ML12335A437
| ML12335A437 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 12/22/2011 |
| From: | - No Known Affiliation |
| To: | Atomic Safety and Licensing Board Panel |
| SECY RAS | |
| References | |
| RAS 21611, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01 | |
| Download: ML12335A437 (188) | |
Text
United States Nuclear Regulatory Commission Official Hearing Exhibit In the Matter of:
Entergy Nuclear Operations, Inc. NYSR0014H (Indian Point Nuclear Generating Units 2 and 3)
Revised: December 22, 2011 v....~f\ REGU<..q" ASLBP #: 07-858-03-LR-BD01
- ~~~'
Docket #: 05000247 l 05000286
< 0 Exhibit #: NYSR0014H-00-BD01 Identified: 10/15/2012
~ ~
IJI o
.,
!>'
~
c;- Admitted: 10/15/2012 Withdrawn:
'e-/i-o? ~O~ Rejected: Stricken:
- . Other:
IP2 FSAR UPDATE Chapter 13, Page 2 of 40 Revision 20, 2006 OAG10000215_1317
IP2 FSAR UPDATE
- 16. Containment isolation and isolation valve seal-water systems.
- 17. Containment penetration and weld channel pressurization system.
- 18. Reactor containment high-pressure test.
- 19. Cold hydrostatic tests.
- 20. Radiation monitoring system.
- 21. Nuclear instrumentation system.
- 22. Radioactive waste disposal system.
- 23. Sampling system.
- 24. Instrument calibration.
- 25. Hot functional tests.
- b. Chemical and volume control system.
- c. Sampling system.
- d. Auxiliary coolant system.
- e. Safety injection system.
- f. Radioactive waste disposal system.
- g. Ventilation system.
- 26. Primary and secondary systems safety valves tests.
- 27. Turbine steam seal and blowdown systems.
- 28. Emergency diesel electric system.
Chapter 13, Page 3 of 40 Revision 20, 2006 OAG10000215_1318
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 1 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading [Historical Information]
System or Test Test Objective
- 1. Switchgear system (electrical To ensure continuity, circuit integrity, and the correct tests) and reliable functioning of electrical apparatus.
Electrical tests were performed on transformers, switchgear, turbine generator, motors, cables, control circuits, excitation switchgear, dc system, annunciator systems, lighting distribution switchboard, communication system, and miscellaneous equipment. Special attention was directed to the following tests:
- a. 480-V switchgear breaker interlock test.
- b. Station loss of voltage auto-transfer test.
- c. Critical power transfer test.
- d. Tests of protective devices.
- e. Equipment automatic start tests.
- f. Check exciter for proper voltage buildup.
- 2. Voice communication To verify proper communication between all systems intraplant stations, for interconnection to commercial phone service, and to balance and adjust amplifiers and speakers.
- 3. Service water system To verify, prior to critical operations, the design head capacity characteristics of the service water pumps; that the system would supply design flow rate through all heat exchangers; and would meet the specified requirements when operated in the safeguards mode.
- 4. Fire protection system To verify proper operation of the system by ensuring that the design specifications would be met for the fire service booster pump and fire service pumps, checking that automatic start functions operate as designed, and that level and pressure controls meet specifications.
- 5. Instrument and service air To verify the operation of all compressors to design systems specifications, the manual and automatic operation of controls at design setpoints, design air-dryer cycle time and moisture content of discharge air, and proper air pressure to each instrument served by the system.
- 6. Nitrogen storage system To verify system integrity, valve operability, regulating and reducing station performance, and the ability to supply nitrogen to interconnecting systems as required.
Chapter 13, Page 4 of 40 Revision 20, 2006 OAG10000215_1319
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 2 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 7. Reactor coolant system To flush and clean the reactor coolant and related cleaning primary systems to obtain the degree of cleanliness required for the intended service. Provisions to maintain cleanliness, integrity, and protection from contamination sources were made after system cleaning and acceptance.
The system, component, or section of a system was considered clean when the flush cloth showed no grindings, filings or insoluble particulate matter larger than 40 11m (lower limit of naked eye visibility). After systems were flushed clean of particulate matter within the limit specified, the cleanliness integrity of the system was maintained filled with water, which met the system cold chemistry requirements. After fill and pressurization and prior to hot operation, cold chemistry requirements were maintained. Oxygen was analyzed and brought into specification prior to exceeding 200°F.
- 8. Reactor containment air To verify, prior to critical operation, the fan recirculation and filtration capacities, and the remote and automatic operation system of system louvers and valves in accordance with the design specifications.
- 9. Feedwater and condensate To verify proper operation of feedwater and circulation systems Circulating water pumps according to specifications, valve and control operability and setpoints, flushing and hydro as applicable, inspection for completeness and integrity. Functional testing was performed when the steam supply became available.
Chapter 13, Page 5 of 40 Revision 20, 2006 OAG10000215_1320
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 3 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 10. Auxiliary coolant system To verify component cooling flow to all components and to verify proper operation of instrumentation, controllers, and alarms. Specifically, each of the three loops, that is, the component cooling loop, the residual heat removal loop, and the spent fuel pit cooling loop, were tested to ensure that:
- a. All manual and remotely operated valves were operable manually and/or remotely.
- b. All pumps performed according to manufacturer's specifications.
- c. All temperature, flow, level, and pressure controllers functioned to control at the required setpoint when supplied with appropriate signals.
- d. All temperature, flow, level, and pressure alarms functioned at the required locations when the alarm setpoint was reached and cleared when the reset point was reached.
- e. Design flow rates were established through heat exchangers.
- 11. Chemical feed system To verify valve and control operability and setpoints, flushing and hydro as applicable, inspection for completeness and integrity. Functional testing was performed when the steam supply became available.
Chapter 13, Page 6 of 40 Revision 20, 2006 OAG10000215_1321
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 4 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 12. Chemical and volume control To verify, prior to critical operation, that the chemical system and volume control system would function as specified in the system description and appropriate technical manuals. More specifically that:
- a. All manual and remotely operated valves were operable manually and/or remotely.
- b. All pumps performed to manufacturer's specifications.
- c. All temperature, flow, level, and pressure controllers functioned to control at the required setpoint when supplied with appropriate signals.
- d. All temperature, flow, level, and pressure alarms functioned at the required locations when the alarm setpoint was reached and cleared when the reset point was reached.
- e. The reactor makeup control accomplished blending, dilution, and boration as designed.
- f. The design seal-water flow rates were attainable at each reactor coolant pump.
- g. The boric acid evaporator package functioned as specified in the manufacturer's technical manual.
- 13. Containment spray system To verify performance of the containment spray pumps.
Chapter 13, Page 7 of 40 Revision 20, 2006 OAG10000215_1322
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 5 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 14. Safety injection system To verify, prior to critical operation, response to control signals and sequencing of the pumps, valves, and controllers of this system as specified in the system description and the manufacturer's technical manuals, and check the time required to actuate the system after a safety injection signal is received.
More specifically that:
- a. All manual and remotely operated valves were operable manually and/or remotely.
- b. All pumps performed their design functions satisfactorily.
- c. For each pair of valves to redundant flow paths, disabling one of the valves would not impair remote operation of the other.
- d. The proper sequencing of valves and pumps occurred on initiation of a safety injection signal.
- e. The fail position on loss of power for each remotely operated valve was as specified.
- f. Valves requiring coincidence signals of safety injection and high containment pressure operated when supplied with these signals.
- g. All level and pressure units were set at the specified points and provided alarms at the required location(s), and reset at the specified point
- h. The time required to actuate the system was within the design specifications.
Chapter 13, Page 8 of 40 Revision 20, 2006 OAG10000215_1323
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 6 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 15. Fuel handling system To show that the system design would be capable of providing a safe and effective means of transporting and handling fuel from the time it reaches the plant until it leaves the plant In particular, the tests were designed to verify that
- a. The major structures required for refueling such as the reactor cavity, refueling canal, spent fuel storage pool, and decontamination facilities were in accordance with the design specifications.
- b. The major equipment required for refueling such as the manipulator crane, spent fuel pit bridge, and fuel transfer system would operate in accordance with the design specifications.
- c. All auxiliary equipment and instrumentation would function properly.
- 16. Containment isolation and To verify the capability for reliable operation and to isolation valve seal water demonstrate the manual and automatic operation of systems the system. To demonstrate the operation and proper sequence of isolation valve closure and seal-water addition. To demonstrate function of isolation valve seal-water system independent of other systems. To demonstrate the operation and system response time induced by an isolation signal. Manual valves were manipulated to ensure proper operation of the seal-gas injection portion of the system.
- 17. Containment penetration and To verify the air system and nitrogen backup system weld channel pressurization integrity, operate valves, check flow-meters and system pressure gauges as required to ensure that pressure differentials would meet design specifications.
- 18. Reactor containment To verify, prior to critical operation, the structural high-pressure test integrity and leaktightness of the containment
- 19. Cold hydrostatic tests To verify the integrity and leaktightness of the reactor coolant system and related primary systems with the performance of a hydrostatic test at the specified test pressure with no visible leakage or distortion.
Chapter 13, Page 9 of 40 Revision 20, 2006 OAG10000215_1324
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 7 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 20. Radiation monitoring system To verify the calibration, operability, and alarm setpoints of all radiation level monitors, air particulate monitors, gas monitors, and liquid monitors that are included in the operational radiation monitoring system and the area radiation monitoring system.
- 21. Nuclear instrumentation To ensure that the instrumentation system is capable system of monitoring the reactor leakage neutron flux from source range through 120-percent of full power and that protective functions are operating properly. In particular the tests were designed to verify that
- a. All system equipment, cabling, and inter-connections were properly installed.
- b. The source range detector and associated instrumentation would respond to neutron level changes and that the source range protection (high flux level reactor trip) as well as alarm features and audible count rate would operate properly.
- c. The intermediate range instrumentation reactor protection and control features (high-level reactor trip and high-level rod stop signals) would operate properly and that permissive signals for blocking source range trip and source range high-voltage-off would operate properly.
- d. The power range instrumentation would operate properly and that the protective features such as the overpower trips and permissive and dropped-rod functions would operate with the required redundancy and separation through the associated logic matrices, and nuclear power signals to other systems were available and operating properly.
- e. All auxiliary equipment such as the comparator and startup rate channel, recorders, and indicators were operating as specified.
- f. All instruments were properly calibrated and all setpoints and alarms properly set.
Chapter 13, Page 10 of 40 Revision 20, 2006 OAG10000215_1325
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 8 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 22. Radioactive waste disposal To verify satisfactory flow characteristics through the system equipment, to demonstrate satisfactory performance of pumps and instruments, to check for leaktightness of piping and equipment, and to verify proper operation of alarms, instrumentation, and controls.
More specifically that
- a. All piping and components were properly installed as per design specifications.
- b. All manual and automatic valves were operable.
- c. All instrument controllers were operating to control processes at required values.
- d. All process alarms were operable at required locations.
- e. All pumps performed to manufacturer's specifications.
t All pump indications and controls were operable at designated stations.
- g. The waste gas compressors packages operated as specified in manufacturer's technical manual.
- h. The gas analyzer operated as specified in manufacturer's technical manual.
- i. The waste evaporator operated as specified in manufacturer's technical manual.
- 23. Sampling system To verify that a specified quantity of representative fluid could be obtained safely and at design conditions from each sampling point In particular the tests were designed to verify that:
- a. All system piping and components were properly installed.
- b. All remotely and manually operated valving operated in accordance with the design specifications.
- c. All sample containers and quick-disconnect couplings functioned properly and as specified.
Chapter 13, Page 11 of 40 Revision 20, 2006 OAG10000215_1326
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 9 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 24. Instrument calibration Instrumentation and control devices were checked to ensure their accuracy. Primary sensing elements, transducers, transmitters, receivers, recorders and indicators were thoroughly inspected and adjusted for accuracy of their setpoint characteristics.
Interconnecting piping and wiring were checked for continuity and functional requirements. Each device was tested in accordance with established test procedures. Limit switches used for initiating indicating lights, alarms, and interlock functions were checked under actual or simulated operating conditions.
Control devices were exercised to ensure proper operation with the required accuracy and response characteristics. Setpoints for devices were checked and adjusted to their specified values.
Each individual circuit of the reactor and turbine protection systems was tested to verify that appropriate signals initiate reactor and turbine trips.
As a signal level corresponding to the particular condition was reached, trip or cutback functions would annunciate as provided in the particular channel under test.
Chapter 13, Page 12 of 40 Revision 20, 2006 OAG10000215_1327
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 10 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 25. Hot functional tests The reactor coolant system was tested to check heatup (using pump heat) and cooldown procedures; to demonstrate satisfactory performance of components prior to installation of the core; to verify proper operation of instrumentation, controllers, and alarms; and to provide operating conditions for checkout of auxiliary systems.
The chemical and volume control system was tested to determine that water could be charged at rated flow against normal reactor coolant system pressure, to check letdown flow against design rate for each pressure reduction station, to determine the response of the system to changes in pressurizer level, to check procedures and components used in boric acid batching and transfer operations, to check operation of the reactor makeup control, to check operation of the excess letdown and seal-water flowpath, and to verify proper operation of instrumentation, controllers, and alarms.
The sampling system was tested to determine that a specified quantity of representative fluid could be obtained safely and at design conditions from each sampling point.
The auxiliary coolant system was tested to evaluate its ability to remove heat from reactor coolant, to verify component cooling flow to all components, and to verify proper operation of instrumentation, controllers, and alarms.
The safety injection system was tested to check the time required to actuate the system after a safety injection signal is received, to check that pumps and motor-operated valves were properly sequenced, and to verify proper operation of instrumentation, controllers, and alarms.
The radioactive waste disposal system was tested to verify satisfactory flow characteristics through the equipment, to demonstrate satisfactory performance of pumps and instruments, to check for leaktightness of piping and equipment, and to verify proper operation of alarms.
The ventilation system was tested to adjust proper flow characteristics of ducts and equipment; to demonstrate satisfactory performance of fans, filters, and coolers; and to verify proper operation of instruments and alarms.
Chapter 13, Page 13 of 40 Revision 20, 2006 OAG10000215_1328
IP2 FSAR UPDATE TABLE 13.1-1 (Sheet 11 of 11)
Objectives of Tests Prior to Initial Reactor Fuel Loading System or Test Test Objective
- 26. Primary and secondary To test pressurizer and boiler safety and relief valves systems safety valves tests to ensure that each valve was operable.
- 27. Turbine steam seal and To verify valve and control operability and setpoints, blowdown systems flushing and hydro as applicable, inspection for completeness and integrity. Functional testing was performed when a steam supply became available.
- 28. Emergency diesel electric To demonstrate that the system was capable of system providing power for operation of vital equipment under power failure conditions. In particular the tests were designed to verify that:
- a. All system components were properly installed.
- b. The emergency diesels function according to the design specification under emergency conditions.
- c. The emergency units are capable of supplying the required power to vital equipment under emergency conditions.
- d. All redundant features of the system function according to the design specifications.
Chapter 13, Page 14 of 40 Revision 20, 2006 OAG10000215_1329
IP2 FSAR UPDATE 13.2 FINAL PLANT PREPARATION [Historical Information]
13.2.1 Core Loading
[Historical Information] Fuel loading did not begin until the prerequisite system tests and operations as defined in the detailed core loading procedures were satisfactorily completed and the facility operating license was obtained. Upon completion of fuel loading, the reactor upper internals and pressure vessel head were installed and additional mechanical and electrical tests were performed. The purpose of these activities was to prepare the system for nuclear operation and to establish that all design requirements necessary for operation had been achieved.
The overall responsibility and direction for initial core loading was exercised by the general superintendent. During the initial core-loading operation, the WEDCO refueling manager was in charge of the Westinghouse activities. The process of initial core load ing was, in general[ directed from the operating floor of the containment structure. Standard procedures for the control of personnel and the maintenance of containment security were established prior to fuel loading. The core configuration was specified as part of the core design studies conducted well in advance of station startup and as such was not subject to change at startup. The core was assembled in the reactor vessel, submerged in water containing sufficient quantities of boric acid to maintain the fully loaded core substantially subcritical. Core-loading procedures specify alignment of fluid systems to prevent inadvertent dilution of the boron in the reactor coolant, restrict the movement of fuel to preclude the possibility of mechanical damage[ prescribe the conditions under which loading may proceed, identify chains of responsibility and authority, and provide for continuous and complete fuel and core component accountability.
The core-loading procedure documents included a detailed tabular check sheet that prescribed and verified the successive movements of each fuel assembly and its specified inserts from its initial position in the storage racks to its final position in the core. Multiple checks were made of component serial numbers and types at successive transfer pOints to guard against possible inadvertent exchanges or substitutions of components. The results of each loading step were evaluated by the Con Edison licensed senior reactor operator and the WEDCO refueling manager before the next prescribed step was started.
Core moderator chemistry conditions (particularly boron concentration) were prescribed in the core-loading procedure document and were verified by chemical analysis of moderator samples every 8 hr during core-loading operations.
The reactor coolant system was isolated and applicable tagging and administrative procedures used to prevent unauthorized change in the boron concentration. The boric acid tank was filled with concentrated boric acid solution and the residual heat removal system placed in service and available to provide moderator mixing and temperature control, if required. A detailed preloading checkoff list was followed to ensure that all systems, equipment and conditions affecting the loading operation were met. Periodically, the checkoff list was reviewed to ensure that systems and equipment continued to meet requirements of the core-loading operation.
The core-loading sequence followed a step-by-step procedure to ensure at each loading step that:
Chapter 13, Page 15 of 40 Revision 20, 2006 OAG10000215_1330
IP2 FSAR UPDATE
- 1. Fuel assemblies of the correct enrichments were installed in the proper locations.
- 2. Rod cluster control assemblies were inserted into the proper fuel assemblies prior to loading the assemblies into the core.
- 3. Neutron sources and neutron detectors were properly located in the core during fueling. Continuous radiation monitoring was provided at the core-loading stations during fuel-handling and core-loading operations.
Core-loading instrumentation consisted of two permanently installed plant source range (pulse-type) nuclear channels and two temporary incore source range channels plus a third temporary channel to be used as a spare. The permanent channels were monitored in the control room by licensed plant operators; the temporary channels were installed in the containment and were monitored by technical specialists of Westinghouse and by licensed senior reactor operators of Con Edison. At least one plant channel and one temporary channel were equipped with audible count range indicators. Both plant channels and both regular temporary channels displayed neutron count rate on count rate meters and strip chart recorders. Two artificial neutron sources, each rated at approximately 200 Ci of Po-210 alpha activity, were introduced into the core at appropriate specified points in the core-loading program to ensure a neutron population large enough for adequate monitoring of the core.
Fuel assemblies together with inserted control components (rod cluster control units or burnable poison inserts) were added to the core one at a time according to a previously established and approved sequence that had been developed to provide reliable core monitoring with minimum possibility of core mechanical damage. The core-loading procedure documents included a detailed tabular check sheet that prescribed a nd verified the successive movements of each fuel assembly and its specified inserts from the initial position in the storage racks to the final pOSitions in the core.
An initial nucleus of eight fuel assemblies, the first of which included an activated neutron source, was determined to be the minimum source-fuel nucleus that would permit subsequent meaningful inverse count rate monitoring. This initial nucleus is known by calculation and previous experience to be markedly subcritical (keff = 0.90) under the required conditions of loading.
Subsequent fuel additions were made one assembly at a time with detailed inverse count rate ratio monitoring after each addition. The results of each loading step were evaluated by both Westinghouse technical speCialists and licensed Con Edison operations personnel; concurrent approval to proceed had to be granted before the next prescribed step was started.
Criteria for safe loading required that loading operations stop immediately if:
- 1. The neutron count rates on all responding nuclear channels doubled during any single loading step.
- 2. The neutron count rate on any individual nuclear channel increased by a factor of 5 during any single loading step.
A containment evacuation alarm was coupled to the plant source range channels to provide automatic indication of high count rate during fuel addition.
Chapter 13, Page 16 of 40 Revision 20, 2006 OAG10000215_1331
IP2 FSAR UPDATE In the event that an unacceptable increase in count rate was observed on any or all responding nuclear channels, special procedures involving fuel withdrawal from the core, detector relocation and charging of additional boric acid into the moderator could have been invoked by Westinghouse technical specialists with the approval of licensed operational personnel of Con Edison.
13.2.2 Precritical Tests [Historical Information]
Upon completion of core loading and installation of the reactor upper internals and the reactor vessel head[ certain mechanical and electrical tests were performed prior to initial criticality. The electrical wiring for the rod drive circuits, the rod position indicators, primary and secondary trip circuits, and the incore thermocouples were tested. Final operational tests were repeated on these electrical items.
Mechanical and electrical tests were performed on the rod cluster control unit drive mechanisms. Tests included a complete operational checkout of the mechanisms. Checks were made to ensure that the rod position indicator coil stacks were connected to their proper position indicators. Similar checks were made on the rod cluster control unit drive coils.
After filling and venting was completed, the final hydro tests were conducted.
Tests were performed on the reactor trip circuits to test manual trip operation. Actual rod cluster control unit drop times were measured for each rod cluster control at operating temperature, pressure, and flow. By use of dummy signals, the various plant abnormalities that require tripping were simulated and accurate trip delay times were measured for the control and protection system Circuitry.
A complete electrical and mechanical check was made on the incore nuclear flux mapping system at the operating temperature and pressure.
The incore thermocouple tests checked circuit continuity and compared the thermocouple readings for their relative errors (offsets) in the isothermal condition.
13.3 INITIAL TESTS IN THE OPERATING REACTOR [Historical Information]
After satisfactory completion of fuel loading and final precriticality tests, nuclear operation of the reactor was initiated. This final stage of startup and testing included initial criticality, low-power testing[ and power level escalation. The purposes of these tests were to establish the operational characteristics of the unit and core, to verify design prediction, to demonstrate that license requirements were being met, and to ensure that the next prescribed step in the test sequence could be safely undertaken. Reactor control setpoint verification was also performed during this stage of startup testing.
Tests that were performed from the initial core loading to rated power are summarized in Table 13.3-1.
13.3.1 Initial Criticality [Historical Information]
Initial criticality was established by withdrawing the shutdown and control banks of rod cluster control units from the core, leaving the last withdrawn control bank inserted far enough to provide effective control when criticality was achieved, and then slowly and Chapter 13, Page 17 of 40 Revision 20, 2006 OAG10000215_1332
IP2 FSAR UPDATE continuously diluting the heavily borated reactor coolant until the chain reaction was self-sustaining.
Successive stages of rod cluster control bank withdrawal and of boron concentration reduction were monitored by observing change in neutron count rate as indicated by the regular plant source range nuclear instrumentation as functions of rod cluster control bank position and, subsequently, of primary water addition to the reactor coolant system during dilution.
The inverse count rate ratio was monitored as an indication of the nearness and rate of approach to criticality of the core during rod cluster control bank withdrawal and during reactor coolant boron dilution. The rate of approach toward criticality was reduced as the reactor approached extrapolated criticality to ensure that effective control was maintained at all times.
Relevant procedures specified alignment of fluid systems to allow controlled start and stop and adjustment of the rate of approach to criticality, indicated values of core conditions under which criticality would be expected, and identified chains of responsibility and authority during reactor operations.
13.3.2 Zero-Power Testing Upon establishment of criticality a prescribed program of reactor physics measurements was undertaken to verify that the basic static and kinetic characteristics of the core were as expected and that the values of kinetic coefficients assumed in the safeguards analysis were indeed conservative.
Measurements made at zero power and primarily at or near operating temperature and pressure included verification of calculated values of rod cluster control group and unit worths, isothermal temperature coefficients under various core conditions, differential boron concentration worth, and critical boron concentrations as a function of rod cluster control group configuration. Preliminary checks on relative power distribution were made in normal and abnormal rod cluster control unit configurations.
Concurrent tests were conducted on the plant instrumentation including the source and intermediate range nuclear channels. Rod cluster control unit operation and the behavior of the associated control and indicating circuits were demonstrated.
Detailed procedures specified the sequence of tests and measurements to be conducted, and the conditions under which each was to be performed to ensure the relevancy and consistency of the results obtained. These tests covered a series of prescribed control rod configurations with intervening measurements of differential control rod worths and boron worth during boron dilution or boron injection. As the successive configurations were established, the measurement techniques used were:
- 1. Dynamic temperature coefficient measurements - Differential moderator coefficient measurement made by continuously increasing or decreasing the moderator average temperature and observing the resultant change in core reactivity.
- 2. Dynamic control rod worth measurements - Control rod differential worth measurements made by monotonically withdrawing or inserting selected control rods or groups of rods and part-length [Note - Subsequent to initial plant Chapter 13, Page 18 of 40 Revision 20, 2006 OAG10000215_1333
IP2 FSAR UPDATE operation (during the Cycfe 2/3 refueling outage), the part-length rod cfuster contraf assemblies were removed from the reactor.] rods and observing the resultant change in core reactivity.
- 3. Dynamic boron worth measurements Differential boron worth measurements made by monotonically increasing or decreasing main coolant boron concentration and observing the resultant change in core reactivity.
13.3.3 Power Level Escalation In order to ensure that operation of the core would be as expected in all respects, and that achievement of rated power was under carefully controlled conditions, a power escalation test program was established to carry the plant from completion of zero-power physics testing through full-power operation. The power escalation test program provided for stepwise achievement of full power, with careful review of significant core parameters at each step, to ensure that fuel and control rod mechanical performance, flux distribution, temperature distribution hot channel factors and reactivity control worths were acceptable before additional escalation was undertaken.
The power escalation test program provided for measurements to be made at convenient power levels in the vicinity of minimum self-sustaining power, discrete levels approaching 100-percent, and at rated power. In each case, progression to higher levels was contingent upon acceptable core performance.
Additional reactor physics measurements were made and the ability of the reactor control and protection system to respond effectively to signals from primary and secondary instrumentation under a variety of conditions encountered in norma I operations was verified. At prescribed power levels, the dynamic response characteristics of the reactor coolant and the steam systems were evaluated.
The sequence of tests, measurements, and intervening operations is prescribed in the power escalation procedures together with specific details relating to the conduct of the several tests and measurements. The measurement and test operations during power escalation are similar to those during normal operation.
The preparation for power escalation is described below. In order to monitor performance, the following analytical results were on hand before power escalation was undertaken:
- 1. Expected values for local power ratios in each of the incore flux-detector thimbles.
- 2. Expected values for relative power in each fuel assembly and in individual fuel rods of interest in various control group configurations.
- 3. Expected values of power peaking factors.
- 4. Combined power and programmed temperature reactivity defect as a function of primary power level at expected boron concentrations.
- 5. Equilibrium xenon reactivity defect as a function of primary power level.
- 6. Identification and integral reactivity worth of the most significant single rod cluster control assemblies in the control group, when fully withdrawn, with Chapter 13, Page 19 of 40 Revision 20, 2006 OAG10000215_1334
IP2 FSAR UPDATE various operating control rod configurations, for both full- and part-length rods.
- 7. Identification and integral reactivity worth of the most significant single rod cluster control assemblies among all groups[ for both full- and part-length rods.
Other conditions that were to be met before commencement of the power escalation test program were as follows:
- 1. The following plant conditions were established:
- a. The zero-power reactor physics test program had been successfully completed as prescribed. Experimental values of zero power reactivity parameters had been deduced and were available for guidance in the elevated power program.
- b. Discrepancies between analytically predicted and experimentally measured values of physics parameters had been identified and appropriate revisions had been made in the values of expected primary coolant boron concentrations and rod cluster control group positions listed in the power escalation test sequence.
- c. The reactor coolant system and all required components of the secondary coolant system were fully assembled, mechanically tested, and ready for service as required.
- d. All control, protection, and safety systems were fully installed; all required preoperational tests satisfactorily completed; and all components ready for service as required.
- e. The reactor coolant was at required temperature, pressure[ and lithium and boron concentration.
- f. Demineralized water was availa ble in adequate quantity for extensive boron dilution.
- g. Concentrated boric acid solution was available in sufficient quantity to permit increases in main coolant boron concentration as required.
- h. All special equipment and instrumentation required for the power escalation test program was installed and calibrated and available for service as specified.
- i. Thermocouple correction constants derived from the hot, isothermal calibrations.
- j. Reactor coolant flow coastdown measured and found acceptable.
- 2. A pretest checkoff list indicating the required status of all systems and auxiliary equipment affecting the power escalation test program was available. The pretest checkoff list included, but was not limited to, provisions for verification and certification of all items specified in item 1, above.
Chapter 13, Page 20 of 40 Revision 20, 2006 OAG10000215_1335
IP2 FSAR UPDATE
- 3. Experimental procedures, suitable for executing the power escalation test sequence, were available for distribution to all personnel concerned with the power escalation test program.
- 4. The procedure, schedule, and personnel assignments and responsibilities were thoroughly discussed with and understood by the operational and experimental personnel.
The following tests were conducted during the power escalation test program:
- 1. Electrical trip testing - Electrical tripping relays that are initiated by plant on-power malfunctions were retested and the consequent trip sequence rechecked under operating conditions for correct operation and sequence.
- 2. Turbine trip testing - The turbine protection system was checked to confirm that the appropriate initiation would either trip the turbine through the main trip solenoid or would mechanically trip the turbine. As the various setpoints or status conditions were reached, the trip or runback functions were verified.
- 3. Elevated power reactivity coefficient evaluation - During the approach to full power and during initial operation at power, a sequence of reactor physics measurements was carried out to determine experimentally the power and temperature coefficients and power defects at various power levels, differential (full- and part-length) control rod worth and boron worths during boron dilutions, and xenon worth during initial operation. Measurements techniques were:
- a. Dynamic differential power coefficient - Differential power coefficient measurements were made at elevated power over a limited range in power level by initiating a small power level change. The change in core reactivity associated with the compensating control rod motion is related to the net change in power level.
- b. Elevated power transient response evaluation - As the power level was increased during the initial power escalation, a series of transient response measurements was made to determine plant response to load changes. The test technique in each case conSisted of establishing the transient change in plant conditions and closely monitoring the system response during and after the transient period. The responses of system components were measured for lO-percent loss of load and recovery, loss of load with steam dump, turbine trip, loss of reactor coolant flow, and trip of single rod cluster control units. Reactor coolant coastdown was also measured.
- c. Elevated power determination of power distribution - At successive power levels and in prescribed control rod configurations (full- and part-length),
measurements of flux and power distributions within the core were made and nuclear hot channel factors evaluated. Use was made of the miniature incore flux detector system and of the incore thermocouples to determine the nuclear power and thermal and hydraulic conditions within the core.
Ex-core nuclear instrumentation was calibrated to indicate actual incore axial power distribution.
Chapter 13, Page 21 of 40 Revision 20, 2006 OAG10000215_1336
IP2 FSAR UPDATE
- d. Determination of prima ry coolant flow rate - Primary coolant flow rate was evaluated by measuring primary coolant pump power and elbow tap pressure differential.
- e. Verification of remote control stations - After the plant was certified to operate at elevated power levels, the capability for manually taking the plant to hot shutdown from stations remote from the control room was verified. This test demonstrated that controls and information available in the local control stations were functioning properly and were sufficient to permit the operators to trip the pia nt, control heat removal, and borate in an orderly manner to reach and maintain the reactor in a hot shutdown status should the control room ever become uninhabitable.
Chapter 13, Page 22 of 40 Revision 20, 2006 OAG10000215_1337
IP2 FSAR UPDATE TABLE 13.3-1 (Sheet 1 of 5)
Initial Testing Summary [Historical Information]
Test Conditions Objectives Acceptance Criteria RCC l unit drop tests 1. Cold shutdown To measure the scram time of RCC units Droptime less than value assumed in
- 2. Hot shutdown under full flow and no flow conditions safety analysis Thermocouple/RTD Various temperatures during To determine in-place isothermal RTDs verify that RTD system meets intercalibration system heatup at zero correction constants for all core exit setpoint requirements of Technical power thermocouples and reactor coolant RTDs Specifications Nuclear design check All two dimensional RCC To verify that nuclear design predictions FFD and SAR2 limiting values for tests control group configurations for endpoint boron concentrations, 8p/8T, Ft,H at hot, zero power isothermal temperature coefficient, and power distributions are valid RCC control group All RCC control groups at TO verify that nuclear design predictions FFD and SAR limiting values for 8p/8h, calibration hot, zero power for control group differential worths with L3.p/h and without part-length RCC units are valid Power coefficient O-percent to lOO-percent Of TO verify that nuclear design predictions FFD and SAR limiting values for 8p/8q measurement full power for differential power coefficient are valid Automatic control Approximately 20-percent To verify the control system response No safety criteria applicable system checkout characteristics for the:
- a. Steam generator level control system
- b. RCC automatic control system
- c. Turbine control system o
>>
G) o o
o o
N
--"
Chapter 13, Page 23 of 40 1U'l
--"
Revision 20, 2006 0) 0)
CD
IP2 FSAR UPDATE TABLE 13.3-1 (Sheet 2 of 5)
Initial Testing Summary Test Conditions Objectives Acceptance Criteria Power range During static and/or transient To verify all power range Verify that setpoints cited in instru mentation conditions at: instrumentation consisting of: Technical Specifications are met calibration 30-percent power range nuclear channels, in-70-percent core flux mapping system, core exit gO-percent thermocouple system, and reactor lOa-percent coolant RTDs are responsive to changes in reactor power level and power distribution, and to intercalibrate the several systems Load swing test +/- la-percent steps at: To verify reactor control system No safety criteria applicable fV40-percent to 50-percent performance
'" lOa-percent Plant trip Full load rejection from: To verify reactor control performance Proper operation of steam dump and N 50-percent feedwater overrides.
'" lOa-percent Pressurizer Hot, shutdown To verify that pressurizer pressure can No safety criteria applicable effectiveness test be reduced at the required rate by pressurizer spray actuation Minimum Hot, zero power To verify the nuclear design prediction of Verify stuck rod shutdown criteria shutdown the minimum shutdown boron verification concentration with one "stuck" RCC unit Psuedo ejection Hot, zero power To verify nuclear design predictions of FFD and SAR limiting values for FLlH ,
test effects on core reactivity and power reactivity insertion distribution of ejection of one RCC unit from a fully inserted control group o
>>
G) o o
o o
N
--"
Chapter 13, Page 24 of 40 1U'l
--"
Revision 20, 2006 0) 0)
CD
IP2 FSAR UPDATE TABLE 13.3-1 (Sheet 3 of 5)
Initial Testing Summary Test Conditions Objectives Acceptance Criteria Pseudo ejection test rv30~percent Of rated power To verify nuclear design predictions of FFD and SAR limiting values for FLlH ,
effects on core reactivity and power reactivity insertion distribution of ejection of one RCC unit from typical operating configuration.
Loss of flow test Hot shutdown Measure reactor coolant flow coastdown Flow coastdown no faster than FFD following trip of reactor coolant pumps and SAR curves Power redistribution '" 70-percent of rated power To verify that ex-core nuclear FFD and SAR symmetric offset FQ follow instrumentation adequately monitors correlation changes in core power distribution under transient xenon conditions Static RCC drop test rvSO-percent of rated power To verify that a single RCC unit inserted Inserted rod detectable with fully or part way below the control bank can instrumentation be detected by ex-core nuclear instrumentation and core exit thermocouples under typical operating conditions and to provide bases for adjustment of protection system setpoints RCC insertion test ",50-percent of rated power To determine the effect of a single fully See next test inserted RCC unit on core reactivity and core power distribution under typical operating conditions as bases for setting turbine runback limits o
>>
G) o o
o o
N
--"
Chapter 13, Page 25 of 40 1U'l
--"
Revision 20, 2006 0)
.j::>.
o
IP2 FSAR UPDATE TABLE 13.3-1 (Sheet 4 of 5)
Initial Testing Summary Test Conditions Objectives Acceptance Criteria Dynamic RCC drop test '" 70-percent of rated power To verify automatic detection of Required power reduction and rod dropped rod, and subsequent Withdrawal block accomplished automatic rod stop and turbine cutback Load reduction test rvSO-percent reduction from To verify reactor control system No safety criteria applicable N 70-percent
'" 50-percent reduction from iOO-percent Part-length group rvgO-percent To verify that the part-length RCC FFD and SAR limiting values for FQ I operational maneuvering maneuvering scheme is effective in Ft,H containing and suppressing spatial xenon transients Load cycle test rv40-percent ",SS-percent To verify that all plant systems are FFD and SAR limiting values for FQ ,
capable of sustaining load follow Ft,H f shutdown margin operations without encountering unacceptable operational limits through a typical weekly cycle Turbine-generator startup Pre- and Post-synchronization To verify that the turbine- Successful completion of all tests generator unit and associated mechanical and electrical and controls and trips are in good control functional checks working order and ready for service o
>>
G) o o
o o
N
...Jo.
Chapter 13, Page 26 of 40 1U'l
...Jo. Revision 20, 2006 0)
.j::>..
...Jo.
IP2 FSAR UPDATE TABLE 13.3-1 (Sheet 5 of 5)
Initial Testing Summary Test Conditions Objectives Acceptance Criteria Turbi ne-generator Power level sufficient for turbine To verify normal trouble free Performance within manufacturers auxiliaries to be operating performance of the turbine-generator limitations at low power Control valve tests N70-percent of rated power To verify capability of exercising Normal trouble free operation control valves at significant load and evaluate function of valves and controls Acceptance test run 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at rated full power To verify reliable steady state full 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> reliable equilibrium plant power capability operation at full power Notes:
- 1. Rod cluster control.
- 2. Final facility description and safety analysis report.
o
>>
G) o o
o o
N
--'"
Chapter 13, Page 27 of 40 1U'l
--'"
Revision 20, 2006 0)
.j::>..
N
IP2 FSAR UPDATE 13.4 OPERATING RESTRICTIONS 13.4.1 Safety Precautions
[Historical Information] Measurements and test operations during zero-power and power escalation phases are always performed under several active trip functions. Any verification program is concluded by several trip functions if the program attempts to violate any of the criteria of the protective circuitry. Furthermore, to ensure that transients are concluded early in the life of the transient, several of the setpoints of the trip functions are reduced, as referenced in Chapter 7.
Measurements are made at various points in the power escalation program as power level is increased. Considerations are made of the instrument accuracy and extrapolations are made for these parameters before proceeding in the program, including both instrument inaccuracies and uncertainties. A continuing verification is then made that the reactor parameters are no more limiting than those assumed in the accident analYSiS, which are the most limiting values.
Each power step is relatively small, so that a high degree of certainty is associated with the prediction of plant parameters. The accuracy of the prediction obtained for each power level is a major factor in determining further power escalation.
The reactor protection system ensures that the public safety is further protected, as stated above.
13.4.2 Initial Operation Responsibilities Ultimate responsibility for the facility rested with the holder of the operating license. During the transition from a construction oriented project to a commercial power-producing plant, equipment and systems were tested to prove their capability in accordance with design criteria. Test procedures for the initial startup program were written and approved by both Westinghouse and Con Edison prior to plant testing. Post-core-Ioad test procedures were prepared by Westinghouse and reviewed prior to performance by Con Edison through the Nuclear Facilities Safety Committee. Pertinent safety comments from the committee were factored into the procedures prior to performance. All tests and test procedures were under the control of the general superintendent of the plant to ensure that proper emphasis was placed on safety by all during these acceptance tests (Le., each test was reviewed by all responsible parties, initial plant conditions and pre-requisites to the test had been met, and proper personnel were available and understood the test procedures and precautions).
Westinghouse provided technical direction for these tests.
As part of the precautions, all licensed senior reactor operators and manufacturer's representatives whose equipment was being tested were instructed to stop a test or a portion of a test if the test was not being performed safely or in accordance with the written test procedures. The test would be promptly continued only if minor modifications to the test procedure were required and the test was approved by the general superintendent or his representative and the Westinghouse representative. If substantial revisions were required, however, the general superintendent would review the change with the same approach as that taken with a new test procedure before the test could be continued.
The Joint Test Group (consisting of responsible WEDCO and Con Edison personnel) reviewed and concurred in the release of test procedures for implementation. Technical responsibility Chapter 13, Page 28 of 40 Revision 20, 2006 OAG10000215_1343
IP2 FSAR UPDATE for each individual phase of actual startup resided with the functional group most directly concerned with the results of the test. WEDCO and Westinghouse had onsite representatives of supporting functional groups to provide technical advice, recommendations, and assistance in planning and executing the respective stages of unit startup.
All system operations in the testing program were performed by station operators in accordance with the approved written procedures. These procedures included such items as delineation of administrative procedures and test responsibilities, equipment clearance procedures, test purpose, conditions, precautions, limitations, and sequence of operations.
Procedural changes were made only in accordance with an approved standard operating procedure that required review and approval of the changes by experienced supervisory personnel.
Test procedures stating the test purpose, conditions, precautions, limitations, and criteria for acceptance were prepared for each test by WEDCO and/or Westinghouse technical advisors. All such procedures were reviewed and concurrence given by the Joint Test Group in accordance with approved standard operating procedures prior to implementation.
All test results received a preliminary review and evaluation by Con Edison site personnel.
Cognizant WEDCO/Westinghouse startup engineers and technical advisors determined the adequacy of test data for verification of design objectives. Detailed analyses of test results and issuance of final test reports were performed by WEDCO site startup and/or Westinghouse engineering and design personnel with input from Con Edison where appropriate. Con Edison reviewed all final test results to determine that design objectives and criteria had been met and gave final approval as to the acceptability of plant components, systems, and operating characteristics of the facility.
13.5 REACTOR COOLANT SYSTEM VIBRATION TESTING PROGRAM [Historical Information]
Two test programs were performed on the Indian Point Unit 2 reactor coolant system to measure the dynamic behavior of the reactor coolant system. The two programs were (1) reactor coolant system impedance test and (2) reactor internals and reactor coolant system loop vibration test under steady-state and transient conditions.
13.5.1 Reactor Coolant System Impedance Test The purpose of the impedance test was to determine the natura I frequencies, mode shapes, and damping of the main components of the reactor coolant system. These tests were performed with the reactor coolant system filled with water and were performed prior to the installation of the core and control rods. The reactor coolant and charging pumps were not in operation during this test.
Electromagnetic shakers were attached at several pOints on one of the reactor coolant system loops so that normal modes of the structure could be excited. Accelerometers were used to measure the response of the structure. The mode shape and damping at the natural frequencies were then deduced from acceleration measurements made at several points on the structure while vibrating at a natural frequency. The shaker was attached at selected locations on the steam generator, reactor coolant pumps, and loop piping; the test plans called for the following locations:
- 1. Steam generator 21, approximately 65-ft elevation/ circumferentially (i.e.,
ta ngential to the wall of the vapor container).
Chapter 13, Page 29 of 40 Revision 20, 2006 OAG10000215_1344
IP2 FSAR UPDATE
- 2. Steam generator 21, between the 100-ft elevation and the 120-ft elevation.
- 3. Main coolant pump 21, approximately 62-ft elevation, circumferentially.
- 4. Main coolant pump 21, approximately 83-ft elevation, circumferentially.
- 5. Main coolant pump 21, approximately 83-ft elevation, radially.
- 6. Intermediate leg, loop 21, approximately 54-ft elevation, radially.
Thirteen monitoring accelerometers were attached to the structure at the locations specified in Table 13.5-1 under external transducers. In addition, hand-held accelerometers were moved from point to point to establish the exact mode shape. All shakers and accelerometer cables were routed to a readout station from which the excitation was controlled and response measured.
An initial impedance plot was obtained by exciting the structure at a constant, low force level from a frequency not less than 1 Hz to a frequency not greater than 300 Hz. This was followed by additional sweeps at higher force levels to facilitate detection of natural frequencies that have relatively low response. A determination of the mode shape at each natural frequency of interest was made by measuring the amplitude and phase of the acceleration response at a large number of pOints relative to the drive pOint.
Data from which damping could be deduced were obtained by suddenly opening the electrical input of the shaker while driving at a natural frequency and recording the resulting decrement.
13.5.2 Steady-State and Transient Internals a nd Loop Vibration Measurements The objectives of the instrumentation program for the second program of testing were:
- 1. To obtain data that provided increased confidence in the adequacy of the internals structures by establishing the design margins at key locations on the structure. The strain gauge and maximum displacement indicators were used primarily for this purpose.
- 2. To obtain data that could be used to develop improved analytical tools for the prediction of internals vibrations. Comparison with the 1/7 scale model data and establishing model validity were part of this objective.
Instrumentation was provided for the reactor coolant system major components, that is, reactor vessel, reactor internals, reactor coolant piping, reactor coolant pumps, and steam generators.
13.5.2.1 Reactor Vessel and Loop Piping Six accelerometers were located on the vessel, three on the vessel head studs and three on the bottom of the vessel. The six vessel transducers were arranged so that the rigid body motion of the vessel could be measured. The loop piping was instrumented with pressure transducers installed in temperature wells on an inlet and outlet leg. In addition, the data from the external transducers were correlated with the internals data to establish remote estimation of internals motions.
Chapter 13, Page 30 of 40 Revision 20, 2006 OAG10000215_1345
IP2 FSAR UPDATE 13.5.2.2 Steam Generators One of the steam generators was instrumented in the same manner as described in Section 13.5.1 and its gross motion measured. The dynamic analysis performed on the steam generator tube bundle is described in Chapter 4.
13.5.2.3 Reactor Coolant Pumps One of the reactor coolant pumps was equipped with three accelerometers mounted at the top of the motor support stand (see Table 13.5-1). They were mounted in a horizontal plane to pick up Circumferential and radial vibrations of the pump. Prior to vibration testing (during preoperational tests), the reactor coolant pumps were checked to ensure that they were within limits. The balance and alignment were adjusted if they were not within limits initially (see Chapter 4 for further description).
