ML16180A430

From kanterella
Jump to navigation Jump to search
FSAR Amendment 107, Text - Chapter 15
ML16180A430
Person / Time
Site: Comanche Peak  Luminant icon.png
Issue date: 02/01/2016
From:
Luminant Generation Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML16042A346 List:
References
txx-16006, CP-20160003
Download: ML16180A430 (227)
v • d • e


Text

CPNPP/FSAR 15.0 ACCIDENT ANALYSIS TABLE OF CONTENTS Section Title Page 15.0 ACCIDENT ANALYSIS ............................................................................................. 15.0-1 15.0.1 CLASSIFICATION OF PLANT CONDITIONS..................................................... 15.0-1 15.0.1.1 Condition I - Normal Operation and Operational Transients ......................... 15.0-2 15.0.1.2 Condition II - Faults of Moderate Frequency ................................................. 15.0-3 15.0.1.3 Condition III - Infrequent Faults ..................................................................... 15.0-4 15.0.1.4 Condition IV - Limiting Faults ........................................................................ 15.0-5 15.0.2 OPTIMIZATION OF CONTROL SYSTEMS ........................................................ 15.0-5 15.0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES.............................................................................. 15.0-6 15.0.3.1 Design Plant Conditions ................................................................................ 15.0-6 15.0.3.2 Initial Conditions ............................................................................................ 15.0-6 15.0.3.3 Power Distribution ......................................................................................... 15.0-7 15.0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES..... 15.0-8 15.0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS .... 15.0-8 15.0.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES ......................................................................................................... 15.0-9 15.0.7 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS - POWER RANGE NEUTRON FLUX................................................................................. 15.0-10 15.0.8 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS................................................................................. 15.0-10 15.0.9 FISSION PRODUCT INVENTORIES................................................................ 15.0-10 15.0.9.1 Activities in the Core.................................................................................... 15.0-10 15.0.9.2 Activities in the Fuel Pellet Clad Gap .......................................................... 15.0-10 15.0.10 RESIDUAL DECAY HEAT ................................................................................ 15.0-12 15.0.10.1 Total Residual Heat ..................................................................................... 15.0-12 15.0.10.2 Distribution of Decay Heat Following Loss of Coolant Accident.................. 15.0-12 15.0.11 COMPUTER CODES UTILIZED ....................................................................... 15.0-12 REFERENCES.................................................................................................. 15.0-13 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM......................... 15.1-1 15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE ................................................ 15.1-1 15.1.1.1 Identification of Causes and Accident Description ........................................ 15.1-1 15.1.1.2 Analysis of Effects and Consequences ......................................................... 15.1-2 15.1.1.3 Conclusions ................................................................................................... 15.1-2 15.1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW .................................................................. 15.1-3 15.1.2.1 Identification of Causes and Accident Description ........................................ 15.1-3 15.1.2.2 Analysis of Effects and Consequences ......................................................... 15.1-3 15.1.2.3 Conclusions ................................................................................................... 15.1-4 15.1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW ............................... 15.1-5 15-i Amendment No. 104

CPNPP/FSAR TABLE OF CONTENTS (Continued)

Section Title Page 15.1.3.1 Identification of Causes and Accident Description ........................................ 15.1-5 15.1.3.2 Analysis of Effects and Consequences ......................................................... 15.1-5 15.1.3.3 Conclusions ................................................................................................... 15.1-6 15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE.................................................................................................. 15.1-6 15.1.4.1 Identification of Causes and Accident Description ........................................ 15.1-6 15.1.4.2 Analysis of Effects and Consequences ......................................................... 15.1-8 15.1.4.3 Conclusions ................................................................................................... 15.1-9 15.1.5 STEAM SYSTEM PIPING FAILURE................................................................... 15.1-9 15.1.5.1 Identification of Causes and Accident Description ........................................ 15.1-9 15.1.5.2 Analysis of Effects and Consequences ....................................................... 15.1-11 15.1.5.3 Environmental Consequences .................................................................... 15.1-13 15.1.5.4 Conclusions ................................................................................................. 15.1-14 REFERENCES.................................................................................................. 15.1-15 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM ....................... 15.2-1 15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW...................................................... 15.2-1 15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD....................................................... 15.2-1 15.2.2.1 Identification of Causes and Accident Description ........................................ 15.2-1 15.2.2.2 Analysis of Effects and Consequences ......................................................... 15.2-3 15.2.2.3 Conclusions ................................................................................................... 15.2-3 15.2.3 TURBINE TRIP ................................................................................................... 15.2-3 15.2.3.1 Identification of Causes and Accident Description ........................................ 15.2-3 15.2.3.2 Analysis of Effects and Consequences ......................................................... 15.2-4 15.2.3.3 Conclusions ................................................................................................... 15.2-6 15.2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES ................ 15.2-6 15.2.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP............................................................................................... 15.2-7 15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES ...................................................................................................... 15.2-7 15.2.6.1 Identification of Causes and Accident Description ........................................ 15.2-7 15.2.6.2 Analysis of Effects and Consequences ......................................................... 15.2-9 15.2.6.2.1 Method of Analysis ........................................................................................ 15.2-9 15.2.6.3 Conclusions ................................................................................................. 15.2-10 15.2.7 LOSS OF NORMAL FEEDWATER FLOW ....................................................... 15.2-10 15.2.7.1 Identification of Causes and Accident Description ...................................... 15.2-10 15.2.7.2 Analysis of Effects and Consequences ....................................................... 15.2-11 15.2.7.2.1 Method of Analysis ...................................................................................... 15.2-11 15.2.7.3 Conclusions ................................................................................................. 15.2-12 15.2.8 FEEDWATER SYSTEM PIPE BREAK.............................................................. 15.2-13 15.2.8.1 Identification of Causes and Accident Description ...................................... 15.2-13 15.2.8.2 Analysis of Effects and Consequences ....................................................... 15.2-14 15.2.8.2.1 Method of Analysis ...................................................................................... 15.2-14 15-ii Amendment No. 104

