARIES A complete loss of all offsite power (no-emergency AC power) may result in the loss of all power to the plant auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system. See analysis contained in Sections 15.2.7, 15.2.8 and 15.3.4.

15.2.10 EXCESSIVE HEAT REMOVAL DUE TO FEEDWATER SYSTEM MALFUNCTIONS 15.2.10.0.1 Identification of Causes and Accident Description Additions of excessive feedwater cause increases in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower-overtemperature protection (high neutron flux, overtemperature T, and overpower T trips) prevents any power increase which could lead to a DNBR less than the limiting value.

Excessive feedwater flow could be caused by a full opening of one or more feedwater control valves due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which closes the feedwater control and isolation valves.

15.2.10.1 Analysis of Effects and Consequences Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed by the detailed digital computer code LOFTRAN[5]. This code simulates a 15.2-28 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 multi-loop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. Also, for the full-power cases, the detailed thermal and hydraulic digital computer code THINC[16,17] is used to determine if DNB occurs for the core conditions computed by LOFTRAN.

Excessive feedwater addition due to a control system malfunction or operator error which allows one or more feedwater control valves to open fully is considered. The most limiting cases are as follows:

1. a Accidental opening of one feedwater control valve with the reactor at zero load.

b Accidental opening of all feedwater control valves with the reactor at zero load.

2. a Accidental opening of one feedwater control valve with the reactor at full power.

b Accidental opening of all feedwater control valves with the reactor at full power.

The plant response following a feedwater system malfunction is calculated with the following assumptions:

(1) Reactor at zero load (a) The reactor is assumed to be just critical in the hot shutdown condition.

(b) Both automatic and manual rod control are considered for each of the zero-power cases.

(c) For case la, an increase in feedwater flow to one steam generator from zero flow to 100% of the nominal single steam generator full-load flow is assumed.

For case lb, an increase in feedwater flow to each of the four steam generators from zero flow to 89.5%, 11.2%, 11.1%, and 12.0% of nominal flow is assumed.

(d) The feedwater temperature is assumed to be at a conservatively low value of 32 °F.

(e) For case 1a, no credit is taken for the heat capacity of the steam and water in the unaffected steam generators.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-29

WATTS BAR WBNP-80 (2) Reactor at full power (a) Intial operating conditions are assumed to be at extreme values consistent with steady-state full-power operation allowing for calibration and instrument errors. This results in minimum margin to DNB at the start of the accident.

(b) Both automatic and manual rod control are considered for each of the full-power cases. The results from the most limiting scenario are presented.

(c) For case 2a, a step increase in feedwater flow to one steam generator from nominal flow to 200% of nominal flow (for one steam generator) is assumed.

For case 2b, a step increase in feedwater flow to each of the four steam generators from nominal flow to 172%, 154%, 154%, and 157% of nominal flow is assumed.

(d) For case 2a, no credit is taken for the heat capacity of the steam and water in the unaffected steam generators.

(e) The feedwater flow from a fully open control valve is terminated by the steam generator high-high signal, which closes all feedwater control and isolation valves and trips the main feedwater pumps.

(3) For both cases 1 and 2 above:

(a) The initial water level in all steam generators is at a conservatively low level for the initial conditions.

(b) No credit is taken for the heat capacity of the reactor coolant system in attenuating the resulting plant cooldown.

(c) A conservatively large moderator coefficient of reactivity that is characteristic of end-of-life core conditions is used.

Results For the cases of an accidental full opening of one or more feedwater control valves with the reactor at hot zero power (HZP) and the above mentioned assumptions, the maximum reactivity insertion rate is less than the maximum reactivity insertion rate analyzed in Section 15.2.1. Therefore, the results of the analyses are not presented.

It should be noted that if the incident occurs with the unit just critical at no load, the reactor may be tripped by the power range high neutron flux trip (low setting) set at approximately 25%.

The full-power cases (end-of-life, with automatic rod control) give the largest reactivity feedback and result in the greatest power increase. Figures 15.2-28a through 15.2-28j show the transient response for the accidental full opening of one or all four 15.2-30 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 feedwater control valves with the reactor at full power. A reactor trip is actuated when the overtemperature T setpoint is reached. A turbine trip results from the reactor trip.

The DNBR does not drop below its limiting value.

Following reactor trip and feedwater isolation, the plant will approach a stabilized condition at hot standby. Normal plant operating procedures may then be followed.

The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.

15.2.10.2 Conclusions Results show that the reactivity insertion rate which occurs at no load following excessive feedwater addition is less than the maximum value considered in the analysis of the rod withdrawal from a subcritical condition. Also, the DNBRs encountered for excessive feedwater addition at power are well above the limiting value.

15.2.11 Excessive Load Increase Incident 15.2.11.1 Identification of Causes and Accident Description An excessive load increase incident is defined as a rapid increase in the steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The RCS is designed to accommodate a 10% step load increase or a 5% per minute ramp load increase in the range of 15 to 100% of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system .

This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals; i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.

Protection against an excessive load increase accident is provided by the following RPS signals:

(1) Overpower T (2) Overtemperature T (3) Power range high neutron flux CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-31

WATTS BAR WBNP-80 15.2.11.2 Analysis of Effects and Consequences Method of Analysis This accident is analyzed using the LOFTRAN[5] Code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and feedwater system. The code computes pertinent plant variables including temperatures, pressures, and power level.

Four cases are analyzed to demonstrate the plant behavior following a 10% step load increase from rated load. These cases are as follows:

(1) Reactor control in manual at beginning-of-life.

(2) Reactor control in manual at end-of-life.

(3) Reactor control in automatic at beginning-of-life.

(4) Reactor control in automatic at end-of-life.

At beginning-of-life the core has the least negative moderator temperature coefficient of reactivity and therefore the least inherent transient capability. At end-of-life the moderator temperature coefficient of reactivity has its highest absolute value and results in the largest amount of reactivity feedback due to changes in coolant temperature. For all cases, a conservatively small value of the totally integrated Doppler reactivity was used.

A conservative limit on the turbine valve opening is assumed, and all cases are studied without credit being taken for pressurizer heaters. Initial operating conditions are assumed at extreme values consistent with the steady state full power operation allowing for calibration and instrument errors. This results in minimum margin to core DNB at the start of the accident.

Results The calculated sequence of events for this accident are listed in Table 15.2-1.

Figures 15.2-29 through 15.2-32 illustrate the transient with the reactor in the manual control mode. As expected, for the beginning-of-life case there is a slight power increase and the average core temperature shows a large decrease. This results in a DNBR which increases above its initial value. For the end-of-life manually controlled case there is a much larger increase in reactor power due to the moderator feedback.

A reduction in DNBR is experienced, but DNBR remains above the limiting value.

Figures 15.2-33 through 15.2-36 illustrate the transient assuming the reactor is in the automatic control mode. Both the beginning-of-life and the end-of-life cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. For both the beginning-of-life and end-of-life cases, the minimum DNBR remains above the limiting value.

15.2-32 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 For each case, the reactor will either reach a stabilized condition operating at a new power level, or will trip and come to a stable hot standby condition. Normal operating procedures may be followed to reduce the power level or to maintain hot standby. If the reactor has tripped, the operating procedures call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition are in a time frame in excess of ten minutes following reactor trip.

15.2.11.3 Conclusions It has been demonstrated that for an excessive load increase the minimum DNBR during the transient will not be below the limiting value.

15.2.12 ACCIDENTAL DEPRESSURIZATION OF THE REACTOR COOLANT SYSTEM 15.2.12.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the reactor coolant system are associated with an inadvertent opening of a pressurizer safety valve. Note that the event is limiting for core analysis only and is not a design basis load condition for pipe stress analysis. Initially the event results in a rapidly decreasing reactor coolant system pressure until this pressure reaches a value corresponding to the hot leg saturation pressure. At that time, the pressure decrease is slowed considerably. The pressure continues to decrease throughout the transient.

The effect of the pressure decrease would be to decrease the neutron flux via the moderator density feedback but the reactor control system (if in the automatic mode) functions to maintain the power essentially constant throughout the initial stage of the transient. The average coolant temperature decreases slowly, but the pressurizer level increases until reactor trip.

The reactor will be tripped by the following reactor protection system signals:

(1) Overtemperature T (2) Pressurizer low pressure 15.2.12.2 Analysis of Effects and Consequences Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code LOFTRAN[5]. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

In calculating the DNBR, the following conservative assumptions are made:

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-33

WATTS BAR WBNP-80 (1) Initial conditions of maximum core power and reactor coolant temperatures and minimum reactor coolant pressure (pressurizer pressure -46 psi allowance for steady-state fluctuations and measurement error) resulting in the minimum initial margin to DNB (see Section 15.1.2.2).

(2) A least negative moderator coefficient of reactivity was assumed in this analysis. The spatial effect of void due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape. The DNB evaluation is made assuming that core power peaking factors remain constant at their design values while, in fact, the effects of local or subcooled void would have the effect of flattening the power distribution (especially in hot channels) thus increasing the DNB margin.

(3) A high (absolute value) Doppler coefficient of reactivity such that the resultant amount of positive feedback is conservatively high in order to retard any power decrease due to moderator reactivity feedback.

Results Figure 15.2-37 illustrates the nuclear power transient following the accident. Reactor trip on overtemperature T occurs as shown in Figure 15.2-37. The pressure and core average temperature versus time following the accident is given in Figure 15.2-38. The resulting DNBR never goes below its limiting value as shown in Figure 15.2-39. The calculated sequence of events for this accident is listed in Table 15.2-1.

Following reactor trip, RCS pressure will continue to fall until flow through the inadvertently opened valve is terminated. Automatic actuation of the safety injection system may occur if the pressure falls to the low pressurizer pressure SI setpoint.

RCS pressure will stabilize following operator action to terminate flow to the inadvertently opened valve; normal operating procedures may then be followed. The operating procedures call for operator action to control RCS boron concentration and pressurizer level using the CVCS and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to stabilize the plant is in a time frame in excess of ten minutes following reactor trip.

15.2.12.3 Conclusions The pressurizer low pressure and the overtemperature T reactor protection system signals provide adequate protection against this accident, and the minimum DNBR remains in excess of the limiting value.

15.2.13 ACCIDENTAL DEPRESSURIZATION OF THE MAIN STEAM SYSTEM 15.2.13.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the main steam system are associated with an inadvertent opening of a single steam dump, relief or safety valve. The analyses performed assuming a rupture of a main steam line are given in Section 15.4.2.1.

15.2-34 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-91 The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the reactor coolant system causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in a reduction of core shutdown margin.

The analysis is performed using the LOFTRAN[5] and THINC[15] codes, to demonstrate that the following criterion is satisfied: there will be no consequent fuel damage after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief or safety valve, assuming a stuck rod cluster control assembly, with or without offsite power, and assuming a single failure in the Engineered Safety Features. This criterion is satisfied by verifying the DNB design basis is met.

The following systems provide the necessary protection against an accidental depressurization of the main steam system:

(1) Safety injection system actuation from any of the following:

(a) Two out of three low pressurizer pressure signals.

(b) Two out of three high containment pressure signals.

(c) Two out of three low steamline pressure signals in any (2) The overpower reactor trips (neutron flux and T and the reactor trip occurring in conjunction with receipt of the safety injection signal).

(3) Redundant isolation of the main feedwater lines. Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, a safety injection signal will rapidly close all feedwater control valves, trip the main feedwater pumps, and close the feedwater pump discharge valves (closure is accomplished by a main feedwater pump trip signal).

(4) Trip of the fast-acting steamline stop valves (main steam isolation valves)

(designed to close in less than 6 seconds) on:

(a) Two out of four high-high containment pressure signals.

(b) Two out of three low steamline pressure signals in any steamline.

(c) Two out of three high negative steamline pressure rate signals in any steamline (below Permissive P-11).

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-35

WATTS BAR WBNP-92 15.2.13.2 Analysis of Effects and Consequences Method of Analysis The following analyses of a secondary system steam release are performed for this section.

(1) A full plant digital computer simulation to determine reactor coolant system transient conditions during cooldown, and the effect of safety injection[5].

(2) Analyses to determine that there is no consequential fuel damage.

The following conditions are assumed to exist at the time of a secondary steam system release.

(1) End-of-life shutdown margin at no load, equilibrium xenon conditions, and with the most reactive rod cluster control assembly stuck in its fully withdrawn position. Operation of rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a secondary system steam release accident will not lead to a more adverse condition than the case analyzed.

(2) A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive rod cluster control assembly in the fully withdrawn position. The variation of the coefficient with temperature and pressure is included. The keff versus temperature at 1000 psi corresponding to the negative moderator temperature coefficient used is shown in Figure 15.2-40.

(3) Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the safety injection system. This corresponds to the flow delivered by one charging pump delivering its full contents to the cold leg header. The injection curve used is shown in Figure 15.4-10 and reflects injection as a function of RCS pressure versus flow including RCP seal injection, excluding centrifugal charging pump mini-flow, and with no spilling lines. This injection analysis result is bounded when using the minimum composite pump curve (degraded 5% of design head) as shown in Figure 6.3-4. Low concentration boric acid must be swept from the safety injection lines downstream of the RWST prior to the delivery of high concentration boric acid (1950 ppm) to the reactor coolant loops. This affect has been allowed for in the analysis.

(4) The case studied is a steam flow of 247 pounds per second at 1100 psia from one steam generator with offsite power available. This is the maximum capacity of any single steam dump, relief or safety valve. Initial hot shutdown conditions at time zero are assumed since this represents the most conservative initial condition.

Should the reactor be just critical or operating at power at the time of a steam release, the reactor will be tripped by the normal overpower protection when 15.2-36 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 power level reaches a trip point. Following a trip at power, the reactor coolant system contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the steam release before the no load conditions of reactor coolant system temperature and shutdown margin assumed in the analyses are reached.

After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no load condition at time zero. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the reactor coolant system cooldown are greater for steam line release occurring from no load conditions.

(5) In computing the steam flow, the Moody Curve for fl/D = 0 is used.

(6) Perfect moisture separation in the steam generator and a tube plugging level of 10% is assumed.

(7) A thermal design flowrate of 372,400 gpm is used based on the assumption of a 10% steam generator tube plugging level and instrumentation uncertainty.

Results The results presented are a conservative indication of the events which would occur assuming a secondary system steam release since it is postulated that all of the conditions described above occur simultaneously.

The time sequence for this event is shown in Table 15.2-1 where it indicates the inadvertent opening of a main steam safety or relief valve results in the pressurizer emptying at 147.0 seconds, boron reaching the core at 233.0 seconds, and criticality occurring at 300 seconds.

Figure 15.2-41 shows the transients arising as the result of a steam flow of 247 lbs/second total at 1100 psia with steam release from four steam generators. The assumed steam release is typical of the capacity of any single steam dump relief or safety valve. In this case safety injection is initiated automatically by low pressurizer pressure. Operation of one centrifugal charging pump is considered. Boron solution at 1950 ppm enters the reactor coolant system providing sufficient negative reactivity to assure no fuel damage.

The cooldown for the case shown in Figure 15.2-41 is more rapid than the case of steam release from all steam generators through one steam dump, relief, or safety valve. The transient is conservative with respect to cooldown, since no credit is taken for the energy stored in the system metal other than that of the fuel elements.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-37

WATTS BAR WBNP-90 Following blowdown of the faulted steam generator, the plant can be brought to a stabilized hot standby condition through control of auxiliary feedwater flow and safety injection flow, as described by plant operating procedures. The operating procedures call for operator action to limit RCS pressure and pressurizer level by terminating safety injection flow, and to control steam generator level and RCS coolant temperature using the auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following safety injection actuation.

15.2.13.3 Conclusions The analysis shows that the criteria stated earlier in this section are satisfied since a DNBR less than the limiting value does not exist.

15.2.14 Inadvertent Operation of Emergency Core Cooling System This analysis was performed after the boron injection tank (BIT) and associated 900 gallons of 20,000 ppm boron were deleted from the Watts Bar design basis. Therefore, the BIT is not referred to in this section.

15.2.14.1 Identification of Causes and Accident Description Spurious Emergency Core Cooling System (ECCS) operation at power could be caused by operator error or a false electrical actuating signal. Spurious actuation may be assumed to be caused by any of the following:

(1) High containment pressure (2) Low pressurizer pressure (above Permissive 11)

(3) Low steamline pressure (above Permissive 11)

(4) Manual actuation Following the actuation signal, the suction of the centrifugal charging pumps is diverted from the volume control tank to the refueling water storage tank.

The charging pumps then force concentrated (2,100* ppm) boric acid solution from the RWST, through the common injection header and injection lines and into the cold leg of each reactor coolant loop. The safety injection pumps also start automatically, but provide no flow when the reactor coolant system is at normal pressure. The passive injection system and the low head system provide no flow at normal reactor coolant system pressure.

A safety injection signal normally results in a reactor trip followed by a turbine trip.

However, it cannot be assumed that any single fault that actuates a safety injection signal will also produce a reactor trip. Therefore, two different courses of events are considered.

• Maximum RWST boric acid solution is conservative for this event analysis.

15.2-38 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-90 (1) Case A - Trip occurs at the same time spurious injection starts.

The operator should determine if the spurious signal was transient or steady state in nature. The operator must also determine if the safety injection signal should be blocked. For a spurious occurrence, the operator would stop the safety injection and maintain the plant in the hot shutdown condition. If the ECCS actuation instrumentation must be repaired, future plant operation will be in accordance with the Technical Specifications.

(2) Case B -The reactor protection system produces a trip later in the transient.

The reactor protection system does not produce an immediate trip, and the reactor experiences a negative reactivity excursion due to the injected boron causing a decrease in reactor power. The power mismatch causes a drop in primary coolant temperature and coolant shrinkage. Pressurizer pressure and level drop. Load will decrease due to the effect of reduced steam pressure on load when the turbine throttle valve is fully open. If automatic rod control is used, these effects will be lessened until the rods have moved out of the core. The transient is eventually terminated by the reactor protection system low pressure trip or by manual trip.

The time to trip is affected by initial operating conditions including core burnup history which affects initial boron concentration, rate of change of boron concentration, Doppler and moderator coefficients.

Recovery from this incident for Case B is made in the same manner described for Case A. The only difference is the lower Tavg and pressure associated with the power mismatch during the transient. The time at which reactor trip occurs is of no concern for this occurrence. At lower loads coolant contraction will be slower resulting in a longer time to trip.

15.2.14.2 Analysis of Effects and Consequences Method of Analysis The spurious operation of the safety injection system is analyzed by employing the detailed digital computer program LOFTRAN[5]. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and the effect of the safety injection system. The program computes pertinent plant variables including temperatures, pressures, and power level.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-39

WATTS BAR WBNP-90 Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. The criteria established for Condition II events include the following:

(a) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values, (b) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and (c) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

To address criterion (c), Westinghouse currently uses the more restrictive criterion that a water-solid pressurizer condition be precluded when the pressurizer is at or above the set pressure of the pressurizer safety relief valves (PSRVs). This addresses any concerns regarding subcooled water relief through the plant PSRVs which are not qualified for this condition. Should water relief through the pressurizer power-operated relief valves (PORVs) occur, the PORV block valves would be available, following the transient, to isolate the RCS.

The inadvertent ECCS actuation at power event is analyzed to determine both the minimum DNBR value and maximum pressurizer water volume. The most limiting case with respect to DNB is a minimum reactivity feedback condition with the plant assumed to be in manual rod control. Because of the power and temperature reduction during the transient, operating conditions do not approach the core limits.

For maximizing the potential for pressurizer filling, the most limiting case is a maximum reactivity feedback condition with an immediate reactor trip, and subsequent turbine trip, on the initiating SI signal. The transient results are presented for each case.

Assumptions (1) Initial Operating Conditions For the minimum DNBR case, initial conditions with maximum uncertainties on power (+2%), vessel average temperature (+6.5oF), and pressurizer pressure (-46 psi) are assumed in order to minimize the margin to the DNBR limit prior to event initiation. For the pressurizer filling case, initial conditions with maximum uncertainties on power (+2%), vessel average temperature (-

4°F), pressurizer pressure (-46 psi), and pressurizer level (+9%) are assumed in order to maximize the rate of coolant expansion and minimize the size of the steam bubble.

(2) Moderator and Doppler Coefficients of Reactivity The minimum DNBR case is evaluated at beginning of life (BOL) conditions, so a low BOL moderator temperature coefficient and a low absolute value Doppler power coefficient are assumed. For the pressurizer pressure filling 15.2-40 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-90 case, conservative maximum feedback coefficients consistent with end of life operation are assumed.

(3) Reactor Control For the minimum DNBR case (without direct reactor trip on SI), the reactor is assumed to be in manual rod control. For the pressurizer filling case, a reactor trip is assumed to occur coincident with initiation of the transient.

(4) Pressurizer Pressure Control Pressurizer heaters are assumed to be inoperable. This yields a higher rate of pressure decrease for the minimum DNBR case.

PORVs are assumed as an automatic pressure control function for both the minimum DNBR and pressurizer filling cases. For the minimum DNBR case, maintaining a low pressurizer pressure is conservative. For the pressurizer filling case, availability of the PORVs provides earlier steam relief and therefore maximizes the pressurizer insurge. If PORVs were not available, steam relief via the safety valves would eventually occur once pressurizer pressure reached the pressure at which the safety valves open. Steam relief at this later time would yield less relief prior to the time of operator action and is, therefore, less limiting than the case with PORVs available.

Pressurizer spray is assumed available to minimize pressure for the minimum DNBR case and to increase the rate of the pressurizer level increase due for the pressurizer filling case.

(5) Boron Injection At the initiation of the event, two centrifugal charging pumps inject borated water into the cold leg of each loop. In addition, flow is included to account for the potential operation of the positive displacement charging pump.

(6) Turbine Load For the minimum DNBR case (without direct reactor trip/turbine trip on SI),

the turbine load remains constant until the governor drives the throttle valve wide open. After the throttle valve is fully open, turbine load decreases as steam pressure drops. In the case of pressurizer filling, the reactor and turbine both trip at the time of SI actuation with the turbine load dropping to zero simultaneously.

(7) Reactor Trikp Reactor trip is initiated by low pressure at 1925 psia for the minimum DNBR case. The pressurizer filling case assumes an immediate reactor trip on the initiating SI signal.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-41

WATTS BAR WBNP-90 (8) Decay Heat The decay heat has no impact on the DNB case (i.e., minimum DNBR occurs prior to reactor trip). For the pressurizer filling case, the availability of decay heat and its expansion effects on the RCS liquid volume is considered. Core residual heat generation is based on the 1979 version of ANSI 5.1[14]

assuming long-term operation at the initial power level preceding the trip is assumed.

Results The transient responses for the minimum DNBR and pressurizer filling cases are shown in Figures 15.2-42a through 15.2-42f. Table 15.2-1 shows the calculated sequence of events.

Minimum DNBR Case:

Nuclear power starts decreasing immediately due to boron injection, but steam flow does not decrease until the turbine throttle valve goes wide open. The mismatch between load and nuclear power causes Tavg, pressurizer water level, and pressurizer pressure to drop. The reactor trips on low pressurizer pressure. After trip, pressures and temperatures slowly rise since the turbine is tripped and the reactor is producing some power due to delayed neutron fissions and decay heat. The DNBR remains above its initial value throughout the transient.

Pressurizer Filling Case:

Reactor trip occurs at event initiation followed by a rapid initial cooldown of the RCS.

Coolant contraction results in a short-term reduction in pressurizer pressure and water level. The combination of the RCS heatup, due to residual RCS heat generation, and ECCS injected flow causes the pressure and level transients to rapidly turn around.

Pressurizer water level then increases throughout the transient. Spray flow helps to condense the pressurizer steam bubble, causing a pressurizer insurge, and pressurizer pressure increases until the PORVs are actuated. The ECCS injection flow is terminated via operator action in accordance with the plant emergency procedures and the increase in pressurizer level stops. At no time does the pressurizer become water-solid.

Following the analyzed portion of the transient, the plant will approach a stabilized condition at hot standby; normal plant operating procedures may then be followed.

The operating procedures call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following reactor trip.

15.2.14.3 Conclusions Results of the analysis show that spurious ECCS operation without immediate reactor trip does not present any hazard to the integrity of the RCS with respect to DNBR. The 15.2-42 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-90 minimum DNBR is never less than the initial value. Thus, there will be no cladding damage and no release of fission products to the RCS. If the reactor does not trip immediately, the low pressurizer pressure reactor trip will provide protection. This trips the turbine and prevents excess cooldown, which expedites recovery from the incident.

With respect to pressurizer filling, the pressurizer will not become water-solid within 10 minutes. Termination of ECCS injection via operator action in accordance with plant emergency procedures, stops the further increase in water level, thus preventing the pressurizer from reaching a water-solid condition.

References (1) Gangloff, W. C., "An Evaluation of Anticipated Operational Transients in Westinghouse Pressurized Water Reactors," WCAP-7486-L (Proprietary),

March 1971 and WCAP-7486 (Non-Proprietary), May 1971 .

(2) "Westinghouse Anticipated Transients Without Trip Analysis," WCAP-8330, August 1974.

(3) Risher, D. H. Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-PA (Proprietary) and WCAP-8028-A (Non-Proprietary), January 1975.

(4) Hargrove, H. G., "FACTRAN, A FORTRAN IV Code for Thermal Transients in a U02 Fuel Rod," WCAP-7908-A, December 1989.

(5) Burnett, T. W. T., et. al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Non-Proprietary), April 1984.

(6) Deleted in Amendment 80.

(7) Deleted in Amendment 80.

(8) Geets, J. M., "MARVEL - A Digital Computer Code for Transient Analysis of a Multiloop PWR System," WCAP-7909, October (9) Cooper, K., et al, "Topical Report, Overpressure Protection for Westinghouse Pressurized Water Reactors," WCAP-7769 Revision 1, June 1972.

(10) Deleted by Amendment 80.

(11) Letter from T.M. Anderson (Westinghouse) to S.H. Hanauer (NRC), "ATWS Submittal," Westinghouse Letter NS-TMA-2182, dated December 30, 1979.

(12) ATWS Final Rule - Code of Federal Regulations 10 CFR 50.62 and Supplementary Information Package, "Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants."

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-43

WATTS BAR WBNP-90 (13) Morita T., et. al., "Dropped Rod Methodology for Negative Flux Rate Trip Plants," WCAP-10297-P-A (Proprietary) and WCAP-10298-A (Non-Proprietary), June 1982.

(14) "American National Standard for Decay Heat Power in Light Water Reactors,"

ANSI/ANS-5.1-1979, August 1979.

(15) Chelemer, H., Weismen, J., and Tong, L. S., "Subchannel Thermal Analysis of Rod Bundle Core (THINC III)," WCAP-7015, Revision 1, January 1969.

(16) Chelemer, H., Chu, P.T., and Hochreiter, L.E., "THINC-IV - An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956-A, February 1989.

(17) Chelemer, H., and Hochreiter, L.E., "Application of the THINC-IV Program to PWR Design," WCAP-8054-P-A (Proprietary), WCAP-8195-A (Nonproprietary), February 1989.

15.2-44 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 1 of 6)

Accident Event Time (sec.)

Uncontrolled RCCA Initiation of uncontrolled rod withdrawal 75 0 Withdrawal from a Subcritical pcm/sec reactivity insertion rate from 10-9 of Condition normal power Power range high neutron flux low setpoint 10.35 reached Peak nuclear power occurs 10.49 Rods begin to fall into core 10.85 Peak heat flux occurs 12.34 Minimum DNBR occurs 12.34 Peak clad temperature occurs 12.84 Peak average fuel temperature occurs 13.09 Uncontrolled RCCA Withdrawal at Power

1. Case A Initiation of uncontrolled RCCA withdrawal 0 at maximum reactivity insertion rate (80 pcm/sec)

Power range high neutron flux high trip point 1.4 reached Rods begin to fall into core 1.9 Minimum DNBR occurs 2.9

2. Case B Initiation of uncontrolled RCCA withdrawal 0 at a small reactivity insertion rate (3 pcm/sec)

Overtemperature T reactor trip signal 23.2 initiated Rods begin to fall into core 24.7 Minimum DNBR occurs 25.2 occurs CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-45

WATTS BAR WBNP-89 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 2 of 6)

Accident Event Time (sec.)

Uncontrolled Boron Dilution

1. Dilution During Startup Dilution begins (Unspecified)*

Reactor trip on source range high flux 0 Shutdown margin lost 1416

2. Dilution During Full Power Operation

a. Automatic Reactor Dilution begins 0 Control Shutdown margin lost 2071

b. Manual Reactor Control Dilution begins 0 Reactor trip setpoint reached for 1127 overtemperature T Rods begin to fall into core Shutdown margin lost 2071 (if dilution continues after trip)

• The results of the analysis are not impacted by the time of dilution initiation Partial Loss of Forced Reactor Coolant Flow (four loops operating, one pump coasting down) One pump begins coasting down 0 Low flow trip setpoint reached 1.29 Rods begin to drop 2.49 Minimum DNBR occurs 3.7 Startup of an Inactive Reactor Coolant Loop Initiation of pump startup 0 Power reaches high nuclear flux trip 15.5 Rods begin to drop 16.0 Minimum DNBR occurs 16.6 15.2-46 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-89 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 3 of 6)

Accident Event Time (sec.)

Loss of External Electrical Load

1. With pressurizer control (BOL) Loss of electrical load 0 High pressurizer pressure 6.2 reactor trip point reached Rods begin to drop 8.2 Minimum DNBR occurs (1)

Peak pressurizer 9.0 pressure occurs

2. With pressurizer control (EOL) Loss of electrical load 0 Low-low steam generator water level 74.5 reactor trip point reached Rods begin to drop 76.5 Minimum DNBR occurs (1)

Peak pressurizer pressure occurs 9.0 (1) DNBR does not decrease below its initial value.

3. Without pressurizer control (BOL) Loss of electrical load 0 High pressurizer pressure reactor trip point 4.7 reached Rods begin to drop 6.7 Minimum DNBR occurs (1)

Peak Pressurizer pressure occurs 7.5

4. Without pressurizer control (EOL) Loss of electrical load 0 High pressurizer pressure reactor trip point 4.7 reached Rods begin to drop 6.7 Minimum DNBR occurs (1)

Peak pressurizer pressure occurs 7.0 (1) DNBR does not decrease below its initial value.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-47

WATTS BAR WBNP-89 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 4 of 6)

Accident Event Time (sec.)

Loss of Normal Feedwater with Main feedwater flow stops 10.0 Offsite Power Available (LONF)

Low-low steam generator water level reactor trip 69.1 Rods begin to drop 71.1 Peak water level in pressurizer occurs 74.0 Four steam generators begin to receive auxiliary feed from two motor-driven auxiliary feedwater pumps 129.1 Loss of Normal Feedwater with Main Feedwater Flow Stops 10.0 Loss of Offsite Power (LOOP)

Low-low steam generator water level 69.1 reactor trip Rods begin to drop 71.1 Reactor coolant pumps begin to coastdown 73.1 Peak water level in pressurizer occurs 74.0 Four steam generators begin to receive auxiliary feed from two motor-driven auxiliary feedwater pumps 129.1 15.2-48 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 5 of 6)

Accident Event Time (sec.)

Single-Loop Feedwater One Main Feedwater Control Valve Fails 0.0 Malfunction at Hot Full Power Fully Open Overtemperature T Reactor Trip Setpoint 13.9 Reached Reactor Trip Occurs 15.4 Minimum DNBR Occurs 16.5 S/G High-High Water Level ESF Setpoint 30.6 Reached Feedwater Isolation Occurs 38.6 Multi-Loop Feedwater All Four Main Feedwater Control Valves Fail 0.0 Malfunction at Hot Full Power Fully Open Overtemperature T Reactor Trip Setpoint 14.3 Reached Reactor Trip Occurs 15.8 Minimum DNBR Occurs 17.0 S/G High-High Water Level ESF Setpoint 36.7 Reached Feedwater Isolation Occurs 44.7 Excessive Load Increase 1.Manual Reactor Control (EOL) 10% step load increase 0 Equilibrium conditions reached (approximate time only) 150 2.Manual Reactor Control (EOL) 10% step load increase 0 Equilibrium conditions reached (approximate time only) 100 3.Automatic Reactor Control (BOL) 10% step load increase 0 Equilibrium conditions reached (approximatetime only) 200 4.Automatic Reactor Control (EOL) 10% step load increased 0 Equilibrium conditions reached (approximate time only) 100 CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-49

WATTS BAR WBNP-90 Table 15.2-1 Time Sequence Of Events For Condition Ii Events (Page 6 of 6)

Accident Event Time (sec.)

Accidental Depressurization of Inadvertent opening of 0.0 the Reactor Coolant System one pressurizer safety valve OTT reactor trip setpoint reached 23.7 Rods begin to drop 25.2 Minimum DNBR occurs 26.0 Accidental Depressurization of Inadvertent opening of one main steam 0.0 the Main Steam System safety or relief valve Pressurizer empties 147.0 Boron reaches core 233.0 Criticality attained 300.0 Inadvertent Operation of ECCS During Power Operation DNBR Case: Charging pumps begin injecting borated 0.0 water; neutron flux starts decreasing Steam flow starts decreasing 64 Low pressurizer pressure reactor trip 72 setpoint reached Rods begin to drop 74 Minimum DNBR occurs (1)

Pressurizer Filling Case: Charging pumps begin injecting borated 0.0 water; reactor trip on 'S' signal; rod motion begins PORVs open 536 Operator terminates injection flow 600 Maximum pressurizer water volume occurs 611 (1)DNBR does not decrease below its initial value.

