ML13330A336

Provides Draft SEP Topic Assessments for Design Basis Events,Per 810407 Commitment.Assessments for Topics XV-1, XV-2,XV-3,XV-5,XV-6,XV-7,XV-8,XV-10,XV-12,XV-14,XV-15 & XV-19 Encl.Remaining Assessments Will Be Provided by 810730

ML13330A336
Person / Time
Site:	San Onofre
Issue date:	07/01/1981
From:	Moody W Southern California Edison Co
To:	Crutchfield D Office of Nuclear Reactor Regulation
References
TASK-15-01, TASK-15-02, TASK-15-03, TASK-15-05, TASK-15-06, TASK-15-07, TASK-15-08, TASK-15-1, TASK-15-10, TASK-15-12, TASK-15-14, TASK-15-15, TASK-15-19, TASK-15-2, TASK-15-3, TASK-15-5, TASK-15-6, TASK-15-7, TASK-15-8, TASK-RR NUDOCS 8107060326
Download: ML13330A336 (29)

Text

Southern California Edison Company P. 0. BOX 800 2244 WALNUT GROVE AVENUE ROSEMEAD, CALIFORNIA 91770 W. C. MOODY TELEPHONES MANAGER, NUCLEAR LICENSING July 1, 1981 (213) 572-1817 (213) 572-1806 Director, Office of Nuclear Reactor Regulation Attention: D. M. Crutchfield, Chief Operating Reactors Branch No. 5 Division of Licensing U. S. Nuclear Regulatory Commission Washington, D.C. 20555 JUL Gentlemen:

Subject:

Design Basis Event Reviews Systematic Evaluation Program San Onofre Nuclear Generating Station Unit 1 Our letter of April 7, 1981, indicated our intention to provide draft topic assessments for 14 of the design basis event SEP topics by June 30, 1981. Enclosed are the draft assessments for SEP Topics XV-1, XV-2, XV-3, XV-5, XV-6, XV-7, XV-8, XV-10, XV-12, XV-14, XV-15, and XV-19. As discussed with the NRC staff, the remainder of the DBE topic assessments will be provided by July 30, 1981.

If you have any questions on any of these draft topic assessments or require additional information, please let me know.

Very truly yours, Enclosure

ENCLOSURE DRAFT TOPIC ASSESSMENT FOR DESIGN BASIS EVENTS SAN ONOFRE NUCLEAR GENERATING STATION UNIT 1 This report provides a discussion of the Systematic Evaluation Program (SEP)

Design Basis Events (DBE's) for San Onofre Unit 1. The DBE's encompass SEP topics XV-1 through XV-24. Each of the topics applicable to San Onofre Unit 1 is addressed in this report, with the exception of those topics deleted from consideration in the SEP (XV-21 through XV-24).

In accordance with previous NRC correspondence (e.g.,.NUREG-0485 and NRC draft evaluation for Palisades), the DBE's have been grouped according to similar events for ease of review. To the extent possible, the evaluations are based on existing analyses on the San Onofre Unit 1 docket. A comprehensive list of references for analyses on the docket is also provided.

Where an analysis does not exist for a particular event, a discussion is provided which relates the consequences of this event with those from analyzed events.

1.0 Group I Events (PWR)

The Group I events occur with moderate frequency and involve either a decrease in the reactor coolant temperature or a decrease in core shutdown margin.

1.0 Decrease in Feedwater Temperature (XV-1)

Introduction A reduction in feedwater temperature can result from loss of one of several feedwater heaters. The loss could be due to interruption of steam extraction flow or to an opening of a feedwater heater bypass line. A decrease in feedwater temperature will cause a decrease in the temperature of the reactor coolant, an increase in reactor power due to the negative moderator temperature coefficient and a decrease in the reactor coolant system and steam generator pressures.

Criteria The criteria for evaluating the decrease in feedwater temperature are given in Standard Review Plan Sections 15.1.1 through 15.1.4., The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage and system pressure are met.

Evaluation The licensee did not analyze this transient. However, the loss of any of the low pressure heaters located upstream of the feedwater pumps will produce only a small effect (i.e., less than 64 Btu/lb) due to the corresponding effect of the high pressure heater in that train. The high pressure heater increases the feedwater enthalpy by 82.6 Btu/lb.

The loss of both high pressure heaters will then cause a 780F decrease in the feedwater temperature. It is estimated that the corresponding change of the inlet temperature in the reactor coolant will be about loF.

Consequently, this temperature reduction is considered no worse than the case of excess feedwater addition to be discussed in the next section.

The temperature response to the cold feedwater is attenuated by the.

thermal capacity of the Reactor Coolant and Steam Systems. If reactor control is unable to maintain plant conditions within the protection limits during the transient, the overpower or variable low pressure protection will cause a reactor trip without core damage.

Conclusion The decrease in feedwater temperature is not the most limiting case involving an unplanned increase in heat removal by the secondary system. If the transient were to occur, trip signals generated from information provided by the Reactor Control and Protection System would assure that fuel design and system pressure limits as specified in the acceptance criteria will not be exceeded.

1.2 Increase in Feedwater Flow (XV-1)

Introduction An increase in feedwater flow can result from excessive opening of the feedwater control valve, overspeed of a feedwater pump, or starting a second feedwater pump. The sharp increase in feedwater flow will cause more heat to be extracted by the steam generator, which in turn causes a power increase through negative reactivity feedback when colder water reaches the core.

Criteria The criteria for evaluating an increase in feedwater flow are the same as the case of decrease in feedwater temperature.

Evaluation The most severe case of excess feedwater addition while at full power was analyzed in Section 7.4.3 of Reference 1. This case was reanalyzed for a reload core in Section 5.2.4 of Reference 2. This reference also analyzed the case of a second pump starting and causing an increase in feedwater flow from 43% to 103% with power initially at a maximum of 51%

power.

The assumptions used in the analysis are in compliance with the acceptance criteria. Furthermore, no credit was taken for automatic control action or for manual intervention by the plant operators in a detailed analog simulation. The results of both cases show that the magnitude of changes in core temperature and power is small.

The change occurs with no overshoot and the system response is within the core limits one minute after the transient takes place. The core never approaches a DNB limit during the transients.