13.5.2.4 Reactor Internals The reactor internals were monitored with strain gauges, accelerometers, pressure transducers, and maximum-displacement indicators. There were 46 strain gauges, 14 accelerometers, 5 pressure transducers, and 14 maximum-displacement indicators.
The instrumentation was used as follows:
- 1. Guide Tubes - The instrumentation used on the guide tubes was the same as that used on the Zorita and Ginna reactors. Three guide tubes were instrumented with strain ga uges. The central guide tube was selected because it would have no set cross flow velOCity during four-pump operation; a guide tube near the outlet nozzle at approximately 150 degrees was selected because it was expected to have the highest cross flow velocity with the initial complement of guide tubes. A guide tube near the OPPOSite outlet nozzle at approximately 330 degrees was selected because it was expected to have the highest cross flow velocity for plutonium recycle operation. In the 1/7 scale model tests for Indian Point Unit 2, the guide tube located at about 150 degrees was similarly instrumented. These data were used to compare the scale model with the actual plant.
The response of the guide tubes over the expected range of vibration frequencies was measured with strain gauges and accelerometers to provide strain versus amplitude data and to ensure that the proper location for the strain gauges had been chosen prior to installation in the reactor vessel.
- 2. Upper Core Barrel - Strain was measured at two locations on the core barrel:
(1) just below the core barrel flange and (2) at the upper to lower core barrel weldment, which is a reduced cross-section elevation (see Table 13.5-1). In addition, an axial strain gauge was placed on the outside surface of the barrel, radially inward from the centerline of an inlet nozzle. This gauge was used to obtain an indication of the stress due to the ram effect of the inlet flow against the core barrel and to compare with previous data taken at this location on the 1/7 scale Indian Point Unit 2 model, the 1/13 ENEL/SENA model, and the Obrigheim plant.
Chapter 13, Page 31 of 40 Revision 20, 2006 OAG10000215_1346
IP2 FSAR UPDATE Accelerometers were located on the upper core ba rrel to determine the vibration of the upper core barrel in its shell modes. This information contributed significantly to understanding the upper barrel strain gauge readings.
Accelerometers were also placed on two thermal shield support blocks to obtain information on the vibration of the core barrel in its ring modes and beam modes. Data were available from the 1/7 scale model at similar locations.
- 3. Thermal Shield - The measurement of the maximum stress in the thermal shield with a reasonable number of strain gauges was impossible because of the number and nonuniform spacing of supports and the flexibility of the core barrel. The most highly strained bolt that fastens the top of the shield to the core barrel was instrumented with four strain gauges. One of the four gauges was redundant so that loss of one gauge would not result in the loss of all information from this location. To measure the desired strains, the gauges were in a vertica I plane passing through the core centerline when the final torque on the bolt was reached (see Table 13.5-1).
Three flexures were instrumented. The locations of the gauges were o degrees, 90 degrees, and 240 degrees. These gauges provided the data needed to determine the forces in each of the instrumented flexures.
Three accelerometers were located at the mid-elevation of the shield and one near the bottom to provide data to assist in the interpretation of the strain gauge results and to compare with 1/7 scale model data. Supporting data were obtained from model and full-scale impedance tests.
Pressure measurements were made at the inside and outSide wall of the thermal shield. Four pressure transducers to measure the fluctuating static pressure were located near the top (82.5 degrees) and bottom (28 degrees) of the thermal shield.
Fourteen maximum displacement indicators were installed into the thermal shield snubber holes, which were not occupied by pressure transducers (eleven at the upper end a nd three at the lower end).
The maximum decrease in the proximity of the thermal shield to the core barrel and the vibratory motion of the thermal shield relative to the core barrel were obtained from these indicators by interpretation of styli scratches.
- 4. Upper Core Plate - Four accelerometers on the upper core plate were used to define the horizontal motion of the upper core plate. This information was used to determine the degree to which base motion excites the guide tubes and support columns (refer to Table 13.5-1).
- 5. Top Support Plate - A pressure transducer was mounted on the top support plate to be sensitive to vertical pressure fluctuations in the upper plenum. In addition to providing pressures in the upper plenum it was useful in relating the other pressure transducer signals to each other. A pressure transducer was placed in a similar location in the Obrigheim reactor.
Chapter 13, Page 32 of 40 Revision 20, 2006 OAG10000215_1347
IP2 FSAR UPDATE 13.S.2.S Instrumentation Description Transducers measuring strain, acceleration, and pressure as well as maximum displacement indicators were used.
- 1. Strain gauges - The strain gauges were integral lead gauges similar to those used for the Zorita and Ginna experiments. The minimum sensitivity was greater than 3 J.lin./in. from 0 to 1000 Hz.
- 2. Accelerometers - Piezoelectric accelerometers having a sensitivity of approximately 200 pc/g were used with resolution greater than O.OOS g from S Hz (+/- 0.002-in.) to 1000 Hz.
- 3. Pressure transducers - Piezoelectric pressure transducers were used[ which had a resolution of 0.2 psi. The diaphragms of the pressure transducers were flush with the surface where pressure was measured.
- 4. Maximum-displacement indicators - The maximum-displacement indicators were similar to those used in the Zorita and Ginna experiments. The internal spring-loaded plunger within the displacement pin was designed to follow the relative cyclic motion between the thermal shield and core barrel, thus causing the two stationary spring-loaded styli to leave small markings on the plunger. These marks provided a direct indication of the magnitude of the vibratory motion. The displacement indicators consisted of a cylindrical pin held by means of a clamping fit within a housing block mounted on the thermal shield. The pin was assembled and adjusted within the block so that it was tight against the outer diameter of the core barrel. Sufficient clamping force was exerted on the pin to ensure that the pin would move within the housing block only by a relative motion of the thermal shield toward the core barrel. This created a gap between the end of the pin and the core barrel that was measured during the post hot functional inspection. These measured gaps provided an indication of the total relative motion between the thermal shield and core barrel resulting from thermal differential expansion, hydraulic forces, and vibration.
13.S.2.6 Test Conditions For these tests the following conditions were required:
- 1. During cold hydrostatiC testing[ data were taken at one primary coolant temperature (less than lS0°F). This temperature was established by the temperature that existed when time for the testing occurred in the schedule.
The temperature was kept within +/-20°F during the testing.
- 2. During the hot functional tests, data were taken at a low temperature (less than lS0°F) and at the maximum test temperature. Again, the main coolant temperature was kept within +/-20°F while data was being taken. During heatup, a selected number of instruments were monitored continuously.
- 3. At the completion of hot functional testing, all instruments were removed except six strain gauges on two guide tubes, three strain gauges on the core barrel, one pressure transducer on the top support plate, and the thirteen Chapter 13, Page 33 of 40 Revision 20, 2006 OAG10000215_1348
IP2 FSAR UPDATE accelerometers on the outside structure. These instruments were monitored during precritical testing after the core was loaded. The measurements were made on these instruments for steady-state and transient conditions. Data were taken during control rod exercising, with and without moving the rods in the instrumented guide tube at the same temperature conditions as specified in items 1 and 2, above. For the above tests, data were recorded during startup transients, shutdown transients, and steady flow with several combinations of reactor coolant pumps running including each pump operating individually and all four pumps operating simultaneously. At the first refueling, the interna I transducers were removed.
This reactor coolant system testing program, when coupled with experience from offsite testing, model testing, and data from other testing programs on operating plants provided assurance that inservice vibration monitoring instrumentation is not required. (See Chapter 4 for a discussion on the metal impact monitoring system installed since the original test program.)
Chapter 13, Page 34 of 40 Revision 20, 2006 OAG10000215_1349
IP2 FSAR UPDATE Table 13.5-1 (Sheet 1 of 3)
Transducer Locations for Vibration Experiments CIt C
'"'" ...'"
..I
.." .." =
~
~
Q>
'":EQ a::
'"
,..'"
a:: <C( .." Z zt-
- ) ~
<
~
Q j: '"Q Q-
-> c "'u c;:)
'"t-=
t-- ;:)Q u
- )
c <C(
>
",'
.." (,.)~ '"
.." CIt CIt CltZ Z
-",
,..
C ;:) '"Z
! '"
.."
~
Z "'
a:z
-\101
'"
(,.)
(,.)
..
"'<
a:: ,..
a::
<<::
C<C(
CIt
- Q
'" <C QCIt <C( =<::
x x UPPER CORE BARREL 0 A 2 X X BELOW FLANGE 90 A 2 X X WELDMENT 270 A 2 X BEHIND INLET NOZZLE Q*ll2 A 1
.... X X WELDMENT UPPER* 0 A 2
'"=
=
<C(
CD X
X X
X LOWER CORE BARREL 0 90 C
A 2
2
'"=
()
x X 90 C 2
(,.)
X NOZZLE ELEVATION a R 1 X 4& R 1 X 90 R 1 X 270 R 1 X 22*112 R 1 ON THERMAL X SHIELD SUPPORT BLOCKS 112*112 R 1 A
- AXIAL C
- CIRCUMFERENTIAL R
- RADIAL Chapter 13, Page 35 of 40 Revision 20, 2006 OAG10000215_1350
IP2 FSAR UPDATE Table 13.5-1 (Sheet 2 of 3)
Transducer Locations for Vibration Experiments
...'"=
CIt
'"'"=
'"=
10&.
...J
...J ...J Z <:) 0> '"
~
'"= <C
...J 0
'" Z'"
0- CJ
'"= Cltz 0( l loY;:)
...
- ) 3
ex:
3:
ex:
i=.
C Q
",' ...CJ!:-
_:> =0
- )en Z CJ
- )
...= ...
loY loY z
- >
'"
..I c:
Z
",CIt
=z
..I
'"CJCJ :c ==
-",
Cc:
=0(
- I 0 ~
..I 0( -'"
Qen C cr. ... t;;c:
CIt
'"
X X
-
X X
SNUBBER PIN HOLES 1_BOTTOM 82.5 28 R
R 2
2 X MID ELEVATION 0 R 1 90 R 1 Q FLEXURES 0 R *8
..I
'"%
CIt 90 R 8
..I C 240 R 8
- !
=
...::::'" TOP SUPPORT BOLT fr7*112 R 4 I I::C~----6 x MID ELEVATION 270 R 1 X NEAR BOTTOM 90 R 1 loY TOP SURFACE 0 R 1 a:
0
<.J 0 C 1 ex:
loY
- cr. ... '80 R 1 cr..."
- Icr.
180 C 1
,.; BOTTOM SURFACE A 1 cr.
CIt cr...,:
0.."
... cr.
Chapter 13, Page 36 of 40 Revision 20, 2006 OAGI0000215_1351
IP2 FSAR UPDATE Table 13.5-1 (Sheet 3 of 3)
Transducer Locations for Vibration Experiments CIt a::
""""a:: ""I-
......
I&.
a::
""
a: <
..J
..J c( Z a 0>
ZI- ""02l ""
....
- ) ;
- ~
Q j: ""Q 0-
-> a:: ""(,.)
a:;:)
- )Q
(,.) a::
u.a
....
a:: <
>
loll'
..J 1--
CJ!:
loW II) ""
..J II) CIt II)Z Z
-""
- )
....a: ;:) ""Z3: ...
Vol a Z
c(
a::z
- loW
""c(
CJ CJ loWe(
a: a::
e(c:.:;J a::c(
CIt Q Vol QII) ""I- =c:.:;J
""
CD
- )
- NEAR TOP SUPT. PL T. 3 I- POS. D*14 IPLUT. RECYCLE) 2
""Q
- H.a (CENTER) 4 a
K.2 (MAX. VEL.)
X ,.
X VESSEL HEAD STUDS 0 0
C R ,.
X
..J X BOTTOM OF VESSEL 180
-
C
,.
1*
""
CIt CIt R
,.
""
- >
X X
C A ,.
X INUT LEG 121,22," 24) 3 X OUTLET LEG (21) 1
,.
STEAM GENERATOR NO.2'
-65 FEET (SUPPORT PAD ELEV.) C
,.
- 120 FEET (NEAR TOP) C R ,.
MAIN COOLANT -62 FEET (SUPPORT PAD ELEV" C ,.
PUMP NO.2'
- 83 FEET (TOP MOTOR FLANGE) C ,.
R 1*
INTeRMEDrATE LEG (LOOP 21)
"'54 FEET (CENTER OF PIPE' R ,.
CONTAINMENT -qFEET R 1 FLOOR C 1 aThese instruments in addition to portable accelerometers were used during the impedance test to determine mode shapes Chapter 13, Page 37 of 40 Revision 20 f 2006 OAGI0000215_1352
IP2 FSAR UPDATE 13.6 TESTS FOLLOWING REACTOR REFUELING During the initial return to power following a refueling shutdown or following a cold shutdown where fuel assemblies have been handled (inspection for example), a series of tests are carried out on the new core. The objectives of these tests are:
- 1. To demonstrate that the core performance during reactor operation will not exceed safety analysis and Technical Specification limits.
- 2. To verify the nuclear design calculations.
- 3. To provide the bases for the calibration of reactor instrumentation.
13.6.1 Reload Startup Physics Test Program A typical reload startup physics test program may include, but is not limited to, the following:
- 1. Precriticality tests Calibration check of the incore thermocouples and reactor coolant resistance temperature detectors.
- 2. Hot zero power and beginning of core life condition tests
- a. Determination of the isothermal temperature coefficients and all rods out condition and boron end pOints for the following conditions (1) All rods out of core.
- b. Determination of the differential and integral rod worths for the following banks of control rods:
(1) Control bank D.
(2) Control bank C with control bank D inserted.
(3) Control bank B with control banks C and D inserted.
(4) Control bank A with control banks B, C and D inserted.
OR Determination of the integral rod worth for each individual Control and Shutdown Bank.
- c. Movable incore detector flux map performed at a power level less than or equal to 30-percent.
- 3. Power ascension tests
- a. Movable incore detector flux maps performed at various power levels.
- b. Overpower ~T and overtemperature ~T setpoint determination.
- c. Ex-corejincore instrumentation calibration.
Chapter 13, Page 38 of 40 Revision 20, 2006 OAG10000215_1353
IP2 FSAR UPDATE
- d. Heat balance/thermal power measurements.
- e. Reactor coolant flow measurements.
Core loading verification is carried out by monitoring the movement of each assembly during actual core loading. The location of each assembly as it is loaded into the core is verified using a detailed procedure prepared from the reload loading pattern. A final loading verification is carried out visually upon the completion of core loading to verify the as-loaded core against the design loading pattern.
Cold, zero-power physics testing is not included for reload core heatup, initial criticality, and power ascension. Since reactor operations in the initial cold condition are nonexistent, and initial warmup can be accomplished without nuclear heat (pump heat only), no meaningful information could be gained from such cold, zero-power testing.
Hot Testing Hot, zero-power physics testing is used to verify that the reactor core can be safely operated and that it meets its design objectives. Hot, zero-power physics testing is accomplished with the reactor coolant system temperature and pressure at the no-load conditions.
Initial Criticality The core conditions are established at their no-load values with all rod cluster controls inserted. A "l/M" plot is maintained during all periods of rod withdrawal and boron dilution.
Determination of Zero Power Flux Level The ideal flux level for conduct of zero-power physics testing is one in which the flux level is sufficiently high enough to give a signal-to-noise ratio and at the same time sufficiently low enough to avoid the reactivity feedback associated with nuclear heating.
AII-Rods-Out Boron Concentration Although this test applies to the all-rods-out condition, it may be employed to determine endpOints of other control configurations.
Moderator Temperature Coefficient The moderator temperature coefficient is determined from the measured all rods out isothermal temperature coefficient to assure that Technical Specification requirements are satisfied.
Differential Rod Worth Differential rod worth is measured by incrementally moving the rods from one endpoint to another and measuring the reactivity addition per increment of movement. The endpOints used are generally the fully inserted and fully withdrawn core configuration for each control bank. Normally, bank overlap is not used at this time. In order to keep the flux level within the selected span for physics testing, boron is traded for rod position so that the overall reactivity status core and the flux level remain relatively constant.
Integral Rod Worth The integral rod worth curves are developed by integrating the differential rod worth curve as a function of rod height. An alternate measurement technique Dynamic Rod Worth (DRWM), can also be used to measure the integral rod worth provided the technique, Chapter 13, Page 39 of 40 Revision 20, 2006 OAG10000215_1354
IP2 FSAR UPDATE evaluation criteria, and remedial actions identified in Attachment 4 of Reference 1 are followed. The NRC documented their acceptance of this technique in a Safety Evaluation Reporf.
Power Ascension The power ascension program involves slow increase in power level up to 100-percent power accompanied by testing to verify that the core is operating within the required limits.
In particular, movable detector flux traces are run at various power levels to ensure that the fuel was properly loaded and that the power distribution is within design limits. Reactor coolant system flow is determined to ensure that the total reactor coolant system flow exceeds the required minimum rate.
For the low-power physics test to measure control rod worth and shutdown margin the reactor may be critical with all but one control rod inserted [Historical Information].
13.6.2 Test Results Test results are compared against nuclear design results; in all cases acceptance criteria are in accordance with Technical Specification limits. If the cycle reload is such that it falls within the conditions specified below for preparation and submittal of a startup physics test report to the NRC, such a report summarizing the results of the startup tests is so prepared and submitted.
Startup Report A summary report of the plant startup and power escalation testing shall be submitted following (1) amendments to the license involving a planned increase in power level, (2) installation of fuel that has a different design or has been manufactured by a different fuel supplier, and (3) modifications that may have significantly altered the nuclear, thermal, or hydraulic performance of the plant. The report shall address each of the appropriate tests identified in the UFSAR and shall include a description of the measured values of the operating conditions or characteristics obtained during the test program and a comparison of these values with design predictions and specifications. Any corrective actions that were required to obtain satisfactory operation shall also be described.
Startup reports shall be submitted within (1) 90 days following completion of the startup test program, (2) 90 days following resumption or commencement of commercial power operation, or (3) 9 months following initial criticality, whichever is earliest. If the startup report does not cover all three events (i.e., initial criticality, completion of startup test program, and resumption or commencement of commercial power operation),
supplementary reports shall be submitted at least every three months until all three events have been completed.
REFERENCES FOR 13.6
- 1. Letter from Nicholas J. Liparulo, Westinghouse to NRC, Document Control Desk, October 10, 1995.
- 2. Letter from Robert C. Jones, NRC to Nicholas J. Liparulo, Westinghouse, dated January 5, 1996.
Chapter 13, Page 40 of 40 Revision 20, 2006 OAG10000215_1355
IP2 FSAR UPDATE CHAPTER 14 SAFETY ANALYSIS
14.0 INTRODUCTION
This chapter evaluates the safety aspects of the plant and demonstrates that the plant can be operated safely and that exposures from credible accidents do not exceed the applicable limits.
14.0.1 Accident Classification This chapter is divided into four sections, each dealing with a different behavior category:
- 1. Core and Coolant Boundary Protection Analysis, Section 14.1 -The incidents presented in Section 14.1 generally have no offsite radiation consequences.
- 2. Standby Safeguards Analysis, Section 14.2 -The accidents presented in Section 14.2 are more severe and may cause the release of radioactive material to the environment.
- 3. Rupture of a Reactor Coolant Pipe, Section 14.3 - The accident presented in Section 14.3, the rupture of a reactor coolant pipe, is the worst-case accident and is the primary basis for the design of engineered safety features. It is shown that even this accident meets the applicable limits.
- 4. Anticipated Transients Without Scram, Section 14.4 -The accidents presented in Section 14.4 were assumed to occur without the benefit of tripping the reactor.
While the failure to trip is unlikely, several accidents were evaluated for which credit was not taken for a reactor trip. The results showed that gross fuel clad damage would not occur if the reactor failed to trip.
14.0.2 General Assumptions Parameters and assumptions that are common to various accident analyses are described below to avoid repetition in subsequent sections. Reactor characteristics are reviewed at the start of each operating cycle to assure that they are within the bounds assumed in the accident analyses.
14.0.2.1 Steady-State Errors For most accidents which are DNB limited, nominal values of initial conditions are assumed.
The allowances on power, temperature, and pressure are determined on a statistical basis and are included in the limit DNBR, as described in Reference 1. This procedure is known as the "Revised Thermal Design Procedure" (RTDP) and these accidents utilized the WRB-1 DNB correlation for both the 15x15 VANTAGE+ fuel design and the upgraded fuel design. The initial conditions for other key parameters are selected in such a manner to maximize the impact to DNBR. Minimum measured flow is used in all RTDP transients. This flow allows for up to 7.9-percent allowance for calorimetric uncertainty.
For accidents which are not DNB limited, or for which the Revised Thermal Design Procedure is not employed, the initial conditions are obtained by applying the maximum steady state errors to Chapter 14, Page 1 of 218 Revision 20, 2006 OAG10000215_1356
IP2 FSAR UPDATE rated values in such a manner to maximize the impact on the limiting parameters and conditions.
The following conservative steady state errors are considered:
- 1. Core Power +/- 2-percent allowance for calorimetric error
- 2. Average Reactor Coolant System +/- 7.5 of allowance for controller dead band and Temperature measurement error
- 3. Pressurizer Pressure +28/-37 psi allowance for steady state fluctuations and measurement error
- 4. Reactor Coolant Flow Thermal Design Flow of 80,700 gpm/loop is assumed and no steady state errors are applied.
For all accidents initiated from full power, a nominal full power vessel average temperature ranging between a minimum and maximum of 549°F to 572.0°F was conservatively chosen for the analysis to bound operation at full power within this temperature range.
14.0.2.2 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of fuel assemblies, control rods, and operating instructions. Power distribution may be characterized by the radial factor (Fi;H) and the total peaking factor (Fa). The peaking factor limits are given in the Core Operating Limits Report (COLR).
For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in Fi;H is included in the core limits illustrated in Figure 7.2-19. All transients that may be DNB limited are assumed to begin with a Fi;H consistent with the design thermal power level defined in the Technical Specifications.
For transients which may be overpower limited, the total peaking factor (Fa) is of importance.
All transients that may be overpower limited are assumed to begin with plant conditions including power distributions which are consistent with reactor operation as defined in the Technical Specifications.
The incore instrumentation system is employed to verify that actual hot channel factors are, in fact, no higher than those specified in the COLR.
14.0.2.3 Reactor Trip A reactor trip signal acts to open the two series trip breakers feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the control rods, which then fall by gravity into the core. There are various instrumentation delays associated with each tripping function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The Chapter 14, Page 2 of 218 Revision 20, 2006 OAG10000215_1357
IP2 FSAR UPDATE total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall.
The time delay assumed for each tripping function is as follows:
Tripping Function Time Delay (sec)
Overpower (nuclear) 0.5 Overtem perature L1T 2.0 Overpower L1T 2.0 Low pressurizer pressure 2.0 High pressurizer pressure 2.0 High pressurizer level 2.0 Low reactor coolant flow
- loop flow detectors 1.0
- reactor coolant pump undervoltage 1.5
- reactor coolant pump underfrequency trip 1.0 Turbine trip 2.0 Low-low steam-generator water level 2.0 The trip levels used in the following analyses are maximum values including the trip setpoint and the error allowance. The trip setpoints are established based on Allowable Values set forth in the Technical Specifications.
The maximum nuclear overpower trip point assumed for the analysis is 116-percent. The trips are calibrated at power such that the calibration error is the calorimetric error of 2-percent. The design allowance for nonrepeatable errors is 6-percent. Nonrepeatable errors include both instrument drift and errors due to process changes such as control rod motion since both are observable as an error between the indicated signal and the known power from calorimetric measurements. In summary, the trip setpoints are less than the trip value assumed in the analyses to ensure that trip occurs within the assumed value when including the design error allowance.
The negative reactivity insertion following a reactor trip is a function of the position versus time of the control rods and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry or approximately 85-percent of the control rod travel.
The reactivity insertion versus time assumed in accident analyses is shown in Figure 14.0-1.
The control rod insertion time to dashpot entry is taken as 2.4 seconds. This control rod drop time requirement is specified in the plant Technical Specifications.
REFERENCES FOR SECTION 14.0
- 1. Friedland, A.J. and Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
- 2. Deleted Chapter 14, Page 3 of 218 Revision 20, 2006 OAG10000215_1358
IP2 FSAR UPDATE 14.0 FIGURES Figure No. Title Figure 14.0-1 Reactivity Insertion vs. Time for Reactor Trip 14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS For the following plant abnormalities and transients, the reactor control and protection systems are relied upon to protect the core and reactor coolant boundary from damage:
- 1. Uncontrolled rod cluster control assembly withdrawal from a subcritical condition.
- 2. Uncontrolled rod cluster control assembly withdrawal at power.
- 3. Rod cluster control assembly drop.
- 4. Chemical and volume control system malfunction.
- 5. Loss of reactor coolant flow.
- 6. Startup of an inactive reactor coolant loop.
- 7. Loss of external electrical load.
- 8. Loss of normal feedwater.
- 9. Reduction in feedwater enthalpy incident.
- 10. Excessive load increase incident.
- 11. Loss of all normal ac power to the station auxiliaries.
- 12. Likelihood and consequences of turbine-generator overspeed.
All reactor protection criteria are met presupposing the most reactive rod cluster control assembly is in its fully withdrawn position. Trip is defined for analytical purposes as the insertion of all full-length rod cluster control assemblies, except the most reactive assembly, which is assumed to remain in the fully withdrawn position. This is to provide margin in shutdown capability against the remote possibility of a stuck rod cluster control assembly condition existing at a time when shutdown is required.
Instrumentation is provided for continuously monitoring all individual rod cluster control assemblies together with their respective group position. This is in the form of a deviation alarm system. If a rod should deviate from its intended position, the reactor can be shut down in an orderly manner and the condition corrected. [Note - See Technical Specifications, Section 3.1, for permissible variances.] Such occurrences are expected to be extremely rare on the basis of operation and test experience to date.
In summary, reactor protection is designed to prevent cladding damage in all transients and abnormalities listed above. The most probable modes of failure in each protection channel result in a signal calling for the protective trip. The coincidence of two-out-of-three (or two-out-of-four) signals is required where single-channel malfunction could cause spurious trips while at power. A single component or channel failure in the protection system itself coincident with one stuck rod cluster control assembly is always permissible as a contingent failure and does not cause a violation of the protection criteria. The reactor protection systems are designed in accordance with the IEEE "Standard for Nuclear Plant Protection Systems."
14.1.1 Uncontrolled Rod Cluster Control Assembly Withdrawal From A Subcritical Or Low Power Startup Condition A rod cluster control assembly (RCCA) withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of rod cluster control assemblies resulting Chapter 14, Page 4 of 218 Revision 20, 2006 OAG1000021S_13S9
IP2 FSAR UPDATE in a power excursion. This could occur with the reactor subcritical, at hot zero power, or at power. The "at power" case is discussed in Section 14.1.2. The low power startup condition assumed in this section (1 x 10-9 of nominal power) is less than the power level expected for any shutdown condition.
Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Section 14.1.5).
The RCCA drive mechanisms are wired into preselected bank configurations, which are not altered during reactor life. The drive mechanisms being wired into preselected bank configurations prevent the RCCAs from being manually withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed, which is well within the capability of the protection system to prevent core damage.
The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self-limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the reactor protection system:
- 1. Source range flux level trip - actuated when either of two independent source range channels indicates a flux level above a preselected, manually adjustable value. This trip function may be manually bypassed when either of two intermediate range flux channels indicates a flux level above the source range cutoff power level.
- 2. Intermediate range flux level trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value. This trip function is manually bypassed when two-out-of-four power range channels are reading above approximately 10-percent power and automatically reinstated when three-out-of-four channels indicate a power level below this value. To prevent unnecessary reactor trips during power reductions prior to shut down, operating procedures allow these trips to be manually bypassed until they have reset to the untripped condition and the reset has been verified.
- 3. Power range flux level trip (low setting) - actuated when two-out-of-four power range channels indicate a power level above approximately 25-percent. This trip function may be manually bypassed when two-out-of-four power range channels indicate a power level above approximately 10-percent power and is automatically reinstated when three of the four channels indicate a power level below this value.
Chapter 14, Page 5 of 218 Revision 20, 2006 OAG10000215_1360
IP2 FSAR UPDATE
- 4. Power range flux level trip (high setting) - actuated when two-out-of-four power range channels indicate a power level above a preset setpoint. This trip function is always active.
In addition, control rod stops on high intermediate range flux level (one out of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.
NOTE: Automatic Rod Withdrawal Has Been Physically Disabled At Indian Point Unit 2.
14.1.1.1 Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages: (1) an average core nuclear power transient calculation, (2) an average core heat transfer calculation, and (3) the DNBR calculation. The average core nuclear calculation is performed using spatial neutron kinetics methods in TWINKLE 18 to determine the average power generation with time, including the various total core feedback effects (i.e., Doppler reactivity and moderator reactivity). The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN 19 . The average heat flux with appropriate peaking factors is next used in VI PRE23 for departure from nucleate boiling ratio calculations.
This accident is analyzed using Standard Thermal Design Procedures. Plant characteristics and initial conditions are discussed in Section 14.0.2.1. In order to give conservative results for a startup accident, the following assumptions are made:
- 1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler defect, conservatively low values as a function of power are used.
- 2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A highly conservative value is used in the analysis to yield the maximum peak heat flux.
- 3. The reactor is assumed to be just critical at hot zero power (no load) Tavg (54rF).
This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.
- 4. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and rod cluster control assembly release, is taken into account. A 10-percent increase is assumed for the power range flux Chapter 14, Page 6 of 218 Revision 20, 2006 OAG10000215_1361
IP2 FSAR UPDATE trip setpoint raising it from the nominal value of 25-percent to 35-percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth rod cluster control assembly is stuck in its fully withdrawn position.
- 5. The maximum positive reactivity insertion rate assumed (75 pcm/sec) is greater than that for the simultaneous withdrawal of the combination of two sequential control banks having the greatest combined worth at maximum speed (45-in.lmin). Control rod drive mechanism design is discussed in Section 3.2.3.4.
- 6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, is assumed in the departure from nucleate boiling analysis.
- 7. The initial power level was assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). This combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
- 8. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to departure from nucleate boiling. No single active failure in any system or equipment available to mitigate the effects of the accident will adversely affect the consequences of the accident.
14.1.1.2 Results Figures 14.1-1 through 14.1-4 show the transient behavior for the uncontrolled RCCA bank withdrawal incident, with the accident terminated by reactor trip at 35-percent of nominal power.
The reactivity insertion rate used is greater than that calculated for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region. Figure 14.1-1 shows the nuclear power transient.
The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for departure from nucleate boiling considerations, is shown in Figure 14.1-
- 2. The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the full power nominal value. There is a large margin to departure from nucleate boiling during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core. Figures 14.1-3 and 14.1-4 show the response of the hot-spot fuel average temperature and the hot-spot clad temperature. The average fuel temperature increases to a value lower than the nominal full power value. The minimum departure from nucleate boiling ratio at all times remains above the limit value.
The calculated sequence of events and summary of the results for this accident are shown in Table 14.1-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.
The operating procedures would call for operator action to control reactor coolant system boron concentration and pressurizer level using the chemical and volume control system, and to maintain steam generator level through control of the main or auxiliary feedwater system.
Chapter 14, Page 7 of 218 Revision 20, 2006 OAG10000215_1362
IP2 FSAR UPDATE Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of 10 min following reactor trip.
14.1.1.3 Radiological Consequences There are no radiological consequences associated with an uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition event since radioactivity is contained within the fuel rods and the reactor coolant system is maintained within design limits. This is demonstrated by showing that the minimum departure from nucleate boiling ratio remains above the limit DNBR.
14.1.1.4 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the reactor coolant system are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of departure from nucleate boiling.
14.1.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal At Power An uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power increase and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad, the Reactor Protection System is designed to terminate any such transient before the DNBR falls below the safety analysis limit values.
This event is classified as an ANS Condition II incident (an incident of moderate frequency).
The automatic features of the Reactor Protection System which prevent core damage following the postulated accident include the following:
- 1. Power range neutron flux instrumentation actuates a reactor trip if two-of-four channels exceed an overpower setpoint.
- 2. Reactor trip is actuated if any two-out-of-four ~T channels exceed an Overtemperature ~T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
- 3. Reactor trip is actuated if any two-out-of-four ~T channels exceed an Overpower
~T setpoint. This setpoint is automatically varied with coolant temperature to ensure that the allowable heat generation rate (kW/ft) is not exceeded.
- 4. A high pressurizer pressure reactor trip is actuated from any two-out-of-three pressure channels which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
Chapter 14, Page 8 of 218 Revision 20, 2006 OAG10000215_1363
IP2 FSAR UPDATE
- 5. A high pressurizer water level reactor trip is actuated from any two-out-of-three level channels when the reactor power is above approximately 10-percent (Permissive P-7).
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- 1. High neutron flux (one-out-of-four power range)
- 2. Overpower L1T (one-out-of-four)
- 3. Overtemperature L1T (one-out-of-four)
The manner in which the combination of the overpower and overtemperature L1T trips provide protection over the full range of RCS conditions is described in Chapter 7.
14.1.2.1 Method of Analysis The transient is analyzed by the RETRAN Code. 21A This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level.
This accident is analyzed using the Revised Thermal Design Procedure. 22 Initial reactor power, RCS pressure, and temperature are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 22 of Chapter 14.1.
In performing the analysis, the following assumptions are made to assure bounding results are obtained for all possible normal operational conditions:
- 1. Reactivity Coefficients - Two cases are analyzed:
- a. Minimum Reactivity Feedback. A least-negative moderator density coefficient of reactivity is assumed, corresponding to the beginning of core life. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed.
- b. Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.
- 2. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 116-percent of nominal full power. The L1T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.
- 3. The trip reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.
- 4. A range of reactivity insertion rates is examined. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the two control banks having the maximum combined worth at maximum speed.
- 5. A range of initial power levels from 10% to 100% power is considered.
Chapter 14, Page 9 of 218 Revision 20, 2006 OAG10000215_1364
IP2 FSAR UPDATE The effect of the axial core power distribution is accounted for by causing a decrease in the Overtemperature L1T trip setpoint proportional to the decrease in margin to DNB.
14.1.2.2 Results Figures 14.1-5, 14.1-6 and 14.1-7 show the transient response for a rapid RCCA withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result and margin to DNB is maintained.
The transient response for a slow RCCA withdrawal from full power is shown in Figures 14.1-8, 14.1-9 and 14.1-10. Reactor trip on Overtemperature L1T occurs after a longer period and the rise in temperature is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater than the safety analysis limit values.
Figure 14.1-11 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and Overtemperature L1T channels. The minimum DNBR is never less than the safety analysis limit values.
Figures 14.1-12 and 14.1-13 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60 and 10-percent power, respectively, for minimum and maximum reactivity feedback. The results are similar to the 100-percent power case, except as the initial power is decreased, the range over which the Overtemperature L1T trip is effective is increased. In all cases the DNBR does not fall below the safety analysis limit value.
The shape of the curves of minimum DNB ratio versus reactivity insertion rate in the reference figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.
For transients initiated at 60% power it is noted that:
- 1. For reactivity insertion rates above approximately 10 pcm/sec reactor trip is initiated by the high neutron flux trip for the minimum reactivity feedback cases.
The neutron flux level in the core rises rapidly for these insertion rates while core heat flux lags behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate decreases, core heat flux can remain more nearly in equilibrium with the neutron flux. Minimum DNBR during the transient thus decreases with decreasing insertion rate.
- 2. The Overtemperature L1T reactor trip circuit initiates a reactor trip when measured coolant loop L1T exceeds a setpoint based on measured Reactor Coolant System average temperature and pressure. It is important to note that the average temperature contribution to the circuit is lead lag compensated to decrease the effect of the thermal capacity of the RCS in response to power increases.
Chapter 14, Page 10 of 218 Revision 20, 2006 OAG10000215_1365
IP2 FSAR UPDATE
- 3. For reactivity insertion rates below10 pcm/sec the Overtemperature L1T trip terminates the transient.
For reactivity insertion rates from 10 pcm/sec to approximately 2 pcm/sec the effectiveness of the Overtemperature L1T trip increases (in terms of increased minimum DNBR) due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower and the system lags and delays become less significant.
- 4. For reactivity insertion rates less than 2 pcm/sec, the rise in the reactor coolant temperature is sufficiently high so that the steam generator safety valve setpoint is reached prior to trip. Opening of these valves, which acts as a heat sink on the Reactor Coolant System and results in increased heat removal from the Reactor Coolant System, sharply decreases the rate of increase of the Reactor Coolant System average temperature.
The effect described in item 4 above, which results in the sharp peak in minimum DNBR at approximately 2 pcm/sec, does not occur for transients initiated at 100% power since the steam generator safety valves are not actuated prior to trip (Figure 14.1-11).
Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 116-percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel centerline temperature will still remain below the fuel melting temperature.
For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the Overtemperature L1T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 116-percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel centerline temperature will remain below the fuel melting temperature.
Since the DNBR is not violated at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient. The calculated sequence of events for this accident is shown on Table 14.1-2 for large and small reactivity insertion rates. These sequences of events are for the cases initiated from full power assuming minimum reactivity feedback conditions. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.
14.1.2.3 Conclusions The high neutron flux and Overtemperature L1T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the safety analysis limit values.
Chapter 14, Page 11 of 218 Revision 20, 2006 OAG10000215_1366
IP2 FSAR UPDATE 14.1.3 Incorrect Positioning Of Part-Length Rods Part-length rods were employed in the original design to improve the axial power distributions as well as to control potential axial xenon oscillations. Subsequent to initial plant operations, however, (during the Cycle 2/3 refueling outage), the part-length rod cluster control assemblies were removed from the reactor.
14.1.4 Rod Cluster Control Assembly Drop The dropping of a rod cluster control assembly could occur from deenergizing a drive mechanism. It would result in a power reduction and a possible increase in the hot-channel factor. If no protective action occurred, the reactor coolant system would attempt to restore the power to the level that existed before the incident occurred. This would lead to a reduced safety margin or possibly departure from nucleate boiling, depending upon the magnitude of the hot-channel factor.
If a rod cluster control assembly should drop into the core during power operation, this would be detected by the rod bottom signal device, which provides an individual position indication signal for each rod cluster control assembly. The initiation of this signal is independent of lattice location, reactivity worth, or power distribution changes inherent with the dropped rod cluster control assembly. Further indication of a rod cluster control assembly drop would be obtained by independent means, using the out-of-core power range channel signals.
A rod drop signal from any rod position indication channel, or from one or more of the four power range channels, initiates protective action by reducing turbine load by a preset adjustable amount. Bypass switches have been installed which are in the DEFEAT position, so as to bypass the runback. The automatic rod control system has been modified and currently utilizes only the automatic rod insertion feature (the automatic rod withdrawal feature has been disabled by this modification). This action prevents core damage. The automatic turbine run back functionality has been administratively deleted. The rod stop is also redundantly actuated. Rod drop protection is discussed in Section 7.2.
14.1.4.1 Method of Analysis The transient response following a dropped RCCA event is calculated using a detailed digital simulation of the plant. A dropped RCCA or dropped RCCA Bank causes a step decrease in reactivity and the resulting core power generation is determined using the LOFTRAN computer code 21. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, rod control system, steam generators, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. Since LOFTRAN employs a point neutron kinetics model, a dropped rod event is modeled as a negative reactivity insertion corresponding to the reactivity worth of the dropped RCCA(s), regardless of the actual configuration of the rod(s) that drop.
A dropped rod cluster control assembly results in a negative reactivity insertion. The core is not adversely affected during this period since power is decreasing rapidly. Following a dropped rod cluster control assembly with turbine runback and automatic rod withdrawal disabled, the plant will establish a new equilibrium condition. Depending on the worth of the dropped RCCA(s),
power may be reestablished by reactivity feedback.
Chapter 14, Page 12 of 218 Revision 20, 2006 OAG10000215_1367
IP2 FSAR UPDATE When reactivity feedback does not offset the worth of the dropped RCCA(s), a cool down condition exists until a low pressurizer pressure reactor trip signal is reached. When reactivity feedback is large enough to offset the worth of the dropped RCCA(s), reactor power is reestablished at a new equilibrium condition.
To capture the transient response, dropped rod statepoints designed to bound possible operation without a turbine runback were evaluated. The dropped rod/bank statepoints are based on generic dropped rod analyses performed as part of the Westinghouse Owners Group (WOG) dropped rod protection modification program. 27 The WOG dropped rod protection modification program was specifically performed to support elimination of turbine runback on dropped rod (for Westinghouse plants with this system) and deletion of the negative flux rate trip (for Westinghouse plants without turbine run back on dropped RCCA) for conditions with and without automatic rod withdrawal block. The incident is analyzed using the Revised Thermal Design Procedure and assumes nominal initial conditions as described in Section 14.0.2.1 14.1.4.2 Results Figures 14.1-14 through 14.1-16 illustrate a typical transient response when reactivity feedback does not offset the worth of the dropped RCCA(s). In this case, BOL conditions are shown with a small negative moderator temperature coefficient (MTC) of -5 pcm/oF for a dropped RCCA worth of 400 pcm. As a result of the negative reactivity insertion of the dropped rod cluster control assembly, a cooldown condition of the RCS exists. The nuclear power reaches a level lower than that which existed before the incident and the RCS temperature and pressure continue to decrease until a low pressurizer pressure reactor trip signal is reached.
Figures 14.1-17, 14.1-18, and 14.1-19 illustrate a typical transient response when reactivity feedback is large enough to offset the worth of the dropped RCCA(s). In these figures EOL conditions are shown with a large negative moderator temperature coefficient (MTC) of -
35 pcm/oF for a dropped rod cluster control assembly worth of 400 pcm. With a large reactivity feedback, a new equilibrium condition is reached without a reactor trip. The nuclear power returns to nearly the initial power level that existed before the incident while the RCS temperature and pressure are reduced to a slightly lower condition.
The evaluation of the generic WOG dropped rod/bank statepoints considered to bound possible operation without turbine runback show the applicable licensing basis acceptance criteria is met.
Specifically, the evaluations performed using the WOG dropped rod/bank statepoints verified that the DNBR licensing basis acceptance criterion is met assuming no turbine runback following a dropped RCCA event for single or multiple dropped RCCAs from the same group of a given bank with rod withdrawal block. It should be noted that no evaluation of single dropped RCCA worths with automatic rod control functioning was performed to confirm the acceptability of the dropped RCCA event for a single failure of a rod-on-bottom signal which automatically blocks rod withdrawal. This is because automatic rod withdrawal has been physically disabled at Indian Point Unit 2 which precludes such occurrences.
For all cases analyzed, the DNBR does not fall below the limit value.
14.1.4.3 Conclusions Based on the DNBR results for all of the cases analyzed, it has been demonstrated that the DNBR criterion is met, and therefore, it is concluded that dropped RCCAs do not lead to Chapter 14, Page 13 of 218 Revision 20, 2006 OAG10000215_1368
IP2 FSAR UPDATE conditions that cause core damage and that all applicable safety criteria is satisfied for this event.
14.1.5 Chemical And Volume Control System Malfunction 14.1.5.1 Introduction Reactivity can be added to the core with the chemical and volume control system by feeding reactor makeup water into the reactor coolant system via the reactor makeup control system.
Boron dilution is a manual operation. A boric acid blend system is provided to permit the operator to match the concentration of reactor coolant makeup water to that existing in the coolant at the time. The chemical and volume control system is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.
There is only a single, common source of dilution water to the blender from the primary water makeup system; inadvertent dilution can be readily terminated by isolating this single source.
The operation of the primary water makeup pumps that take suction from the primary water storage tank (PWST) provides the non-borated supply of makeup water to the blender. The boric acid from the boric acid storage tank(s) is blended with the reactor makeup water in the blender, and the composition is determined by the preset flow rates of boric acid and reactor makeup water on the reactor makeup control. The operator must switch from the automatic makeup mode to the dilute mode and move the start-stop switch to start, or, alternatively, the boric acid flow controller could be set to zero. Since these are deliberate actions, the possibility of inadvertent dilution is very small. In order for this dilution water to be added to the reactor coolant system, the charging pumps must be running in addition to the primary water makeup pumps. Also, any diluted water introduced into the volume control tank (VCT) must pass through the charging pumps to be added to the reactor coolant system.
Thus, the rate of addition of diluted water to the reactor coolant system from any source is limited to the capacity of the charging pumps. This addition rate is 294 gpm for all three charging pumps. This is the maximum delivery rate based on a pressure drop calculation comparing the pump curve with the system resistance curve. Normally, only one charging pump is operating while the others are on standby.
Information on the status of the reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of pumps in the chemical and volume control system. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction. Boron dilution during refueling, startup, and power operation are considered in this analysis.
14.1.5.2 Method of Analysis and Results 14.1.5.2.1 Dilution During Refueling During refueling the following conditions exist:
Chapter 14, Page 14 of 218 Revision 20, 2006 OAG10000215_1369
IP2 FSAR UPDATE
- 1. One residual heat removal pump providing a minimum flow rate of 1000 gpm is normally running except during short time periods as allowed by the technical specifications.
- 2. The chemical and volume control system and/or safety injection system are aligned so that there is at least one flow path to the core for boric acid injection when there is fuel in the reactor, as required by the Technical Specifications.
- 3. The minimum boron concentration of the refueling water is at least 2050 ppm or higher to maintain a shutdown of at least 5-percent i1k1k with all control rods in; periodic sampling ensures that this concentration is maintained.
- 4. Neutron sources are installed in the core and detectors connected to instrumentation giving audible count rates are installed outside or within the reactor vessel to provide direct monitoring of the core.
A minimum water volume in the reactor coolant system of 3257-fe is considered. This corresponds to the volume necessary to fill the reactor vessel to mid-loop. The maximum dilution flow of 294 gpm and uniform mixing are also considered. The operator has prompt and definite indication of any boron dilution from the audible count rate instrumentation. High count rate is alarmed in the reactor containment and the main control room. The count-rate increase is proportional to the multiplication factor.