15.2-50 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-63 Table 15.2-2 Deleted by Amendment 63.

CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-51

WATTS BAR WBNP-80 Table 15.2-3 Deleted by Amendment 80 15.2-52 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 Table 15.2-4 Deleted by Amendment 80 CONDITION II - FAULTS OF MODERATE FREQUENCY 15.2-53

WATTS BAR WBNP-80 Table 15.2-5 Deleted by Amendment 80 15.2-54 CONDITION II - FAULTS OF MODERATE FREQUENCY

WATTS BAR WBNP-80 Figure 15.2-1 Uncontrolled RCCA Bank Withdrawal From Subcritical Condition II - Faults of Moderate Frequency 15.2-55

WATTS BAR 15.2-56 Condition II - Faults of Moderate Frequency Figure 15.2-2 Uncontrolled Rod Withdrawal From a Subcritical Condition Heat Flux vs Time WBNP-80

WATTS BAR Condition II - Faults of Moderate Frequency Figure 15.2-3 Uncontrolled Rod Withdrawal from a Subcritical Condition, Temperature Versus Time, Reactivity Insertion Rate Fuel Average 75 x 10-5 k/sec WBNP-80 15.2-57

WATTS BAR WBNP-80 Figure 15.2-3a Uncontrolled Rod Withdrawal from a Subcritical Condition, Clad Inner Temperature Versus Time, Reactivity Insertion Rate 75 x 10-5 k/sec 15.2-58 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-63 Figure 15.2-4 Pressurizer Pressure Transient and Nuclear Power Transient for Uncontrolled Rod Withdrawal from Full Power with Minimum Feedback and 80 PCM/SEC Withdrawal Rate Condition II - Faults of Moderate Frequency 15.2-59

WATTS BAR WBNP-70 Figure 15.2-5 Powerhouse Units 1 & 2 DNBR Transient and Vessel Tavg for Uncontrolled Rod Withdrawal from Full Power with Minimum Feedback and 80 PCM/SEC Withdrawal Rate 15.2-60 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-63 Figure 15.2-6 Pressurizer Pressure Transient and Nuclear Power Transient for Uncontrolled Rod Withdrawal from Full Power with Minimum Feedback and 3 PCM/SEC Withdrawal Rate Condition II - Faults of Moderate Frequency 15.2-61

WATTS BAR WBNP-63 Figure 15.2-7 DNBR Transient and Vessel Average Temperature Transient for Uncontrolled Rod Withdrawal from Full Power with Minimum Feedback and 3 PCM/SEC Withdrawal Rate 15.2-62 Condition II - Faults of Moderate Frequency

WATTS BAR Condition II - Faults of Moderate Frequency WBNP-63 Figure 15.2-8 Effect of Reactivity Insertion Rate on Minimum DNBR for Rod Withdrawal Accident from 100% Power 15.2-63

WATTS BAR 15.2-64 Condition II - Faults of Moderate Frequency WBNP-63 Figure 15.2-9 Effect of Reactivity Insertion Rate on Minimum DNBA for Rod Withdrawal Accident from 60% Power

WATTS BAR WBNP-63 Figure 15.2-10 Effect of Reactivity Insertion Rate on Minimum DNBR for Rod Withdrawal Accident from 10% Power Condition II - Faults of Moderate Frequency 15.2-65

WATTS BAR WBNP-63 Figure 15.2-11 Pressurizer Pressure Transient, Nuclear Power, Core Average Temperature, and Core Heat Flux Transient for Dropped RCCA Assembly 15.2-66 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-12 Reactor Vessel Flow Transient Four Pumps in Operation, One Pump Coasting Down Condition II - Faults of Moderate Frequency 15.2-67

WATTS BAR WBNP-80 Figure 15.2-13 Loop Flow Transient Four Pumps In Operation One Pump Coasting Down 15.2-68 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-14 Deleted by Amendment 89 Condition II - Faults of Moderate Frequency 15.2-69

WATTS BAR WBNP-80 Figure 15.2-15 Hot Channel Heat Flux Transient Four Pumps in Operation, One Pump Coasting Down 15.2-70 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-16 Nuclear Power Transient Four Pumps In Operation One Pump Coasting Down Condition II - Faults of Moderate Frequency 15.2-71

WATTS BAR WBNP-80 Figure 15.2-17 DNBR Versus Time Four Pumps In Operation One Pump Coasting Down 15.2-72 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-18a Startup Of An Inactive Reactor Coolant Loop Core Average Temperature Condition II - Faults of Moderate Frequency 15.2-73

WATTS BAR WBNP-80 Figure 15.2-18b Startup Of An Inactive Reactor Coolant Loop Nuclear Power 15.2-74 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-18c Startup Of An Inactive Reactor Coolant Loop DNBR Condition II - Faults of Moderate Frequency 15.2-75

WATTS BAR WBNP-80 Figure 15.2-18d Startup Of An Inactive Reactor Coolant Loop Pressurizer Pressure 15.2-76 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-18e Startup Of An Inactive Reactor Coolant Loop Core Thermal Power Condition II - Faults of Moderate Frequency 15.2-77

WATTS BAR WBNP-89 Figure 15.2-19 Loss Of Load Accident With Pressurizer Spray and Power-Operated Relief Valves, End Of Life 15.2-78 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-20 Loss Of Load Accident With Pressurizer Spray and Power-Operated Relief Valves, End-Of-Life Condition II - Faults of Moderate Frequency 15.2-79

WATTS BAR WBNP-89 Figure 15.2-21 Loss of Load Accident with Pressurizer Spray and Power-Operated Relief Valves, End-of-Life 15.2-80 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-22 Loss of Load Accident with Pressurizer Spray and Power-Operated Relief Valves, End-of-Life Condition II - Faults of Moderate Frequency 15.2-81

WATTS BAR WBNP-89 Figure 15.2-23 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life 15.2-82 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-24 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, Beginning-of-Life Condition II - Faults of Moderate Frequency 15.2-83

WATTS BAR WBNP-89 Figure 15.2-25 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life 15.2-84 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-26 Loss of Load Accident Without Pressurizer Spray and Power-Operated Relief Valves, End-of-Life Condition II - Faults of Moderate Frequency 15.2-85

WATTS BAR WBNP-89 Figure 15.2-27a Nuclear Power Transient For Loss Of Normal Feedwater 15.2-86 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-27b Core Heat Flux Transient for Loss of Normal Feedwater Condition II - Faults of Moderate Frequency 15.2-87

WATTS BAR WBNP-89 Figure 15.2-27c Flow Transient For Loss of Normal Feedwater 15.2-88 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-27d Reactor Coolant System Temperature Transient for Loss of Normal Feedwater Condition II - Faults of Moderate Frequency 15.2-89

WATTS BAR WBNP-72 Figure 15.2-27e Deleted by Amendment 72 15.2-90 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-27f Pressurizer Pressure Transient for Loss of Normal Feedwater Condition II - Faults of Moderate Frequency 15.2-91

WATTS BAR WBNP-89 Figure 15.2-27g Pressurizer Water Volume Transient for Loss of Normal Feedwater 15.2-92 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-89 Figure 15.2-27h Steam Generator Pressure Transient for Loss of Normal Feedwater Condition II - Faults of Moderate Frequency 15.2-93

WATTS BAR WBNP-89 Figure 15.2-27i Steam Generator Mass Transient for Loss of Normal Feedwater 15.2-94 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-28a Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Nuclear Power Versus Time Condition II - Faults of Moderate Frequency 15.2-95

WATTS BAR WBNP-80 Figure 15.2-28b Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Core Heat Flux Versus Time 15.2-96 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-28c Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control

- Core Average Temp Versus Time Condition II - Faults of Moderate Frequency 15.2-97

WATTS BAR WBNP-80 Figure 15.2-28d Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Pressurizer Pressure Versus Time 15.2-98 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-28e Single Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -DNBR Versus Time Condition II - Faults of Moderate Frequency 15.2-99

WATTS BAR WBNP-80 Figure 15.2-28f Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -Nuclear Power Versus Time 15.2-100 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-28g Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -Core Heat Flux Versus Time Condition II - Faults of Moderate Frequency 15.2-101

WATTS BAR WBNP-80 Figure 15.2-28h Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Core Average Temp Versus Time 15.2-102 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-28i Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control - Pressurizer Pressure Versus Time Condition II - Faults of Moderate Frequency 15.2-103

WATTS BAR WBNP-80 Figure 15.2-28j Multiple Feedwater Control Valve Malfunction, Excess Feedwater with Automatic Rod Control -DNBR Versus Time 15.2-104 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-29 Ten Percent Step Load Increase, Beginning of Life , Manual Reactor Control Condition II - Faults of Moderate Frequency 15.2-105

WATTS BAR WBNP-80 Figure 15.2-30 Ten Percent Step Load Increase, Beginning of Life, Manual Reactor Control 15.2-106 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-31 Ten Percent Step Load Increase, End of Life, Manual Reactor Control Condition II - Faults of Moderate Frequency 15.2-107

WATTS BAR WBNP-80 Figure 15.2-32 Ten Percent Step Load Increase, End of Life, Manual Reactor Control 15.2-108 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-33 Ten Percent Step Load Increase, Beginning of Life, Automatic Reactor Control Condition II - Faults of Moderate Frequency 15.2-109

WATTS BAR WBNP-80 Figure 15.2-34 Ten Percent Step Load Increase, Beginning of Life, Automatic Reactor Control 15.2-110 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-35 Ten Percent Step Load Increase, End of Life, Automatic Reactor Control Condition II - Faults of Moderate Frequency 15.2-111

WATTS BAR WBNP-80 Figure 15.2-36 Ten Percent Step Load Increase, End of Life, Automatic Reactor Control 15.2-112 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 Figure 15.2-37 Power Transient for Accidental Depressurization of the RCS Condition II - Faults of Moderate Frequency 15.2-113

WATTS BAR WBNP-63 Figure 15.2-38 Pressurizer Pressure Transient and Core Average Temperature for Accidental Depressurization of the RCS 15.2-114 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-63 Figure 15.2-39 DNBR Transient for Accidental Depressurization of the RCS Condition II - Faults of Moderate Frequency 15.2-115

WATTS BAR WBNP-53 Figure 15.2-40 Variation of Keff with Core Temperature 15.2-116 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-63 Figure 15.2-41 Transient Response for a Stearn Line Break Equivalent to 247 Ibs/second at 1100 psia with Outside Power Condition II - Faults of Moderate Frequency 15.2-117

WATTS BAR WBNP-90 Figure 15.2-42a Inadvertent Operation of Emergency Core Cooling System - Nuclear Power Response 15.2-118 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-90 Figure 15.2-42b Inadvertent Operation of Emergency Core Cooling System - Pressurizer Pressure Condition II - Faults of Moderate Frequency 15.2-119

WATTS BAR WBNP-90 Figure 15.2-42c Inadvertent Operation of Emergency Core Cooling System - Pressurizer Water Volume 15.2-120 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-90 Figure 15.2-42d Inadvertent Operation of Emergency Core Cooling System - Core Average Temperature Condition II - Faults of Moderate Frequency 15.2-121

WATTS BAR WBNP-90 Figure 15.2-42e Inadvertent Operation of Emergency Core Response Cooling System - DNB Ratio 15.2-122 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-90 Figure 15.2-42f Inadvertent Operation of Emergency Core Cooling System - Steam Flow Response Condition II - Faults of Moderate Frequency 15.2-123

WATTS BAR WBNP-90 Figure 15.2-43a Deleted 15.2-124 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-90 Figure 15.2-43b Deleted Condition II - Faults of Moderate Frequency 15.2-125

WATTS BAR WBNP-90 THIS PAGE INTENTIONALLY BLANK 15.2-126 Condition II - Faults of Moderate Frequency

WATTS BAR WBNP-80 15.3 CONDITION III - INFREQUENT FAULTS By definition Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the RCS or containment barriers. For the purposes of this report the following faults have been grouped into this category:

(1) Loss of reactor coolant, from small ruptured pipes or from cracks in large pipes, which actuates the ECCS.

(2) Minor secondary system pipe breaks.

(3) Inadvertent loading of a fuel assembly into an improper position.

(4) Complete loss of forced reactor coolant flow.

(5) Waste gas decay tank rupture.

(6) Single rod cluster control assembly withdrawal at full power.

15.3.1 Loss of Reactor Coolant From Small Ruptured Pipes or From Cracks in Large Pipes Which Actuate the Emergency Core Cooling System 15.3.1.1 Identification of Causes and Accident Description A LOCA is defined as the loss of reactor coolant at a rate in excess of the reactor coolant normal makeup rate from breaks or openings in the RCPB inside primary containment up to, and including, a break equivalent in size to the largest justified pipe rupture (or in the absence of justification, a double-ended rupture of the largest pipe) in the reactor coolant pressure boundary (RCPB)(ANSI/ANS-51.1-1983). See Section 3.6 for a more detailed description of the loss of reactor coolant accident boundary limits. Ruptures of small cross section will cause expulsion of the coolant at a rate which can be accommodated by the charging pumps which would maintain an operational water level in the pressurizer, permitting the operator to execute an orderly shutdown. The coolant which would be released to the containment contains the existing fission products.

The maximum break size for which the normal makeup system can maintain the pressurizer level is obtained by comparing the calculated flow from the RCS through the postulated break against the charging pump makeup flow at normal RCS pressure, i.e., 2250 psia. A makeup flow rate from one centrifugal charging pump is typically adequate to sustain pressurizer level at 2250 psia for a break through a 0.375 inch diameter hole. This break results in a loss of approximately 17.5 lb/sec.

CONDITION III - INFREQUENT FAULTS 15.3-1

WATTS BAR WBNP-80 Should a larger break occur, depressurization of the RCS causes fluid to flow to the RCS from the pressurizer, resulting in a pressure and level decrease in the pressurizer.

A reactor trip occurs when the pressurizer low pressure trip setpoint is reached. The safety injection system is actuated when the appropriate pressure setpoint is reached.

The consequences of the accident are limited in two ways:

(1) Reactor trip and borated water injection complement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay.

(2) Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs, the plant is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from decay, hot internals and the vessel continues to be transferred to the reactor coolant. The heat transfer between the RCS and the secondary system may be in either direction, depending on the relative temperatures. In the case of continued heat addition to the secondary system, pressure increases, and steam dump may occur.

Makeup to the secondary side is automatically provided by the auxiliary feedwater pumps. The reactor trip signal coincident with low Tavg signal (with assumed coincident loss of offsite power), stops normal feedwater flow by closing the main feedwater isolation valves and flow control valves. The secondary flow aids in the reduction of RCS pressure.

When the RCS depressurizes to the cold leg accumulator tank pressure, the accumulators begin to inject water into the reactor coolant loops. The reactor coolant pumps are assumed to be tripped concurrent with the reactor trip, and effects of pump coastdown are included in the blowdown analyses.

15.3.1.2 Analysis of Effects and Consequences Method of Analysis For breaks less than 1.0 ft2, the NOTRUMP[2] digital computer code is employed to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow through the break.

Small Break LOCA Analysis Using NOTRUMP The NOTRUMP computer code is used in the analysis of loss-of-coolant accidents due to small breaks in the reactor coolant system. The NOTRUMP computer code is a state-of-the-art one-dimensional general network code consisting of a number of advanced features. Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes, and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the 15.3-2 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-89 NRC concerns expressed in NUREG-0611, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse Designed Operating Plants."

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly with the intact loops lumped into a second loop. The transient behavior of the system is determined from the governing conservation equation of mass, energy, and momentum applied throughout the system. A detailed description of NOTRUMP is given in References [1] and [2].

The use of NOTRUMP in the analysis involves, among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components.

In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant transient.

Cladding thermal analyses are performed with the LOCTA-IV[3] code which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from the NOTRUMP hydraulic calculations as input.

A schematic representation of the computer code interfaces is given in Figure 15.3-1.

The small break analysis was performed with the approved Westinghouse ECCS Small Break Evaluation Model[1,2,3].

Safety injection flow rate to the RCS as a function of system pressure is an input parameter. The SIS is assumed to begin delivering full flow to the RCS 30 seconds after the generation of a safety injection signal.

Also, minimum safeguards ECCS capability and operability has been assumed in these analyses including conservative assumptions with regard to spillage of ECCS water from broken lines.

Hydraulic transient analyses are performed with the NOTRUMP code which determines the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core and mixture height history. The core thermal transient is performed with the LOCTA-IV[3] code. Both calculations assume the core is operating at 102%

of licensed power.

15.3.1.3 Reactor Coolant System Pipe Break Results A spectrum of break sizes was analyzed to determine the limiting break size in terms of the highest peak cladding temperature. These break sizes were 3, 4, and 6 inches.

For all cases reported, during the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as they are coasting down following reactor trip.

Therefore, upward flow through the core is maintained.

CONDITION III - INFREQUENT FAULTS 15.3-3

WATTS BAR WBNP-89 The resultant heat transfer cools the fuel rod cladding to very near the coolant temperatures as long as the core remains covered by a two-phase mixture. When the mixture level drops below the top of the core, the steam flow computed with NOTRUMP provides cooling to the upper portion of the core.

The typical core power (dimensionless) transient following the accident (relative) to reactor scram time is shown in Figure 15.3-9. Also shown is the typical hot rod axial power shape in Figure 15.3-10.

The reactor scram delay time is equal to the reactor trip signal time plus control rod insertion time, or a total of 4.7 seconds. During this delay period, the reactor is conservatively assumed to continue to operate at the initial rated power level.

The safety injection flow is depicted in Figure 15.3-2 as a function of RCS pressure.

Auxiliary feedwater flow is 1050 gpm based on the operation of one motor-driven and the turbine-driven auxiliary feedwater pump, each delivering to two steam generators.

The 30 second delay time includes the time for diesel generator startup, loading on the 6.9 kV shutdown board, and sequential loading of the centrifugal charging and safety injection pumps onto the emergency buses, with acceleration to full speed and capability for injection. Although included in the 30 second delay, the effect of the residual heat removal pump flow is not a factor in this analysis since their shutoff head is lower than RCS pressure during the time period for this transient.

The 4-inch break was determined to be the limiting break size, with a peak cladding temperature of 1452°F. The transient results for the limiting 4-inch break are presented in Figures 15.3-3 to 15.3-8. The depressurization transient for the 4-inch break is shown in Figure 15.3-3. The extent to which the core is uncovered is shown in Figure 15.3-4. The peak cladding temperature transient is shown in Figure 15.3-5.

The steam flow rate for this break is shown in Figure 15.3-6. The heat transfer coefficients for the rod for this phase of the transient are given in Figure 15.3-7, and the hot spot fluid temperature is shown in Figure 15.3-8.

The comparable transient results for the 3-inch break are presented in Figures 15.3-11 to 15.3-11e and for the 6-inch break in Figures 15.3-12 to 15.3-12e.

It should be noted that all small break sizes presented here result in calculated peak cladding temperatures less than those calculated for large breaks (Section 15.4.1).

15.3.1.4 Conclusions - Thermal Analysis For cases considered, the emergency core cooling system meets the acceptance criteria as presented in 10 CFR 50.46. That is:

(1) The calculated peak fuel element cladding temperature provides margin to the limit of 2200°F, based on an Fq value of 2.40.

(2) The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1% of the total amount of zircaloy in the reactor.

15.3-4 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-80 (3) The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. The oxidation limit of 17% of the cladding thickness is not exceeded during or after quenching.

(4) The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.

The time sequence of events is shown in Table 15.3-1. Table 15.3-2 summarizes the results of these analyses.

15.3.2 Minor Secondary System Pipe Breaks 15.3.2.1 Identification of Causes and Accident Description Included in this grouping are ruptures of secondary system lines which would result in steam release rates equivalent to a 6 inch diameter break or smaller.

15.3.2.2 Analysis of Effects and Consequences Minor secondary system pipe breaks must be accommodated with the failure of only a small fraction of the fuel elements in the reactor. Since the results of analysis presented in Section 15.4.2 for a major secondary system pipe rupture also meet this criteria, separate analysis for minor secondary system pipe breaks is not required.

The analysis of the more probable accidental opening of a secondary system steam dump, relief or safety valve is presented in Section 15.2.13. These analyses are illustrative of a pipe break equivalent in size to a single valve opening.

15.3.2.3 Conclusions The analyses presented in Section 15.4.2 demonstrate that the consequences of a minor secondary system pipe break are acceptable since a DNBR of less than the limiting value does not occur even for a more critical major secondary system pipe break.

15.3.3 Inadvertent Loading of a Fuel Assembly Into an Improper Position 15.3.3.1 Identification of Causes and Accident Description Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct CONDITION III - INFREQUENT FAULTS 15.3-5

WATTS BAR WBNP-80 enrichments. There is a 5% uncertainty margin included in the design value of power peaking factor assumed in the analysis of Condition I and Condition II transients. The incore system of moveable flux detectors which is used to verify power shapes at the start of life is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading the identification number is checked before each assembly is moved into the core. Serial numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placing after the loading is completed.

In addition to the flux monitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise.

15.3.3.2 Analysis of Effects and Consequences Method Of Analysis Steady-state power distributions in the x-y plane of the core are calculated by the TURTLE[6] Code based on macroscopic cross section calculated by the LEOPARD[7]

Code. A discrete representation is used wherein each individual fuel rod is described by a mesh interval. The power distributions in the x-y plane for a correctly loaded core assembly are also given in Chapter 4 based on enrichments given in that section.

For each core loading error case analyzed, the percent deviations from detector readings for a normally loaded core are shown at all incore detector locations (see Figures 15.3-15 to 15.3-19, inclusive).

Results The following core loading error cases have been analyzed.

Case A:

Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case considered was the interchange of two adjacent assemblies near the periphery of the core (see Figure 15.3-15).

Case B:

Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly. Two analyses have been performed for this case (see Figures 15.3-16 and 15.3-17).

In Case B-1, the interchange is assumed to take place with the burnable poison rods transferred with the Region 2 assembly mistakenly loaded into Region 1.

15.3-6 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-80 In Case B-2, the interchange is assumed to take place closer to core center and with burnable poison rods located in the correct Region 2 position but in a Region 1 assembly mistakenly loaded into the Region 2 position.

Case C:

Enrichment error: Case in which a Region 2 fuel assembly is loaded in the core central position (see Figure 15.3-18).

Case D:

Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core periphery (see Figure 15.3-19).

15.3.3.3 Conclusions Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins.

Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

15.3.4 Complete Loss of Forced Reactor Coolant Flow 15.3.4.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps (RCPs). If the reactor is at power at the time of the accident, the immediate effect of loss of forced reactor coolant flow is a rapid increase in the reactor coolant temperature and subsequent increase in reactor coolant pressure. The flow reduction and increase in coolant temperature could eventually result in DNB and subsequent fuel damage before the peak pressures exceed the values at which the integrity of the pressure boundaries would be jeopardized unless the reactor was tripped promptly.

Normal power for the reactor coolant pumps is supplied through individual buses from a transformer connected to the generator. When generator trip occurs, the buses are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to provide forced coolant flow to the core. Following a turbine trip where there are no electrical faults or a thrust bearing failure which requires tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the CONDITION III - INFREQUENT FAULTS 15.3-7

WATTS BAR WBNP-89 generator thus ensuring full flow for 30 seconds after the reactor trip before any transfer is made.

The following reactor trips provide the necessary protection against a loss of coolant flow accident:

(1) Reactor coolant pump power supply undervoltage or underfrequency.

(2) Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of power supply to all reactor coolant pumps. This function is blocked below the approximately 10% power (Permissive 7) interlock setpoint to permit startup.

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid. This function is also blocked below the approximately 10% power (Permissive 7) interlock setpoint to permit startup.

Reference [8] provides analyses of grid frequency disturbances and the resulting Nuclear Steam Supply System protection requirements which are applicable to current generation Westinghouse plants.

These analyses have shown that the reactor is adequately protected by the underfrequency reactor trip such that DNB will be above the limiting value for grid frequency decay rates less than 6.8 Hz/sec based on a trip setpoint of approximately 57 Hz. In addition, for a maximum frequency decay rate of 5 Hz/sec, the selected trip setpoint would have to be at least 54.3 Hz. The sensing relay connected to the load side of each RCP breaker for WBN is set at approximately 57 Hz (see Section 7.2.1.1.2 paragraph 4c). A grid analysis has been provided which determined that for the worst case the maximum system frequency decay rate is less than 5 Hz/sec.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above approximately 48%

power (Permissive 8), low flow in any loop will actuate a reactor trip. Between approximately 10% power and 48% power (Permissive 7 and Permissive 8), low flow in any two loops will actuate a reactor trip.

The effect of low loop flow trip protection alone relative to frequency decay rate, although not the primary trip function taken credit for in WBN's design, is also addressed in Reference [8].

15.3.4.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by three digital computer codes. The LOFTRAN[9] Code is used to calculate the loop flow, core flow, the time of reactor trip, the nuclear power 15.3-8 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-86 transient, and the primary system pressure and coolant temperature transients. The FACTRAN[10] Code is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN. Finally, the THINC[13,14] Code (see Section 4.4.3.4) is used to calculate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.2, except that following the loss of supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency.

Results The calculated sequence of events for the case analyzed is shown on Table 15.3-3.

The reactor is assumed to trip on an undervoltage signal. Figures 15.3-20 and 15.3-22 through 15.3-25 show the transient response for the loss of power to all reactor coolant pumps. The DNBR never goes below the design basis limit.

The most limiting statepoint occurred for the complete loss of flow under- frequency case for the DNB transient. The DNB evaluation showed that the minimum DNBR remained above the limiting value. Figure 15.3-26 provides the axial power shape modeled for the statepoint evaluation of the complete loss of flow analysis (also partial loss of flow analysis as presented in Section 15.2.5). The calculated peak RCS pressure is 2449 psia, demonstrating that the RCS remains below 110% of design pressure.

Following reactor trip, the pumps will continue to coast down until natural circulation flow is established and will approach a stabilized hot standby condition as shown in Section 15.2.8. The operating procedures call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following reactor trip.

15.3.4.3 Conclusions The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNBR will not decrease below the design basis limit at any time during the transient.

15.3.5 Waste Gas Decay Tank Rupture 15.3.5.1 Identification of Causes and Accident Description The gaseous waste processing system, as discussed in Section 11.3, is designed to remove fission product gases from the reactor coolant. The system consists of a closed loop with waste gas compressors, hydrogen recombiners, waste gas decay tanks for service at power and other waste gas decay tanks for service at shutdown and startup.

CONDITION III - INFREQUENT FAULTS 15.3-9

WATTS BAR WBNP-89 The maximum amount of waste gases stored occurs after a refueling shutdown at which time the gas decay tanks store the radioactive gases stripped from the reactor coolant.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste decay tank as a consequence of a failure of a single gas decay tank or associated piping.

15.3.5.2 Analysis of Effects and Consequences For the analyses and consequences of the postulated waste gas decay tank rupture, please refer to Section 15.5.2.

15.3.6 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.3.6.1 Identification of Causes and Accident Description The current WBN design basis for the single rod cluster control assembly (RCCA) withdrawal at full power event assumes no single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions in the assemblies in the bank. The urgent failure alarm also inhibits automatic rod withdrawal. Withdrawal of a single RCCA by operator action would result in activation of the same alarm and the same visual indications.

Each bank of RCCAs in the system is divided into two groups of 4 mechanisms each (except group 2 of bank D which consists of 5 mechanisms). The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite sequence of actuation of the stationary gripper, movable gripper, and lift coils of a mechanism is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.

In the unlikely event of multiple failures which result in continuous withdrawal of a single RCCA, it is not possible, in all cases, to provide assurance of automatic reactor trip such that DNB safety limits are not violated. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area associated with the RCCA.

15.3-10 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-80 15.3.6.2 Analysis of Effects and Consequences Method of Analysis Power distributions within the core are calculated by the TURTLE[6] Code based on macroscopic cross sections generated by LEOPARD[7]. The peaking factors calculated by TURTLE are then used by THINC[11] to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to occur at beginning-of-life since this results in the minimum value of moderator temperature coefficient. This maximizes the power rise and minimizes the tendency of increased moderator temperature to flatten the power distribution.

Results Two cases have been considered as follows:

(1) If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the failed RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.2.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNB ratio from falling below the limiting value. Evaluation of this case at the power and coolant conditions at which the overtemperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the limiting value is 5%.

(2) 2.If the reactor is in automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case 1 described above. For such cases as above, a trip will ultimately ensue, although not sufficiently fast in all cases to prevent the minimum DNBR in the core from decreasing below the limiting value.

Following reactor trip, the plant will approach a stabilized condition at hot standby; normal plant operating procedures may then be followed. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.

15.3.6.3 Conclusions For the case of one RCCA fully withdrawn, with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an CONDITION III - INFREQUENT FAULTS 15.3-11

WATTS BAR WBNP-89 upper bound of the number of fuel rods experiencing DNBR at values less than the limiting value is 5% of the total fuel rods in the core.

For both cases discussed, the indicators and alarms mentioned would function to alert the operator to the malfunction. For case 1, the insertion limit alarms (low and low-low alarms) would also serve to alert the operator.

It is to be additionally noted that the current analysis methodology for the bank withdrawal at power uses point-kinetics and one-dimensional kinetics transient models, respectively. These models use conservative constant reactivity feedback assumptions which result in an overly conservative prediction of the core response for these events.

The accidental withdrawal of a bank or banks of RCCAs in the normal overlap mode is a transient which has been specifically considered in the safety analysis. The consequences of a bank withdrawal accident meet Condition II criteria (no DNB). If, however, it is assumed that less than a full group or bank of control rods is withdrawn, and these rods are not symmetrically located around the core, this then can cause a "tilt" in the core radial power distribution. The "tilt" could result in a radial power distribution peaking factor which is more severe than is normally considered in the safety analysis, and therefore cause a loss of DNB margin.

A more detailed DNBR analysis addressing the limiting transient setpoints has been conducted (References 11 and 12) and the Revised Thermal Design Procedure (RTDP) maximizes DNBR margins and determines setpoints that are conservatively low when compared to previous results.

Using these approaches, generic analyses and their plant-specific application demonstrate that for WBN DNB does not occur for the worst-case asymmetric rod withdrawal, and the licensing basis for the facility with regard to the requirements for system response to a single failure in the rod control system (GDC-25 or equivalent) is still satisfied.

REFERENCES (1) Lee, N., Rupprecht, S. D., Tauch, W. D., and Schwartz, W. R.,

"Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," WCAP-10054-P-A, August 1985.

(2) Meyer, P. E. and Kornfilt, J., "NOTRUMP: A Nodal Transient Small Break and General Network Code," WCAP-10079-P-A, August 1985.

(3) F. M. Bordelon, et. al., "LOCTA-IV Program: Loss-of-Coolant Transient Analysis," WCAP-8305 (Non-Proprietary) and WCAP-8301 (Proprietary),

June 1974.

(4) Deleted by Amendment 63.

(5) Deleted by Amendment 63.

15.3-12 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-89 (6) Barry, R. F. and Altomare, S. "The TURTLE 24.0 Diffussion Depletion Code,"

WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary),

January 1975.

(7) Barry, F. R., "LEOPARD, A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963.

(8) Balwin, M. S., Merrian, M. M., Schenkel, H. S., and Vandewalle, D. J., "An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in Westinghouse PWRs," WCAP-8424, Revision 1, June 1975.

(9) Burnett, T. W. T, et.al., "LOFTRAN Code Description", WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Non-Proprietary), April 1984.

(10) Hargrove, H. G., "FACTRAN, A FORTRAN IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

(11) Friedland, A. J., and Ray, S., "Improved THINC IV Modeling for PWR Core Design," WCAP-12330-P, August 1989.

(12) Huegel, D., et al., "Generic Assessment of Asymmetric Rod Cluster Control Assembly Withdrawal," WCAP-13803, August 1993.

(13) Chelemer, H., Chu, P.T., and Hochreiter, L.E., "THINC-IV - An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956-A, February 1989.

(14) Chelemer, H., and Hochreiter, L.E., "Application of the THINC-IV Program to PWR Design," WCAP-8054-P-A (Proprietary), WCAP-8195-A (Nonproprietary), February 1989.

CONDITION III - INFREQUENT FAULTS 15.3-13

WATTS BAR WBNP-89 Table 15.3-1 Small Break Loca Analysis Time Sequence Of Events Event Time (seconds)

Break Size: 3 inch 4 inch 6 inch Break initiation 0.0 0.0 0.0 Reactor trip signal 20.7 11.9 6.4 Safety injection signal 30.2 20.5 13.1 Top of core uncovery 985 535 289 Accumulator injection begins 2197 816 375 Peak cladding temperature occurs 1733 956 444 Top of core recovered 2618 1734 477 15.3-14 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-89 Table 15.3-2 Small Break Loca Analysis Summary Of Results Parameter Value Break Size: 3-inch 4-inch 6-inch Peak cladding temperature (°F) 1303 1452 911 Elevation (ft) 11.50 11.50 10.50 Max. local Zr-H2O reaction (%) 0.224 0.370 0.002 Elevation (ft) 11.50 11.25 10.75 Total Zr-H2O reaction (%) <1 <1 <1 Hot rod burst time (sec) N/A N/A N/A Boundary Condition Assumptions NSS power 102% of 3411 MW Core power (rod heatup analysis) 102% of 3411 MW Peak linear power 12.77 kW/ft(1)

Cold leg accumulators:

Water volume (each) 1050 ft3 Pressure 600 psia (1)

The hot rod linear power shape used for this analysis is shown in Figure 15.3-10. The peak linear power of 12.77 kW/ft corresponds to FQ = 2.30 at that elevation. The value of FQ = 2.30 at the peak linear power elevation was determined from the normalized FQ as a function of core height (Figure 4.3-21), where normalized FQ = 1.0 corresponds to the peak FQ = 2.40.