Conclusion With respect to excessive feedwater flow, there are adequate margins to accommodate the magnitude of changes in core temperature and power. The rate of change for core power is slower than the response time of the reactor protection system and a more negative moderator coefficient has only a small effect on the nuclear transient. As a result, an overshoot in core power is not predicted. If the perturbation were great enough to require core protection, the overpower and variable low pressure protection would cause a reactor trip to prevent the transient from reaching the core limits.

It is concluded that the analysis meets current criteria and is acceptable.

1.3 Increase in Steam Flow (XV-1)

Introduction An increase in steam flow may be initiated by opening of the turbine control valves. Power increases as a result of the negative moderator temperature coefficient, and primary temperatures and both primary and secondary pressures decrease. The Reactor Control and Protection System is designed to accommodate step load increases of the order of 10 percent without a reactor trip. Turbine control valve opening is limited by the turbine governor control and the turbine load limit control which is preset above operating load but not to exceed rated load. Very large load increases, however, are further protected by the combination of the variable low pressure trip and the nuclear overpower trip.

Criteria The criteria for evaluating the increase in steam flow or excess load increase are the same as the case of decrease in feedwater temperature.

Evaluation The most severe transient resulting from a sudden load increase of more than 30% by the turbine governor control while operating at 70% load was analyzed in Section 7.4.4 of Reference 1. The analysis is determined' from a detailed analog plant simulation using a maximum positive moderator temperature coefficient and a low Doppler coefficient. It also takes into account the turbine generator load limit with the automatic tracking feature. If the reactor control is unable to maintain the plant conditions within the preset values shown in Figure 7.8 of Reference 1 after a load increase, a reactor trip will result and no DNB can occur.

Conclusion The preset overpower and overtemperature conditions are in compliance with the acceptance criteria. The resulting transient will not exhibit excessive temperature or pressure excursions nor will it trip the reactor under the postulated conditions. In addition, the coolant temperature and pressure will continue to decrease until the variable low pressure trip is reached. It is concluded that the analysis meets current criteria and is acceptable.

1.4 Inadvertent Opening of Steam Generator Relief/Safety Valve (XV-1)

Introducti on An atmospheric dump valve may be inadvertently opened by the operator or may open due to failure in the control system that opens the valve. A steam generator safety valve may be opened only as a result of a valve failure. The consequences of an inadvertent opening of either valve have the same effect as a small break in the steam line.

Criteria The criteria for evaluating the inadvertent opening of a steam generator relief/safety valve are the same as the case of decrease in feedwater temperature. However, Westinghouse has also adopted the specific criterion that the core will remain subcritical throughout the transient.

Evaluation For San Onofre Unit 1, there are two main steam lines each carrying one-half of the total steam generated by three steam generators. Each main steam line has a branch with two atmospheric dump valves and five spring-loaded safety valves. In addition, there is a condenser bypass valve on each main steam line for direct discharge of steam to each corresponding condenser. When the condenser is not available, the atmospheric dump valves must be used. The atmospheric dump valves exhaust to the atmosphere, as do the safety valves. The combined capacity of the atmospheric dump and condenser bypass valves is 35% of rated full power steam flow.

The opening and closing of the atmospheric dump and condenser bypass valves are controlled by the steam dump controller which is split-ranged to close the atmospheric dump valves completely before beginning to close the condenser bypass valves. The initiation of steam dump operation occurs when both types of valves are opened fully due to an error signal between the rapidly decreasing Tref and the Reactor Coolant System Tavg Tref is automatically adjusted by the Reactor Control and Protection System. At hot standby or shutdown conditions unplanned opening of the atmopheric dump valves could occur because of malfunction of the steam dump controller or because of lowTref in the controller. This latter failure would result in a partial opening of the valves, which would close again when Tavg dropped to the reference setpoint. At full load, the valves could be opened if the circuit between the controller and the atmospheric dump valves is closed, so that the temperature program will cause the atmospheric dump valves to open fully.

Unplanned opening of the atmospheric dump valves has been analyzed in conjunction with the analysis of steam line break and is documented in Reference 1. The most severe transient occurs at hot shutdown conditions. This transient will result in a much slower depressurization of the steam generator. The subsequent reactivity insertion rate due to cooldown is also small.

The analysis for the reload core (Reference 9) also accounts for higher values of feedwater flow.

If the reactor were critical or operating at power at the time of a steam release, the reactor would be tripped by the normal high nuclear flux protection. Following the trip at power, the Reactor Coolant System contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel.

The additional stored energy will then be removed via the cooldown initiated by the transient and eventually the Reactor Coolant System will reach no load condition. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the Reactor Coolant System cooldown are less for this transient occurring at power.

The inadvertent opening of a safety valve may be attributable to a valve failure. Each of the ten safety valves passes only 10% of rated full power steam flow. This transient was also analyzed in conjunction with the analysis of steam line break and is documented in Reference 9, 10, 13, 14, and 17.

Its consequences are no worse than the analysis of inadvertent opening of atmospheric dump valves.

Conclusion The results of the referenced analyses show that the core will remain subcritical throughout the transient under the most pessimistic initial conditions including conservatively high values of feedwater flow for hot shutdown at time zero. It is concluded that the analyses meet current criteria and are acceptable.

1.5 Startup of an Inactive Loop (XV-9)

This topic has been reviewed and evaluated by the staff per Reference 22.

1.6 System Malfunction Causing Boron Dilution (XV-10)

Introduction Reactivity can be added to the reactor with the Chemical and Volume Control System by feeding a more dilute solution of boric acid into the Reactor Coolant System than is present in the reactor coolant.

Improper boron dilution via the Chemical and Volume Control System can be initiated by operator actions accompanied by a single equipment failure.

Criteria The criteria for evaluating the system malfunction causing boron dilution are given in Standard Review Plan Section 15.4.6. The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage and system pressure are met and adequate time is allowed for the operator to terminate the dilution before the shutdown margin is eliminated.

Evaluation Since boron dilution is conducted under strict procedural controls which specify limits on the rate and magnitude of any required change in boron concentration, the probability of a sustained or erroneous dilution is very low. An analysis was performed in Section 7.3 of Reference 1 to verify the adequacy of the design under the limiting cases of reactor transients which could result from improper boron dilution. The analysis accounts for these transients at power as well as at hot standby or cold shutdown conditions. This issue was also addressed in References 23, 24 and 25.