CPNPP/FSAR TABLE OF CONTENTS (Continued)

Section Title Page 15.2.8.3 Conclusions ................................................................................................. 15.2-17 15.2.8.4 Analysis of Radiological Effects and Consequences .................................. 15.2-17 REFERENCES.................................................................................................. 15.2-17 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ............................... 15.3-1 15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW ............................ 15.3-1 15.3.1.1 Identification of Causes and Accident Description ........................................ 15.3-1 15.3.1.2 Analysis of Effects and Consequences ......................................................... 15.3-2 15.3.1.3 Conclusions ................................................................................................... 15.3-2 15.3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW ....................... 15.3-2 15.3.2.1 Identification of Causes and Accident Description ........................................ 15.3-2 15.3.2.2 Analysis of Effects and Consequences ......................................................... 15.3-4 15.3.2.3 Conclusions ................................................................................................... 15.3-4 15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR) ............... 15.3-4 15.3.3.1 Identification of Causes and Accident Description ........................................ 15.3-4 15.3.3.2 Analysis of Effects and Consequences ......................................................... 15.3-5 15.3.3.3 Conclusions ................................................................................................... 15.3-7 15.3.4 REACTOR COOLANT PUMP SHAFT BREAK ................................................... 15.3-7 15.3.4.1 Identification of Causes and Accident Description ........................................ 15.3-7 15.3.4.2 Conclusions ................................................................................................... 15.3-7 REFERENCES.................................................................................................... 15.3-7 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES...................................... 15.4-1 15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION ........................................................................................................ 15.4-1 15.4.1.1 Identification of Causes and Accident Description ........................................ 15.4-1 15.4.1.2 Analysis of Effects and Consequences ......................................................... 15.4-3 15.4.1.3 Conclusions ................................................................................................... 15.4-4 15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER................................................................................ 15.4-4 15.4.2.1 Identification of Causes and Accident Description ........................................ 15.4-4 15.4.2.2 Analysis of Effects and Consequences ......................................................... 15.4-5 15.4.2.3 Conclusions ................................................................................................... 15.4-6 15.4.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT (SYSTEM MALFUNCTION OR OPERATOR ERROR)........................................................ 15.4-7 15.4.3.1 Identification of Causes and Accident Description ........................................ 15.4-7 15.4.3.2 Analysis of Effects and Consequences ......................................................... 15.4-9 15.4.3.3 Conclusions ................................................................................................. 15.4-12 15.4.4 STARTUP OF AN INACTIVE REACTOR COOLANT PUMP AT AN INCORRECT TEMPERATURE......................................................................... 15.4-12 15.4.4.1 Identification of Causes and Accident Description ...................................... 15.4-12 15-iii Amendment No. 104

CPNPP/FSAR TABLE OF CONTENTS (Continued)

Section Title Page 15.4.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE ..................................................................................................... 15.4-12 15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT ...................................................................................... 15.4-13 15.4.6.1 Identification of Causes and Accident Description ...................................... 15.4-13 15.4.6.2 Analysis of Effects and Consequences ....................................................... 15.4-14 15.4.6.3 Conclusions ................................................................................................. 15.4-16 15.4.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY INTO AN IMPROPER POSITION ..................................................................... 15.4-18 15.4.7.1 Acceptance Criteria .................................................................................................

15.4.7.2 Identification of Causes and Accident Description ...................................... 15.4-18 15.4.7.3 Evaluation.................................................................................................... 15.4-18 15.4.7.4 Conclusion................................................................................................... 15.4-19 15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS...................................................................................................... 15.4-19 15.4.8.1 Identification of Causes and Accident Description ...................................... 15.4-19 15.4.8.1.1 Design Precautions and Protection ............................................................. 15.4-19 15.4.8.1.2 Limiting Criteria ........................................................................................... 15.4-22 15.4.8.2 Analysis of Effects and Consequences ....................................................... 15.4-22 15.4.8.2.1 Calculation of Basic Parameters ................................................................. 15.4-23 15.4.8.3 Environmental Consequences .................................................................... 15.4-25 15.4.8.4 Conclusions ................................................................................................. 15.4-28 REFERENCES.................................................................................................. 15.4-28 15.5 INCREASE IN REACTOR COOLANT INVENTORY ................................................ 15.5-1 15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION.......................................................... 15.5-1 15.5.1.1 Identification of Causes and Accident Description ........................................ 15.5-1 15.5.1.2 Analysis of Effects and Consequences ......................................................... 15.5-2 15.5.1.3 Conclusions ................................................................................................... 15.5-4 15.5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY............................................. 15.5-4 15.5.3 A NUMBER OF BWR TRANSIENTS .................................................................. 15.5-4 15.6 DECREASE IN REACTOR COOLANT INVENTORY ............................................... 15.6-1 15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE................................................................................................................. 15.6-1 15.6.1.1 Identification of Causes and Accident Description ........................................ 15.6-1 15.6.1.2 Analysis of Effects and Consequences ......................................................... 15.6-2 15.6.1.3 Conclusions ................................................................................................... 15.6-2 15-iv Amendment No. 104