CONDITION III - INFREQUENT FAULTS 15.3-15

WATTS BAR WBNP-80 Table 15.3-3 Time Sequence Of Events For Condition Iii Events Accident Event Time (seconds)

Complete Loss of Forced Reactor Coolant Flow Undervoltage 1.All pumps in operation, all pumps coasting down All operating pumps lose 0

power (due to undervoltage event) and begin coasting down Rods begin to drop 1.5 Minimum DNBR occurs 3.4 Underfrequency 2.All pumps in operation, all All operating pumps 0 pumps decelerating lose power (due to underfrequency event) and begin coasting down Rods begin to drop 1.24 Minimum DNBR occurs 3.50 15.3-16 CONDITION III - INFREQUENT FAULTS

WATTS BAR WBNP-63 Figure 15.3-1 Code Interface Description for Small Break Model Condition III - Infrequent Faults 15.3-17

WATTS BAR WBNP-89 Figure 15.3-2 Pumped Safety Injection Flowrate vs. RCS Pressure 15.3-18 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-3 Reactor Coolant System Pressure for the 4-Inch Break Condition III - Infrequent Faults 15.3-19

WATTS BAR WBNP-89 Figure 15.3-4 Core Mixture Level Transient for the 4-Inch Break 15.3-20 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-5 Clad Temperature Transient at Peak Temperature Elevation for 4-Inch Break Condition III - Infrequent Faults 15.3-21

WATTS BAR WBNP-89 Figure 15.3-6 Core Outlet Steam Flow Rate for 4-Inch Break 15.3-22 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-7 Clad Surface Heat Transfer Coefficient at Peak Temperature Elevation for 4-Inch Break Condition III - Infrequent Faults 15.3-23

WATTS BAR WBNP-89 Figure 15.3-8 Fluid Temperature at Peak Clad Temperature Elevation for 4-Inch Break 15.3-24 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8b Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-25

WATTS BAR WBNP-89 Figure 15.3-8c Deleted by Amendment 89 15.3-26 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8d Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-27

WATTS BAR WBNP-89 Figure 15.3-8e Deleted by Amendment 89 15.3-28 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8f Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-29

WATTS BAR WBNP-89 Figure 15.3-8g Deleted by Amendment 89 15.3-30 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8h Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-31

WATTS BAR WBNP-89 Figure 15.3-8i Deleted by Amendment 89 15.3-32 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8j Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-33

WATTS BAR WBNP-89 Figure 15.3-8k Deleted by Amendment 89 15.3-34 Condition III - Infrequent Faults

WATTS BAR WBNP-89

\

Figure 15.3-8l Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-35

WATTS BAR WBNP-89 Figure 15.3-8m Deleted by Amendment 89 15.3-36 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-8n Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-37

WATTS BAR WBNP-63 Figure 15.3-9 Core Power Transient 15.3-38 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-10 Hot Rod Axial Power Shape Condition III - Infrequent Faults 15.3-39

WATTS BAR WBNP-89 THIS PAGE INTENTIONALLY BLANK 15.3-40 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-11 Reactor Coolant System Pressure for 3-Inch Break Condition III - Infrequent Faults 15.3-41

WATTS BAR WBNP-89 Figure 15.3-11a Core Mixture Level Transient for 3-inch Break 15.3-42 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-11b Clad Temperature Transient at Peak Temperature Elevation for 3-Inch Break Condition III - Infrequent Faults 15.3-43

WATTS BAR WBNP-89 Figure 15.3-11c Core Outlet Steam Flow Rate for 3-Inch Break 15.3-44 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-11d Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation for 3-Inch Break Condition III - Infrequent Faults 15.3-45

WATTS BAR WBNP-89 Figure 15.3-11e Fluid Temperature at Peak Clad Temperature Elevation for 3-Inch Break 15.3-46 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-12 Reactor Coolant System Pressure for 6-Inch Break Condition III - Infrequent Faults 15.3-47

WATTS BAR WBNP-89 Figure 15.3-12a Core Mixture Level Transient for 6-Inch Break 15.3-48 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-12b Clad Temperature Transient at Peak Temperature Elevation for 6-Inch Break Condition III - Infrequent Faults 15.3-49

WATTS BAR WBNP-89 Figure 15.3-12c Core Outlet Steam Flow Rate for 6-Inch Break 15.3-50 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-12d Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation for 6-Inch Break Condition III - Infrequent Faults 15.3-51

WATTS BAR WBNP-89 Figure 15.3-12e Fluid Temperature at Peak Clad Temperature Elevation for 6-Inch Break 15.3-52 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-13a Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-53

WATTS BAR WBNP-89 Figure 15.3-14a Deleted by Amendment 89 15.3-54 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-14b Deleted by Amendment 89 Condition III - Infrequent Faults 15.3-55

WATTS BAR WBNP-89 Figure 15.3-15 Interchange Between Region 1 and Region 3 Assembly 15.3-56 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-16 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly Condition III - Infrequent Faults 15.3-57

WATTS BAR WBNP-89 Figure 15.3-17 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Transferred to the Region 1 Assembly 15.3-58 Condition III - Infrequent Faults

WATTS BAR WBNP-89 Figure 15.3-18 Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position Condition III - Infrequent Faults 15.3-59

WATTS BAR WBNP-89 Figure 15.3-19 Loading a Region 2 Assembly into a Region 1 Position Near Core Periphery 15.3-60 Condition III - Infrequent Faults

WATTS BAR WBNP-80 Figure 15.3-20 Total RCS Flow-Complete Loss of Flow - Undervoltage Four Pumps in Operation, Four Pumps Coasting Down Condition III - Infrequent Faults 15.3-61

WATTS BAR WBNP-80 Figure 15.3-21 Deleted by Amendment 80 15.3-62 Condition III - Infrequent Faults

WATTS BAR WBNP-80 Figure 15.3-22 Loop 1 Flow Complete Loss of Flow - Undervoltage - Four Pumps in Operation, Four Pumps Coasting Down Condition III - Infrequent Faults 15.3-63

WATTS BAR WBNP-80 Figure 15.3-23 Hot Channel Heat Flux Transient; Four Pumps in Operation, Four Pumps Coasting Down 15.3-64 Condition III - Infrequent Faults

WATTS BAR WBNP-80 Figure 15.3-24 Nuclear Power Transient; Four Pumps in Operation, Four Pumps Coasting Down Condition III - Infrequent Faults 15.3-65

WATTS BAR WBNP-80 Figure 15.3-25 DNBR Versus Time Four Pumps in Operation, Four Pumps Coasting Down 15.3-66 Condition III - Infrequent Faults

WATTS BAR WBNP-80 Figure 15.3-26 Loss of Forced Reactor Coolant Flow (Partial and Complete) -Axial Power Shape Condition III - Infrequent Faults 15.3-67

WATTS BAR WBNP-80 THIS PAGE INTENTIONALLY BLANK 15.3-68 Condition III - Infrequent Faults

WATTS BAR WBNP-80 15.4 CONDITION IV - LIMITING FAULTS Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10 CFR Part 100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the emergency core cooling system (ECCS) and the containment. For the purposes of this report the following faults have been classified in this category:

(1) Major rupture of pipes containing reactor coolant up to and including double ended rupture of the largest pipe in the reactor coolant system (loss of coolant accident).

(2) Major secondary system pipe ruptures.

(3) Steam generator tube rupture.

(4) Single reactor coolant pump locked rotor.

(5) Fuel handling accident.

(6) Rupture of a control rod drive mechanism housing (rod cluster control assembly ejection).

The analysis of thyroid and whole body doses, resulting from events leading to fission product release, appears in Section 15.5. The fission product inventories which form a basis for these calculations are presented in Chapter 11 and Section 15.1. Section 15.5 also includes the discussion of systems interdependency contributing to limiting fission product leakages from the containment following a Condition IV occurrence.

15.4.1 Major Reactor Coolant System Pipe Ruptures (Loss of Coolant Accident)

Loss-of-coolant accidents (LOCAs) are accidents that would result from the loss of reactor coolant at a rate in excess of the capability of the reactor coolant makeup system. LOCAs could occur from breaks in pipes in the reactor coolant pressure boundary up to and including a break equivalent in size to the double-ended rupture of the largest pipe in the reactor coolant system (RCS). Large breaks are defined as breaks in the reactor coolant pressure boundary having a cross-sectional area greater than or equal to 1.0 ft2. Reference [34] documents this criterion. The large break LOCA analysis is performed to demonstrate compliance with the 10 CFR 50.46 acceptance criteria[35] for emergency core cooling systems for light water nuclear power reactors.

A large break LOCA is the postulated double-ended guillotine or split rupture of one of the RCS primary coolant pipes. Reference [36] analyses have shown the limiting CONDITION IV - LIMITING FAULTS 15.4-1

WATTS BAR WBNP-80 break to be the double-ended guillotine severance of the cold leg piping between the reactor coolant pump (RCP) and the reactor vessel. A large break LOCA will cause a rapid depressurization of the RCS in approximately 30 seconds with a nearly complete loss of system inventory. Accumulators, as well as pumped safety injection (SI) when it is initiated, combine to refill the lower plenum and downcomer. Large amounts of steam and entrained liquid are generated as the incoming ECCS water reaches the fuel. The resulting steam cooling at the upper core elevations terminates the fuel cladding temperature excursion.

The cold leg break is analyzed since this break location has been shown to cause the most severe core uncovery.

The boundary considered for loss of coolant accidents is the RCS or any line connected to the system up to the first closed valve.

Should a major break occur, depressurization of the reactor coolant system results in a pressure decrease in the pressurizer. Reactor trip signal occurs when the pressurizer low pressure trip setpoint is reached. A safety injection signal is actuated when the appropriate setpoint is reached. These countermeasures will limit the consequences of the accident in two ways:

(1) Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat.

(2) Injection of borated water provides heat transfer from core and prevents excessive clad temperature.

At the beginning of the blowdown phase, the entire reactor coolant system contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. After the break develops, the time to departure from nucleate boiling is calculated, consistent with Appendix K of 10 CFR 50. Thereafter the core heat transfer is based on local conditions with transition boiling and forced convection to steam as the major heat transfer mechanism.

When the reactor coolant system pressure falls below approximately 600 psia, the cold leg accumulators begin to inject borated water. The conservative assumption is made that accumulator water injected bypasses the core and goes out through the break until the termination of bypass. This conservatism is again consistent with Appendix K of 10 CFR 50.

Furthermore, no credit is taken for the boration of the injected water in shutting down the reactor. Instead, it is shutdown because of the negative reactivity added due to voiding in the core.

15.4-2 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 15.4.1.1 Thermal Analysis 15.4.1.1.1 Westinghouse Performance Criteria for Emergency Core Cooling System The reactor is designed to withstand thermal effects caused by a loss of coolant accident including the double ended severance of the largest reactor coolant system pipe. The reactor core and internals together with the ECCS are designed so that the reactor can be safely shutdown and the essential heat transfer geometry of the core preserved following the accident. The current internals is of the upflow barrel/baffle design.

The ECCS, even when operating during the injection mode with the most limiting single active failure, is designed to meet the acceptance criteria.

15.4.1.1.2 Method of Thermal Analysis Descriptions of the various aspects of the LOCA analysis are provided in References

[1] and [2]. These documents describe the major phenomena modeled, the interfaces among the computer codes and features of the codes which serve to maintain compliance with the acceptance criteria of 10 CFR 50.46.

The analysis of a large-break LOCA transient is divided into three phases: Blowdown, Refill, and Reflood. A series of computer codes has been developed to analyze the transient based on the specific phenomena which govern each phase. During the blowdown portion, the SATAN-VI code[3] is used to calculate the RCS pressure, enthalpy, density, and mass and energy flows in the primary system, as well as the heat transfer between the primary and secondary system. At the end of the blowdown, information on the state of the system is transferred to the WREFLOOD code[4] which performs the calculation of the refill period to bottom of core (BOC) recovery time.

Once the vessel has refilled to the bottom of the core, the reflood portion of the transient begins. The BASH code[2] is used to calculate the thermal-hydraulic simulation of the RCS for the reflood phase.

Information concerning the core boundary conditions is taken from all of the above codes and input to the LOCBART code[2] for the purpose of calculating the core fuel rod thermal response for the entire transient. From the boundary conditions, LOCBART computes the fluid conditions and heat transfer coefficient for the full length of the fuel rod by employing mechanistic models appropriate to the actual flow and heat transfer regimes. Conservative assumptions ensure that the fuel rods modeled in the calculation represent the hottest rods in the entire core.

15.4.1.1.3 Containment Analysis The containment pressure analysis is performed with the LOTIC-2[5] code. Transient mass and energy releases for input to the LOTIC-2 model are obtained from the WREFLOOD code[4] and Satan-VI code[3]. The transient pressure computed by the LOTIC-2 code is then input to the BASH code[2] for the purpose of supplying a backpressure at the break plane while computing the reflood transient. The containment pressure transients and associated parameters were computed by CONDITION IV - LIMITING FAULTS 15.4-3

WATTS BAR WBNP-89 LOTIC-2 for WBN's initial downflow barrel/baffle internals design and are presented in Figures 15.4-29 through 15.4-34 and 15.4-35 through 15.4-40a for the minimum and maximum safeguards cases, respectively. Two additional LOTIC-2 calculations were performed for WBN's current upflow barrel/baffle internals design for both the minimum and maximum safeguards injection flows. Results for the containment response can be found in Figures 15.4-40b to 15.4-40m for the upflow barrel/baffle cases. The data used to model the containment for the analysis is presented in Tables 15.4-14 and 15.4-15. Mass and energy release rates to containment can be found in Tables 15.4-16a and 15.4-16b.

15.4.1.1.4 Results of Large Break Spectrum Calculations of double-ended cold leg guillotine pipe breaks were initially performed for a downflow barrel/baffle internals design over a range of Moody discharge coefficients (CD) to identify the case which produces the highest peak clad temperature. For this analysis, calculations were performed for discharge coefficients of 0.4, 0.6, and 0.8.

This spectrum of breaks was analyzed assuming the availability of only minimum safety injection flow capacity (minimum safeguards), in accordance with the single failure criteria of 10CFR50, Appendix K. The safety injection flow is depicted in Figure 15.3-2 as a function of RCS pressure. This figure represents injection flow based on ECCS pump performance curves degraded 5% from design head with additional conservatism provided in the calculated system resistance. Injection flow vs. RCS pressure developed using the minimum composite of ECCS pump design head curves (minus 5%) shown in Figures 6.3.2, 6.3.3, and 6.3.4 and the as- designed/as-constructed WBN injection piping configuration, provides injection flows which bound that shown in Table 15.4-23. A break discharge coefficient of 0.6 was found to result in the highest peak cladding temperature.

Consistent with the methodology described in Reference [6], an additional calculation for the initial downflow barrel/baffle internals design was performed for the worst break size. In this calculation, termed "maximum safeguards," no failures of the safety injection systems are assumed to occur. This case was found to result in a limiting peak cladding temperature of 2193°F, which is below the 2200°F limit of 10CFR50.46.

Two additional calculations were then performed for the limiting discharge coefficient (0.6) for both the minimum and maximum safeguards for the current upflow barrel/baffle design configuration. The limiting peak cladding temperature for the upflow barrel/baffle configuration was 2126°F for the minimum safeguards case. The results of these calculations are summarized in Tables 15.4-17 and 15.4-18. Table 15.4-19 contains some key plant parameters input to the analyses.

Figures 15.4-41 through 15.4-96g show transient plots of important parameters from the code calculations. For each break calculation, transients of the following parameters are presented.

For the blowdown portion of the transient:

RCS pressure, Core inlet and outlet flow rates, 15.4-4 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Cold leg accumulator delivery rate, Core pressure drop, Break mass flowrate, Break energy discharge rate, Normalized core power.

For the reflood portion of the transient:

Core and downcomer liquid levels, Core inlet fluid velocity, as input to the rod thermal analysis code, Accumulator and pumped safety injection flow rates.

From the fuel rod thermal analysis, at the peak temperature location:

Fluid mass flux, Rod heat transfer coefficient, Cladding temperature transient, and Temperature transient at the burst elevation.

15.4.1.1.5 Effect of Containment Purging To assess the impact of purging on the calculated post-LOCA Watts Bar containment pressure, a calculation was performed to obtain the amount of mass which exits through two available purge lines during the initial portion of a postulated LOCA transient. Purge line isolation closure time is assumed at 4.0 seconds after receipt of signal; during this interval, the full flow area is presumed available. In addition, the time to reach the SI signal setpoint and the delay necessary to generate the SI signal are conservatively assessed as 1.5 seconds total. Thus, flow through a pair of fully open available purge lines was evaluated from 0.0 to 5.5 seconds for the postulated Double-Ended Cold Leg break.

The calculation employed the 50-node transient mass distribution (TMD) computer code model which is described in Section 6.2.1.3.4. Referring to Figure 6.2.1-9, purge supply lines are connected to volumes 34, 37, and 25; purge exhaust lines are connected to volumes 36 and 25. Possible combinations of one supply line and one exhaust line open to the atmosphere were considered. Each of the purge lines is represented by a flowpath of cross-section area equal to 2.948 ft2 and a total flow resistance factor equal to 3.98 (entrance and exit loss, three fully open butterfly valves and a debris screen).

CONDITION IV - LIMITING FAULTS 15.4-5

WATTS BAR WBNP-80 In a computation for ECCS performance, the greatest impact on containment pressure occurs for the purge case of maximum air mass loss which involves two purge lines open in the lower compartment (TMD elements 34 and 36) together with a cold leg break in TMD volume 1; 1160 lbs of air are calculated to be lost in this case. The maximum air loss case is the limiting case because any steam lost via purging in an ECCS backpressure evaluation would otherwise be calculated to condense in the ice bed. Therefore, any steam lost via purging is ultimately of no consequence in the containment pressure determination while any air loss directly reduces calculated pressure.

The impact of the air loss from purging is implicitly included in the calculations of peak clad temperature. The containment pressure transient calculations account for a loss of 1160 lbm of air after initiation of the accident through modifying the compression ratio input to the LOTIC-2 code. The acceptable performance of the ECCS, as calculated using the resulting containment backpressure, permits the purging of the Watts Bar containment during normal operation.

15.4.1.1.6 Conclusions - Thermal Analysis For cases considered, the ECCS meets the acceptance criteria presented in 10 CFR 50.46. That is:

(1) The calculated peak fuel element cladding temperature provides margin to the requirement of 2200°F, based on an Fq value of 2.40.

(2) The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1% of the total amount of zircaloy in the fuel.

(3) The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. Local oxidation limits of 17% are not exceeded during or after quenching.

(4) The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.

15.4.1.2 Hydrogen Production and Accumulation Hydrogen accumulation in the containment atmosphere following the DBA can be the result of production from several sources. The potential sources of hydrogen are the zirconium-water reaction, corrosion of construction materials, and radiolytic decomposition of the emergency core cooling solution. The latter source, solution radiolysis, includes both core solution radiolysis and sump solution radiolysis.

15.4.1.2.1 Method of Analysis The quantity of zirconium which reacts with the core cooling solution depends on the performance of the ECCS. The criteria for evaluation of the ECCS requires that the zircaloy-water reaction be limited to one percent by weight of the total quantity of 15.4-6 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 zirconium in the core. ECCS calculations have shown the zircaloy-water reaction to be less than 0.1%, much less than required by the criteria.

The use of aluminum inside the containment is limited and is not used in safety-related components which are in contact with the recirculating core cooling fluid. Aluminum is more reactive with the containment spray alkaline borate solution than other plant materials such as galvanized steel, copper, and copper nickel alloys. By limiting the use of aluminum, the aggregate source of hydrogen over the long term is essentially restricted to that arising from radiolytic decomposition of core and sump water. The upper limit rate of such decomposition can be predicted with ample certainty to permit the design of effective countermeasures.

It should be noted that the zirconium-water reaction and aluminum corrosion with containment spray are chemical reactions and thus essentially independent of the radiation field inside the containment following a LOCA. Radiolytic decomposition of water is dependent on the radiation field intensity. The radiation field inside the containment is calculated for the maximum credible accident in which the fission product activities given in TID-14844[20] are used.

Two hydrogen generation calculations are performed--one using the Westinghouse model discussed below and the other using the NRC Branch Technical Position CSB 6-2[21]. The requirements of Regulatory Guide 1.7[32] have been considered, and the results are shown in Figures 15.4-4 and 15.4-6.

15.4.1.2.2 Typical Assumptions The following discussion outlines the assumptions used in the calculations.

(1) Zirconium-Water Reaction The zirconium-water reaction is described by the chemical equation:

Zr + 2H 2 O Zr0 2 + 2H 2 + Heat The hydrogen generation due to this reaction will be completed during the first day following the LOCA. The Westinghouse model assumes a 0.5- or 1.5% zirconium-water reaction. The NRC model assumes a 1.5%

zirconium-water reaction or a corewide average depth of reaction into the original cladding of 0.00023 inches of clad thickness. In accordance with Regulatory Guide 1.7, the hydrogen generation has been assumed to be five times the maximum amount calculated in accordance with 10CFR50.46, but no less than the amount that would result from the reaction of all the metal surrounding the fuel (excluding the cladding surrounding the plenum volume) to a depth of 0.00023 inches. This meets the current NRC basis for evaluating hydrogen production inside containment. The hydrogen generated is assumed to be released to the containment atmosphere over the first two minutes following the break in both models.

CONDITION IV - LIMITING FAULTS 15.4-7

WATTS BAR WBNP-80 (2) Primary Coolant Hydrogen The maximum equilibrium quantity of hydrogen in the primary coolant is 1120 scf. This value includes both hydrogen dissolved in the coolant water at 35 cc (STP) per kilogram of water and the corresponding equilibrium hydrogen in the pressurizer gas space. The 1120 scf of hydrogen is assumed to be released immediately and uniformly to the containment atmosphere.

(3) Corrosion of Plant Materials Oxidation of metals in aqueous solution results in the generation of hydrogen gas as one of the corrosion products. Extensive corrosion testing has been conducted to determine the behavior of the various metals used in the containment in the emergency core cooling solution at DBA conditions.

Metals tested include zircaloy, inconel, aluminum alloys, cupronickel alloys, carbon steel, galvanized carbon steel, and copper. Tests conducted at ORNL[22,23] have also verified the compatibility of the various materials (exclusive of aluminum) with alkaline borate solution. As applied to the quantitative definition of hydrogen production rates, the results of the corrosion tests have shown that only aluminum and zinc will corrode at a rate that will significantly add to the hydrogen accumulation in the containment atmosphere.

The corrosion of aluminum may be described by the overall reaction:

2Al + 3H 2 O Al 2 O 3 + 3H 2 Therefore, three moles of hydrogen are produced for every two moles of aluminum that is oxidized (approximately 20 scf of hydrogen for each pound of aluminum corroded).

The corrosion of zinc may be described by the overall reaction:

Zn + 2H 2 O Zn ( OH ) 2 + H 2 Therefore, one mole of hydrogen is produced for each mole of zinc oxidized. This corresponds to 5.5 scf hydrogen produced for each pound of zinc corroded.

The time-temperature cycle (Table 15.4-2) considered in the calculation of aluminum and zinc corrosion is based on a conservative step-wise representation of the postulated postaccident containment transient. The corrosion rates at the various steps are determined from the aluminum and zinc corrosion rate design curves shown in Figures 15.4-1 and 15.4-1a. The corrosion data points include the effects of temperature, alloy, and spray solution conditions. Based on these corrosion rates and corrodible metal inventory given in Table 15.4-3, the contribution of aluminum and zinc 15.4-8 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 corrosion to hydrogen accumulation in the containment following the DBA was calculated. For conservative estimation, no credit is taken for protective shield effects of insulation or enclosures from the spray and complete and continuous immersion is assumed.

Calculations based on the NRC model are performed by allowing an increased aluminum corrosion rate during the final step of the post-accident containment temperature transient (Table 15.4-2) corresponding to 200 mils (15.7 mg/dm2/hr). The corrosion rates earlier in the accident sequence are the higher rates determined from Figure 15.4-1.

(4) Radiolysis of Core and Sump Water Water radiolysis is a complex process involving reactions of numerous intermediates. However, the overall radiolytic process may be described by the reaction:

2H 2 O 2H 2 + O 2 Of interest here is the quantitative definition of the rates and extent of radiolytic hydrogen production following the DBA.

An extensive program has been conducted by Westinghouse to investigate the radiolytic decomposition of the core cooling solution following the DBA.

In the course of this investigation, it became apparent that two separate radiolytic environments exist in the containment at DBA conditions. In one case, radiolysis of the core cooling solution occurs as a result of the decay energy of fission products in the fuel. In the other case, the decay of dissolved fission products, which have escaped from the core, results in the radiolysis of the sump solution. The results of these investigations are discussed in Reference [24].

15.4.1.2.3 Core Solution Radiolysis As the emergency core cooling solution flows through the core, it is subjected to gamma radiation by decay of fission products in the fuel. This energy deposition results in solution radiolysis and the production of molecular hydrogen and oxygen.

The initial production rate of these species will depend on the rate of energy absorption and the specific radiolytic yields.

The energy absorption rate in solution can be assessed from knowledge of the fission products contained in the core, and a detailed analysis of the dissipation of the decay energy between core materials and the solution. The results of Westinghouse studies show essentially all of the beta energy is absorbed within the fuel and cladding and that this represents approximately 50% of the total beta-gamma decay energy. This study shows further that of the gamma energy, a maximum of 7.4% will be absorbed by the solution incore. Thus, an overall absorption factor of 3.7% of the total core decay CONDITION IV - LIMITING FAULTS 15.4-9

WATTS BAR WBNP-80 energy ( + ) is used to compute solution radiation dose rates and the time-integrated dose. Table 15.4-4 presents the total decay energy ( + ) of a reactor core, which assumes a full power operating time of 650 days before the accident. For the maximum credible accident case, the contained decay energy in the core accounts for the assumed TID-14844 release of 50% halogens and 1% other fission products. To be conservative, the noble gases have been assumed to be retained in the core. In reality, the noble gases are assumed by the TID-14844 model to escape to the containment vapor space where little or no water radiolysis would result from decay of these nuclides.

The total decay energy of the reactor core which is used to evaluate post-LOCA hydrogen production and accumulation has been compared to a decay energy curve based on ANS Standard 5.1-1979[25]. For this comparison, the values given in ANS 5.1 for decay energy release rate at infinite irradiation time were adjusted to a 650-day irradiation time. These resultant values were then multiplied by a factor of 1.2. The results of this comparison are shown in Figure 15.4-1b. The curve presented here as the Westinghouse decay energy curve is used exclusively for post-LOCA hydrogen production calculations.

The radiolysis yield of hydrogen in solution has been studied extensively by Westinghouse and ORNL[22, 23]. The results of static capsule tests conducted by Westinghouse indicate that hydrogen yields much lower than the maximum of 0.44 molecules per 100 ev would be the case incore. With little gas space to which the hydrogen formed in solution can escape, the rapid back reactions of molecular radiolytic products in solution to reform water is sufficient to result in very low net hydrogen yields.

However, it is recognized that there are differences between the static capsule tests and the dynamic condition incore, where the core cooling fluid is continuously flowing.

Such flow is reasoned to disturb the steady-state conditions which are observed in static capsule tests, and while the occurrence of back reactions would still be significant, the overall net yield of hydrogen would be somewhat higher in the flowing system.

The study of radiolysis in dynamic systems was initiated by Westinghouse, which formed the basis for experimental work performed at ORNL. Both studies clearly illustrate the reduced yields in hydrogen from core radiolysis, i.e., reduced from the maximum yield of 0.44 molecules per 100 ev. These results have been published[24,26].

For the purposes of this analysis, the calculations of hydrogen yield from core radiolysis are performed with the very conservative value of 0.44 molecules per 100 ev. That this value is conservative and a maximum for this type of aqueous solution and gamma radiate on is confirmed by many published works. The Westinghouse results from the dynamic studies show 0.44 molecules per 100 ev to be a maximum at very high solution flow rates through the gamma radiation field. The referenced ORNL[26] work also confirms this value as a maximum at high flow rates. A. O. Allen[27]

15.4-10 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 presents a very comprehensive review of work performed to confirm the primary hydrogen yield to be a maximum of 0.44 - 0.45 molecules per 100 ev.

On the foregoing basis, the production rate and total hydrogen produced from core radiolysis, as a function of time, has been conservatively estimated for the maximum credible accident case.

Calculations based on the NRC model assume a hydrogen yield value of 0.5 molecules per 100 ev, 10% of the gamma energy produced from fission products in the fuel rods is absorbed by the solution in the region of the core, and the noble gases escape to the containment vapor space.

15.4.1.2.4 Sump Solution Radiolysis Another potential source of hydrogen assumed for the postaccident period arises from water contained in the reactor containment sump being subjected to radiolytic decomposition by fission products. In this consideration, an assessment must be made as to the decay energy deposited in the solution and the radiolytic hydrogen yield, much in the same manner as given above for core radiolysis.

The energy deposited in solution is computed using the following basis:

(1) For the maximum credible accident, a TID-14844 release model[20] is assumed where 50% of the total core halogens and 1% of all other fission products, excluding noble gases, are released from the core to the sump solution.

(2) The quantity of fission product release is equal to that from a reactor operating at full power for 650 days before the accident.

(3) The total decay energy from the released fission products, both beta and gamma, is assumed to be fully absorbed in the solution.

Within the assessment of energy release by fission products in water, account is made of the decay of halogens, and a separate accounting for the slower decay of the 1%

other fission products. To arrive at the energy deposit rate and time-integrated energy deposited, the contribution from each individual fission product class was computed.

The overall contributions from each of the two classes of fission products is shown in Table 15.4-5.

The yield of hydrogen from sump solution radiolysis is most nearly represented by the static capsule tests performed by Westinghouse and ORNL with the alkaline sodium borate solution. The differences between these tests and the actual conditions for the sump solution, however, are important and render the capsule tests conservative in their predictions of radiolytic hydrogen yields.

In this assessment, the sump solution will have considerable depth, which inhibits the ready diffusion of hydrogen from solution, as compared to the case with shallow-depth capsule tests. This retention of hydrogen in solution will have a significant effect in CONDITION IV - LIMITING FAULTS 15.4-11

WATTS BAR WBNP-91 reducing the hydrogen yields to the containment atmosphere. The buildup of hydrogen concentration in solution will enhance the back reaction to formation of water and lower the net hydrogen yield, in the same manner as a reduction in gas to liquid volume ratio will reduce the yield.

This is illustrated by the data presented in Figure 15.4-2 for capsule tests with various gas to liquid volume ratios. The data show a significant reduction in the apparent or net hydrogen yield from the published primary maximum yield of 0.44 molecules per 100 ev. Even at the very highest ratios, where capsule solution depths are very low, the yield is less than 0.30, with the highest scatter data point at 0.39 molecules per 100 ev.

With these considerations taken into account, a reduced hydrogen yield is a reasonable assumption to make for the case of sump radiolysis. While it can be expected that the yield will be on the order of 0.1 or less, a conservative value of 0.30 molecules per 100 ev has been used in the maximum credible accident case.

Calculations based on the NRC model do not take credit for a reduced hydrogen yield in the case of sump radiolysis and a hydrogen yield value of 0.5 molecules per 100 ev has been used.

15.4.1.2.5 Results Figures 15.4-3 and 15.4-5 show the hydrogen production and accumulation in the containment following a LOCA for both the Westinghouse and NRC models, while Figures 15.4-7 and 15.4-8 give the volume percent of hydrogen in the containment for each of the models. Figures 15.4-4 and 15.4-6 reflect the current NRC basis (Regulatory Guide 1.7) and provide the hydrogen generation and accumulation in containment following a LOCA.The figures for hydrogen accumulation and volume percent in the containment are based on the assumption that no measures are taken to remove the hydrogen (i.e., no recombination on purging of the hydrogen is taken into account). The effect of the hydrogen recombiner system on hydrogen accumulation is discussed in Section 6.2, while the effect of hydrogen purging to atmosphere is discussed in Section 15.5.

15.4.2 Major Secondary System Pipe Rupture 15.4.2.1 Major Rupture of a Main Steam Line 15.4.2.1.1 Identification of Causes and Accident Description The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the reactor coolant system causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in a reduction of core shutdown margin.

If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam line rupture 15.4-12 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-91 is a potential problem mainly because of the high power peaking factors which exist, assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid injection delivered by the safety injection system.

The analysis of a main steam line rupture is performed to demonstrate that the following criterion is satisfied:

Assuming a stuck RCCA with or without offsite power and assuming a single failure in the engineered safeguards, the core remains in place and intact. Radiation doses are not expected to exceed the guidelines of 10 CFR 100.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position.

The following functions provide the necessary protection for a steam line rupture:

(1) Safety injection system actuation from any of the following:

(a) Two out of three low pressurizer pressure signals.

(b) Two out of three high containment pressure signals.

(c) Two out of three low steamline pressure signals in any steamline.

(2) The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

(3) Redundant isolation of the main feedwater lines: Sustained high feedwater flow would cause additional cooldown. A safety injection signal will rapidly close all feedwater control valves and main feedwater isolation valves, and trip the main feedwater pumps, condensate booster pumps, condensate demineralizer pump, and motor-operated standby feedwater pump if operating.