0 0

A maximum reactivity insertion rate of one pcm per second is assumed in the analysis for estimating the time interval required to reach criticality from shutdown. In practice, however, the equivalent rate of reactivity insertion resulting from the maximum rate of boron dilution achievable with the Chemical and Volume Control System is less than this value under conservative conditions. Consequently, it would require continuous dilution at the maximum rate of 90 gpm with this postulated reactivity insertion rate to lose 2.3 percent shutdown (Reference 10) in approximately 40 minutes at the cold shutdown condition. An additional 17 minutes are available for hot standby because of the additional one percent shutdown. Under these shutdown conditions, the boron concentration will be periodically sampled and the source range channels will also indicate any increase in neutron flux level.

Furthermore, there are numerous alarms and indications to alert the operator of the status of the Chemical and Volume Control System. Therefore, there is considerable time for the operator to evaluate and correct the situation by several alternate means to maintain a safe shutdown margin if dilution should occur during shutdown.

If the reactor is at power, uncontrolled reactivity addition by boron dilution would behave like a slow control rod withdrawal and is thus bounded by the rod withdrawal analysis discussed in Sections 6.1 and 6.2 of the Standard Review Plan. Nevertheless, the analysis shows that the Reactor Control and Protection System will actuate a rod insertion alarm signal at a programmed limit to assure an adequate shutdown margin under automatic control.

Improper boron dilution will result in a slow rise in reactor power and coolant temperature under manual control.

This slow transient would be terminated by the variable low pressure reactor trip, assuming the control board indications and alarms on coolant temperature were ignored.

Conclusion The maximum boron dilution rate to be attained with the Chemical and Volume Control System is limited by design to a rate very small with relation to the ability of the control rods to change reactivity. The analysis and results show that the acceptance criteria can be met. The excess shutdown, coupled with the inherent limit on reactivity insertion by dilution, provides the operator with adequate time to add boron as necessary by one of several alternate means for maintaining a safe shutdown margin.

The core is protected by the variable low pressure trip if boron dilution continues at power without compensating control group insertion.

2.0 Group II Events (PWR)

The Group II events occur with moderate frequency (except for feedwater line breaks) and involve a decrease in heat removal by the secondary system.

IC 0

2.1 Loss of External Load (XV-3)

Introduction A loss of load can result from many causes. The most likely source of a complete loss of load is a turbine generator trip. A partial loss of load may result from turbine governor response to a sudden increase in frequency of the distribution network. A rapid and large reduction in generator load will produce a significant reduction in the heat removal rate of the Reactor Coolant System. If the decrease is greater than what the system is designed to accept in the event of no protective action, the resultant increase in reactor coolant temperature and pressure could exceed the normal core operating limits.

Criteria The criteria for evaluating the loss of external load/turbine generator trip are given in Standard Review Plan Sections 15.2.1 through 15.2.5.

The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage and system pressure are met.

Evaluation San Onofre Unit 1 is designed to accept a 30 percent step reduction from full load and 50 percent step reduction from 395 Mwe load without reactor trip. Both atmospheric dump and condenser bypass valves will be used to release steam automatically. However, a 10 percent step reduction of full load would not require steam release.

The greater the magnitude of the sudden load decrease, the more severe are the system transients. The Reactor Control and Protection System and steam release to the atmosphere and condenser, if in automatic control, will respond to try to limit temperature and pressure excursions. If the load decrease is within their capability, equilibrium system conditions are restored at the reduced load without further incident. If the load decrease exceeds the capability of these systems, or if the systems are in manual control, a reactor trip will be initiated by the variable low pressure set point as well as high pressurizer pressure and/or level set points to protect the core from DNB. Automatic reactor control and/or steam dump are not.required as a design basis for the safety of the plant.

A complete loss of load with a reactor trip was analyzed as part of the complete and detailed plant analog simulation study in Section 8.6 of Reference 1. The analysis employs a maximum positive moderator temperature coefficient and the smallest Doppler coefficient in absolute value to determine margins to core protection limits and to establish pressure relieving requirements for the Reactor Coolant and Turbine Cycle Systems. No credit for steam release to the atmosphere and condenser and for the beneficial effect of spray and relief valves in reducing or limiting pressurizer pressure is assumed in the analysis.

The reactor is assumed to be in manual control without control rod insertion. Adverse instrument errors are also considered in initial operating conditions.

These assumptions for initial conditions and parameters result in the maximum power difference for the load loss, minimum pressurizer water level, and minimum margin to core protection limits at the initiation of the transient.

In practice, the reactor would actually be tripped immediately upon a turbine trip from a signal derived from turbine autostop oil pressure based on a two-out-of-three coincidence principle. There would be no temperature or pressure increase in the Reactor Coolant System.

Nonetheless, the analysis and results show that the pressurizer and steam generator safety valves will act to keep primary and secondary pressures below design limits. The pressure transient will cause the safety valves to open at seven (7) and twelve (12) seconds respectively for the steam generator and pressurizer. -The maximum surge of 25 cubic feet is well below filling the 1,300 cubic foot pressurizer volume. If the reactor is assumed to continued at power, it will then be tripped from the high pressurizer water level at 34 seconds. On the other hand, the fixed high pressure trip set point at 2,250 psia will limit the transient at approximately seven (7) seconds to prevent DNB in the core. The minimum DNBR with the high pressure reactor trip is found to be 1.55 which is in excess of the design limit of 1.30. The maximum overpower trip level with errors is 118 percent which also exceeds the minimum possible trip set point of 103 percent., Thus the overpower could result in a trip to limit the transient.

In operation the pressurizer pressure would be rapidly reduced to approximately 2,150 psia by the power operated relief valves and by pressurizer spray. The reduced pressure, in conjunction with the elevated reactor coolant temperature, would result in a variable low pressure reactor trip, a further protective feature for this most limiting transient.

Conclusion The complete loss of load, without a direct and immediate reactor trip, resents no hazard to the integrity of the Reactor Coolant and Turbine ycle Systems, even under the very conservative assumptions. Pressure relieving devices incorporated in the two systems are more than adequate to limit the maximum pressures. The integrity of the core is maintained by the fixed high pressurizer pressure trip for the complete loss of load under very conservative conditions which are in compliance with the acceptance criteria. The analysis and results show that the core will be protected from DNB during the transient. It is concluded that the analysis meets current criteria and is acceptable.

2.2 Turbine Trip (XV-3)

The turbine trip event is assessed in the preceding section as part of the loss of load transient.