CPNPP/FSAR TABLE OF CONTENTS (Continued)

Section Title Page 15.6.2 BREAK IN INSTRUMENT LINE OR OTHER LINES FROM REACTOR COOLANT PRESSURE BOUNDARY THAT PENETRATE CONTAINMENT .... 15.6-2 15.6.3 STEAM GENERATOR TUBE FAILURE ............................................................. 15.6-3 15.6.3.1 Identification of Causes and Accident Description ........................................ 15.6-3 15.6.3.1.1 Analysis of Effects and Consequences ......................................................... 15.6-6 15.6.3.2 Environmental Consequences ...................................................................... 15.6-8 15.6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT .......................................................................................... 15.6-10 15.6.5 LOSS OF COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY ................................................................................. 15.6-11 15.6.5.1 Identification of Causes and Frequency Classification ................................ 15.6-11 15.6.5.2 Sequence of Events and Systems Operations ............................................ 15.6-11 15.6.5.3 Core and System Performance ................................................................... 15.6-13 15.6.5.3.1 Mathematical Model .................................................................................... 15.6-13 15.6.5.3.2 Input Parameters and Initial Conditions ...................................................... 15.6-14 15.6.5.3.3 Results ........................................................................................................ 15.6-15 15.6.5.4 Environmental Consequences .................................................................... 15.6-16 15.6.6 A NUMBER OF BWR TRANSIENTS ................................................................ 15.6-23 REFERENCES.................................................................................................. 15.6-23 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT ................... 15.7-1 15.7.1 RADIOACTIVE GAS WASTE SYSTEM LEAK OR FAILURE ............................. 15.7-1 15.7.1.1 Identification of Causes and Accident Description ........................................ 15.7-1 15.7.1.2 Analysis of Effects and Consequences ......................................................... 15.7-1 15.7.1.3 Environmental Consequences ...................................................................... 15.7-1 15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE......................... 15.7-2 15.7.2.1 Identification of Causes and Accident Description ........................................ 15.7-2 15.7.2.2 Analysis of Effects and Consequences ......................................................... 15.7-2 15.7.2.3 Environmental Consequences ...................................................................... 15.7-2 15.7.3 POSTULATED RADIOACTIVE RELEASES DUE TO LIQUID TANK FAILURES........................................................................................................... 15.7-2 15.7.4 DESIGN BASIS FUEL HANDLING ACCIDENTS ............................................... 15.7-3 15.7.4.1 Identification of Causes and Accident Description ........................................ 15.7-3 15.7.4.2 Analysis of Effects and Consequences ......................................................... 15.7-3 15.7.4.3 Environmental Consequences ...................................................................... 15.7-5 15.7.4.3.1 Postulated Fuel Handling Accident Outside Containment............................. 15.7-5 15.7.4.3.2 Postulated Fuel Handling Accident Inside Containment ............................... 15.7-5 15.7.4.4 Conclusions ................................................................................................... 15.7-6 15.7.5 SPENT FUEL CASK DROP ACCIDENTS .......................................................... 15.7-6 REFERENCES.................................................................................................... 15.7-6 15-v Amendment No. 104

CPNPP/FSAR TABLE OF CONTENTS (Continued)

Section Title Page 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM ................................................... 15.8-1 REFERENCES.................................................................................................... 15.8-1 15A DELETED...................................................................................................................15A-1 15B DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS .........................................................................15B-1 15B.1 INTRODUCTION..................................................................................................15B-1 15B.2 ASSUMPTIONS ...................................................................................................15B-1 15B.3 GAMMA DOSE.....................................................................................................15B-1 15B.4 THYROID INHALATION DOSE ...........................................................................15B-2 15B.5 CONTROL ROOM DOSE ....................................................................................15B-3 15B.6 COMPUTER CODES USED IN ACCIDENT ANALYSIS .....................................15B-5 REFERENCES.....................................................................................................15B-6 15-vi Amendment No. 104

CPNPP/FSAR LIST OF TABLES Number Title 15.0-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS 15.0-2 DELETED 15.0-3 DELETED 15.0-4 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES 15.0-5 DELETED 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS 15.0-7 CORE ACTIVITIES 15.0-8 POWER-TEMPERATURE DISTRIBUTION FOR FULL CORE 15.1-1 DELETED 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAM LINE 15.1-3 PARAMETERS FOR POSTULATED MAIN STEAM LINE BREAK ACCIDENT ANALYSIS 15.1-4 PRIMARY AND SECONDARY SIDE EQUILIBRIUM ACTIVITIES (ACCIDENT ANALYSIS) 15.1-4A DELETED 15.2-1 DELETED 15.2-2 DELETED 15.3-1 PARAMETERS FOR POSTULATED LOCKED ROTOR ACCIDENT ANALYSIS 15.3-2 DELETED 15.4-1 DELETED 15.4-2 DELETED 15.4-3 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT 15.4-4 PARAMETERS FOR POSTULATED ROD EJECTION ACCIDENT ANALYSIS 15-vii Amendment No. 104

CPNPP/FSAR LIST OF TABLES (Continued)