(4) Trip of the fast acting steam line stop valves (main steam isolation valves)

(designed to close in less than 6 seconds) on:

(a) Two out of four high-high containment pressure signals.

(b) Two out of three low steamline pressure signals in any steamline.

(c) Two out of three high negative steamline pressure rate signals in any steamline.

Fast-acting isolation valves are provided in each steam line that will fully close within 6 seconds after a steamline isolation signal setpoint is reached. The time delay for actuation of the low steamline pressure safety injection actuation signal, high negative steamline pressure rate signal, high-high containment pressure signal, and manual CONDITION IV - LIMITING FAULTS 15.4-13

WATTS BAR WBNP-91 block of the low steamline pressure safety injection actuation signal must be within 2 seconds after initiation. This, along with the main steam isolation time of approximately 6 seconds, shall not exceed a 8 second total response time for this action in the safety analysis for this event. For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would blowdown even if one of the isolation valves fails to close. A description of steam line isolation is included in Chapter 10.

Steam flow is measured by monitoring dynamic head in nozzles located in the throat of the steam generator. The effective throat area of the nozzles is 1.4 square feet, which is considerably less than the main steam pipe and thus the nozzles also serve to limit the maximum steam flow for a break at any location.

Table 15.4-6 lists the equipment required in the recovery from a high energy line rupture. Not all equipment is required for any one particular break, since it will vary depending upon postulated break location and details of initial conditions. Design criteria and methods of protection of safety related equipment from the dynamic effects of postulated piping ruptures are provided in Section 3.6.

15.4.2.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the steam pipe rupture has been performed to determine:

(1) The core heat flux and reactor coolant system temperature and pressure resulting from the cooldown following the steam line break. The LOFTRAN[11] Code has been used.

(2) The thermal and hydraulic behavior of the core following a steam line break.

A detailed thermal and hydraulic digital computer code, THINC[30], has been used to determine if DNB occurs for the core conditions computed in Item 1 above.

The following conditions were assumed to exist at the time of a main steam line break accident.

(1) End-of-life shut down margin at no load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.

(2) The negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position: The variation of the coefficient with temperature and pressure has been included.

The keff versus temperature at 1000 psi corresponding to the negative moderator temperature coefficient used is shown in Figure 15.2-40. The 15.4-14 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 effect of power generation in the core on overall reactivity is shown in Figure 15.4-9. The parameters used to determine the radioactivity releases for the steamline break are given in Table 15.5-16.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked for the statepoints shown on Table 15.4-7. These core analyses considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and non-uniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated including the above local effects for all statepoints. The limiting statepoint is presented in Table 15.4-7. These results verified conservatism, i.e., underproduction of negative reactivity feedback from power generation.

(3) Minimum capability for injection of concentrated boric acid (1950 ppm) solution corresponding to the most restrictive single failure in the safety injection system. The emergency core cooling system consists of three systems: 1) the passive accumulators, 2) the residual heat removal system, and 3) the safety injection system.

The actual modeling of the safety injection system in LOFTRAN is described in Reference [11] and reflects injection as a function of RCS pressure versus flow including RCP seal injection, excluding centrifugal charging pump miniflow, and with no spilling lines. This injection analysis result is bounded when using the minimum composite pump curve (degraded by 5% of design head) as shown in Figure 6.3-4. This corresponds to the flow delivered by one charging pump delivering its full flow to the cold leg header. The injection curve used is shown in Figure 15.4-10. No credit has been taken for the low concentration borated water, which must be swept from the lines downstream of the RWST prior to the delivery of concentrated boric acid to the reactor coolant loops.

For the cases where offsite power is assumed, the sequence of events in the safety injection system is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the high head safety injection pump starts. In 27 seconds, the valves are assumed to be in their final position and the pump is assumed to be at full speed. The volume containing the low concentration borated water is swept, of course, CONDITION IV - LIMITING FAULTS 15.4-15

WATTS BAR WBNP-80 before the 1950 ppm reaches the core. This delay, described above is inherently included in the modeling.

In cases where offsite power is not available, a 15-second delay is assumed to start the diesels and then begin loading the necessary safety injection equipment sequentially onto them.

Although a 15-second delay is assumed for the diesels to be available for loading for the peak clad temperature analysis, it should be noted that the actual design basis requirement for the diesel generator to attain minimum voltage and frequency settings is within 10-seconds of a start signal. This assumption results in additional conservatism in the analysis, which adds the 15 seconds to the 27 seconds assumed for valve alignment in the offsite power available case for a total of 42 seconds.

(4) Design value of the steam generator heat transfer coefficient including allowance for fouling factor.

(5) Since the steam generators are provided with integral flow restrictors with a 1.4 square foot throat area, any rupture with a break area greater than 1.4 square feet, regardless of location would have the same effect on the Nuclear Steam Supply System (NSSS) as the 1.4 square foot break. The following cases have been considered in determining the core power and reactor coolant system transients:

(a) Complete severance of a pipe, with the plant initially at no load conditions, full reactor coolant flow with offsite power available.

(b) Case a above with loss of offsite power simultaneous with the steam line break and initiation of the safety injection signal. Loss of offsite power results in coolant pump coastdown.

(6) Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly-during the return to power phase following the steam line break. This void in conjunction with the large negative moderator coefficient partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.

The core parameters used for each of the two cases correspond to values determined from the respective transient analysis. The limiting statepoints for the two cases are presented in Table 15.4-7.

Both the cases above assume initial hot shutdown conditions at time zero since this represents the most pessimistic initial condition. Should the reactor 15.4-16 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-91 be just critical or operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power the reactor coolant system contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no load conditions of RCS temperature and shutdown margin assumed in the analyses are reached.

After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no load condition at time zero.

However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the RCS cooldown are greater for steam line breaks occurring from no load conditions.

(7) In computing the steam flow during a steam line break, the Moody Curve[9]

for fl/D = 0 is used.

(8) A steam generator tube plugging level of 10% is assumed.

(9) A thermal design flowrate of 372,400 gpm is used which accounts for the 10%

steam generator tube plugging level and instrumentation uncertainty.

Results The results presented are a conservative indication of the events which would occur assuming a steam line rupture since it is postulated that all of the conditions described above occur simultaneously.

Core Power and RCS Transient Figure 15.4-11 shows the RCS transient and core heat flux following a main steam line rupture (complete severance of a pipe) at initial no load condition (Case a). Offsite power is assumed available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator.

Should the core be critical at near zero power when the rupture occurs the initiation of safety injection by low steamline pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by high-high containment pressure or low steam line pressure signals. Even with the failure of one valve, release is limited by isolation valve closure for the other steam generators while the one generator blows down. The main steamline isolation valves are designed to be fully closed in less than 6 seconds from receipt of a closure signal.

As shown in Figure 15.4-11 the core attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) before boron solution at 1950 ppm enters the reactor coolant system. A peak core power less than the nominal full power value is attained.

CONDITION IV - LIMITING FAULTS 15.4-17

WATTS BAR WBNP-80 The calculation assumes the boric acid is mixed with, and diluted by the water flowing in the reactor coolant system prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the reactor coolant system and in the safety injection system. The variation of mass flow rate in the reactor coolant system due to water density changes is included in the calculation as is the variation of flow rate in the safety injection system due to changes in the reactor coolant system pressure. The safety injection system flow calculation includes the line losses in the system as well as the pump head curve.

Figure 15.4-12 shows the responses of the salient parameters for Case b which corresponds to the case discussed above with additional loss of offsite power at the time the safety injection signal is generated. The safety injection system delay time includes 10 seconds (assumed for peak cladding temperature analysis) to start the diesel and load it on the 6.9 kV shutdown board (design basis requirement is 10 seconds) and 10 seconds to bring the injection pump to full speed. The centrifugal charging pump is sequentially loaded on the 6.9 kV shutdown board nominally at 5 seconds, with 5 additional seconds for acceleration to full speed and delivery of design flow and head. Although not modeled in this analysis, loading of the safety injection pumps at 10 seconds and the residual heat removal pumps at 15 seconds with another 5 seconds for acceleration to full speed and delivery of design flow and head, adds 10 additional seconds to the ECCS pump sequence for a total of 30 seconds for the loss of offsite power case (see Table 8.3-3). However, as defined earlier, the injection of borated water is conservatively delayed to 42 seconds based on the assumed 15 second diesel generator delay time plus the 27 seconds associated with the valve lineup for the offsite power available case (Case a). In each case criticality is achieved later and the core power increase is slower than in the similar case with offsite power available. The ability of the emptying steam generator to extract heat from the reactor coolant system is reduced by the decreased flow in the reactor coolant system. For both these cases the peak power remains well below the nominal full power value.

It should be noted that following a steam line break only one steam generator blows down completely. Thus, the remaining steam generators are still available for dissipation of decay heat after the initial transient is over. In the case of loss of offsite power this heat is removed to the atmosphere via the steam line safety valves.

Following blowdown of the faulted steam generator, the plant can be brought to a stabilized hot standby condition through control of auxiliary feedwater flow and safety injection flow as described by plant operating procedures. The operating procedures call for operator action to limit RCS pressure and pressurizer level by terminating safety injection flow, and to control steam generator level and RCS coolant temperature using the auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in excess of ten minutes following safety injection actuation.

Margin to Critical Heat Flux A DNB analysis was performed for both of these cases. The limiting statepoints are presented in Table 15.4-7. It was found that all cases had a minimum DNBR greater than the limiting value.

15.4-18 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-86 15.4.2.1.3 Conclusions The analysis shows that the criteria stated earlier in this section are satisfied. In addition, the pressure differential across the steam generator tubes that has been calculated for a postulated main feedwater line break is more limiting (i.e., dictates a minimum tube wall thickness) than the pressure differential for a postulated main steam line break. Therefore, steam generator tube rupture is not expected to occur (see Section 4.19.7.6 of Reference [34]).

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and not precluded in the criterion, the above analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive RCCA stuck in its fully withdrawn position.

If it is assumed that there is leakage from the reactor coolant system to the secondary system in the steam generators and that offsite power is lost following the steam line break, radioactivity will be released to the atmosphere through the relief or safety valves. Environmental consequences of a postulated steam line break are addressed in Section 15.5.4.

15.4.2.2 Major Rupture of a Main Feedwater Pipe 15.4.2.2.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater pipe large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell-side fluid inventory in the steam generators. If the break is postulated in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break. Further, a break in this location could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. (A break upstream of the feedline check valve would affect the nuclear steam supply system only as a loss of feedwater.)

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a reactor coolant system cooldown (by excessive energy discharge through the break), or a reactor coolant system heatup.

Potential reactor coolant system cooldown resulting from a secondary pipe rupture is evaluated in Section 15.4.2.1. Therefore, only the reactor coolant system heatup effects are evaluated for a feedline rupture.

A feedline rupture reduces the ability to remove heat generated by the core from the reactor coolant system because of the following reasons:

(1) Feedwater to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

(2) Liquid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

CONDITION IV - LIMITING FAULTS 15.4-19

WATTS BAR WBNP-86 (3) The break may be large enough to prevent the addition of any main feedwater after trip.

An auxiliary feedwater system is provided to assure that adequate feedwater is available such that:

(1) No substantial overpressurization of the reactor coolant system occurs; and (2) Liquid in the reactor coolant system is sufficient to cover the reactor core at all times.

The following provides the necessary protection for a main feedwater rupture:

(1) A reactor trip on any of the following conditions:

(a) High pressurizer pressure (b) Overtemperature T (c) Low-low steam generator water level in one or more steam generators (d) Safety injection signals from any of the following:

(i) Low steamline pressure (ii) Low pressurizer pressure (iii) High containment pressure (2) An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal.

15.4.2.2.2 Analysis of Effects and Consequences The discussion of the analysis for a main feedwater break inside primary containment presented below is based on a reactor trip generated by steam generator low-low water level. Evaluations that were performed using the MONSTER[37] Code show a high containment pressure signal is generated in less than 1.0 second. In the analysis presented below, steam generator level decreases to its trip setpoint in 26.0 seconds.

Thus, the following analysis is conservative and is being retained although containment pressure is the signal that will actually be used to generate a reactor trip for this event.

Method of Analysis A detailed analysis using the LOFTRAN[11] Code is performed in order to determine the plant transient following a feedline rupture. The code describes the plant thermal kinetics, reactor coolant system including natural circulation, pressurizer, steam generators and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature.

15.4-20 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Two cases are analyzed. One case assumes that offsite electrical power is maintained throughout the transient. Another case assumes the loss of offsite electrical power at the time of reactor trip, and RCS flow decreases to natural circulation. Both cases assume a double-ended rupture of the largest feedwater pipe at full power. Major assumptions used in the analysis are as follows:

(1) The plant is initially operating at 102% of the design rating.

(2) Initial reactor coolant average temperature is 6.5°F above the nominal value, and the initial pressurizer pressure is 46 psi above its nominal value.

(3) The pressurizer power-operated relief valves and the safety relief valves are assumed to function. No credit is taken for pressurizer spray. Initial pressurizer level is at the nominal programmed value plus 5% uncertainty.

(4) No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

High pressurizer pressure Overtemperature T High pressurizer level High containment pressure (5) Main feedwater to all steam generators is assumed to stop at the time the break occurs (all main feedwater spills out through the break).

(6) Saturated liquid discharge (no steam) is assumed from the affected steam generator through the feedline rupture. This assumption minimizes energy removal from the NSSS during blowdown.

(7) No credit is taken for the low-low water level trip on the affected steam generator until the steam generator level reaches 0% of the narrow range span. This assumption minimizes the steam generator fluid inventory at the time of trip, and thereby maximizes the resultant heatup of the reactor coolant.

(8) A double-ended break area of 0.223 ft2 is assumed.

(9) No credit is taken for heat energy deposited in reactor coolant system metal during the RCS heatup.

(10) No credit is taken for charging or letdown.

(11) Steam generator heat transfer area is assumed to decrease as the shellside liquid inventory decreases.

CONDITION IV - LIMITING FAULTS 15.4-21

WATTS BAR WBNP-80 (12) The core residual heat generation is based on the 1979 version of ANS 5.1

[Ref. 33] based upon long term operation at the initial power level. The decay of U-238 capture products is included as an integral part of this expression.

(13) The auxiliary feedwater is actuated by the low-low steam generator water level signal. The auxiliary feedwater is assumed to supply a total of 410 gpm to two unaffected steam generators, based on the following scenario:

- The turbine driven pump is assumed to fail.

- The motor-driven pump supplying the faulted steam generator is conservatively assumed to lose all its flow out the break. The intact steam generator aligned to that pump is therefore assumed to receive no flow.

- The remaining motor-driven pump supplies flow to two intact steam generators.

A 60 second delay was assumed following the low-low level signal to allow time for startup of the emergency diesel generators and the auxiliary feedwater pumps.

Results Figures 15.4-13a, 15.4-13b, and 15.4-13c show the calculated plant parameters following a feedline rupture for the case with offsite power. Figures 15.4-14a, 15.4-14b, and 15.4-14c show the calculated plant parameters following a feedline rupture with loss of offsite power. The calculated sequence of events for both cases analyzed is presented in Table 15.4-9.

The system response following the feedwater line rupture is similar for both cases analyzed. Results presented in the figures show that pressures in the RCS and main steam system remain below 110% of the respective design pressures. Pressurizer pressure increases until reactor trip occurs on low-low steam generator narrow range level. Pressure then decreases, due to the loss of heat input, until steamline isolation occurs. Coolant expansion occurs due to reduced heat transfer capability in the steam generators. The pressurizer relief valves open to maintain primary pressure at an acceptable value. The calculated relief rates are within the relief capacity of the pressurizer relief valves. Addition of the safety injection flow aids in cooling down the primary side and helps to ensure that sufficient fluid exists to keep the core covered with water.

The reactor core remains covered with water throughout the transient, as water relief due to thermal expansion is limited by the heat removal capability of the auxiliary feedwater system and makeup is provided by the safety injection system. Bulk boiling does not occur in the RCS prior to the turnaround of the transient.

15.4.2.2.3 Conclusions Results of the analysis show that for the postulated feedline rupture, the assumed auxiliary feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the reactor coolant system, and to prevent the water level in the RCS from dropping to the top of the core.

15.4-22 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 15.4.3 Steam Generator Tube Rupture 15.4.3.1 Identification of Causes and Accident Description The accident examined is the complete severance of a single steam generator tube.

The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or failure of the condenser dump system, discharge of radioactivity to the atmosphere takes place via the steam generator power-operated relief valves (and safety valves if their setpoint is reached).

The steam generator tube material is Inconel-600 and is a highly ductile material; thus, it is considered that the assumption of a complete severance of a tube is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and an accumulation of minor leaks which exceed the limits established in the Technical Specifications is not permitted during the unit operation.

The operator is expected to readily determine that a steam generator tube rupture (SGTR) has occurred, identify and isolate the faulty steam generator on a restricted time scale in order to complete the required recovery actions to stabilize the plant, minimize contamination of the secondary system, and ensure termination of radioactive release to the atmosphere from the faulty unit. The recovery procedure can be carried out on a time scale which ensures that break flow to the secondary system is terminated before water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by a tube rupture:

(1) Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a steam flow/feedwater flow mismatch alarm as feedwater flow to the affected steam generator is reduced due to the additional break flow which is now being supplied to that steam generator from the primary side.

(2) Continued loss of reactor coolant inventory leads to a reactor trip signal generated by low pressurizer pressure or by overtemperature T. Resultant plant cooldown following reactor trip leads to a rapid change of pressurizer level, and the safety injection signal, initiated by low-low pressurizer pressure, follows soon after the reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

CONDITION IV - LIMITING FAULTS 15.4-23

WATTS BAR WBNP-89 (3) The steam generator blowdown liquid monitor, the condenser vacuum exhaust radiation monitor and/or main steamline radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system. The steam generator blowdown liquid monitor will automatically terminate steam generator blowdown.

(4) The reactor trip automatically trips the turbine and if offsite power is available the steam dump valves open permitting steam dump to the condenser. In the event of a coincident station blackout, the steam dump valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase resulting in steam discharge to the atmosphere through the steam generator power operated relief valves (and safety valves if their setpoint is reached).

(5) Following reactor trip, the continued action of auxiliary feedwater supply and borated safety injection flow (supplied from the refueling water storage tank) provide a heat sink which absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of offsite power, steam relief to atmosphere.

(6) Safety injection flow results in increasing RCS pressure and pressurizer water level, and the RCS pressure trends toward an equilibrium value where the safety injection flow rate equals the break flow rate.

In the event of an SGTR, the plant operators must diagnose the event and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR recovery are provided in the plant Emergency Operating Procedures.

Operator actions are described below.

(1) Identify the ruptured steam generator.

High secondary side activity, as indicated by the condenser vacuum exhaust radiation monitor, steam generator blowdown liquid monitor, or main steam line radiation monitor, typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator narrow range level, a RADCON survey, or a chemistry laboratory sample. For an SGTR that results in a reactor trip at high power, the steam generator water level as indicated on the narrow range scale will decrease significantly for all of the steam generators. The auxiliary feedwater flow will begin to refill the steam generators, distributing flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will increase more rapidly than normally expected in that steam generator. This response, as displayed by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.

15.4-24 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 (2) Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.

Once the steam generator with a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by l) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.

(3) Cool down the RCS using the intact steam generators.

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling will exist in the RCS after depressurization of the RCS to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump system to the condenser can be used to perform this cooldown. However, if offsite power is lost, the RCS is cooled using the steam generator power operated relief valves to release steam from the intact steam generators.

(4) Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, safety injection flow will increase RCS pressure until break flow matches safety injection flow. Consequently, safety injection flow must be terminated to stop primary to secondary leakage.

However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after safety injection flow is stopped. Since leakage from the primary side will continue after safety injection flow is stopped until RCS and ruptured steam generator pressures equalize, an "excess" amount of inventory is needed to ensure pressurizer level remains on span. The "excess" amount required depends on RCS pressure and reduces to zero when RCS pressure equals the pressure in the ruptured steam generator.

The RCS depressurization is performed using normal pressurizer spray if the RCPs are running. However, if offsite power is lost or the RCPs are not running for some other reason, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using the pressurizer power operated relief valve or auxiliary pressurizer spray.

(5) Terminate safety injection to stop primary to secondary leakage.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure CONDITION IV - LIMITING FAULTS 15.4-25

WATTS BAR WBNP-80 that safety injection flow is no longer needed. When these action have been completed, safety injection flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after safety injection flow is stopped until RCS and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.

Following safety injection termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated, and all immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cooldown and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.

15.4.3.2 Analysis of Effects and Consequences An SGTR results in the leakage of contaminated reactor coolant into the secondary system and subsequent release of a portion of the activity to the atmosphere.

Therefore, an analysis must be performed to assure that the offsite radiological consequences resulting from an SGTR are within the allowable guidelines. One of the major concerns for an SGTR is the possibility of steam generator overfill since this could potentially result in a significant increase in the offsite radiological consequences. Therefore, an analysis was performed to demonstrate margin to steam generator overfill, assuming the limiting single failure relative to overfill. The results of this analysis demonstrated that there is margin to steam generator overfill for a design basis SGTR for Watts Bar Units 1 and 2. A thermal and hydraulic analysis was also performed to determine the input for the offsite radiological consequences analysis, assuming the limiting single failure relative to offsite doses without steam generator overfill. Since steam generator overfill does not occur, the results of this analysis represent the limiting case for the analysis of the radiological consequences for an SGTR for Watts Bar. The thermal and hydraulic analyses to demonstrate margin to overfill and to determine the input for the offsite radiological consequences analysis for a design basis SGTR for Watts Bar are presented in Reference [38] and the results of the thermal and hydraulic analysis for the offsite radiological consequences analysis are discussed as follows.

Thermal and Hydraulic Analysis A thermal and hydraulic analysis has been performed to determine the plant response for a design basis SGTR, and to determine the integrated primary to secondary break flow and the mass releases from the ruptured and intact steam generators to the condenser and to the atmosphere. This information has been used to calculate the quantity of radioactivity released to the environment and the resulting radiological consequences.

The plant response following an SGTR was analyzed with the LOFTTR2 program until the primary to secondary break flow is terminated. The reactor protection system and the automatic actuation of the engineered safeguards systems were modeled in the 15.4-26 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 analysis. The major operator actions which are required to terminate the break flow for an SGTR were also simulated in the analysis.

Analysis Assumptions The accident modeled is a double-ended break of one steam generator tube located at the top of the tube sheet on the outlet (cold leg) side of the steam generator. The time of reactor trip was calculated by modeling the Watts Bar Units 1 and 2 reactor protection system, and the effect of turbine runback until the time of trip was simulated in the analysis. It was assumed that the reactor is operating at full power at the time of the accident and the initial secondary mass was assumed to correspond to operation at nominal steam generator mass, minus an allowance for uncertainties and the differential between the full power mass and runback power level mass. It was also assumed that a loss of offsite power occurs at the time of reactor trip and the highest worth control assembly was assumed to be stuck in its fully withdrawn position at reactor trip.

The limiting single failure was assumed to be the failure of the power operated relief valve on the ruptured steam generator. Failure of this valve in the open position will cause an uncontrolled depressurization of the ruptured steam generator which will increase primary to secondary leakage and the mass release to the atmosphere. It was assumed that the ruptured steam generator power operated relief valve fails open when the ruptured steam generator is isolated, and that the valve was subsequently isolated by locally closing the associated block valve.

The major operator actions required for the recovery from an SGTR are discussed in Section 15.4.3.1 and these operator actions were simulated in the analysis. The operator action times which were used for the analysis are presented in Table 15.4-20.

It is noted that the power operated relief valve on the ruptured steam generator was assumed to fail open at the time the ruptured steam generator was isolated. Before proceeding with the recovery operations, the failed open power operated relief valve was assumed to be isolated by locally closing the associated block valve. It was assumed that the ruptured steam generator power operated relief valve is isolated at 11.0 minutes after the valve was assumed to fail open. After the ruptured steam generator power operated relief valve was isolated, the additional delay time of 7.15 minutes (Table 15.4-20) was assumed for the operator action time to initiate the RCS cooldown.

Transient Description The LOFTTR2 analysis results are described below. The sequence of events for this transient is presented in Table 15.4-21.

Following the tube rupture, reactor coolant flows from the primary into the secondary side of the ruptured steam generator since the primary pressure is greater than the steam generator pressure. In response to this loss of reactor coolant, pressurizer level decreases as shown in Figure 15.4-97a. The RCS pressure also decreases as shown in Figure 15.4-97b as the steam bubble in the pressurizer expands. As the RCS CONDITION IV - LIMITING FAULTS 15.4-27

WATTS BAR WBNP-80 pressure decreases due to the continued primary to secondary leakage, automatic reactor trip occurs at approximately 94 seconds on an overtemperature T trip signal.

After reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves close and steam flow to the turbine is terminated. The steam dump system is designed to actuate following reactor trip to limit the increase in secondary pressure, but the steam dump valves remain closed due to the loss of condenser vacuum resulting from the assumed loss of offsite power at the time of reactor trip. Thus, the energy transfer from the primary system causes the secondary side pressure to increase rapidly after reactor trip until the steam generator power operated relief valves and (safety valves if their setpoints are reached) lift to dissipate the energy, as shown in Figure 15.4-97c. The loss of offsite power at reactor trip results in the termination of main feedwater and actuation of the auxiliary feedwater system. It was assumed that auxiliary feedwater flow is initiated to all steam generators at 60 seconds after reactor trip.

The RCS pressure and pressurizer level decrease more rapidly after reactor trip as energy transfer to the secondary shrinks the reactor coolant and the leak flow continues to deplete primary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI signal at approximately 137 seconds. After SI actuation, the RCS pressure and pressurizer level begin to increase and approach the equilibrium values where the safety injection flow rate equals the break flow rate.

Since offsite power is assumed lost at reactor trip, the RCPs trip and a gradual transition to natural circulation flow occurs. Immediately following reactor trip the temperature differential across the core decreases as core power decays (see Figures 15.4-97d and 15.4-97e); however, the temperature differential subsequently increases as the reactor coolant pumps coast down and natural circulation flow develops. The cold leg temperatures trend toward the steam generator temperature as the fluid residence time in the tube region increases. The hot leg temperatures reach a peak and then slowly decrease as steady state conditions are reached until the ruptured steam generator is isolated and the power operated relief valve is assumed to fail open.

Major Operator Actions (1) Identify and Isolate the Ruptured Steam Generator The ruptured steam generator is to be identified and isolated earlier or less than 15.0 minutes after the initiation of the SGTR or when the narrow range level reaches 30%, whichever time is greater. The ruptured steam generator power operated relief valve is also assumed to fail open at this time. The failure causes the ruptured steam generator to rapidly depressurize as shown in Figure 15.4-97c which results in an increase in primary to secondary leakage. The depressurization of the ruptured steam generator increases the break flow and energy transfer from primary to secondary which results in a decrease in the ruptured loop temperatures as shown in Figure 15.4-97e.

The intact steam generator loop temperatures also slowly decrease, as 15.4-28 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 shown in Figure 15.4-97d until the RCS cooldown is initiated. The shrinkage of the reactor coolant due to the decrease in the RCS temperatures results in a decrease in the pressurizer level and RCS pressure as shown in Figures 15.4-97a and 15.4-97b. When the depressurization of the rupture steam generator is terminated, the pressure begins to increase as shown in Figure 15.4-97c.

(2) Cool Down the RCS to establish Subcooling Margin After the block valve for the ruptured steam generator power operated relief valve is closed, there is a 7.15 minute operator action time assumed prior to initiation of cooldown. The depressurization of the ruptured steam generator due to the failed-open power operated relief valve affects the RCS cooldown target temperature since it is determined based on the pressure at that time.

Since offsite power is lost, the RCS is cooled by dumping steam to the atmosphere using the intact steam generator power operated relief valves.

The cooldown is continued until RCS subcooling at the ruptured steam generator pressure is 20 °F plus an allowance for instrument uncertainty.

Because of the lower pressure in the ruptured steam generator when the cooldown is initiated, the associated temperature the RCS must be cooled to is also lower which has the net effect of extending the time required for cooldown.

The reduction in the intact steam generator pressures required to accomplish the cooldown is shown in Figure 15.4-97c, and the effect of the cooldown on the RCS temperature is shown in Figure 15.4-7d. The pressurizer level and RCS pressure also decrease during this cooldown process due to shrinkage of the reactor coolant, as shown in Figures 15-4-97a and 15.4-97b.

(3) Depressurize RCS to Restore Inventory After the RCS cooldown, a 2.45 minute operator action time is included prior to the RCS depressurization. The RCS is depressurized to assure adequate coolant inventory prior to terminating safety injection flow. With the RCPs stopped, normal pressurizer spray is not available and the RCS is depressurized by opening a pressurizer power operated relief valve. The depressurization is initiated and continued until the criteria in the emergency operating procedures are satisfied. The RCS depressurization reduces the break flow as shown in Figure 15.4-97g and increases safety injection flow to refill the pressurizer as shown in Figure 15.4-97a.

(4) Terminate SI to Stop Primary to Secondary Leakage The previous actions establish adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that safety injection flow is no longer needed. When these actions have been completed, the safety injection flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage.

CONDITION IV - LIMITING FAULTS 15.4-29

WATTS BAR WBNP-80 The safety injection flow is terminated at this time if the safety injection termination criteria in the emergency operating procedures are satisfied.

After depressurization is completed, an operator action time of 4.07 minutes is assumed prior to initiation of safety injection termination. When termination requirements are satisfied, actions proceed to close off the safety injection flow path. After safety injection termination, the RCS pressure begins to dec4rease as shown in Figure 15.4.97b. The intact steam generator power operated relief valves are opened to dump steam to maintain the prescribed RCS temperature to ensure that subcooling is maintained. When the power operated relief valves are opened, the increased energy transfer from primary to secondary also aids in the depressurization of the RCS to the ruptured steam generator pressure. The differential pressure between the RCS and the ruptured steam generator is shown in Figure 15.4-97f. Figure 15.4-97g shows that the primary to secondary leakage continues after the safety injection flow is stopped until the RCS and ruptured steam generator pressures equalize.

The ruptured steam generator water volume for the transient is shown in Figure 15.4-97h. The mass of water in the ruptured steam generator is also shown as a function of time in Figure 15.4-97i.

Mass Releases The mass releases are determined for use in evaluating the site boundary and low population zone radiation exposure. The steam releases from the ruptured and intact steam generators, the feedwater flows to the ruptured and intact steam generators, and primary to secondary break flow into the ruptured steam generator are determined for the period from accident initiation until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the accident and from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident. The releases for 0-2 hours are used to calculate the radiation doses at the site boundary for a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> exposure, and the releases for 0-8 hours are used to calculate the radiation doses at the low population zone for the duration of the accident.

The operator actions for the SGTR recovery up to the termination of primary to secondary leakage are simulated in the LOFTTR2 analysis. Thus, the steam releases from the ruptured and intact steam generators, the feedwater flows to the ruptured and intact steam generators, and the primary to secondary leakage into the ruptured steam generator are determined from the LOFTTR2 results for the period from the initiation of the accident until the leakage is terminated.

Following the termination of leakage, actions are taken to cooldown the plant to cold shutdown conditions. The power operated relief valves for the intact steam generators can be used to cool down the RCS to the RHR system operating temperature of 350°F, at the maximum allowable cooldown rate of 100°F/hr. The steam releases and the feedwater flows for the intact steam generators for the period from leakage termination unit two hours are then determined from a mass and energy balance using the calculated RCS and intact steam generator conditions at the time of leakage termination and at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The RCS cooldown is continued after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> until the RHR 15.4-30 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 system in-service temperature of 350 °F is reached. Depressurization of the ruptured steam generator can be performed to the RHR in-service pressure of 395 psia via steam release from the ruptured steam generator power operated relief valve. The RCS pressure is also reduced concurrently as the ruptured steam generator is depressurized. Therefore, the analysis assumes that the continuation of the RCS cooldown and depressurization to RHR operating conditions are completed within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident since there is ample time to complete the operations during this time period. The steam releases and feedwater flows from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> are then determined for the intact and ruptured steam generators from a mass and energy balance using the conditions at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and at the RHR system in-service conditions.

After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, plant cooldown to cold shutdown as well as long-term cooling can be provided by the RHR system. Therefore, the steam releases to the atmosphere are terminated after RHR cut-in, assumed to be reached at 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

For the time period from initiation of the accident until leakage termination, the releases are determined from the LOFTTR2 results for the time prior to reactor trip and following reactor trip. Since the condenser is in service until reactor trip, any radioactivity released to the atmosphere prior to reactor trip would be through the condenser vacuum exhaust. After reactor trip, the releases to the atmosphere are assumed to be via the steam generator power operated relief valves. The mass release rates to the atmosphere from the LOFTTR2 analysis are presented in Figure 15.4-97j and 15.4-97k for the ruptured and intact steam generators, respectively, for the time period until leakage termination. The mass releases calculated from the time of leakage termination until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and from 2-8 hours were also assumed to be released to the atmosphere via the steam generator power operated relief valves. The mass releases for the SGTR event for the 0-2 hour and 2-8 hour time intervals considered are presented in Table 15.4-22.