The boron concentration must be reduced from 2050 ppm to approximately 1390 ppm before the reactor will go critical. This would require more than 30 minutes. This is ample time for the operator to recognize the audible high count-rate signal and isolate the reactor makeup source by closing valves and stopping the primary water makeup pumps and/or charging pumps. The Refueling Operation Surveillance Procedure requires values which are potential sources of un-borated water be tagged closed, and the possibility of inadvertent dilution during refueling is very small. In addition, there could be a source of water from Indian Point Unit 1. Procedures call for isolation of that source should there be an unintended dilution.
14.1.5.2.2 Dilution During Startup In this mode, the plant is being taken from one long-term mode of operation, Hot Standby, to another, Power Operation. Typically, the plant is maintained in the Startup mode only for the purpose of startup testing at the beginning of each cycle. During this mode of operation rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation.
Conditions assumed for the analysis are:
- 1. Dilution flow is the maximum capacity of the charging pumps, 294 gpm.
- 2. A minimum RCS water volume of 8567-fe. This corresponds to the active RCS volume taking into account 10% uniform steam generator tube plugging minus the pressurizer and the reactor vessel upper head.
- 3. The initial boron concentration is assumed to be 1800 ppm, which is a conservative maximum value for the critical concentration at the condition of hot zero power, rods to insertion limits, and no Xenon.
Chapter 14, Page 15 of 218 Revision 20, 2006 OAG10000215_1370
IP2 FSAR UPDATE
- 4. The critical boron concentration following reactor trip is assumed to be 1550 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no Xenon condition. The 250 ppm change from the initial condition noted above is a conservative minimum value.
This mode of operation is a transitory operational mode in which the operator intentionally dilutes (borates) and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution (boration) and subsequently manually withdraw the control rods, a process that takes several hours. The Technical Specifications require that the operator assure that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip nominally set at 2.3 E5 CPS after receiving P-6 from the intermediate range. Too fast a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor.
However, in the event of an unplanned approach to criticality or dilution during power escalation while in the Startup mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the power range neutron flux - high, low setpoint (nominal 25-percent power). From initiation of the event, there are greater than 15 minutes available for operator action prior to return to criticality.
14.1.5.2.3 Dilution at Power In this mode, the plant may be operated in either automatic or manual rod control. Conditions assumed for the analysis are:
- 1. Dilution flow is the maximum capacity of the charging pumps, 294 gpm.
- 2. A minimum RCS water volume of 8567-fe. This corresponds to the active RCS volume (with 10% uniform steam generator tube plugging) minus the pressurizer and reactor vessel upper head.
- 3. The initial boron concentration is assumed to be 1800 ppm, which is a conservative maximum value for the critical concentration at the condition of hot full power, rods to insertion limits, and no Xenon.
- 4. The critical boron concentration following reactor trip is assumed to be 1450 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no Xenon condition. The 350 ppm change from the initial condition noted above is a conservative minimum value.
With the reactor in automatic rod control, the power and temperature increase from boron dilution results in insertion of the control rods and a decrease in the available shutdown margin.
The rod insertion limit alarms (LOW and LOW-LOW settings) alert the operator more than 15 minutes prior to losing the required minimum shutdown margin. This is sufficient time to determine the cause of dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.
Chapter 14, Page 16 of 218 Revision 20, 2006 OAG10000215_1371
IP2 FSAR UPDATE With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the Overtemperature L1T trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially the equivalent to an uncontrolled RCCA bank withdrawal at power. The maximum reactivity insertion rate for a boron dilution is conservatively estimated to 1.24 pcm/sec, which is within the range of insertion rates analyzed. Thus, the effects of dilution prior to reactor trip are bounded by the uncontrolled RCCA bank withdrawal at power analysis (Section 14.1.2). Following reactor trip there are greater than 15 minutes prior to criticality. This is sufficient time for the operator to determine the cause of dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.
14.1.5.3 Conclusions Because of the procedures involved in the dilution process requIring operator action, an erroneous dilution is considered very unlikely. Nevertheless, if an unintentional dilution of boron in the reactor coolant does occur, numerous alarms and indications are available to alert the operator to the condition. The maximum reactivity addition due to changes in dilution are slow enough to allow the operator to determine the cause of the addition and take corrective action before shutdown margin is lost.
14.1.6 Loss Of Reactor Coolant Flow 14.1. 6.1 Description A loss-of-coolant-flow incident may result from a mechanical or electrical failure in one or more reactor coolant pumps, or from a fault in the power supply to these pumps. If the reactor is at power at the time of the incident, the immediate effect of loss-of-coolant flow is a rapid increase in coolant temperature. This increase could result in departure from nucleate boiling with subsequent fuel damage if the reactor is not tripped promptly. The following trip circuits provide the necessary protection against a loss-of-coolant-flow incident and are actuated by:
- 1. Low voltage on pump power supply bus (above P-7 permissive).
- 2. Pump circuit breaker opening (one-out-of-four above P-8 permissive, two-out-of-four above P-7 permissive).
- 3. Low reactor coolant flow (one-out-of-four above P-8 permissive, two-out-of-four above P-7 permissive).
Each pump circuit breaker is automatically tripped on an undervoltage of its associated bus or an underfrequency on any two-out-of-four pump buses.
These trip circuits and their redundancy are further described in Section 7.2.
The most severe partial and complete loss of reactor coolant flow accidents are analyzed to ensure that the reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to prevent departure from nucleate boiling. Therefore, the fuel will not be damaged as a result of the most severe credible loss-of-coolant-flow accident.
Chapter 14, Page 17 of 218 Revision 20, 2006 OAG10000215_1372
IP2 FSAR UPDATE 14.1.6.2 Method of Analysis The following loss of flow cases were analyzed:
- 1. Loss of four pumps from full power during four-loop operation.
- 2. Loss of one pump from full power during four-loop operation.
The normal power supplies for the pumps are the four buses connected to the generator, each of which supplies power to one of the four pumps. When a turbine trip occurs, the pumps are automatically transferred to the buses supplied from an external power line, and the pumps will continue to supply coolant flow to the core. The simultaneous loss of power to the four reactor coolant pumps is a highly unlikely event. Since the pumps are on separate buses, a single bus fault would result in the loss of only one pump.
These transients are analyzed with two computer codes. First, the RETRAN 21a computer code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE 23 computer code is then used to calculate the heat flux and DNBR transients based on the nuclear power and RCS flow from RETRAN.
The calculation of DNBR during the transient is made using the nucleate boiling correlations as described in Section 3.2.2.1.2. In addition, the following assumptions were made in the calculations.
14.1.6.2.1 Initial Operating Conditions The initial operating conditions used for the analysis are consistent with the use of the Revised Thermal Design Procedure (RTDP).22 These assumptions include the following full power initial operating conditions; nominal value of power, nominal steady state pressure, and maximum steady state average programmed temperature.
14.1.6.2.2 Reactivity Coefficients A conservatively large absolute value of the Doppler-only power coefficient is used. The least negative moderator temperature coefficient (minimum moderator density coefficient) is assumed (0.0 pcm/oF), since this results in the maximum core power during the initial part of the transient, when the minimum DNBR is reached.
14.1.6.2.3 Reactor Trip For the one-pump loss-of-flow incidents, the reactor trip is assumed to be actuated by the redundant flow monitoring channel (two-out-of-three), since this results in the largest delay to reactor trip. For the four-pumps loss of flow incident, two cases are considered; reactor trip actuated by redundant bus undervoltage or breaker trip (one-out-of-four or one-out-of-three) and reactor trip on bus underfrequency (two-out-of-four). For the analysis of the four-pump loss-of-flow incident actuated by a bus undervoltage or breaker trip, the loss of flow is assumed to occur at the initiation of the event (i.e., t=O). Hence, with respect to the safety analysis, the undervoltage trip setpoint is irrelevant. However, for the analysis of the four-pumps loss-of-flow incident actuated by a bus underfrequency, the reactor is assumed to trip after an underfrequency reactor coolant pump trip at 57 Hz following a frequency decay of 5 Hz/sec from an initial frequency of 60 Hz. The trip is conservatively modeled to occur at 1.6 seconds, which Chapter 14, Page 18 of 218 Revision 20, 2006 OAG10000215_1373
IP2 FSAR UPDATE includes a maximum reactor trip time delay of 1.0 seconds. Following reactor trip, the reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established. With the reactor tripped, a stable plant condition will eventually be attained.
Normal plant shutdown may then proceed.
The low-flow trip setting is 92-percent of full flow; the trip signal is assumed to be initiated at 85.0-percent of full flow, allowing 7.0-percent for margin and instrumentation uncertainty. Upon reactor trip, it is assumed that the most reactive rod cluster control assembly is stuck in its fully withdrawn position, hence resulting in a minimum insertion of negative reactivity. The negative reactivity insertion upon trip is conservatively assumed to be 4% L1k.
A conservative shape of trip reactivity insertion versus time (based on a RCCA drop time of 2.4 seconds to the dashpot) was also used.
14.1.6.2.4 Heat Transfer Coefficient The overall heat conductance between the fuel and water regions varies considerably during the transient mostly as a result of the change of fuel gap conductance. The larger heat transfer coefficients calculated at several different power levels, using EOL fuel temperatures, are used.
This assumption produces a fast fuel thermal response and maximizes the positive reactivity inserted by Doppler feedback as the core is shutdown.
14.1.6.2.5 Flow Coastdown Reactor coolant flow coastdown curves are shown in Figure 14.1-21 for the one-pump loss of flow and in Figures 14.1-24 and 14.1-27, for the four-pumps loss of flow accident on bus undervoltage and bus underfrequency, respectively. These curves are based on high estimates of loop pressure losses and include the effect of inertia from the pump flywheels.
14.1.6.3 Results The time sequence of events and summary of the results for the complete (four-pumps) loss of flow and for the partial (one-pump) loss of flow accidents are shown in Tables 14.1-3 and 14.1-4, respectively.
Figure 14.1-20 shows the nuclear power and heat flux transients for the partial loss of flow from full power operation. Figure 14.1-22 shows the DNBR as a function of the time for this case.
The minimum DNBR is reached at about 3.4 seconds after the initiation of the accident. For this case, the DNBR also always remains above the safety limit value.
Figure 14.1-23 shows the nuclear power and heat flux transients for the complete loss of flow from full power operation following a reactor trip on bus undervoltage. Figure 14.1-25 shows the DNBR as a function of time for this case. The minimum DNBR is reached at about 3.3 seconds from the start of the accident and the DNBR always remains above the safety limit value.
Figure 14.1-26 shows the nuclear power and hot channel heat flux transients for the complete loss of flow from full power operation following a reactor trip on bus underfrequency. Figure 14.1-28 shows the DNBR as a function of time for this case. The minimum DNBR is reached at about 3.6 seconds from the start of the accident and the DNBR always remains above the safety limit value.
Chapter 14, Page 19 of 218 Revision 20, 2006 OAG10000215_1374
IP2 FSAR UPDATE 14.1.6.4 Conclusions Since the applicable safety analysis DNBR limit is met for the loss of flow cases considered, there is no cladding damage and no release of fission products into the reactor coolant.
Therefore, all applicable safety criteria is met for the loss of flow events.
14.1.6.5 Locked Rotor Accident A transient analysis was performed for the postulated instantaneous seizure of a reactor coolant pump rotor. Flow through the reactor coolant system is rapidly reduced, leading to a reactor trip on a low-flow signal. Following the trip, heat stored in the fuel rods continues to pass into the core coolant, causing the coolant to expand. The rapid expansion of the coolant in the reactor core, combined with the reduced heat transfer to the secondary system, causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and eventually opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure-reducing effect is not included in the analysis.
14.1.6.5.1 Method of Analysis As was the case for the loss of flow accident previously analyzed, the locked rotor analysis was performed assuming a full power initial condition with all four loops in operation and the same two computer codes are used to analyze this transient. The RETRAN 21a computer code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE 23 computer code is then used to calculate the heat flux and DNBR transients based on the nuclear power and RCS flow from RETRAN.
The following effects of the locked rotor event were investigated.
- 1. Primary pressure transient.
- 2. Fuel clad temperature transient (this is calculated assuming film boiling in order to give the worst possible results).
- 3. DNB transient (for determining the amount of rods in DNB for the offsite dose release calculations).
14.1.6.5.1.1 Initial Conditions Except for the DNB evaluation, performed using the Revised Thermal Design Procedure, the locked rotor accident was analyzed assuming that at the beginning of the postulated event (at the time the shaft in one of the reactor coolant pumps is assumed to seize), the plant is in operation under the most adverse steady-state operating conditions; i.e., 102% of the NSSS design thermal power, with maximum steady-state pressure and maximum steady-state coolant average temperature.
14.1.6.5.1.2 Evaluation of the Pressure Transient For the peak pressure evaluation, the initial pressure is conservatively estimated as 28 psi above nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement Chapter 14, Page 20 of 218 Revision 20, 2006 OAG10000215_1375
IP2 FSAR UPDATE and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. To obtain the maximum pressure in the primary side, conservatively high loop pressure drops are added to the calculated pressurizer pressure.
After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is assumed to begin 1 second after the flow in the affected loop reaches 85.0-percent of nominal flow. No credit is taken for the pressure-reducing effect of the pressurizer relief valves, pressurizer spray, steam dump, or controlled feedwater flow after plant trip. Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.
The safety valves start operating at 2485 psig and their combined capacity for steam relief is 42-fe/sec.
14.1.6.5.1.3 Evaluation of Fuel Rod Thermal Transient The evaluation of fuel rod thermal transient is performed at the hot spot. Results obtained from analysis of this "hot spot" condition represent the upper limit with respect to clad temperature and zirconium-water reaction.
In the evaluation, the rod power at the hot spot is conservatively assumed to be 2.5 times the average rod power (i.e., Fa =2.5) at the initial core power level.
14.1.6.5.1.4 Film Boiling Coefficient The film boiling coefficient is calculated in the VI PRE program 23 using the Bishop-Sandberg-Tong film-boiling correlation. The fluid properties are evaluated at film temperature (average between wall and bulk temperatures). The program calculates the film coefficient at every time step, based upon the actual heat transfer conditions at the time. The nuclear power, system pressure, bulk density, and mass flowrate as a function of time are used as program input.
For this analysis, the initial values of the pressure and the bulk density are used throughout the transient since they are the most conservative with respect to clad temperature response. For conservatism, film boiling was assumed to start at the beginning of the accident.
14.1.6.5.1.5 Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) have a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with initial fuel temperature to 10,000 Btu/hr-ft2 _oF at the initiation of the transient. Thus, the large amount of energy stored in the fuel because of the small initial value of the gap coefficient is released to the clad at the initiation of the transient.
14.1.6.5.1.6 Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium-steam reaction.
Chapter 14, Page 21 of 218 Revision 20, 2006 OAG10000215_1376
IP2 FSAR UPDATE 2
d(w ) = 33.3x10 6 ex (_ 45,500) dt p 1.986T where:
w =amount reacted (mg/cm 2).
t =time (seconds).
T =temperature (OKelvin).
The reaction heat is 1510 cal/g.
The effect of zirconium-steam reaction is included in the calculation of the hot spot clad temperature transient.
14.1.6.5.1.7 Evaluation of Departure from Nucleate Boiling (DNB) in the Core During the Accident The evaluation of the number of rods in DNB has been performed using the Revised Thermal Design Procedure.
Nominal values for power, core pressure and core inlet temperature were assumed in the analysis, consistent with the use of the RTDP.
Calculation of the extent of the DNB in the core during the transient has been performed using the VIPRE 23 program.
14.1.6.5.2 Results Figures 14.1-29 through 14.1-30a show the transient results for one locked rotor with four loops in operation (with loss of offsite power). The results of these calculations and the time sequence of events are also summarized in Table 14.1-5. The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits of the ASME code,Section III. Also the clad peak temperature is considerably less than 2700°F. It should be noted that the clad temperature was conservatively calculated assuming that DNB (i.e., film boiling) occurs at the initiation of the transient even if DNB is not expected.
14.1.6.5.3 Fission Product Release As a result of the accident, fuel clad damage may occur. Due to the potential for leakage between the primary and secondary systems, radioactive reactor coolant is assumed to leak from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Iodine and alkali metals group activity is assumed to be contained in the secondary coolant prior to the accident, and some of this activity is also released to the atmosphere as a result of steaming the steam generators following the accident.
Chapter 14, Page 22 of 218 Revision 20, 2006 OAG10000215_1377
IP2 FSAR UPDATE There are no rods in DNB as a result of the locked rotor. In determining the offsite doses following the locked rotor accident, it is conservatively assumed that 5% of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. The core activity is provided in Table 14.3-43 and it is assumed that the damaged fuel rods have all been operating at a peaking factor of 1.70. The gap fractions from Table 3 of Regulatory Guide 1.183 (Reference 37) are used. These are 8% for 1-131, 10% for Kr-85, 5% for other iodines and noble gases, and 12% for alkali metals. Per the model in Regulatory Guide 1.183, these are the only nuclide groups considered for gap activity.
A pre-existing iodine spike in the reactor coolant is assumed to have increased the primary coolant iodine concentration to 60 IlCilgm of dose equivalent 1-131 prior to the locked rotor accident. The alkali metals and noble gas activity concentrations in the RCS at the time the accident occurs are based on operation with a fuel defect level of one percent. The iodine activity concentration of the secondary coolant at the time the locked rotor ejection accident occurs is assumed to be 0.15 IlCilgm of dose equivalent 1-131.
Regulatory Guide 1.183 (Reference 37) specifies that the iodine released from the fuel is 95%
particulate (cesium iodide), 4.85% elemental, and 0.15% organic. However, iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.
The primary to secondary steam generator tube leak used in the analysis is 150 gpd per steam generator (total of 600 gpd).
No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite power. All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere. The residual heat removal system is assumed to be placed in service at 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> after the accident and there are no further releases to the environment after this point in time.
An iodine partition factor in the steam generators of 0.01 curies/gm steam per curies/gm water is used. The partition factor for the alkali metal activity in the steam generators is 0.0025 and is based on moisture carryover.
The resultant 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose is 0.24 rem TEDE. The 30 day low population zone dose is 0.54 rem TEDE. These doses are calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1.
The offsite doses resulting from the accident are less than 2.5 rem TEDE, which is 10-percent of the limit value of 10 CFR 50.67 and is the dose acceptance limit from Regulatory Guide 1.183.
The accumulated dose to control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite doses, using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51.
The calculated control room dose is presented in Table 14.3-52 and is less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
Chapter 14, Page 23 of 218 Revision 20, 2006 OAG10000215_1378
IP2 FSAR UPDATE 14.1.6.5.4 Conclusions
- 1. The peak pressure of 2533 psia for the worst case ensures that the integrity of the primary coolant system is not endangered and can be considered as an upper limit, considering the conservative assumptions used in the study.
- 3. The peak clad average temperature of 1810°F, calculated for the hot spot, includes the effect of the zirconium-steam reaction (which is still quite small at that temperature). It can be considered an upper limit since:
- a. The hot spot was assumed to be in departure from nucleate boiling from time zero regardless if DNB occurs.
- b. A high gap coefficient (10000 Btu/hr-ff -OF) was used.
- c. No credit was taken for transition boiling. The heat transfer coefficient for fully developed film boiling was used from time zero.
- d. The nuclear heat released in the fuel at the hot spot was based on a zero moderator coefficient.
- 4. The radiological consequences of this event are within the limit values.
Based on this, it can be concluded that all the applicable safety criteria for the locked rotor accident are met.
14.1.7 Startup Of an Inactive Reactor Coolant Loop Technical Specifications require that all 4 reactor coolant pumps be operating for reactor power operation and preclude operation with an inactive loop (except for testing or repair and not to exceed the time specified). This event was originally included in the FSAR licensing basis when operation with a loop out of service was considered. Based on the current Technical Specifications which prohibit at power operation with an inactive loop as indicated above and the changes to the Technical Specifications which deleted all references to three loop operation, this event has been deleted from the updated FSAR.
14.1.8 Loss Of External Electrical Load 14.1. 8.1 Description A major load loss on the plant can result from either a loss of external electrical load or from a turbine trip. For either case, offsite power is normally available for the continued operation of plant components such as the reactor coolant pumps, unless the 6.9 KV fast bus transfer does not take place. The specific case of loss of all ac power to station auxiliaries is discussed in Section 14.1.12. The case of RCP overs peed following a turbine mechanical overs peed trip is addressed in Section 4.2.2.4.
A turbine trip will cause a reactor trip based on a signal derived from the turbine autostop oil pressure unless the reactor is below approximately 20-percent power (P-8). The automatic steam dump system accommodates the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not Chapter 14, Page 24 of 218 Revision 20, 2006 OAG10000215_1379
IP2 FSAR UPDATE available, the excess steam generation would be dumped to the atmosphere. Additionally, main feedwater flow would be lost if the turbine condenser were not available. For this situation, steam generator level would be maintained by the auxiliary feedwater system.
The unit was originally designed to accept a step 50% loss of load without actuating a reactor trip. The automatic steam dump system, with 40% steam dump capacity to the condenser, was designed to accommodate this load rejection by reducing the severity of the transient imposed upon the RCS. The reactor power is reduced to the new equilibrium power level at a rate consistent with capability of the Rod Control System. The steam generator relief valves may be actuated, but the pressurizer relief valves and the steam generator safety valves should not lift for the 50% step loss of load with steam dump available.
In the event the steam dump valves fail to open following a large loss of load or in the event of a complete loss of load with steam dump operating, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, the low steam generator level signal, or the overtemperature/overpower L1T signals. The steam generator shell-side pressure and reactor coolant temperatures will increase rapidly. However, the pressurizer safety valves and steam generator safety valves are sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the steam dump system. The RCS and main steam supply relieving capacities were designed to ensure safety of the unit without requiring the automatic rod control, pressurizer pressure control and/or steam bypass control systems.
14.1.8.2 Method of Analysis In this analysis, the behavior of the unit was evaluated for a complete loss of steam load from full power without a direct reactor trip. This was done to show the adequacy of the pressure relieving devices and to demonstrate core protection margins. The reactor is not tripped until conditions in the RCS result in a trip. The turbine was assumed to trip without actuating the turbine trip signal (low auto stop oil pressure). This assumption delays reactor trip until conditions in the RCS result in a trip due to other signals. Thus, the analysis assumes a worst case transient. In addition, for conservatism, no credit was taken for steam dump, main feedwater flow is terminated at the time of turbine trip, and no credit was taken for auxiliary feedwater (except for long-term recovery) to mitigate the consequences of the transient.
In addition to the specific analysis discussed above for a complete loss of steam load from full power, the acceptability of a loss of steam load without direct reactor trip on turbine trip below 35% of 3230.0 MWt NSSS full power was also evaluated.
The total loss of load transients were analyzed with the RETRAN computer program (Reference 21a). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.
This accident was analyzed using the Revised Thermal Design Procedure (RTDP)
(Reference 22) for DNB concerns (case with pressure control) and for overpressure concerns (case without pressurizer pressure control) using the Standard Thermal Design Procedure (STOP). The initial conditions assumed for reactor power, RCS pressure and temperature are assumed to be at their nominal values as described in Section 4.0.2.1.
Major assumptions are summarized below:
Chapter 14, Page 25 of 218 Revision 20, 2006 OAG10000215_1380
IP2 FSAR UPDATE
- 1. Initial Operating Conditions The initial reactor power, RCS pressure, and RCS temperatures are assumed at their nominal values consistent with steady state full power operation for DNB case analyzed using RTDP. For the peak RCS pressure case, uncertainties are applied in the most limiting directions to the initial core power, reactor coolant pressure and reactor coolant temperature.
- 2. Moderator and Doppler Coefficients of Reactivity The turbine trip is analyzed with minimum reactivity feedback. The minimum feedback cases assume a minimum moderator temperature coefficient and the least negative Doppler coefficient.
- 3. Reactor Control From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
- 4. Steam Releases No credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits the secondary steam pressure at the setpoint value.
- 5. Pressurizer Spray and Power-operated Relief Valves Two cases with minimum reactivity feedback conditions were analyzed:
(a) For the DNB case, full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are also available.
(b) For the overpressure case, no credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are operable.
- 6. Feedwater Flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur. However, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
Reactor trip is actuated by the first reactor protection system trip setpoint reached with no credit taken for the direct reactor trip on the turbine trip.
14.1.8.3 Results The transient responses for a total loss of load from full power operation are shown on Figures 14.1-31 to 14.1-33 and Figures 14.1-37 through 14.1-39 for two cases; one case with pressure control, one case without pressure control, both assuming minimum reactivity feedback Chapter 14, Page 26 of 218 Revision 20, 2006 OAG10000215_1381
IP2 FSAR UPDATE conditions. Previously, four cases were analyzed; two cases at BOL minimum reactivity feedback conditions and two cases at EOL reactivity feedback conditions. Since the Loss of Load/ Turbine Trip event results in a primary system heatup, the analysis conservatively assumed minimum reactivity feedback conditions for both, with and without pressurizer pressure control which bounds the event with EOL reactivity feedback conditions.
Figures 14.1-31 through 14.1-33 show the transient responses for the total loss of steam load assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure trip channel.
The minimum DNBR is well above the limit value. The pressurizer power operated relief valves are actuated for this case and maintain system pressure below 11 O-percent of the design value.
The steam generator safety valves open and limit the secondary steam pressure increase.
The total loss of load event was also analyzed assuming the plant to be initially operating at full power nominal conditions with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam dump. The reactor is tripped on the high pressurizer pressure signal. Figures 14.1-37 through 14.1-39 show the transients without credit for pressurizer spray or power-operated relief valves. The neutron flux remains essentially constant at full power until the reactor is tripped. The DNBR increases throughout the transient. In this case the pressurizer safety valves are actuated and maintain the system pressure below 11 O-percent of the design value.
Table 14.1-6 summarizes the sequence of events for the various transients considered for the total loss of load cases presented above.
The results of the complete loss of steam load from full power evaluation concluded that a loss of steam load without direct reactor trip on turbine trip below 35% of full power is bounded by the complete loss of flow event described in Section 14.1.6 with respect to the minimum DNBR condition reached during the transient and bound by the loss of load (turbine trip) event from full power conditions with respect to peak overpressure RCS conditions.
14.1.8.4 Conclusions The results of the analyses performed for a total loss of external electrical load without a direct or immediate reactor trip from full power conditions show that the plant design is such that there would be no challenge to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the design of the plant would be adequate to limit the maximum pressures to within the design limits. In addition, the integrity of the core would be maintained by operation of the reactor protection system; i.e., the DNBR would be maintained above the safety analysis limit value. Thus, no core safety limit would be violated. Furthermore, these results, in conjunction with the results for the complete loss of flow event from full power, bound the results for a complete loss of load from 50% power without a direct reactor trip on turbine trip.
Chapter 14, Page 27 of 218 Revision 20, 2006 OAG10000215_1382
IP2 FSAR UPDATE 14.1.9 Loss Of Normal Feedwater 14.1.9.1 Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in the capability of the secondary system to remove the heat generated in the reactor core. If an alternate supply of feedwater were not furnished, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the reactor coolant system and possible core damage. Since the plant is tripped well before the steam generator heat transfer capacity would be reduced, the primary system variables never approach a departure from nucleate boiling condition.
The following events occur upon the loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):
A. As the steam pressure rises following the trip, the steam generator power-operated relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam generator power-operated relief valves are not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and reactor coolant pumps plus the residual decay heat produced in the reactor.
B. As the no-load temperature is approached, the steam generator power-operated relief valves (or safety valves if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
Following the occurrence of a loss of normal feedwater, the reactor may be tripped by any of the following reactor protection system trip signals:
- Low-low steam generator water level
- Over-Temperature L1T
- High pressurizer pressure
- High pressurizer water level
- Steam flow-feedwater flow mismatch in coincidence with low water level in any steam generator.
Auxiliary Feedwater (AFW) is supplied by actuation of two motor-driven auxiliary feedwater pumps, which are initiated by any of the following signals:
- a. Low-low water level in any steam generator.
- b. Automatic trip (not manual) of any main feed pump turbine.
- c. Any safety injection signal.
- d. Manual actuation.
- e. Loss of offsite power concurrent with unit trip.
In addition, one turbine driven auxiliary feedwater pump starts on the following actuation signals although no automatic delivery of water to the steam generators occurs:
Chapter 14, Page 28 of 218 Revision 20, 2006 OAG10000215_1383
IP2 FSAR UPDATE
- a. Low-low level in any two steam generators.
- b. Loss of offsite power concurrent with unit trip and no safety injection signal.
- c. Manual actuation.
The motor-driven auxiliary feedwater pumps are powered by the emergency diesel generators.
The pumps take suction from the condensate storage tank for delivery to the steam generators.
Each motor-driven pump is designed to supply the minimum required flow within 60 seconds of the initiating signal. The turbine-driven AFW pump is valved out during normal operation.
Therefore, although it is automatically actuated, it is not available to deliver flow to the steam generators until an operator action is taken to align the turbine-driven train.
Backup in equipment and control logic is provided to ensure that reactor trip and automatic auxiliary feedwater flow will occur following any loss of normal feedwater, including that followed by loss of offsite power. An analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat plus reactor coolant pump waste heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and the plant returning to a safe condition.
14.1.9.2 Method of Analysis A detailed analysis using the RETRAN computer code (Reference 21a) is performed to determine the plant transient following a loss of normal feedwater. The code simulates the core neutron kinetics, reactor coolant system, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables, including pressurizer pressure, pressurizer water level, steam generator mass, and reactor coolant average temperature.
Assumptions made in the analysis are:
- 1. Initial steam generator level is at the nominal programmed value plus 10%
narrow range span (NRS). Reactor trip occurs on steam generator low-low level at 0% of narrow range span.
- 2. The plant is initially operating at 102-percent of the NSSS power (3230 MVVt) which bounds a nominal pump heat of 14MVVt.
- 3. Conservative core residual heat generation based on long-term operation at the initial power level preceding the trip is assumed. The 1979 decay heat standard (ANS 5.1) plus 2 sigma uncertainty was used for calculation of residual decay heat levels.
- 4. The worst single failure in the AFW system occurs, i.e., failure of one of the motor-driven auxiliary feedwater pumps. The Auxiliary Feedwater System is assumed to automatically supply a total of 380 gpm to two steam generators from one motor-driven pump. Additional flow from the turbine-driven auxiliary feedwater pump is assumed available only following an operator action to align the turbine-driven pump.
Chapter 14, Page 29 of 218 Revision 20, 2006 OAG10000215_1384
IP2 FSAR UPDATE
- 5. The pressurizer sprays, heaters, and power operated relief valves are assumed operable. This maximizes the peak transient pressurizer water volume. If these control systems did not operate, the pressurizer safety valves would maintain peak RCS pressure at or below the actuation setpoint throughout the transient.
- 6. Secondary system steam relief is achieved through the steam generator safety valves. No credit is taken for the operation of steam dumps or power-operated relief valves.
- 7. Cases are analyzed assuming initial hot full power reactor vessel average coolant temperatures at the upper and lower ends of the uprated operating range with uncertainty applied in both the positive and negative direction. The vessel average temperature assumed at the upper end of the range is 572°F with an uncertainty of +/-7.5°F. The average temperature assumed at the lower end of the range is 549°F with an uncertainty of +/-7.5°F. Results for the limiting case are presented.
- 8. Initial pressurizer pressure is assumed to be 2250 psi with an uncertainty of +28/-
37 psi. Cases are considered with the pressure uncertainty applied in both the positive and negative directions to conservatively bound potential operating conditions. Results for the limiting case are presented.
- 9. Cases are analyzed assuming initial feedwater temperatures at the upper and lower ends of the uprated operating feedwater temperature window (436.2°F and 390°F, respectively).
- 10. The high Tavg program cases assumes an initial pressurizer level of 71-percent (65% + 6% uncertainty). For the low Tavg program cases, an initial pressurizer level of 43-percent (37% + 6% uncertainty) is considered.
- 11. The enthalpy of the auxiliary feedwater is assumed to be 90.77 Btu/Ibm corresponding to a condensate storage tank temperature of 120 of.
- 12. Analyses with both minimum (0%) and maximum (10%) steam generator tube plugging were performed to conservatively bound potential operating conditions.
- 13. An auxiliary feedwater line purge volume of 268.8 fe is assumed.
The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (i.e., the auxiliary feedwater system). The analysis demonstrates the capability of the AFW system to remove long term decay heat, thus preventing RCS overpressurization or loss of RCS water by overfilling the pressurizer.
As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.
For the loss of normal feedwater transient, the reactor coolant volumetric flow remains at its normal value and the reactor trips via the low-low steam generator level trip. The reactor coolant pumps may be manually tripped at some later time to reduce heat addition to the RCS.
Chapter 14, Page 30 of 218 Revision 20, 2006 OAG10000215_1385
IP2 FSAR UPDATE Normal reactor control systems are not required to function in this analysis. The reactor protection system is required to function following a loss of normal feedwater as analyzed herein. The auxiliary feedwater system is required to deliver a minimum auxiliary feedwater flow rate and no single active failure will prevent operation of any system required to function.
14.1.9.3 Results Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. Sixty seconds following the initiation of the low-low level trip, at least one motor-driven auxiliary feedwater pump is automatically started and supplying the minimum required flow to reduce the rate of decrease in steam generator water level.
The capacity of one motor driven auxiliary feedwater pump is such that the rate of decrease of the water level in the steam generator being fed AFW flow is sufficiently slowed to provide an allowable time for the operator to align the turbine-driven train and prevent water relief from the RCS relief or safety valves.
The calculated sequence of events for this accident is listed in Table 14.1-7. Figure 14.1-43 (Sheet 1 through Sheet 5) shows the significant plant parameters following a loss of normal feedwater. The Figures show that the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation. Figure 14.1-43 Sheet 1 shows the pressurizer water volume transient. As shown in Figure 14.1-43 Sheet 3, RCS subcooling is maintained since the RCS never reaches saturated conditions. Plant procedures may be followed to further stabilize and cool down the plant.
14.1.9.4 Conclusions Results of the analysis show that, for a loss of normal feedwater event, all safety criteria are met. The AFW capacity is sufficient to prevent pressurizer filling and any subsequent water relief through the pressurizer relief and safety valves. This assures that the RCS is not overpressurized.
14.1.10 Excessive Heat Removal Due To Feedwater System Malfunctions 14.1.10.1 Description Excessive heat removal due to feedwater system malfunctions is a means of increasing core power above full power and can result from a decrease in feedwater enthalpy or excessive feedwater additions. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower and overtemperature protection (high neutron flux, overtemperature L1T, and overpower L1T trips) prevent any power increase that could lead to a DNBR that is less than the DNBR limit.
An example of a feedwater control system malfunction that results in a decrease in feedwater enthalpy would be an inadvertent opening of the feedwater bypass valve which diverts flow around the low pressure feedwater heaters. The feedwater bypass valve was retired in place when operating experience proved that it was not required for its intended purpose of providing sufficient suction pressure at the feed pumps. The description of this event, however, including the method of analysis, results and conclusions, is being retained herein for informational Chapter 14, Page 31 of 218 Revision 20, 2006 OAG10000215_1386
IP2 FSAR UPDATE purposes. For this event, there would be a sudden reduction in inlet feedwater temperature to the steam generator. The increased subcooling of the secondary side would create a greater load demand on the primary side which can lead to reactor trip conditions.
An example of excessive feedwater flow would be a full opening of a feedwater control valve due to a feedwater control system malfunction or an operator error. At power, these occurrences could also cause a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant at no-load conditions, the addition of cold feedwater might cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. Continuous excessive feedwater addition would be prevented by the steam generator high-high level trip, which closes the feedwater control valves.
14.1.10.2 Method of Analysis The excessive heat removal due to feedwater system malfunction transients were analyzed using the RETRAN code (Reference 21 a).
The decrease in feedwater enthalpy event is conservatively assumed to occur at hot full power initial conditions. As a result of opening the feedwater bypass valve and diverting the flow around the low-pressure feedwater heaters, the feedwater temperature at the inlet of the steam generator in the affected loop decreases from 430°F to 420°F. This results in a decrease in the feedwater enthalpy of less than 11 Btu/Ibm. An evaluation shows that the reduction in feedwater enthalpy by 11 Btu/Ibm is significantly less than that for excessive load increase events described in Section 14.1.11. Therefore, excessive load increase events (cases with manual reactor control at BOL and with automatic reactor control at EOL) bound the feedwater enthalpy cases as previously described.
For the excessive feedwater addition due to a control system malfunction or operator error that allows a feedwater control valve to open fully, three cases were analyzed as follows:
- 1. Accidental opening of one feedwater control valve with the reactor just critical at zero load conditions assuming a conservatively large moderator density coefficient characteristic of end-of-life conditions and the reactor in manual rod control.
- 2. Accidental opening of one feedwater control valve from full power initial conditions with the reactor in manual rod control.
- 3. Accidental opening of one feedwater control valve from full power initial conditions with the reactor in automatic rod control.
The reactivity insertion rate following a feedwater system malfunction was calculated with the following assumptions:
- 1. For the feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction, resulting in a step increase to 130% of nominal feedwater flow to one steam generator.
- 2. For the feedwater control valve accident at zero load conditions, a feedwater valve malfunction occurs that results in a ramp increase in flow to one steam Chapter 14, Page 32 of 218 Revision 20, 2006 OAG10000215_1387
IP2 FSAR UPDATE generator from zero flow at time zero to 210% of the nominal full load value for one steam generator at 5 seconds.
- 3. For the zero load condition, a conservatively low feedwater enthalpy corresponding to a feedwater temperature of 100°F is assumed.
- 4. No credit is taken for the heat capacity of the RCS and steam generator metal in attenuating the resulting plant cooldown.
- 5. No credit is taken for the heat capacity of the steam and water in the unaffected steam generators.
14.1.10.3 Results and Conclusions For the feedwater enthalpy reduction event, the reduction in feedwater enthalpy is less than the equivalent reduction in feedwater enthalpy from the excessive load increase incident as described in Section 14.1.11. Therefore, the results for the excessive load increase incident, which show considerable margin to the DNBR limit exist under these same conditions, bound the feedwater enthalpy reduction cases.
In the case of excessive feedwater flow resulting from an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, the resulting transient is similar to, but less severe than the hypothetical steamline break transient described in Section 14.2.5. Because the excessive feedwater flow cases with the reactor at zero power is bounded by the analysis presented in Section 14.2.5, no transient results are given in this section. It should be noted that if the incident occurs with the unit just critical at no-load, the reactor may be tripped by the power range neutron flux trip (low setting).
For the full power cases, the results with automatic rod control are nearly identical to those with manual rod control assumed. This is because the small increase in feedwater flow (30% above nominal) results in a very small increase in RCS temperature. The rod control system actuates but rod movement is minimal due to the small RCS temperature change.
Transient results showing the core heat flux, pressurizer pressure, Tavg , and DNBR, as well as the increase in nuclear power and loop L1T associated with the increased thermal load on the reactor are given in Figure 14.1-45 for the full power case with manual rod control. Steam generator water level rises until the feedwater is terminated as a result of the high-high steam generator water level trip. The DNBR does not fall below the safety analysis DNBR limit. The calculated sequence of events for the full power cases are shown in Table 14.1-8.
14.1.11 Excessive Load Increase Incident 14.1.11.1 Description An excessive load increase incident is defined as a rapid increase in the steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10% step-load increase or a 5% per minute ramp load increase in the range of 15 to 100% of full power (the elimination of the automatic control rod withdrawal function could require the use of manual rod control to have the reactor respond to the turbine load change and to restore the coolant average temperature Chapter 14, Page 33 of 218 Revision 20, 2006 OAG10000215_1388
IP2 FSAR UPDATE to the programmed value). Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system.
This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.
During power operation, steam dump to the condenser is controlled by reactor coolant condition signals: i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided that blocks the opening of the valves unless a large turbine load decrease or turbine trip has occurred.
14.1.11.2 Method of Analysis Historically, four cases were analyzed to demonstrate plant behavior following a 10% step load increase from rated load. These cases are as follows:
- 1. Reactor control in manual with beginning-of-life minimum moderator reactivity feedback.
- 2. Reactor control in manual with end-of-life maximum moderator reactivity feedback.
- 3. Reactor control in automatic with beginning-of-life minimum moderator reactivity feedback.
- 4. Reactor control in automatic with end-of-life maximum moderator reactivity feedback.
For the beginning-of-life minimum moderator feedback cases, the core has the least negative moderator temperature coefficient of reactivity and the least negative Doppler only power coefficient curve; therefore the least inherent transient response capability. For the end-of-life maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value and the most negative Doppler only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.
A conservative limit on the turbine valve opening (equivalent to 120% turbine load) was assumed, and all cases were analyzed without credit being taken for pressurizer heaters.
This accident was analyzed using the Revised Thermal Design Procedure (RTDP).22 Initial reactor power, ReS pressure, and temperature were assumed to be at their nominal values.
Uncertainties in initial conditions were included in the limit DNBR as described in Section 14.0.2.1.
Normal reactor control systems and engineered safety systems were not required to function for this event. The reactor protection system was assumed to be operable; however, reactor trip was not encountered for most cases due to the error allowances assumed in the setpoints. No single active failure would prevent the reactor protection system from performing its intended function.
The cases which assume automatic rod control were analyzed to ensure that the worst case with respect to minimum DNBR is presented. The automatic rod control function is not required to mitigate the consequences of this event. The automatic control rod withdrawal feature in plant operation has been physically disabled, allowing only the automatic control rod insertion mode to be in effect when rod control is in automatic.
Chapter 14, Page 34 of 218 Revision 20, 2006 OAG10000215_1389
IP2 FSAR UPDATE Given the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an explicit analysis was not performed as part of the Stretch Power Uprate program. Instead, a detailed evaluation of this event was performed. The evaluation model consists of the generation of statepoints based on generic conservative data. The statepoints are then compared to the core thermal limits to ensure that the DNBR limit is not violated. Since automatic rod withdrawal has been disabled at Indian Point Unit 2, only cases assuming manual rod control are evaluated.
These cases are:
- Reactor in manual rod control with EOL (maximum moderator) reactivity feedback.
14.1.11.3 Results and Conclusions An evaluation of this event was performed to support the Stretch Power Uprate program. The evaluation determined that the DNB design basis for a 10% step load increase continues to be met.
14.1.12 Loss of all AC Power to the Station Auxiliaries 14.1.12.1 Description A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries: i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite non-emergency AC distribution system.
The first few seconds of the transient would be almost identical to the four pump loss-of-flow case presented in Section 14.1.6 where the pump coastdown inertia along with the reactor trip prevent reaching the DNBR limit. After the trip, decay heat will be accommodated by the auxiliary feedwater system. This portion of the transient would be similar to that presented in Section 14.1.9 for the Loss of Normal Feedwater event.
The events following such a condition are described in the sequence listed below:
- 1. Plant vital instruments are supplied by emergency power sources (See Chapter 8).
- 2. As the steam system pressure rises following the trip, the steam system power-operated relief valves are automatically opened to the atmosphere. Steam bypass to the condenser is not available because of loss of the circulating water pumps. If the power-operated relief valves are not available, the steam generator self-actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual heat produced in the reactor.
- 3. As the no-load temperature is approached, the steam system power-operated relief valves (or the self-actuated safety valves, if the power-operated relief valve are not available) are used to dissipate the residual heat and to maintain the plant at the hot standby condition.
Chapter 14, Page 35 of 218 Revision 20, 2006 OAG10000215_1390
IP2 FSAR UPDATE
- 4. The emergency diesel generators are started on loss of voltage on the plant emergency buses and begin to supply plant vital loads.
The auxiliary feedwater system is started automatically as discussed in Section 14.1.9 for the loss of normal feedwater analysis. The two motor-driven AFW pumps are supplied by power from the emergency diesel generators. The pumps take suction directly from the condensate storage tank for delivery to the steam generators. Each motor-driven pump is designed to supply the minimum required flow within 60 seconds of the initiating signal. Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops aided by the auxiliary feedwater in the secondary system. The analysis here will show that following a loss of AC power event, the natural circulation flow in the RCS is sufficient to remove residual heat from the core.
14.1.12.2 Method of Analysis A detailed analysis using the RETRAN computer code (Reference 21a) is performed to determine the plant transient following a loss of AC power to the station auxiliaries. The code simulates the core neutron kinetics, reactor coolant system including natural circulation, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables, including pressurizer pressure, pressurizer water level, steam generator mass, and reactor coolant average temperature.
Major assumptions differing from those in a loss of normal feedwater presented in Section 14.1.9 are:
- 1. No credit is taken for immediate response of control rod drive mechanisms caused by a loss of offsite power.
- 2. A heat transfer coefficient in the steam generator associated with RCS natural circulation is assumed following the reactor coolant pump coastdown.
- 3. The plant is initially operating at 102-percent of the NSSS power (3230 Mwt). A nominal RCP heat of 14 Mwt was assumed.
The complete loss of non-emergency AC power analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (i.e., the auxiliary feedwater system). The analysis demonstrates the capability of the AFW system to remove long term decay heat, thus preventing RCS overpressurization or loss of RCS water by overfilling the pressurizer.
As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as discussed in Section 14.1.9 for the assumptions in the loss of normal feedwater analysis.
14.1.12.3 Results Figure 14.1-50 (Sheet 1 through Sheet 5) shows the plant parameters following a loss of offsite power to the station auxiliaries. The time sequence of events for this accident is given in Table 14.1-10.