2.3 Loss of Condenser Vacuum (XV-3)

The consequences of a loss of condenser vacuum become identical to those of a turbine trip since loss of vacuum results in loss of the condenser and thus of the heat sink for the turbine. The atmospheric dump valves will automatically open to release steam. No separate analysis was performed for this transient. The analysis discussed in the preceding section for the loss of load is applicable.

2.4 Steam Pressure Regulator Failure (Closed) (XV-3)

Steam flow to the turbine is controlled by the turbine generator control system. A malfunction in the control system resulting in zero demand for the turbine would lead to closure of the turbine control valves to initiate load rejection. Excess steam flow is automatically transferred to the condenser via the condenser bypass valves on high steam pressure. The atmospheric dump valves would also be available to relieve pressure. The safety valves are the ultimate means of removing the heat out of the steam generators. Consequences of this event are considered to be covered by the analysis discussed in the preceding section in which a complete loss of load witout automatic reactor control and/or steam dump has been analyzed in detail.

Control failures resulting in an increase in steam flow are considered in the section of increase in steam flow.

2.5 Loss of Feedwater Flow (XV-5)

Introduction A loss of feedwater flow results in a reduction in the capability of the secondary system to remove the heat generated in the reactor core. As, steam generator water levels decrease, the primary pressure and temperature begin to increase and pressurizer water level increases.

This trend continues until the heat removal capability of the auxiliary feedwater (AFW) is sufficient to remove the decay heat and reactor coolant pump heat, reducing primary pressure and temperature and preventing significant loss of water from the RCS.

If loss of offsite power is assumed, the decrease in heat removal by the secondary system is accompanied by a flow coastdown which further reduces the capacity of the primary coolant to remove heat from the core. In this case natural circulation capability of the RCS removes residual and decay heat from the core aided by the AFW system.

0 0

Criteria Acceptance criteria for this event are specified in Standard Review Plan Section 15.2.7. However, Westinghouse has adopted the following more restrictive acceptance criteria for ease in interpreting the transient results following a loss of normal feedwater:.

1. The pressurizer shall not become water solid following a loss of normal feedwater or station blackout (loss of offsite power) event.

This criteria assures that overpressurization of the RCS or significant loss of water from the RCS will not occur.

Evaluation This event was not originally analyzed in Reference 1 to determine system response. However, Reference 1 stated that the AFW system design basis was that each AFW pump flow capacity was sufficient to remove core decay heat shortly after reactor trip following a loss of offsite power which in the original plant design would cause a loss of main feedwater. This event was analyzed in Reference 20 to confirm the AFW system flow design basis for this event. A review of this analysis compared to current requirements (SRP 15.2.7) indicates that the analysis is equivalent to that performed for current PWR's with respect to initial conditions, reactor parameters, analytical methods, and acceptance criteria.

Conclusion Based on the above, it is concluded that the analysis of the loss of feedwater flow event meets current requirements and is therefore acceptable.

2.6 Feedwater System Pipe Break (XV-6)

Introduction A feedwater line break may result in the loss of main feedwater flow to the steam generators. If the break occurs between the main feedwater line check valve and the steam generator, the complete blowdown of one steam generator within a short time also occurs.- Further, a break in this location may prevent or reduce the subsequent addition of auxiliary feedwater to the steam generators.

A feedwater line break can result in a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup (by reducing feedwater flow to the steam generator). Potential RCS cooldown resulting from a secondary pipe break is bounded by the analysis of main steamline breaks, since the rate of cooldown is slower for the feedwater line break. Therefore, only the RCS heatup effects are evaluated for a feedline break.

Criteria The acceptance criteria for this event specified in Standard Review Plan Section 15.2.8 are:

1. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design pressures.

2. Any fuel damage that may occur during the transient should be of a sufficiently limited extent so that the core will remain in place and geometrically intact with no loss of core cooling capability.

3. Any activity release must be such that the calculated doses at the site boundary are well within the guidelines of 10CFR Part 100.

However, Westinghouse has adopted the following criteria for purposes of interpreting the transient results of this event:

a. Maximum pressures do not exceed those specified for service limit D as defined in ASME Nuclear Power Plant Components Code,Section III.

b. The core remains in place and geometrically intact with no loss of core cooling capability because:

1. The DNB ratio is such that there is a 95 percent probability that the limiting fuel rod does not go through DNB with a 95 percent confidence level.

2. The core remains covered with water.

c. Any activity release must be such that the calculated doses at the site boundary are within the guidelines of 10CFR Part 100.

Evaluation This event was not originally analyzed in Reference 1. However, this event was analyzed in Reference 20 to determine the existing capability of the AFW system to mitigate this event. A review of this analysis compared to current requirements (SRP 15.2.8) indicates that the analysis is equivalent to that performed for current PWR's with respect to initial conditions, reactor parameters, and analytical methods.

The consequences of this event also meet the Westinghouse acceptance criteria stated above which are considered more restrictive than the Standard Review Plan acceptance criteria. However, a detailed review of the capability of the AFW system to meet the single failure criteria as required by the Standard Review Plan following a feedline break has not been performed. This concern will be addressed as part of the long term post-TMI requirements for the AFW system.

Conclusion Based on the above, it is concluded that the analysis of the main feedline break event meets current requirements with the exception of the one area noted above, and is therefore acceptable pending acceptable resolution of this concern as part of the post-TMI long term AFW system requirements.

3.0 Group III Events Group III events are infrequent or limiting events with a low probability of occurrence. These events involve ruptures of secondary system piping, up to and including a double-ended rupture of a main steamline. These events cause a loss of energy and mass from the secondary system.

3.1 Steamline Break Inside/Outside Containment (XV-2)

Introduction A main steamline break causes a rapid depressurization of the steam generators and an increase in steam flow resulting in increased heat removal from the reactor coolant temperature and pressure.

In the presence of a negative moderator temperature coefficient, the cooldown causes an increase in core reactivity with the possibility that the core will become critical and return to power. The return to power is a potential problem mainly because of the high power peaking factors which exist assuming the most reactive control rod is stuck in its fully withdrawn position after reactor trip. The core is ultimately shutdown by the boric acid delivered by the safety injection system.

Criteria The acceptance criteria specified in Standard Review Plan Section 15.1.5 are:

a.