In addition to the mass releases, information is developed for use in performing the offsite radiation dose analysis. The time dependent fraction of rupture flow that flashes to steam and is assumed to be immediately released to the environment is presented in Figure 15.4-97e. The break flow flashing fraction is conservatively calculated assuming that 100% of the break flow comes from the hot leg side of the steam generator, whereas the break flow actually comes from both the hot leg and cold leg sides of the steam generator. The water level relative to the top of the tubes in the ruptured and intact steam generators is shown in Figure 15.4-97m. The water above the steam generator tubes reduces the iodine content of the atmospheric release by scrubbing the steam bubbles as they rise from the rupture to the water surface. Figure 15.4-97m indicates that the tubes are always completely covered throughout the SGTR event. However, even if partial tube uncovery were to occur, and that is not predicted, the increase in iodine release would be negligible. This result for tube uncovery is described in References [39] and [40]. Reference [41] provides NRC approval of References [39] and [40] and states that no further evaluation of steam generator tube uncovery is required.

CONDITION IV - LIMITING FAULTS 15.4-31

WATTS BAR WBNP-89 15.4.3.3 Conclusions A steam generator tube rupture will cause no subsequent damage to the reactor coolant system or the reactor core. An orderly recovery from the accident can be completed even assuming simultaneous loss of offsite power. The results of the thermal and hydraulic analysis are used to evaluate the environmental consequences of the postulated SGTR. The results of the environmental consequences analysis are presented in Section 15.5.5.

15.4.4 Single Reactor Coolant Pump Locked Rotor 15.4.4.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor such as is discussed in Section 5.5.1.3.5.

Flow through the affected reactor coolant loop is rapidly reduced, leading to initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

The consequences of a locked rotor are very similar to those of a pump shaft break.

The initial rate of reduction of coolant flow is greater for the locked rotor event.

However, with a failed shaft, the impeller could conceivably be free to spin in the reverse direction as opposed to being fixed in position as assumed for a locked rotor.

The effect of such reverse spinning is a slight decrease in the endpoint (steady-state) core flow when compared to the locked rotor. Only one analysis is performed, representing the most limiting condition for the locked rotor and pump shaft break accidents.

15.4.4.2 Analysis of Effects and Consequences Method of Analysis Two digital-computer codes are used to analyze this transient. The LOFTRAN[11] Code is used to calculate the resulting loop and core flow transient following the pump seizure, the time of reactor trip, based on the loop flow transients, the nuclear power 15.4-32 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-89 following reactor trip, and the reactor coolant system peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the FACTRAN[12]

Code, using the core flow and the nuclear power calculated by LOFTRAN. The FACTRAN Code includes a film boiling heat transfer coefficient.

One reactor coolant pump seizure has been analyzed for a locked rotor/shaft break with four loops in operation.

The accident is evaluated without offsite power available. For the evaluation, power is assumed to be lost to the unaffected pumps instantaneously after reactor trip. At the beginning of the postulated locked rotor accident, i.e. at the time the shaft in one of the reactor coolant pumps in assumed to seize, the plant is assumed to be in operation under the most adverse steady state operating conditions, i.e., maximum steady state power level, maximum steady state pressure, and maximum steady state coolant average temperature.

When the peak pressure is evaluated, the initial pressure is conservatively estimated as 46 psi above nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. To obtain the maximum pressure in the primary side, conservatively high loop pressure drops are added to the calculated pressurizer pressure. The pressure response shown in Figure 15.4-15 is at the point in the reactor coolant system having the maximum pressure.

Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion effect.

Rod motion is assumed to begin 1.2 seconds after the flow in the affected loop reaches 87% to nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip.

Although these systems are expected to function and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.

The pressurizer safety valves are full open at 2580 psia and their capacity for steam relief is as described in Section 5.2.2.

Evaluation of DNB in the Core During the Accident For this accident, DNB is assumed to occur in the core and, therefore, an evaluation of the consequences with respect to fuel rod thermal transients is performed. Results obtained from analysis of the 'hot spot' condition represent the upper limit with respect to clad temperature and zirconium water reaction.

Film Boiling Coefficient The film boiling coefficient is calculated in the FACTRAN Code using the Bishop-Sandberg-Tong film boiling correlation[19]. The fluid properties are evaluated at film temperature (average between wall and bulk temperatures).

CONDITION IV - LIMITING FAULTS 15.4-33

WATTS BAR WBNP-80 The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density and mass flow rate as a function of time are used as program input.

For this analysis, the initial values of the pressure and the bulk density are used throughout the transient since they are the most conservative with respect to clad temperature response. For conservatism, DNB was assumed to start at the beginning of the accident.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a presounded influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad.

Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-°F at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient.

Zirconium Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium steam reaction.

2 d(w ) 6 45, 000

---

= 33.3 x 10 exp - ------------------

dt 1.986T where:

w = amount reacted, mg/cm2 t = time, sec T = temperature, °K The reaction heat is 1510 cal/gm Results The calculated sequence of events is shown on Table 15.4-1. The transient results without offsite power available are shown in Figures 15.4-15 through 15.4-20. The peak reactor coolant system pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits. Also, the peak clad surface temperature is considerable less than 2700 °F. It should be noted that the clad temperature was conservatively calculated assuming that DNB occurs at the initiation of the transient. The results of these calculations (peak pressure, peak 15.4-34 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 clad temperature, and zirconium-steam reaction) are also summarized in Table 15.4-10.

15.4.4.3 Conclusions (1) Since the peak reactor coolant system pressure reached during any of the transients is less than that which cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

(2) Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2700°F, and the amount of zirconium-water reaction is small, the core will remain in place and intact with no consequential loss of core cooling capability.

15.4.5 Fuel Handling Accident 15.4.5.1 Identification of Causes and Accident Description The accident is defined as dropping of a spent fuel assembly onto the fuel storage area floor resulting in the rupture of the cladding of all the fuel rods in the assembly despite many administrative controls and physical limitations imposed on fuel handling operations. Dropping a fuel assembly in the spent fuel pool has been analyzed and will not result in criticality.[43]

15.4.5.2 Analysis of Effects and Consequences For the analyses and consequences of the postulated fuel handling accident, refer to Section 15.5.6.

15.4.6 Rupture of a Control Rod Drive Mechanism Housing (Rod Cluster Control Assembly Ejection) 15.4.6.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.6.1.1 Design Precautions and Protection Certain features in Westinghouse pressurized water reactors are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high power levels.

CONDITION IV - LIMITING FAULTS 15.4-35

WATTS BAR WBNP-86 Mechanical Design The mechanical design is discussed in Section 4.2. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:

(1) Each full length control rod drive mechanism housing was completely assembled and shop tested at 4100 psi.

(2) The mechanism housings were individually hydrotested after being attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.

(3) Stress levels in the mechanism are not be affected by anticipated system transients at power, or by the thermal movement of the coolant loops.

Moments by the design earthquake are acceptable within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.

(4) The latch mechanism housing and rod travel housing are each a single length of forged Type-304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated by compensating for fuel depletion and xenon oscillations with changes to the boron concentration. Typically the control rods are not deeply inserted. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident.

Therefore, should a RCCA be ejected from its normal position during full power operation, a less severe reactivity excursion could be expected to occur.

However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level.

Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCA's approaches its insertion limit or if one RCCA deviates from its bank. Operating instruction requirements are as specified in Technical Specifications 3.1.5, 3.1.6 and 3.1.7.

15.4-36 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Reactor Protection The reactor protection in the event of a rod ejection accident has been described in Reference [14]. The protection for this accident is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are described in detail in Section 7.2.

Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings leading to an increase in severity of the initial accident.

Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor coolant pressure of 2250 psia. The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the steel tube.

If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings.

If the adjacent housings were on the periphery, they might bend outward from their bases. The housing material is quite ductile; plastic hinging without cracking would be expected. Housings adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.

Effect of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, the broken-off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil stack assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When the projectile reached the missile shield it would partially penetrate the shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield.

If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. The top end plates of the position indicator coil stack assemblies would prevent the broken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage.

Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected CONDITION IV - LIMITING FAULTS 15.4-37

WATTS BAR WBNP-80 to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.

Summary The considerations given above lead to the conclusion that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase severity of the initial accident.

15.4.6.1.2 Limiting Criteria Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy, have been carried out as part of the SPERT project by the Idaho Nuclear Corporation[15]. Extensive tests of UO2 zirconium clad fuel rods representative of those in Pressurized Water Reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm.

However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT[13] results, which indicated that this threshold decreases by about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm or unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure rise) even for irradiated rods, did not occur below 300 cal/gm.

In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are:

(1) Average fuel pellet enthalpy at the hot spot to be below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.

(2) Average clad temperature at the hot spot to be below 3000 °F and a zirconium-water reaction at the hot spot to be below 16%.

(3) Peak reactor coolant pressure less than that which would cause stresses to exceed the faulted condition stress limits. This criteria is generically addressed in Reference [16].

(4) Fuel melting will be limited to less than the innermost 10% of the fuel pellet at the hot spot even if the average fuel pellet enthalpy at the hot spot is below the limits of criterion 1 above.

15.4-38 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 15.4.6.2 Analysis of Effects and Consequences Method of Analysis The calculation of the RCCA ejection transient is performed in two stages: first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation.

The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient.

A detailed discussion of the method of analysis can be found in Reference [16].

Average Core Analysis The spatial kinetics computer code, TWINKLE[17], is used for the average core transient analysis. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feedback affects. In this analysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement and the elimination of axial feedback weighting factors. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Section 15.1.9.

Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod.

Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region will necessarily be depressed.

The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN[12]. This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation[19] to determine the film boiling coefficient after DNB. The DNB heat flux is not calculated, instead the code CONDITION IV - LIMITING FAULTS 15.4-39

WATTS BAR WBNP-80 is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady state temperature distribution to agree with the fuel heat transfer design codes presently in use by Westinghouse. Further description of FACTRAN appears in Section 15.1.9.

System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.

The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in a plant transient computer code. This code calculates the pressure transient taking into account fluid transport in the reactor coolant system and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.

Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below.

Table 15.4-12 presents the parameters used in this analysis.

Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three dimensional static methods or by synthesis method employing one dimensional and two dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions and part length rod positions are considered in the calculation.

Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.

Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions.

Reactivity changes were compared and effective weighting factors determined. These 15.4-40 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 weighting factors take the form of multipliers which when applied to single channel feedbacks correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, the axial weighting is not necessary. In addition, no weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three dimensional analysis[16].

Moderator and Doppler Coefficient The critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.

The Doppler reactivity defect is determined as a function of power level using a one dimensional steady state computer code with a Doppler weighting factor of 1.0. The resulting curve is conservative compared to design predictions for this plant. The Doppler weighting factor should be larger than 1.0 (approximately 1.2), just to make the present calculation agree with design predictions before ejection. This weighting factor will increase under accident conditions, as discussed above.

Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction eff typically yield values no less than O.70% at beginning-of-life and 0.50% at end-of-life for the first cycle. The accident is sensitive to if the ejected rod worth is equal to or greater than as in zero power transients. In order to allow for future cycles, conservative estimates of of 0.66% at beginning-of-cycle and 0.44% at end-of-cycle were used in the analysis.

Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 15.4-12 and includes the effect of one stuck RCCA. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod notion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay is assumed to consist of 0.2 seconds for the instrument channel to produce a signal, 0.15 seconds for the trip breaker to open and 0.15 seconds for the coil to release the rods. A curve of trip rod insertion versus time was used which assumed that insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is a particularly important conservatism for a full-power accident. The rod ejection transient was evaluated at thermal design flow rate with the corresponding rod drop time.

The minimum design shutdown margin available for this plant at HZP may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, and adverse xenon distribution and positioning of the part length rods, conservative Doppler and moderator defects, and an allowance for calculational CONDITION IV - LIMITING FAULTS 15.4-41

WATTS BAR WBNP-80 uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCA's (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1% k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The safety injection system is actuated on low pressurizer pressure within one minute after the break. The reactor coolant system pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2% k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated (1950 ppm) safety injection flow starting one minute after the break is much more than sufficient to ensure that the core remains sub-critical during the cooldown.

Results Cases are presented for both beginning and end-of-life at zero and full power.

In the full power cases, control bank D was assumed to be inserted to its insertion limit.

In the zero power cases, control bank D was assumed to be fully inserted, and control banks B and C were assumed to be at their insertion limits.

The results for these cases are summarized in Table 15.4-12. In all cases the maximum fuel pellet average enthalpy is well below that which could cause sudden cladding failure, the maximum clad average temperature is below the point of clad embrittlement, and fuel melting, if any, is limited to less than 10% of the fuel cross-section at the hot spot.

The nuclear power and hot spot fuel and clad temperature transients for the worst cases (beginning-of-life full power and end-of-life zero power) are presented in Figures 15.4-24 through 15.4-27.

Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB.

In all cases considered, less than 10% of the rods entered DNB based on a detailed 3 dimension THINC analysis[16]. Although limited fuel melting at the hot spot was predicted for the full power cases, in practice melting is not expected since the analysis conservatively assumed that the hot spots before and after ejection were coincident.

Pressure Surge A detailed calculation of the pressure surge for an ejection worth 1 dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that 15.4-42 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 which would cause stress to exceed the faulted condition stress limits[16]. Since the severity of the present analysis does not exceed this "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the reactor coolant system.

Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in this ratio at the hot spot.

The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

15.4.6.3 Conclusions Even on a worst-case basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further, consequential damage to the reactor coolant system. The analyses have demonstrated that upper limit in fission product release as a result of a number of fuel rods entering DNB amounts to 10%.

The environmental consequences of this accident is bounded by the loss of coolant accident. See Section 15.5.3, "Environmental Consequences of a Loss of Coolant Accident." The reactor coolant system integrated break flow to containment following a rod ejection accident is shown in Figure 15.4-28.

Following reactor trip, requirements for operator action and protection system operation are similar to those presented in the analysis of a small loss of coolant event, section 15.3.1.

CONDITION IV - LIMITING FAULTS 15.4-43

WATTS BAR WBNP-80 REFERENCES (1) Rahe, E. P., "Westinghouse ECCS Evaluation Model - 1981 Version",

WCAP-9220-P-A, Rev. 1, WCAP-9221-P-A (Nonproprietary), February 1982.

(2) Besspiata, J. J., et al., "The 1981 Version of the Westinghouse ECCS Evaluation Model Using BASH Code," WCAP-10266-P-A, Revision 2, (proprietary) WCAP-11524-A, Revision 2, (Nonproprietary), March 1987.

(3) Bordelon, F. M., et al., "SATAN-VI Program: Comprehensive Space-Time Dependent Analysis of Loss of Coolant," WCAP-8306 (non-proprietary) and WCAP-8302 (Proprietary), June 1974.

(4) Kelly, R. D., et al., "Calculational Model for Core Reflooding After A Loss-of-Coolant Accident (W REFLOOD) Code"; WCAP-8171 (non-proprietary) and WCAP-8170 (Proprietary), June 1974.

(5) Hsieh, T., and Raymund, M., "Long Term Ice Condenser Transient Analysis (LOTIC II)," WCAP-8355 Supplement 1, May 1975 and WCAP-8354 (Proprietary), July 1974.

(6) Rahe, E. P., (Westinghouse) letter to R.L. Tedesco (USNRC), NS-EPR 38, December 1981.

(7) Deleted by Amendment 63.

(8) Deleted by Amendment 80.

(9) Moody, F. S., "Transactions of the ASME, Journal of Heat Transfer," Figure 3, Page 134, February 1965.

(10) Deleted Amendment 80.

(11) Burnett, T. W. T., et. al., "LOFTRAN Code Description," WCAP-7907-P-A (proprietary) and WCAP-7907-A (non-proprietary), April 1984.

(12) Hunin, C., "FACTRAN, A FORTRAN IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, July 1972.

(13) Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO2-Core Simulated Fuel Elements," ANL-7225, January - June 1966, p.

177, November 1966.

(14) Burnett, T. W. T, "Reactor Protection System Diversity in Westinghouse Pressurized Water Reactors," WCAP-7306, April 1969.

(15) Taxelius, T. G., "Annual Report - Spert Project, October 1968, September 1968," Idaho Nuclear Corporation IN-1370, June 1970.

15.4-44 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 (16) Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods,"

WCAP-7588, Revision 1-A, January 1975.

(17) Barry, R. F., and Risher, D. H., Jr., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A, January 1975 (Proprietary) and WCAP-8208-A, January 1975 (Non-Proprietary).

(18) Deleted by Amendment 80.

(19) Bishop, A. A., et al., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965.

(20) Anderson, F. D., et al., "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, March 1962.

(21) Branch Technical Position CSB 6-2, "Control of Combustible Gas Concentrations in Containment Following a Loss-of Coolant Accident."

(22) Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for July - August 1968," ORNL-TN-2368, November 1968.

(23) Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for September - October 1968," ORNL-TN-2425, p. 53, January 1969.

(24) Bell, M. J, et al., "Post-LOCA Hydrogen Generation in PWR Containments,"

Nuclear Technology 10, 420-422, (1971).

(25) American Nuclear Society Standary ANSI/ANS-5.1-1979, "Decay Heat Power in Light-Water Reactors," August 29, 1979.

(26) Row, T. H., and Zittel, H. E., "Radiation and Thermal Stability of Spray Solutions," Nuclear Technology 10, 436-443, (1971).

(27) Allen, A. O., "The Radiation Chemistry of Water and Aqueous Solutions,"

Princeton, N. J., Van Nostrand, 1961.

(28) Deleted by Amendment 80.

(29) Deleted by Amendment 80.

(30) Chelmer, H., Wiseman, J., and Tong, L. S., Subchannel Thermal Analysis of Rod Bundle Core (THINC III)" WCAP-7015 R1, dated January 1969.

(31) Deleted by Amendment 80.

(32) USNRC Regulatory Guide 1.7, Revision 2, November 1978, "Control of Combustible Gas Concentrations in Containment Following a Loss of Coolant Accident".

CONDITION IV - LIMITING FAULTS 15.4-45

WATTS BAR WBNP-92 (33) "American National Standard for Decay Heat Power in Light Water Reactors,"

ANSI/ANS-5.1-1979, August 1979.

(34) Rupprecht, S. D, et. al., "Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP-11145-P-A (Proprietary), WCAP-11372 (Non-Proprietary), October 1986.

(35) U.S. Nuclear Regulatory Commission, Code Federal Regulations - Energy 10, Chapter 1, Part 50, Section 50.46(c), "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors."

(36) Westinghouse Emergency Core Cooling System Plant Sensitivity Studies,"

WCAP-8340 (Proprietary), July 1974.

(37) Devault, R. M., Smith, J. D., and Studer, P. G., "MONSTER - A Multi-Compartment Containment System Analysis Program User Manual," System I.D. 262303, March 1993.

(38) Monahan, J. S., and White, D. W., "LOFTTR2 Analysis for a Steam Generator Tube Rupture for Watts Bar Nuclear Plant Units 1 and 2," WCAP-13575, Revision 1 (Proprietary), and WCAP-13576, Revision 1 (Non-Proprietary), October 1993.

(39) Letter from Walsh, L. A., Westinghouse Owners Group, to Jones, R. C., U.S.

Nuclear Regulatory Commission, "Steam Generator Tube Uncovery Issue,"

OG-92-25, March 1992.

(40) "Report on the Methodology for the Resolution of the Steam Generator Tube Uncovery Issue," WCAP-13247 (Proprietary), March 1992.

(41) Letter from Jones, R. C., U.S. Nuclear Regulatory Commission, to Walsh, L.

A., Westinghouse Owners Group, "Steam Generator Tube Uncovery Issue,"

March 10, 1993.

(42) Watts Bar "Design Basis Events Design Criteria", Document WB-DC-40-64.

(43) Criticality Analysis Summary Report for Watts Bar Nuclear Plant, Document Number PFE-R07, Tennessee Valley Authority Nuclear Fuels Deplartment (L38 961015 802).

15.4-46 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-89 Table 15.4-1 Time Sequence Of Events For Condition Iv Events (Page 1 of 2)

Accident Event Time (Seconds)

Major Reactor Coolant See Table 15.4-17 System Pipe Ruptures, Double-Ended Cold Leg Guillotine Major Secondary System Pipe Rupture

1. Case A Complete severence of a pipe, Steam Line Ruptures 0.0 loss of offsite power simultaneous Low Steam Pressure Setpoint with the break and initiation of Reached 0.63 safety injection signal Pressurizer Empties 11.0 Criticality Attained 22.4 Boron Reaches Core 56.8

2. Case B Complete severence of a pipe, Steam Line Ruptures 0.0 offsite power available Low Steam Pressure Setpoint Reached 0.63 Pressurizer Empties 12.0 Criticality Attained 24.8 Boron Reaches Core 73.6 Reactor Coolant Pump Shaft Seizure (Locked Rotor/Broken Shaft)

All pumps in operation, Rotor on one pump seizes 0 one shaft seizure without offsite power available Low flow trip point reached 0.02 Rods begin to drop 1.22 Undamaged pumps lose power and begin 1.22 coasting down Maximum RCS pressure 3.6 occurs Maximum clad temperature 4.0 occurs CONDITION IV - LIMITING FAULTS 15.4-47

WATTS BAR WBNP-80 Table 15.4-1 Time Sequence Of Events For Condition Iv Events (Page 2 of 2)

Accident Event Time (Seconds)

Rod Ejection BOL EOL HFP HZP RCCA Ejected 0.0 0.0 Reactor Trip Setpoint Reached 0.06 0.162 Peak Nuclear Power 0.14 0.192 Rods Drop 0.56 0.662 Peak Fuel Average Temperature is 2.32 1.74 Reached Peak Clad Temperature is Reached 2.37 1.42 Peak Heat Flux 2.38 1.42 15.4-48 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-2 Post-Accident Containment Temperature Transient Used In The Calculation Of Aluminum And Zinc Corrosion Time Interval (seconds) Temperature (°F) 0 - 1,000 240 1,000 - 2,000 190 2,000 - 3,000 180 3,000 - 10,000 200 10,000 - 100,000 190

> 100,000 153*(147**)

• Past 100,000 seconds, the long-term aluminum corrosion rate of 200 mils/year specified in Regulatory Guide 1.7 is used for the NRC basis calculation. The corresponding temperature is 153°F.

• • The temperature of 147°F corresponds to the Westinghouse basis long-term aluminum corrosion rate of 150 mils/year.

CONDITION IV - LIMITING FAULTS 15.4-49

WATTS BAR WBNP-80 Table 15.4-3 Parameters Used To Determine Hydrogen Generation Power Level 3,565 Mwt Containment Free Volume 1,230,000 ft3 Containment Temperature at Accident 120°F Weight Zirconium Cladding 45,232 Hydrogen Generated Zirconium-Water Reaction Based on 1.5% Value 5,360 Standard ft3 Based on 0.23 Mil 3,653 Standard ft3 Based on 5.0% Value117,001 Standard ft3 Hydrogen from Primary Coolant System 1,120 Standard ft3 Corrodable MetalAluminum, Zinc 1

Based on Regulatory Guide 1.7, Revision 2, using 5 times the amount calculated per 10CFR50.46.

Inventory Of Aluminum And Zinc In Containment Surface Description Weight (lbs) Area (ft2)

Aluminum components 1,975 767 Galvanized zinc sources 92,312 571,519 Inorganic zinc paint sources 83,162 977,834 15.4-50 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-4 Core Fission Product Energy After 650 Full Power Days Core Fission Product Energy*

Time After Reactor Trip Energy Release Rate Integrated Energy Release (Days) (watts/MWt x 10-3) (watt days/MWt x 10-4) 1 3.887 0.574 5 2.595 1.777 10 2.211 2.967 20 1.760 4.934 30 1.475 6.541 40 1.291 7.919 50 1.163 9.143 60 1.068 10.259 70 0.992 11.289 80 0.926 12.249 90 0.867 13.139 100 0.814 13.979

• Assumes release of 50% core halogens + 1% other fission products, includes 100% noble gases. Values are for total ( and ) energy.

CONDITION IV - LIMITING FAULTS 15.4-51

15.4-52 WATTS BAR Table 15.4-5 Fission Product Decay Deposition In Sump Solution 50% Halogens 1% other Fission Products TOTAL Time After Energy Release Integrated Energy Energy Release Integrated Energy Energy Release Integrated Energy Reactor Trip Rate Release Rate Release Rate Release (Days) (watt/Mwt) (watt/day/Mwtx10-2) (watt/Mwtx10-1) (watt/day/Mwtx10-2) (watt/Mwtx10-1) (watt/day/Mwtx10-3) 1 145 4.27 3.78 0.536 18.28 0.481 3 49.4 5.88 2.90 1.18 7.85 0.707 5 31.0 6.65 2.59 1.78 5.59 0.838 10 18.2 7.82 2.22 2.92 4.03 1.07 20 7.63 9.03 1.77 4.89 2.53 1.39 30 3.22 9.54 1.49 6.51 1.81 1.61 40 1.35 9.76 1.30 7.90 1.44 1.77 60 0.241 9.89 1.08 10.3 1.10 2.02 80 0.043 9.91 0.935 12.3 0.940 2.22 100 0.008 9.92 0.822 14.0 0.823 2.39 CONDITION IV - LIMITING FAULTS WBNP-80

CONDITION IV - LIMITING FAULTS WATTS BAR Table 15.4-6 Equipment Required Following A High Energy Line Break SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Reactor trip and safeguards actuation channels Auxiliary feedwater system including pumps, Steam generator power-operated relief valves including sensors, circuitry, and water supply, and system valves and piping (can be manually operated locally) processing equipment (the protection circuits (this system must be placed in service to supply used to trip the reactor on under- voltage, water to operable steam generators Controls for defeating automatic safety injection underfrequency, and turbine trip may be no later than 10 minutes after the incident). actation during a cooldown and excluded). depressurization.

Safety injection system including the pumps, the Capability for obtaining a reactor coolant Residual heat removal system including pumps, refueling water storage tank, and the systems systemsample. heat exchanger, and system valves valves and piping. and piping necessary to cool and maintain the reactor coolant system in a cold shutdown condition Diesel generators and Lower compartment cooling fans must be started emergency power distribution equipment. (a minimum of 2 of 4) 1-1/2 hours to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initiation of HELB.

Essential raw cooling water Ice condenser.

system Containment safeguards cooling equipment. Air return fan to recirculate air thru ice condenser.

Main feedwater control Containment spray to maintain hot standby lower valves* (trip closed compartment temperature.

feature).

15.4-53 WBNP-80

Table 15.4-6 Equipment Required Following A High Energy Line Break 15.4-54 WATTS BAR SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Bypass feedwater control valves* (trip closed feature).

Circuits and/or equipment required to trip the main feedwater pumps.*

Main steam line stop valves* (Main Steam Isolation Valves trip closed feature).

Main steam line stop valve bypass valves* (trip closed feature).

Steam generator blowdown isolation valves (automatic closure feature).

Batteries (Class 1E).

Control room ventilation.

Control room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.

CONDITION IV - LIMITING FAULTS WBNP-80

Table 15.4-6 Equipment Required Following A High Energy Line Break CONDITION IV - LIMITING FAULTS WATTS BAR SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Emergency lighting.

Post accident monitoring system**

Wide range Thot or Tcold for each reactor coolant loop.

Pressurizer water level.

Wide range reactor coolant system pressure Steam line pressure for each steam generator.

Wide range and narrow range steam generator level for each steam generator.

Containment pressure

• Required for steam line, feed line, and steam generator blowdown line break only.

• • See Section 7.5 for a discussion of the post accident monitoring system.

15.4-55 WBNP-80

WATTS BAR WBNP-80 Table 15.4-7 Limiting Core Parameters Used In Steam Break DNB Analysis Reactor vessel inlet temperature (°F)

Faulted SG Loop 341.6 Intact SG Loops 478.2 RCS pressure (psia) 671.0 RCS flow fraction of nominal (%) 100 Heat flux fraction of nominal (%) 17.7 Reactivity (%) 0.004 Density (gm/cc) 0.827 Boron (ppm) 8.94 Time (seconds) 196.2 15.4-56 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-8 Deleted by Amendment 80 CONDITION IV - LIMITING FAULTS 15.4-57

WATTS BAR WBNP-89 Table 15.4-9 Time Sequence Of Events For Feedline Break Event Time (seconds)

With Offsite Power Without Offsite Power Feedline rupture occurs 10 10 Pressurizer relief valve setpoint reached 22 22 Low-low steam generator level reactor trip and 36 36 auxiliary feedwater pump start setpoint reached in affected steam generator Rods begin to drop 38 38 Auxiliary feedwater starts to intact steam generators 96 96 Cold auxiliary feedwater reaches intact steam 260 260 generators Low steamline pressure setpoint reached 366 442 All main steam stop (main steam isolation) valves 373 449 closed Pressurizer water relief begins 1734 5636 Core power decreases to auxiliary feedwater removal -4600 -1800 capacity 15.4-58 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-89 Table 15.4-10 Summary Of Results For Locked Rotor Transients 4 Loops Operating Initially Maximum reactor coolant system pressure (psia) 2659 Maximum clad temperature at core hot spot (EF) 1795 Zr-H2O reaction at core hot spot

(% by weight) 0.3%

CONDITION IV - LIMITING FAULTS 15.4-59

WATTS BAR WBNP-80 Table 15.4-11 Deleted by Amendment 80 15.4-60 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-12 Parameters Used In The Analysis Of The Rod Cluster Control Assembly Ejection Accident Time in Life Beginning Beginning End End Power Level, % 102 0 102 0 Ejected rod worth, %K 0.200 0.725 0.210 0.970 Delayed neutron fraction, % 0.66 0.66 0.44 0.44 Trip Reactivity, % K 4.0 2.0 4.0 2.0 Fq before rod ejection 2.50 -- 2.50 --

Fq after rod ejection 6.70 10.60 7.25 23.0 Number of operational pumps 4 2 4 2 Results with Thermal Design Flow:

Max. fuel pellet average 3954 2443 3833 3719 temperature, °F Max. fuel center temperature, °F 4952 2856 4853 4173 Max. clad average temperature, °F 2198 1817 2143 2883 Max. fuel stored energy, 172 98 166 160 cal/gm CONDITION IV - LIMITING FAULTS 15.4-61

WATTS BAR WBNP-80 Table 15.4-13 Parameters Recommended For Determining Radioactivity Releases For Rod Ejection Accident Failed fuel 10% of fuel rods in core Activity released to reactor coolant from failed fuel and available for release Noble gases 10% of gap inventory Iodines 10% of gap inventory Melted fuel 0.25% of core Activity released to reactor coolant from melted fuel and available for release Noble gases 0.25% of core inventory Iodines 0.125% of core inventory Steam dump from relief valves 59,000 lbs Duration of dump from relief valves 140 sec Time between accident and equilization of primary 300 sec and secondary system pressures 15.4-62 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-14 Containment Data Required For Eccs Evaluation Ice Condenser Containment (Page 1 of 3)

I. Conservatively High Estimate of Containment Net Free Volume CONTAINMENT VOLUME IN FT3 Upper Compartment 651,000 Lower Compartment 253,100 Ice Condenser 181,400 Dead-Ended Compartments (includes all accumulator rooms, both fan compartments, instrument room, pipe tunnel) 129,900 1,215,400 II.Initial Conditions A.Lowest Operational Containment Pressure -0.1 psi B.Highest Operational Containment Temperature 110°F UC for the Upper, Lower, and Dead-Ended 120°F LC Compartments* 120°F DE C.Lowest Refueling Water Storage Tank Temperature 60°F D.Lowest Service Water Temperature 41°F E.Lowest Temperature Outside Containment 5°F F.Lowest Initial Spray Temperature 60°F G.Ice Condenser Temperature Max. + 15°F H.Lowest Annulus Temperature 40°F III.Structural Heat Sinks CONDITION IV - LIMITING FAULTS 15.4-63

WATTS BAR WBNP-80 Table 15.4-14 Containment Data Required For Eccs Evaluation Ice Condenser Containment (Page 2 of 3)

A. For Each Surface 1.Description of Surface 2.Conservatively High Estimate of Area See Table 15.4-15 Exposed to Containment Atmosphere 3.Location in Containment by Compartment

• Maximum operational temperatures (minimum air mass and minimum peak air pressure)

B. For Each Separate Layer of Each Surface 1.Material 2.Conservatively Large Estimate of Layer Thickness See Table 15.4-15 3.Conservatively High Value of Material See Table 15.4-15 Conductivity 4.Conservatively High Value of Volumetric See Table 15.4-15 Heat Capacity IV.Spray System A. Runout Flow for One Spray Pump*** (Containment 4650 gpm Spray)

B. Number of Spray Pumps Operating with No Diesel Failure 2/Unit C. Number of Spray Pumps Operating with One Diesel Failure 1/Unit D. Fastest Post-Accident Initiation of Spray System without Offsite Power**

221 sec V.Deck Fan (Containment Air Return Fans)

A. Fastest Post-Accident Initiation of Deck Fans 10 min B. Conservatively High Flow Rate Per Fan 42,000 cfm VI.Conservatively Low Hydrogen Skimmer System Flow Rate 100 cfm ea 15.4-64 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-14 Containment Data Required For Eccs Evaluation Ice Condenser Containment (Page 3 of 3)

• • Delay time consists of a load sequencing time delay of 100 seconds plus 13 seconds for error tolerances plus 28 seconds for diesel generator startup and signal processing. The last analysis utilized 135 seconds, however 221 seconds has been justified (to permit relaxation of diesel generator loading) due to the heat removal effectiveness of the Watts Bar ice condenser. The sprays have minimal effect on the analysis of the ice condenser while ice remains. Therefore, the sprays do not remove energy from the containment atmosphere until the ice is melted (about 3600 seconds). Thus, the peak containment pressure remains essentially unaffected by the longer spray pump actuation delay.