Chapter 14, Page 36 of 218 Revision 20, 2006 OAG10000215_1391
IP2 FSAR UPDATE After the reactor trip, stored and residual heat must be removed to prevent damage to either the RCS or the core. The RETRAN results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and RCP coastdown.
14.1.12.4 Conclusions Results of the analysis show that, for the loss of offsite power to the station auxiliaries event, all safety criteria are met. The AFW capacity is sufficient to prevent water relief through the pressurizer relief and safety valves; this assures that the RCS is not overpressurized.
The analysis also demonstrates that sufficient long-term heat removal capability exists by the natural circulation capability of the RCS following reactor coolant pump coastdown to prevent fuel or clad damage.
14.1.13 Likelihood And Consequences of Turbine-Generator Unit Overspeed The assessment of turbine-generator overspeed prepared and submitted in the original 1968 Indian Pont Unit 2 FSAR (as part of the initial license application) assumed that all turbine missiles (i.e., fragments of turbine rotor disks) would be contained within the turbine casing.
Subsequent to that submittal, a 1970 study was prepared by Westinghouse to document the results of additional analytical and experimental work performed regarding the likelihood and consequences of turbine overspeed. (See Reference 30). In response to an AEC request for further information, this study was provided as Appendix 14A in Supplement 12 to the original FSAR prior to initial plant operation. The results showed that the original position on the containment of low pressure turbine disk fragments within the turbine casing could no longer be maintained and a completely independent turbine electric overspeed detection and valve trip initiation system (i.e., IEOPS) was incorporated into the original Indian Point Unit 2 design.
In the late 1980s, Westinghouse and the Westinghouse Owners Group proposed and the NRC approved the generic application of a revised probabilistic methodology for turbine missile generation likelihood and the appropriate frequencies for inspection, testing, and maintenance of turbine rotors and control systems (See References 28, 31, 32, 33). The NRC concluded that maintaining a small probability of turbine missile generation through testing and inspection is a reliable means of ensuring safety-related structures, systems, and components are adequately protected from such missiles and that the revised approach simplifies and improves procedures for evaluation of turbine missile risks by eliminating from consideration factors such as missile trajectory and damage probability. The NRC's revised acceptance criteria for total turbine missile generation probabilities was established as less than 1E-4 per year for a favorably oriented turbine and less than 1E-5 per year for an unfavorably oriented turbine.
By letter dated February 8, 1994 (Reference 34), the NRC issued Amendment No. 168 to the Indian Point Unit 2 Operating License which approved the application of the revised generic methodology to Indian Point Unit 2, a revised surveillance interval for testing turbine stop and control valves, and the deletion of Technical Specification limiting conditions for operation and surveillance requirements for the Independent Electrical Overspeed Protection System (lEOPS).
This approval was based on the application of the generic methodology and data of Reference 28 as supplemented by Reference 29, and the Consolidated Edison commitment contained in Reference 35 to review and re-evaluate the turbine valve testing frequency probabilistic analysis any time major changes in the turbine system have been made or a significant upward trend in the valve failure rate is identified. This commitment included the incorporation of information on Chapter 14, Page 37 of 218 Revision 20, 2006 OAG10000215_1392
IP2 FSAR UPDATE valve failure rates in the UFSAR and the updating of that information at least once every three years (See Section 14.1.13.2).
14.1.13.1 Turbine Control and Protection The likelihood of a turbine-generator unit overspeed condition is remote because of the reliability and redundancy of the turbine control and protection systems.
The turbine control and protection system is completely hydraulic. There are two low-pressure oil control systems: the auxiliary governor system and the emergency trip system. These two systems and the 300-psi system are interconnected through orifices. The control and protection system is fail-safe; any loss of oil pressure causes closure of the steam valves.
The main governor normally controls the unit. Should an overspeed take place, the auxiliary governor system will be actuated first, the auxiliary governor dome valve will open, the 300-psi pressure oil will drain, and the control valve will close.
Should the unit overspeed reach the mechanical overs peed trip setpoint, the overs peed trip valve will open, the 300-psi pressure oil will drain, and the throttle valves will close. At the same time, a second drain path will be provided for the 300-psi oil system that controls the first set of valves, so that the control valves will trip too, in case they did not trip.
Assuming, for the purpose of analysis, that a control valve and stop valve in the same steam path fail to close, a turbine runaway would occur.
Besides the provisions in the design of the turbine control and protection system during plant operation, valves are exercised on a periodic basis to preclude the possibility of a valve stem sticking. Analyses of oil samples are performed as required.
The turbine is periodically given an overs peed check to verify the trip speed. The remaining tripping devices are periodically checked.
14.1.13.2 Analysis and Results Reference 28 documents the probabilistic analysis performed to determine the annual turbine missile ejection probability, as a function of turbine valve test frequency, for a group of nuclear power plants with Westinghouse turbines. Testing of turbine valves affects the probability that the valves will be incapable of closing given that the load on the turbine is lost. The failure or unavailability of the turbine valves contributes to the probability that the turbine will overs peed and eject a missile.
The analysis of turbine overs peed included a thorough identification of all faults and contributors to overspeed. Specific plant data was collected from the turbine owners in the effort. In addition, other systems which interface with the turbine were investigated to determine whether they have any impact on the probability of overspeed. The study quantified the total risk of turbine missile ejection at destructive overspeed (approximately 180-percent of rated turbine speed) and at lower speeds in the range of 120 to 136-percent at rated speed. The lower speeds were evaluated in two categories: design overs peed and intermediate overspeed.
The analysis performed used fault trees to determine the annual probability of overspeed for each of the three overspeed events. Failures of turbine valves and overspeed protection Chapter 14, Page 38 of 218 Revision 20, 2006 OAG10000215_1393
IP2 FSAR UPDATE components were modeled in the fault trees as a function of the valve test intervals as appropriate. The probability of overs peed was calculated for various test intervals. The probabilities of missile generation for the design and intermediate overspeed conditions were determined based on plant-specific low pressure rotor design information. The probability of missile generation for the destructive overspeed event was assumed to be 1.0. For each overspeed event, the probability of the overspeed event was combined with the probability of missile generation for that event. The resulting annual probabilities of missile generation for each event, for a given test interval, were summed to provide the total.
Subsequent to the issuance of Reference 28, a subgroup of plants with Westinghouse 88-95/96 turbines evaluated more recent valve failure data and modes. Reference 29 modeled the revised failure rates and modes using a fault tree for the destructive overspeed event. The destructive overspeed probability was calculated for various turbine valve test intervals. An allowance was defined for the missile ejection contributions of the design and intermediate overspeed. Reference 29 provided revised guidance for determining appropriate turbine valve test intervals. Using the destructive overspeed results in conjunction with the allowance, the results may be used to determine an appropriate turbine valve test interval which meets the NRC acceptance criterion of 1.0E-5 per year. Reference 36 contains the most recent assessment of turbine valve failure data and covers a period from January 1986 through December 1999. The valve failure data is presented in Figures 14.1-62 through 14.1-66, and the turbine valve test interval currently recommended by the vendor is presented in Figure 14.1-67.
Indian Point Unit No.2 has fully integral low pressure turbine rotors. The fully integral design eliminates the disk bores and keyways of the earlier design, reducing peak stresses and transferring the location of peak stresses to the blade fastening locations on the rotor.
Reference 16 (submitted to the NRC by Westinghouse) discusses the probabilities of crack initiation and missile generation. The probability of creating a disk-segment missile is significantly lower for the fully integral design than for the previous design. 8ased on the conclusions in Reference 16, Consolidated Edison notified the NRC (Reference 17) that periodic in-service inspections of the fully integral low pressure turbine rotors will not be required.
8ecause of the very large margin between the high pressure spindle bursting speed and the maximum speed at which the steam can drive the unit with all admission valves full open, the probability of spindle failure is practically zero. Therefore, no harmful missile is expected from the high pressure turbine rotor in case of a turbine runaway.
REFERENCES FOR SECTION 14.1
- 1. Deleted
- 2. Deleted
- 3. Deleted
- 4. Deleted
- 5. Deleted
- 6. Deleted Chapter 14, Page 39 of 218 Revision 20, 2006 OAG10000215_1394
IP2 FSAR UPDATE
- 7. Deleted
- 8. Deleted
- 9. Deleted
- 10. Deleted
- 11. Deleted
- 12. Deleted
- 13. Deleted
- 14. Deleted
- 15. Letter from J. D. O'Toole, Con Edison, to S. A. Varga, NRC,
Subject:
Technical Specification for Reactor Trip on Turbine Trip, dated August 6, 1985.
- 16. Westinghouse Topical Report WSTG-4-NP, "Analysis of the Probability of the Generation of Missiles from Fully-Integral Low-Pressure Rotors," 1984.
- 17. Letter from M. Selman, Con Edison, to Document Control Desk, NRC, dated May 28, 1987.
- 18. D. H. Risher, Jr. and R. F. Barry, "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code", WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary), January 1975.
- 19. H. G. Hargrove, "FACTRAN - A Fortran IV Code for Thermal Transients in a U02 Fuel Rod", WCAP-7908-A, December 1989.
- 20. Hochreiter, L. E., Chelemer, H., Chu, P. T. "THINC IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, February 1989.
- 21. T. W. T. Burnett, et. aI., "LOFTRAN Code Description", WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), April 1984.
21a. D. S. Huegel, et. aI., "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," WCAP-14882-P-A (Proprietary), April 1999 and WCAP-15234-A (non-Proprietary), May 1999.
- 22. Friedland, A. J. and Ray, S., "Revised Thermal Design Procedure", WCAP-11397-P-A, April 1989
- 23. SUNG, Y. x., et aI., "Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-A (Proprietary) and WCAP-15306 (Non-Proprietary), October 1999.
- 24. Deleted Chapter 14, Page 40 of 218 Revision 20, 2006 OAG10000215_1395
IP2 FSAR UPDATE
- 25. Liu, Y. S., et aI., "ANC - A Westinghouse Advanced Nodal Computer Code,"
WCAP-10965-P-A, September 1986.
- 26. (saved for future use)
- 27. Haessler, R. L., et aI., "Methodology for the Analysis of the Dropped Rod Event,"
WCAP-11394-P-A (Proprietary) and "WCAP-11394 (Non-proprietary), January 1990
- 28. Probabilistic Evaluation of Reduction in Turbine Valve Test Frequency," WCAP-11525, June 1987
- 29. Letter from S.B.Bram, Consolidated Edison, to Document Control Desk, NRC, dated November 8, 1993, Attachment A: Summary of Westinghouse Owners Group Turbine Valve Test Frequency Subgroup Final Report "Update of BB-95/96 Turbine Valve Failure Rates and Effects on Destructive Overs peed Probabilities."
- 30. Fox, J.N., Westinghouse Electric Corporation, "Likelihood and Consequences of Turbine Overs peed at the Indian Point Nuclear Generating Unit No.2," July, 1970
- 31. Letter from C. E. Rossi, NRC, to J. A. Martin, Westinghouse, dated February 2, 1987 forwarding an NRC Safety Evaluation Report on generic Westinghouse licensing topical reports regarding the probability of turbine overspeed and missile generation.
- 32. Letter from A. C. Thandani, NRC, to D. M. Musolf, Northern States Power Company, dated November 2, 1989, forwarding an NRC Safety Evaluation and Supplemental Safety Evaluation regarding use of WCAP-11525 in future license amendment requests by Westinghouse Owners Group (Turbine Valve Test Frequency Subgroup Members).
- 33. Letter from D. S. Brinkman to S. B. Bram, Consolidated Edison, dated November 30, 1989, regarding approval for referencing of WCAP-11525 by members of the Westinghouse Owners Group (Turbine Valve Test Frequency Evaluation Subgroup).
- 34. Letter from F.J. Williams, Jr., NRC, to S.B. Bram, Consolidated Edison, forwarding License Amendment No. 168 to Facility Operating License No. DPR-26 and associated Safety Evaluation.
- 35. Letter from S.B. Bram, Consolidated Edison, to Document Control Desk, NRC, "Proposed Amendment to Technical Specifications Regarding Turbine Valve Test Frequency and Electrical Overs peed Protection System", dated August 9, 1991.
- 36. Letter from R. Sisk, Westinghouse Owners Group, to Turbine Valve Test Frequency Evaluation Subgroup, dated October 16, 2000, forwarding "Final Update and Evaluation of BB-95/96 Turbine Valve Failure Data Base -
September 29, 2000."
Chapter 14, Page 41 of 218 Revision 20, 2006 OAG10000215_1396
IP2 FSAR UPDATE
- 37. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
TABLE 14.1-1 Uncontrolled RCCA Withdrawal From a Subcritical Condition Time Sequence of Events Event Time (Seconds)
Start of the accident 0.0 High Neutron Flux Reactor Trip Setpoint (Low Setting) reached 9.8 Rods begin to fall 10.3 Minimum DNBR occurs 11.8 Peak Clad Average Temperature occurs 12.0 Peak Fuel Average Temperature occurs 12.3 Peak Fuel Centerline Temperature occurs 13.2
SUMMARY
OF THE RESULTS Peak Clad Average Temperature (OF) 701 Peak Fuel Average Temperature (OF) 1927 Peak Fuel Centerline Temperature (OF) 2286 Chapter 14, Page 42 of 218 Revision 20, 2006 OAG10000215_1397
IP2 FSAR UPDATE TABLE 14.1-2 Uncontrollable RCCA Bank Withdrawal at Power Time Sequence of Events Accident Event Time (Sec)
Uncontrollable RCCA bank withdrawal at power
- 1. Case A Initiation of uncontrollable RCCA withdrawal o at a high reactivity insertion rate (70 pcm/sec)
Power range high neutron flux high trip 1.6 point reached Rods begin to fall into core 2.1 Minimum DNBR occurs 3.0
- 2. Case B Initiation of uncontrollable RCCA withdrawal o at a small reactivity insertion rate (1 pcm/sec)
Overtemperature ~T reactor trip signal 100.2 initiated Rods begin to fall into core 102.2 Minimum DNBR occurs 103.0 Chapter 14, Page 43 of 218 Revision 20, 2006 OAG10000215_1398
IP2 FSAR UPDATE TABLE 14.1-3 Complete Loss of Flow (Undervoltage)
Time Sequence of Events Time (Seconds)
All the pumps begin to coastdown O.
Reactor coolant pump undervoltage trip point reached at O.
Rods begin to fall 1.5 Minimum DNBR occurs 3.3 Maximum RCS pressure occurs 15.0
SUMMARY
OF THE RESULTS COMPLETE LOSS OF FLOW (Undervoltage)
Maximum RCS Pressure (psia) 2349 Complete Loss of Flow (Underfrequency)
Time Sequence of Events Event Time (Seconds)
Frequency decay of 5 Hz/sec begins O.
Reactor coolant pump underfrequency trip point reached 0.6 and all the pumps begin to coastdown Rods begin to fall 1.6 Minimum DNBR occurs 3.6 Maximum RCS pressure occurs 15.2
SUMMARY
OF THE RESULTS COMPLETE LOSS OF FLOW (Underfrequency)
Maximum RCS Pressure (psia) 2366 Chapter 14, Page 44 of 218 Revision 20, 2006 OAG10000215_1399
IP2 FSAR UPDATE TABLE 14.1-4 Partial Loss of Flow Time Sequence of Events Event Time (Seconds)
One pump begins to coastdown O.
Reactor coolant low-flow trip setpoint (85%) reached 1.6 Rods begin to fall 2.6 Minimum DNBR occurs 3.4 Maximum RCS pressure occurs 14.4
SUMMARY
OF THE RESULTS PARTIAL LOSS OF FLOW Maximum RCS Pressure (psia) 2331 Chapter 14, Page 45 of 218 Revision 20, 2006 OAG10000215_1400
IP2 FSAR UPDATE TABLE 14.1-5 Locked Rotor Event - Hot Spot Time Sequence of Events Time (Seconds)
Rotor in one pump seizes O.
Reactor coolant low flow trip setpoint reached at 0.10 Rods begin to fall 1.10 Maximum RCS pressure occurs 4.9 Maximum clad temperature occurs 3.8
SUMMARY
OF THE RESULTS LOCKED ROTOR EVENT-HOTSPOT Maximum Reactor Coolant System Pressure (psia) 2533 Maximum Clad Average Temperature (OF) 1810
% Zirconium Reacted 0.31%
Chapter 14, Page 46 of 218 Revision 20, 2006 OAG10000215_1401
IP2 FSAR UPDATE TABLE 14.1-6 Loss of External Electrical Load Time Sequence of Events Time of event, sec With Pressurizer Without Pressurizer Control- DNB Case Control-Overpressurization Case Loss of electrical load/turbine trip 0.0 0.0 Initiation of steam release from 11.97 8.19 SG safety valves High pressurizer pressure 9.81 6.25 reactor trip point reached Rods begin to fall 11.81 8.25 Minimum DNBR occurs 13.10 N/A (min. DNBR =2.06)
Peak RCS pressure occurs N/A 8.6 (peak RCS pres. =2664.32 psia)
Peak MSS pressure occurs N/A 15.60 (peak MSS pres. = 1158.65 psia)
TABLE 14.1-7 Loss of Normal Feedwater Time Sequence of Events Time of event, sec Main feedwater flow stops 20.0 Low-low steam generator water level reactor 64.0 trip setpoint reached Rods begin to drop 66.0 Automatic auxiliary feedwater from one motor 124.0 driven auxiliary feedwater pump initiated Operator action to establish auxiliary 666.0 feedwater flow to remaining steam generators Peak water level in the pressurizer occurs 925.0 Chapter 14, Page 47 of 218 Revision 20, 2006 OAG10000215_1402
IP2 FSAR UPDATE TABLE 14.1-8 Feedwater Malfunction Event Time Sequence of Events Time of event, sec With Automatic Manual Rod Control Rod Control Feedwater flow to one SG increases 0.0 0.0 to 130% of nominal Peak pressurizer pressure occurs 99.5 100.0 Peak nuclear power occurs 98.0 98.0 Minimum DNBR occurs 97.5 98.0 TABLE 14.1-9 DELETED TABLE 14.1-10 Loss of All AC Power to the Station Auxiliaries Time Sequence of Events Time of event, sec Main feedwater flow stops 20.0 Low-low steam generator water level reactor 64.0 trip setpoint reached Rods begin to drop 66.0 Reactor coolant pumps begin to coast down 68.1 Automatic auxiliary feedwater from one motor 124.0 driven auxiliary feedwater pump initiated Operator action to establish auxiliary 666.0 feedwater flow to remaining steam generators Peak water level in the pressurizer occurs 720.0 TABLE 14.1-11 DELETED Chapter 14, Page 48 of 218 Revision 20, 2006 OAG10000215_1403
IP2 FSAR UPDATE TABLE 14.1-12 DELETED TABLE 14.1-13 DELETED TABLE 14.1-14 DELETED TABLE 14.1-15 DELETED TABLE 14.1-16 DELETED TABLE 14.1-17 DELETED TABLE 14.1-18 DELETED TABLE 14.1-19 DELETED TABLE 14.1-20 DELETED TABLE 14.1-21 DELETED 14.1 FIGURES Figure No. Title Figure 14.1-1 Uncontrolled RCCA Withdrawal From A Subcritical Condition Nuclear Power vs. Time Figure 14.1-2 Uncontrolled RCCA Withdrawal From A Subcritical Condition Heat Flux vs. Time, Avg. Channel Figure 14.1-3 Uncontrolled RCCA Withdrawal From A Subcritical Condition Fuel Average Temperature vs. Time At Hot Spot Figure 14.1-4 Uncontrolled RCCA Withdrawal From a Subcritical Condition Clad Inner Temperature vs. Time At Hot Spot Figure 14.1-5 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (70 pcm/sec Withdrawal Rate)
Figure 14.1-6 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (70 pcm/sec Withdrawal Rate)
Figure 14.1-7 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (70 pcm/sec Withdrawal Rate)
Chapter 14, Page 49 of 218 Revision 20, 2006 OAG10000215_1404
IP2 FSAR UPDATE Figure 14.1-8 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate)
Figure 14.1-9 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate)
Figure 14.1-10 Uncontrolled RCCA Bank Withdrawal From Full Power With Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate)
Figure 14.1-11 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal From 100 Percent Power Figure 14.1-12 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal From 60 Percent Power Figure 14.1-13 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal From 10 Percent Power Figure 14.1-14 Dropped Rod Incident Manual Rod Control Nuclear Power and Core Heat Flux at BOL (Small Negative MTC) for Dropped RCCA of Worth - 400 PCM Figure 14.1-15 Dropped Rod Incident Manual Rod Control Core Average and Vessel Inlet Temperature at BOL (Small Negative MTC) for Dropped RCCA of Worth - 400 PCM Figure 14.1-16 Dropped Rod Incident Manual Rod Control Pressurizer Pressure at BOL (Small Negative MTC) for Dropped RCCA Worth of 400 PCM Figure 14.1-16a Deleted Figure 14.1-17 Dropped Rod Incident Manual Rod Control Nuclear Power and Core Heat Flux at EOL (Large Negative MTC) for Dropped RCCA of Worth - 400 PCM Figure 14.1-18 Dropped Rod Incident Manual Rod Control Core Average and Vessel Inlet Temperature at EOL (Large Negative MTC) for Dropped RCCA of Worth - 400 PCM Figure 14.1-19 Dropped Rod Incident Manual Rod Control Pressurizer Pressure at EOL (Large Negative MTC)for Dropped RCCA Worth of 400 PCM Figure 14.1-20 Loss of One Pump Out of Four Nuclear Power and Core Heat Flux vs. Time Figure 14.1-21 Loss of One Pump Out of Four Total Core Flow and Faulted Loop Flow vs. Time Figure 14.1-22 Loss of One Pump Out of Four Pressurizer Pressure and DNBR vs. Time Figure 14.1-23 Four Pump Loss of Flow - Undervoltage Nuclear Power and Core Heat Flux vs. Time Figure 14.1-24 Four Pump Loss of Flow - Undervoltage Total Core Flow and RCS Loop Flow vs. Time Figure 14.1-25 Four Pump Loss of Flow - Undervoltage Pressurizer Pressure and DNBR vs. Time Figure 14.1-26 Four Pump Loss of Flow - Underfrequency Nuclear Power and Heat Flux vs. Time Figure 14.1-27 Four Pump Loss of Flow - Underfrequency Total Core Flow and RCS Loop Flow vs. Time Chapter 14, Page 50 of 218 Revision 20, 2006 OAG10000215_1405
IP2 FSAR UPDATE Figure 14.1-28 Four Pump Loss of Flow Underfrequency Pressurizer Pressure and DNBR vs. Time Figure 14.1-29 Locked Rotor Nuclear Power and RCS Pressure vs. Time Figure 14.1-30 Locked Rotor Total Core Flow and Faulted Loop Flow vs.
Time Figure 14.1-30a Locked Rotor Fuel Clad Inner Temperature vs. Time Figure 14.1-31 Loss of Load With Pressurizer Spray and PORV - Nuclear Power and Pressurizer Pressure vs. Time Figure 14.1-32 Loss of Load With Pressurizer Spray and PORV - Average Coolant Temperature and Pressurizer Water Volume vs.
Time Figure 14.1-33 Loss of Load With Pressurizer Spray and PORV - ON BR vs. Time Figure 14.1-34 Deleted Figure 14.1-35 Deleted Figure 14.1-36 Deleted Figure 14.1-37 Loss of Load Without Pressurizer Spray and Power Operated Relief Valves - Nuclear Power and Pressurizer Pressure vs. Time Figure 14.1-38 Loss of Load Without Pressurizer Spray and Power Operated Relief Valves - Average Coolant Temperature and Pressurizer Water Volume vs. Time Figure 14.1-39 Loss of Load Without Pressurizer Spray and Power Operated Relief Valves - Steam Pressure vs. Time Figure 14.1-40 Deleted Figure 14.1-41 Deleted Figure 14.1-42 Deleted Figure 14.1-43 Sh. 1 Loss of Normal Feedwater, Offsite Power Available, High T avg Program, Pressurizer Pressure and Pressurizer Water Volume vs. Time Figure 14.1-43 Sh. 2 Loss of Normal Feedwater, Offsite Power Available High T ava Program, Nuclear Power and Core Heat Flux vs. Time Figure 14.1-43 Sh. 3 Loss of Normal Feedwater, Offsite Power Available, High Tavg Program, Loop 21 Temperature and Loop 23 Temperature vs. Time Figure 14.1-43 Sh. 4 Loss of Normal Feedwater, Offsite Power Available, High T avg Program, Steam Generator 21 Pressure and Steam Generator 23 Pressure vs. Time Figure 14.1-43 Sh. 5 Loss of Normal Feedwater, Offsite Power Available, High Tavg Program, Total RCS Flow and Pressurizer Relief vs.
Time Figure 14.1-44 Sh. 1 Deleted Figure 14.1-44 Sh. 2 Deleted Figure 14.1-44 Sh. 3 Deleted Figure 14.1-44 Sh. 4 Deleted Figure 14.1-44 Sh. 5 Deleted Figure 14.1-45 Sh. 1 Feedwater System Malfunction Excessive Feedwater Flow
- HFP Conditions Manual Rod Control Nuclear Power, and Core Heat Flux vs. Time Chapter 14, Page 51 of 218 Revision 20, 2006 OAG10000215_1406
IP2 FSAR UPDATE Figure 14.1-45 Sh. 2 Feedwater System Malfunction Excessive Feedwater Flow
- HFP Conditions Manual Rod Control Pressurizer Pressure and DN8R vs. Time Figure 14.1-45 Sh. 3 Feedwater System Malfunction Excessive Feedwater Flow
- HFP Conditions Manual Rod Control, Loop Delta - T, and Core T ava vs. Time Figure 14.1-46 Sh. 1 Deleted Figure 14.1-46 Sh. 2 Deleted Figure 14.1-47 Sh. 1 Deleted Figure 14.1-47 Sh. 2 Deleted Figure 14.1-48 Sh. 1 Deleted Figure 14.1-48 Sh. 2 Deleted Figure 14.1-49 Sh. 1 Deleted Figure 14.1-49 Sh. 2 Deleted Figure 14.1-50 Sh. 1 Loss of all AC Power, High T avg Program, Pressurizer Pressure and Water Volume vs. Time Figure 14.1-50 Sh. 2 Loss of all AC Power, High T avg Program, Nuclear Power and Core Heat Flux vs. Time Figure 14.1-50 Sh. 3 Loss of all AC Power To The Station Auxiliaries, High T avg Program, Loop 21 Temperature and Loop 23 Temperature Figure 14.1-50 Sh. 4 Loss of all AC Power To The Station Auxiliaries, High T avg Program, Steam Generator 21 Pressure and Steam Generator 23 Pressure Figure 14.1-50 Sh. 5 Loss of all AC Power To The Station Auxiliaries, High T avg Program, Total RCS Flow and Pressurizer Relief vs. Time Figure 14.1-51 Sh. 1 Deleted Figure 14.1-51 Sh. 2 Deleted Figure 14.1-51 Sh. 3 Deleted Figure 14.1-51 Sh. 4 Deleted Figure 14.1-51 Sh. 5 Deleted Figure 14.1-52 Through Deleted 14.1-57 Figure 14.1-58 Deleted Figure 14.1-59 Sh. 1 Deleted Figure 14.1-59 Sh. 2 Deleted Figure 14.1-60 Deleted Figure 14.1-61 Deleted Figure 14.1-62 Tracking 88-95/96 Stop Valve (SV) Type 1 Failures Stop Valve Disc Fails Figure 14.1-63 Tracking 88-95/96 Stop Valve (SV) Type 2 Failures Stop Valve Spring Fails Figure 14.1-64 Tracking 88-95/96 Stop Valve (SV) Type 3 Failures Stop Valve Sticks Open Figure 14.1-65 Tracking 88-95/96 Control Valve (CV) Type 4 Failures CV Spring 80lt Fails Figure 14.1-66 Tracking 88-95/96 Control Valve (CV) Type 5 Failures Control Valve Sticks Open Figure 14.1-67 Annual Frequency of Destructive Overspeed for Various 88-95/96 Turbine Valve Test Interval Chapter 14, Page 52 of 218 Revision 20, 2006 OAG10000215_1407
IP2 FSAR UPDATE 14.2 STANDBY SAFETY FEATURES ANALYSIS Adequate provisions have been included in the design of the plant and its standby engineered safety features to limit potential exposure of the public to below the applicable limits for situations that could conceivably involve uncontrolled releases of radioactive materials to the environment. The following situations have been considered:
- 1. Fuel-handling accidents.
- 2. Accidental release of waste liquid.
- 3. Accidental release of waste gases.
- 4. Rupture of a steam-generator tube.
- 5. Rupture of a steam pipe.
- 6. Rupture of a control rod drive mechanism housing - rod cluster control assembly ejection.
14.2.1 Fuel-Handling Accidents The possibility of a fuel-handling incident is very remote because of the many administrative controls and physical limitations imposed on fuel-handling operations. All refueling operations are conducted in accordance with prescribed procedures under direct surveillance of a supervisor technically trained in nuclear safety. Before any refueling operations begin, a verification of complete rod cluster control assembly insertion is obtained by opening the reactor trip breakers and observing the rod position indicators. Boron concentration in the coolant is raised to the refueling concentration and verified by sampling.
After the vessel head is removed, the rod cluster control drive shafts are disconnected from their respective assemblies using the manipulator crane and the shaft unlatching tool. A spring scale is used to indicate that the drive shaft is free of the control cluster as the lifting force is applied.
The fuel-handling manipulators and hoists are designed so that fuel cannot be raised above a position that provides adequate shield water depth for the safety of operating personnel. This safety feature applies to handling facilities in both the containment and in the spent fuel pit area.
In the spent fuel pit, the design of storage racks and manipulation facilities is such that:
- 1. Fuel at rest is positioned by positive restraints in an eversafe, always subcritical, geometrical array. Even if an assembly is not placed in the correct region, sub-criticality is ensured because a minimum boron concentration of 2000 ppm is required at all times in the pool.
- 2. Fuel can be manipulated only one assembly at a time.
- 3. Violation of procedures by placing one fuel assembly in juxtaposition with any group of assemblies in racks will not result in criticality.
In addition, administrative controls do not permit the handling of heavy objects above the fuel racks under conditions specified in the Technical Requirements Manual.
Adequate cooling of fuel during underwater handling is provided by convective heat transfer to the surrounding water. The fuel assembly is immersed continuously while in the refueling cavity or spent fuel pit.
Chapter 14, Page 53 of 218 Revision 20, 2006 OAG1000021S_1408
IP2 FSAR UPDATE Even if a spent fuel assembly becomes stuck in the transfer tube, the fuel assembly is completely immersed and natural convection will maintain adequate cooling to remove the decay heat. The fuel-handling equipment is described in detail in Section 9.5.
Two nuclear instrumentation system source range channels are continuously in operation and provide warning of any approach to criticality during refueling operations. This instrumentation provides a continuous audible signal in the containment and will annunciate a local horn and a horn and light in the plant control room if the count rate increases above a preset low level.
Refueling boron concentration is sufficient to maintain the clean, cold, fully loaded core subcritical by at least 5-percent with all rod cluster control assemblies inserted. The refueling cavity is filled with water meeting the same boric acid specifications.
Special precautions are taken in all fuel-handling operations to minimize the possibility of damage to fuel assemblies during transport to and from the spent fuel pit and during installation in the reactor. All handling operations on irradiated fuel are conducted under water. The handling tools used in the fuel-handling operations are conservatively designed, and the associated devices are of a fail-safe design.
In the fuel storage area, the fuel assemblies are spaced in a pattern that prevents any possibility of a criticality accident. As required by 10 CFR 50.68, "Criticality Accident Requirements," if the spent fuel pit takes credit for soluble boron, then "the k-effective of the spent fuel storage racks loaded with fuel of the maximum fuel assembly reactivity must not exceed 0.95, at a 95 percent probability, 95 percent confidence level, if flooded with borated water, and the k-effective must remain below 1.0 (subcritical), at a 95 per cent probability, 95 percent confidence level, if flooded with unborated water." NET -173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in the Con Edison Indian Point Unit 2 Spent Fuel Storage Racks" and NET-173-02, "Indian Point Unit 2 Spent Fuel Pool (SFP) Boron Dilution Analysis," determined that 10 CFR 50.68(b)(4) will be met during normal SFP operation and all credible accident scenarios (including affects of boraflex degradation) if: a) spent fuel pit boron concentration is maintained within the Technical Specification limits and, b) fuel assembly storage location within the spent fuel pit is restricted based on the fuel assembly's initial enrichment, burnup, decay of PU 241 (i.e.,
cooling time) and number of Integral Fuel Burnable Absorbers (lFBA) rods.
Northeast Technology Corporation report NET-173-01 evaluated non-accident conditions in the SFP including the affects of the projected boraflex degradation through the year 2006. This report determined that if storage location requirements in the Technical Specifications are met then the SFP will have a keff of :'S:0.95 if filled with a soluble boron concentration of ~786 ppm and will have a keff of <1.0 if filled with unborated water.
Northeast Technology Corporation report NET-173-01 also evaluated credible abnormal occurrences in accordance with ANSI/ANS-57.2-1983. This evaluation considered the effects of the following: a) a dropped fuel assembly or an assembly placed alongside a rack; b) a misloaded fuel assembly; and, c) abnormal heat loads. Northeast Technology Corporation report NET-173-01 determined that the SFP will maintain a keff of :'S:0.95 under the worst-case accident scenario if the SFP is filled with a soluble boron concentration of ~ 1495 ppm.
Therefore, Northeast Technology Corporation report NET-173-01 confirmed that the requirements in 10 CFR 50.68, "Criticality Accident Requirements," will be met for both normal SFP operation and credible abnormal occurrences if:
Chapter 14, Page 54 of 218 Revision 20, 2006 OAG10000215_1409
IP2 FSAR UPDATE a) Spent Fuel Pit boron concentration is maintained within the limits Technical Specifications, and; b) Fuel assembly storage location within the spent fuel pit is restricted in accordance with Technical Specifications based on the fuel assembly's initial enrichment, burnup, decay of Plutonium-241 (i.e. cooling time), and number of Integral Fuel Burnable Absorbers (lFBA) rods.
Northeast Technology Corporation report NET-173-02 evaluated postulated unplanned SFP boron dilution scenarios assuming an initial SFP boron concentration within the Technical Specification limit. The evaluation considered various scenarios by which the SFP boron concentration may be diluted and the time available before the minimum boron concentration necessary to ensure subcriticality for the non-accident condition (i.e. it is not assumed an assembly is misloaded concurrent with the spent fuel pit dilution event). Northeast Technology Corporation report NET-173-02 determined that an unplanned or inadvertent event that could dilute the SFP boron concentration from 2000 ppm to 786 ppm is not a credible event because of the low frequency of postulated initiating events and because the event would be readily detected and mitigated by plant personnel through alarms, flooding, and operator rounds through the SFP area.
Northeast Technology Corporation report NET-173-01 and NET-173-02 are based on conservative projections of amount of Boraflex absorber panel degradation assumed in each sub-region. These projections are valid through the end of the year 2006. These compensatory measures for boraflex degradation in the SFP were evaluated by the NRC in Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 227 to Facility Operating License No. DPR-26, May 29,2002. The design of the facility is such that it is not possible to carry heavy objects, such as a spent fuel transfer case, over the fuel assemblies in the storage racks. The design is such that only one fuel assembly can be handled at a given time.
The motions of the cranes that move the fuel assemblies are limited to a low maximum speed.
Caution is exercised during fuel handling to prevent a fuel assembly from striking another fuel assembly or structures in the containment or fuel storage building.
The fuel-handling equipment suspends the fuel assembly in the vertical position during fuel movements, except when the fuel is moved through the transport tube.
All these safety features and precautions make the probability of a fuel handling incident very low. Nevertheless, since it is possible that a fuel assembly could be dropped during the handling operations, the radiological consequences of such an incident were evaluated.
Sections 14.2.1.1 through 14.2.1.3 specifically address evaluations performed for the following accidents:
- 1. Fuel-handling accident in the fuel-handling building.
- 2. Refueling accident inside containment.
- 3. Fuel-handling cask drop accident.
14.2.1.1 Fuel-Handling Accident in Fuel-Handling Building As a design basis for equipment in the fuel-handling area, consideration has been given to the perforation of all rods in one assembly resulting from a dropped fuel assembly during refueling.
Chapter 14, Page 55 of 218 Revision 20, 2006 OAG10000215_1410
IP2 FSAR UPDATE Provisions have been included in the fuel-handling building to give further assurance that the consequences of this fuel-handling accident involving a spent fuel assembly will be acceptable.
To show that the radiological consequences of the postulated accident in which all rods in an assembly are breached are acceptable, an investigation was made to determine what the expected situation would be in terms of iodine available for release to the spent fuel pool water, the retention of iodine in the pool water, and the resulting doses at the site boundary. These analyses do not take credit for either building holdup of the iodines or removal by charcoal filters. The activity released from the damaged assembly is assumed to be released to the environment over a two hour period.
The consequences of an accident in which all rods in an assembly are breached under water have been analyzed. This is a conservative design-basis case, in which factors are introduced to allow for uncertainties.
In the analysis, conservative assumptions regarding fission product inventories and species distribution were made as summarized in Table 14.2-2. The maximum offsite doses are 4.2 rem total effective dose equivalent (TEDE) at the site boundary and 2.0 rem TEDE at the low population zone. Thus the consequences of the postulated fuel-handling accident are well within (i.e., less than 25-percent of) the limits of 10 CFR 50.67 which is the dose acceptance limit identified in Regulatory Guide 1.183 (Reference 20). All reasonable measures are employed in the handling of irradiated fuel to ensure against the occurrence of fuel damage and the associated radiological hazard.
The accumulated dose of the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite dose, using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51. The calculated control room dose is presented in Table 14.3-52 and is less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
14.2.1.1.1 Basis for Assumptions The fuel handling accident considers the release of all fuel-to-clad gap activity from one fuel assembly. The radial peaking factor (Fi1H) applied to this assembly is 1.7.
A value of 285 for the pool elemental iodine decontamination factor was conservatively assumed. A decontamination factor of 1.0 is modeled for organic iodine and noble gases. The iodine released from the assembly gap is assumed to be 99.85% elemental and 0.15% organic.
The overall pool decontamination factor for iodine is 200.
No credit is taken for removal of iodine by filters nor is credit taken for isolation of the release path. The Fuel Storage Building Ventilation System will remain in operation and discharge through the plant stack as approved by Technical Specification Amendment 211. Although the containment purge will be automatically isolated on a purge line high radiation alarm, isolation is not modeled in the analysis. The analysis assumes that the equipment hatch and airlock doors will be open (no credit is given for the requirement to maintain outage management administrative controls in place for re-establishing containment closure consistent with plant conditions). The activity released from the damaged assembly is assumed to be released to the environment over a two hour period. Since no filtration or containment isolation is modeled, this analysis supports refueling operations in either the containment or the fuel handling building.
Chapter 14, Page 56 of 218 Revision 20, 2006 OAG10000215_1411
IP2 FSAR UPDATE The decay time prior to fuel movement assumed in the fuel handling accident radiological consequences analysis is 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />.
14.2.1.1.2 Calculation of Offsite Exposure In calculating offsite exposure, it is assumed that the incident occurs in either the spent fuel pit or in the containment building and that the activity is discharged to the atmosphere at the ground level.
The dispersion of this activity is computed using the Gaussian plume dispersion formula and taking credit for building wake dilution as included in the 2 hr dispersion factor developed in Section 14.3.
The dose calculations were performed for a two hour release of the fuel assembly gap activity to the spent fuel pit water. The dispersion factors (XlQ) used in the calculations are for the site boundary, and the low population zone.
The Total Effective Dose Equivalent (TEDE) dose is the sum of Committed Effective Dose Equivalent (CEDE) dose and Effective Dose Equivalent (EDE) dose for the duration of the exposure to the cloud.
14.2.1.1.2.1 Iodine Committed Effective Dose Equivalent (CEDE) Dose A delay of at least 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> is required after shutdown before fuel movement. The iodine activity remaining in the fuel assembly gap at the end of this 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> is used as input to the calculation. The following equation is used to obtain the integrated CEDE dose at the site boundary or low population zone for each of the iodine isotopes.
where AI =activity of the Iodine isotope in fuel assembly gap after 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of decay (Ci)
OF =decontamination factor for iodine in water DCF I = CEDE dose conversion factor for the Iodine isotope from EPA-520/1-88-020 (Reference 21) (rem/Ci) [Note: See Table 14.2-2J XIQ =atmospheric dilution factor (sec/m 3 )
B = breathing rate (m 3 /sec) 14.2.1.1.2.2 Effective Dose Equivalent (EDE) Dose On an isotopic basis, the equations for the integrated doses at the site boundary or low population zone are given by:
Chapter 14, Page 57 of 218 Revision 20, 2006 OAG10000215_1412
IP2 FSAR UPDATE Dr = 0.25[ Ar x (~F ) x Er x ~]
Dr = [ Ar x DCFr x ~]
where AI =activity of the isotope in fuel assembly gap after 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> of decay (Ci)
OF = pool decontamination factor (200 for iodines and 1.0 for noble gases)
DCF I = EDE dose conversion factor for the nuclide from EPA 402-R-93-081 (Reference
- 22) (rem-m 3/Ci-sec) [Note - **See Table 14.2-2]
XIQ =atmospheric dilution factor (sec/m 3 )
14.2.1.2 Refueling Accident Inside Containment Since no filtration or isolation of the release path is modeled in the analysis for the accident occurring in the fuel handling building, the analysis presented above (Section 14.2.1.1) is applicable to the accident occurring in containment.
14.2.1.3 Fuel Cask Drop Accident Performing an evaluation using the analysis assumptions for the fuel-handling accident shows that even with damage to a full core of recently discharged fuel assemblies by a fuel cask dropped into the spent fuel pool, the calculated fuel-handling accident doses would not be exceeded if 90 days had elapsed after shutdown. As outlined below, the accident is extremely improbable. In addition, Technical Requirements Manual Section 3.9.C precludes movement of a spent fuel cask over any region of the spent fuel pit.
During normal operation, if a spent fuel cask were placed in or removed from its position in the spent fuel pit, mechanical stops incorporated on the bridge rails would make it impossible for the bridge of the crane to travel further north than a point directly over the spot reserved for the cask in the pit.
It is extremely improbable that the cask would be inadvertently or otherwise dropped during the process of transfer. This is due to the following provisions:
- 1. Conservative design margins used for the cask-related handling equipment (crane, rigging, hooks, etc.).
- 2. Periodic nondestructive equipment tests and inspection procedures.
- 3. Use of qualified crane operator and riggers.
- 4. Use of approved operating and administrative procedures.
These provisions will be rigorously met so that the inadvertent drop of the cask into the pool is highly improbable. However, should such a highly unlikely accident occur, the basic assumptions for analysis are as follows:
- 1. The drop would be from the highest position of the cask, which is 5-ft above the water surface and 43-ft above the bottom of the pool.
Chapter 14, Page 58 of 218 Revision 20, 2006 OAG10000215_1413
IP2 FSAR UPDATE
- 2. The cask is fully loaded and weighs 40 tons.
The results of the analysis indicate that the cask would hit the bottom of the pit with a velocity of approximately 40-ftlsec, assuming a conservative drag coefficient of 0.5. In comparison, the cask would have reached a velocity of 52-ftlsec if dropped through 43-ft in air.
Using the Ballistic Research Laboratories formula for the penetration of missiles in steel, the depth of penetration of the cask into the 1-in. wear plate covering the 1/4-in. pit liner plate would be 0.35-in., assuming the cask struck the wear plate while in a perfectly vertical position. In the event that the cask falls through the water at an angle, terminal velocity of the cask would be somewhat less because of the increased drag. However, the cask would strike the wear plate with an initial line contact and would penetrate the wear plate and the pit liner plate, causing some cracking of the concrete below. This reinforced concrete is a minimum of 3-ft thick and rests on solid rock.
Water would initially flow through the punctured liner plate and fill the cracks in the concrete.
Since the pit is founded on solid rock and since the bottom of the pit is approximately 24 feet below the surrounding grade, very little water can be lost from the pit. The capacity of the makeup demineralized water supply to the pit is 150 gpm. In addition, the spent fuel pit cooling system piping has a 4-in. blind flange connection for temporary cooling and/or makeup water.
Because the bottom of the spent fuel pit is 24-ft below grade and no equipment areas are in the vicinity, there can be no flooding of other areas with subsequent damage to equipment.
14.2.2 Accidental Release-Recycle Of Waste Liquid Accidents that would result in the release of radioactive liquids are those which may involve the rupture or leaking of system pipe lines or storage tanks. The largest vessels are the three liquid holdup tanks of the chemical and volume control system, each sized to hold two-thirds of the reactor coolant liquid volume. The tanks are used to process the normal recycle of waste fluids produced. The contents of one tank will be passed through the liquid processing train while another tank is being filled.
All liquid waste components of the waste disposal system except the reactor coolant drain tank and the waste holdup tank are located in the auxiliary building, and any leakage from the tank or piping will be collected in the building sump to be pumped back into the liquid waste system.
The waste holdup and the liquid holdup tanks are located in a thick concrete under-ground vault. The vault volume is sufficient to hold the full volume of any tank without overflowing to areas outside the vault. The reactor coolant drain tank is located in the containment building.
Holdup tanks are equipped with safety pressure relief and designed to accept the established seismic forces at the site. Liquids in the chemical and volume control system flowing into and out of these tanks are controlled by manual valve operation and governed by prescribed administrative procedures.
The volume control tank design philosophy is similar in many respects to that applied to the holdup tanks. Level alarms, pressure relief valves, and automatic tank isolation and valve control ensure that a safe condition is maintained during system operation. Excess letdown flow is directed to the holdup tanks via the reactor coolant drain tank.