Pressure in the reactor coolant and main steam systems should be maintained below acceptable design limits.

b. The potential for core damage is evaluated on the basis that it is acceptable if the minimum DNBR remains above 1.30 using the W-3 correlation. If DNBR falls below this value fuel damage must be assumed, unless it can be shown that fuel failure has not occurred. Any fuel damage calculated to occur must be of sufficiently limited extent that the core will remain in place and intact with no loss of core cooling capability.

c. Radiological consequences must be a small fraction (less than 10%)

of the 1UCFR Part 100 exposure guidelines, or within 10CFR Part 100 guidelines for the cases of a pre-accident iodine spike or one rod held out of the core.

Westinghouse has adopted more restrictive acceptance criteria for this event as follows:

1. For a hypothetical steamline break (double-ended break), DNB does not occur following a return to power. (Occurrence of DNB in small regions of the core would not violate Standard Review Plan criteria).

2. For a credible steamline break (inadvertent opening of a main steam atmospheric dump or safety valve), the core remains subcritical through the transient.

Evaluation Main steamline breaks (both hypothetical and credible breaks) were originally analyzed in Reference 1 and subsequently reanalyzed in Reference 2, 9,10, 13, 14, and 17. A review of these analyses compared to current requirements (SRP 15.1.5) indicates that these analyses are equivalent to those performed for current PWR's with respect to initial conditions, reactor parameters, and analytical methods. The consequences of these analyses meet the Standard Review Plan and Westinghouse acceptance criteria for this event.

Conclusion Based on the above, it is concluded that the analyses of steamline breaks inside or outside containment meet current requirements and are therefore acceptable.

3.2 Radiological Consequences of Steamline Failure Outside Containment A final assessment of this topic was completed by the NRC in Reference

21.

4.0 Group IV Events Group IV events involve a loss of ac power. Loss of power to auxiliaries occurs with moderate frequency.

4.1 Loss of AC Power to Station Auxiliaries (XV-4)

(Later) 5.0 Group V Events (PWR)

The Group V events involve a decrease in reactor coolant system flow rate. A reactor coolant pump rotor seizure occurs infrequently; whereas a loss of flow due to loss of ac power occurs with moderate frequency.

0 0

5.1 Loss of Forced Coolant Flow (XV-7)

Introduction A loss of all forced flow may result from a loss of electrical power to the pumps. The loss of flow through the core reduces the heat removal capability causing a corresponding increase in the coolant temperature.

If this increase is sufficiently large, a minimum DNB can result.

Depending on the heat flux and flow conditions at the point of DNB, cladding temperature rise may result in plastic deformation or rupture unless corrective action is taken. To avoid such damage, a reactor trip is actuated under conditions of reduced flow and initial heat flux excursion.

Criteria The criteria for evaluating the loss of forced coolant flow are given in Standard Review Plan Sections 15.3.1 and 15.3.2. The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage and system pressure are met.

Evaluation In addition to the fact that coincident electric failure to all three reactor coolant pumps is very unlikely, flywheel inertia of the pumps was selected to provide sufficient coastdown flow to protect fuel cladding in the event of simultaneous power loss. The resulting flow.

rate, together with the thermal syphoning effect of the reactor and steam generators, is sufficient to remove residual decay heat and prevent cladding or fuel damage. The reactor trip circuit is designed to protect the reactor core against electrical or mechanical failure of the coolant pumps and can be initiated either by the low bus voltage pump circuit breaker or the low flow trip circuits. Each of these circuits consists of three channels and signals from any two out of three in coincidence will actuate a reactor.trip. Manual reactor trip by the operator is an additional means of limiting the consequences of loss of flow, independent of the automatic trip schemes. If none of these circuits were assumed to function, coolant temperature would increase until the low variable pressure trip, high pressure trip, or high pressurizer level trip points were reached. The Reactor Coolant System would not be overpressurized under these circumstances.

Loss of coolant flow analyses were made for minimum DNB on the basis of 90% and 85% low flow trip set points in Section 8.2 of Reference 1. The analyses take into account the conditions of maximum steady state power level, minimum steady state primary pressure, and maximum steady state inlet temperature coupled with the most positive moderator temperature coefficient and the smallest negative expected Doppler coefficient.

These initial conditions are consistent with the requirements of the Standard Review Plan.

The low flow trip is assumed to be actuated instead of the bus undervoltage or breaker trips because of a longer delay for the former.

A conservative instrumentation delay is also assumed before the rods are inserted. Minimum available reactivity worth in withdrawn rods is assumed and the most reactive rod is supposed to be stuck in its fully withdrawn position. Thus, conservative scram characteristics are considered in the analysis. The reactor trip will then be completed in about three (3) seconds in conjunction with the minimum DNB ratio.

For the 90% setpoint case, the loss of coolant flow was analyzed by a combination of computational techniques including a full plant simulation and a digital computer code using the W-3 correlation. The calculated minimum DNBR is found to be 1.6 which is well above the 1.30 limit. For the 85% setpoint case, the analysis utilized simplified, conservative calculational methods. The minimum DNBR occurs at 3.3 seconds after the reactor trip and is found to be 1.43. In short, these analyses show that approach to DNB is not critical even for the complete and simultaneous failure of all the reactor coolant pumps using the low flow trip setpoints.

Conclusion The redundant circuit ensures the reactor core against DNB under loss of flow conditions. These conditions assume a total failure of reactor coolant pumps, a maximum delay time between pump failure and reactor trip, and operation at time of failure at maximum initial steady state conditions.

Immediate reactor trip, together with the flywheel inertia of the reactor pumps, serve to prevent the resulting DNBR of 1.43 from approaching the permissible design limit of 1.30 under total pump failure conditions. The assumptions comply with the requirements for the most limiting conditions for loss of flow transient. The analysis meets current criteria and is therefore acceptable.

5.2 Pump Rotor Seizure and Shaft Break in Reactor Coolant Pumps (XV-7)

Introduction A loss of flow can occur as a result of a mechanical failure such as a primary pump seizure. The early stages of the flow cooldown from a rotor seizure are faster than for the case of loss of power since instantaneous stopping of the pump is assumed. This is an extremely unlikely event and only one pump is assumed to fail.

As shown in the preceding section, protection is provided by either the breaker trip or the low flow trip. This event is more severe than a loss of flow resulting from loss of power because of the faster coastdown due to the loss of flywheel inertia.