• • • Runout flow is determined utilizing conservatively low containment spray system piping resistance and "0" psig containment pressure.

CONDITION IV - LIMITING FAULTS 15.4-65

WATTS BAR WBNP-80 Table 15.4-15 Major Characteristics Of Structural Heat Sinks Inside Containment Upper Compartment (Page 1 of 3)

Heat Thickness Volume Transfer and Thermal Heat Area Material Conductivity Capacity Structure (ft2) (As Noted) (Btu/ft-Hr-°F) (Btu/ft3-°F)

Operating Deck 4,452 1.1 ft concrete 0.84 30.24 7,749 6.3 mils coating 0.087 29.8 1.25 ft concrete 0.84 30.24 672 1.6 ft concrete 0.84 30.24 11,445 6.3 mils coating 0.087 1.6 ft concrete 0.84 30.24 4,032 0.26 in. stainless steel 9.87 59.22 1.6 ft concrete 0.84 30.24 798 15.7 mils coating 0.087 29.8 1.6 ft concrete 0.84 30.24 Containment Shell 25,985 7.8 mils coating 0.21 29.8 1.3 in. carbon steel 27.3 59.22 10,450 7.8 mils coating 0.21 29.8 0.78 in. carbon steel 27.3 59.22 11,365 7.8 mils coating 0.21 29.8 0.98 in. carbon steel 27.3 59.22 Miscellaneous Steel 4,095 7.8 mils coating 0.21 29.8 0.26 carbon steel 27.3 59.22 3,559 7.8 mils coating 0.21 29.8 0.46 in. carbon steel 27.3 59.22 3,538 7.8 mils coating 0.21 29.8 0.72 in. carbon steel 27.3 59.22 273 7.8 mils coating 0.21 29.8 1.57 in. carbon steel 27.3 59.2 Operating Deck 7,300 1.1 ft concrete 0.84 30.24 2,971 1.6 mils coating 0.087 29.8 1.1 ft concrete 0.84 30.24 2,131 1.75 ft concrete 0.84 30.24 798 6.3 mils coating 0.087 29.8 1.84 ft concrete 0.84 30.24 2,646 2.1 ft concrete 0.84 29.8 30.24 15.4-66 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-15 Major Characteristics Of Structural Heat Sinks Inside Containment Upper Compartment (Continued) (Page 2 of 3) 210 6.3 mils coating 0.087 29.8 2.1 ft concrete 0.84 30.24 Crane Wall 14,710 1.6 ft concrete 0.84 30.24 3,970 6.3 mils coating 0.087 29.8 1.6 ft concrete 0.84 30.24 Containment Floor 567 1.6 ft concrete 0.84 30.24 7.612 6.3 mils coating 0.087 29.8 1.6 ft concrete 0.84 30.24 Interior Concrete 3,780 1.1 ft concrete 0.84 30.24 567 1.1 ft concrete 0.84 30.24 2,992 2.1 ft concrete 0.84 30.24 2,384 0.26 in. stainless steel 2.1 9.8 59.2 ft concrete 0.84 30.24 2,373 2.1 ft concrete 0.84 30.24 1,480 6.3 mils coating 0.087 29.8 2.1 ft concrete 0.84 30.24 Miscellaneous Steel 12,915 7.8 mils coating 0.22 14.7 5.3 in. carbon steel 27.3 59.2 7,560 7.8 mils coating 0.22 14.7 0.78 in. carbon steel 27.3 59.2 5,250 7.8 mils coating 0.22 14.7 1.1 in. carbon steel 27.3 59.2 2,625 7.8 mils coating 0.22 14.7 1.45 in. carbon steel 27.3 59.2 1,575 7.8 mils coating 0.22 14.7 1.7 in. carbon steel 27.3 59.2 CONDITION IV - LIMITING FAULTS 15.4-67

WATTS BAR WBNP-80 Table 15.4-15 Major Characteristics Of Structural Heat Sinks Inside Containment Upper Compartment (Continued) (Page 3 of 3)

Containment Shell 3,190 7.8 mils coating 0.22 14.7 0.78 in. carbon steel 27.3 59.2 2,924 7.8 mils coating 0.22 14.7 1.25 in. carbon steel 27.3 59.2 14,810 7.8 mils coating 0.22 14.7 1.37 in. carbon steel 27.3 59.2 4,520 7.8 mils coating 0.22 14.7 1.51 in. carbon steel 27.3 59.2 Crane Wall 7,255 1.7 ft concrete 0.84 30.24 3,801 6.3 mils coating 0.087 14.7 1.7 ft concrete 0.84 30.24 Containment Floor 4,809 6.3 mils coating 0.087 14.7 2.1 ft concrete 0.84 30.24 Enterior Concrete 9,870 1.1 ft concrete 0.84 30.24 3,948 6.3 mils coating 0.087 14.7 1.1 ft concrete 0.84 30.24 5,376 2.0 ft concrete 0.84 30.24 15.4-68 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-16a Mass And Energy Release Rates To Containment CD= 0.6 Min Si Downflow Barrel/Baffle Internals (Initial Design) (Page 1 of 2)

Time Mass Flow Rate Energy Flow Rate (s) (lb/s) (BTU/s x 106) 0 64206 35.707 2 54461 29.574 4 36494 20.380 6 31021 17.851 8 24619 15.214 10 21585 12.873 12 17886 10.733 14 13863 8.778 16 9565 6.432 18 7014 4.884 20 4738 3.061 22 8165 3.559 24 8018 2.874 26 6249 1.688 28 4975 1.106 30 4274 0.728 31.75 1656 0.1531 38 1335 0.0735 39 193 0.0054 46 193 0.0054 52 219 0.0393 63 552 0.2367 75 562 0.2400 89 575 0.2384 104 580 0.2354 142 589 0.2278 180 632 0.2346 211 640 0.2339 256 649 0.2331 337 656 0.2317 350 658 0.2319 CONDITION IV - LIMITING FAULTS 15.4-69

WATTS BAR WBNP-80 Table 15.4-16a Mass And Energy Release Rates To Containment CD = 0.6 Min Si (Cont'd)

Upflow Barrel/Baffle Internals (Current Design After Modification) (Page 2 of 2)

Time Mass Flow Rate Energy Flow Rate (s) (lb/s) (BTU/s x 106) 0 64506 35.877 2 55557 30.225 4 37617 21.030 6 31311 18.069 8 24485 15.234 10 21547 12.845 12 17470 10.585 14 13160 8.504 16 8935 18 6534 6.150 20 6718 4.641 22 8174 3.502 24 7762 3.378 26 6165 2.591 28 4616 1.598 30.78 1481 0.947 38 1330 0.114 39 193 0.0732 46.4 193 0.0054 54 219 0.0054 64 552 0.0393 72 562 90 569 0.2367 105 580 0.2401 137 589 0.2384 170 624 0.2355 260 649 0.2279 351 658 0.2331 15.4-70 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-16b Mass And Energy Release Rates To Containment CD = 0.6 Max Si Downflow Barrel/Baffle Internals (Initial Design) (Page 1 of 2)

Time Mass Flow Rate Energy Flow Rate (s) (lb/s) (BTU/s x 106) 0 64206 35.707 2 54461 29.574 4 36494 20.380 6 31021 17.851 8 24619 15.214 10 21585 12.873 12 17886 10.733 14 13863 8.778 16 9565 6.432 18 7015 4.884 20 4740 3.061 22 8167 3.559 24 8018 2.874 26 6249 1.688 28 4975 1.106 30 4274 0.728 31.75 1657 0.1536 38 1452 0.0767 39 312 0.0087 46 312 0.0087 57 347 0.0548 66 847 0.1487 76 1237 0.2207 88 1297 0.2297 106 1312 0.2281 118 1316 0.2259 138 1320 0.2226 166 1330 0.2196 193 1359 0.2219 210 1361 0.2212 273 1370 0.2192 334 1374 0.2179 350 1376 0.2178 CONDITION IV - LIMITING FAULTS 15.4-71

WATTS BAR WBNP-80 Table 15.4-16b Mass And Energy Release Rates To Containment CD = 0.6 Max Si (Cont'd)

Upflow Barrel/Baffle Internals (Current Design After Modification) (Page 2 of 2)

Time Mass Flow Rate Energy Flow Rate (s) (lb/s) (BTU/s x 106) 0 64506 35.877 2 55557 30.225 4 37617 21.030 6 31311 18.069 8 24485 15.234 10 21547 12.845 12 17470 10.585 14 13160 8.504 16 8936 6.150 18 6534 4.641 20 6718 3.502 22 8174 3.378 24 7763 2.591 26 6165 1.598 28 4616 0.947 30.78 1481 0.114 38 1451 0.0767 39 312 0.0087 45.8 312 0.0087 57 347 0.0594 66 847 0.1487 76 1237 0.2207 93 1306 0.2297 106 1312 0.2281 138 1320 0.2226 166 1330 0.2196 273 1370 0.2192 351 1376 0.2178 15.4-72 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-17 Large Break LOCA Time Sequence Of Events Downflow Barrel/Baffle Internals (Initial Design)

(Page 1 of 2)

Break Loss coefficient: Cd= 0.4 Cd= 0.6 Cd= 0.8 Cd= 0.6 Max SI Event Reactor trip 0.52 0.51 0.50 0.51 Safety injection signal 3.15 2.86 2.75 2.86 Accumulator injection 19.7 14.9 12.4 14.9 begins End of bypass 41.35 31.75 26.06 31.75 End of blowdown 41.35 31.75 26.06 31.75 Pumped safety injection 33.15 32.86 32.75 32.86 begins Bottom of core recovery 57.27 46.39 39.85 45.82 Accumulators empty 70.4 62.2 58.3 64.4 Time of Peak Clad Temperature 287.5 281.5 265.2 234.4 Break Loss coefficient: 0.6 0.6 Max SI Event Start Reactor Trip Signal 0.0 0.0 Reactor Trip Signal 0.506 0.0 Safety injection signal 2.907 2.907 Accumulator injection 14.7 14.7 begins End of bypass 30.78 30.78 End of blowdown 30.78 30.78 Pumped safety injection 32.907 32.907 begins Bottom of core recovery 45.398 44.848 Hot Rod Burst 50.26 -

Accumulators empty 61.768 63.998 Time of Peak Clad Temperature 239.7 240.3 CONDITION IV - LIMITING FAULTS 15.4-73

WATTS BAR WBNP-80 Table 15.4-17 Large Break LOCA Time Sequence Of Events Downflow Barrel/Baffle Internals (Initial Design) (Continued)

(Page 2 of 2)

Break Loss coefficient: Cd= 0.4 Cd= 0.6 Cd= 0.8 Cd= 0.6 Max SI Event Peak cladding temperature (°F) 2161 2173 2143 2193 Elevation (ft) 7.25 6.75 6.75 6.75 Local Zr/H20 reaction max (%) 11.10 10.96 9.69 11.20 Elevation (ft) 7.25 6.75 6.50 6.75 Total Zr/H20 reaction (%) <0.3 <0.3 <0.3 <0.3 Hot rod burst time (sec) 112.0 50.6 50.7 50.6 Elevation (ft) 6.50 5.75 5.50 5.75 15.4-74 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-18 Large Break LOCA Fuel Cladding Data (Cont'd) Upflow Barrel/Baffle Internals (Current Design After Modification)

Break Loss coefficient: 0.6 0.6 Max SI Parameter Peak cladding temperature (°F) 2126 2125 Elevation (ft) 6.75 6.75 Maximum Zr/H20 reaction (%) 9.41 9.32 Elevation (ft) 6.75 6.75 Total Zr/H20 reaction (%) <0.3 <0.3 Hot rod burst time (sec) 50.26 50.25 Elevation (ft) 6.0 6.0 CONDITION IV - LIMITING FAULTS 15.4-75

WATTS BAR WBNP-80 Table 15.4-19 Plant Parameters Used In All Loca Analysis Scenarios RCS Initial Conditions Vessel flow rate (lbm/s) 38225 Core flow rate (lbm/s) 36865 Active loop flow rate (1bm/s) 9569.3 Inactive loop flow rate (1bm/s) 28707.8 Vessel inlet temperature (°F) 561.5 Pressure (psia) 2280 Cold Leg Accumulator Conditions Cover gas pressure (psia) 600 Water volume (ft3) 1050 per accumulator Water temperature (°F) 90 Line resistance (fL/D) 4.68 Calculation Assumptions Core power (MWt) 102% of 3411 Peak linear power (kW/ft) @ 102% 13.328 Peaking factor (at licensing rating) 2.4 Fh (at licensing rating) 1.58 Steam generator plugging level 10% uniform Minimum safeguards ECCS flow (lbm/s) See Table 15.4-23 15.4-76 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-20 Operator Action Times For Design-Basis Steam Generator Tube Rupture Analysis Identify and isolate ruptured SG 15.00 min or LOFTTR2 calculated time from event initiation to reach 30% narrow range level in the ruptured SG, whichever is longer Operator action time to initiate cooldown 7.15 min Cooldown Calculated by LOFTTR2 Operator action time to initiate 2.45 min depressurization Depressurization Calculated by LOFTTR2 Operator action time to initiate SI termination 4.07 min SI termination and pressure equalization Calculated by LOFTTR2 CONDITION IV - LIMITING FAULTS 15.4-77

WATTS BAR WBNP-80 Table 15.4-21 Steam Generator Tube Rupture Analysis Sequence Of Events EVENT TIME (sec)

SG Tube Rupture 0 Reactor Trip 94 Safety Injection 137 Ruptured SG Isolated 902*

Ruptured SG Atmospheric Steam Dump Valve Fails Open 904*

Ruptured SG Atmospheric Steam Dump Valve Closed 1566 RCS Cooldown Initiated 1995 RCS Cooldown Terminated 2728 RCS Depressurization Initiated 2875 RCS Depressurization Terminated 2968 SI Terminated 3212 Break Flow Terminated 4648

• Additional two seconds results from program limitations for simulating operator actions.

15.4-78 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Table 15.4-22 Steam Generator Tube Rupture Analysis Mass Release Results Total Mass Flow (Pounds) 0 - 2 HRS 2 - 8 HRS Ruptured SG

- Condenser 102,100 0

- Atmosphere 104,300 31,700

- Feedwater 131,700 0 Intact SGs

- Condenser 303,500 0

- Atmosphere 510,600 938,400

- Feedwater 975,100 947,700 Break Flow 185,500 0 CONDITION IV - LIMITING FAULTS 15.4-79

WATTS BAR WBNP-80 Table 15.4-23 Large Break Loss Of Coolant Accident Minimum Safeguards Eccs Flow Pressure Charging SI RHR Total psi lbm/s lbm/s lbm/s lbm/s 14.7 43.53 62.49 393.43 499.45 34.7 43.16 61.96 318.54 423.66 54.7 42.79 61.44 240.96 345.19 74.7 42.43 60.91 165.15 268.49 94.7 42.06 60.39 114.20 216.65 114.7 41.70 59.87 51.92 153.49 134.7 41.33 59.32 0.0 100.65 214.7 39.83 57.14 0.0 96.97 414.7 35.98 51.14 0.0 87.12 614.7 31.94 44.66 0.0 76.6 15.4-80 CONDITION IV - LIMITING FAULTS

WATTS BAR WBNP-80 Figure 15.4-1 Aluminum Corrosion in DBA Environment Condition IV - Limiting Faults 15.4-81

WATTS BAR WBNP-80 Figure 15.4-1a Zinc Corrosion in DBA Environment 15.4-82 Condition IV - Limiting Faults

WATTS BAR Condition IV - Limiting Faults WBNP-80 Figure 15.4-1b Comparison of ANS 5.1 Decay Energy Curve at 650 Days Irradiation + 20% to Decay Energy Values used for H2 Production Calculation 15.4-83

WATTS BAR WBNP-80 Figure 15.4-2 Results of Westinghouse Irradiation Tests 15.4-84 Condition IV - Limiting Faults

WATTS BAR Condition IV - Limiting Faults WBNP-80 Figure 15.4-3 Hydrogen Production Rate -Westinghouse Model 15.4-85

WATTS BAR WBNP-80 Figure 15.4-4 Hydrogen Generation Rates: NRC Basis 15.4-86 Condition IV - Limiting Faults

WATTS BAR Condition IV - Limiting Faults WBNP-80 Figure 15.4-5 Hydrogen Accumulation from All Sources -Westinghouse Model 15.4-87

WATTS BAR 15.4-88 Condition IV - Limiting Faults WBNP-80 Figure 15.4-6 Hydrogen Accumulation from All Sources: NRC Basis

WATTS BAR Condition IV - Limiting Faults WBNP-49 Figure 15.4-7 Volume Percent of Hydrogen in Containment - Westinghouse Model 15.4-89

WATTS BAR 15.4-90 Condition IV - Limiting Faults WBNP-49 Figure 15.4-8 Volume Percent of Hydrogen in Containment - NRC Model

WATTS BAR WBNP-49 Figure 15.4-9 Variation of Reactivity with Power at Constant Core Average Temperature Condition IV - Limiting Faults 15.4-91

WATTS BAR WBNP-89 Figure 15.4-10 Deleted by Amendment 89 15.4-92 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-11 Transient Response to Steam Line Break with Safety Injection and Offsite Power (case a)

Condition IV - Limiting Faults 15.4-93

WATTS BAR WBNP-63 Figure 15.4-12 Transient Response to Steam Line Break with Safety Injection and Without Offsite Power (case b) 15.4-94 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-13a Pressurizer Pressure and Water Volume Transients for Main Feedline Rupture With Offsite Power Condition IV - Limiting Faults 15.4-95

WATTS BAR WBNP-89 Figure 15.4-13b Reactor Coolant Temperature Transients for the Faulted and Intact Loops for Main Feedline Rupture With Offsite Power 15.4-96 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-13c Steam Generator Pressure and 'Water Mass Transients for Main Feedline Rupture With Offsite Power Condition IV - Limiting Faults 15.4-97

WATTS BAR WBNP-89 Figure 15.4-14a Pressurizer Pressure and Water Volume Transients for Main Feedline Rupture With Offsite Power 15.4-98 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-14b Reactor Coolant Temperature Transients for the Faulted and Intact Loops for Main Feedline Rupture With Offsite Power Condition IV - Limiting Faults 15.4-99

WATTS BAR WBNP-89 Figure 15.4-14c Steam Generator Pressure and Water Mass Transients for Main Feedline Rupture With Offsite Power 15.4-100 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-15 RCS Pressure Transient; Four Pumps in Operation, One Locked Rotor Condition IV - Limiting Faults 15.4-101

WATTS BAR WBNP-80 Figure 15.4-16 Deleted by Amendment 80 15.4-102 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-17 Reactor Vessel Flow Transient; Four Pumps in Operation, One Locked Rotor Condition IV - Limiting Faults 15.4-103

WATTS BAR WBNP-89 Figure 15.4-18 Loop Flow Transient; Four Pumps in Operation, One Locked Rotor 15.4-104 Condition IV - Limiting Faults

WATTS BAR WBNP-89 Figure 15.4-19 Heat Flux Transient; Four Pumps in Operation, One Locked Rotor Condition IV - Limiting Faults 15.4-105

WATTS BAR WBNP-89 Figure 15.4-20 Nuclear Power Transient; Four Pumps in Operation, One Locked Rotor 15.4-106 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-21 Clad Inner Temperature Transient; Four Pumps in Operation, One Locked Rotor Condition IV - Limiting Faults 15.4-107

WATTS BAR WBNP-80 Figure 15.4-22 Deleted by Amendment 80 15.4-108 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-23 Deleted by Amendment 80 Condition IV - Limiting Faults 15.4-109

WATTS BAR WBNP-80 Figure 15.4-24 Nuclear Power Transient; BOL HFP Rod Ejection Accident 15.4-110 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-25 Hot Spot Fuel and Clad Temperature Versus Time; BOL HFP Rod Ejection Accident Condition IV - Limiting Faults 15.4-111

WATTS BAR WBNP-80 Figure 15.4-26 Nuclear Power Transient; EOL HZP Rod Ejection Accident 15.4-112 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-27 Hot Spot Fuel and Clad Temperature Versus Time; EOL HZP Rod Ejection Accident Condition IV - Limiting Faults 15.4-113

WATTS BAR WBNP-80 Figure 15.4-28 Reactor Coolant System Integrated Break Flow Following a Rod Ejection Accident 15.4-114 Condition IV - Limiting Faults

WATTS BAR Condition IV - Limiting Faults 15.4-115 WBNP-63 Figure 15.4-29 Containment Lower Compartment Pressure, Minimum Safeguards

WATTS BAR 15.4-116 Condition IV - Limiting Faults WBNP-63 Figure 15.4-30 Containment Temperatures, Minimum Safeguards

WATTS BAR WBNP-63 Figure 15.4-31 Lower Compartment Structural Heat Removal Rate, Minimum Safeguards Condition IV - Limiting Faults 15.4-117

WATTS BAR WBNP-63 Figure 15.4-32 Ice Bed Heat Removal Rate, Minimum Safeguards 15.4-118 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-33 Heat Removal by Sump, Minimum Safeguards Condition IV - Limiting Faults 15.4-119

WATTS BAR WBNP-63 Figure 15.4-34 Heat Removal by Spray, Minimum Safeguards 15.4-120 Condition IV - Limiting Faults

WATTS BAR Condition IV - Limiting Faults 15.4-121 WBNP-63 Figure 15.4-35 Containment Lower Compartment Pressure, Maximum Safeguards

WATTS BAR 15.4-122 Condition IV - Limiting Faults WBNP-63 Figure 15.4-36 Containment Lower Compartment Pressure, Maximum Safeguards

WATTS BAR WBNP-63 Figure 15.4-37 Lower Compartment Structural Heat Removal Rate, Maximum Safeguards Condition IV - Limiting Faults 15.4-123

WATTS BAR WBNP-63 Figure 15.4-38 Ice Bed Heat Removal Rate, Maximum Safeguards 15.4-124 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-39 Heat Removal by Sump, Maximum Safeguards Condition IV - Limiting Faults 15.4-125

WATTS BAR WBNP-63 Figure 15.4-40a Heat Removal by Spray, Maximum Safeguards 15.4-126 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40b Containment Lower Compartment Pressure, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-127

WATTS BAR WBNP-63 Figure 15.4-40c Compartment Temperatures, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-128 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40d Lower Compartment Structural Heat Removal Rate, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-129

WATTS BAR WBNP-63 Figure 15.4-40e Ice Bed Heat Removal Rate, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-130 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40f Heat Removal by Sump, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-131

WATTS BAR WBNP-63 Figure 15.4-40g Heat Removal by Spray, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-132 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40h Containment Lower Compartment Pressure, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-133

WATTS BAR WBNP-63 Figure 15.4-40i Compartment Temperatures, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-134 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40j Lower Compartment Structural Heat Removal Rate, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-135

WATTS BAR WBNP-63 Figure 15.4-40k Ice Bed Heat Removal Rate, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-136 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-40l Heat Removal by Sump, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-137

WATTS BAR WBNP-63 Figure 15.4-40m Heat Removal by Spray, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-138 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-41 Reactor Coolant System Pressure, DECLG, CD=O.4 Condition IV - Limiting Faults 15.4-139

WATTS BAR WBNP-63 Figure 15.4-42 Core Flowrate DECLG, CD=0.4 15.4-140 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-43 Accumulator Flow during Blowdown, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-141

WATTS BAR WBNP-63 Figure 15.4-44 Core Pressure Drop, DECLG, CD=0.4 15.4-142 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-45 Break Flow During Blowdown, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-143

WATTS BAR WBNP-63 Figure 15.4-46 Break Energy During Blowdown, DECLG, CD-=0.4 15.4-144 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-47 Core Power, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-145

WATTS BAR WBNP-63 Figure 15.4-48 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.4 15.4-146 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-49 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-147

WATTS BAR WBNP-63 Figure 15.4-50 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DEGLG, CD=0.4 15.4-148 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-51 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-149

WATTS BAR WBNP-63 Figure 15.4-52 Rod Heat Transfer Coefficient at the Peak Temperature Location, DECLG, CD=0. 4 15.4-150 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-53 Fuel Rod Peak Clad Temperature, DECLG, CD=0.4 Condition IV - Limiting Faults 15.4-151

WATTS BAR WBNP-63 Figure 15.4-54 Clad Temperature at the Burst Node, DECLG, CD=0.4 15.4-152 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-55 Reactor Coolant System Pressure, DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-153

WATTS BAR WBNP-63 Figure 15.4-56 Core Flowrate, DEGLG, CD=0.6 15.4-154 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-57 Accumulator Flow During Blowdown, DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-155

WATTS BAR WBNP-63 Figure 15.4-58 Core Pressure Drop, DECLG, CD=0.6 15.4-156 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-59 Break Flow During Blowdown, DECLG, CD-O.6 Condition IV - Limiting Faults 15.4-157

WATTS BAR WBNP-63 Figure 15.4-60 Break Energy During Blowdown, DECLG, CD=0 .6 15.4-158 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-61 Core Power, DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-159

WATTS BAR WBNP-63 Figure 15.4-62 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.6 15.4-160 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-63 Core Inlet Fluid Velocity for Rod Thermal Analysis DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-161

WATTS BAR WBNP-63 Figure 15.4-64 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0. 6 15.4-162 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-65 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-163

WATTS BAR WBNP-63 Figure 15.4-66 Rod Heat Transfer Coefficient at the Peak Temperature Location, DECLG,CD=0. 6 15.4-164 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-67 Fuel Rod Peak Glad Temperature, DECLG, CD=0.6 Condition IV - Limiting Faults 15.4-165

WATTS BAR WBNP-63 Figure 15.4-68a Clad Temperature at the Burst Node, DECLG, CD=O.6 15.4-166 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68b Reactor Coolant System Pressure, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-167

WATTS BAR WBNP-63 Figure 15.4-68c Core Flowrate During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-168 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68d Accumulator Flow During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-169

WATTS BAR WBNP-63 Figure 15.4-68e Core Pressure Drop During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-170 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68f Break Flow During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-171

WATTS BAR WBNP-63 Figure 15.4-68g Break Energy Flow During Blowdown, CD=0.6, Safeguards, Upflow Barrel/Baffle Region Minimum and Maximum 15.4-172 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68h Core Power During Blowdown, CD=0.6, Minimum and Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-173

WATTS BAR WBNP-63 Figure 15.4-68i Core and Downcomer Liquid Levels During Reflood, CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-174 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68j Core Inlet Fluid Velocity During Reflood CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-175

WATTS BAR WBNP-63 Figure 15.4-68k Intact Loop Accumulator and Pumped SI During Reflood CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-176 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68l Mass Flux, CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-177

WATTS BAR WBNP-63 Figure 15.4-68m Fuel Rod Heat Transfer Coefficient, CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region 15.4-178 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-68n Fuel Rod Peak Clad Temperature, CD=0.6, Minimum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-179

WATTS BAR WBNP-63 Figure 15.4-69 Reactor Coolant System Pressure, DECLG, CD=0.8 15.4-180 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-70 Core Flowrate During Blowdown, DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-181

WATTS BAR WBNP-63 Figure 15.4-71 Accumulator Flow During Blowdown, DECLG, CD=0.8 15.4-182 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-72 Core Pressure Drop, DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-183

WATTS BAR WBNP-63 Figure 15.4-73 Break Mass Flow During Blowdown, DECLG, CD=0.8 15.4-184 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-74 Break Energy Flow During Blowdown, DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-185

WATTS BAR WBNP-63 Figure 15.4-75 Core Power, DECLG, CD=0.8 15.4-186 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-76 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-187

WATTS BAR WBNP-63 Figure 15.4-77 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.8 15.4-188 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-78 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-189

WATTS BAR WBNP-63 Figure 15.4-79 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.8 15.4-190 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-80 Rod Heat Transfer Coefficient at the Peak Temperature Location, DECLG, CD=0. 8 Condition IV - Limiting Faults 15.4-191

WATTS BAR WBNP-63 Figure 15.4-81 Fuel Rod Peak Clad Temperature, DECLG, CD=0.8 15.4-192 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-82 Clad Temperature, at the Burst Node DECLG, CD=0.8 Condition IV - Limiting Faults 15.4-193

WATTS BAR WBNP-63 Figure 15.4-83 Reactor Coolant System Pressure, DECLG, CD=0.6, Max SI 15.4-194 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-84 Core Flowrate DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-195

WATTS BAR WBNP-63 Figure 15.4-85 Accumulator Flow During Blowdown, DECLG, CD=0.6, Max SI 15.4-196 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-86 Core Pressure Drop DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-197

WATTS BAR WBNP-63 Figure 15.4-87 Break Flow During Blowdown, DECLG, CD=0.6, Max SI 15.4-198 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-88 Break Energy During Blowdown DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-199

WATTS BAR WBNP-63 Figure 15.4-89 Core Powe, DECLG, CD=0.6, Max SI 15.4-200 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-90 Core and Downcomer Liquid Levels During Reflood, DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-201

WATTS BAR WBNP-63 THIS PAGE INTENTIONALLY BLANK 15.4-202 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-91 Core Inlet Fluid Velocity for Rod Thermal Analysis, DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-203

WATTS BAR WBNP-63 Figure 15.4-92 Intact Loop Accumulator and Pumped Safety Injection During Reflood, DECLG, CD=0.6, Max SI 15.4-204 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-93 Mass Flux at the Peak Rod Temperature Elevation, DECLG, CD=0.6, Max SI Condition IV - Limiting Faults 15.4-205

WATTS BAR WBNP-63 Figure 15.4-94 Rod Heat Transfer Coefficient at the Peak Temperature Location, DECLG, CD=0.6, Max SI 15.4-206 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-95 Fuel Rod Peak Clad Temperature, DECLG, CD=0.6. Max SI Condition IV - Limiting Faults 15.4-207

WATTS BAR WBNP-63 Figure 15.4-96a Clad Temperature at the Burst Node, DECLG. CD=0.6, Max SI 15.4-208 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-96b Core and Downcomer Liquid Levels During Reflood, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-209

WATTS BAR WBNP-63 Figure 15.4-96c Core Inlet Fluid Velocity During Reflood, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-210 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-96d Intact Loop Accumulator and Pumped SI During Reflood, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-211

WATTS BAR WBNP-63 Figure 15.4-96e Mass Flux, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-212 Condition IV - Limiting Faults

WATTS BAR WBNP-63 Figure 15.4-96f Fuel Rod Heat Transfer Coefficient, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region Condition IV - Limiting Faults 15.4-213

WATTS BAR WBNP-63 Figure 15.4-96g Fuel Rod Peak Clad Temperature, CD=0.6, Maximum Safeguards, Upflow Barrel/Baffle Region 15.4-214 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97a SGTR Analysis -Pressurizer Level Condition IV - Limiting Faults 15.4-215

WATTS BAR WBNP-80 Figure 15.4-97b SGTR Analysis -RCS Pressure 15.4-216 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97c SGTR Analysis -Secondary Pressure Condition IV - Limiting Faults 15.4-217

WATTS BAR WBNP-80 Figure 15.4-97d SGTR Analysis -Intact Loop Hot and Cold Leg RCS Temperatures 15.4-218 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97e SGTR Analysis -Ruptured Loop Hot and Cold Leg RCS Temperatures Condition IV - Limiting Faults 15.4-219

WATTS BAR WBNP-80 Figure 15.4-97f SGTR Analysis - Differential Pressure Between RCS and Ruptured SG 15.4-220 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97g SGTR Analysis - Primary to Secondary Break Flow Rate Condition IV - Limiting Faults 15.4-221

WATTS BAR WBNP-80 Figure 15.4-97h SGTR Analysis - Ruptured SG Water Volume*

15.4-222 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97i SGTR Analysis - Ruptured SG Water Mass Condition IV - Limiting Faults 15.4-223

WATTS BAR WBNP-80 Figure 15.4-97j SGTR Analysis - Ruptured SG Mass Release Rate to the Atmosphere 15.4-224 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97k SGTR Analysis - Intact SGs Mass Release Rate to the Atmosphere Condition IV - Limiting Faults 15.4-225

WATTS BAR WBNP-80 Figure 15.4-97l SGTR Analysis - Break Flow Flashing Fraction 15.4-226 Condition IV - Limiting Faults

WATTS BAR WBNP-80 Figure 15.4-97m SGTR Analysis - SG Water Level Above Top of Tubes Condition IV - Limiting Faults 15.4-227

WATTS BAR WBNP-80 THIS PAGE INTENTIONALLY BLANK 15.4-228 Condition IV - Limiting Faults

WATTS BAR WBNP-90 15.5 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5.1 Environmental Consequences of a Postulated Loss of AC Power to the Plant Auxiliaries The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the reactor coolant system (RCS) to the secondary system in the steam generator. A conservative analysis of the potential offsite doses resulting from this accident is presented with steam generator leakage as a parameter. This analysis incorporates assumptions of one percent defective fuel, and steam generator leakage prior to the postulated accident for a time sufficient to establish equilibrium specific activity levels in the secondary system. A realistic analysis is also performed. Parameters used in both the realistic and conservative analyses are listed in Table 15.5-1.

The realistic assumptions used to determine the equilibrium concentrations of isotopes in the secondary system are as follows:

(1) The primary to secondary leakage to the steam generators is assumed to be 1 gpm for one year prior to the accident.

(2) Primary coolant activity is associated with 0.125% defective fuel and is given in Table 11.1-7.

(3) The iodine partition factor in the steam generators is:

amount of iodine/unit mass steam

= 0.01 amount of iodine/unit mass liquid The iodine partition factor in the condenser is:

amount of iodine/unit vol. gas

= 0.01 (Reference [1])

amount of iodine/unit vol. liquid (4) No noble gas is dissolved or contained in the steam generator water, i.e., all noble gas leaked to the secondary system is continuously released with steam from the steam generators through the condenser off gas system.