Piping external to the containment running between the containment and the auxiliary building and between the auxiliary building and liquid holdup tank vault is run below grade in concrete Chapter 14, Page 59 of 218 Revision 20, 2006 OAG10000215_1414
IP2 FSAR UPDATE trenches. Any liquid spillage from pipe rupture or leaks in these trenches would drain to the sump and be pumped to the sump tank and to the waste holdup tank.
The incipient hazard from these process or waste liquid releases is derived only from the volatilized components. The releases are described and their effects summarized in Section 14.2.3.
A river diffusion analysis was performed to determine the concentrations that would result at the Chelsea reservoir if a release of waste liquid to the river was assumed. The results of the analysis show that even the instantaneous release of the entire primary coolant system maximum activity corresponding to operation with 1-percent defects would not result in peak concentrations at Chelsea in excess of 10 CFR 20 MPC limits. Drought conditions were assumed to exist at the time of and for a period following the spill limiting the total runoff flow to 4000 cfs. The mean longitudinal diffusion coefficient corresponding to this flow was 8.74 mi 2 per day. These data represent a drought similar to conditions existing in late summer of 1964, which can be verified by data in Section 2.5.
The unlikely event of a loss of water from a spent resin storage tank actuates a low-level alarm to warn the operator. Resin contained in the tank can then be cooled by periodically flushing water from the primary water storage tank through the resin. Two pathways are available for the water: (1) through the primary water storage injection pipeline used when resin is removed from the tank, or (2) through the primary water pipeline used when resin is sluiced from the demineralizers into the tank.
The following conservative assumptions are made to determine the frequency of flushing to cool the resin:
- 1. The tank contains resin from the letdown line mixed-bed demineralizers discharged to the spent resin storage tank following the operation of the plant for one cycle with 1-percent fuel defects. This assumption yields the maximum heat generation rate per unit volume of resin in the tank and the maximum level of radioactivity in the tank.
- 2. There are no heat losses through the tank walls.
- 3. Water is lost immediately following the discharge of a mixed-bed resin into the spent-resin storage tank. This yields a maximum heat generation rate due to fission product decay.
- 4. The heat generation rate and resin bed temperature equations are developed based on one cubic foot of resin.
- 5. The mean heat capacity of the resin is 0.31 Btu/lb-oF.
- 6. Resin specific gravity is 1.14 with a void fraction of 0.4 giving a resin density of 43lb/fe.
- 7. The amount of radioactivity in the resin is:
uCilcm 3 Br-84 6.4E-1 Chapter 14, Page 60 of 218 Revision 20, 2006 OAG10000215_1415
IP2 FSAR UPDATE 1-131 1.4E4 1-132 1.7E2 1-133 2.4E3 Rb-88 3.1E1 Cs-134 3.7E4 Cs-136 1.3E3 Ba-137m 2.6E4 Cs-138 1.3E1 Co-60 1.5E2 La-140 3.1E1 (There is assumed to be sufficient Cs-137 on the resin to maintain the inventory of Ba-137m at the above value.)
These assumptions result in the following relationships:
- 1. The heat generation rate, q (Btu/hr per cubic foot of resin), due to fission product decay is approximated closely as a function of time, t (hr), by q = 0.247e-0.05781 + 0.86ge-0.01441 + 4.65e-0.001441 + 41.95 where the first term is due to nuclides with half lives less than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, the second term is due to nuclides with half-lives between 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and 2 days, the third term is due to nuclides with half-lives between 2 and 20 days, and the last term is due to nuclides with half lives >20 days.
- 2. The resin bed temperature, T (F), as a function of time, t (hr), is T =0.32(1 - e-0.05781) + 4.52(1 - e-0.01441) + 242(1_e-0.001441) + 3.15t + To where To is the initial resin temperature.
If To is assumed to be 90°F, it will take 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> for the resin temperature to rise to 140°F, the normal resin operating limit. At or below a temperature of 140°F, the radioactivity will not be released from the resin. The actual time to heat to 140°F will be greater than 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> because of the conservative assumptions made in the calculation. With 100 cubic feet of resin in the tank, the heat accumulated in the resin through the initial 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> will be 66,650 Btu. The resin can be maintained at 140°F or less by back flushing the resin with primary water at appropriate intervals. Flush water will be collected by the floor drain system and be pumped to the waste holdup tank. If a 10°F rise is taken in the flush water, the total quantity of water required will be about 810 gal per backflush operation to remove the 66,650 Btu accumulated in the resin.
Hence, the loss of water from the spent resin storage tank presents no hazard offsite or onsite because means are available both to detect the situation occurring and to keep the resin temperature under control until the resin can be removed to burial facilities.
14.2.3 Accidental Release - Waste Gas The leakage of fission products through cladding defects can result in a buildup of radioactive gases in the reactor coolant. Based on experience with other operational, closed-cycle, Chapter 14, Page 61 of 218 Revision 20, 2006 OAG10000215_1416
IP2 FSAR UPDATE pressurized-water reactors, the number of defective fuel elements and the gaseous coolant activity is expected to be low. The shielding and sizing of components such as demineralizers and the waste handling system are based on activity corresponding to 1-percent defective fuel which is at least an order of magnitude greater than expected. Tanks accumulating significant quantities of radioactive gases during operation are the gas decay tanks, the volume control tank, and the liquid holdup tanks.
The volume control tank accumulates gases over a core cycle by stripping action of the entering spray. Gaseous activity for the tank based on operation with 1-percent defective fuel is given in Table 14.2-5. During a refueling shutdown, this activity is vented to the waste gas system and stored for decay. A rupture of this tank is assumed to release all of the contained noble gases plus a small fraction of the iodine in the tank (a partition factor of 0.01 is used). Also, the noble gas activity and a fraction of the iodine activity contained in the letdown flow would be released.
A maximum letdown flow of 120 gpm, plus ten percent for uncertainty, is assumed. The noble gas activity in the primary coolant is based on operation with one percent fuel defects (see Table 9.2-4) and the iodine concentration is assumed to be 60 I-lCilgm. The iodine concentration is assumed to be reduced by a factor of ten by the demineralizer in the letdown line and ten percent of the remaining iodine activity is assumed to be released to the atmosphere. The letdown line is assumed to be isolated after 30 minutes.
The liquid holdup tanks receive reactor coolant, after passing through demineralizers, during the process of coolant purification. The contents of one tank are passed through the liquid processing train while another tank is being filled. In analyzing the consequence of rupture of a holdup tank, it is assumed that a single tank is filled to 80% of capacity using the letdown flow of 120 gpm (maximum purification flow) and the primary coolant noble gas concentrations are those for operation with one-percent fuel defects. The iodine concentration in the flow to the holdup tank is assumed to be 0.1 I-lCilgm of dose-equivalent 1-133 (this is ten-percent of the primary coolant equilibrium activity limit and this reduction is due to the 90% removal assumed to take place in the letdown line mixed-bed demineralizer). A major tank failure would be required to cause a release of all the contained noble gas. Since the tanks operate at low pressure, approximately 2 psig, a gas phase leak would result in an expulsion of approximately 12-percent of the contained gases and then the pressure would be in equilibrium with atmosphere. It is conservatively assumed that all of the contained noble gas activity and one-percent of the iodine activity are released. The tank pits are vented to the ventilation system so that any gaseous leakage would be discharged to the atmosphere by this route. Any liquid leaks from the tanks or piping will be collected in the tank sump pit to be pumped back into the liquid waste system.
The waste gas decay tanks receive the radioactive gases from the radioactive liquids from the various laboratories and drains processed by the waste disposal system. The maximum storage of waste gases occurs after a refueling shutdown, at which time the gas decay tanks store the radioactive gases stripped from the reactor coolant. A radiation monitor counts activity in a gas decay tank sample to the gas analyzer and an alarm is actuated if the activity approaches an administrative limit of 6000 Ci of dose-equivalent Xe-133. There is also an operating limit of 29,761 Ci of dose-equivalent Xe-133 in any tank. As discussed in Section 11.1, six shut-down gas decay tanks are provided in addition to the four gas decay tanks used during power operation to reduce the gaseous activity release as a result of an assumed rupture of one of the tanks during the decay period following a refueling shutdown.
The Total Effective Dose Equivalent (TEDE) dose resulting from the failure of any of these tanks is calculated by combining the Effective Dose Equivalent (EDE) dose which is the acute dose Chapter 14, Page 62 of 218 Revision 20, 2006 OAG10000215_1417
IP2 FSAR UPDATE resulting from immersion in the cloud of activity and the Committed Effective Dose Equivalent (CEDE) dose which is the dose resulting from the inhalation and absorption of activity. The dose models for the calculation of these doses are described in detail in Section 14.2.1.1.
The doses from these postulated tank failures are dominated by the release of noble gases and the contributions to the doses from iodine releases are relatively small. For the gas decay tank failure there is no release of iodine assumed.
The offsite doses calculated for the tank failures are:
Low Population Site Boundary Dose Zone Dose (rem TEDE) (rem TEDE)
Volume Control Tank 0.39 0.18 Gas Decay Tank 0.14 0.07 Holdup Tank 0.4 0.19 These doses are all less than 0.5 rem.
The accumulated doses to the control room operators following the postulated accidents were calculated using the same release assumptions used in the offsite dose calculations and using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 & 51. The calculated control room doses are presented in Table 14.3-52 and are all less than the 5.0 rem TEDE dose limit from 10 CFR 50.67.
14.2.4 Steam-Generator Tube Rupture Accident Description The event examined is the complete severance of a single steam generator tube. The accident is assumed to take place during full power operation with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator power operated relief valves (and safety valves if their setpoint is reached).
The activity that is available for release from the secondary system is limited by:
- 1. Activities in the steam generator secondary that are a consequence of operational leakage prior to the complete tube rupture.
- 2. The activity concentration in the reactor coolant.
- 3. Operator actions to isolate the mixed primary and secondary leakage to atmosphere.
The steam generator tube material is highly ductile and it is considered that the assumption of a complete severance is conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continuous surveillance and an accumulation of minor leaks that cause the activity to exceed the limits in the Technical Specifications is not permitted during reactor operation.
Chapter 14, Page 63 of 218 Revision 20, 2006 OAG10000215_1418
IP2 FSAR UPDATE For small leaks which will not result in a safety injection signal or containment isolation signal, the air ejector radiation monitor will alarm in the presence of activity in the air ejector discharge line. The air ejector discharge is automatically diverted back to the containment. The steam-generator liquid monitor will then alarm after a delay of about 2 minutes and the steam-generator blowdown/sampling lines will be isolated automatically. The main steamline nitrogen-16 (N-16) monitors and other main steamline monitors will also detect the presence of activity in the secondary system. See Sections 11.2.3.2.4, 11.2.3.2.8, 11.2.3.2.13, 11.2.3.2.19 and 11.2.3.4.3 for further information on the secondary system monitors provided.
The operator is expected to determine that a steam generator tube rupture (SGTR) has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the ruptured steam generator. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale that ensures that break flow to the ruptured steam generator is terminated before the water level in the affected steam generator rises into the main steam line. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.
Assuming normal operation of the various plant systems, the following sequence of events is initiated by a tube rupture:
- 1. Pressurizer low pressure and low level alarms are actuated, and prior to reactor trip, charging pump flow is increased in an attempt to maintain pressurizer level.
On the secondary side there is a steam flow/feedwater flow mismatch before trip, and feedwater flow to the affected steam generator is reduced due to the additional break flow which is being supplied to that steam generator.
- 2. The main steamline N-16 monitor and air ejector radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system.
- 3. Decrease in reactor coolant system pressure due to a continued loss of reactor coolant inventory leads to a reactor trip signal on low pressurizer pressure or overtemperature L1T. Resultant plant cool-down following reactor trip leads to a rapid decrease in pressurizer level and a safety injection signal, initiated by low pressurizer pressure, follows soon after reactor trip. The safety injection signal automatically terminates normal feedwater and initiates auxiliary feedwater.
- 4. The unit trip will automatically shut off steam flow through the turbine and will open steam bypass valves and bypass steam to the condenser if offsite power is available. In the event of a coincident loss of offsite power the steam dump valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator power operated relief valves (and the steam generator safety valves if their setpoint is reached).
- 5. Following reactor trip and safety injection actuation, the continued action of auxiliary feedwater supply and borated water injection flow provide a heat sink.
Chapter 14, Page 64 of 218 Revision 20, 2006 OAG10000215_1419
IP2 FSAR UPDATE Thus, steam bypass to the condenser, or in the case of a loss of offsite power, steam relief to atmosphere, is attenuated during the time in which the recovery procedure leading to isolation is being carried out.
- 6. Safety injection flow results in stabilization of the reactor coolant system (RCS) pressure and pressurizer water level and, if not for the operator's recovery actions, the RCS pressure trends towards the equilibrium value where the safety injection flow rate equals the break flow rate.
Recovery In the event of an SGTR, the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR recovery are provided in the Emergency Operating Procedures (EOPs). The EOPs are based on guidance in the Westinghouse Owner's Group Emergency Response Guidelines which address the recovery from a SGTR with and without offsite power available. The major operator actions include: identification of the ruptured steam generator, isolation of the ruptured steam generator, cooldown of the reactor coolant system using the intact steam generators to ensure subcooling at the ruptured steam generator pressure, controlled depressurization of the reactor coolant system to the ruptured steam generator pressure, and subsequent termination of safety injection flow to stop primary to secondary leakage.
These operator actions are described below.
- 1. Identify the ruptured steam generator.
High secondary side activity, as indicated by the secondary side radiation monitors will typically provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator narrow range level or high activity in any steam generator sample. For an SGTR that results in a reactor trip at high power, the steam generator water level as indicated on the narrow range will decrease significantly for all of the steam generators. The auxiliary feedwater flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional inventory to the ruptured steam generator, the water level will increase more rapidly in that steam generator.
This response, as displayed by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.
- 2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.
Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of filling the ruptured steam generator by (1) minimizing the accumulation of feedwater flow and (2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.
Chapter 14, Page 65 of 218 Revision 20, 2006 OAG10000215_1420
IP2 FSAR UPDATE
- 3. Cooldown the Reactor Coolant System (RCS) using the intact steam generators.
After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump system to the condenser can be used to perform this cool down.
However, if offsite power is lost, the RCS is cooled using the power-operated atmospheric relief valves on the intact steam generators.
- 4. Depressurize the RCS to restore reactor coolant inventory.
When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped.
The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer power operated relief valve (PORV) or auxiliary spray.
- 5. Terminate SI to stop primary to secondary leakage.
The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that the SI flow is no longer needed. When these actions have been completed, the SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after the SI flow is stopped until the RCS and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent re-pressurization of the RCS and re-initiation of leakage into the ruptured steam generator.
Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated and all immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for cool down to cold shutdown conditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.
Results The analysis supports a Tavg window ranging from 549.0°F to 572.0°F. The analysis also supports a steam generator tube plug ranging from 0% to 10%. In estimating the mass transfer from the reactor coolant system through the broken tube, the following assumptions were made:
- a. Plant trip occurs automatically as a result of low pressurizer pressure.
- b. Following the safety injection signal, three high head safety injection pumps deliver flow for 30 minutes.
Chapter 14, Page 66 of 218 Revision 20, 2006 OAG10000215_1421
IP2 FSAR UPDATE
- c. The ruptured steam generator pressure is maintained at the lowest steam generator safety valve reseat pressure of 885.4 psia (including 18% blowdown, which covers the 3% setpoint tolerance).
- d. After reactor trip if the operators take no action to respond to the event the break flow will tend to equilibrate to the point where incoming safety injection flow is balanced by outgoing break flow as shown in Figure 14.2-0. In the accident analysis, this equilibrium break flow is assumed to persist from plant trip until 30 minutes after the accident initiation. The analysis does not require that the operators demonstrate the ability to terminate break flow within 30 minutes from the start of the event. It is recognized that the operators may not be able to terminate break flow within 30 minutes for all postulated SGTR events. The purpose of the calculation is to provide conservatively high mass-transfer rates for use in the radiological consequences analysis. This is achieved by assuming a constant break flow at the equilibrium flow rate for a relatively long time period. 30 minutes was selected for this purpose.
Sufficient indications and controls are provided at the control board to enable the operator to complete these functions satisfactorily within 60 minutes for the design-basis event even without offsite power. In order to demonstrate that releases calculated with the 30 minute equilibrium break flow assumption are indeed conservative, an evaluation was performed with a licensed thermal-hydraulic analysis code modeling the operator's response to the event. This evaluation modeled the operator's identification and isolation of the ruptured steam generator, cool down of the RCS by dumping steam from the intact steam generators, depressurization of the RCS using the pressurizer PORV and subsequent termination of SI. This evaluation demonstrated that although break flow was terminated at 60 minutes, the mass transfer data calculated with the assumption of a constant break flow at the equilibrium value for 30 minutes from reactor trip is limiting as input to the radiological consequences analysis.
In addition to the above assumptions, it is conservatively assumed that all stored energy and decay heat is removed by steaming until 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> from the start of the event at which point heat removal would be provided by the Residual Heat Removal System. These assumptions lead to the determination of the following:
Time of reactor trip 290 sec Steam releases prior to reactor trip 1075.61b/sec per SG Steam releases from ruptured SG after reactor trip (trip - 30 minutes) 77,3001b Steam releases from intact SGs after reactor trip Trip - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 542,0001b 2 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1,090,000 Ib 8 - 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> 1,760,000Ib Ruptured SG break flow 0- trip 29,0001b trip - 30 minutes 99,0001b Break flow flashing fraction 0- trip 0.21 trip - 30 minutes 0.13 Chapter 14, Page 67 of 218 Revision 20, 2006 OAG10000215_1422
IP2 FSAR UPDATE Radiological Consequences The radiological consequences analysis considers both a pre-accident iodine spike and an accident initiated iodine spike.
In the pre-accident iodine spike case it is assumed that a reactor transient has occurred prior to the SGTR and has raised the RCS iodine concentration to 60 IlCilgm of Dose Equivalent (DE) 1-131 (60 times the assumed maximum coolant equilibrium concentration limit of 1.0 IlCilgm of Dose Equivalent 1-131).
For the accident-initiated iodine spike case, the reactor trip associated with the SGTR creates an iodine spike in the RCS which increases the iodine release rate from the fuel to the RCS to a value 335 times greater than the release rate corresponding to the assumed maximum equilibrium RCS concentration of 1.0 IlCilgm of Dose Equivalent 1-131. The duration of the accident-initiated iodine spike is limited by the amount of activity available in the fuel-cladding gap. Based on having 8-percent of the iodine in the fuel-cladding gap, the gap inventory would be depleted within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and the analysis assumed that the spike is terminated at that time.
The noble gas activity concentration in the RCS at the time the accident occurs is based on a one percent fuel defect level (see Table 9.2-4). The iodine activity concentration of the secondary coolant at the time the SGTR occurs is assumed to be equivalent to the Technical Specification limit of 0.15 IlCilgm of Dose Equivalent 1-131.
The amount of primary to secondary steam generator tube leakage in the intact steam generators is assumed to be equal to 150 gpd per steam generator.
An iodine partition factor in the steam generators of 0.01 (curies iodine/gm steam) / (curies iodine/gm water) is used. Prior to reactor trip and concurrent loss of offsite power an iodine removal factor of 0.01 is taken for steam released to the condenser. All iodine contained in the fraction of the break flow that flashes to steam upon entering the secondary side of the steam generator is assumed to be immediately released to the outside atmosphere.
All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere.
At 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> after the accident, the Residual Heat Removal System is assumed to be capable of all decay heat removal and that there are thus no further steam releases to atmosphere from the secondary system.
The resultant site boundary doses are 3.3 rem TEDE for the pre-accident iodine spike and 1.2 rem TEDE for the accident-initiated iodine spike. The corresponding low population zone doses are 1.6 rem TEDE and 0.6 rem TEDE. These doses are calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1.
The offsite doses resulting from the accident with the assumed pre-accident iodine spike case are below than the limit values of 10 CFR 50.67 (25 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183. The offsite doses resulting from the accident with the assumed accident-initiated iodine spike are less than 10-percent of the limit values of 10 CFR Chapter 14, Page 68 of 218 Revision 20, 2006 OAG10000215_1423
IP2 FSAR UPDATE 50.67 (less than 2.5 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183 ..
The accumulated doses to control room operators following the postulated accident were calculated using the same release, removal and leakage assumptions as the offsite doses, using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51.
The calculated control room doses are presented in Table 14.3-52 and are less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
14.2.5 Rupture of a Steam Pipe 14.2.5.1 Description A rupture of a steam pipe is assumed to include any accident that results in an uncontrolled steam release from a steam generator. The release can occur as a result of a break in a pipe line or a valve malfunction. The steam release results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The removal of energy from the reactor coolant system causes a reduction of coolant temperature and pressure. With a negative moderator temperature coefficient, the cooldown results in a reduction of core shutdown margin. If the most reactive control rod is assumed to be stuck in its fully withdrawn position, there is a possibility that the core may become critical and return to power even with the remaining control rods inserted. A return to power following a steam pipe rupture is a potential problem only because of the high hot-channel factors that may exist when the most reactive rod is assumed stuck in its fully withdrawn position. Even if the most pessimistic combination of circumstances that could lead to power generation following a steam line break was assumed, the core is ultimately shut down by the boric acid in the safety injection system.
The analysis of a steam pipe rupture was made to show that assuming the most reactive RCCA stuck in its fully withdrawn position and assuming the worst single failure in the engineered safety features (ESFs), the core cooling capability is maintained and that offsite doses do not exceed applicable limits. In addition, the analysis considers conditions both with and without offsite power available.
Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis shows that DNB does not occur thus assuring clad integrity.
The following systems provide the necessary protection against a steam pipe rupture:
- 1. Safety injection system actuation from anyone of the following:
[Note - The details of the logic used to actuate safety injection are discussed in Section 7.2.]
- a. Two-out-of-three channels of low pressurizer pressure signals.
- b. Two-out-of-three high differential pressure signals between steam lines.
- c. High steam flow in two-out-of-four lines (one-out-of-two per line) in coincidence with either low reactor coolant system average temperature (two-out-of-four) or low steam line pressure (two-out-of-four).
Chapter 14, Page 69 of 218 Revision 20, 2006 OAG10000215_1424
IP2 FSAR UPDATE
- d. Two-out-of-three high containment pressure signals.
- e. Manual actuation
- 2. The overpower reactor trips (nuclear flux and L1T) and the reactor trip occurring upon actuation of the safety injection system.
- 3. Redundant isolation of the main feedwater lines. Sustained high feedwater flow would cause additional cooldown; however, in addition to the normal control action that will close the main feedwater valves, any safety injection signal will rapidly close all feedwater control valves and close the feedwater pump discharge valves, which in turn would trip the main feedwater pumps.
- 4. Closing of the fast-acting steam line stop valves (designed to close in less than 5 sec) on:
- a. High steam flow in any two steam lines (one-out-of-two per line) in coincidence with either low reactor coolant system average temperature (two-out-of-four) or low steam line pressure (two-out-of-four)
- b. Two sets of two-out-of-three high-high containment pressure signals.
Each main steam line has a fast-closing stop valve and a check valve. These eight valves prevent blowdown of more than one steam generator for any main steam line break location even if one valve fails to close. For example, for a main steam line break upstream of the stop valve in one line, a closure of either the check valve in that line or the stop valves in the other lines will prevent blowdown of the other steam generators.
Steam flow is measured by monitoring dynamic head in nozzles inside the steam pipes. The nozzles (16-in. 10 versus a pipe diameter of 28-in. 00) are located inside the containment near the steam generators and also serve to limit the maximum steam flow for any break further downstream. In particular, the nozzles limit the flow for all breaks outside the containment and those inside the containment which are downstream of the flow-measuring nozzles. A schematic showing the location of the stop valves, check valves, and nozzles is shown in Figure 14.2-1. In addition a flow limiting device (integral flow restrictor) consisting of seven (7) low pressure drop venturis is located in the steam outlet nozzle of each steam generator. This limits the flow of the postulated steam line break at the outlet nozzle to 1.4ft2 (flow restrictor area).
14.2.5.2 Method of Analysis The analysis of the steam pipe rupture has been performed to determine:
- 1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. These conditions were determined using the RETRAN code. 4
- 2. The thermal-hydraulic behavior of the core following a steam line break. A detailed thermal-hydraulic computer code, VI PRE 16 was used to determine if DNB occurs for the core conditions computed in the item 1 above.
The following conditions were assumed to exist at the time of a main steam line break accident:
Chapter 14, Page 70 of 218 Revision 20, 2006 OAG10000215_1425
IP2 FSAR UPDATE
- 1. The control rods give 1.3% shutdown reactivity margin at end-of-life (EOL), no-load conditions with equilibrium xenon. This is the EOL design value including design margins with the most reactive stuck rod in its fully withdrawn position.
The actual shutdown capability is expected to be significantly greater.
- 2. The moderator reactivity coefficient corresponding to the EOL rodded core with the most reactive rod in its fully withdrawn position. The variation of the coefficient with temperature and pressure is included.
- 3. Minimum capability of the safety injection system, corresponding to two-out-of-three safety injection pumps in operation and degraded system performance.
- 4. Power peaking factors corresponding to one stuck RCCA and non-uniform core inlet temperatures are determined at EOL. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck RCCA during the return to power phase following the steam line break.
- 5. The Moody curve for UD = 0 reported in Figure 3 of Reference 6 was used to calculate the steam flow through a steam line break.
- 6. The determination of the critical heat flux is based on local coolant conditions.
Two separate steam line rupture cases initiated from EOL, hot standby conditions were analyzed to determine the resulting core power and reactor coolant system transient conditions.
These cases are:
Case A - Steam pipe rupture of a 1.4ft2 break size (integral flow restrictor area) in faulted main steam line with offsite power available.
Case B - Steam pipe rupture 1.4ft2 break size (integral flow restrictor area) in faulted main steam line with a loss of offsite power.
For the case with offsite power, it is assumed that within 12 seconds following receipt of an safety injection signal (including appropriate delays for the instrumentation, logic, and signal transport), the appropriate realignment of valves and actuations have been completed and that the high head safety injection pump is at full speed.
In the case where offsite power is not available, an additional 7 seconds delay is assumed to start the diesels and to load the necessary SI equipment on line.
14.2.5.3 Results The results presented are a conservative indication of the events that would occur assuming a steam line rupture. The worst case assumes that the following occur simultaneously.
- 1. Minimum shutdown margin equal to 1.3% delta-K
- 2. The most negative moderator temperature coefficient for the rodded core at end of life.
- 3. The most reactive RCCA stuck in its fully withdrawn position.
- 4. One safety injection pump fails to function as designed.
Chapter 14, Page 71 of 218 Revision 20, 2006 OAG10000215_1426
IP2 FSAR UPDATE The Time Sequence of the Events for both cases analyzed is reported in Table 14.2-6 14.2.5.4 Core Power and Reactor Coolant System Transients Case A - Steam pipe rupture of a 1.4ff break size (integral flow restrictor area) in faulted main steam line with offsite power available.
Figure 14.2-2 shows the reactor coolant system transient and core heat flux following a steam pipe rupture (complete severance of a pipe) at the initial no-load conditions. Should the core be critical at near zero power when the rupture occurs, a reactor trip signal from the safety injection signal initiated on high differential pressure between steam lines or by high steam flow signals in coincidence with either low reactor coolant system temperature or low steam line pressure would trip the reactor.
The break assumed is the largest break that could occur, i.e., assuming a double-ended rupture of the steamline, limited to 1.4ff at the SG nozzle restrictor. Offsite power is assumed available such that full reactor coolant flow is maintained. Steam release out the break from the three intact steam generators would be prevented by the reverse flow check valve in the faulted loop or by the automatic closing of the fast-acting stop valves in the steam lines on a high steam flow signal in coincidence with low reactor coolant system temperature or low steam line pressure.
Even with the failure of one valve, release from the three intact steam generators while the fourth steam generator blows down would be limited to the time required to obtain an isolation signal and to actuate steam line isolation via the fast-acting stop valves. The steam line stop valves are designed to be fully closed in less than 5 seconds with no flow through them. With the high flow that exists during a steam line rupture, the valves would close considerably faster.
For this case, a high steam flow condition in all four loops occurs almost immediately. A low-low average loop temperature condition (i.e., less than 537 degree F) is reached in 2 of 4 loops at 12.9 seconds. Seven seconds later, at 19.99 seconds, signals to initiate SI, steam line isolation, and feedwater isolation are actuated. At 25.00 seconds, isolation of the 3 intact steam generators by closure of the main steam line isolation valves is completed. At 33.00 seconds, isolation of the main feedwater system is completed. The safety injection pumps which were started on the SI signal begin to deliver borated flow into the reactor core, after primary system pressure decreases below the SI pump head and the safety injection system lines are purged of unborated water.
As shown in Figure 14.2-2 the core becomes critical at 20.0 seconds. The peak core average heat flux of 15.5% of the nominal core power value (3216.0 MWt) is reached at 126.5 seconds.
Case B - Steam pipe rupture of a 1.4ff break size (integral flow restrictor area) in faulted main steam line with a loss of offsite power.
For the case assuming a break with a loss of offsite power at time zero which results in a subsequent reactor coolant system flow coastdown, a high steam flow condition in all four loops occurs almost immediately. A low-low average loop temperature condition (i.e., less than 537°F) is reached in 2 of 4 loops at 14.65 seconds. Seven seconds later, at 21.65 seconds, signals to initiate SI, steam line isolation, and feedwater isolation are actuated. At 26.67 seconds, isolation of 3 intact steam generators is completed. At 34.67 seconds, isolation of the main feedwater system is completed. Following the appropriate safety injection system delay time required to start the safety injection pumps on the diesels, the safety injection pumps begin to deliver borated flow into the reactor core.
Chapter 14, Page 72 of 218 Revision 20, 2006 OAG10000215_1427
IP2 FSAR UPDATE The peak core average heat flux of 9.20% of the nominal core power is reached at approximately 72 seconds.
14.2.5.5 Margin to Critical Heat Flux Using the transients of Cases A and B, DNB analyses were performed for each steam line break cases. It was found that both cases have a minimum DNBR greater than the applicable safety analysis limit value.
14.2.5.6 Containment Peak Pressure for a Postulated Steam Line Break The impact of steam line break mass and energy releases on containment pressure was addressed to assure the containment pressure remains below the design pressure of 47 psig.
The LOFTRAN computer code was used to generate the mass and energy release to the containment for a large double-ended rupture atth! discharge [l():z:zleof the Model 44F replacement steam generator. A single failure of §i~h~@ the main prpyp$:$$ feedwater control valve was assumed to occur concurrent with the break, which results in additional mass and energy release to containment from the feedwater system. The limiting case for the mass and energy releases is that which assumes offsite power is available at the hot full power conditions.
The feedwater addition assumes a 2 second electronic delay, and a 5 second delay on tripping the main boiler feedwater pumps. The pumps are then assumed to coastdown in 10 seconds and the main boiler feedwater pump discharge valves (BFD-2) are assumed to close in 60 seconds. For the failure of the main feedwater control valve analysis, credit was taken for the main feedwater valves BF with a closure time of 120 seconds.
An operator action to terminate auxiliary feed-water flow to the faulted steam generator was assumed at 15 minutes following receipt of the SI signal, which is more conservative than the 10 minute assumption previously used.
The COCO Code 17 was used to generate the containment response. The containment model was identical to that used for the Long Term LOCA Containment Integrity Analysis. The following assumptions were made:
-time dependent mass and energy release rates from LOFTRAN 5 ,
-an initial ambient pressure in the containment of 2 psig,
-an initial ambient temperature in the containment of 130°F,
-maximum safeguards of 5 fan coolers and two spray pumps.
-fan cooler initiation on SI signal with 60 second delay,
-containment spray initiation at 30 psig, with 60 second delay, and
-a containment spray temperature of 110°F.
The peak containment pressure was calculated to be @~.9 psig for failure of the main feedwater control valve, ?Q~@Z.4p§i9fqff§tilqf~gfth~~yp§t$§f~~9NV§tt~f9qI)Mqly§tIV~. The calculated pressure time history is shown in Figure 14.2-7.
Chapter 14, Page 73 of 218 Revision 20, 2006 OAG10000215_1428
IP2 FSAR UPDATE 14.2.5.7 Dose Considerations Assuming that a steam line break occurs when the steam generator is operating with a leak, the portion of reactor coolant activity discharged through the leak will be released to the steam generator. For the case in which the break is outside the containment and the leak occurs in the steam generator with the ruptured steam line, this activity is released to the atmosphere. In addition, the activity initially present in the steam generator will be released. Following the accident, the reactor coolant system would be cooled down and depressurized. The analysis assumes that the residual heat removal loop would be put into operation within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> after the accident, and that there are no further steam releases to the atmosphere from the intact steam generators. Activity releases due to leakage of primary coolant to the faulted steam generator are assumed to continue until the primary coolant temperature is reduced to less than 212°F at 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br />. At this point there would be no further release to the atmosphere. The radiological consequences analysis considers both a pre-accident iodine spike and an accident initiated iodine spike.
In the pre-accident iodine spike case it is assumed that a reactor transient has occurred prior to the event and has raised the RCS iodine concentration to 60 IlCilgm of Dose Equivalent (DE) 1-131 (60 times the assumed maximum coolant equilibrium concentration limit of 1.0 IlCilgm of Dose Equivalent 1-131).
For the accident-initiated iodine spike case, the depressurization and reactor trip associated with the event creates an iodine spike in the RCS which increases the iodine release rate from the fuel to the RCS to a value 500 times greater than the release rate corresponding to the assumed maximum equilibrium RCS concentration of 1.0 IlCilgm of Dose Equivalent 1-131. The duration of the accident-initiated iodine spike is limited by the amount of activity available in the fuel-cladding gap. Based on having 8-percent of the iodine in the fuel-cladding gap, the gap inventory would be depleted within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and the analysis assumed that the spike is terminated at that time.
The noble gas activity concentration in the RCS at the time the accident occurs is based on a one percent fuel defect level (see Table 9.2-4). The iodine activity concentration of the secondary coolant at the time the steam line break occurs is assumed to be equivalent to the Technical Specification limit of 0.15 IlCilgm of Dose Equivalent 1-131.
The amount of primary to secondary steam generator tube leakage in the steam generators is 150 gpd per steam generator.
The steam generator connected to the broken steam line is assumed to boil dry within the initial five minutes following the steamline break. The entire liquid inventory of this steam generator is assumed to be steamed off and all of the iodine initially in the steam generator is assumed to be released to the environment. Also, the iodine carried over to the faulted steam generator by tube leaks is assumed to be released directly to the environment with no credit taken for iodine retention in the steam generator.
For the intact steam generators an iodine partition factor in the steam generators of 0.01 (curies iodine/gm steam) / (curies iodine/gm water) is used. The concentration of iodine in the intact steam generators thus increases over the duration of the accident.
Chapter 14, Page 74 of 218 Revision 20, 2006 OAG10000215_1429
IP2 FSAR UPDATE Prior to reactor trip and concurrent loss of offsite power an iodine removal factor of 0.01 could be taken for steam released to the condenser, but conservatively, the pre-trip condenser iodine removal is ignored.
All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere.
The resultant site boundary dose is 0.12 rem TEDE for both the pre-accident iodine spike case and the accident-initiated iodine spike case. The corresponding low population zone doses are 0.13 rem TEDE for the pre-accident spike and 0.33 rem TEDE for the accident-initiated spike.
These doses are calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1.
The offsite doses resulting from the accident with the assumed pre-accident iodine spike case are below the limit values of 10 CFR 50.67 (25 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183. The offsite doses resulting from the accident with the assumed accident-initiated iodine spike are less than 10-percent of the limit values of 10 CFR 50.67 (less than 2.5 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183.
The accumulated doses to control room operators following the postulated accidents were calculated using the same release, removal and leakage assumptions as the offsite doses, using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51.
The calculated control room doses are presented in Table 14.3-52 and are less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
14.2.6 Rupture of A Control Rod Mechanism Housing - Rod Cluster Control Assembly Ejection 14.2.6.1 Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a rod cluster control assembly and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.
Certain features are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design that lessens the potential ejection worth of rod cluster control assemblies and minimizes the number of assemblies inserted at high power levels.
14.2.6.2 Mechanical Design Mechanical design and quality control procedures intended to preclude the possibility of a rod cluster control assembly drive mechanism housing failure are listed below:
- 1. Each control rod drive mechanism housing was completely assembled and shop tested at 4100 psi.
Chapter 14, Page 75 of 218 Revision 20, 2006 OAG10000215_1430
IP2 FSAR UPDATE
- 2. Each mechanism housing was individually hydro tested to 310S psig as it was installed on the reactor vessel head adapters and checked during the hydro test of the completed reactor coolant system.
- 3. Stress levels in the mechanism are not affected by system transients at power, or by thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME code,Section III, for Class A components.
- 4. The latch mechanism housing and rod travel housing are each a single length of forged type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures that will be encountered. The joint between latch mechanism and head adapter is a threaded joint, reinforced using a canopy-type seal weld.
The joint between the latch mechanism and rod travel housings is a Conoseal mechanical joint.
14.2.6.3 Nuclear Design Even if a rupture of a rod cluster control assembly (RCCA) drive mechanism housing is postulated, the operation of a plant using chemical shim is such that the severity of an ejected RCCA is inherently limited. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident.
Therefore, should a RCCA be ejected from its normal position during full-power operation, only a minor reactivity excursion, at worst, could be expected to occur.
However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCA's above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCA's is continuously indicated in the control room. Alarms will occur if a bank of RCCA's approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration when a valid "APPROACHING ROD INSERTION LIMIT" alarm is received and emergency boration when a valid "ROD INSERTION LIMIT" alarm is received.
14.2.6.4 Reactor Protection The protection for this accident is provided by high neutron flux trip (high and low setting).
14.2.6.S Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a rod cluster control assembly mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings.
However, even if damage is postulated, it would not be expected to lead to a more severe transient since rod cluster control assemblies are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that rod cluster control assembly not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.
Chapter 14, Page 76 of 218 Revision 20, 2006 OAG1000021S_1431
IP2 FSAR UPDATE 14.2.6.6 Limiting Criteria This event is classified as an ANS Condition IV incident. Due to the extremely low probability of a rod cluster control assembly ejection accident, some fuel damage could be considered an acceptable consequence.
Comprehensive studies of the threshold of fuel failure and of the threshold or significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project by the Idaho Nuclear Corporation. 7 Extensive tests of U02 zirconium clad fuel rods representative of those in pressurized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT results,8 which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10-percent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure (large fuel dispersal, large pressure rise) even for irradiated rods, did not occur below 300 cal/gm. In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are as follows:
- 1. Average fuel pellet enthalpy at the hot spot below 200 cal/gm.
- 2. Average clad temperature at the hot spot below 3000°F and a Zirconium water reaction at the hot spot below 16%23.
- 3. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
- 4. Fuel melting will be limited to less than 10-percent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion (1) above.
Criteria 2 is a Westinghouse internal criterion established to address clad melting and embrittlement. However Criterion 1 was identified (Reference 23) as the limit which ensures that core cool ability is maintained.
14.2.6.7 Method of Analysis The calculation of the rod cluster control assembly ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient.
A detailed discussion of the method of analysis can be found in Reference 9.
Chapter 14, Page 77 of 218 Revision 20, 2006 OAG10000215_1432
IP2 FSAR UPDATE 14.2.6.7.1 Average Core Analysis The spatial kinetics computer code, TWINKLE,10 is used for the average core transient analysis.
This code solves the 2 group neutron diffusion theory kinetic equation in 1, 2, or 3 spatial dimensions (rectangular coordinates) for 6 delayed neutron groups and up to 8000 spatial points. The computer code includes a detailed multi-region, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feed-back effects. In this analysis, the code is used as one-dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and rod cluster control assembly movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described in the following) for calculating the ejected rod worth and hot-channel factor.
14.2.6.7.2 Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot-channel factor. During the transient, the heat flux hot-channel factor is linearly increased to the transient value in 0.1 sec, the time for full ejection of the rod. Therefore, the assumption is made that the hot spots before and after ejection are coincident. This is very conservative since the peak hot spot after ejection will occur in or adjacent to the assembly with the ejected rod, and before ejection the power in this region will necessarily be depressed.
The hot spot analysis is performed using the detailed fuel and cladding transient heat transfer computer code FACTRAN.11 This computer code calculates the transient temperature distribution in a cross section of a metal clad U0 2 fuel rod and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative pellet radial power distribution is used within the fuel rod.
FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before ON B, and the Bishop-Sandberg-Tong correlation 12 to determine the film boiling coefficient after DNB. The Bishop-Sandberg-Tong correlation is conservatively used assuming zero bulk fluid quality. The DNB ratio is not calculated; instead, the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full-power steady-state temperature distribution to agree with the fuel heat transfer design codes.
Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 14.2-7 presents the parameters used in this analysis.
14.2.6.7.3 Ejected Rod Worths and Hot-Channel Factors The values for ejected rod worths and hot-channel factors are calculated using either three-dimensional static methods or by a synthesis method employing one-dimensional and two-dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation.
Chapter 14, Page 78 of 218 Revision 20, 2006 OAG10000215_1433
IP2 FSAR UPDATE Power distribution before and after ejection for a "worst case" can be found in Reference 9.
During plant startup physics testing, rod worths and power distributions are measured in the zero- and full-power rodded configurations and compared to values used in the analysis. It has been found that the worth and power peaking factors are consistently over-predicted in the analysis.
14.2.6.7.4 Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks, occur in the channel where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which when applied to single-channel feedbacks correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one-dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension.
14.2.6.7.5 Moderator and Doppler Coefficient The critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the nuclear code in order to obtain moderator density coefficient curves, which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.
The Doppler reactivity defect is determined as a function of power level using a one-dimensional steady-state computer code with a Doppler weighting factor of 1.0. The Doppler weighting factor will increase under accident conditions, as discussed above.
14.2.6.7.6 Delayed Neutron Fraction, p Calculation of the effective delayed neutron fraction (Peff) yielded values no less than 0.500-percent at beginning-of-life, 0.400-percent at end-of-life hot full power and 0.420-percent at end-of-life hot zero power.
14.2.6.7.7 Trip Reactivity Insertion The trip reactivity insertion assumed includes the effect of one stuck rod cluster control assembly. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 sec after the high neutron flux trip point was reached. This delay is assumed to consist of 0.2 sec for the instrument channel to produce a signal, 0.15 sec for the trip breaker to open, and 0.15 sec for the coil to release the rods. A curve of trip rod insertion versus time was used, which assumed that insertion to the dashpot does not occur until 2.4 sec after the start of fall.
The minimum design shutdown available for this plant at hot zero power may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, Chapter 14, Page 79 of 218 Revision 20, 2006 OAG10000215_1434
IP2 FSAR UPDATE adverse xenon distribution for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck rod cluster control assemblies (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1-percent L1K. Therefore, following a reactor trip resulting from a rod cluster control assembly ejection accident, the reactor will be subcritical when the core returns to hot zero power.
Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75-in. diameter) located in the reactor pressure vessel head.
The results show a rapid pressure drop and a decrease in system water mass due to the break.
The safety injection system is actuated by the low pressurizer pressure trip within 1 min after the break. The reactor coolant pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about 2 to 3 min. Because of the large thermal inertia of the primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2-percent L1k due to the pressure coefficient.
The cool down transient could not absorb the available shutdown margin until more than 10 min after the break. The addition of highly borated (2000-ppm) safety injection flow starting 1 min after the break is more than sufficient to ensure that the core remains subcritical during the cooldown.
As discussed previously, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting). These protection functions are part of the reactor trip system. No single failure of the reactor trip system will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.
14.2.6.8 Results Cases are presented at zero and full power for both beginning-of-life and end-of-life.
- 1. Beginning-of-Life, Full Power - Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot-channel factor were conservatively calculated to be 0.17-percent L1k and 6.80, respectively. The maximum hot-spot clad average temperature was 2196°F. The maximum hot-spot fuel center temperature was 4959°F.
- 2. Beginning-of-Life, Zero Power - For this condition, control bank D was assumed to be fully inserted, and banks Band C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.65-percent L1k and a hot-channel factor of 12.0. The maximum hot-spot clad average temperature reached 1881°F and the maximum fuel center temperature was 2812°F.
- 3. End-of-life, Full Power - Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot-channel factors were conservatively calculated to be 0.20-percent L1k and 7.10, respectively. This resulted in a maximum clad average temperature of 2130°F. The maximum hot-spot fuel center temperature reached 4862°F.
- 4. End-of-Life, Zero Power - The ejected rod worth and hot-channel factor for this case were obtained assuming control bank D to be fully inserted and banks C and B at their insertion limits. The results were 0.79-percent L1k and 20.00, Chapter 14, Page 80 of 218 Revision 20, 2006 OAG10000215_1435
IP2 FSAR UPDATE respectively. The maximum clad average and fuel center temperatures were 2899°F and 4018°F, respectively.
A summary of the results for the cases presented above is given in Table 14.2-8. The nuclear power, fuel center, fuel average and clad temperature transients for all the cases are presented in Figures 14.2-11 through 14.2-18.
The calculated sequence of events for the rod ejection accident cases, are presented in Table 14.2-9. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated. As discussed previously, the reactor will remain subcritical following a reactor trip.
The ejection of a rod cluster control assembly constitutes a break in the reactor coolant system boundary located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents are discussed in Section 14.3. Following the rod cluster control assembly ejection, the operator would follow the same emergency instructions as for any other loss-of-coolant accident to recover from the event.