Number Title 15.4.7.3-1 FLUX MAP REVIEW CRITERIA FOR A 4-LOOP CORE 15.5-1 DELETED 15.6-1 PARAMETERS FOR POSTULATED STEAM GENERATOR TUBE RUPTURE ACCIDENT ANALYSIS 15.6-2 PREACCIDENT IODINE SPIKE CONCENTRATION IN THE PRIMARY COOLANT 15.6-3 IODINE APPEARANCE RATE TO THE REACTOR COOLANT AFTER THE ACCIDENT 15.6-4 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 1 15.6-5 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 2 15.6-6 LARGE-BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE FOR COMANCHE PEAK UNITS 1 AND 2 15.6-7 LARGE-BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE FOR COMANCHE PEAK UNITS 1 AND 2 15.6-8 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST-ESTIMATE LARGE BREAK LOCA (BE LOCA) FOR COMANCHE PEAK UNIT 1 15.6-9 COMANCHE PEAK UNIT 1 BEST-ESTIMATE LARGE BREAK LOCA RESULTS 15.6-10 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST-ESTIMATE LARGE BREAK LOCA (BE LOCA) FOR COMANCHE PEAK UNIT 2 15.6-11 COMANCHE PEAK UNIT 2 BEST-ESTIMATE LARGE BREAK LOCA RESULTS 15.6-12 TOTAL MINIMUM INJECTED SAFETY INJECTION FLOW USED IN BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNITS 1 AND 2 15.6-13 INPUT PARAMETERS USED IN THE SMALL BREAK LOCA ANALYSIS 15.6-14 SAFETY INJECTION FLOWS FOR 2-INCH TO 6-INCH BREAK SIZES (SPILLING TO RCS PRESSURE) (UNIT 1 AND UNIT 2) 15-viii Amendment No. 104

CPNPP/FSAR LIST OF TABLES (Continued)

Number Title 15.6-15 SAFETY INJECTION FLOWS FOR 8.75-INCH BREAK SIZE (SPILLING TO CONTAINMENT PRESSURE) (UNIT 1 AND UNIT 2) 15.6-16 NOTRUMP TRANSIENT RESULTS (UNIT 1) 15.6-17 SBLOCTA BOL RESULTS (UNIT 1) 15.6-18 NOTRUMP TRANSIENT RESULTS (UNIT 2) 15.6-19 SBLOCTA BOL RESULTS (UNIT 2) 15.6-20 PARAMETERS FOR POSTULATED LOCA ANALYSIS 15.6-21 ACTIVITY AVAILABLE FOR RELEASE VIA ESF COMPONENTS AT T=O FOLLOWING LOCA 15.6-22 ATMOSPHERIC DILUTION FACTORS IN CONTROL ROOM DOSE ANALYSIS 15.7-1 PARAMETERS FOR POSTULATED WASTE GAS DECAY TANK RUPTURE ACCIDENT 15.7-2 GAS DECAY TANK INVENTORY FOR ACCIDENT ANALYSIS (ONE GAS DECAY TANK) 15.7-3 MAXIMUM RADIOACTIVITY IN A FLOOR DRAIN TANK FOR ACCIDENT ANALYSIS 15.7-4 PARAMETERS FOR POSTULATED RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE 15.7-5 DELETED 15.7-6 NOBLE GAS AND IODINE ACTIVITIES RELEASED TO THE ENVIRONMENT AS A RESULT OF A FUEL HANDLING ACCIDENT 15.7-7 PARAMETERS FOR POSTULATED FUEL HANDLING ACCIDENT ANALYSIS 15B-1 DOSE CONVERSIONS FACTORS 15-ix Amendment No. 104