(5) The blowdown rate from steam generators is a continuous 25 gpm per steam generator.

(6) The 0-2 and 0-8 hour atmospheric dilution factors given in Appendix 15A and the 0-8 hour breathing rate of 3.47 x 10-4 m3/sec are applicable. Doses are based on the dose models presented in Appendix 15A .

Assumptions used for the conservative analysis are the same as the realistic assumptions except 1% failed fuel is assumed.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-1

WATTS BAR WBNP-90 The steam releases to the atmosphere for the loss of AC power are given in Table 15.5-1.

The gamma, beta, and thyroid doses for the loss of AC power to the plant auxiliaries at the exclusion area boundary and low population zone are given in Table 15.5-2 for the realistic analysis. These doses are calculated by the FENCDOSE computer code[16]. The doses for this accident are less than 25 rem whole body, 300 rem beta and 300 rem thyroid. This is well within the limits as defined in 10 CFR 100.

15.5.2 Environmental Consequences of a Postulated Waste Gas Decay Tank Rupture Two analyses of the postulated waste gas decay tank rupture are performed:

(1) a realistic analysis, and (2) an analysis based on Regulatory Guide 1.24 (Reference 2). The parameters used for each of these analyses are listed in Table 15.5-3.

The assumptions for the Regulatory Guide analysis are:

(1) The reactor has been operating at full power with 1% defective fuel for the RG 1.24 analysis.

(2) The maximum content of the decay tank assumed to fail is used for the purpose of computing the noble gas inventory in the tank. Radiological decay is taken into account in the computation only for the minimum time period required to transfer the gases from the reactor coolant system to the decay tank. For the Regulatory Guide 1.24 analysis, noble gas and iodine inventories of the tank are given in Table 15.5-4. For the realistic analysis, source terms are based on ANSI/ANS-18.1-1984 methodology[14].

(3) The tank rupture is assumed to occur immediately upon completion of the waste gas transfer, releasing the entire contents of the tank through the Auxiliary Building vent to the outside atmosphere. The assumption of the release of the noble gas inventory from only a single tank is based on the fact that all gas decay tanks will be isolated from each other whenever they are in use.

(4) The short-term (i.e., 0-2 hour) dilution factor at the exclusion area boundary given in Appendix 15A is used to evaluate the doses from the released activity. Doses are based on the dose models presented in Appendix 15A.

The gamma, beta, and thyroid doses for the gas decay tank rupture at the exclusion area boundary and low population zone are given in Table 15.5-5 for both the realistic and Regulatory Guide 1.24 analyses.

15.5.3 Environmental Consequences of a Postulated Loss of Coolant Accident The results of the analysis presented in this section demonstrate that the amounts of radioactivity released to the environment in the event of a loss-of-coolant accident do not result in doses which exceed the reference values specified in a 10 CFR 100.

15.5-2 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 The analysis is based on Regulatory Guide 1.4[3]. The parameters used for this analysis are listed in Table 15.5-6. In addition, an evaluation of the dose to control room operators and an evaluation of the offsite doses resulting from recirculation loop leakage are presented.

Fission Product Release to the Containment Following a postulated double-ended rupture of a reactor coolant pipe with subsequent blowdown, the emergency core cooling system keeps cladding temperatures well below melting, and limits zirconium-water reactions to an insignificant level, assuring that the core remains intact and in place. As a result of the increase in cladding temperature and rapid depressurization of the core, however, some cladding failure may occur in the hottest regions of the core. Thus, a fraction of the fission products accumulated in the pellet-cladding gap may be released to the reactor coolant system and thereby to the primary containment.

In this analysis, based on Regulatory Guide 1.4[3], a total of 100% of the noble gas core inventory and 25% of the core iodine inventory is assumed to be immediately available for leakage from the primary containment. Of the halogen activity available for release, it is further assumed that 91% is in elemental form, 4% in methyl form, and 5% in particulate form.

The core inventory of iodines and noble gases is listed in Table 15.1-5.

Primary Containment Model The quantity of activity released from the containment was calculated with a single volume model of the containment.

If it is assumed that there are no sources of activity following the initial instantaneous release of fission products to the containment, the equation which describes the time dependent activity or quantity of material in a component is:

dA ij ( t )

- = - ij A ij ( t ) + P ij ( t )

---

(1) dt where Aij is the activity or quantity of material i in component j. Pij is the rate at which activity or material i is added to component j, and ij is the rate at which activity or material i is removed or lost from component j. If both and P are independent of time, then for one material and one component one obtains the solution:

- t P - t (2)

A = A0 e + ---- ( 1 - e )

A where Ao is the initial activity. However, in general, P is time dependent and in some cases is also time dependent.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-3

WATTS BAR WBNP-80 The addition of material to the component, Pij(t), may come from two sources: (1) flow from another component in the system may add material to the component, (2) material may be produced within the component by radioactive decay. Thus, the addition rate for material i to component j can be expressed as:

(1) (2) (3)

P ij ( t ) = P ij ( t ) + P ij ( t )

where:

n (1)

P ij ( t ) = cijj - j ( t )Aijj ( t ) ;cijj - j ( t ) is the transfer coefficient jj j n

(2) of i from component jj to j, and P i (t) = ii - i Aiij ( t ) ; ii - i is the rate of production ii of i from ii in component j. Note that ii-i is not normally a function of time or component.

Similarly, the loss from a component can be due to: (1) loss within the component (such as radioactive decay), (2) flow out of the component to other components, and (3) removal from the system. Thus, the loss rate from component j for material i can be expressed as:

(2) (3) ij ( t ) = i + ij ( t ) + ij ( t ) (3) where i is the removal rate inside the component due to radioactive decay (neither time nor component dependent),

n (ij2 ) ( t ) = fij - jj ( t ) ; fij - jj ( t ) is the transfer coefficient of material i from component j to jj, jj j and ij( 3 ) is the removal from the system.

A computer program Source Transport Program (STP) has been developed to solve equation (1) for each isotope and for two halogen forms (i.e., elemental and or organic). From this, the isotopic concentration airborne in the containment as a function of time and the integrated isotopic leakage from the containment for a given time period can be obtained. Parameters used in the loss-of-coolant accident analysis are listed in Table 15.5-6.

Modeling of Removal Process For fission products other than iodine, the only removal processes considered are radioactive decay and leakage.

15.5-4 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 The fission product iodine is assumed to be present in the containment atmosphere in elemental, organic, and particulate form. It is assumed that 91% of the iodine available for leakage from the containment is in elemental (i.e., I2 vapor) form, 4% is assumed to be in the form of organic iodine compounds (e.g., methyl iodine), and 5% is assumed to be absorbed on airborne particulate matter. In this analysis it was conservatively assumed that the organic form of iodine is not subject to any removal processes other than radioactive decay and leakage from the containment. The elemental and particulate forms of iodine are assumed to behave identically.

The effectiveness of the ice condenser for elemental iodine removal is described in Section 6.5.4. For the calculation of doses, the ice condenser was treated as a time dependent removal process. The time dependent ice condenser iodine removal efficiencies for the Regulatory Guide 1.4 analysis are given in Table 15.5-7.

Ice Condenser The ice condenser is designed to limit the leakage of airborne activity from the containment in the event of a loss-of-coolant accident. This is accomplished by the removal of heat released to the containment during the accident to the extent necessary to initially maintain that structure below design pressure and then reduce the pressure to near atmospheric. The addition of an alkaline solution such as sodium tetraborate enhances the iodine removal qualities of the melting ice to a point where credit can be assumed in the radiological analyses.

The operation of the containment deck fans (air return fans) is delayed for approximately 10 minutes following a Phase B isolation signal resulting from the loss-of-coolant accident.

This delay in fan operation yields an initial inlet steam-air mixture into the ice condenser of greater than 90% steam by volume which results in more efficient iodine removal by the ice condenser.

As a result of experimental and analytical efforts, the ice condenser system has been proven to be an effective passive system for removing iodine from the containment atmosphere following a loss-of-coolant accident. (Reference 4)

With respect to iodine removal by the ice condenser, the following assumptions were made:

(1) The ice condenser is only effective in removing airborne elemental and particulate iodine from the containment atmosphere.

(2) The ice condenser is modeled as a time dependent removal process.

(3) The ice condenser is no longer effective in removing iodine after all of the ice has been melted using the most conservative assumptions.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-5

WATTS BAR WBNP-80 Primary Containment Leak Rate The primary containment leak rate used in the Regulatory Guide 1.4 analysis for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is the design basis leak rate guaranteed in the technical specifications regarding containment leakage and it is 50% of this value for the remainder of the 30 day period. Thus, for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the accident, the leak rate was assumed to be 0.25% per day and the leak rate was assumed to be 0.125% per day for the remainder of the 30 day period.

The leakage from the primary containment can be grouped into two categories: (1) leakage into the annulus volume and (2) through line leakage to rooms in the Auxiliary Building (see Figure 15.5-1). The environmental effects of the core release source events have been analyzed on the basis that 25% of the total primary containment leakage goes to the Auxiliary Building.

The leakage paths to the Auxiliary Building are tested as part of the normal Appendix J testing of all containment penetrations. An upper bound to leakage to the Auxiliary Building was estimated to be 25% of the total containment leakage. Selecting an upper bound is conservative because an increasing leakage fraction to the Auxiliary Building results in an increasing calculated offsite dose. This upper bound was also selected on the basis that it is large enough to be verified by testing. The periodic Appendix J testing will assure that leakage to the Auxiliary Building remains below 25%. The remaining 75% of the leakage goes to the annulus.

Bypass Leakage Paths There are no bypass paths for primary containment leakage to go directly to the atmosphere without being filtered. For further details see the discussion on Type E leakage paths in Section 6.2.4.3.1.

Auxiliary Building Release Path The Auxiliary Building allows holdup and is normally ventilated by the auxiliary building ventilation system. However, upon an ABI signal following a loss-of-coolant accident, the normal ventilation systems to all areas of the Auxiliary Building are shutdown and isolated. Upon Auxiliary Building isolation, the Auxiliary Building gas treatment system (ABGTS) is activated to provide ventilation of the area and filtration of the exhaust to the atmosphere. This system is described in Section 6.2.3.2.3.

Fission products which leak from the primary containment to areas of the Auxiliary Building are diluted in the room atmosphere and travel via ducts and other rooms to the fuel handling area or the waste packaging area where the suctions for the Auxiliary Building gas treatment system are located. The mean holdup time for airborne activity in the Auxiliary Building areas other than the fuel handling area is greater than one hour with the Auxiliary Building isolated and both trains of the ABGTS operating. It has been conservatively assumed in the estimation of activity release that activity leaking to the Auxiliary Building is directly released to the environment for the first four minutes and then through the ABGTS filter system, with a conservatively assumed mean hold-up time of 0.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> in the Auxiliary Building before being exhausted. In the Regulatory Guide 1.4 analysis the ABGTS filter system is assumed to have a removal efficiency 15.5-6 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 of 99% for elemental, organic, and particulate iodines. Minor leakage into the ABGTS and EGTS ductwork allows some unfiltered Auxiliary Building air to be released to the environment. This leakage, quantified by testing, is modeled in the LOCA analysis as indicated in Table 15.5-6 and does not significantly impact doses.

The Auxiliary Building internal pressure is maintained at less than atmospheric during normal operation (see Section 9.4.2 and 9.4.3), thereby preventing release to the environment without filtration following a LOCA. The annulus pressure is maintained more negative than the Auxiliary Building internal pressure during normal operation and after a DBA. Therefore, any leakage between the two volumes following a LOCA is into the annulus.

Shield Building Releases The presence of the annulus between the primary containment and the Shield Building reduces the probability of direct leakage from the vessel to the atmosphere and allows holdup, dilution, sizing, and plate-out of fission products in the Shield Building. The major factor in the effectiveness of the secondary containment is its inherent capability to collect the containment leakage for filtration of the radioactive iodine prior to release to the environment. This effect is greatly enhanced by the recirculation feature of the air handling systems, which forces repeated filtration passes for the major fraction of the primary containment leakage before release to the environment. Seventy-five percent of the primary containment leakage is assumed to go to the annulus volume.

The initial pressure in the annulus is less than atmospheric. After blowdown, the annulus pressure will increase rapidly due to expansion of the containment vessel as a result of primary containment atmosphere temperature and pressure increases. The annulus pressure will continue to rise due to heating of the annulus atmosphere by conduction through the containment vessel. After a delay, the EGTS operates to maintain the annulus pressure below atmospheric pressure.

The EGTS is essentially an annulus recirculation system with pressure activated valves which allow part of the system flow to be exhausted to atmosphere to maintain a "negative" annulus pressure. The system includes absolute and impregnated charcoal filters for removal of halogens. The EGTS combined with ABGTS ensures that all primary containment leakage is filtered before release to the atmosphere.

The EGTS suction in the annulus is located at the top of the containment dome, while nearly all penetrations are located near the bottom of the containment (see Section 6.2), thereby minimizing the probability of leakage directly from the primary containment into the EGTS.

Transfer of activity from the annulus volume to the EGTS suction is assumed to be a statistical process similar mathematically to the decay process, (i.e., the rate of removal from the annulus is proportional to the activity in the annulus). This corresponds an assumption that the activity is homogeneously distributed throughout the mixing volume. Because of the low EGTS flow rate (compared to the annulus volume), the thermal convection due to heating of the containment vessel, and the relative locations of the EGTS suctions (at the top of the dome) and the EGTS ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-7

WATTS BAR WBNP-90 recirculation exhausts (at the base of the annulus), a high degree of mixing can be expected. It is conservatively assumed that only 50% of the annulus free volume is available for mixing of activity in the Regulatory Guide 1.4 analysis.

Figure 6.2.3-17 shows the EGTS exhaust rate and annulus pressure, as a function of time after the LOCA, which was used for calculation of activity releases for the Regulatory Guide 1.4 analysis. The flow path of fission products which are drawn into the air handling systems is shown schematically in Figure 15.5-1 where:

L0 Represents the flow of activity from primary containment to the annulus L1 Represents the flow of activity from primary containment to the Auxiliary Building L Represents the flow of activity from the annulus into the EGTS K Represents the ratio of EGTS recirculation flow to total EGTS flow rate nf Represents the appropriate filter efficiency Effectiveness of Double Containment Design The analysis has demonstrated clearly the benefits of the double containment concept.

As would be expected for a double barrier arrangement, the second barrier acts as an effective holdup tank, resulting in substantial reduction in the two-hour inhalation and whole body immersion doses. The expected offsite doses for the 30-day period at the low population zone are also substantially reduced, since the holdup process is effective for the duration of the accident.

The EGTS exhaust flow rate is dependent on the rate of air inleakage to the annulus.

In fact, after about 25 minutes following blowdown of the reactor vessel the EGTS exhaust flow is equal to the air inleakage rate. Studies[5] made of leak rates from typical concrete buildings of this type have resulted in leak rates from 4% to 8% per day at a pressure differential of 14 inches of water. Although the pressure differential in this case will be much lower than this value, it has been assumed that a shield building inleakage flow of 250 cfm exists throughout the 30-day period. This inleakage flow includes leakage past ventilation system primary containment isolation valves assuming that a single isolation valve fails in the open position.

In order to evaluate the effectiveness of the Shield Building, the following case was analyzed:

50% Mixing Case After 85 seconds following a LOCA, the EGTS starts exhausting filtered fission products to the environs (see Table 15.5-8). All of the primary containment leakage going to the shield building as well as the fission products recirculated by the EGTS is assumed to be uniformly mixed in 50% of the annulus free volume.

15.5-8 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Emergency Gas Treatment System Filter Efficiencies The EGTS takes suction from the annulus, and the exhaust gases are drawn through two banks of impregnated charcoal filters in series. Sufficient filter capacity is provided to contain all iodines, inorganic, organic, and particulate available for leakage. Since the air in the annulus is dry, filter efficiencies of greater than 99% are attainable as reported in ORNL-NSIC-4[6]. Heaters and demisters have been incorporated upstream of the filters resulting in a relative humidity of less than 70% in the air entering the filters which further ensures high filter efficiency.

In the Regulatory Guide 1.4 analysis however, an overall removal efficiency of 99% for elemental, organic, and particulate iodine is assumed for the two filter banks in series.

Discussion of Results The gamma, beta, and thyroid doses for the LOCA at the exclusion area boundary and the low population zone are given in Table 15.5-9. These doses are calculated by the FENCDOSE computer code[16]. The doses are based on the atmospheric dilution factors and dose models given in Appendix 15A. The doses for this accident are less than 25 rem whole body, 300 rem beta, and 300 rem thyroid. The doses are well within the 10 CFR 100 guidelines.

Loss of Coolant Accident - Environmental Consequences of Recirculation Loop Leakage Component leakage in the portion of the emergency core cooling system outside containment during the recirculation phase following a loss of coolant accident could result in offsite exposure. The maximum potential leakage for this equipment is specified is Table 6.3-6. This leakage refers to specified design limits for components and normal leakage is expected to be well below those upper limits. Recirculation is assumed in the analysis to start at 10 minutes after the loss of coolant accident. At this time the sump temperature is approximately 160F (Figure 6.2.1-3). The enthalpy of the sump is approximately 130 BTU/lb. The enthalpy of saturated liquid at 1.0 atmosphere pressure and 212F is greater than 130 BTU/lb. Therefore, there will be no flashing of the leakage from recirculation loop components, and an iodine partition factor of 0.1 is assumed for the total leakage.

The analysis of the environmental consequences is performed as follows:

Core iodine inventory given in Table 15.1-5 is used. The water volume is comprised of water volumes from the reactor coolant system, accumulators, refueling water storage tank, and ice melt. All the noble gases are assumed to escape to the primary containment. Radioactive decay was taken into account in the dose calculation. The major assumptions used in the analysis are listed in Table 15.5-12. The offsite doses at the exclusion area boundary and low population zone for the analysis are given in Table 15.5-13. The atmospheric dilution factors and dose models discussed in Appendix 15A are used in the dose analysis.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-9

WATTS BAR WBNP-80 Loss of Coolant Accident - Control Room Operator Doses In accordance with General Design Criterion 19, the control room ventilation system and shielding have been designed to limit the whole body gamma dose during an accident period to 5 rem, the thyroid dose to 30 rem and the beta skin dose to 30 rem.

The doses to personnel during a post-accident period originate from several different sources. Exposure within the control room may result from airborne radioactive nuclides entering the control room via the ventilation system. In addition, personnel are exposed to direct gamma radiation penetrating the control room walls, floor, and roof from:

(1) Radioactivity within the primary containment atmosphere (2) Radioactivity released from containment which may have entered adjacent structures (3) Radioactivity released from containment which passes above the control room roof Further exposure of control room personnel to radiation may occur during ingress to the control room from the exclusion area boundary and during egress from the control room to the exclusion area boundary.

In the event of a radioactive release incident, the control room is isolated automatically by a safety injection system signal and/or by radiation signal from beta detectors located in the air intake stream common to the air intake ports at either end of the Control Building. These redundant signals are routed to redundant controls which actuate air-operated isolation dampers downstream of the beta detectors. Operation of the emergency pressurizing fans with inline HEPA filters and charcoal adsorbers is also initiated by these signals. Simultaneously, recirculation air is rerouted automatically through the HEPA filters and charcoal adsorbers. Approximately 711 cfm of outside air, the emergency pressurization air, flows through a duct routed to the emergency recirculation system upstream of the HEPA filters and charcoal adsorbers.

This flow of outside air provides the control room with a slight positive pressure relative to the atmosphere outside and to surrounding structures. In addition, the equivalent of 51 cfm of unfiltered outside air enters through the main control room doors and other sources. Isolation dampers located in each intake line may be selectively closed by control room personnel. The selection between the two would be based on the objective of admitting a minimum of airborne activity to the control room via the makeup airflow.

The control room ventilation flow system is shown in Figure 9.4-1.

To evaluate the ability of the control room to meet the requirements of General Design Criterion 19, a time-dependent model of the control room was developed. In this model, the outside air concentration enters the control room via the isolation damper bypass line and the HEPA filters and charcoal absorbers. The concentration in the room is reduced by decay, leakage out, and by recirculation through the HEPA filters 15.5-10 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 and charcoal absorbers. Credit for filtration is taken during two passes through the charcoal absorbers. Using these assumptions, the following equations for the rate of change of the control room concentrations are obtained:

dM R

---

= C o ( 1 - K 1 )L V - L V M - ------c- M- M (1) dt V dN R

---

= ------c- ( 1 - K 2 ) M - L V N - N (2) dt V C(t) = M(t) + N(t) (3)

Where:

M(t) = Once-filtered time-dependent concentration N(t) = Twice-filtered (or more) time-dependent concentration C(t) = Total time-dependent concentration in control room Co = Concentration of isotope entering air intake K1 = Filter efficiency for a particular isotope during first pass K2 = Filter efficiency for a particular isotope during second pass L = Flow rate of outside air into control room and leakage out of control room Rc = Recirculated air flow rate through filters

= Decay constant V = Control room free volume These equations are readily solvable if Co is constant or a simple function of time during a time interval. Since Co consists of a number of terms involving exponentials, it was assumed to be constant during particular time intervals corresponding to the average concentration during each interval as described below. Solving equations (1), (2), and (3) yields:

1 - K1 1 - K2 Co L Rc L -Wn t -Wn t -Wm t C ( t ) = --------------------------------------- x -------------------- ( 1 - e - Wmt ) + ------------ ( 1 - e ) - L(e -e ) (4)

Wm V ( 1 - K2 ) Wn V ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-11

WATTS BAR WBNP-90 Where:

( L + R c + V )

W m = -----------------------------------

V

( L + V )

W n = ----------------------

V The value of Co used in equation (4) is determined as follows:

ti + 1 R dt (5) ti C oi = ( X Q ) i ------------------

ti + 1 - ti Coi= Average concentration of activity outside control room during ith time period (Ci/m3).

(x/Q)i= Atmospheric dilution factor (sec/m3) during the ith time period.

R= Time dependent release rate of activity from containment (Ci/sec).

The atmospheric dilution factors were determined using the accumulated meteorological data on wind speed, direction, and duration of occurrence obtained from the Watts Bar plant site applied to a building wake dilution model. The dilution factors are calculated by the Halitsky methodology[8] and are the maximum values for each time period. The worst case is Unit 1 exhaust to intake 1. These factors are applied for the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, at which time it is assumed that the operator selects intake 2 which has more favorable dilution factors. The values used in the analysis are given in Table 15.5-14. The values include average wind direction frequency factors (methodology from Murphy and Campe).[9]

Equation (4) is used to determine the concentration at any time within a time period and upon integrating and dividing by the time interval gives the average concentration during the time interval due to inflow of radioactivity with outside air as shown:

15.5-12 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 T

C i ( t )dt (6)

Ci = -----------------

T-0 0

Where:

T = t - ti-1 t = Time after accident ti-1 = Time at end of previous time period Further contributions to the concentration during the time period are due to the concentrations remaining from prior time periods. These contributions are obtained from the following equations:

CR ( i + j ) = MR ( i + j ) + NR ( i + j ) (7) dM R ( i + j )

---

= ( L V ) + ( R c V + )M R ( i + j ) (8) dt dN R ( i + j )

---

= ( R c V ) ( 1 - K 2 )M R ( i + j ) - ( L V + ) N R ( i + j ) (9) dt With initial conditions:

M R(i+ j) (0) = M R 0(i) = (Once-filtered concentration at end of the ith time period.)

N R(i+ j) (0) = N R 0(i) = (Twice-filtered, or more, concentration at end of the ith time period.)

Solving equations (8) and (9) and substituting certain initial condition relations, equation (7) becomes:

-W (10)

- M R0 ( i ) K 2 e -W N ( t - ti ) - e -W M ( t - ti )

( t - ti )

C R ( i + j ) = C R0 ( i ) e n ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-13

WATTS BAR WBNP-90 Integrating equation (1) for each of the prior time periods gives the contribution from these time periods to the present time period. The average concentration is determined for these contributions using the method of equation (6).

Filter efficiencies of 95% for elemental and particulate iodine and 95% for organic iodine were deemed appropriate for the first filter pass. Since the concentrations of iodine in the main control room are such reduced as a result of this filtration, the efficiencies were reduced for the second pass to 70% for elemental and particulate iodine, and 70% for organic iodine.

To account for the unfiltered inleakage, a bypass leak rate (BPR) of 51 cfm was added to the makeup flow (L in equation (1)) of 711 cfm, and the filter factor for the first pass was decreased by the ratio L/(L+BPR). The filter efficiencies for the second pass are not affected by the unfiltered inleakage.

The filter efficiency for noble gases was taken as zero for all cases.

The above equations were incorporated into computer program COROD[17] together with appropriate equations for computing gamma dose, beta dose, and inhalation dose using these average nuclide concentrations and time periods. The whole body gamma dose calculation consists of an incremental volume summation of a point kernel over the control room volume. The principal gammas of each isotope are used to compute the dose from each isotope. The dose computations for beta activity was based on a semi infinite cloud model. Doses to thyroid were based on activity to dose conversion factors. (The equations and various data are given below.) The doses from these calculations are presented in Table 15.5-15. Gamma dose contributions from shine through the control room roof due to the external cloud and from shine through the control room walls from adjacent structures and from containment are computed using an incremental volume summation of a point kernel which includes buildup factors for the concrete shielding. For the calculation of shine through the control room roof, an atmospheric, rectangular volume several thousand feet in height and several control room widths was used. The control room roof is a 2 foot 3-inch-thick concrete slab and is the only shielding considered in this calculation. The average isotope concentrations at the control bay for each time period were used as the source concentrations. For the shine from adjacent structures, the shielding consists of the 3-foot-thick (5 feet in certain areas) control room walls. The doses are calculated similarly to the shine dose through the roof. The average isotope concentrations at the control bay intake for each time period are also used for these calculations.

The shine from the spreading room below the control room is also computed in the same manner as adjacent structures.

Shielding for this computation consists of the 8-inch-thick concrete floor. The summation of the incremental elements is performed over the volume of each room or structure of interest.

In addition to the dose due to shine from surrounding structures and from the passing cloud, the shine from the reactor containment building also contributes to the gamma whole body dose to personnel. This contribution is computed in the same manner as 15.5-14 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 the methods used above. Due to the location of the Auxiliary Building between the Reactor Buildings and the control room and the thicker control room auxiliary building wall near the roof, the minimum ray path through concrete from the containment into the control room below 10 feet above the control floor, is 8 feet. All nuclides released to containment are assumed uniformly distributed and their time-dependent concentrations were used to compute the dose. The dose computed from this source is small.

Several doors penetrate the control room walls, and the dose at these areas would be larger than the doses calculated as described above. The potential shine at these doors and at other penetrations has been evaluated. As a result, hollow steel doors filled with no. 12 lead shot have been incorporated into the design of the shield wall between the control room and the Turbine Building. These doors provide shielding comparable to the concrete walls. Shine through other penetrations was found to be negligible.

Another contribution to the total exposure of control room personnel is the exposure incurred during ingress from and egress to the exclusion area boundary. The doses due to ingress and egress were computed based on the following assumptions:

(1) Five minutes are required to leave the control room and arrive at car or vice versa.

(2) The distance traveled on the access road to the site exclusion boundary is estimated to be 1500 meters. The average car speed is assumed to be 25 mph.

(3) One one-way trip first day, one round-trip/day 2nd through 30th days.

The control room occupancy factors used in this calculation were taken from Murphy and Campe[9]. They are:

100% occupancy 0-24 hours 60% occupancy 1-4 days 40% occupancy 4-30 days.

All atmospheric dilution factors were conservatively based on 5th percentile wind velocity averages.

It was also assumed that initially the makeup air intake would be through the vent admitting the highest radioisotope concentration, but that the main control room personnel would switch intake vents 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident in order to admit a lower amount of airborne activity to the MCR via the makeup air flow.

The whole body, beta, and thyroid doses from the radiation sources discussed above are presented in Table 15.5-15. The dose to whole body is below the GDC 19 limit of 5 rem for control room personnel, and the thyroid dose is below the limit of 30 rem.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-15

WATTS BAR WBNP-90 These LOCA main control room doses are bounding for all Section 15.5 design-basis events in terms of maximum dose to the control room personnel.

Dose Equations, Data, and Assumptions The dose from gamma radiation originating within the control room is given by:

2 + y2 + z2 )

4 e

---

exp ( - a x m n q D = 1.69 x 10 TCOT ik k k E f -

( xm + yn + zq )

2 2 2

- x y z (11) i =1 k=1 =1 m= 1 n= 1 q =1 Where:

D = Absorbed dose in flesh in mrads TCOTik=Total concentration integrated over time period i of isotope k in curies/m3 Ek = Energy of gamma from isotope k in MeV fk = Number of gammas of isotope k given off per disintegration e =Mass attenuation coefficient for flesh determined at the energy of gamma of 2

l isotope k in cm /gram a=Linear attenuation coefficient for air determined at the energy of gamma in inverse meters x,y,z=Coordinate distances from the dose point to the source volume element (m,n,q) in meters x,y,z=Dimensions of source element (m,n,q)

=Number of time periods

=Number of isotopes

=Number of gammas from an isotope

=Number of intervals in the x direction

=Number of intervals in the y direction

=Number of intervals in the z direction 15.5-16 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 The control room radiation dose from gamma radiation originating outside of the control room and penetrating concrete walls is given as:

2 + y2 + z2 4 e

---

exp - a x m n q D = 1.69 x 10 oik k k C E f - -----------------------------------------------------------

( xm 2 + y2 + z2 )

n q exp ( - c t c sec )

i =1 k=1 =1 m= 1 n= 1 q =1 B c ( c t c sec ) x y z ( t i - t i - 1 )

Where:

c = Linear attenuation coefficient of concrete determined at the energy of gamma in inverse meters tc= Concrete shield thickness in meters

= Angle between a vector normal to the shield and a vector from the dose point to the source point Bc(ctcsec) = Buildup factor for concrete Coik = Average concentration of isotope k outside the control room during time period i in curies/m3 ti-1,ti = Times at the beginning and end of time period i in hours Other parameters are defined as previously noted.

The dose from beta radiation is given by the semi-infinite cloud immersion dose:

D B = ( 0.230 ) ( X Q ) Q Eik Fik (12) i =1 k= 1 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-17

WATTS BAR WBNP-90 Where:

DB=Dose due to beta in rem X/Q=Atmospheric dispersion factor during time period in sec/m3 Qi=Accumulated activity release of isotope i during time period Eik=Average energy of beta k of isotope i fik=Number of k betas of isotope i per disintegration For beta dose in the control room, equation (12) becomes:

D B = ( 0.230 ) Cij Eik fik ( tj - t j -1 )

i =1 i = 1 1 Where:

Cij =Average concentration of isotope i during time period j Inhalation Dose (Thyroid)

The inhalation dose for a given period of time has the general form:

n DI = ( X Q ) ( B ) ( Qi ) ( DCF ) ( tJ - tj - 1 )

j (13) i=1 Where:

DI=Thyroid inhalation dose, rem 15.5-18 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 X/Q=Site dispersion factor during time period, sec/m3 B=Breathing rate during time period, m3/hr Qij=Average activity release rate during time period j of iodine isotope i DCFi=Dose conversion factor for iodine isotope i, rem/microcurie inhaled tj=Total time at end of period j, hours For inhalation dose within the control room, equation (13) becomes:

n DI = ( B ) Cij ( DCFi ) ( tj - tj - 1 )

i =1 In this expression Cij, the average concentration of isotope i during time period j, has replaced the following factor:

(X/Q) Qij The Cij's are those determined by equations (4) and (6). The breathing rate factor B, was taken to be 3.47 x 10-4 m3/sec, 1.75 x 10-4 m3/sec, and 2.32 x 10-4 m3/sec for the time intervals of 0-8 hours, 8-24 hours, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> - 30 days, respectively.

15.5.4 Environmental Consequences of a Postulated Steam Line Break The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is a leakage from the reactor coolant system to the secondary system in the steam generator. A conservative analysis of the potential offsite doses resulting from this accident is presented with steam generator leakage as a parameter. This analysis incorporates assumptions of one per cent defective fuel and steam generator leakage prior to the postulated accident for time sufficient to establish equilibrium specific activity levels in the secondary system.

The following conservative assumptions and parameters are used to calculate the activity releases and offsite doses for the postulated steamline break.

(1) The primary-to-secondary leakage of 1 gpm has remained constant for one year in order to maximize the radionuclide inventory in the secondary side.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-19

WATTS BAR WBNP-90 (2) Primary coolant activity is associated with 1% defective fuel and is determined by multiplying the 0.12% failed fuel values listed in Table 11.1-7 by 8.

(3) The iodine partition factor in the steam generators is:

amount of iodine/unit mass steam

= 0.01 amount of iodine/unit mass liquid The iodine partition factor in the condenser is:

amount of iodine/unit volume steam

= 0.01 (Reference 1) amount of iodine/unit volume liquid (4) No noble gas is dissolved or contained in the steam generator water, i.e., all noble gas leakage to the secondary system is continuously released with steam from the steam generator.

(5) The blowdown rate from steam generators is continuous at 25 gpm per steam generator.

(6) After eight hours following the accident, no steam and activity are released to the environment.

(7) No condenser vacuum release during the accident.

(8) The 0-2 and 2-8 hour accident atmospheric dilution factors given inAppendix 15A and the 0-8 hour breathing rate of 3.47 x 10-4 m3/sec are applicable.