Criteria The criteria for evaluating primary pump rotor seizure/shaft break are given in Standard Review Plan Sections 15.3.3 and 15.3.4. The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage, radiological consequences, and system pressure are met.

Evaluation The licensee has not analyzed this transient. However, a very brief discussion of an analysis corresponding to steady state conditions for 68% of nominal reactor flow can be found in Section 8.2 of Reference 1.

The simulated case corresponds to one pump shutdown with back flow,

through the idle loop. The DNBR is found to be 1.30. Westinghouse also analyzed the reactor coolant pump locked rotor while assuming 40% steam.

generator tube blockage for the Surry plant and found that this transient is not the limiting case.

If the loss of flow were to go undetected from either of the means which directly actuate a trip, numerous alarms will be actuated instead and the temperature unbalance in the running loops will actuate a variable low pressure trip to terminate the transient.

Long term cooling can be accommodated via natural circulation using the auxiliary feedwater system, if necessary.

Conclusion The transient of primary rotor seizure/shaft break has not been analyzed by the licensee. A simulation case under steady state conditions was performed applying the technique used in the analysis of loss of forced flow discussed in the preceding section. The DNBR is critical in this transient. Since San Onofre Unit 1 is a Westinghouse three-loop plant similar to Surry, it is anticipated that this transient will not be limiting.

6.0 Group VI Events Group VI events involve reactivity and power distribution anomalies associated with control and malfunctions. These events are of moderate frequency except for rod ejection which is a limiting fault.

6.1 Control Rod Misoperation Introduction Events in this category include uncontrolled control rod assembly withdrawal from subcritical or low power startup condition, uncontrolled control rod assembly withdrawal at power, and control rod assembly misalignment. The first two events add reactivity to the core causing an increase in core power, heat flux, coolant temperature and pressure,,

and subsequent reduction in margin to fuel design limits on DNBR and fuel centerline temperature. A control rod misalignment event (dropped rod) causes a reduction in core reactivity resulting in an initial decrease in core power, pressure, and temperature. Returning the reactor to normal power would result in a distorted core power distribution with a corresponding reduction in margin to DNB.

Criteria Acceptance criteria for these events specified in Standard Review Plan Sections 15.4.1, 15.4.2, and 15.4.3 are:

1. Critical heat flux should not be exceeded. Minimum DNBR should not be less than 1.30 using the W-3 corrolation.

2. Fuel temperature and fuel clad strain limits consistent with the acceptance criteria of SRP Section 4.2 should not be exceeded.

Evaluation These events were originally analyzed in the Reference 1 Sections 7.1, 7.2, and 7.5 and reanalyzed in various reload submittals' (References 5, 7 and 9).

A dropped rod was considered to be the limiting rod misalignment event, and therefore, was the only event analyzed in Reference 1, Section 7.5. A review of these analyses compared to current requirements for these events (SRP 15.4.1, 15.4.2, and 15.4.3) indicates that these analyses are equivalent to those used for current PWR's with respect to initial conditions, reactor parameters, analytical methods, and acceptance criteria.

Conclusion Based on the above, it is concluded that the analysis of the control rod misoperation event meets current requirements and is therefore acceptable.

6.2 Spectrum of Control Rod Ejection Accidents (XV-12)

Introduction A control rod ejection accident is caused by the mechanical failure of a control rod mechanism pressure housing and the RCS pressure ejects the control rod and drive shaft. The consequences of this event are a rapid positive reactivity insertion and a rapid rise in core power for a short period of time. This increase is terminated by Doppler feedback (predominant at full power). The ejected rod results in an adverse core power distribution leading to potential localized fuel damge. The potential for fuel damage is limited by control rod insertion limits during normal operation and by reactor trip on high neutron flux which combine to limit fuel enthalpy, fuel and clad temperature and RCS pressure during the transient to acceptable valves.

Criteria The acceptance criteria for this event specified in Standard Review Plan Section 15.4.8 are:

1. Reactivity excursions should not result in a radially averaged enthalpy greater than 280 cal/gm at any axial location in any fuel rod.

2. The maximum pressure during any portion of the assumed transient should be less than the value that will.cause stress to exceed "Service Limit C" as defined in the ASME Code.

Westinghouse has adopted the following more restrictive acceptance criteria for this event:

1. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.

2. Average clad temperature at the hot spot below the temperature at which clad embrittlement may be expected (27000F)

3. Peak reactor coolant pressure less than that which would cause stresses to exceed the faulted condition stress limit.

4. Fuel melting will be limited to less than ten precent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion 1. above.

Evaluation The event was originally analyzed in Reference 1 and subsequently reanalyzed in References 2, 4, 7, 8, 9 and 10. A review of these analyses compared to current requirements (Standard Review Plan 15.4.8) for this event indicates this analyses is equivalent to that performed for current PWR's with respect to initial conditions (zero power, full power, beginning of life, and end of life conditions), reactor parameters (ejected rod worth, peaking factors, trip reactivity, and reactivity coefficients), and analytical methods. The results of this analysis meet the Standard Review Plan and Westinghouse acceptance criteria stated above.

Conclusion Based on the above, it is concluded that the analyses of spectrum of postulated rod ejection accidents meets current requirements and is therefore acceptable.

6.3 Radiological Consequences of Control Rod Ejection Accidents (XV-12)

A final assessment of this topic was provided by the NRC in Reference 28.

7.0 Group VII Events Group VII events are infrequent incidents or limiting faults that involve a decrease in reactor coolant inventory, which leads to plant depressurization. The loss of inventory is caused by a breach of the reactor coolant system pressure boundary, from a valve opening, crack or rupture of primary piping.

7.1 Spectrum of Loss of Coolant Accidents (XV-19)

Introduction A loss of coolant accident (LOCA) would result from a rupture of the reactor coolant system piping or of any line connected to that system up to the first closed valve. The break can range in size from a small leak which can be controlled by normal makeup flow to a double-ended rupture of the largest coolant pipe. The extent of system response depends on the size and location of the break. However, in general, a loss of coolant leads to plant depressurization and core heatup. Severe accidents can cause core uncovery and fuel failures. Core cooling is provided by the safety injection system (ECCS) which is actuated on either low pressurizer pressure or high containment pressure.