CPNPP/FSAR LIST OF FIGURES Number Title 15.0-1 Illustration of Overtemperature and Overpower N-16 Protection 15.0-2A Deleted 15.0-2B Deleted 15.0-3 Normalized RCCA Position Versus Normalized Drop Time 15.0-4 Normalized Rod Worth Versus Fraction Inserted 15.0-5 Normalized RCCA Bank Reactivity Worth Versus Normalized Drop Time 15.0-6 Moderator Temperature Coefficient Versus Percent of Rated Thermal Power 15.0-7 Abbreviations 15.0-8 Excessive Heat Removal Due To Feedwater Systems Malfunction 15.0-9 Excessive Load Increase 15.0-10 Depressurization of Main Steam System 15.0-11 Loss of External Load 15.0-12 Loss of Offsite Power to Station Auxiliaries (Blackout) 15.0-13 Loss of Normal Feedwater 15.0-14 Major Rupture of a Main Feedwater Line 15.0-15 Loss of Forced Reactor Coolant Flow 15.0-16 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal 15.0-17 Dropped Rod Cluster Control Assembly 15.0-18 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.0-19 Deleted 15.0-20 Boron Dilution 15.0-21 Rupture of Control Rod Drive Mechanism Housing 15.0-22 Inadvertent ECCS Operation at Power 15-x Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.0-23 Accidental Depressurization of Reactor Coolant System 15.0-24 Steam Generator Tube Rupture 15.0-25 Loss Of Coolant Accident 15.0-26 CVCS Letdown Line Rupture 15.0-27 GWPS Gas Decay Tank Rupture 15.0-28 Floor Drain Tank Failure 15.0-29 Fuel Handling Accident in Fuel Building 15.0-30 Fuel Handling Accident Inside Containment 15.0-31 Spent Fuel Cask Drop Accident 15.1-1 Deleted thru 15.1-20 15.2-1 Deleted thru 15.2-26 15.3-1 Deleted thru 15.3-24 15.4-1 Deleted thru 15.4-30 15.5-1 Deleted thru 15-xi Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.5-3 15.6-1 Unit 1 Limiting PCT Case PCT and PCT Location 15.6.2 Unit 1 Limiting PCT Case Vessel Side Break Flow 15.6.3 Unit 1 Limiting PCT Case Loop Side Break Flow 15.6-4 Unit 1 Limiting PCT Case Broken and Intact Loop Pump Void Fraction 15.6-5 Unit 1 Limiting PCT Case Hot Assembly Top Third of Core Vapor Flow 15.6-6 Unit 1 Limiting PCT Case Pressurizer Pressure 15.6-7 Unit 1 Limiting PCT Case Lower Plenum Collapsed Liquid Level 15.6-8 Unit 1 Limiting PCT Case Vessel Fluid Mass 15.6-9 Unit 1 Limiting PCT Case Loop 2 Accumulator Flow 15.6-10 Unit 1 Limiting PCT Case Loop 2 Safety Injection Flow 15.6-11 Unit 1 Limiting PCT Case Core Average Channel Collapsed Liquid Level 15.6-12 Unit 1 Limiting PCT Case Loop 2 Downcomer Collapsed Liquid Level 15.6-13 Unit 1 BELOCA Analysis Axial Power Shape Operating Space Envelope 15.6-14 Unit 1 Lower Bound Containment Pressure 15.6-15 Unit 2 Limiting PCT Case PCT and PCT Location 15.6.16 Unit 2 Limiting PCT Case Vessel Side Break Flow 15.6.17 Unit 2 Limiting PCT Case Loop Side Break Flow 15.6-18 Unit 2 Limiting PCT Case Broken and Intact Loop Pump Void Fraction 15.6-19 Unit 2 Limiting PCT Case Hot Assembly Top Third of Core Vapor Flow 15.6-20 Unit 2 Limiting PCT Case Pressurizer Pressure 15.6-21 Unit 2 Limiting PCT Case Lower Plenum Collapsed Liquid Level 15.6-22 Unit 2 Limiting PCT Case Vessel Fluid Mass 15-xii Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.6-23 Unit 2 Limiting PCT Case Loop 2 Accumulator Flow 15.6-24 Unit 2 Limiting PCT Case Loop 2 Safety Injection Flow 15.6-25 Unit 2 Limiting PCT Case Core Average Channel Collapsed Liquid Level 15.6-26 Unit 2 Limiting PCT Case Loop 2 Downcomer Collapsed Liquid Level 15.6-27 Unit 2 BELOCA Analysis Axial Power Shape Operating Space Envelope 15.6-28 Unit 2 Lower Bound Containment Pressure 15.6-29 Core Interface Description for Small Break Model 15.6-30 Hot Rod Axial Power Shape Units 1 and 2 15.6-31 Pumped Safety Injection Flow Rate, Faulted Loop Spill to RCS Pressure Units 1 and 2 15.6-32 Pumped Safety Injection Flow Rate, Faulted Loop Spill to Containment Pressure Units 1 and 2 15.6-33 Reactor Coolant System Pressure Unit 1: 2-Inch Break 15.6-34 Core Mixture Height and Top of Core Unit 1: 2-Inch Break 15.6-35 Top Core Exit Vapor Temperature Unit 1: 2-Inch Break 15.6-36 Reactor Coolant System Pressure Unit 1: 3-Inch Break 15.6-37 Core Mixture Height and Top of Core Unit 1: 3-Inch Break 15.6-38 Top Core Exit Vapor Temperature Unit 1: 3-Inch Break 15.6-39 Clad Temperature Transient at Peak Clad Temperature Elevation Unit 1: 3-Inch Break 15-xiii Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.6-40 Maximum Local ZRO2 Thickness Unit 1: 3-Inch Break 15.6-41 Reactor Coolant System Pressure Unit 1: 4-Inch Break 15.6-42 Core Mixture Height and Top of Core Unit 1: 4-Inch Break 15.6-43 Total Reactor Coolant System Mass Unit 1: 4-Inch Break 15.6-44 Top Core Exit Vapor Temperature Unit 1: 4-Inch Break 15.6-45 Top Core Steam Mass Flow Rate Unit 1: 4-Inch Break 15.6-46 Total Break Flow and Total Safety Injection Flow Unit 1: 4-Inch Break 15.6-47 Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation Unit 1: 4-Inch Break 15.6-48 Fluid Temperature at Peak Clad Temperature Elevation Unit 1: 4-Inch Break 15.6-49 Clad Temperature Transient at Peak Temperature Elevation Unit 1: 4-Inch Break 15.6-50 Maximum Local ZRO2 Thickness Unit 1: 4-Inch Break 15.6-51 Reactor Coolant System Pressure Unit 1: 6-Inch Break 15.6-52 Core Mixture Height and Top of Core Unit 1: 6-Inch Break 15.6-53 Top Core Exit Vapor Temperature Unit 1: 6-Inch Break 15.6-54 Reactor Coolant System Pressure Unit 1: 8.75-Inch Break 15-xiv Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.6-55 Core Mixture Height and Top of Core Unit 1: 8.75-Inch Break 15.6-56 Top Core Exit Vapor Temperature Unit 1: 8.75-Inch Break 15.6-57 Reactor Coolant System Pressure Unit 2: 2-Inch Break 15.6-58 Core Mixture Height and Top of Core Unit 2: 2-Inch Break 15.6-59 Top Core Exit Vapor Temperature Unit 2: 2-Inch Break 15.6-60 Reactor Coolant System Pressure Unit 2: 3-Inch Break 15.6-61 Core Mixture Height and Top of Core Unit 2: 3-Inch Break 15.6-62 Top Core Exit Vapor Temperature Unit 2: 3-Inch Break 15.6-63 Clad Temperature Transient at Peak Clad Temperature Elevation Unit 2: 3-Inch Break 15.6-64 Maximum Local ZRO2 Thickness Unit 2: 3-Inch Break 15.6-65 Reactor Coolant System Pressure Unit 2: 4-Inch Break 15.6-66 Core Mixture Height and Top of Core Unit 2: 4-Inch Break 15.6-67 Total Reactor Coolant System Mass Unit 2: 4-Inch Break 15.6-68 Top Core Exit Vapor Temperature Unit 2: 4-Inch Break 15.6-69 Top Core Steam Mass Flow Rate Unit 2: 4-Inch Break 15-xv Amendment No. 104