Doses are based on the dose models presented in Appendix 15A.

The steam releases to the atmosphere for the steam line break are given in Table 15.5-16.

The gamma, beta, and thyroid doses for the steam line break accident at the exclusion area boundary and low population zone are given in Table 15.5-17. The doses from this accident are less than the reference values as listed in 10 CFR 100 (25 rem whole body and 300 rem thyroid).

15.5.5 Environmental Consequences of a Postulated Steam Generator Tube Rupture Thermal and hydraulic analysis has been performed to determine the plant response for a design basis steam generator tube rupture (SGTR), and to determine the integrated primary to secondary break flow and mass releases from the ruptured and intact steam generators (SGs) to the condenser and the atmosphere (Section 15.4.3).

An analysis of the environmental consequences of the postulated SGTR has also been performed, utilizing the reactor coolant mass and secondary steam mass releases 15.5-20 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 determined in the base thermal and hydraulic analysis (See Reference [38] in Section 15.4). Table 15.5-18 summarizes the parameters used in the SGTR analysis.

The SGTR thermal and hydraulic analysis documents use WBN specific parameters and actual operator performance data, as determined from simulator exercises utilizing the appropriate emergency operating procedures (EOPs). The primary side activity release was determined by using maximum Technical Specification (TS) limit design reactor coolant activities assuming 1% failed fuel isotopic spectrum, and a pre-existing iodine spike of a factor of ten. The secondary side releases were determined using expected secondary side activities, based on ANSI/ANS-18.1-l984[14] as modified for WBN, and on a 1 gpm primary-to-secondary-side leakage. Credit was taken for flashing of the primary coolant (References [34] and [35] of Section 15.4), but "scrubbing" of the iodine in the rising steam bubbles by the water in the steam generator was conservatively neglected. A partition factor of 100 was applied to iodine in the remaining unflashed coolant which will boil.

The atmospheric diffusion coefficients (X/Q) for the exclusion area boundary (EAB) and offsite dose determination are the same as those used for the LOCA analysis (Appendix 15A). The X/Q values for the control room operator were determined in the analysis. The LOCA X/Q values were based on release from the shield building vent, whereas the SGTR release is from the top of the main steam valve vault. The methodology for determination of the WBN X/Q was based on Halitsky[8].

The gamma, beta, and thyroid dose for the SGTR event are given in Table 15.5-19. It can be seen that the doses at the EAB and the low population zone were less than 10%

of the 10 CFR 100 limits. The control room operator doses from this event were determined to be well below the GDC 19 reference values.

15.5.6 Environmental Consequences of a Postulated Fuel Handling Accident The analysis of a postulated fuel handling accident is based on Regulatory Guide 1.25[11].

The parameters used for this analysis are listed in Table 15.5-20.

The bases for the Regulatory Guide 1.25 evaluations are:

(1) In the Regulatory Guide 1.25 analysis the accident occurs 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> after plant shutdown. Radioactive decay of the fission product inventory during the interval between shutdown and placement of the first spent fuel assembly into the spent fuel pit is taken into account.

(2) In the Regulatory Guide 1.25 analysis damage was assumed for all rods in one assembly.

(3) The assembly damaged is the highest powered assembly in the core region to be discharged. The values for individual fission product inventories in the damaged assembly are calculated assuming full-power operation at the end ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-21

WATTS BAR WBNP-90 of core life immediately preceding shutdown. Nuclear core characteristics used in the analysis are given in Table 15.5-21. In the Regulatory Guide 1.25 analysis, a radial peaking factor of 1.65 is used.

(4) For the Regulatory Guide 1.25 analysis all of the gap activity in the damaged rods is released to the spent fuel pool and consists of 10% of the total noble gases in the assembly other than Kr-85, 30% of the Kr-85, and 10% of the total radioactive iodine in the rods at the time of the accident.

(5) Noble gases released to the spent fuel pool are released through the Shield Building vent to the environment.

(6) In the Regulatory Guide 1.25 analysis the iodine gap inventory is composed of inorganic species (99.75%) and organic species (0.25%).

(7) In the Regulatory Guide 1.25 analysis the spent fuel pool decontamination factors for the inorganic and organic species are 133 and 1, respectively.

(8) All iodine escaping from the pool is exhausted to the environment through charcoal filters.

(9) A filter efficiency of 99% is used for elemental and organic iodine for the ABGTS filters and 90% for inorganic iodine and 30% organic iodine for the purge air exhaust filters.

(10) No credit is taken for natural decay either due to holdup in the Auxiliary Building or after the activity has been released to the atmosphere.

(11) The short-term (i.e., 0-2 hour) atmospheric dilution factors at the exclusion area boundary and low population zone given in Table 15A-2 are used.

Doses are based on the dose models presented in Appendix 15A.

The thyroid, gamma, and beta doses for FHAs in the Auxiliary and Reactor Buildings are given in Table 15.5-23 for the exclusion area boundary and low population zone.

These doses are much less than 300 rem to the thyroid, 25 rem gamma to the whole body, and 100 rem beta and are within 10 CFR 100 guidelines. These doses are calculated by using the computer code FENCDOSE[16].

The ventilation function of the reactor building purge ventilating system (RBPVS) is not a safety-related function. However, the filtration units and associated exhaust ductwork do provide a safety-related filtration path following a fuel-handling accident prior to automatic closure of the associated isolation valves. The RBPVS contains air cleanup units with prefilters, HEPA filters, and 2-inch-thick charcoal adsorbers. This system is similar to the auxiliary building gas treatment system except that the latter is equipped with 4-inch-thick charcoal adsorbers. Anytime fuel handling operations are being carried on inside the primary containment, either the containment is isolated or the reactor building purge filtration system is operational. The assumptions listed above are, therefore, applicable to a fuel handling accident inside primary containment except that the assigned filter efficiency is 90% for inorganic iodine and 30% for 15.5-22 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 organic iodine since no relative humidity control is provided. For the Regulatory Guide 1.25 analysis, this results in a thyroid dose at the exclusion area boundary of 42.2 rem and at the LPZ boundary of 9.8 rem. In these considerations no allowance has been made for possible holdup or mixing in the primary containment or isolation of the primary containment as a result of high radiation signals from monitors in the ventilation systems. Containment isolation can only result in smaller releases to the environment and lower doses. The result of a fuel handling accident inside the primary containment is well below the limits of 10 CFR 100.

15.5.7 Environmental Consequences of a Postulated Rod Ejection Accident This accident is bounded by the loss-of-coolant accident. See Section 15.5.3 for the loss-of-coolant accident.

REFERENCES (1) Styrikovich, M. A., Martynova, 0. I., Katkovska, K. YA., Dubrovski, I. YA.,

Smrinova, I. N., "Transfer of Iodine from Aqueous Solutions to Saturated Vapor," translated from Atomnaya Energiya, Vol. 17, No. 1, pp. 45-49, July 1964.

(2) Regulatory Guides for Water Cooled Nuclear Power Plants, Regulatory Guide 1.24, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Pressurized Water Reactor Gas Storage Tank Failure,"

Division of Reactor Standards, U.S. Atomic Energy Commission, March 23, 1972.

(3) Regulatory Guide 1.4, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors," Directorate of Regulatory Standards, U.S. Atomic Energy Commission, June 1974.

(4) D. D. Malinowski, "Iodine Removal in the Ice Condenser System,"

WCAP-7426, April 1970.

(5) NAA-SR 10100, Conventional Buildings for Reactor Containment.

(6) ORNL-NSIC-4, Behavior of Iodine in Reactor Containment Systems, February 1965.

(7) Branch Technical Position CSB 6-2, "Control of Combustible Gas Concentrations in Containment Following a Loss-of-Coolant Accident."

(8) James Halitsky, Jack Golden, Paul Halpern, and Paul Wu, "Wind Tunnel Tests of Gas Diffusion from a Leak in the Shell of a Nuclear Power Reactor and from a Nearby Stack," New York University College of Engineering Research Division, Department of Meteorology and Oceanography Geophysical Sciences Laboratory, Report No. 63-2, April 1, 1963.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-23

WATTS BAR WBNP-90 (9) K. G. Murphy and Dr. K. M. Campe "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19," 13th AEC Air Cleaning Conference, August 1974.

(10) Deleted by Amendment 80.

(11) Regulatory Guides for Water Cooled Nuclear Power Plants, Regulatory Guide 1.25, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors," Division of Reactor Standards, U.S. Atomic Energy Commission, March 23, 1972.

(12) Regulatory Guides for Water Cooled Nuclear Power Plants, Regulatory Guide 1.77, "Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors," Directorate of Regulatory Standards, U.S. Atomic Energy Commission, May 1974.

(13) D. B. Risher, Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods,"

WCAP-7588, Revision 1, December 1971.

(14) ANSI/ANS-18.1-1984, "Radioactive Source Terms for Normal Operations of Light Water Reactors," December 31, 1984.

(15) WCAP-7664, Revision 1, "Radiation Analysis Design Manual-4 Loop Plant,"

RIMS Number NEB 810126 316, October 1972.

(16) Computer Code FENCDOSE, Revision 3, Code I.D. 262358.

(17) Computer Code COROD, Revision 3, Code I.D. 262347.

15.5-24 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS WATTS BAR Table 15.5-1 Parameters Used In Loss Of A. C. Power Analyses Realistic Analysis Conservative Analysis Core thermal power 3565 MWt 3565 MWt Steam generator tube leak rate 1 gpm 1.0 gpm prior to and during accident Fuel defects ANSI/ANS 18.1 - 1984 1%

Iodine partition factor in 0.01 0.01 steam generator prior to and during accident Iodine partition factor in 0.01 0.01 condenser prior to accident Blowdown rate per steam 25 gpm 25 gpm generator prior to accident Duration of plant cooldown by secondary system after 8 hr 8 hr accident Steam release from 4 steam 625,000 lbs (0-2 hr) 625,000 lbs (0-2 hr) generators 959,000 lbs (2-8 hr) 959,000 lbs (2-8 hr)

Meteorology See Table 15A-2 See Table 15A-2 15.5-25 WBNP-80

WATTS BAR WBNP-90 Table 15.5-2 Doses From Loss Of A. C. Power Exclusion Area Boundary Dose (Rem)

Thyroid Gamma Beta

-4 -5 Realistic Analysis 3.062 x 10 3.063 x 10 2.686 x 10-5 Conservative Analysis 2.450 x 10-3 2.450 x 10-4 2.149 x 10-4 Low Population Zone Dose (Rem)

Thyroid Gamma Beta Realistic Analysis 1.633 x 10-4 1.913 x 10-5 1.832 x 10-5 Conservative Analysis 1.306 x 10-3 1.530 x 10-4 1.466 x 10-4 15.5-26 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Table 15.5-3 Parameters Used In Waste Gas Decay Tank Rupture Analyses Regulatory Guide Realistic Analysis 1.24 Analysis Core thermal power 3565 MWt 3565 MWt Plant load factor 1.0 1.0 Fuel defects ANSI/ANS-18.1, 1984 1%

Activity released from GWPS (1) See Table 15.5-4 Time of accident After Tank Fill Immediately after at end of equilibrium core cycle Meteorology See Table 15A-2 See Table 15A-2 (1)Activity based on maximum concentrations of each isotope and actual plant flow rates of the GWPS.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-27

WATTS BAR WBNP-80 Table 15.5-4 Waste Gas Decay Tank Inventory (One Unit) (Regulatory Guide 1.24 Analysis)

Activity Isotope (Curies)

Xe-133 7.02 x 104 Xe-133m 7.75 x 102 Xe-135 1.58 x 103 Xe-135m 1.75 x 102 Xe-138 1.75 x 102 Kr-85 4.14 x 103 Kr-85m 5.25 x 102 Kr-87 3.00 x 102 Kr-88 9.25 x 102 I-131 1.44 x 10-1 I-132 ---------

I-133 7.27 x 10-2 I-134 ---------

I-135 2.70 x 10-3 15.5-28 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Table 15.5-5 Doses From Gas Decay Tank Rupture Exclusion Area Boundary Dose (Rem)

Thyroid Gamma Beta

-2 -2 Realistic Analysis 1.789 x 10 2.755 x 10 1.050 x 10-1 Regulatory Guide 1.24 Analysis 5.110 x 10-2 9.161 x 10-1 1.702 Low Population Zone Dose (Rem)

Thyroid Gamma Beta Realistic Analysis 4.155 x 10-3 6.399 x 10-3 2.438 x 10-2 Regulatory Guide 1.24 Analysis 1.187 x 10-2 2.128 x 10-1 3.953 x 10-1 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-29

WATTS BAR WBNP-80 Table 15.5-6 Parameters Used In Loca Analysis Regulatory Guide 1.4 Analysis Core thermal power 3565 MWt Primary containment free volume 1.27 x 106 ft3 Annulus free volume 3.75 x 105 ft3 Primary containment deck (air return) fan flow rate 40,000 cfm Number of deck (containment air return fans) fans assumed 1 of 2 operating Activity released to primary containment and available for release noble gases 100% of core inventory iodines 25% of core inventory Form of iodine activity in primary containment available for release elemental iodine 91%

methyl iodine 4%

particulate iodine 5%

Ice condenser removal efficiency for elemental and See Table 15.5-7 particulate iodine Primary containment leak rate (volume percent) 0.25% per day (0-24 hours) 0.125% per day (1-30 days)

Percent of primary containment leakage to auxiliary building 25%

ABGTS filter efficiencies elemental iodine 99%

methyl iodine 99%

particulate iodine 99%

Delay time of activity in auxiliary building before ABGTS None operation Delay time before filtration credit is taken for the ABGTS 4 min Mean holdup time in auxiliary building after initial 10 minutes 0.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> ABGTS flow rate 9000 cfm 15.5-30 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-6 Parameters Used In Loca Analysis Leakage from Auxiliary Building to ABGTS downstream 27.88 cfm HVAC (bypass of filters)

Leakage from ABGTS HVAC into Auxiliary Building 8.87 cfm Leakage from Auxiliary Building into EGTS downstream 10.7 cfm HVAC (bypass of filters)

Leakage from Auxiliary Building to environment due to single 9900 cfm (for 4 minutes) failure of ABGTS (from 30 minutes to 34 minutes post-LOCA)

Percent of primary containment leakage to annulus 75%

Emergency gas treatment system flow rates See Table 15.5-8 Percent of annulus free volume available for mixing of 50%

recirculated activity Number of emergency gas treatment system air handling 1 of 2 units operating Emergency gas treatment system filter efficiencies elemental iodine 99%

methyl iodine 99%

particulate iodine 99% 99%

Shield building mixing model (see Section 15.5.3) 50% mixing Meteorology See Table 15A-2 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-31

WATTS BAR WBNP-90 Table 15.5-7 Ice Condenser Elemental And Particulateiodine Removal Efficiency(1)

Time Interval Iodine Removal Post LOCA (Hours) Efficiency 0.0 to 0.156 0.96 0.156 to 0.267 0.76 0.267 to 0.323 0.73 0.323 to 0.489 0.71 0.489 to 0.615 0.60 0.615 to 0.768 0.58 0.768 to 0.824 0.40 0.824 to 720 0.0 (1)The ice condenser removal efficiencies given in the above table are used for the Regulatory Guide 1.4 analysis. The inlet steam/air mixture coming into the ice condenser is greater than 90% steam by volume initially due to the delaying of the operation of the containment deck fans.

Without the delay of operation of the deck fans, the amount of steam by volume in the inlet mixture initially would be much lower and the ice condenser iodine removal efficiencies would be reduced.

15.5-32 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Table 15.5-8 Emergency Gas Treatment System Flow Rates Time Interval Time Interval Recirculation Rate Exhaust Rate (sec) (hours) cfm cfh cfm cfh 0-30 0-0.00833 0.00 0.00 0.00 0.00E+00 30-84 0.00833-0.0233 3600.00 2.16E+05 0.00 0.00E+00 84-85 0.0233-0.0236 3286.62 1.97E+05 313.38 1.88E+04 85-86 0.0236-0.0238 2352.31 1.41E+05 1247.69 7.49E+04 86-87 0.0238-0.0242 1304.79 7.83E+04 2295.21 1.38E+05 87-88 0.0242-0.0244 362.60 2.18E+04 3237.40 1.94E+05 88-104 0.0244-0.0289 0.00 0.00E+00 3600.00 2.16E+05 104-105 0.0289-0.0292 50.55 3.03E+03 3549.45 2.13E+051.5 105-106 0.0292-0.0294 1006.42 6.04E+04 2593.58 6E+05 106-107 0.0294-0.0297 993.21 5.96E+04 2606.79266 1.56E+05 107-120 0.0297-0.0333 931.51 5.59E+04 8.49 1.60E+05 120-130 0.0333-0.0361 843.72 5.06E+04 2756.28 1.65E+05 130-145 0.0361-0.0403 779.80 4.68E+04 2820.20 1.69E+05 145-160 0.0403-0.0444 732.93 4.40E+04 2867.07 1.72E+05 160-168 0.0444-0.0467 715.86 4.30E+04 2884.14 1.73E+05 168-169 0.0467-0.0469 713.85 4.28E+04 2886.15 1.73E+05 169-190 0.0469-0.0528 724.66 4.35E+04 2875.34 1.73E+05 190-210 0.0528-0.0583 763.89 4.58E+04 2836.11 1.70E+05 210-230 0.0583-0.0639 831.58 4.99E+04 2768.42 1.66E+05 230-250 0.0639-0.0694 919.68 5.52E+04 2680.32 1.61E+05 250-270 0.0694-0.0750 1021.62 6.13E+04 2578.38 1.55E+05 270-446 0.0750-0.1239 1563.59 9.38E+04 2036.41 1.22E+05 446-602 0.1239-0.1672 2357.42 1.41E+05 1242.58 7.46E+04 602-603 0.1672-0.1675 2663.76 1.60E+05 936.24 5.62E+04 603-1607 0.1675-0.4464 3600.00 2.16E+05 0.00 0.00E+00 1607-1608 0.4464-0.4467 3594.46 2.16E+05 5.54 3.32E+02 1608-1609 0.4467-0.4469 3458.91 2.08E+05 141.09 8.47E+039.6 1609-1610 0.4469-0.4472 3438.76 2.06E+05 161.24 7E+03 1610-1611 0.4472-0.4475 3435.54 2.06E+05 164.46 9.87E+03 1611-1612 0.4475-0.4478 3434.81 2.06E+05 165.19 9.91E+03 1612-1855 0.4478-0.5153 3409.64 2.05E+05 190.36 1.14E+04 1855-2100 0.5153-0.5833 3374.31 2.02E+05 225.69 1.35E+04 2100-30 days* 0.5833-720 3350.00 2.01E+05 250.00 1.50E+04

• Required to maintain annulus pressure when assuming 250 cfm annulus inleakage.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-33

WATTS BAR WBNP-90 Table 15.5-9 DOSES FROM LOSS-OF-COOLANT ACCIDENT 2-Hour Exclusion Area Boundary Dose (Rem)

Thyroid Gamma Beta Regulatory Guide 1.4 Analysis 34.07 2.253 1.233 30-Day Low Population Zone Dose (Rem)

Thyroid Gamma Beta Regulatory Guide 1.4 Analysis 11.01 1.652 1.791 15.5-34 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-10 Deleted by Amendment 80 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-35

WATTS BAR WBNP-80 Table 15.5-11 Deleted by Amendment 80 15.5-36 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS WATTS BAR Table 15.5-12 PARAMETERS USED IN ANALYSIS OF RECIRCULATION LOOP LEAKAGE FOLLOWING A LOCA Regulatory Guide 1.4 Analysis Core thermal power 3565 MWt Recirculation sump water volume Reactor coolant system 11,375 ft3 Accumulators 4,000 ft3 Refueling water storage tank 46,800 ft3 Ice Melt 34,100 ft3 Total 96,275 ft3 Activity mixed with recirculation loop water Noble gases 0.0 Iodines 50% of core inventory Leakage of ECCS equipment outside containment See Table 6.3-6 Iodine partition factor for leakage 0.1 Regulatory Guide 1.4 Analysis ABGTS filter efficiencies elemental iodine 99%

methyl iodine 99%

particulate iodine 99%

Meteorology See Table 15A-2 15.5-37 WBNP-90

WATTS BAR WBNP-90 Table 15.5-13 Doses From Recirculation Loop Leakage Following A LOCA Exclusion Area Boundary Dose (Rem)

Thyroid Gamma Beta Exclusion Area Boundary Dose (Rem) 0.2205 0.0284 0.0152 Low Population Zone Dose (Rem) 0.1623 0.1581 0.1946 15.5-38 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Table 15.5-14 Atmospheric Dilution Factors At The Control Building Time Period Dilution Factor (hr) (sec/m3) 0-2 3.11 x 10 Unit 1 Exhaust, Intake 1 2-8 1.64 x 10 Unit 1 Exhaust, Intake 1 8-24 8.34 x 10 Unit 1 Exhaust, Intake 2 24-96 4.36 x 10 Unit 1 Exhaust, Intake 2 96-720 1.06 x 10 Unit 1 Exhaust, Intake 2 Note:The above atmospheric dilution factors have been modified (multiplied) by the following factors (methodology from Murphy and Campe[9]):

0-8 hrs1.0 8-24 hrs 0.75 + F/4 1-4 day(s) 0.5 + F/2 4-30 days F Where F is the annual average wind direction frequency. The values of F are:

Unit 1, Intake 1 F = 0.195 Unit 1, Intake 2 F = 0.204 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-39

WATTS BAR WBNP-90 Table 15.5-15 Control Room Personnel Doses For DBA LOCA Post-Accident Period **

Personnel Dose Source Whole Body Beta Dose Thyroid Dose Gamma Dose (rem)* (rem)*

(rem)*

Control room airborne activity 2.563 21.86 8.94 Shine 0.0152 0 0 Ingress-egress 0.0789 0.1529 0.2693 TOTAL 2.657 22.01 9.209

• Includes occupancy factor:

100% occupancy 0-24 hours 60% occupancy 1-4 days 40% occupancy 4-30 days

• • Control room LOCA doses are bounding for all Section 15.5 design basis events in terms of maximum dose to main control room personnel.

15.5-40 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-16 Parameters Used In Steam Line Break Analysis Conservative Analysis Core thermal power 3565 MWt Steam generator tube leak rate 1.0 gpm Offsite power Lost Failed fuel 1%

Iodine partition factor prior to 0.01 accident and for long-term steam release from steam generators Iodine partition factor in condenser 0.01 Blowdown rate per steam generator 25 gpm prior to accident Initial steam release from defective 150,000 lbs (0-30 min) steam generator Long-term steam release from defective 1000 lbs (30 min-8 hr) steam generator Steam release from 3 non-defective 480,000 lbs (0-2 hr) steam generators 871,000 lbs (2-8 hr)

Meteorology See Table 15A-2 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-41

WATTS BAR WBNP-90 Table 15.5-17 Doses From Steam Line Break Exclusion Area Boundary Dose (Rem)

Thyroid Gamma Beta

-3 -5 Conservative Analysis 2.202 x 10 9.441 x 10 6.828 x 10-5 Low Population Zone Dose (Rem)

Thyroid Gamma Beta

-4 -5 Conservative Analysis 6.014 x 10 2.631 x 10 1.866 x 10-5 15.5-42 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Table 15.5-18 Parameters Used In Steam Generator Tube Rupture Analysis Primary Side Activity Technical Specification Limit (Based on Design/1% failed fuel)

Secondary Side Activity ANSI/ANS-18.1-1984 (Expected levels, 1 gpm leak)

Iodine Spiking Factor 10 Iodine Partition Factor 100 Secondary Side Mass Release (Ruptured Steam Generator) 0-2 hours 104,300 lbm 2-8 hours 30,700 lbm Secondary Side Mass Release (Intact Steam Generator) 0-2 hours 510,600 lbm 2-8 hours 938,400 lbm Primary Coolant Mass Release (Total) 0-2 hours 185,500 lbm Primary Coolant Mass Release (Flashed) 0-2 hours 9646.4 lbm Atmospheric diffusion coefficients for control room 4.07 x 10 (0-2hrs)

Operator doses 2.47 x 10 (2-8hrs)

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-43

WATTS BAR WBNP-90 Table 15.5-19 Doses From Steam Generator Tube Rupture Thyroid Gamma Beta (rem) (rem) (rem)

Exclusion Area Boundary 16.10 0.3732 0.6341 Low Population Zone 3.74 0.0867 0.1473 15.5-44 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-20 Parameters Used In Fuel Handling Accident Analysis Regulatory Guide 1.25 Analysis Time between plant shutdown and accident 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> Damage to fuel assembly All rods ruptured Fuel assembly activity Highest powered fuel assembly in core region discharged Activity release to spent fuel pool Gap activity in ruptured rods(1)

Radial peaking factor 1.65 Form of iodine activity released to spent fuel pool elemental iodine 99.75%

methyl iodine 0.25%

Decontamination factor in spent fuel pool elemental iodine 133 methyl iodine 1 noble gases 1 Decontamination factor in spent fuel pool elemental iodine 133 methyl iodine 1 noble iodine 1 Filter efficiencies in auxiliary building elemental iodine 99%

methyl iodine 99%

Amount of mixing of activity in auxiliary building None Meteorology See Table 15A-2 Filter efficiencies in Auxiliary Building elemental iodine 99%

methyl iodine 99%

Amount of mixing of activity in Auxiliary Building None Meteorology See Table 15A-2 (1)10% of the total radioactive iodine and 10% of total noble gases, except for 30% for Kr-85, in the damaged rods at the time of the accident.

ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-45

WATTS BAR WBNP-80 Table 15.5-21 Nuclear Characteristics Of Highest Rated Discharged Assembly Used In The Analysis Core thermal power 3565 MWt Number of assemblies 193 Fuel rods per assembly 264 Core average assembly power at 102% of full power 18.84 MWt Discharged Assembly Radial peak to average ratio 1.65 15.5-46 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-22 Deleted by Amendment 80 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-47

WATTS BAR WBNP-90 Table 15.5-23 Doses From Fuel Handling Accident Regulatory Guide 1.25 Analysis Doses From A Fuel Handling Accident (FHA) (rem) FHA in Auxiliary Building Exclusion Area Low Population Boundary (EAB) Zone (LPZ)

Gamma 0.7103 0.1650 Beta 2.0509 0.4764 Thyroid 1.6893 0.3924 FHA in Reactor Building Gamma 0.7198 0.1672 Beta 2.0569 0.4778 Thyroid 42.2364 9.811 15.5-48 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-80 Table 15.5-24 Deleted by Amendment 80 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15.5-49

WATTS BAR WBNP-80 Table 15.5-25 Deleted by Amendment 80 15.5-50 ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

WATTS BAR WBNP-90 Figure 15.5-1 Schematic of Leakage Path Environmental Consequences of Accidents 15.5-51

WATTS BAR WBNP-80 Figure 15.5-2 Deleted by Amendment 80 15.5-52 Environmental Consequences of Accidents

WATTS BAR WBNP-26 Figure 15.5-3 Primary Pressure Versus Time Following Rod Ejection Accident Environmental Consequences of Accidents 15.5-53

WATTS BAR 15.5-54 Environmental Consequences of Accidents Figure 15.5-4 Secondary System Pressure versus Time Following Rod Ejection Accident WBNP-26 Watts Bar FSAR Section15.0 Accident Analyses

WATTS BAR WBNP-92 15A DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15A.1 INTRODUCTION This Appendix identifies the models used to calculate the offsite radiological doses that would result from releases of radioactivity due to various postulated accidents. The postulated accidents are:

(1) Fuel Handling Accident (2) Waste Gas Decay Tank Rupture (3) Steam Generator Tube Rupture (4) Steam Line Break (5) Loss of A. C. Power (6) Loss of Coolant Accident 15A.2 ASSUMPTIONS The following assumptions are basic to both the model for the gamma and beta doses due to immersion in a cloud of radioactivity and the model for the thyroid dose due to inhalation of radioactivity.

(1) Direct radiation from the source point is negligible compared to gamma and beta radiation due to submersion in the radioactivity leakage cloud.

(2) All radioactivity releases are from the appropriate point of discharge.

(3) The dose receptor is a standard man as defined by the International Commission on Radiological Protection (ICRP).[1}

(4) Radioactive decay from the point of release to the dose receptor is neglected.

(5) Isotopic data such as decay rates and decay energy emissions are taken from Table of Isotopes.[2]

15A.3 GAMMA DOSE AND BETA DOSE The gamma and beta dose delivered to a dose receptor is obtained by considering the dose receptor to be immersed in a radioactive cloud which is infinite in all directions above the ground plane, i.e., an "infinite semispherical cloud." The concentration of radioactive material within this cloud is taken to be uniform and equal to the maximum centerline ground level concentration that would exist in the cloud at the appropriate distance from the point of release.

The beta dose is a result of external beta radiation and the gamma dose is a result of external gamma radiation. Equations describing an infinite semispherical cloud were used to calculate the doses for a given time period as follows:[5]

INTRODUCTION 15A.1-1

WATTS BAR WBNP-80 Beta Dose = 0.23 ( X Q ) t AR E i i i

and Gamma Dose = 0.25 ( X Q ) t AR Ei i

i where:

ARi=activity of isotope i released during a given time period, curies (X/Q)t=atmospheric dilution factor for a given time interval t, sec/m3 Ei=average beta radiation energy emitted by isotope i per disintegration, mev/dis Ei=average gamma radiation energy omitted by isotope i per disintegration, mev/dis 15A.4 THYROID INHALATION DOSE The thyroid dose for a given time period t, is obtained from the following expression[6]:

D = ( X Q )t B Qi DCFi i

where:

D = thyroid inhalation dose, rem (X/Q)t = site dispersion factor for time interval t, sec/m3 B = Breathing rate for time interval t, m3/sec Qi = total activity of iodine isotope i released in time period t, curies (DCF)i = dose conversion factor for iodine isotope i, rem/curies inhaled 15A.4-2 THYROID INHALATION DOSE

WATTS BAR WBNP-92 The isotopic data and "standard man" data are given in Table 15A-1. The atmospheric dilution factors used in the analysis of the environmental consequences of accidents are given in Chapter 2 of this report and are reiterated in Table 15A-2 of this appendix.

The gamma energies, E, on Table 15A-1 include the X-rays and annihilation gamma rays if they are prominent in the electromagnetic spectrum. Also the beta energies E4, include conversion electrons if they are prominent in the electromagnetic spectrum.

The beta energies are averaged quantities in the sense that the continuous beta spectra energies are computed as one-third the maximum beta energies.

REFERENCES (1) "Report of ICRP Committee II on Permissible Dose for Internal Radiation (1959)," Health Physics, Vol. 3, pp. 30, 146-153, 1970.

(2) Leaderer, C. M., et. al., Table of Isotopes, 6th edition, 1968.

(3) Nuclear Data Sheets, Oak Ridge National Laboratory (ORNL) Nuclear Data Group, Vol. 7, Number 1, Academic Press, New York, January 1972.

(4) Radioactive Atoms - Supplement 1, ORNL-4923, Martin, M. J., NTIS, November 1973.

(5) Regulatory Guide 1.4 "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors," USAEC, June 1974.

(6) J. J. Dinunno, et. al, "Calculation of Distance Factors for Power and Test Reactor Sites", TID 14844, March 1962.

THYROID INHALATION DOSE 15A.4-3

15A.4-4 WATTS BAR Table 15A-1 Physical Data For Isotopes Decay Constant** Gamma Energy** Beta Energy** Dose Conversion Factor*

Isotope (Hr-1) (Mev/Disint.) (Mev/Disint.) (Rem/Curie)

I-131 3.5856 x 10-3 0.371 0.197 1.48 x 106 I-132 2.97 x 10-1 2.400 0.448 5.35 x 104 I-133 3.31 x 10-2 0.477 0.423 4.00 x 105 I-134 7.92 x 10-1 1.929 0.455 2.50 x 104 I-135 1.03 x 10-1 1.779 0.308 1.24 x 105 Xe-133 5.47 x 10-3 0.03 0.146 -

Xe-133m 1.26 x 10-2 0.033 0.155 -

Xe-135 7.60 x 10-2 0.246 0.322 -

Xe-135m 2.72 x 100 0.422 0.097 -

Xe-138 2.45 x 100 2.87 0.80 -

Kr-85 7.95 x 10-6 0.0021 0.223 -

Kr-85m 1.49 x 10-1 0.151 0.233 -

Kr-87 5.33 x 10-1 1.375 1.05 Kr-88 2.50 x 10-1 1.743 0.341 BREATHING RATES Time Period Breathing Rates (Hours) (M3/Sec) 0-8 3.47 x 10-4 8 - 24 1.75 x 10-4 24 - 720 2.32 x 10-4

• Refer to Reference [4]

THYROID INHALATION DOSE

• • Refer to Reference [2]

WBNP-80

WATTS BAR WBNP-80 Table 15A-2 Accident Atmospheric Dilution Factors (sec/m3)

Conservative And Regulatory Guide Analyses Low Population Zone (4828 Time Period (hours) Exclusion Area Boundary* meters) 0-2 6.04 x 10-4 1.45 x 10-4 2-8 6.77 x 10-5 8 - 24 4.63 x 10-5 24 - 96 2.03 x 10-5 96 - 720 6.23 x 10-6

• The dilution factors were calculated for a travel distance of 1100 meters, the distance from the 100 meter radius release zone to the 1200 meter radius exclusion boundary (See Section 2.3.4).

THYROID INHALATION DOSE 15A.4-5