Criteria The acceptance criteria for this event applicable to stainless steel clad cores are specified in the AEC Interim Policy Statement, "Criteria for Emergency Core Cooling Systems for Light Water Reactors," published in the Federal Register June 29, 1971. These criteria are summarized below:

1. Peak clad temperatures (PCT) less than 23000F.

2. Metal-water reaction less than 1% of clad.

3.

Core geometry remains coolable.

4. Decay heat removed for extended period of time.

The criteria for evaluating loss of coolant accidents for current PWR's are in Standard Review Plan Section 15.6.5.

Evaluation This event was originally analyzed in Section 8.1 of Reference 1. Large break LOCAs were subsequently reanalyzed in References 4, 9, 10, 11, 12, 13, 14 and 17. Small break LOCA's were subsequently reanalyzed in References 12 and 18. A review of these analyses compared to current criteria (SRP 15.6.5) indicates the analysis is equivalent to that performed for current PWR's with respect to the following SRP review areas:

1. The calculations were performed using an approved evaluation model (IAC evaluation model applicable to stainless steel clad cores).

2.

An adequate failure mode analysis has been performed to justify the selection of the most limiting single failure (i.e. loss of one SI train).

3. A variety of break locations and a complete spectrum of break sizes were analyzed (see Table 1 attached).

Small break LOCA caused by inadvertent opening of a PORV is discussed in SEP Topic XV-15.

4. The parameters and assumptions used for the calculations conform to those of the approved evaluation model and were conservatively chosen.

5. Reactor protection system actions and safety injection actuation and delivery were conservatively chosen.

The calculated results for these analyses are in compliance with the Interim Acceptance Criteria stated above (i.e. PCT of 22720F for the 0.8 DECLG limiting large break from Reference 10 and PCT of 8640F for the 4" CL limiting small break from Reference 18).

Conclusion Based on the above, it is concluded that the analysis of a spectrum of postulated loss of coolant accidents meets current requirements applicable to stainless steel clad cores and is therefore acceptable.

7.2 Radiological Consequences of Loss of Coolant Accident (XV-19)

A final assessment of this topic was completed by the NRC in Reference 26.

7.3 Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment (XV-16)

(Later) 8.0 Group VIII Events Evaluation of these events has been deleted from consideration in the SEP.

9.0 Group IX Events Group IX events involve a loss of coolant inventory due to inadvertant opening of a valve. These events are of infrequent occurrence.

9.1 Inadvertent Opening of PWR Pressurizer Safety/Relief Valve (XV-15)

Introduction Events in this category involve a loss of coolant inventory due to inadvertent opening of a pressurizer safety/relief valve. The loss of coolant inventory causes depressurization of the reactor coolant system, draining of the vessel upper head, and filling of the pressurizer with two-phase mixture. Safety injection is initiated which refills the vessel upper head and pressurizer and establishes a stable condition with safety injection flow matching PORV discharge flow.

Criteria This event is considered to be a small break LOCA. Thus, the acceptance criteria for this event applicable to stainless steel clad cores are specified in the AEC Interim Policy Statement, "Criteria for Emergency Core Cooling Systems for Light Water Reactors," published in the Federal Register June 29, 1971.

The Interim Acceptance Criteria (IAC) for the performance of ECCS in LWRs adopted by the AEC on June 19, 1971.

These criteria are summarized below:

1. Peak clad temperatures less than 2300oF.

2. Metal-water reaction less than 1% of clad.

TABLE 1 LOCA BREAK SIZES AND BREAK LOCATION ANALYSIS

SUMMARY

Reference Break Size and Break Location (1) 1.0 DECLG, 1", 2", 4", 6", 8", 10" CL (4) 0.6 DECLG (9) 0.6, 0.8 DECLG (10) 0.6, 0.8, 1.0 DECLG (11) 0.6, 1.0 DECLG, 0.5 ft2, 3.0 ft2 CL Split (12) 0.2, 0.4, 0.8 DECLG, 2", 3", 4", 6", 8", 10" CL (13) 0.6 DECLG (14) 0.4, 0.6, 0.8 DECLG (17) 0.6 DECLG (18) 3", 4", 6", 8" CL, 1.5" PORV

3. Core geometry remains coolable.

4.

Decay heat removed for extended period of time.

The criteria for current PWRs are in Standard Review Plan Section 15.6.1.

Evaluation This event was not originally analyzed in Reference 1. However, a pressurizer vapor space break corresponding to two PORVs stuck open was analyzed in Reference 18 as part of a plant specific small break LOCA study for San Onofre Unit 1. A review of this analysis compared to current requirements (SRP 15.6.1) indicates that the analysis is equivalent to that performed for current PWR's with respect to initial conditions, reactor parameters, and analytical methods. The analysis was performed using the Westinghouse evaluation model for small break LOCA which has been approved by the NRC as complying with 10CFR50 Appendix K. The results meet the acceptance criteria stated above. No core uncovery occurs and therefore no clad heatup is calculated. Thus, this event is not the limiting small break LOCA for peak clad temperature.

Conclusion Based on the above, it is concluded that the analysis of inadvertent opening of a pressurizer relief valve meets current requirements and is therefore acceptable.

10.0 Group X Events The Group X events have a moderate frequency of occurring and lead to an increase in primary coolant inventory.

These events could cause an increase in pressure and power.

10.1 Inadvertent Operation of ECCS or CVCS Malfunction that Causes an increase in Coolant Inventory (XV-14)

Introduction An increase in primary coolant inventory can result from inadvertent safety injection or from malfunctions of the pressurizer level controls. Depending on the boron concentration and temperature of the injected water and the response of the automatic control systems, a power level increase may result and lead to fuel damage or overpressurization of the reactor coolant system. Conversely, a power level decrease and depressurization may result. In either case, if the transient is severe enough, the reactor will trip from high water level, high flux, or high or low pressure.

Criteria The criteria for evaluating an inadvertent operation of ECCS or CVCS Malfunction that causes an increase in coolant inventory are given in Standard Review Plan Sections 15.5.1 and 15.5.2. The objective is to verify that the plant responds to the most limiting transients in such a way that the criteria regarding fuel damage and system pressure are met.

I 0

Evaluation The safety injection system consists of two separate and independent pumping trains for delivery of borated water into the Reactor Coolant System. The actuation of each pump train is controlled by an independent safeguard load sequencing system or sequencer. Operation of the safety injection system is initiated automatically upon two out of three low Reactor Coolant System pressure (1735 psig) signals. At normal operating conditions, the pressure of the Reactor Coolant System (2100 psig) exceeds the shutoff head of the safety injection pumps.