CPNPP/FSAR LIST OF FIGURES (Continued)

Number Title 15.6-70 Total Break Flow and Total Safety Injection Flow Unit 2: 4-Inch Break 15.6-71 Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation Unit 2: 4-Inch Break 15.6-72 Fluid Temperature at Peak Clad Temperature Elevation Unit 2: 4-Inch Break 15.6-73 Clad Temperature Transient at Peak Clad Temperature Elevation Unit 2: 4-Inch Break 15.6-74 Maximum Local ZRO2 Thickness Unit 2: 4-Inch Break 15.6-75 Reactor Coolant System Pressure Unit 2: 6-Inch Break 15.6-76 Core Mixture Height and Top of Core Unit 2: 6-Inch Break 15.6-77 Top Core Exit Vapor Temperature Unit 2: 6-Inch Break 15.6-78 Reactor Coolant System Pressure Unit 2: 8.75-Inch Break 15.6-79 Core Mixture Height and Top of Core Unit 2: 8.75-Inch Break 15.6-80 Top Core Exit Vapor Temperature Unit 2: 8.75-Inch Break 15.6-81 Deleted thru 15.6-89 15.A-1 Deleted thru 15.A-2 15-xvi Amendment No. 104

CPNPP/FSAR 15.0 ACCIDENT ANALYSIS This chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 of Regulatory Guide 1.70, Revision 2 as they apply to the Comanche Peak Nuclear Power Plant (CPNPP).

Certain items in the guide warrant comment, as follows:

Items 1.3 and 2.1 - There are no pressure regulators in the Nuclear Steam Supply System (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.

Item 6.2 - No instrument lines from the Reactor Coolant System boundary in the NSSS PWR design penetrate the Containment.(a) 15.0.1 CLASSIFICATION OF PLANT CONDITIONS Since 1970 the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

1. Condition I: Normal Operation and Operational Transients.
2. Condition II: Faults of Moderate Frequency.
3. Condition III: Infrequent Faults.
4. Condition IV: Limiting Faults.

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, Reactor Trip System and engineered safeguards functioning is assumed to the extent allowed by considerations such as the single failure criterion in fulfilling this principle (i.e. seismic Category I, Class 1E, and IEEE qualified equipment, instrumentation, and components are used in the ultimate mitigation of the consequences of Condition II, III and IV events; see Section 15.0.8).

Step-by-step sequence-of-events diagrams are provided for each transient in Figures 15.0-8 through 15.0-31. Figure 15.0-7 provides the legend used in these diagrams.

a. For the definition of the Reactor Coolant System boundary, refer to ANSI-N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, Section 5, 1973.

15.0-1 Amendment No. 104

CPNPP/FSAR 15.0.1.1 Condition I - Normal Operation and Operational Transients Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to adverse conditions which can occur during Condition I operation.

A typical list of Condition I events is listed below:

1. Steady state and shutdown operations
a. Mode 1, Power operation (Keff > 0.99, > 5 percent of rated thermal power).
b. Mode 2, Startup (Keff 0.99, 5 percent of rated thermal power).
c. Mode 3, Hot standby (Keff < 0.99, Tavg 350°F).
d. Mode 4, Hot shutdown (Keff < 0.99, 200°F < Tavg < 350°F, all reactor head closure bolts fully tensioned).
e. Mode 5, Cold shutdown (Keff < 0.99, Tavg 200°F, all reactor head closure bolts fully tensioned).
f. Mode 6, Refueling (One or more reactor vessel head closure bolts less than fully tensioned).
2. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes.

These include:

a. Operation with components or systems out of service (such as power operation with a reactor coolant pump out of service).
b. Leakage from fuel with clad defects.
c. Radioactivity in the reactor coolant
1. Fission products.
2. Corrosion products.
3. Tritium.

15.0-2 Amendment No. 104

CPNPP/FSAR

d. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications.
e. Testing as allowed by the Technical Specifications.
3. Operational transients
a. Plant heatup and cooldown (up to l00°F/hour for the Reactor Coolant System; 200°F/hour for the pressurizer during cooldown and 100°F/hour for the pressurizer during heatup).
b. Step load changes (up to +/- 10 percent).
c. Ramp load changes (up to 5 percent/minute).
d. Load rejection up to and including design full load rejection transient.

15.0.1.2 Condition II - Faults of Moderate Frequency These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or Reactor Coolant System or secondary system overpressurization. This is demonstrated by assuring that DNBR remains greater than the limit value, and thus, the number of rods calculated to be in DNB corresponds to the criterion in Section 4.4.1.

For the purposes of this report, the following faults are included in this category:

1. Feedwater system malfunctions that result in a decrease in feedwater temperature (Section 15.1.1).
2. Feedwater system malfunctions that result in an increase in feedwater flow (Section 15.1.2).
3. Excessive increase in secondary steam flow (Section 15.1.3).
4. Inadvertent opening of a steam generator relief or safety valve (Section 15.1.4).
5. Loss of external electrical load (Section 15.2.2).
6. Turbine trip (Section 15.2.3).
7. Inadvertent closure of main steam isolation valves (Section 15.2.4).
8. Loss of condenser vacuum and other events resulting in turbine trip (Section 15.2.5).
9. Loss of nonemergency AC power to the station auxiliaries (Section 15.2.6).
10. Loss of normal feedwater flow (Section 15.2.7).