14.2.6.9 Fission Product Release As a result of the accident, fuel clad damage and a small amount of fuel melt are assumed to occur. Due to the pressure differential between the primary and secondary systems, radioactive reactor coolant is discharged from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Iodine and alkali metals group activity is contained in the secondary coolant prior to the accident, and some of this activity is also released to the atmosphere as a result of steaming the steam generators following the accident. Finally, radioactive reactor coolant is discharged to the containment via the spill from the opening in the reactor vessel head. A portion of this radioactivity is released through containment leakage to the environment.
As a result of the rod ejection accident, less than 10% of the fuel rods in the core undergo ON B.
In determining the offsite doses following the rod ejection accident, it is conservatively assumed that 10% of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Consistent with Regulatory Guide 1.183, a gap fraction of 10% is assumed for iodine and noble gas activity. Additionally, 12% of the alkali metal activity is assumed to be in the gap.
The core activity is provided in Table 14.3-43 and it is assumed that the damaged fuel rods have all been operating at the maximum radial peaking factor of 1.70.
A small fraction of the fuel in the failed fuel rods is assumed to melt as a result of the rod ejection accident. This amounts to 0.25% of the core and the melting takes place in the centerline of the affected rods. Consistent with Regulatory Guide 1.183, for the containment leakage release pathway 25% of the iodine activity and 100% of the noble gas activity are assumed to enter the containment but for the secondary system release pathway 50% of the iodine activity and 100% of the noble gas activity are assumed. Additionally, for both pathways it is assumed that 100% of the alkali metal activity from the melted fuel is available for release.
The primary coolant iodine concentration is assumed to be at the equilibrium operating limit of 1.0 IlCilgm of dose equivalent 1-131 prior to the rod ejection accident. The alkali metals and noble gas activity concentrations in the RCS at the time the accident occurs are based on operation with a fuel defect level of one percent. The iodine activity concentration of the Chapter 14, Page 81 of 218 Revision 20, 2006 OAG10000215_1436
IP2 FSAR UPDATE secondary coolant at the time the rod ejection accident occurs is assumed to be 0.15 IlCilgm of dose equivalent 1-131.
Regulatory Guide 1.183 specifies that the iodine released from the fuel is 95% particulate (cesium iodide), 4.85% elemental, and 0.15% organic. These fractions are used for the containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.
Conservatively, all the iodine, alkali metals group and noble gas activity (from prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.
The primary to secondary steam generator tube leak used in-the analysis is 150 gpd per steam generator (total of 600 gpd).
When determining the doses due to containment leakage, all of the iodine, alkali metal and noble gas activity is assumed to be in the containment. The design basis containment leak rate of 0.1 % per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter, the containment leak rate is assumed to be one-half the design value, or 0.05% per day. Releases are continued for 30 days from the start of the event.
No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite power. All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere. Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.
An iodine partition factor in the steam generators of 0.01 curies/gm steam per curies/gm water is used. A partition factor of 0.0025 is used for the alkali metal activity in the steam generators.
For the containment leakage pathway, no credit is taken for sedimentation removal of aerosols.
No credit is taken for elemental iodine deposition onto containment surfaces or for containment spray operation which would remove both airborne particulates and elemental iodine.
The resultant site boundary dose is 3.1 rem TEDE. The low population zone dose is 4.2 rem TEDE. These doses are calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1.
The offsite doses resulting from the accident are less than 25-percent of the limit values of 10 CFR 50.67 (less than 6.25 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183.
The accumulated dose to control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite doses, using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51.
The calculated control room dose is presented in Table 14.3-52 and is less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
Chapter 14, Page 82 of 218 Revision 20, 2006 OAG10000215_1437
IP2 FSAR UPDATE 14.2.6.10 Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits.9 Since the severity of the present analysis does not exceed the worst case analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the reactor coolant system.
14.2.6.11 Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod.
Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are undermoderated, and bowing will tend to increase the undermoderation at the hot spot. Since the 15 x 15 fuel design is also undermoderated, the same effect would be observed. In practice, no significant bowing is expected since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from the region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling sufficient to distort the lattice is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.
14.2.6.12 Conclusions Analyses indicate that the described fuel and cladding limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is not danger of further consequential damage to the reactor coolant system. The analyses have demonstrated that the fission product release, as a result of a number of fuel rods entering departure from nucleate boiling, is limited to less than 10-percent of the fuel rods in the core. The radiological consequences of this event are within applicable limits.
REFERENCES FOR SECTION 14.2
- 1. Deleted
- 2. Deleted
- 3. Deleted
- 4. D. S. Huegel, et. aI., "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," WCAP-14882-P-A (Proprietary), April 1999 and WCAP-15234-A (non-Proprietary), May 1999.
Chapter 14, Page 83 of 218 Revision 20, 2006 OAG10000215_1438
IP2 FSAR UPDATE
- 5. Burnett, T. W. T., et ai, "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), April 1984.
- 6. F. J. Moody, Transactions of the ASME, Journal of Heat Transfer, p. 134, February 1965.
- 7. T. G. Taxelius, (ed.), Annual Report - SPERT Project , October, 1968, September, 1969, IN-1370, Idaho Nuclear Corporation, June 1970.
- 8. R. C. Liimataninen, and F. J. Testa, Studies in TREAT of Zircaloy-2-Clad, U02-Core Simulated Fuel Elements ANL-7225, January-June 1966, p.177, November 1966.
- 9. D. H. Risher, Jr., An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods, WCAP-7588, Revision 1-A, Westinghouse Electric Corporation, January 1975.
- 10. D. H. Risher, Jr. and R. F. Barry, TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code, WCAP-7979-A (proprietary) and WCAP-8028-A (nonproprietary), Westinghouse Electric Corporation, January 1975.
- 11. H. G. Hargrove, FACTRAN - A Fortran-IV Code for Thermal Transients in UO£ Fuel Rods, WCAP-7908-A, December 1989.
- 12. A. A. Bishop, R. O. Sandberg, and L. S. Tong, "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965.
- 13. Deleted
- 14. Deleted
- 15. Letter from R. Pederson, NRC, to J. O'Toole, Con Edison,
Subject:
Amendment No. 86 to Facility Operating License No. DPR-26 Regarding Movement of Reactor Fuel, dated February 21,1984.
- 16. SUNG, Y. x., et aI., "Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-A (Proprietary) and WCAP-15306 (Non-Proprietary), October 1999.
- 17. Bordelon, F. M. and Murphy, E. T., "Containment Pressure Analysis Code (COCO), WCAP-8327, July 1974.
- 18. Hochreiter, L.E., Chelemer, H., Chu, P.T., "THINC IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores", WCAP-7956, June 1973.
- 19. Letter from D. Brinkman, NRC, to S. Bram, Con Edison,
Subject:
Issuance of Amendment (No. 148) (TAC No. 69542) dated March 7, 1990.
- 20. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
Chapter 14, Page 84 of 218 Revision 20, 2006 OAG10000215_1439
IP2 FSAR UPDATE
- 21. Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake And Air Concentration and Dose Conversion Factors For Inhalation, Submersion, And Ingestion," Environmental Protection Agency Report EPA-520/1-88-020, September 1988.
- 22. Federal Guidance Report No. 12, "External Exposures to Radionuclides in Air, Water, and Soil," Environmental Protection Agency Report EPA 402-R-93-081, September 1993.
- 23. W.J. Johnson, "Use of 27000F PCT Acceptance Limit in Non-LOCA Accidents,"
NS-NRC-89-3466, October 23, 1989.
TABLE 14.2-1 DELETED TABLE 14.2-2 (Sheet 1 of 2)
Fuel Handling Accident - Design Basis Case Fuel Parameters Reactor power (including 2% uncertainty), Mwt 3280.3 Number of assemblies 193 Fuel Rods per assembly 204 Normalized power, highest rated discharged assembly 1.70 Time from Reactor Shutdown to Accident, Hrs 84 Fission Product Release Fraction of Fuel Rod Activity in gap(1) 1-131 0.12 Kr-85 0.30 Other iodines and noble gases 0.10 Decontamination factor for retention by pool water lodines 200 Noble gases 1.00 Decontamination factor for Filters Not Credited Dispersion and Potential Exposure at Site Boundary Atmospheric dispersion factor (XIQ, sec/m 3 )
Site Boundary 7.5x10-4 Low Population Zone 3.5x10-4 Receptor breathing rate (m 3/sec) 3.5x10-4 Chapter 14, Page 85 of 218 Revision 20, 2006 OAG10000215_1440
IP2 FSAR UPDATE TABLE 14.2-2 (Sheet 2 of 2)
Fuel Handling Accident - Design Basis Case Shutdown Core CEDE Dose EDE Dose Inventory after Conversion Conversion Factor, 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />, Factor, rem/Ci rem-m 3 /Ci-sec Nuclide Curies (2) 1-130 3.44E+4 2.64E+3 3.848E-1 1-131 6.94E+7 3.29E+4 6.734E-2 1-132 6.39E+7 3.81 E+2 4.144E-1 1-133 1.17E+7 5.85E+3 1.088E-1 1-134 0 1.31 E+2 4.810E-1 1-135 2.62E+4 1.23E+3 2.953E-1 Kr-85M 0 - 2.768E-2 Kr-85 1.10E+6 - 4.403E-4 Kr-87 0 - 1.524E-1 Kr-88 0 - 3.774E-1 Xe-131 M 9.85E+5 - 1.439E-3 Xe-133M 2.91 E+6 - 5.069E-3 Xe-133 1.36E+8 - 5.772E-3 Xe-135M 4.20E+3 - 7.548E-2 Xe-135 7.83E+5 - 4.403E-2 Xe-138 0 - 2.135E-1 Notes:
- 1. The gap fractions are consistent with Regulatory Guide 1.25 except for 1-131 for which the gap fraction was increased above the Regulatory Guide 1.25 value of 0.10 following the recommendations of NUREG/CR-5009. These values were selected for the analysis in place of the lower gap fraction values provided in Regulatory Guide 1.183 due to the expectation that the fuel would not meet the criteria of a peak rod average power of ::56.3 kw/ft for some of the high burnup fuel rods.
- 2. Inventory of 0 means less than one Curie per fuel assembly.
TABLE 14.2-2A DELETED TABLE 14.2-3 DELETED TABLE 14.2-4 DELETED Chapter 14, Page 86 of 218 Revision 20, 2006 OAG10000215_1441
IP2 FSAR UPDATE TABLE 14.2-5 Volume Control Tank ActivitY1 Nuclide Volume Control Tank Inventory, Curies (1) 1-130 1.741 E-2 1-131 5.916E-1 1-132 9.220E-1 1-133 1.468E+0 1-134 2.143E-1 1-135 6.884E-1 Kr-85M 1.521E+2 Kr-85 2.357E+3 Kr-87 4.640E+1 Kr-88 2.254E+2 Xe-131M 3.766E+2 Xe-133M 4.104E+2 Xe-133 2.991E+4 Xe-135M 7.292E+1 Xe-135 9.081E+2 Xe-138 6.303E+0 Notes:
- 1. Inventory is based on operation with one percent fuel defects. The reported activity reflects the combined vapor space and liquid space inventories.
Chapter 14, Page 87 of 218 Revision 20, 2006 OAG10000215_1442
IP2 FSAR UPDATE TABLE 14.2-6 Time Sequence of Events for the Rupture of a Main Steamline Event Case with Offsite Case without Power Offsite Power Time (sec) Time (sec)
Double-Ended Steamline Rupture in Loop 1 (1.4ft2) 0.00 0.00 High Steamline Flow Setpoint Reached (2/4 loops) 0.29 0.27 Loss of Offsite Power (RCPs begin coasting down) -- 2.99 High Steamline Flow Signal Generated (2/4 loops) 9.29 9.27 Low-Low Tavq Setpoint Reached in Loop 1 9.92 10.66 Low-Low Tavq Setpoint Reached in Loop 2 12.99 14.65 Low-Low T ava Signal Generated in Loop 1 16.92 17.66 Low-Low T ava Signal Generated in Loop 2 19.98* 21.64*
Safety Injection SLI and FWI Actuation due to 19.99 21.66 Coincidence of Low-Low Tavg (2/4 loops) 1 High Steam Flow (2/4 loops) ESF MSIV Closure Initiated in Loops 1, 2, 3, and 4 24.89(1) 26.56(1)*
MSIV Closure Completed in Loops 1, 2, 3, and 4 25.00 26.67 MFIV Closure Initiated in Loops 1, 2, 3, and 4 32.89(1)' 34.56(1),
MFIV Closure Completed in Loops 1,2, 3, and 4 33.00 34.67 Maximum Heat Flux Reached 126.49 71.99 Note:
- additional modeling delay (round off) not included
- 1. An additional 0.1 second allowance for valve closure time.
TABLE 14.2-7 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident BOL-HFP BOL-HZP EOL-HFP EOL-HZP Power level, percent 102 0 102 0 Ejected rod worth, percent ~k 0.17 0.65 0.20 0.79 Delayed neutron fraction, percent 0.50 0.50 0.40 0.42 Feedback reactivity weighting 1.46 2.16 1.50 2.96 Trip reactivity, percent ~k 4.0 2.0 4.0 2.0 Fa after rod ejection 6.8 12.0 7.1 20.0 Number of operational pumps 4 2 4 2 Key: BOL Beginning of Life EOL End-of-Life HFP Hot full Power HZP Hot zero Power Chapter 14, Page 88 of 218 Revision 20, 2006 OAG10000215_1443
IP2 FSAR UPDATE TABLE 14.2-8 Results of the Analysis of the Rod Cluster Control Assembly Election Accident BOL-HFP BOL-HlP EOL-HFP EOL-HlP Maximum fuel pellet average temperature, ° 3973 2472 3861 3653 F
Maximum fuel center temperature, of 4959 2812 4862 4018 Maximum clad average temperature, of 2196 1881 2130 2899 Maximum fuel stored energy, Btuilb 311.2 178.0 300.8 281.6 Percent fuel melt 3.55 0 3.61 0 Key: BOL Beginning-of-Life EOL End-of-Life HFP Hot full Power HZP Hot zero Power TABLE 14.2-9 Time Sequence of Events for Rod Cluster Control Assembly Ejection RCCA Ejection Time of Event, sec Event BOL-HFP BOL-HlP EOL-HFP EOL-HlP Initiation of rod ejection 0.0 0.0 0.0 0.0 Power range neutron flux set point 0.06 0.34 0.04 0.18 reached (HFP, High i HlP, Low)
Peak nuclear power occurs 0.13 0.40 0.13 0.22 Rods begin to fall into core 0.56 0.84 0.54 0.68 Peak fuel average temperature occurs 2.17 2.45 2.24 1.85 Peak clad temperature occurs 2.29 2.36 2.35 1.65 Peak heat flux occurs 2.31 2.37 2.37 1.65 Chapter 14, Page 89 of 218 Revision 20, 2006 OAG10000215_1444
IP2 FSAR UPDATE 14.2 FIGURES Figure No. Title Figure 14.2-0 Steam Generator Tube Rupture, Break Flow and Safety Injection Flow vs. Reactor Coolant System Pressure Figure 14.2-1 Steam Line Valve Arrangement Schematic Figure 14.2-2 Sh. 1 Steam Line Rupture Offsite Power Available, EOL, Core Heat Flux and Core Reactivity vs. Time Figure 14.2-2 Sh. 2 Steam Line Rupture Offsite Power Available, EOL, Reactor Coolant Pressure and RV Inlet Temperature vs. Time Figure 14.2-2 Sh. 3 Steam Line Rupture Offsite Power Available, EOL, Steam Flow and Steam Generator Pressure vs. Time Figure 14.2-2 Sh. 4 Steam Line Rupture Offsite Power Available, EOL, Core Boron Concentration vs. Time Figure 14.2-3 Sh. 1 Deleted Figure 14.2-3 Sh. 2 Deleted Figure 14.2-3 Sh. 3 Deleted Figure 14.2-4 Sh. 1 Deleted Figure 14.2-4 Sh. 2 Deleted Figure 14.2-4 Sh. 3 Deleted Figure 14.2-5 Sh. 1 Deleted Figure 14.2-5 Sh. 2 Deleted Figure 14.2-5 Sh. 3 Deleted Figure 14.2-6 Sh. 1 Deleted Figure 14.2-6 Sh. 2 Deleted Figure 14.2-7 Containment Pressure Time History (Double - Ended Main Steam Line Break Main FCV Failure Maximum Containment Safeguards)
Figure 14.2-8 Through Deleted 14.2-10 Figure 14.2-11 Rod Ejection Accident, BOL-HFP, Nuclear Power vs. Time Figure 14.2-12 Rod Ejection Accident, BOL-HFP, Fuel Temperatures vs.
Time Figure 14.2-13 Rod Ejection Accident, BOL-HZP, Nuclear Power vs. Time Figure 14.2-14 Rod Ejection Accident, BOL-HZP, Fuel Temperatures vs.
Time Figure 14.2-15 Rod Ejection Accident, EOL-HZP, Nuclear Power vs. Time Figure 14.2-16 Rod Ejection Accident, EOL-HZP, Fuel Temperatures vs.
Time Figure 14.2-17 Rod Ejection Accident, EOL-HFP, Nuclear Power vs. Time Figure 14.2-18 Rod Ejection Accident, EOL-HFP, Fuel Temperatures vs.
Time Figure 14.2-19 Thru Deleted Figure 14.2-22 Chapter 14, Page 90 of 218 Revision 20, 2006 OAG10000215_1445
IP2 FSAR UPDATE 14.3 LOSS-OF-COOLANT ACCIDENTS 14.3.1 Identification of Causes And Frequency Classification A loss-of-coolant accident (LOCA) is the result of a pipe rupture of the reactor coolant system pressure boundary. A major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0-ft2. This event is considered a limiting fault, an ANS Condition IV event, in that it is not expected to occur during the lifetime of the plant, but is postulated as a conservative design basis.
A minor pipe break (small break) is defined as a rupture of the reactor coolant pressure boundary with a total cross-sectional area less than 1.0-ft2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered an ANS Condition III event in that it is an infrequent fault that may occur during the life of the plant.
The acceptance criteria for the loss-of-coolant accident are described in 10 CFR 50 Paragraph 46 (Reference 1), as follows:
- 1. The calculated maximum fuel element cladding temperature shall not exceed 2200°F.
- 2. The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.
- 3. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
- 4. Calculated changes in core geometry shall be such that the core remains amenable to cooling.
- 5. After any successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core.
These criteria were established to provide significant margin in emergency core cooling system performance following a LOCA. Reference 2 presents a study in regard to the probability of occurrence of RCS system pipe ruptures.
[Pglgtgdl 14.3.2 Sequence Of Events And Systems Operations Should a major break occur, the depressurization of the reactor coolant system results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low-pressure trip setpoint is reached. A safety injection actuation signal is Chapter 14, Page 91 of 218 Revision 20, 2006 OAG10000215_1446
IP2 FSAR UPDATE generated when the appropriate setpoint is reached. These countermeasures limit the consequences of the accident in the following two ways:
- 1. Reactor trip and borated water injection complement void formation in causing a rapid reduction of power to a residual level corresponding to fission product decay heat.
- 2. The injection of borated water provides for heat transfer from the core, prevents excessive clad temperatures, and maintains subcriticality.
14.3.2.1 Description of Large-Break LOCA Transient The RCS is assumed to be operating normally at full power [P§I§t§~]. A break is assumed to open nearly instantaneously in one of the main coolant pipes. Calculations where the location and size of the break have been varied indicate that a break in the cold leg between the reactor coolant pump and the reactor vessel leads to the most severe transient. For this break location, a rapid depressurization occurs, along with a core flow reversal as subcooled liquid flows out of the vessel into the broken cold leg. Boiling begins in the core, and the reactor core begins to shut down. With in approximately 2 seconds, the core is highly voided, and core fission is terminated. The cladding temperature rises rapidly as heat transfer to the fuel rods is reduced.
Within approximately q seconds, the pressure in the pressurizer has fallen to the point where the protection systems initiate safety injection. Along with the safety injection, containment isolation is also initiated.
In the first f~w seconds, the coolant in all regions of the vessels begins to flash. In addition, the break flow becomes saturated and is substantially reduced. This reduces the depressurization rate, and may also lead to a period of positive core flow as the RCS pumps in the intact loops continue to supply water to the vessel, and as flashing continues in the vessel lower plenum and downcomer. Cladding temperatures may be reduced, and some portions of the core may rewet during this period.
This positive core flow period ends as two-phase conditions occur in the pumps, reducing their effectiveness. Once again, the core flow reverses as most of the vessel mass flows out through the broken cold leg. Core cooling occurs as a result of the reverse flow.
At approximately 10 seconds after the break, the pressure falls to the point where the accumulators begin injecting cold water into the cold legs. Because the break flow is still high, much of the injected ECCS water, which flows from the cold legs into the downcomer of the vessel, is assumed to be carried out to the break.
Approximately 4& seconds after the break, most of the original RCS inventory has been ejected or boiled off. The system pressure and break flow are reduced and the ECCS water from the aCC;LlIII Lllator, which has been filling the downcomer, begins to fill the lower plenum of the vessel.
[Dgl~t~q]
During this time, core heat transfer is relatively poor and cladding temperatures increase.
flow into the core is oscillatory, as cold water rewets hot fuel cladding, generating steam.
steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam Chapter 14, Page 92 of 218 Revision 20, 2006 OAG10000215_1447
IP2 FSAR UPDATE generator, and the pump before it can be vented out the break. The resistance of this flow path to the steam flow is balanced by the driving force of water filling the downcomer. Shortly after reflood begins, the accumulators exhaust their inventory of water, and begin to inject the nitrogen gas, which was used to pressurize the accumulators. This results in a short period of improved heat transfer as the nitrogen forces water from the downcomer into the core. When the accumulators have exhausted their supply of nitrogen the reflood rate may be reduced and peak cladding temperatures may again rise. This heatup may continue until the core has reflooded to several feet. Approximately 3 minutes after the break, all locations in the core begin to cool. The core is completely quenched within 5 minutes, and long term cooling and decay heat removal begin. Long term cooling for the next several minutes is characterized by continued boiling in the vessel as decay power and heat stored in the reactor structures is removed.
Continued operation of the emergency core cooling system pumps supplies water during long-term cooling. Core temperatures would be reduced to long-term steady-state levels associated with the dissipation of residual heat generation. After the water level of the refueling water storage tank reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold-leg recirculation mode of operation in which spilled borated water is drawn from either the recirculation sump or containment sump by the recirculation or residual heat removal pumps and returned to the reactor coolant system cold legs. The containment spray pumps continue to operate drawing water from the refueling water storage tank for further reduction of containment pressure. Approximately 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after initiation of the LOCA, the emergency core cooling system is realigned to supply water to the reactor coolant system hot legs in order to control the boric acid concentration in the reactor vessel.
The sequence of events for the large break LOCA is summarized in Table 14.3-1.
14.3.2.2 Description of Small-Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA there are only three characteristic stages, i.e., a gradual blowdown in which the water level decreases, core recovery, and long-term recirculation.
For small break LOCAs, the most limiting single active failure is the one that results in the minimum ECCS flow delivered to the RCS. This has been determined to be the loss of an emergency power train, which results in the loss of one complete train of ECCS components.
This means that credit can be taken for two out of three high head safety injection pumps, and one RHR (low head) pump. During the small break transient, two high head pumps are assumed to start and deliver flow into all four loops. The flow to the broken loop was conservatively assumed to spill to RCS in accordance with Reference 93 for a four-loop plant.
For the limiting break location analyzed (cold leg), the depressurization of the RCS causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low-pressure trip setpoint is reached. Loss-Of-Offsite-Power (LOOP) is assumed to occur coincident with reactor trip. A safety injection signal is generated when the appropriate setpoint (pressurizer low pressure SI) is reached. After the safety injection signal is generated, an additional delay ensues. This delay accounts for the instrumentation delay, the diesel generator start time, plus the time necessary to align the appropriate valves and bring the pumps up to full speed. The safety features described will limit the consequences of the accident in two ways:
Chapter 14, Page 93 of 218 Revision 20, 2006 OAG10000215_1448
IP2 FSAR UPDATE
- 1) Reactor trip and borated water injection supplement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay. No credit is taken in the small break LOCA analysis for the boron content of the injection water. In addition, in the small break LOCA analysis, credit is taken for the insertion of Rod Cluster Control Assemblies (RCCAs) subsequent to the reactor trip signal, while assuming the RCCA at the most reactive location is stuck in the full out position, and
- 2) Injection of (borated) water ensures sufficient flooding of the core to prevent excessive clad temperatures.
Before the break occurs, the plant is assumed to be in normal plant operation at 102% of hot full power, i.e., the heat generated in the core is being removed via the secondary system. During the earlier phase of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as the pumps coast down following LOOP. Upward flow through the core is maintained. However, depending on the break size, the core flow is not sufficient to prevent a partial core uncovery.
Subsequently, the ECCS provides sufficient core flow to cover the core, adequately removing decay heat.
During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred to the RCS. The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In the case of heat transfer from the RCS to the secondary, heat addition to the secondary results in increased secondary system pressure which leads to steam relief via the safety valves. Makeup to the secondary is automatically provided by the auxiliary feedwater pumps. The safety injection signal isolates normal feedwater flow by closing the main feedwater control and bypass valves. Auxiliary feedwater flow is initiated by the reactor trip signal with coincident LOOP. In the Small Break LOCA analysis, flow from a single motor driven auxiliary feedwater pump is assumed to begin 60 seconds after the generation of a reactor trip signal coincident with LOOP. The secondary flow aids in the reduction of RCS pressure. Also, due to the loss of offsite power assumption, the reactor coolant pumps are assumed to be tripped at the time of reactor trip during the accident and the effects of pump coastdown are included in the blowdown analysis.
The cold leg accumulators will inject borated water into the reactor coolant loops if the RCS depressurizes to the nitrogen cover gas pressure.
14.3.3 Core And System Performance 14.3.3.1 Mathematical Model
.....................................
,-h~reqLlirelllents of an acceptable ECCS evaluation model are presented in10RIPR$O.'41$
(R~f~r~n¢~ * *1);
14.3.3.1.1 Large Break LOCA Evaluation Model The evaluation model used to comply with the requirements of 10 CFR50.46 (Reference 1),
Revisions to the Acceptance Criteria (Reference 3), and USNRC Regulatory Guide 1.157 (Reference 74), is described in this section. The analytical techniques used for the large break Chapter 14, Page 94 of 218 Revision 20, 2006 OAG10000215_1449
IP2 FSAR UPDATE LOCA analysis are in compiiancevvith19gFR 50.46 (Reference 1) as amended in Reference 3, and are described in References $9 al"ldJ'P.
In 1988, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, "ECCS Evaluation Models" to permit the use of a realistic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.
Under the amended rules, best estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best estimate codes is provided in Regulatory Guide 1.157 (Reference 74).
To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (Reference 77). This method outlined an approach for defining and qualifying a best estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.
LOCA evaluation methodology for three- and four-loop plants based on the revised 10 CFR 50.46 rules was develo of EPRI and Consolidated Edison. The methodology is documented in ,
"q()~E!Qualification Document (CQD) for Best-Estimate LOCA Analysis" (Reference 75).
[P~I§t¢@]
WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR.
The two-fluid formulation uses a separate set of conservation equations and constitutive relations for each phase. The effects of one phase on another are accounted for by interfacial friction and heat and mass transfer interaction terms in the equations. The conservation equations have the same form for each phase; only the constitutive relations and physical properties differ. Dividing the liquid phase into two fields is a convenient and physically accurate way of handling flows where the liquid can appear in both film and droplet form. The Chapter 14, Page 95 of 218 Revision 20, 2006 OAG10000215_1450
IP2 FSAR UPDATE droplet field permits more accurate modeling of thermal-hydraulic phenomena such as entrainment, de-entrainment, fallback, liquid pooling, and flooding.
WCOBRA/TRAC also features a two-phase, one-dimensional hydrodynamics formulation. In this model, the effect of phase slip is modeled indirectly via a constitutive relationship, which provides the phase relative velocity as a function of fluid conditions. Separate mass and energy conservation equations exist for the two-phase mixture and for the vapor.
The reactor vessel is modeled with the three-dimensional, three-field model, while the loop, major loop components, and safety injection points are modeled with the one-dimensional model.
All geometries modeled using the three-dimensional model are represented as a matrix of cells.
The number of mesh cells used depends on the degree of detail required to resolve the flow field, the phenomena being modeled, and practical restrictions such as computing costs and core storage limitations.
The basic building block for the mesh is the channel, a vertical stack of single mesh cells.
Several channels can be connected together by gaps to model a region of the reactor vessel.
Regions that occupy the same level form a section of the vessel. Vessel sections are connected axially to complete the vessel mesh by specifying channel connections between sections. Heat transfer surfaces and solid structures that interact significantly with the fluid can be modeled with rods and unheated conductors.
The noding diagram for Indian Point Unit 2 is shown in Figures 14.3-1 and 14.3-2. The vessel channel layout is shown in Figure 14.3-1. Figure 14.3-2 shows the one-dimensional component layout for the loops. Within the channels and components, additional subdivisions into cells are present, as described in Reference 75.
A typical calculation using WCOBRAITRAC begins with the establishment of a steady-state, initial condition with all loops intact. The input parameters and initial conditions for this steady-state calculation are discussed in the next section.
Following the establishment of an acceptable steady-state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown refill, and reflood follows continuously, using the same computer code.
Chapter 14, Page 96 of 218 Revision 20, 2006 OAG10000215_1451
IP2 FSAR UPDATE Plant Model Development In this step, a ~COBRAITRAC model of the plant is developed. A high level of noding detail is used to insure an accurate simulation of the transient. Specific guidelines are followed to assure that the model is consistent with models used in the code validation. This results in a h* h level of consisten ant Determination of Plant Operating Conditions In this ste analysis is The parameters considered are based on a "key LOCA parameters" list was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the "initial transient." Next, several confirmatory runs are made, which vary a subset of the LOCA arameters over their ected "n<:.r<>t, Chapter 14, Page 97 of 218 Revision 20, 2006 OAG10000215_1452
IP2 FSAR UPDATE 14.3.3.1.2 Small Break LOCA Evaluation Model For loss-of-coolant accidents due to small breaks less than 1 fe, the NOTRUMP (References 15, 16 and 93) computer code is used to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow through the break.
Clad thermal analyses are performed with the LOCTA-IV code (Reference 7), which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from NOTRUMP hydraulic calculations as input. The LOCTA-IV code version used for the clad thermal analysis of the small break LOCA includes the clad swelling and rupture model of NUREG-0630.
For these analyses, the safety injection delivery considers pumped injection flow, which is depicted in Figure 14.3-3 as a function of RCS pressure. This figure represents injection flow from the high head safety injection pumps based on performance curves degraded 7 percent from the design head. A 25 second delay was assumed from the time that the SI signal is generated to the time that the pumps are at full speed and capable of injecting water into the system. The effect of the low head safety injection pumps (Residual Heat Removal pump) flow is not considered since their shutoff head is lower than the Reactor Coolant System pressure during the time period of the transient. Also, minimum Emergency Core Cooling System capability has been assumed in these analyses. The small break LOCA analysis also assumes that the rod drop time is 2.7 seconds.
Figure 14.3-53 presents the hot rod power shape utilized as input to perform the small break analysis presented here. This power shape was chosen because it represents a distribution with power concentrated in the upper regions of the reactor core. Such a distribution is limiting for SBLOCA since it minimizes coolant swell while maximizing vapor superheating and fuel rod heat generation at the uncovered elevations.
The small break analysis was performed with the Westinghouse ECCS small break Evaluation Model using the NOTRUMP code, approved for this use by the Nuclear Regulatory Commission in May 1985 (Reference 16) and in August 1996 (Reference 93).
14.3.3.2 Input Parameters and Initial Conditions 14.3.3.2.1 Large-Break Input Parameters and Initial Conditions Table 14.3-3 and the following summarize key plant and model parameters whose range arlej uncertCiintY.CirE!.c;()nsidE!rE!ej .. in.thE!.largE! .. ~rE!Cik.LqG,A..arlCilysis .... l"he.assumed initial condition fqr tngiOiti~l~nqrgf~6~dq~q~$~Q~lqyl~tiQO$iDR~fgr~nQ~t~i$~1$Qgiv~O, 1.0 Plant Physical Description 1.0a Chapter 14, Page 98 of 218 Revision 20, 2006 OAG10000215_1453
IP2 FSAR UPDATE 1.0b 1.0c 1.0d 1.0e 1.0f 2.0 Plant Initial Operating Conditions 2.1 Reactor Power 2.1 a Initial Core Average Linear Heat Rate: Maximum power without measurement uncertainties is assumed. Uncertainties are accounted for as part of the uncertainty analysis.
2.1 b Hot Rod Peak Linear Heat Rate: The hot rod to be 2.1c 2.1 d Linear Heat Rate: The power generated
,,6",,6ii'i+ lower than that enerated in the hot 2.1 e Hot Assembly Peak Linear Heat Rate: Consistent with the average linear heat rates, the peaking factor used to calculate the k nuclear energy generated in the hot assem e rod is than the value assumed in the hot rod.
Chapter 14, Page 99 of 218 Revision 20, 2006 OAG10000215_1454
IP2 FSAR UPDATE 2.1 f ,l.\){iCilp()""er[)i~tribLJti()n:A~h(3pe""ithat()p~~~""ed power distribution (Bi9(.!r§ 14.@+4Q)Withir"lth§$xp$qt§~Hr~ng$i$~$$qm$q. V (3riations ... in ... (3){ial ... po",,~r (jistribution due to transient operation are accounted for ~$p~mpfth§qnq$rt~inty
~r"I~IY$i$.
2.1 gL()""p()",,~r Region (PLOW): A relative power of ~9p~r~Q09ft6~99r§§lV§[§l9§ i§~§§qm$q for the low power region. The limiting value over the expected operating range for this parameter is discussed in Section 4.3.3 of Reference 79.
2.1h 2.1 i priorQperating History: The reactor is assumed to have been operating at f@1 PQW$f. When a given axial power distribution is considered, it is assumed to have existed since this startup time. This means that the distribution of fission products coincides with the steady-state fission rate distribution. This assumption conservatively places both the initial fission rate and stored energy, and the subsequent decay heat production, at the same axial location.
2.1j 1VI()(jerCitor Temperature Coefficient: The value g@~~t§rtb~nQr§qq~ltQtHt~
m?Ximgm specified in Technical Specifications is assumed, to conservatively estimate core reactivity and fission power.
2.1 k Hot Full Power (HFP) Boron Concentration: A IPW value typical of those used in current cores at BOL conditions is assumed.
2.2 Fluid Conditions 2.2a Average Fluid Temperature (Tavg): Tavg is assumed at the maximum ex[)ectea value duri normal full on.
2.2b Pressurizer Pressure:
assumed.
2.2d Upper Head Temperature (TUH): The appropriate best estimate value of T UH is assumed. Since variation in this parameter is small, uncertainties are not included.
2.2e Pressurizer Level: The nominal value of pressurizer level is assumed. Because the pressurizer level is automatically controlled and the effect on PCT is small, uncertainties are not included.
2.2f Accumulator Water Temperature: A nominal value is assumed, with variations treated as part of the initial condition uncertainty.
Chapter 14, Page 100 of 218 Revision 20, 2006 OAG10000215_1455
IP2 FSAR UPDATE 2.2g 2.2h 2.2i 2.2j 3.0 Accident Boundary Conditions 3.0a 3.0b 3.0c 3.0d 3.0e 3.0f 3.0g 3.0h Chapter 14, Page 101 of 218 Revision 20, 2006 OAG10000215_1456
IP2 FSAR UPDATE 3.0i 3.0j Rod Drop Time: Consistent with the current design basis for this plant control rods are assumed not to insert during the LBLOCA.
4.0 Model parameters All model parameters are used at their best estimate or as coded values in the initial transient.
14.3.3.2.2 Small-Break Input Parameters and Initial Conditions Table 14.3-11 lists important input parameters and initial conditions used in the Indian Point Unit 2 small break LOCA analysis.
The small break LOCA analysis was performed with the upper head fluid temperature equal to the Reactor Coolant System hot leg fluid temperature. In addition, this analysis has included the effects of a 10% uniform steam generator tube plugging.
The bases used to select the numerical values that are input parameters to the analysis have been conservatively determined from extensive sensitivity studies (References 17-18). In addition, the requirements of 10 CFR 50 Appendix K regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time the LOCA occurs and include such items as the core peaking factors and the performance of the ECCS. Decay heat generated throughout the transient is also conservatively calculated.
14.3.3.3 Large Break Results 14.3.3.3.1 Large Break LOCA Reference Transient Description Chapter 14, Page 102 of 218 Revision 20, 2006 OAG10000215_1457
IP2 FSAR UPDATE Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be enhanced if the pumps are not degraded, and the break discharge rate is reduced because the fluid is saturated at the break. Figures 14.3-7 and 14.3-8 show the break flowrate for the vessel side and pump side, respectively, for the reference transient. This phase ends as lower plenum mass is depleted, the loops become two-phase, and the pump head degrades. If pumps are highly degraded or the break flow is large, the cooling effect due to upward flow may not be significant.
Figures 14.3-9 shows the void fraction for one intact loop pump and the broken loop pump. The intact loop pump remains in single-phase liquid flow for several seconds, while the broken loop pump is in two-phase and steam flow soon after the break.
The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pumps become two- . The break flow b *ns to dominate and lis flow down th h the core.
As the system pressure continues to fall, the break flow and consequently the core flow, are reduced. The core begins to heat up as the system reaches containment pressure and the vessel begins to fill with Emergency Core Cooling System (ECCS) water.
v.
Chapter 14, Page 103 of 218 Revision 20, 2006 OAG10000215_1458
IP2 FSAR UPDATE 14.3.3.3.2 1.
2.
3.
4.
14.3.3.3.3 Chapter 14, Page 104 of 218 Revision 20, 2006 OAG10000215_1459
IP2 FSAR UPDATE 14.3.3.3.4 14.3.3.3.5 Plant Operation Range The expected PCT and its uncertainty developed above is valid for a range of plant operation conditions. [Deleted] The range of variation of the operating parameters has been accounted for in the uncertainty evaluation. Table 14.3-5-A summarizes the operating ranges for Indian Point Unit 2. If operation is maintained within these ranges, the LOCA analyses developed in this section using WCOBRAITRAC are valid.
14.3.33.6 Chapter 14, Page 105 of 218 Revision 20, 2006 OAG10000215_1460
IP2 FSAR UPDATE 2.
3.
4.
5.
14.3.3.4 Small-Break Results This section presents the results of the small break LOCA analysis for a range of break sizes and fuel with ZIRLO' cladding. NUREG-0737 (Reference 80),Section II.K.3.31, requires a plant specific small break LOCA analysis using an Evaluation Model revised per Section II.K.3.30. In accordance with NRC Generic Letter 83-35 (Reference 81), generic analyses using NOTRUMP (References 15, 16, and 93) were performed and are presented in WCAP-11145 (Reference 59). Those results demonstrate that in a comparison of cold leg, hot leg and pump suction leg break locations, the cold leg break location is limiting. The limiting break for Indian Point Unit 2 was found to be a 3-inch cold leg break. Also, in compliance with 10 CFR50.46 Section (a)(1)(i), additional cases were analyzed to ensure that the 3-inch diameter break was limiting. Calculations were run assuming breaks of 2 inches and 4 inches for ZIRLO' clad fuel.
A list of input assumptions used in the small break analysis is provided in Table 14.3-11. The results of a spectrum analysis (three break sizes) performed for the upgraded ZI RLO ' clad fuel Chapter 14, Page 106 of 218 Revision 20, 2006 OAG10000215_1461
IP2 FSAR UPDATE are summarized in Table 14.3-13, while the key transient event times are listed in Table 14.3-12.
For the limiting 3-inch break transient, Figures 14.3-54 through 14.3-61 depict the following parameters:
- RCS Pressure
- Core mixture level
- Hot rod cladding temperature
- Core steam flow rate
- Hot assembly rod surface heat transfer coefficient
- Hot spot fluid temperature
- Cold leg break mass flow rate
- Safety injection mass flow rate In addition, the following transient parameters are presented for the non-limiting 2-inch and 4 inch breaks:
- RCS Pressure
- Core mixture level
- Hot rod cladding temperature Figures 14.3-62 through 14.3-64 are for the 2-inch break transient, while Figures 14.3-65 through 14.3-67 show the above parameters for the 4-inch break.
During the initial period of the small break transient, the effect of the break flow rate is not strong enough to overcome the flow rate maintained by the reactor coolant pumps as they coast down following Loss-Of-Offsite-Power (LOOP). At the low heat generation rates following reactor trip, the fuel rods continue to be well cooled as long as the core is covered by a two-phase mixture.
From the cladding temperature transients for the limiting break calculation shown in Figure 14.3-56, it can be seen that the peak cladding temperature occurs near the time of minimum core mixture level (1308 seconds) when the top of the core is steam cooled. This time is accompanied by the highest vapor superheating above the mixture level. The peak cladding temperature during the transient was 1028°F. At the time the transient was terminated, the safety injection flow rate that was delivered to the RCS exceeded the mass flow rate out the break. The decreasing RCS pressure results in greater safety injection flow as well as reduced break flow. As the RCS inventory continues to gradually increase, the reactor mixture level will continue to increase and the fuel cladding temperatures will continue to decline.
The maximum calculated peak cladding temperature for all small breaks analyzed is 1028°F, which is less than the 10 CFR 50.46 ECCS Acceptance Criteria limit of 2200°F. The maximum local metal water reaction is below the embrittlement limit of 17-percent as required by 10 CFR 50.46. The total metal-water reaction is less than 1 percent, as compared with the 1 percent, criterion of 10 CFR 50.46, and the cladding temperature transient is terminated at a time when the core geometry is still coolable. As a result, the core temperature will continue to drop and the ability to remove decay heat for an extended period of time will be provided. The PCT results provided in Table 14.3-13 relate to the small break LOCA Analysis of Record and do not reflect any individual PCT assessments made relative to the Analysis-of-Record and the accepted SBLOCA Evaluation Model which are reported separately, pursuant to 10CFR 50.46 and Reference 82.
An additional feature of the 15 X 15 upgraded fuel, the Integral Fuel Burnable Absorber (lFBA),
Chapter 14, Page 107 of 218 Revision 20, 2006 OAG10000215_1462
IP2 FSAR UPDATE has been generically evaluated for its impact on small break LOCA Analyses. This feature was previously discussed in the Reload Safety Evaluation for Cycle 11, (Reference 85) for 15 x 15 VANTAGE+ fuel. The evaluation has determined that the magnitude of SBLOCA PCT differences between IFBA and non IFBA Fuel is negligible and remains valid for 15 x 15 upgraded fuel. Therefore the small break LOCA transient was analyzed assuming upgraded fuel without IFBA.
14.3.3.4.1 Conclusions Analyses presented in this section show that the high head safety injection of the Emergency Core Cooling System (the low head safety injection pumps were not modeled in the Indian Point Unit 2 small break LOCA analysis), provides sufficient core flooding to keep the calculated peak cladding temperature below the required limit of 10 CFR 50.46.
The results of this analysis demonstrate that, for a small break LOCA, the Emergency Core Cooling System will meet the acceptance criteria as presented in 10 CFR 50.46 (Reference 1).
These criteria are as follows:
- 1) The calculated peak fuel element cladding temperature is below the requirement of 2200°F.
- 2) The amount of fuel element cladding that reacts chemically with water or steam does not exceed one percent by weight of the total amount of zircaloy in the reactor.
- 3) The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limits of 17-percent by weight are not exceeded during or after quenching.
- 4) The core remains amenable to cooling during and after the break.
- 5) The core temperature is reduced and decay heat is removed for an extended period of time as required by the long-lived radioactivity remaining in the core.
14.3.4 Core And Internals Integrity Analysis 14.3.4.1 Design Criteria The basic requirement of any LOCA (Loss-Of-Coolant-Accident), including the double- ended severance of a reactor coolant pipe, is that sufficient integrity be maintained to permit the safe and orderly shutdown of the reactor. This implies that the core must remain essentially intact and the deformations of the internals must be sufficiently small so that primary loop flow, and particularly, adequate safety injection flow, is not impeded. The ability to insert control rods, to the extent necessary, to provide shutdown following the accident must be maintained.
Maximum allowable deflection limitations are established for those regions of the internals that are critical for plant shutdown. The allowable and no loss of function deflection limits under dead weight loads plus the maximum potential earthquake and/or blowdown excitation loads are presented in Table 14.3-14.
With the acceptance of Leak-Before-Break by USNRC, Reference 20, (see Section 14.3.5.4.3.2) the dynamic effects of main coolant loop piping no longer have to be considered in Chapter 14, Page 108 of 218 Revision 20, 2006 OAG10000215_1463
IP2 FSAR UPDATE the design basis analysis. Only the dynamic effects of the next most limiting breaks of auxiliary lines need to be considered; and consequently the components will experience considerably less loads and deformations than those from the main loop line breaks.
14.3.4.2 Internals Evaluation The horizontal and vertical forces exerted on reactor internals and the core, following a LOCA are computed by employing MULTIFLEX (3.0), Reference 21, NRC accepted for similar applications, Reference 19, computer code developed for the space-time dependent analysis of nuclear power plants.
14.3.4.2.1 LOCA Forces Analysis MULTI FLEX (3.0), Reference 21, is a digital computer program for calculation of pressure, velocity, and force transients in reactor primary coolant systems during the subcooled, transition, and early saturation portion of blowdown caused by a LOCA. During this phase of the accident, large amplitude rarefaction waves are propagated through the system with the velocity of sound causing large differences in local pressures. As local pressures drop below saturation, causing formation of steam, the amplitudes and velocities of these waves drastically decrease.