Therefore, no injection of emergency cooling water into the Reactor Coolant System would occur during power operation if an inadvertent actuation of safety injection should be initiated.

A malfunction of the pressurizer level control system could result in the starting of two charging pumps and closing of three letdown orifices. Under normal operating conditions, the pressurizer level control system would detect the increase in pressurizer level and increase the letdown flow to compensate for the increased charging pump flow. Both indication and alarm functions are provided in the control room to detect the mismatch of letdown and charging flow and for low level or pressure in the volume control tank. If the malfunction were not detected and both charging pumps continued to operate while closing the letdown orifices, it would take approximately twenty-three (23) minutes to fill the pressurizer. After the pressurizer fills, the pressurizer pressure will increase sharply until a high pressure reactor trip occurs.

Conclusion No mathematical analysis of this transient was performed by the licensee. However, it is concluded that there will be no adverse consequences of an inadvertent actuation of theisafety injection system at power operation and the core can be protected from a malfunction of the chemical and Volume Control System by operator action or automatic actions.

11.0' Group XI Events These events are not applicable to San Onofre Unit 1.

12.0 Group XII Events The Group XII events involve failure of steam generator tubes.

Leaks from steam generator tubes are of moderate frequency but a tube rupture is an infrequent occurrence.

12.1 Steam Generator Tube Failure (XV-17)

A final assessment of this topic was completed by the NRC in Reference 27.

REFERENCES

1. San Onofre Nuclear Generating Station Unit 1 Part II Final Safety Analysis, 1970.

2. San Onofre Nuclear Generating Station Unit 1 Part I Operating,History and Verification of Design Objectives Appendix A, 1970.

3. Cycle 3 - Description and Safety Analysis San Onofre Unit 1, August, 1971.

4. Description and Safety Analysis Including Fuel Densification San Onofre Nuclear Generating Station Unit 1 Cycle 4, May, 1973.

5. San Onofre Unit 1 Cycle 5 Design Conclusion Letter, December, 1974.

6. Reload Safety Evaluation San Onofre Nuclear Generating Station Unit 1 Cycle 6, May 1976.

7. Reload Safety Evaluation San Onofre Nuclear Generating Station Unit 1 Cycle 7, August, 1978.

8. Reload Safety Evaluation San Onofre Nuclear Generating Station Unit 1 Cycle 8, January, 1980.

9. Reload Safety Evaluation San Onofre Nuclear Generating Station Unit 1 Cycle 8 Revision 1, October, 1980.

10. Reload Safety Evaluation San Onofre Nuclear Generating Station Unit 1 Cycle 8 Revision 2, April, 1981.

11.

Letter from Jack B. Moore to Director, Division of Reactor Licensing dated December 29, 1971, enclosure title "San Onofre Nuclear Generating Station ECCS Report"..

12.

Letter from 0. J. Ortega to Donald J. Skovholt dated January 31, 1973, enclosure titled "ECCS Performance Analysis for San Onofre Nuclear Generating Station Unit 1".

13. Letter from Jack B. Moore to E. G. Case dated February 7, 1975, enclosed report titled "Addition-of Standby Power and ECCS Modifications (Preliminary Engineering and Safety Analysis Report) San Onofre Nuclear Generating Station Unit 1, February, 1975".

14. Letter from K. P. Baskin to K. R. Goller dated December 30, 1976, enclosures titled "ECCS Performance Recalculation, San Onofre Nuclear Generating Station, Unit 1" and " Steamline Break Accident Reanalysis, San Onofre Nuclear Generating Station, Unit 1".

REFERENCES (Continued)

15.

Letter from K. P. Baskin to A. Schwencer dated January 19, 1977, enclosure titled "Containment Post Accident Pressure Reanalysis San Onofre Unit 1".

16. Letter from Victor Stello, Jr. to Jack B. Moore dated April 1, 1977, enclosure titled "Safety Evaluation by the Office of Nuclear Reactor Regulation Supporting Amendment No. 25 to Provisional Operating License No. DPR-13".

17. Letter from K. P. Baskin to D. Eisenhut dated May 30, 1978, enclosure titled "ECCS Performance Reanalysis San Onofre Nuclear Generating Station Unit 1, May, 1978".

18. Letter from Bruce King to J. G. Haynes dated March 12, 1980, enclosed report titled "Study of Small Loss of Coolant Accidents for the San Onofre Nuclear Generating Station Unit 1, February 29, 1980".

19. Letter from K. P. Baskin to D. M. Crutchfield dated June 10, 1980, enclosed report titled "Report of Information Presented at May 13, 1980 NRC Meeting Regarding Preliminary Results of Main Steamline Break Analysis and Auxiliary Feedwater System Automatic Modifications".

20. Letter from K. P. Baskin to D. M. Crutchfield dated March 6, 1981, titled "Basis for Auxiliary Feedwater System Flow Requirements San Onofre Unit 1".

21.

Letter from Dennis L. Ziemann to James H. Drake dated January 29, 1980, enclosure titled "San Onofre Unit 1 Topic XV-18 Radiological Consequences of Main Steam Line Failure Outside Containment".

22. Letter from D. M. Crutchfield to Robert Dietch dated May 11, 1981, titled "Topic XV-9, Startup of an Inactive Loop".

23. Letter from A. Schwencer to James H. Drake dated September 26, 1977.

24. Letter from K. P. Baskin to D. L. Ziemann dated November 20, 1978, Potential for Boron Dilution Accidents.

25. Letter from Dennis L. Ziemann to James H. Drake dated February 21, 1979.

26. Letter from Dennis L. Ziemann to James H. Drake dated January 29, 1980, enclosure titled "San Onofre Unit 1 Topic XV-19, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary-Radiological Consequences".

REFERENCES (Continued)

27.

Letter from Dennis L. Ziemann to James H. Drake dated January 29, 198U, enclosure titled "San Onofre Unit 1 Topic XV-17, Radiological Consequences of Steam Generator Tube Failure (PWR)".

28. Letter from Dennis L. Ziemann to James H. Drake, dated January 29, 1980, enclosure titled "San Onofre Unit 1, Topic XV-12, Spectrum of Rod Ejection Accidents (PWR) - Radiological Consequences".