15.0-3 Amendment No. 104

CPNPP/FSAR

11. Partial loss of forced reactor coolant flow (Section 15.3.1).
12. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition (Section 15.4.1).
13. Uncontrolled rod cluster control assembly bank withdrawal at power (Section 15.4.2).
14. Rod cluster control assembly misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full or part length assembly)

(Section 15.4.3).

15. Startup of an inactive reactor coolant pump at an incorrect temperature (Section 15.4.4).
16. Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant (Section 15.4.6).
17. Inadvertent operation of the Emergency Core Cooling System during power operation (Section 15.5.1).
18. Chemical and Volume Control System malfunction that increases reactor coolant inventory (Section 15.5.2).
19. Inadvertent opening of a pressurizer safety or relief valve (Section 15.6.1).

15.0.1.3 Condition III - Infrequent Faults By definition Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the Reactor Coolant System or Containment barriers. For the purposes of this report the following faults are included in this category:

1. Steam system piping failure (minor) (Section 15.1.5).
2. Complete loss of forced reactor coolant flow (Section 15.3.2).
3. Rod cluster control assembly misalignment (single rod cluster control assembly withdrawal at full power) (Section 15.4.3).
4. Inadvertent loading and operation of a fuel assembly in an improper position (Section 15.4.7).
5. Loss of coolant accidents resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (small break) (Section 15.6.5).
6. Radioactive Gas Waste System leak or failure (Section 15.7.1).

15.0-4 Amendment No. 104

CPNPP/FSAR

7. Radioactive Liquid Waste System leak or failure (Section 15.7.2).
8. Postulated radioactive releases due to liquid tank failures (Section 15.7.3).
9. Spent fuel cask drop accidents (Section 15.7.5).
10. Pipe breaks which result in the release of reactor coolant outside containment (Section 15.6.2).

15.0.1.4 Condition IV - Limiting Faults Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential of the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10CFR100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the Emergency Core Cooling System and the Containment. For the purposes of this report the following faults have been classified in this category:

1. Steam system piping failure (major) (Section 15.1.5).
2. Feedwater system pipe break (Section 15.2.8).
3. Reactor coolant pump shaft seizure (locked rotor) (Section 15.3.3).
4. Reactor coolant pump shaft break (Section 15.3.4).
5. Spectrum of rod cluster control assembly ejection accidents (Section 15.4.8).
6. Steam generator tube failure (Section 15.6.3).
7. Loss of coolant accidents resulting from the spectrum of postulated piping breaks within the reactor coolant pressure boundary (large break) (Section 15.6.5).
8. Design basis fuel handling accidents (Section 15.7.4).

15.0.2 OPTIMIZATION OF CONTROL SYSTEMS The NSSS Control System Setpoint Study was performed to simulate performance of the reactor control and protection systems. The Study describes setpoints and performance of the Reactor Control System for operation up to the rated power level with chemical shim operation.

Emphasis was placed on the development of a control system which safely and automatically maintains prescribed conditions in the plant, even under the most conservative set of reactivity parameters, with respect to both system stability and transient performance.

Using a detailed analog computer simulator coupled with a digital computer as a hybrid system, various design plant disturbances were studied to ensure continued plant operation under these prescribed conditions. The Study presents the sensitivity of the control system performance to 15.0-5 Amendment No. 104

CPNPP/FSAR variations in plant system parameter setpoints. For each mode of plant operation, a group of optimum controller setpoints was determined. In areas where the resultant setpoints are different, compromises based on the optimum overall performance were made and verified. A consistent set of control system setpoints was derived to ensure that no setpoint adjustments are required during core lifetime for the full range of automatic control between 15 and 100 percent power. Based on such setpoints, the plant transient response to each specified disturbance was predicted for various times throughout core life to provide an indication of the sensitivity of transient performance to the reactor physics parameters associated with chemical shim operation.

The results show that with these setpoints the control system will provide stable response with adequate margins to protection system setpoints during expected transient operations. The effects of the control system setpoints on the transient analyses are bounded by the assumptions used in accident analyses within this Chapter.

The Study was comprised of analyses of the following control systems: rod control, steam dump, steam generator level, pressurizer pressure, pressurizer level, feedwater pump speed, control rod insertion limits, and rod stops and turbine runbacks.

15.0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES 15.0.3.1 Design Plant Conditions Table 15.0-1 lists the principal power rating values which are assumed in analyses performed in this report. The nominal NSSS thermal power output includes the rated thermal power plus the thermal power generated by the reactor coolant pumps.

The initial power operating conditions assumed in the accident analyses include allowance for errors in steady state power determination unless otherwise noted.

15.0.3.2 Initial Conditions For most accidents which are DNB limited, nominal values of initial conditions are assumed. The allowances on power, temperature, and pressure are determined on a statistical basis and are included in the DNBR limit. This procedure is known as the Revised Thermal Design Procedure (Reference 6) and is discussed more fully in Section 4.4. For accidents which are not DNB limited, or in which the Revised Thermal Design Procedure is not employed, the initial conditions are obtained by adding the maximum steady state errors to rated values.