Therefore, the largest forces across the reactor internals due to wave propagation occur during the subcooled portions of the blowdown transient. MULTIFLEX includes mechanical structure models and their interaction with the thermal-hydraulic system.
14.3.4.2.2 MULTIFLEX The thermal-hydraulic portion of MULTI FLEX (3.0), Reference 21, is based on the 1-dimensional homogeneous flow model which is expressed as a set of mass, momentum, and energy conservation equations. These equations are quasi-linear first order partial differential equations, which are solved by the method of characteristics. The numerical method employed is the explicit scheme, consequently time steps for stable numerical integration are restricted by sonic propagation.
In MULTIFLEX, the structural walls surrounding a hydraulic path may deviate from their neutral positions depending on the force differential on the wall. The wall displacements are represented by those of 1-dimensional mass points, which are described by the mechanical equations of vibration.
MULTI FLEX is a generalized program for analyzing and evaluating thermal-hydraulic-structure system dynamics. The thermal-hydraulic system is modeled with an equivalent pipe network consisting of 1-dimensional hydraulic legs, which define the actual system geometry. The actual system parameters of length, area, and volume are represented with the pipe network.
MULTI FLEX computes the pressure response of a system during a decompression transient.
The asymmetric pressure field in the downcomer annulus region of a PWR can be calculated.
This pressure field is integrated over the core support barrel area to obtain total dynamic load on the core support barrel. The pressure distributions computed by MULTIFLEX can also be used to evaluate the reactor core assembly and other primary coolant loop component support integrity.
MULTI FLEX evaluates the pressure and velocity transients for locations throughout the system.
The pressure and velocity transients are made available to the programs LATFORC and Chapter 14, Page 109 of 218 Revision 20, 2006 OAG10000215_1464
IP2 FSAR UPDATE FORCE-2 (described in Reference 24, Appendix A and B), which used detailed geometric descriptions to evaluate hydraulic loadings on reactor internals.
14.3.4.2.3 Horizontal/Lateral Forces - LA TFORC LATFORC, described in Reference 24 Appendix A, calculates the lateral hydraulic loads on the reactor vessel wall, core barrel, and thermal shield, resulting from a postulated loss-of-coolant accident in the primary reactor coolant system. A variation of the fluid pressure distribution in the downcomer annulus region during the blowdown transient produces significant asymmetrical loading on the reactor vessel internals. The LATFORC computer code is used in conjunction with MULTI FLEX, which provides the transient pressures, mass velocities, and other thermodynamic properties as a function of time.
14.3.4.2.4 Vertical Forces - FORCE2 FORCE-2, described in Reference 24 Appendix B, determines the vertical hydraulic loads on the reactor vessel internals. Each reactor component for which force calculations are required is designated as an element and assigned an element number. Forces acting upon each of the elements are calculated summing the effects of;
- 1. The pressure differential across the element.
- 2. Flow stagnation on, and unrecovered orifice losses across, the element.
- 3. Friction losses along the element.
Input to the code, in addition to the MULTI FLEX pressure and velocity transients, includes the effective area of each element on which acts the force due to the pressure differential across the element, a coefficient to account for flow stagnation and unrecovered orifice losses, and the total area of the element along which the shear forces act.
14.3.4.3 Structural Response of Reactor Vessel Internals During LOCA and Seismic Conditions 14.3.4.3.1 Structural Model and Method of Analysis The response of reactor vessel internals components due to an excitation produced by a complete severance of auxiliary loop piping is analyzed. With the acceptance of Leak-Before-Break by USNRC, Reference 20, the dynamic effects of main coolant loop piping no longer have to be considered in the design basis analysis. Only the dynamic effects of the next most limiting breaks of auxiliary lines need to be considered; and consequently the components will experience considerably less loads than those from the main loop line breaks.
The required break locations are defined in Reference 25. Aside from 8 locations on the primary coolant loop piping, the 3 largest auxiliary line breaks are also postulated. These are the accumulator line, the pressurizer surge line, and the RHR line. In accordance with Reference 25, the auxiliary line break is postulated to occur at the safe-end junction between the branch connection and the branch piping. In practice, this has been conservatively represented in these applicable MULTI FLEX analyses as a break location 1 foot from the main coolant loop piping, with a branch line nozzle flow area equivalent to the main coolant loop piping, although a longer branch line connection (nozzle) with a smaller flow area is justified by the approved methodology described in Reference 24 and 25. Branch line nozzles with thermal Chapter 14, Page 110 of 218 Revision 20, 2006 OAG10000215_1465
IP2 FSAR UPDATE shields are conservatively assumed to have no thermal shield, since the thermal shield could be postulated to be lost with the ruptured branch line piping.
Assuming that such a pipe break on the cold leg occurs in a very short period of time (1 ms), the rapid drop of pressure at the break produces a disturbance that propagates through the reactor vessel nozzle into the downcomer (vessel and barrel annulus) and excites the reactor vessel and the reactor internals. The characteristics of the hydraulic excitation combined with those of the structures affected present a unique dynamic problem. Because of the inherent gaps that exist at various interfaces of the reactor vessel/reactor internals/fuel, the problem becomes that of nonlinear dynamic analysis of the RPV system. Therefore, nonlinear dynamic analyses (LOCA and Seismic) of the RPV system includes the development of LOCA and seismic forcing functions which are also discussed here.
14.3.4.3.2 Structural Model Figure 14.3-101 is schematic representation of the reactor pressure vessel system. In this figure, the major components of the system are identified. The RPV system finite element model for the nonlinear time history dynamic analysis consists of three concentric structural sub-models connected by nonlinear impact elements and linear stiffness matrices. The first sub-model, shown in Figure 14.3-102 represents the reactor vessel shell and its associated components. The reactor vessel is restrained by four reactor vessel supports (situated beneath alternate nozzles) and by the attached primary coolant piping. Also shown in Figure 14.3-102 is a typical RPV support mechanism.
The second sub-model, shown in Figure 14.3-103a represents the reactor core barrel, thermal shield, lower support plate, tie plates, and the secondary support components. These sub-models are physically located inside the first, and are connected to them by stiffness matrices at the vessel/internals interfaces. Core barrel to reactor vessel shell impact is represented by nonlinear elements at the core barrel flange, upper support plate flange, core barrel outlet nozzles, and the lower radial restraints.
The third and innermost sub-model, shown in Figure 14.3.103b represents the upper support plate assembly consisting of guide tubes, upper support columns, upper and lower core plates, and the fuel. The fuel assembly simplified structural model incorporated in to the RPV system model preserves the dynamic characteristics of the entire core. For each type of fuel design the corresponding simplified fuel assembly model is incorporated in to the system model. The third sub-model is connected to the first and second by stiffness matrices and nonlinear elements.
Finally, Figure 14.3-104 shows the RPV system model representation.
14.3.4.3.3 Analysis Technique The WECAN Computer Code (Westinghouse Electric Computer Analysis), Reference 22, which is used to determine the response of the reactor vessel and its internals, is a general purpose finite element code. In the finite element approach, the structure is divided into a finite number of discrete members or elements. The inertia and stiffness matrices, as well as the force array, are first calculated for each element in the local coordinates. Employing appropriate transformations, the element global matrices and arrays are assembled into global structural matrices and arrays, and used for dynamic solution of the differential equation of motion for the structure.
Chapter 14, Page 111 of 218 Revision 20, 2006 OAG10000215_1466
IP2 FSAR UPDATE The WECAN Code solves equation of motions using the nonlinear modal superposition theory.
Initial computer runs such as dead weight analysis and the vibration (modal) analyses are made to set the initial vertical interface gaps and to calculate eigenvalues and eigenvectors. The modal analysis information is stored on magnetic tapes, and is used in a subsequent computer runs which solves equations of motions. The first time step performs the static solution of equations to determine steady state solution under normal operating hydraulic forces. After the initial time step, WECAN calculates the dynamic solution of equations of motions and nodal displacements and impact forces are stored on tape for post-processing The fluid-solid interactions in the LOCA analysis are accounted through the hydraulic forcing functions generated by MULTI FLEX Code, Reference 21. Following a postulated LOCA pipe rupture, forces are imposed on the reactor vessel and its internals. These forces result from the release of the pressurized primary system coolant. The release of pressurized coolant results in traveling depressurization waves in the primary system. These depressurization waves are characterized by a wave front with low pressure on one side and high pressure on the other.
Depressurization waves propagate from the postulated break location into the reactor vessel through either a hot leg or a cold leg nozzle. After a postulated break in the accumulator branch line on the cold leg, the depressurization path for waves entering the reactor vessel is through the nozzle which contains the broken pipe and into the region between the core barrel and the reactor vessel (i.e., downcomer region). The initial wave propagates up, around, and down the downcomer annulus, then up through the region circumferentially enclosed by the core barrel, that is, the fuel region. In the case of a break in a branch line on the cold leg, the region of the downcomer annulus close to the break depressurizes rapidly but, because of the restricted flow areas and finite wave speed (approximately 3000 feet per second), the opposite side of the core barrel remains at a high pressure. This results in a net horizontal force on the core barrel and the reactor vessel. As the depressurization wave propagates around the downcomer annulus and up through the core, the core barrel differential pressure reduces and, similarly, the resulting hydraulic forces drop.
In the case of a postulated auxiliary branch line break on the hot leg piping (such as the RHR line or Pressurizer surge line), the wave follows a similar depressurization path, passing through the outlet nozzle and directly into the upper internals region depressurizing the core and entering the downcomer annulus from the bottom exit of the core barrel. Thus, after a branch line break, on the hot leg, the downcomer annulus would be depressurized with very little difference in pressure forces across the outside the diameter of the core barrel. A branch line break on the hot leg produces less horizontal force because the depressurization wave travels directly to the inside of the core barrel (so that the downcomer annulus is not directly involved) and internal differential pressures are not as large as for a cold leg break of the same size.
Since the differential pressure is less for a branch line break, the horizontal force applied to the core barrel is less for a hot leg break than for a branch line break on the cold leg. For breaks in branch line piping on both the hot leg and cold leg, the depressurization waves continue to propagate by reflection and translation through the reactor vessel and loops.
The MULTI FLEX computer code, Reference 21, calculates the hydraulic transients within the entire primary coolant system. It considers subcooled, transition, and early two-phase (saturated) blowdown regimes. The MULTIFLEX code employs the method of characteristics to solve the conservation laws, and assumes one-dimensionality of flow and homogeneity of the liquid-vapor mixture. As mentioned earlier, the MULTI FLEX code considers a coupled fluid-structure interaction by accounting for the deflection of constraining boundaries, which are represented by separate spring-mass oscillator system. A beam model of the core support Chapter 14, Page 112 of 218 Revision 20, 2006 OAG10000215_1467
IP2 FSAR UPDATE barrel has been developed from the structural properties of the core barrel; in this model, the cylindrical barrel is vertically divided into equally spaced segments and the pressure as well as the wall motions are projected onto the plane parallel to the broken loop inlet nozzle.
Horizontally, the barrel is divided into 10 segments; each segment consists of four separate walls. The spatial pressure variation at each time step is transformed into 10 horizontal forces which act on the 10 mass points of the beam model. Each flexible wall is bounded on either side by a hydraulic flow path. The motion of the flexible wall is determined by solving the global equations of motions for the masses representing the forced vibration of an undamped beam.
In order to obtain the response of reactor pressure vessel system (vessel/internals/fuel), the LOCA horizontal and vertical forces obtained from the LATFORC and FORCE2 Codes, which were described earlier, are applied to the finite element system model. The transient response of the reactor internals consists of time history nodal displacements and time history impact forces.
14.3.4.3.4 Seismic Analysis The basic mathematical model for seismic analysis is essentially similar to the LOCA model except for some minor differences. In LOCA model, as mentioned earlier, the fluid-structure interactions are accounted though the MULTI FLEX Code; whereas in the seismic model the fluid-structure interactions are included through the hydrodynamic mass matrices in the downcomer region. Another difference between the LOCA and seismic models is the difference between in loop stiffness matrices. The seismic model uses the unbroken loop stiffness matrix, whereas the LOCA model uses the broken loop stiffness matrix. Except for these two differences, the RPV system seismic model is identical to that of LOCA model.
The horizontal fluid-structure or hydroelastic interaction is significant in the cylindrical fluid flow region between the core barrel and the reactor vessel annulus. Mass matrices with off-diagonal terms (horizontal degrees-of-freedom only) attach between nodes on the core barrel, thermal shield and the reactor vessel. The mass matrices for the hydroelastic interactions of two concentric cylinders are developed using the work of reference 23. The diagonal terms of the mass matrix are similar to the lumping of water mass to the vessel shell, thermal shield, and core barrel. The off-diagonal terms reflect the fact that all the water mass does not participate when there is no relative motion of the vessel and core barrel. It should be pointed out that the hydrodynamic mass matrix has no artificial virtual mass effect and is derived in a straight-forward, quantitative manner.
The matrices are a function of the properties of two cylinders with the fluid in the cylindrical annulus, specifically, inside and outside radius of the annulus, density of the fluid and length of the cylinders. Vertical segmentation of the reactor vessel and the core barrel allows inclusion of radii variations along their heights and approximates the effects beam mode deformation.
These mass matrices were inserted between the selected nodes on the core barrel, thermal shield, and the reactor vessel as shown in Figure 14.3-104. The seismic evaluations are performed by including the effects of simultaneous application of time history accelerations in three orthogonal directions. The WECAN computer code, which is described earlier, is also used to obtain the response for the RPV system under seismic excitations.
14.3.4.3.5 Results and Acceptance Criteria The reactor internals behave as a highly nonlinear system during horizontal and vertical oscillations of the LOCA forces. The nonlinearities are due to the coulomb friction at the sliding Chapter 14, Page 113 of 218 Revision 20, 2006 OAG10000215_1468
IP2 FSAR UPDATE surfaces and due to gaps between components causing discontinuities in force transmission.
The frequency response is consequently a function not only of the exciting frequencies in the system but also of the amplitude. Different break conditions excite different frequencies in the system. This situation can be seen clearly when the response under LOCA forces is compared with the seismic response. Under seismic excitations, the system response is not as nonlinear as LOCA response because various gaps do not close during the seismic excitations.
The results of the nonlinear LOCA and seismic dynamic analyses include the transient displacements and impact loads for various elements of the mathematical model. These displacements and impact loads, and the linear component loads (forces and moments) are then used for detailed component evaluations to assess the structural adequacy of the reactor vessel, reactor internals, and the fuel.
14.3.4.3.6 Structural Adequacy of Reactor Internals Components The reactor internal components of Indian Point Unit 2 are not ASME Code components, because Sub-section NG of the ASME Boiler and Pressure Code edition applicable to this unit did not include design criteria for the reactor internals since its design preceded Subsection NG of the ASME Code. However, these components were originally designed to meet the intent of the 1971 Edition of Section III of the ASME Boiler and Pressure Vessel Code with addenda through the Winter 1971. As mentioned earlier, that with the acceptance of Leak-Before-Break (LBB) by USNRC, Reference 20, the dynamic effects of the main reactor coolant loop piping no longer have to be considered in the design basis analysis. Only the dynamic effects of the next most limiting breaks of the auxiliary lines (Accumulator line and Pressurizer Surge or RHR line) are considered. Consequently, the components experience considerably less loads and deformations than those from the main loop breaks which were considered in the original design of the reactor internals.
14.3.4.3.7 Allowable Deflection and Stability Criteria The criteria for acceptability in regard to mechanical integrity analyses is that adequate core cooling and core shutdown must be ensured. This implies that the deformation of reactor internals must be sufficiently small so that the geometry remains substantially intact.
Consequently, the limitations established on the reactor internals are concerned principally with the maximum allowable deflections and stability of the components.
For faulted conditions, deflections of critical internals structures are limited to values given in Table 14.3-14. In a hypothesized vertical displacement of internals, energy-absorbing devices limit the displacement to 1.25 inches by contacting the vessel bottom head.
Core Barrel Response Under Transverse Excitations In general, there are two possible modes of dynamic response of the core barrel during LOCA conditions: a) during a cold leg break the inside pressure of the core barrel is much higher than the outside pressure (downcomer), thus subjecting the core barrel to outward deflections, and b) during hot leg break the pressure outside the core barrel (downcomer) is greater than the inside pressure thereby subjecting the core barrel to compressive loadings. Therefore this condition requires the dynamic stability check of the core barrel during hot leg break.
(1) To ensure shutdown and cooldown of the core during cold leg blowdown, the basic requirement is a limitation on the outward deflection of the Chapter 14, Page 114 of 218 Revision 20, 2006 OAG10000215_1469
IP2 FSAR UPDATE barrel at the locations of the inlet nozzles connected to unbroken lines. A large outward deflection of the upper barrel in front of the inlet nozzles, accompanied with permanent strains, could close the inlet area and restrict the cooling water coming from the accumulators. Consequently, a permanent barrel deflection in front of the unbroken inlet nozzles larger than a certain limit, called "no loss of function" limit, could impair the efficiency of the ECCS.
(2) During the hot leg break, the rarefaction wave enters through the outlet nozzle into the upper internals region and thus depressurizes the core and then enters the downcomer annulus from the bottom exit of the core barrel. This depressurization of the annulus region subjects the core barrel to external pressures and this condition requires a stability check of the core barrel during hot leg break. Therefore, to ensure rod insertion and to avoid disturbing the control rod cluster guide structure, the barrel should not interfere with the guide tubes.
Table 14.3-14 summarizes the allowable and no loss of function deflection limits of the core barrel for both the cold leg and hot leg breaks postulated in the main line loop piping. With the acceptance of LBB, the reactor internal components such as core barrel will experience much less loads and deformations than those obtained from main loop piping.
Control Rod Cluster Guide Tubes The deflection limits of the guide tubes, which were established from the test data, and for fuel assembly thimbles, cross-section distortion (to avoid interference between the control rod and the guides) are given in Table 14.3-14.
Upper Package The local vertical deformation of the upper core plate, where a guide tube is located, shall be below 0.100 inch. This deformation will cause the plate to contact the guide tube since the clearance between the plate and the guide tube is 0.100 inch. This limit will prevent the guide tubes from undergoing compression. For a plate local deformation of 0.150 inch, the guide tube will be compressed and deformed transversely to the upper limit previously established.
Consequently, the value of 0.150 inch is adopted as the no loss function local deformation with an allowable limit of 0.100 inch. These limits are given in Table 14.3-14.
14.3.4.4 Evaluations of Effects of Loss-of-Coolant and Safety Injection on the Reactor Vessel The effects of Safety Injection on the Reactor Vessel following a loss of coolant accident were generically evaluated after the Three Mile Island - 2 accident as part of NUREG-0737, Item II.K.2.13, and determined to be acceptable as documented in NRC's June 15, 1984 Safety Evaluation Report (SER) from Steven A. Varga (NRC) to John D. O'Toole (Consolidated Edison). The potential for thermal shock of reactor vessels was later broadened in scope to include all over cooling events, the evaluation of which is currently required by the Pressurized Thermal Shock (PTS) Rule, 10 CFR 50.61. As described in Section 4.2.5, NRC's February 27, 1987 Safety Evaluation Report (SER) from M. Siosson (NRC) to M. Selman (Consolidated Edison) concluded that the Indian Point Unit 2 evaluations were acceptable and meet the requirements of the PTS Rule.
Chapter 14, Page 115 of 218 Revision 20, 2006 OAG10000215_1470
IP2 FSAR UPDATE 14.3.5 Containment Integrity Analysis 14.3.5.1 Containment Structure 14.3.5.1.1 Design Bases The design and analysis of the Indian Point 2 containment structure are described in Chapter 5.
The design bases and design criteria are discussed in Section 5.1.1.1.6 and 5.1.2.2, respectively. The discussion contained in this Section pertains to containment response to Loss of Coolant Accidents. Containment response to secondary system pipe ruptures is discussed in Section 14.2.5.6.
Sources and amounts of energy that may be available for release to the containment are discussed in Section 14.3.5.3. To obtain a conservative pressure, energy is added to the containment in the manner most detrimental to peak pressure response for the containment response analysis.
Systems for removing energy from within the containment include the safety injection system (Section 6.2), the containment fan cooler system (Section 6.4), and the containment spray system (Section 6.3). The containment fan coolers remove energy from the containment atmosphere. Containment spray is used for rapid pressure reduction and for containment airborne activity removal. During the recirculation phase, the recirculation system removes heat from the reactor fuel via containment sump water. Heat removal by containment spray during the recirculation phase, which is part of the engineered safety features, is not assumed in the containment response analyses.
Engineered safety features systems are redundant and independent such that any single active failure in the engineered safety features system during the injection phase or any single active or passive failure during recirculation will not affect the ability to mitigate containment pressure as discussed in Sections 14.3.5.3.7 and 14.3.5.5.
Reference 61 has provided the basis for the loss-of-coolant accident spectrum that is analyzed to provide limiting containment pressures and temperatures. These results are bounded by the transient used for design as discussed in Section 5.1.2.2. Results are provided for a Double-Ended Pump Suction (DEPS) break with minimum and maximum safeguards and a Double-Ended Hot Leg (DEHL) break. These analyses were performed at a reactor power level of 3216 MWt. Analyses, assumptions, and results are presented in sections 14.3.5.1.3 through 14.3.5.3.9 for the break spectrum analyzed.
To summarize the break cases, Tables 14.3-16 through 14.3-30 show mass and energy release information, Tables 14.3-15 and 14.3-37 show systems and containment assumptions, and the assumed containment safeguards equipment. Tables 14.3-35 and 14.3-36 show the containment passive heat sink information assumed, and Figure 14.3-115 shows the heat removal capability assumed for one RCFC. Results of the break cases are shown in Figures 14.3-109 through 14.3-114, and are summarized in Table 14.3-34. The break cases show that a reactor coolant system double-ended pump suction (DEPS) rupture, assuming operation of the minimum emergency cooling system equipment, three RCFC units, and one containment spray pump consistent with the assumption of a single failure of one diesel generator, results in the highest containment pressure after a LOCA. The chronology of events for the DEPS minimum safeguards case is shown in Table 14.3-31. (See Section 5.1.1.1.6 for a discussion of the structural containment evaluation based on the limiting case.) The selection of the limiting Chapter 14, Page 116 of 218 Revision 20, 2006 OAG10000215_1471
IP2 FSAR UPDATE case, based on both the sensitivity cases and the generic conclusions of the mass and energy release topical report (Reference 61), remains valid for reanalysis of the Indian Point Unit 2 containment transients at stretch power uprate conditions.
The analysis of the limiting case, a DEPS rupture with minimum safeguards, has been performed at an NSSS power of 3230 MWt (core power of 3216 MWt). The analysis was performed using the models and assumptions presented in Reference 61 and Table 14.3-15.
The mass and energy release models include the Model 44F replacement steam generator input (including the conservative assumption of 0% tube plugging) and the containment response model includes the release of the accumulator nitrogen gas to containment. Tables 14.3-16 through 14.3-18 show the mass and energy releases for the blowdown phase, the reflood phase, and the post-reflood phase respectively. Tables 14.3-19 and 14.3-20 show the mass and energy balance data, while Table 14.3-21 shows the principal parameters during the reflood phase. Table 14.3-37 shows the assumed containment safeguards equipment, and Tables 14.3-35 and 14.3-36 show the containment passive heat sink information assumed.
Calculation of containment pressure and temperature transients is accomplished by use of the COCO (Reference 6) computer code.
Fan cooler (RCFC) heat removal performance assumed in the analysis is shown in Figure 14.3-115. The critical parameter as regards RCFC capability in the calculated containment pressure is the available total RCFC heat removal capacity. In the containment pressure response analysis, three RCFCs, each with the heat removal capability presented in Figure 14.3-115, are modeled. Any RCFC configuration that assures that heat removal greater than or equal to three times that of Figure 14.3-115 is available post-LOCA via the RCFC system is equally acceptable. Service water flow rate and temperature, fouling factor, and the number of RCFCs available under accident conditions may be modified as long as the required total RCFC heat removal capability exists.
The reanalysis of the limiting containment pressure case, a DEPS rupture with minimum safeguards, has been performed at an NSSS power level of 3230 MWt (core power level of 3216 MWt). The chronology of events is shown in Table 14.3-31. Quantities of heat removed by structures, fan coolers and containment spray are shown in Figures 14.3-105, 14.3-106, and 14.3-107 respectively. The structural heat transfer coefficient is shown in Figure 14.3-108.
Results in Figures 14.3-109 and 14.3-110 show that the calculated maximum pressure and temperature are 45.71 psig and 266.81°F, respectively. This indicates margin to the containment design pressure of 47 psig.
Heat removal by recirculation spray is not credited in the analysis. Therefore, the increase in the duration of the recirculation spray flow has no impact on the containment integrity design basis LOCA analysis.
14.3.5.1.2 System Design Structural design of the containment and containment internal structures is discussed in Chapter 5.
14.3.5.1.3 Design Evaluation The results of the transient analysis of the containment for the loss-of-coolant accidents are shown in Figures 14.3-105 through 14.3-114. A series of cases were performed in this analysis illustrating the sensitivity to break location. Subsection 14.3.5.3 documented the mass and Chapter 14, Page 117 of 218 Revision 20, 2006 OAG10000215_1472
IP2 FSAR UPDATE energy release (LOCA) for the minimum and maximum safeguards cases for a Double-Ended Pump Suction (DEPS) break and the releases from the blowdown of a Double-Ended Hot Leg (DEHL) break. All of these design basis cases show that the containment pressure will remain below design pressure with margin without taking credit for the recirculation spray. After the peak pressure is attained, the performance of the minimum safeguards system reduces that containment pressure. At the end of the first day following the accident, the containment pressure has been reduced to a low value. The peak pressures are shown in Table 14.3-34 for a variety of containment safeguards availability assumptions.
Calculation of containment pressure and temperature transients is accomplished by use of the digital computer code, COC0 6 . Transient phenomena within the reactor coolant system affect containment conditions by means of mass and energy transport through the pipe break.
For analytical rigor and convenience, the containment air-steam-water mixture is separated into systems. The first system consists of the air-steam phase; the second consists of the water phase. Sufficient relationships to describe the transient are provided by the equations of conservation of mass and energy as applied to each system, together with appropriate boundary conditions. Thermodynamic equations of state and conditions may vary during the transient. The equations have been derived for all possible cases of superheated or saturated steam and subcooled or saturated water. Switching between states is handled automatically within the COCO code. The following are the major assumptions made in the containment analysis:
- 1. Discharge mass and energy flow rates through the reactor coolant system break are established from the analysis in Section 14.3.5.3.
- 2. For the LOCA containment response analysis, the discharge flow from either end of the break separates into steam and water phases upon entry to the containment atmosphere. For each input set of tables of break effluent mass and energy, the COCO code assumes that the saturated water phase is at the total containment pressure, while the steam phase is at the partial pressure of the steam in the containment.
- 3. Homogeneous mixing is assumed. The steam-air mixture and the water phase each have uniform properties. More specifically, thermal equilibrium between the air and steam is assumed. This does not imply thermal equilibrium between the steam-air mixture and the water phase, which may be at different temperature.
- 4. Air is taken as an ideal gas, while compressed water and steam tables are employed for water and steam thermodynamic properties.
14.3.5.1.4 Initial Conditions The pressure, temperature, and humidity of the containment atmosphere prior to the postulated reactor coolant system rupture are conservatively specified in the analysis. Also, conservative values for the temperature of the service water and refueling water storage tank water solution are assumed. All of these values are as shown in Table 14.3-37.
In each of the transients, the safeguards systems shown in Table 14.3-37 are assumed to operate with a 60 second delay in startup. The assumed spray flow rate is based on one of two trains of the containment spray system operating.
Chapter 14, Page 118 of 218 Revision 20, 2006 OAG10000215_1473
IP2 FSAR UPDATE 14.3.5.1.5 Heat Removal The significant heat removal source during the early portion of the transient are structural heat sinks. Provision is made in the containment pressure transient analysis for heat transfer through, and heat storage in, both interior and exterior walls. Every wall is divided into many nodes; for each node, a conservation of energy equation expressed in finite- difference form accounts for transient conduction into and out of the node and temperature rise of the node.
Tables 14.3-35 and 14.3-36 are summaries of the containment structural heat sinks used in the analysis.
The heat transfer coefficient to the containment structure is calculated by the code based primarily on the work of Tagami 31 . From this work, it was determined that the value of the heat transfer coefficient increases parabolically to peak value at the end of blowdown for LOCA. The value then decreases exponentially to a stagnant heat transfer coefficient, which is a function of steam-to-air-mass ratio.
Tagami presents a plot of the maximum value of h as a function of "coolant energy transfer speed," defined as follows:
total coolant energy transferred into containment (containment volume) x (time interval to peak pressure)
From this, the maximum h of steel is calculated:
(14.3 - 1) where:
75 = material coefficient for steel hmax = maximum value of h (Btu/hr ft 2 OF).
tp = time from start of accident to end of blowdown (sec)
V = containment volume (fe).
E = coolant energy discharge (Btu).
The parabolic increase to the peak value is given by:
(14.3 - 2) where
= heat transfer coefficient for steel (Btu/hr ft2 OF).
Chapter 14, Page 119 of 218 Revision 20, 2006 OAG10000215_1474
IP2 FSAR UPDATE t = time from start of accident (sec).
For concrete, the heat transfer coefficient is taken as 40-percent of the value calculated for steel.
The exponential decrease of the heat transfer coefficient is given by:
(14.3-3) where hstag = 2 + 50X, 0 < X < 1.4.
hstag = h for stagnant conditions (Btu/hr ft2 OF).
X = steam-to-air mass ratio in containment.
For a large break, the engineered safety features are quickly brought into operation. Because of the brief period of time required to depressurize the reactor coolant system, the containment safeguards do not influence the blowdown peak pressure; however, they significantly reduce the containment pressure after the blowdown and maintain a low long-term pressure. Also, although the containment structure is not a very effective heat sink during the initial reactor coolant system blowdown, it still contributes significantly as a form of heat removal.
14.3.5.2 Engineered Safety Features During the injection phase of post-accident operation, the emergency core cooling system pumps water from the refueling water storage tank (RWST) into the reactor vessel (the containment spray pumps also inject RWST water into the containment). Since this water enters the vessel at refueling water storage tank temperature, which is less than the temperature of the water in the vessel, it can absorb heat from the core until saturation temperature is reached. During the recirculation phase of operation, water is taken from the containment sump and cooled in the residual heat removal heat exchanger. The cooled water is then pumped back to the reactor vessel to absorb more decay heat. The heat is removed from the residual heat exchanger by component cooling water and from the component cooling heat exchanger by service water.
14.3.5.2.1 Containment Spray Another containment heat removal system is the containment spray. During the injection phase of operation, the containment spray pumps draw water from the RWST and spray it into the containment through nozzles mounted high above the operating deck. As the spray droplets fall, they absorb heat from the containment atmosphere. Since the water comes from the RWST, the entire heat capacity of the spray from the RWST temperature to the temperature of the containment atmosphere is available for energy absorption. During the recirculation phase of post-accident operation, water can be drawn from the residual heat removal heat exchanger outlet and sprayed into the containment atmosphere via the recirculation spray system.
However, no-credit was taken for recirculation spray in the analysis in calculating the peak containment pressure.
Chapter 14, Page 120 of 218 Revision 20, 2006 OAG10000215_1475
IP2 FSAR UPDATE When a spray drop enters the hot, saturated, steam-air containment environment following a loss-of-coolant accident, the vapor pressure of the water at its surface is much less than the partial pressure of the steam in the atmosphere. Hence, there will be diffusion of steam to the drop surface and condensation on the drop. This mass flow will carry energy to the drop.
Simultaneously, the temperature difference between the atmosphere and the drop will cause the drop temperature and vapor pressure to rise. The vapor pressure of the drop will eventually become equal to the partial pressure of the steam, and the condensation will cease. The temperature of the drop will equal the temperature of the steam-air mixture.
The equations describing the temperature rise of a falling drop are as follows:
d
-(Mu) = mhg + q (14.3-4)
~t
-(M)=m (14.3-5) dt where q = heA (T s - T).
The coefficients of heat transfer (he) and mass transfer (kg) are calculated from the Nusselt number for heat transfer, Nu, and the Nusselt number for mass transfer, Nu'.
Both Nu and Nu' may be calculated from the equations of Ranz and Marshal1. 38 Nu = 2 + 0.6 (Re)1/2 (Pr)1/3 (14.3-6)
Nu' = 2 + 0.6 (Re)1/2 (SC)1/3 (14.3-7)
Thus, Equations 14.3-4 and 14.3-5 can be integrated numerically to find the internal energy and mass of the drop as a function of time as it falls through the atmosphere. Analysis shows that the temperature of the (mass) mean drop produced by the SPRACO 1713A spray nozzles rises to a value within 99-percent of the bulk containment temperature in less than 2 seconds. Drops of approximately 1000 micron average size (as discussed in Chapter 6) will reach temperature equilibrium with the steam-air containment atmosphere after falling through less than half the available spray fall height. Detailed calculations of the heatup of spray drops in post-accident containment atmospheres by Parsll3 show that drops of all sizes encountered in the containment spray reach equilibrium in a fraction of their residence time in a typical pressurized water reactor containment. These results confirm the assumption that the containment spray will be 100-percent effective in removing heat from the atmosphere. Nomenclature in this section is as follows:
A = area
= coefficient of heat transfer
= steam enthalpy
= coefficient of mass transfer Chapter 14, Page 121 of 218 Revision 20, 2006 OAG10000215_1476
IP2 FSAR UPDATE M = droplet mass m = diffusion rate Nu = Nusselt number for heat transfer Nu' = Nusselt number for mass transfer Ps = steam partial pressure Pv = droplet vapor pressure Pr = Prandtl number q = heat flow rate Re = Reynolds number Sc = Schmidt number Ts = droplet temperature T = steam temperature t = time u = internal energy 14.3.5.2.2 Reactor Containment Fan Coolers (RCFCs)
The reactor containment fan coolers are a principal means of post-accident containment heat removal. The fans draw the dense atmosphere through banks of finned cooling coils and mix the cooled steam/air mixture with the rest of the containment atmosphere. The coils are kept at a low temperature by maintaining the required flow of cooling water from the service water system. Since the RCFCs do not use water from the RWST, the mode of operation remains the same before and after the containment spray and emergency core cooling systems are changed to the recirculation mode.
The ability of the containment air recirculation coolers to function properly in the accident environment is demonstrated by the coil vendor's analysis. This analysis determines the plate-fin cooling coil heat removal rate when operating in a saturated steam-air mixture.
In the heat removal analysis of the RCFC coils, a mass flow rate of cooling water is first established. This determines the inside film coefficient of the tube. Next, the resistance to heat transfer between the cooling water and the outside of the fin collars is computed, including inside film coefficient, fouling factor, [Note - A fouling factor of 0.001 hr-tf-oFIBtu, under both normal and design basis accident conditions, has been assumed for cooling coil design purposes. This value is conventionally used in sizing heat exchangers cooled by river water at 95°F or less and with tube water velocity greater than 3-ftlsec33 and is considered sufficiently conservative for this application. Computer analysis of the coils selected shows that the required post-accident heat removal rate can be achieved even with a slight increase in fouling.
Chapter 14, Page 122 of 218 Revision 20, 2006 OAG10000215_1477
IP2 FSAR UPDATE
] tube radial conduction, fin-collar interface resistance, and conduction across the fin collars.
The analysis now becomes iterative. One assumes an overall heat transfer rate Qtot and the temperature at the outside of the fin collars is determined from Qtot and the sum of the resistances cited above.
A second iterative procedure is now established. The variable whose value is assumed is the effective film coefficient between the fins and the gas stream, which involves the effect of convective heat transfer and mass transfer. With this value of heffective, fin efficiency and the fin temperature distribution can be determined. It is assumed that a condensate film exists on the vertical fins. An analysis is performed, which relates this film thickness to the rate of removal due to gravity and shear and the rate of addition of condensate by mass transfer from the bulk gas. In the process, from an energy balance the temperature of the interface between the bulk gas and the condensate can be determined; this is necessary for determining the mass transfer rate from the gas. Now that the thickness of the condensate film is known, the value of the assumed heffective is checked from the relation heff = Kwate/8 film. If the assumed and computed values are not the same, a new value is selected and calculations repeated until the assumed and computed values are equal.
When this occurs, the heat transfer rate from the fins and fin collar is computed, using the standard equations for fin and fin collar heat transfer and the values of heffective and film-bulk gas interface temperature. If this value is not the same as Qtot initially assumed in order to determine fin collar temperature, the whole analysis is repeated with a new estimate of Qtot.
When, finally, the heat transfer rate to the cooling water from the fin collar equals the resulting computed rate to the fin collar and fins from the gas, the effect of this heat transfer rate on the cooling water is computed. The water exit temperature is established, and this value is used as the inlet temperature for the next heat exchanger pass. Also, the effect of convective heat transfer and condensate mass transfer is determined relative to the gas composition and thermodynamic state. The updated gas state is used as inlet conditions for the next pass. The process is repeated for the second, third, etc., passes until the gas exits the heat exchanger.
The mass transfer coefficients used in the computer code were derived from analyses and reports of experimental data. 33 , 34, 35 From Reference 34, the mass flow rate of condensate is defined by [ Note - Nomenclature used is given at the end of this discussion.]
~= hD (PSg - Psw) (14.3-8)
From Reference 34, pp. 471-473, experimental data for mass and heat transfer correlate well with the expression (14.3-9) as shown in Figure 16-10 of Reference 34. Thus, Chapter 14, Page 123 of 218 Revision 20, 2006 OAG10000215_1478
IP2 FSAR UPDATE s )2/3 hD = Us X St ( P~ (14.3 - lOa)
Substituting: St = _h_ thus we get, pCus (14.3-10b)
As Reference 34 points out, for large partial pressures of the condensing components, Equation 14.3-10b must be corrected by a factor P/Pam . Thus, hD = ~x~x(SC)2/3 (14.3-11) pC Pam Pr This is essentially the same result as reported by Reference 35, p. 343 and Reference 33.
Reference 34 states that experiments show Equation (14.3-8) to be valid when the Schmidt number does not differ greatly from 1.0. Equations (14.3-8) and (14.3-11) are combined to give the mass transfer rate, which is
- h Pt (Sc)2/3 ( ) (14.3 - 12) m = pC x P m x Pr x Psg - Psw a
An approximation was made in assuming that (Sc/Pr)2/3 : : : 1.0, thus the local mass transfer rate was computed from
- h Pt m = -x--x(PSg - psw) (14.3 -13) pC Pam The heat transfer rate due to condensation is computed from AhP t ( )
(14.3 - 14) q 1 = CP x Psg - Psw P am where Psg is evaluated at the local bulk gas temperature Psw is evaluated at the local gas-condensate interface temperature A is evaluated at the local gas-condensate interface temperature P, is evaluated at the local bulk gas temperature C is evaluated at the local bulk gas temperature The heat transfer coefficient, h, was determined from experiments on the same geometry used in this application.
Chapter 14, Page 124 of 218 Revision 20, 2006 OAG10000215_1479
IP2 FSAR UPDATE The heat transfer rate, locally, is computed from (14.3-15)
The basis for selecting these values is that the authorities cited as references have shown, through analyses and through cited experiments, that the methods used are accurate.
The air side pressure drop across the cooling coils at a conservative design-basis accident condition of 47 psig is estimated to be approximately 3.2-in. of water, or 0.115 psi. This will have a negligible effect on the heat removal capability of the cooling coils.
The pressure of noncondensible gases is taken into consideration because the theory behind the analysis assumed that the condensible vapor must diffuse through a noncondensible gas.
The nomenclature is as follows:
ill mass flow rate of condensate, Ibm/hr-ft2 mass transfer coefficient, ftlhr psg density of saturated steam at local bulk gas temperature, Ibm/fe psw density of saturated steam at local condensate-gas interface temperature, Ibm/fe Us free steam gas velocity, ftlmin Sc Schmidt number, JdpD, dimensionless viscosity of bulk gas, Ibm/ft-hr p bulk gas density, Ibm/fe D gas-air diffusion coefficient, ft2/hr St Stanton number, hipCu s , dimensionless h convective heat transfer coefficient, Btu/hr-ft2-oF c specific heat of bulk gas, Btu/lbm-oF Pr Prandtl number, fL c/k, dimensionless k thermal conductivity of bulk gas, Btu/hr-ft-OF total gas pressure, Ibflft2 Chapter 14, Page 125 of 218 Revision 20, 2006 OAG10000215_1480
IP2 FSAR UPDATE air log-mean Paw -P Pag , Ibf/ft2 In~
Pag Paw partial pressure of air at the local gas-condensate interface, Ibflff Pag partial pressure of air at the local bulk gas temperature, Ibflff A latent heat of vaporization (or condensation) at the local gas-condensate interface temperature, Btu/Ibm q1 local heat transfer rate due to condensation, Btu/hr-ff q2 local heat transfer rate due to convection, Btu/hr-ff Tg local bulk gas temperature, of Ti local gas-condensate interface temperature, of 8fi1m water film thickness, ft A similar heat removal analysis of the currently installed RCFC coils results in the fan-cooler heat removal rate per fan as presented in Figure 14.3-115.
14.3.5.3 Mass and Energy Release Analyses for Postulated Loss-of-Coolant Accidents This analysis presents the mass and energy releases to the containment subsequent to a hypotheticalloss-of-coolant accident (LOCA) at 3216 MWt. The release rates are calculated for pipe failure at three distinct locations:
- 1. Hot leg (between vessel and steam generator)
- 2. Pump suction (between steam generator and pump)
- 3. Cold leg (between pump and vessel)
The LOCA transient is typically divided into four phases:
- 1. Blowdown - which includes the period from accident occurrence (when the reactor is at steady state operation) to the time when the total break flow stops.
- 2. Refill - the period of time when the lower plenum is being filled by accumulator and safety injection water. (This phase is conservatively neglected in computing mass and energy releases for containment evaluations.)
- 3. Reflood - begins when the water from the lower plenum enters the core and ends when the core is completely quenched.
- 4. Post-Reflood - describes the period following the reflood transient. For the pump suction and cold leg breaks, a two-phase mixture exits the core, passes through Chapter 14, Page 126 of 218 Revision 20, 2006 OAG10000215_1481
IP2 FSAR UPDATE the hot legs, and is superheated in the steam generators. After the broken loop steam generator cools, the flow out of the break becomes two phase.
During the reflood phase, these breaks have the following different characteristics. For a cold leg pipe break, all of the fluid, which leaves the core must vent through a steam generator and becomes locally superheated. However, relative to breaks at the other locations, the core flooding rate (and therefore the rate of fluid leaving the core) is low, because all the core vent paths include the resistance of the reactor coolant pump. For a hot leg pipe break, the vent path resistance is relatively low, which results in a high core flooding rate, but the majority of the fluid, which exits the core bypasses the steam generators in venting to the containment. The pump suction break combines the effects of the relatively high core flooding rate, as in the hot leg break, and steam generator heat addition, as in the cold leg break. As a result, the pump suction break yields the highest energy flow rates during the post-blowdown period, thereby bounding the hot leg breaks.
The spectrum of breaks analyzed includes the largest pump suction and hot leg breaks.
Because of the phenomena of reflood as discussed above, the pump suction break location is the worst case for long term containment depressurization. Smaller hot leg breaks have been shown on similar plants to be less severe than the double-ended hot leg. Cold leg breaks, however, are lower both in the blowdown peak and in the reflood pressure rise and therefore have not been analyzed.
14.3.5.3.1 Mass and Energy Release Data Blowdown Mass and Energy Release Data Tables 14.3-16, 14.3-22 and 14.3-28 present the calculated mass and energy releases for the blowdown phase of the various breaks analyzed.
The mass and energy releases for the double-ended pump suction break, given in Table 14.3-16, terminate 26.4 seconds after the postulated accident for the minimum ECCS case. The DEPS maximum ECCS case has a blowdown time of 26.0 seconds and the mass and energy release are given in Table 14.3-22.
Reflood Mass and Energy Release Data Tables 14.3-17 and 14.3-23 present the calculated mass and energy releases for the reflood phase of the various breaks analyzed along with the corresponding safety injection assumption (minimum and maximum).
Two Phase Post-Reflood Mass and Energy Release Data Tables 14.3-18 and 14.3-24 present the two phase (froth) mass and energy release data for a double-ended pump suction break using minimum and maximum safety injection assumptions, respectively.
Equilibrium and Depressurization Energy Release Data The equilibrium and depressurization energy release has been incorporated in the post-reflood mass and energy release data. This eliminates the need to determine additional releases due to the cooling of steam generator secondary and primary metal.
Chapter 14, Page 127 of 218 Revision 20, 2006 OAG10000215_1482
IP2 FSAR UPDATE 14.3.5.3.2 Mass and Energy Sources The sources of mass considered in the LOCA mass and energy release analysis are given in the mass balance Tables 14.3-19, 14.3-25, and 14.3-29. These sources are the reactor coolant system, accumulators and pumped injection.
The energy inventories considered in the LOCA mass and energy release analysis are given in Tables 14.3-20, 14.3-26, and 14.3-30. The energy sources include:
- 2. Accumulators
- 3. Pumped injection
- 4. Decay heat
- 5. Core stored energy
- 6. Primary metal energy
- 7. Secondary metal energy
- 8. Steam generator secondary energy
- 9. Secondary transfer of energy (feedwater into and steam out of the steam generator secondary), main feedwater coastdown following reactor trip and SI signal generation.
The inventories are presented at the following times, as appropriate:
- 1. Time zero (initial conditions)
- 2. End of blowdown time
- 3. End of refill time
- 4. End of reflood time
- 5. Time that broken loop secondary energy is removed.
- 6. Time that intact loops secondary energy is removed.
- 7. Time that the secondary side is assumed to equilibrate to 14.7 psia and 212°F.
The methods and assumptions used to release the various energy sources are given in NRC-approved WCAP-1 032561 .
The following items ensure that the core energy release is conservatively analyzed for maximum containment pressure:
- 1. Maximum expected operating temperature of the reactor coolant system
- 2. Allowance in operating temperature for instrument error and deadband (+ 7.5°F)
- 3. Margin in volume (1.4-percent)
- 4. Allowance in volume for thermal expansion (1.6-percent)
- 5. A core power level of 3216 Mwt was assumed
- 6. Allowance for calorimetric error (2-percent of 3216 Mwt)
- 7. Appropriately modified coefficients of heat transfer
- 8. Allowance in core stored energy for effect of fuel densification
- 9. Margin in core stored energy (+15-percent)
Chapter 14, Page 128 of 218 Revision 20, 2006 OAG10000215_1483
IP2 FSAR UPDATE 14.3.5.3.3 Blowdown Model Description The computer code used to calculate the mass and energy release in the blowdown phase is SATAN-VI. The model is described in WCAP-9220 12 and WCAP-8302 4 . WCAP-10325 61 provides the method by which the model is used.
14.3.5.3.4 Refill Model Description At the end of blowdown, a large amount of water remains in the cold legs, downcomer, and lower plenum. To conservatively model the refill period for the purpose of containment mass and energy releases, this water is instantaneously transferred to the lower plenum along with sufficient accumulator water to completely fill the lower plenum. Thus, the time required for refill is conservatively neglected.
14.3.5.3.5 Reflood Model Description The computer code used for the reflood phase is WREFLOOD. The model is described in WCAP-9220 12 and WCAP-8170 5 . WCAP-10325 61 describes the method by which this model is used and the modifications. A complete thermal equilibrium mixing condition for the steam and ECCS injection water during the reflood phase has been assumed for each loop receiving ECCS water. This is consistent with the use and application of the M&E release evaluation model (Reference 61) in recent analyses, for example, D. C. Cook Docket (Reference 60).
Even though the WCAP-10325-P-A (Reference 61) model credits steam/water mixing only in the intact loop and not in the broken loop, the justification, applicability, and NRC approval for using the mixing model in the broken loop has been documented (Reference 60). Transients of the principle parameters during reflood are given in Tables 14.3-21 and 14.3-27 for the double-ended pump suction break with minimum and maximum safety injection.
14.3.5.3.6 Post-Reflood Model Description Two-Phase (FROTH)
The transient model (FROTH), along with its method of use, is described in WCAP-8312-A 62 .
The mass and energy rates calculated by FROTH are utilized in the containment analysis to the time of containment depressurization.
Long Term (Dry Steam)
After depressurization, the mass and energy release from decay heat for 3216 Mwt is based on ANSI/ANS-5.1- 1979 and the following input:
- 1. Decay heat sources considered are fission product decay and heavy element decay of U-239 and Np-239. The highest decay heat release rates come from the fission of the U-238 nuclei. Thus, to maximize the decay heat rate a maximum value (8%) has been assumed for the U-238 fission fraction.
- 2. The second highest decay heat release rate comes from the fission of the U-235 nuclei. Therefore, the remaining fission fraction (92%) has been assumed for U-235.
- 3. Fission rate is constant over the operating history of maximum power level.
Chapter 14, Page 129 of 218 Revision 20, 2006 OAG10000215_1484
IP2 FSAR UPDATE
- 4. The factor accounting for neutron capture in fission products has been taken from Table 10 of ANS (1979).
- 5. The fuel has been assumed to be at full power for 10A 8 seconds.
- 6. The total recoverable energy associated with one fission has been assumed to be 200 MeV/fission.
- 7. Two sigma uncertainty has been applied to the fission product decay.
14.3.5.3.7 Single Failure Analysis The effect of single failures of various ECCS components on the mass and energy releases is included in these data. Two analyses bound this effect for the pump suction double-ended rupture.
No failure of any ECCS component is assumed in determining the mass and energy releases for the maximum safeguards case. For the maximum safeguards case, the single failure assumed is the loss of one containment spray pump. For the minimum safeguards case, the single failure assumed is the loss of one emergency diesel generator, which results in the loss of the pumped safety injection (i.e., one residual heat removal pump and one safety injection pump) and the loss of the containment safeguards on that diesel. For further conservatism, an additional containment fan cooler unit is assumed to be unavailable, thus limiting the assumed available containment safeguards to three fan cooler and one spray pump. The analysis of both maximum and minimum safeguards cases ensure that the effect of all credible single failures on mass and energy releases is bounded.
A single failure analysis is not performed for the hot leg ruptures since the ECCS has no effect on the maximum containment pressure, which occurs at the end of blowdown.
14.3.5.3.8 Metal-Water Reaction In the mass and energy release data presented, no zirconium-water reaction heat was considered because the clad temperature did not rise high enough for the rate of reaction to be of any significance.
14.3.5.3.9 Additional Information System parameters needed to perform confirmatory analyses are provided in Tables 14.3-37, 14.3-38, 14.3-39, and 14.3-40. The chronology of events for the DEPS breaks are presented in Tables 14.3-31 and 14.3-32.
14.3.5.4 Evaluation of Containment Internal Structures 14.3.5.4.1 Previous Design Basis The containment internal structures such as the reactor coolant loop compartments and the reactor shield wall are designed for the pressure build-up that could occur following a loss of coolant. If a LOCA were to occur in these relatively small volumes, the pressure would build up at a rate faster than the overall compartments.
Chapter 14, Page 130 of 218 Revision 20, 2006 OAG10000215_1485
IP2 FSAR UPDATE A digital computer code, COMCO, was developed to analyze the pressure build-up in the reactor coolant loop compartments. The COMCO code is largely an extension of the COCO code in that a separation of the two-phase blowdown into steam and water is calculated and the pressure build-up of the steam-air mixture in the compartment is determined. Each compartment has a vent opening to the free volume of the containment.
The main calculation performed is a mass energy balance within the control volume of a compartment. The pressure builds up in the compartment until a mass and energy relief through the vent exceeds the mass and energy entering the compartment from the break. The reactor coolant loop compartments are designed for the maximum calculated differential pressure resulting from an instantaneous double-ended rupture of the reactor coolant pipe.
There are two reactor coolant loop compartments (i.e., crane wall areas) with two loops in each compartment. The total free volume of each compartment is 113,500-fe with a vent area of 1000-ff. The calculated differential pressure across the wall of the compartment is 6.4 psi.
The primary shield around the reactor vessel is designed for a pressure of 1000 psi to provide missile protection against the highly unlikely failure of the reactor vessel by longitudinal splitting or by various modes of circumferential cracking.
14.3.5.4.2 Current Design Basis Additional analyses for initial conditions, including prior operation parameters and 3216 MWt power operation parameters, were evaluated relative to short term subcompartment pressurization effects. The mass and energy releases from postulated full double-ended Reactor Coolant System (RCS) breaks were determined with the SATAN-V computer program, reference 62. The TMD computer program, reference 64, was used to evaluate the subcompartment containment response to the hypothetical pipe ruptures. The results of the evaluation indicate that for the full double-ended breaks the peak calculated differential pressure across the wall of the loop compartment was conservatively calculated to be greater that the current design basis of 6.4 psi, as discussed in Section 14.3.5.4.1.
References 65 and 66 demonstrate that RCS primary loop pipe breaks need not be considered in the structural design basis of the Indian Point 2 Plant. Therefore, implementation of Leak-Before-Break (LBB) Technology has eliminated the large RCS breaks from dynamic consideration. For the LOCA event, the break locations and the break sizes are significantly less severe than the previously mentioned RCS double-ended breaks. The previously calculated subcompartment pressure of 6.4 psi is discussed in 14.3.5.4.1. The subcompartment pressure loadings have been evaluated and it has been determined that the loadings, including LBB and operation at 3216 MWt, are less than 6.4 psi. The peak differential pressure across the primary shield wall is bounded by the design pressure of 1000 psi, as discussed in Section 14.3.5.4.1. The effects of the differential operating parameters at 3216 MWt do not result in a challenge to the subcompartment designs.
14.3.5.5 Evaluation of Long Term Fan Cooler Capability The ability of the fan coolers to limit containment pressure following loss of the component cooling system has been examined. If the component cooling loop were lost for any reason during long-term recirculation, core subcooling could be lost and boiling in the core would begin.
Chapter 14, Page 131 of 218 Revision 20, 2006 OAG10000215_1486
IP2 FSAR UPDATE Since the cooling units of the fans are cooled by service water, the energy from the core would be removed from the containment via the fans.
The model employed in this analysis does not consider recirculation spray to operate and conservatively considers decay heat from the core to enter the containment as steam during the entire LOCA long-term transient. Therefore, the pressures calculated are not affected with a postulated component cooling system failure, because core energy is already postulated to enter the containment as boil off. Containment pressure at various times for the DEPS case with minimum safeguards is shown below:
Time After Accident Occurs 3 Fans (psig) 2 Fans (psig)
At 12 hr 20.2 29.9 At 1 day 17 25.6 At 1 week 12.6 17.9 14.3.5.6 Radiolytic Hydrogen Formation Radiolytic hydrogen formation is discussed in Section 6.8.3.
14.3.6 Environmental Consequences Of A Loss-Of-Coolant Accident Chapters 5 and 6 describe the protection systems and features that are specifically designed to limit the consequences of a major LOCA. The capability of the safety injection system for preventing melting of the fuel clad and the ability of the containment and containment cooling systems to absorb the blowdown resulting from a major loss of coolant are discussed in Section 14.3.4. The capability of the safeguards in meeting dose limits set forth in 10 CFR 50.67 was demonstrated as documented in this section.
For the Large Break Loss-of-Coolant Accident radiological consequences, an abrupt failure of the main reactor coolant pipe is assumed to occur. It is assumed that the emergency core cooling features fail to prevent the core from experiencing significant degradation (i.e. melting).
A portion of the activity that is released to the containment is assumed to be released to the environment due to the containment leaking at its design rate.
In the following sections, the expected activity is described and the containment and isolation features are discussed. Trisodium phosphate is used to control pH in the recirculation solutions, as described in Sections 6.3.2.1.2 and 6.3.2.2.12.
14.3.6.1 Effectiveness of Containment and Isolation Features in Terminating Activity Release The reactor containment serves as a boundary limiting activity leakage. The containment is steel lined and designed to withstand internal pressure in excess of that resulting from the design-basis LOCA (Chapter 5). All weld seams and penetrations are designed with a double barrier to inhibit leakage. In addition, the weld channel and penetration pressurization system supplies a pressurized nitrogen seal, at a pressure above the containment design pressure, between the double barriers so that if leakage occurred it would be into the containment (Section 6.5). The containment isolation system, Section 5.2, provides a minimum of two barriers in piping penetrating the containment. The isolation valve seal-water system, Section 6.6, provides a water seal at a pressure above containment design pressure in the piping lines that could be a source of leakage and is actuated on the containment isolation signal within 1 Chapter 14, Page 132 of 218 Revision 20, 2006 OAG10000215_1487
IP2 FSAR UPDATE min to terminate containment leakage. The containment is designed to leak at a rate of less than 0.1-percent per day at design pressure without including the benefit of either the isolation valve seal-water system or the weld channel and penetration pressurization system. The weld seams and penetrations are pressurized continuously during reactor operation causing zero outleakage through these paths.
14.3.6.1.1 Effectiveness of Spray System for Removal of Airborne Activity One train of the containment spray system is assumed to operate following the LOCA. The containment sprays are an effective means for removing airborne activity existing as aerosols or as elemental iodine. As discussed in Appendix 6A, the following spray removal coefficients have been determined for Indian Point Unit 2:
Aerosol Removal Injection spray mode of operation 4.4 h(1 Recirculation spray mode of operation 2.25 h(1 Once a OF of 50 is attained (i.e., when the airborne activity is reduced to 2% of the total activity released to the containment atmosphere), the spray removal coefficient is reduced by a factor of 10. For the Indian Point 2 analysis it is assumed that the sprays are terminated after the OF of 50 is reached for aerosols and that aerosol removal continues after that time due to sedimentation only. Consistent with this assumption, sprays are credited for 3.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the event.
Elemental Iodine Removal Injection spray mode of operation Recirculation spray mode of operation Once a OF of 200 is attained (i.e., when the airborne activity is reduced to 0.5% of the total activity released to the containment atmosphere), no additional removal of elemental iodine is assumed.
14.3.6.1.2 Deleted 14.3.6.1.3 Deleted 14.3.6.1.4 Sedimentation Removal of Particulates During spray operation credit is taken for sedimentation removal only in the unsprayed portion of the containment. It is assumed that containment spray operation is terminated at 3.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as discussed in Section 14.3.6.1.1. After spray operation is terminated sedimentation is credited throughout the containment.
Based on the Containment Systems Experiments (CSE) which examined the air cleanup experienced through natural transport processes, it was found that a large fraction of the aerosols were deposited on the floor rather than on the walls indicating that sedimentation was the dominant removal process for the test (Reference 86). The CSE tests determined that there was a significant sedimentation removal rate even with a relatively low aerosol concentration.
From Reference 86, even at an air concentration of 10 Ilg/m3, the sedimentation removal Chapter 14, Page 133 of 218 Revision 20, 2006 OAG10000215_1488
IP2 FSAR UPDATE coefficient was above 0.3 h(1. With 2.0-percent of particulates remaining airborne at the end of crediting spray removal, there would be in excess of 10,000 Ilg/m3 and an even higher sedimentation rate would be expected. The sedimentation removal coefficient is conservatively assumed to be only 0.1 h(1. It is also conservatively assumed that sedimentation removal does not continue beyond a OF of 1000.
14.3.6.2 Source Term The reactor coolant activity is assumed to be released over the first 30 seconds of the accident.
However, the activity in the coolant is insignificant compared with the release from the core and is not included in the analysis.
The use of NUREG-1465 (Reference 87) and Regulatory Guide 1.183 (Reference 92) source term modeling results in several major departures from the assumptions used in previous LOCA dose analyses from TID-14844 (Reference 88). Instead of assuming instantaneous melting of the core and release of activity to the containment, the release of activity from the core occurs over a 1.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> interval. Also, instead of considering only the release of iodines and noble gases, a wide spectrum of nuclides is taken into consideration. Table 14.3-43 lists the nuclides being considered for the LOCA with core melt (eight groups of nuclides). Table 14.3-43a provides the fission product release fractions and the timing/duration of releases to the containment as assumed in the analysis based on Regulatory Guide 1.183.
Instead of the iodine being primarily in the elemental form, the iodine is mainly in the particulate form (cesium iodide) and the fraction that is in the organic form is much smaller than in the earlier model. The iodine characterization from NUREG-1465 and Regulatory Guide 1.183 is 4.85% elemental, 0.15% organic and 95% particulate. The other groups of nuclides (other than the noble gases) all occur as particulates only.
14.3.6.2.1 Atmosphere Dispersion The offsite dispersion factors were calculated with the following meteorology and the model described in Reg. Guide 1.4 (Reference 67).
- a. Pasqual Type F, 1 m/sec wind speed, nonvarying wind direction, and volumetric building wake correction factor with C = 0.5 and the cross-sectional area of the containment structure for the first 8 hr.
- b. From 8 to 24 hr, Pasqual Type F, 1 m/sec wind speed with plume meander in a 22.5-degree sector.
- c. From 1 to 4 days, Pasqual Type F and 2 m/sec wind speed with a frequency of 60-percent Pasqual Type 0 and 3 m/sec wind speed with a frequency of 40-percent, with a meander in the same 22.5-degree sector.
- d. From 4 to 30 days, Pasqual Types C, 0, and F each occurring 33-1/3-percent of the time with wind speeds of 3 m/sec, 3 m/sec, and 2 m/sec, respectively, with a meander in the same 22.5-degree sector 33-1/3-percent of the time.
The radiological consequences analysis employs the dispersion factors listed in Table 14.3-46 for the site boundary and low population zone.
Chapter 14, Page 134 of 218 Revision 20, 2006 OAG10000215_1489
IP2 FSAR UPDATE 14.3.6.3 Method of Analysis The activity leaking from the containment following the accident is calculated for each isotope as a function of time taking into account the core activity, release fractions, removal in containment via sprays and sedimentation (as described previously) and the containment leak rate. The major assumptions and parameters used to determine the doses due to containment leakage are given in Table 14.3-49. To evaluate the ability to meet the 10 CFR 50.67 limits, the total effective dose equivalent (TEDE) dose was calculated at the site boundary and at the low population zone. Onsite exposure is evaluated in the control room. The TEDE dose is equivalent to the committed effective dose equivalent (CEDE) dose from inhalation of activity plus the effective dose equivalent (EDE) dose from submersion in the activity cloud for the duration of the exposure to the cloud.
14.3.6.3.1 Offsite CEDE Dose The CEDE dose resulting from activity leaking from the reactor containment following an accident is computed from:
D(I, T) = Q(I, T) . DCF(I) . B(T) . X Q(x,T)
Where:
D(I,T) = CEDE dose from isotope I during period T (rem)
Q(I,T) = activity of isotope I released in time period T (curies)
DCF(I) = CEDE dose conversion factor for isotope I (rem/curie) (See Table 14.3-45) 8(T) = breathing rate (m 3/sec)
X/Q(x,T)= atmospheric dispersion factor at distance x and during period T (sec/m3) 14.3.6.3.2 Offsite EDE Dose For the computation of the offsite EDE doses from cloud immersion, the following equation was used:
D(I, T) = Q(I, T) . DCF(I). X Q(x,T)
Where:
D(I,T) = EDE dose from isotope I during period T (rem)
Q(I,T) = activity of isotope I released in time period T (curies)
DCF(I) = EDE dose conversion factor for isotope (rem-m 3/curie-sec)
(See Table 14.3-45)
X/Q(x,T) = atmospheric dispersion factor (sec/m3) at distance x and during period T 14.3.6.4 Containment Leakage NUREG-1465 Core Release Doses The resultant site boundary dose is 17.8 rem TEDE. The low population zone dose is 12.1 rem TEDE.
The total large break LOCA offsite dose is the combination of the dose for the containment leakage pathway discussed above and the dose for the ECCS recirculation leakage pathway discussed in Section 14.3.6.6.
Chapter 14, Page 135 of 218 Revision 20, 2006 OAG10000215_1490
IP2 FSAR UPDATE 14.3.6.5 Control Room Dose Evaluations The control room is modeled as a discrete volume. The filtered and unfiltered inflow to the control room are used to calculate the activity in the control room. The control room parameters modeled in the analysis are presented in Table 14.3-50.
The control room CEDE dose from each isotope for each time period is:
D(I, T) = CONC(I, T) . DCF(I)* B(T)
Where:
D(I,T) =CEDE dose from isotope I during period T (rem)
CONC(I,T) =concentration of isotope I in the control room (Ci-sec/m 3 )
DCF(I) =CEDE dose conversion factor for isotope I (rem/curie) 8(T) = breathing rate (m 3/sec)
The control room EDE dose from each nuclide for each time period is:
D(I, T) = _1 CONC(I, T) . DCF(I)
GF Where:
D(I,T) = inhalation dose from isotope I during period T (rem)
DCF(I) = inhalation dose conversion factor for isotope I (rem-m 3/curie-sec)
CONC(I,T) =concentration of isotope I in the control room (Ci-sec/m 3 )
GF = geometry factor, calculated based on Reference 89 using the following equation, where V is the control room volume GF = 1173 V 0338 The ARCON96 computer code was utilized to analyze the XlQ (atmospheric dispersion factor) values at the control room intake for releases at Indian Point 2. This code was developed by Pacific Northwest National Laboratory for the United States Nuclear Regulatory Commission.
The ARCON96 analysis for Indian Point 2 required calculation of XlQ values for four locations: a containment surface leak, the side of the auxiliary boiler feedwater building, vent stacks on the roof of the auxiliary boiler feedwater building, and the containment vent. These correspond to potential release points for various accident scenarios. Additional conservatisms were added to the calculations:
- 1. The initial plume standard deviations used were equal to one-sixth of the width and available height of the containment.
- 2. The initial horizontal plume dimension for vent releases is the equivalent vent diameter divided by six
- 3. All vertical velocities were set to zero The XlQ values calculated for release of activity from the event-specific release point to the control room intake are used to determine the activity available at the control room intake, and are presented in Table 14.3-51.
The accumulated dose to control room operators following the postulated accidents were Chapter 14, Page 136 of 218 Revision 20, 2006 OAG10000215_1491
IP2 FSAR UPDATE calculated using the same release, removal and leakage assumptions as the offsite doses. The control room personnel dose calculations includes the direct dose from the radiation cloud outside the control room as well as the inhalation and acute doses from the activity introduced inside the control room. That direct dose takes into account the shielding afforded by the control room walls.
In addition to the dose from activity released from containment, the large break LOCA control room dose includes a conservative calculation of the direct whole-body gamma dose in the control room from the activity inside the containment. The activity is assumed to be homogeneously distributed within the free volume of the reactor containment. The source intensity as a function of time after the accident is determined considering decay and removal by processes described in Section 14.3.6.1. The direct dose rate in the control room due to the activity dispersed within the containment is calculated based on a point kernel attenuation model. The source region is divided into a number of incremental source volumes and the associated attenuation, gamma ray buildup, and distance through regions between each source point and the control room are computed. The summation of all point source contributions gives the total direct dose rate at the control room.
The control room doses calculated for each of the events are presented in table 14.3-52 and in all cases are less than the 5.0 rem TEDE control room dose limit values of 10 CFR 50.67.
14.3.6.6 External Recirculation The Indian Point Unit 2 design includes internal recirculation which is to be maintained for the first 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following a LOCA. An analysis has been performed to calculate the dose resulting from leakage from the ECCS outside containment after external recirculation is established at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The analysis models the same core iodine release model as the containment leakage releases discussed in Section 14.3.6.2, the same dose calculation method as discussed in Section 14.3.6.3 and the control room model discussed in Section 14.3.6.5.
The offsite dose is calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1. The anal is considered a leak rate of 4.0 . This is double the Technical The leakage is assumed to start at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and continues until 30 days from accident initiation. A conservatively low sump water volume is modeled to maximize the iodine concentration in the leakage.
The calculations were performed using the approach in Regulatory Guide 1.183 (Reference 92) guidance that if the calculated flash fraction is less than 10% or if the water is less than 212°F, then an amount of iodine smaller than 10% of the iodine in the leakage may be used if justified based upon actual sump pH history and ventilation rates. Iodine release fractions have been specifically calculated for external leakage sources (ECCS leakage post LOCA) beginning at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> post accident when ECCS flow is directed by procedure to go to portions of the external safety injection system. These calculations are based upon calculated post accident fluid temperatures and pH in sump water, flows and volumes in the primary auxiliary building (PAB),
and ventilation flow rates in various areas of the PAB. Leakage is assumed to be at 4 gph. The calculation was performed both with and without the boundary layer effect. The boundary layer effect credits the iodine concentration gradient across the boundary layer at the liquid-gas interface, thus lowering the equilibrium iodine concentration in the gas phase. The calculated values are:
Chapter 14, Page 137 of 218 Revision 20, 2006 OAG10000215_1492
IP2 FSAR UPDATE Fraction of Incoming Iodine Released Time Period With Boundary Layer Effect Without Boundary Layer Effect 6.5 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 0.012 0.12 8 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 0.00855 0.0855 1 to 4 days 0.00523 0.0523 4 to 30 days 0.003 0.03 The releases would be subject to filtration by the filtered ventilation system provided for the primary auxiliary building which houses the portions of the ECCS located outside containment.
However, filtration of the releases is not credited in the analysis.
Since the leakage is initiated at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the LOCA, it does not contribute to the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose. When boundary layers effects are considered the 30 day low population zone dose is 0.15 rem TEDE and the 30 day control room dose is 0.14 rem TEDE. When the boundary layer effects are neglected the doses increase to 1.5 rem at the low population zone and 1.36 rem in the control room.
The total large break LOCA offsite and control room doses are the combination of the doses for the containment leakage pathway discussed in Sections 14.3.6.4 and 14.3.6.5 and the doses for the ECCS recirculation leakage pathway discussed above.
The remainder of this section discusses the analysis performed prior to implementation of the Regulatory Guide 1.183 dose methodology and is retained for historical purposes.
Indian Point Unit 2 has an internal spilled coolant and injection water recirculation system incorporating two pumps for return of water to the reactor core for decay heat removal after a LOCA. The residual heat removal pumps serve as a backup to these pumps. The residual heat removal compartment and piping is surrounded by 2-ft-thick concrete shield walls. In addition, each residual heat removal compartment is shielded from its adjacent residual heat removal compartment and piping by 2-ft of concrete. Figure 14.3-129 shows the results of an evaluation of direct radiation levels surrounding a 14-in. residual heat removal pipe. The evaluation was based on gap activity, except noble gases, being diluted in the reactor coolant and refueling water volume, which is being recirculated through the pipes. With the 24-in. of concrete provided, the dose levels would be an order of magnitude less than shown for 12-in. of concrete.
As discussed in Section 6.2, design leakage for the external recirculation system was less that 1000 cm3/hr. Westinghouse performed experiments in which solutions of iodine in sodium hydroxide of pH that would exist in the containment after a loss of coolant were evaporated to dryness. The result was that less that 10-3 of the iodine was released. For purpose of conservatism, it was assumed that for a period of 1 hr, 10-percent of the iodine in the leakage was released to atmosphere. Assuming gap iodine activity immediately after the loss of coolant was present in the sump water being recirculated, the offsite thyroid dose for the period was less than 2 mrem. Protection from inhalation dose in the auxiliary building following an accident can be attained by the use of self-contained breathing apparatus during those periods when access is required.
Chapter 14, Page 138 of 218 Revision 20, 2006 OAG10000215_1493
IP2 FSAR UPDATE 14.3.6.7 Small Break LOCA Radiological Consequences The radiological consequences resulting from a small break LOCA which is large enough to result in actuation of the containment spray system would be bounded by the Large Break LOCA analysis. This is true because a small break releases less activity to the containment than that assumed in the large break, but the spray system would function in an identical manner.
An analysis was performed to determine the radiological consequences for a small break LOCA that does not actuate the containment sprays. As a result of the accident, fuel clad damage is assumed to occur. Due to the potential for leakage between the primary and secondary systems, radioactive reactor coolant is assumed to leak from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Radioactive reactor coolant is also discharged to the containment via the break. A portion of this radioactivity is released through containment leakage to the environment.
In determining the offsite doses following the accident, it is conservatively assumed that all of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Five percent of the core activity of iodines, noble gases, and alkali metals is assumed to be contained in the pellet-clad gap. The iodine released from the fuel is assumed to be 95%
particulate (cesium iodide), 4.85% elemental, and 0.15% organic. These fractions are used for the containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.
Conservatively, all the iodine, alkali metals group and noble gas activity (from prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.
The primary to secondary steam generator tube leak used in the analysis is 150 gpd per steam generator (total of 600 gpd).
When determining the doses due to containment leakage, all of the iodine, alkali metal and noble gas activity is assumed to be in the containment. The design basis containment leak rate of 0.1 % per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter, the containment leak rate is assumed to be one-half the design value, or 0.05% per day. Releases are continued for 30 days from the start of the event.
No credit for activity partitioning is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite power. All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere. Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.
An iodine partition factor in the steam generators of 0.01 curies/gm steam per curies/gm water is used. This partition factor is also used for the alkali metal activity in the steam generators.
This conservatively overstates the release of alkali metal activity via this pathway since their release would be limited by the moisture carryover fraction of 0.0025.
Chapter 14, Page 139 of 218 Revision 20, 2006 OAG10000215_1494
IP2 FSAR UPDATE For the containment leakage pathway, no credit is taken for containment spray operation which would remove airborne particulates and elemental iodine. Credit is taken for sedimentation of particulates and deposition of elemental iodine onto containment surfaces. The sedimentation coefficient is assumed to be 0.1 h(1, the same as credited in the large break LOCA analysis (see Section 14.3.6.1.4). Deposition removal of elemental iodine is determined using the model described in SRP Section 6.5.2 (Reference 68). The first order deposition removal rate constant for elemental iodine is written as follows:
where Ae = Elemental removal rate constant due to deposition, h(1 k = Mass transfer coefficient =4.9 m/hr A = Area available for deposition, ft2 V = Containment volume, fe Parameters for Indian Point Unit 2 are:
A = 250,000 ft26 V = 2.61 x 10 fe The resulting deposition removal coefficient is 1.5 h(1. Consistent with SRP Section 6.5.2, removal of elemental iodine is terminated when a OF of 200 is reached.
The resultant 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose is 7.8 rem TEDE. The 30 day low population zone dose is 10.8 rem TEDE. These doses are calculated using the meteorological dispersion factors discussed in Section 14.3.6.2.1. The offsite doses resulting from the accident are less than the 25 rem TEDE limit value of 10 CFR 50.67.
The accumulated dose to the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite dose, and using the control room model discussed in Section 14.3.6.5 and Tables 14.3-50 and 14.3-51.
The calculated central control room doses are presented in Table 14.3-52 and are less than the 5.0 rem TEDE control room dose limit values of 10CFR 50.67.
14.3.6.8 Summary and Conclusions The total large break LOCA offsite and control room doses are the combination of the doses for the containment leakage pathway discussed in Sections 14.3.6.4 and 14.3.6.5 and the doses for the ECCS recirculation leakage pathway discussed in Section 14.3.6.6. With boundary layer effects considered in the ECCS recirculation leakage analysis the total LOCA doses are 17.8 rem TEDE for the limiting 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose, 12.25 rem TEDE for the 30 day low population zone dose and 3.68 rem TEDE for the 30 day control room dose. Neglecting boundary layer effects in the ECCS leakage analysis has no impact on the limiting 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose, but increases the 30 day low population zone and control room doses to 13.6 rem TEDE and 4.9 rem TEDE, respectively.
The small break LOCA doses are 7.8 rem TEDE for the limiting 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose, 10.8 rem TEDE for the 30 day low population zone dose and 3.5 rem TEDE for the 30 day control room dose.
Table 14.3-52 lists the calculated control room doses for all the analyzed accidents and Chapter 14, Page 140 of 218 Revision 20, 2006 OAG10000215_1495
IP2 FSAR UPDATE demonstrates that the large break LOCA results in the highest control room doses.
Thus, the doses resulting from large break and small break LOCA the accidents are less than the 25 rem TEDE offsite dose limit and 5.0 rem TEDE control room dose limit values of 10 CFR 50.67. It is concluded that even with very pessimistic assumptions that do not take full credit for the safeguards systems provided, doses after a loss of coolant accident would be within the 10 CFR 50.67 limits.
REFERENCES FOR SECTION 14.3
- 1. U. S. Nuclear Regulatory Commission, Code of Federal Regulations - Energy, Title 10, Chapter 1, Part 50, Section 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors."
- 2. U. S. Nuclear Regulatory Commission, Reactor Safety Study - An Assessment of Accident Risks in U S. Commercial Nuclear Power Plants, WASH-1400 (NUREG 75/014), October 1975.
- 3. U.S. Nuclear Regulatory Commission, "Emergency Core Cooling Systems:
Revisions to Acceptance Criteria," Federal Register, Vol. 53, No.180, 1988.
- 4. F. M. Bordelon, et aI., SATAN-VI Program: Comprehensive Space-Time Dependent Analysis of Loss of Coolant,WCAP-8302(proprietary) and WCAP-8306 (nonproprietary), Westinghouse Electric Corporation, June 1974.
- 5. R. D. Kelly, et aI., Calculational Model for Core Reflooding After a Loss of Coolant Accident (WREFLOOD Code), WCAP-8170 (proprietary) and WCAP-8171 (nonproprietary), Westinghouse Electric Corporation, June 1974.
- 6. F. M. Bordelon, and E. T. Murphy, Containment Pressure Analysis Code (COCO), WCAP-8327 (proprietary) and WCAP-8326 (nonproprietary),
Westinghouse Electric Corporation, June 1974.
- 7. LOCTA-IV Program: Loss of Coolant Transient Analysis, WCAP-8301 (proprietary) and WCAP-8305 (nonproprietary), June 1974.
8.
- 9. Deleted
- 10. Deleted
- 11. Deleted
- 12. C. Eicheldinger, Westinghouse ECCS Evaluation Model, February 1978 Version, WCAP-9220-P-A (proprietary), and WCAP-9221-A (nonproprietary),
Westinghouse Electric Corporation, February 1978.
- 13. Deleted Chapter 14, Page 141 of 218 Revision 20, 2006 OAG10000215_1496
IP2 FSAR UPDATE
- 14. Deleted
- 15. NOTRUMP, A Nodal Transient Small Break and General Network Code, WCAP-10079-P-A, (proprietary) and WCAP-10080-A (non-proprietary), August 1985.
- 16. Westinghouse Small Break LOCA ECCS Evaluation Model Using the NOTRUMP Code, WCAP-10054-A, (proprietary) and WCAP-10081-A, (non-proprietary),
August 1985.
- 17. Westinghouse ECCS Evaluation Model Sensitivity Studies, WCAP-8341 (proprietary) and WCAP-8342 (nonproprietary), July 1974.
- 18. Westinghouse ECCS - Four Loop Plant (15 x 15) Sensitivity Studies With Upper Head Fluid Temperature at T Hot, WCAP-8855-A (nonproprietary), May 1977.
- 19. R. E. Schwirian, et aI., "Westinghouse Methodology for Evaluating the Acceptability of Baffle-Former-Barrel Bolting Distributions Under Faulted Load Conditions",
WCAP-15029-P-A, (Westinghouse Proprietary Class 2), and WCAP-15030-NP-A, (Non-Proprietary), January 1999.
- 20. Letter from Donald S. Brinkman, USNRC to Mr. Stephen B. Bram Nuclear Power Consolidated Edison Company, dated February 23, 1989, "Safety Evaluation of Elimination of Dynamic Effects of Postulated Primary Loop Pipe Ruptures from Design Basis for Indian Point Unit 2 (TAC No* 68318) Docket No. 50-247."
- 21. Takeuchi, et aI., "MULTIFLEX 3.0 A FORTRAN IV Computer Program for Analyzing Thermal-Hydraulic-Structural System Dynamics Advanced Beam Model," WCAP-9735, Revision 2, (Westinghouse Proprietary Class 2), and WCAP-9736, Revision 1, (Non-Proprietary), February 1998.
- 22. Benchmark Problem Solutions Employed for Verification of the WECAN Computer Program, WCAP-8929, June 1977.
- 23. Fritz, R.J., "The Effects of Liquids on the Dynamic Motions of Immersed Solids",
Trans. ASME, Journal of Engineering for Industry, 1972, pp. 167-173.
- 24. Takeuchi, K., et aI., MULTIFLEX, A FORTRAN IV Computer Program for Analyzing Thermal-Hydraulic Structure System Dynamics, WCAP-8708-PA (Westinghouse Proprietary Class 2), WCAP-8709-A (Non-Proprietary),
September 1977.
- 25. R. Salvatori, Pipe Breaks for the LOCA Analysis of the Westinghouse Primary Coolant Loop, WCAP-8082-PA (Westinghouse Proprietary Class 2), WCAP-8172 (Non-Proprietary), January 1975.
- 26. C. Boyd, N. Singleton, M. Hankinson, A. Fakhri, F. Klonica, A. Kuenzel, D.
Bhandri, D. Altman, Electricite de France 1300 MWe Plants Reactor Internals Functional Criteria, Volume 2, WCAP-15012, December 1997.
- 27. R. Salvatori, Topical Report - Indian Point Unit 2 Reactor Internals Mechanical Analysis for Blowdown Excitations, WCAP-7332-L-AR, November 1973.
Chapter 14, Page 142 of 218 Revision 20, 2006 OAG10000215_1497
IP2 FSAR UPDATE
- 28. Deleted
- 29. Deleted
- 30. Westinghouse Electric Corporation, Creep Rupture Tests of Type 304 Stainless Steel Weldments with Central Axial Welds of Type 304 Stainless Steel at 593°C, WCAP-5890, Revision 1.
- 31. T. Tagami, Interim Report on Safety Assessments and Facilities Establishment Project in Japan for Period Ending June 1965 (No.1).
- 32. Deleted
- 33. W. H. McAdams, Heat Transmission, 3rd Edition, McGraw-Hili Book Company, Inc., New York, 1954.
- 34. E. R. G. Eckert and P. M. J. Drake, Heat and Mass Transfer, McGraw-Hili Book Company, Inc., New York, 1959.
- 35. D. Q. Kern, Process Heat Transfer, McGraw-Hili Book Company, Inc., New York, 1950.
- 36. T. H. Chilton and A. P. Colburn, "Mass Transfer (Absorption) Coefficients Prediction from Data on Heat Transfer and Fluid Friction," Imd. Eng. Chem., No.
26,1934, pp. 1183-1187.
- 37. S. Weinberg, Proc. Inst. Mech. Engr., Vol. 164, 1952, pp. 240-258.
- 38. W. Ranz and W. Marshall, Chem. Engr., Prog. Vol. 48, No.3, 1952, pp. 141-146 and Vol. 48, No.4, pp. 173-180.
- 39. J. Perry, Chemical Engineers Handbook, 3rd Edition, McGraw-Hili Book Company, Inc., 1950.
- 40. E. Eckert and J. Gross, Introduction to Heat and Mass Transfer, McGraw-Hili Book Company, Inc., 1963.
- 41. Deleted
- 42. Deleted
- 43. L. F. Parsly, "Design Considerations of Reactor Containment Spray Systems -
Part VI, The Heating of Spray Drops in Air-Steam Atmospheres," ORNL-TM-2412, Part VI, January 1970.
- 44. Deleted
- 45. Deleted
- 46. Deleted Chapter 14, Page 143 of 218 Revision 20, 2006 OAG10000215_1498
IP2 FSAR UPDATE
- 47. Deleted
- 48. Deleted
- 49. Deleted
- 50. Deleted
- 51. Deleted
- 52. Deleted
- 53. Deleted
- 54. Deleted
- 55. Kelly, et aI., Westinghouse Emergency Core Cooling System Evaluation Model for Analyzing Large LOCA's During Operation with One Loop Out of Service for Plants Without Loop Isolation Valves, WCAP-9166, February 1978.
- 56. Deleted
- 57. Deleted
- 58. Deleted
- 59. "Westinghouse Small Break LOCA-ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP-11145-P-A, (proprietary), October 1986.
- 60. Amendment No. 126, Facility Operating License No. DPR-58 (TAC No. 7106), for D.C. Cook Nuclear Plant Unit 1, Docket No. 50-315, June 9,1989.
- 61. Westinghouse Electric Corporation, Westinghouse LOCA Mass and Enerav Release Model for Containment Design-March 1979 Version, WCAP-10325-P-A, May 1983.
- 62. Shepard, et. aI., Topical Report Westinghouse Mass and Energy Release Data For Containment Design, WCAP-8264-PA (proprietary), WCAP-8312-A (non-proprietary), Revision 1, August 1975.
- 63. Deleted
- 65. WCAP-10977, "Technical Bases for Eliminating Large Primary Loop Pipe Rupture as the Structural Design Basis for Indian Point Unit 2," Original -
November 1985, Rev. 1 - March 1986, Rev. 2 - December 1986.
Chapter 14, Page 144 of 218 Revision 20, 2006 OAG10000215_1499
IP2 FSAR UPDATE
- 66. WCAP-10977 Supplement 1, "Additional Information in Support of the Technical Justification for Eliminating Large Primary Loop Pipe Rupture as the Structural Design Basis for Indian Point Unit 2," January 1989.
- 67. USNRC Regulatory Guide 1.4., Rev. 2, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss-of-Coolant Accident for Pressurized Water Reactors," July 1974.
- 68. NUREG-0800, Standard Review Plan 6.5.2, "Containment Spray as a Fission Product Cleanup System", Rev. 2, December 1988.
69.
- 70. Davidson, S. L., and Nuhfer, D. L. (Ed.), "VANTAGE+ Fuel Assembly Reference Core Report," WCAP-12610, (Proprietary), June 1990.
- 71. "Westinghouse ECCS Evaluation Model October 1975 Version," WCAP-8622, (Proprietary), November 1975 and WCAP-8623, (Non-proprietary),November
- 72. Westinghouse Letter NS-EPR-2538 From E. P. Rahe of Westinghouse to R Tedesco and T. P. Speisof USNRC, December 22, 1981.
- 73. Davidson, S. L., et aI., "Extended Burnup Evaluation of Westinghouse Fuel",
WCAP-10125-P-A, (Proprietary), December, 1985 and WCAP-10126-A, (Non-proprietary), December, 1985.
- 74. USNRC Regulatory Guide 1.157, "Best-Estimate Calculations of Emergency Core Cooling System Performances," 1989.
- 75. Bajorek, S. M. et. aI., 1998, "Westinghouse Code Qualification Document for Best Estimate Loss of Coolant Accident Analysis," WCAP-12945-P-A (Proprietary), Volume I, Revision 2, and Volumes II - V, Revision 1 and WCAP-14747 (Non-proprietary).
- 76. Letter from N. J. Liparulo, Westinghouse, to R. C. Jones, USNRC, "Revisions to Westinghouse Best-Estimate Methodology," NTD-NRC-95-4575, October 13, 1995.
- 77. Boyack, B., et.al., "Qualifying Reactor Safety Margins: application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, "NUREG/CR-5249, 1989.
78.
Chapter 14, Page 145 of 218 Revision 20, 2006 OAG10000215_1500
IP2 FSAR UPDATE 79.
- 80. "Clarification ofTMI Action Plan Requirements," NUREG-0737, November, 1980.
- 81. NRC Generic Letter 83-35 from D. G. Eisenhut, "Clarification of TMI Action Plan Item II.K.3.31," November 2,1983.
- 82. M. Y. Young, J. S. Ivey, "Westinghouse Methodology for Implementation of 10CFR 50.46 Reporting," WCAP-13451, October 1992.
- 83. Not Used
- 84. Letter from Patrick D. Milano, USNRC, to Mr. A. Alan Blind, ConEd, "Indian Point Nuclear Generating Unit No. 2 - Re: Issuance Of Amendment Affecting Containment Air Filtration, Control Room Air Filtration, And Containment Integrity During Fuel Handling Operations (TAC NO. MA6955)", dated July 27,2000.
- 85. B. W. Gergos, W. H. Slagle, "Con Edison Reload Safety Evaluation Indian Point Nuclear Plant Unit2 Cycle 11," June 1991.
- 86. Industry Degraded Core Rulemaking (lDCOR) Program Technical Report 11.3, "Fission Product Transport in Degraded Core Accidents," Atomic Industrial Forum, December 1983.
- 87. NUREG-1465, "Accident Source Terms for Light-Water Nuclear Power Plants,"
February 1995, U.S. Nuclear Regulatory Commission.
- 88. TID-14844, "Calculation of Distance Factors for Power and Test Reactor Sites,"
U.S. AEC, Division of Licensing and Regulation, J. J. DiNunno, et ai, March 23, 1962.
- 89. K. G. Murphy and K. W. Campe, "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19," published in Proceedings of 13th AEC Air Cleaning Conference, Atomic Energy Commission (now NRC),
August 1974.
- 90. p~l~t~cl
- 91. WCAP-15704, Control Rod Insertion Following a Cold Leg LOCA, Generic Analyses for 3-Loop and 4-Loop Plants, October 2001.
- 92. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
- 93. Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COS I Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), July 1997 and WCAP-10081-NP, Addendum 2, Revision 1 (non-Proprietary), August 1995.
Chapter 14, Page 146 of 218 Revision 20, 2006 OAG10000215_1501
IP2 FSAR UPDATE TABLE 14.3-1 l...argeBreaJ<UOGASegdericeOfEveritsf6fUffiitiridPCWWrarisierit TABLE 14.3-2 Large-Break Containment Data Net free volume 2.61 x 10 -ft Initial conditions Pressure 14.7 psia Temperature Refueling water storage tank temperature Service water temperature Outside temperature Spray system Number of pumps operating 2 Total flow rate 1$712gpm Actuation time 20 sec Safeguards fan coolers Number of fan coolers operating 5 Fastest postaccident initiation of fan coolers 30 sec Chapter 14, Page 147 of 218 Revision 20, 2006 OAG10000215_1502
IP2 FSAR UPDATE TABLE 14.3-2 (Cont.)
Large-Break Containment Data Structural heat sinks Thickness (in.) Area (ft2)
- 1. 0.007 paint, 0.375 steel, 54.0 concrete $&,$&4-
- 2. 0.007 paint, 0.5 steel, 42.0 concrete 28,613
- 3. 12.0 concrete 15,000
- 4. 0.375 stainless steel, 12.0 concrete 10,000
- 5. 12.0 concrete 61,000
- 6. 0.5 steel 68,792
- 7. 0.007 paint, 0.375 steel 81,704
- 8. 0.25 steel 27,948
- 9. 0.007 paint, 0.1875 steel 69,800
- 10. 0.125 steel 3,000
- 11. 0.138 steel 22,000
- 12. 0.0625 steel 10,000
- 13. 0.019 stainless steel, 1.25 insulation, 785 0.75 steel, 54.0 concrete
- 14. 0.019 stainless steel, 1.25 insulation 6,849 0.5 steel, 54.0 concrete
- 15. 0.025 stainless steel, 1.5 insulation 9,7~4 0.5 steel, 54.0 concrete
- 16. 0.025 stainless steel, 1.5 insulation 4362 0.375 steel, 54.0 concrete
- 17. 7f1QQ
- 18. 24 Chapter 14, Page 148 of 218 Revision 20, 2006 OAG10000215_1503
IP2 FSAR UPDATE Chapter 14, Page 149 of 218 Revision 20, 2006 OAG10000215_1504