The following steady state errors were assumed in the analyses:

1. Core power +/-0.6 percent allowance for calorimetric error
2. Average Reactor Coolant +/- 6°F allowance for controller System temperature Temperature deadband and measurement error and steam generator fouling penalty 15.0-6 Amendment No. 104

CPNPP/FSAR

3. Pressurizer pressure +/-30 pounds per square inch (psi) allowance for steady state fluctuations and measurement error
4. Pressurizer water level +5% of normal programmed water level, unless indicated otherwise Initial values for core power, average Reactor Coolant System temperature and pressurizer pressure are selected to minimize the initial departure from nucleate boiling ratio (DNBR) unless otherwise stated in the sections describing specific accidents.

Pressurizer water level is a controlled parameter, programmed to vary with temperature during normal plant operation. For those events which are sensitive to the initial pressurizer water volume, the value used in the Chapter 15 analyses is chosen to be consistent with the normal level program including an error allowance. No credit has been taken in the Chapter 15 non-LOCA analyses for safety functions initiated by pressurizer water level trips.

15.0.3.3 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of control rods and operating instructions. Power distribution may be characterized by the radial peaking factor (FH) and the total peaking factor (Fq). The peaking factor limits are given in the Technical Specifications.

For transients which may be DNB limited the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15.0-1. All transients that may be DNB limited are assumed to begin with a FH consistent with the initial power level defined in the Technical Specifications.

The axial power shapes used in the DNB calculations are discussed in Section 4.4 The radial and axial power distributions described above are input to the DNB analysis as described in Section 4.4.

For transients which may be overpower limited the total peaking factor (Fq) is of importance. All transients that may be overpower limited are assumed to begin with plant conditions including power distributions which are consistent with reactor operation as defined in the Technical Specifications.

For overpower transients which are slow with respect to the fuel rod thermal time constant, for example the Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant incident which lasts many minutes, and the excessive increase in secondary steam flow incident which may reach equilibrium without causing a reactor trip, the fuel rod thermal evaluations are performed as discussed in Section 4.4. For overpower transients which are fast with respect to the fuel rod thermal time constant, for example the uncontrolled rod cluster control assembly bank withdrawal from subcritical or low power startup 15.0-7 Amendment No. 104

CPNPP/FSAR and rod cluster control assembly ejection incidents which result in a large power rise over a few seconds, a detailed fuel heat transfer calculation must be performed.

15.0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some analyses such as loss of reactor coolant from cracks or ruptures in the Reactor Coolant System do not depend on reactivity feedback effects. The justification for use of conservatively large versus small reactivity coefficient values is treated on an event-by-event basis. In some cases conservative combinations of parameters are used to bound the effects of core life. For example, in a load increase transient it is conservative to use a small Doppler defect and a small moderator coefficient.

A moderator temperature coefficient which is positive at reduced power levels has been considered in the analyses for both Units. As shown in Figure 15.0-6, the moderator temperature coefficient would be no greater than +5 pcm/°F below 70% of rated power, ramping down to 0 pcm/°F at 100% power.

15.0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS All accident analysis results contained herein are applicable to all the control rod types defined in Chapter 4. The negative reactivity insertion following a reactor trip is a function of the acceleration of the rod cluster control assemblies and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry or approximately 85 percent of the rod cluster travel. The rod cluster control assembly position versus time assumed in accident analyses is shown in Figure 15.0-3. The RCCA drop time assumed in the accident analyses is greater than or equal to the value specified in the plant Technical Specifications.

Figure 15.0-4 shows the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve, or another like it which has been similarly developed, is used to compute the negative reactivity insertion versus time following a reactor trip which is input to all point kinetics core models used in transient analyses. The bottom skewed power distribution itself is not an input into the point kinetics core model.

There is inherent conservatism in the use of a curve such as Figure 15.0-4 in that it is based on a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

A representative normalized rod cluster control assembly negative reactivity insertion versus time is shown in Figure 15.0-5. The curve shown in this figure was obtained from Figures 15.0-3 and 15.0-4. A total negative reactivity insertion of 4% k/k following a trip is assumed in the transient 15.0-8 Amendment No. 104

CPNPP/FSAR analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4.3-3. For Figures 15.0-3 and 15.0-4, the rod cluster control assembly drop time is normalized to the insertion time to dashpot entry in order to provide a bounding analysis for all rod cluster control assemblies to be used in the CPNPP cores, as previously stated.

The normalized rod cluster control assembly negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom is used in those transient analyses for which a point kinetics core model is used. Where special analyses require use of three dimensional or axial one dimensional core models, the negative reactivity insertion resulting from the reactor trip is calculated directly by the reactor kinetics code and is not separable from the other reactivity feedback effects. In this case, the rod cluster control assembly position versus time of Figure 15.0-3 is used as code input.

15.0.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the rod cluster control assemblies which then fall by gravity into the core.

There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms.

Limiting trip setpoints assumed in accident analyses and the time delay which occurs between generation of the reactor trip signal and the point at which the rods are free to fall for each trip function are given in Table 15.0-4. Reference is made in that table to the Overtemperature and Overpower N-16 trip shown in Figure 15.0-1.

The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for process measurement errors, instrumentation channel error and setpoint error. For additional information, see Section 7.1.2.1.9 and the CPNPP Technical Specifications. Nominal trip setpoints are specified in the plant Technical Specifications. During plant startup tests it will be demonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system channels are calibrated and instrument response times determined periodically in accordance with the plant Technical Specifications.

15.0.7 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS - POWER RANGE NEUTRON FLUX This section has been deleted. See Section 15.0.6 above.

15.0.8 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS The NSSS is designed to afford proper protection against the possible effects of natural phenomena, postulated environmental conditions and dynamic effects of the postulated accidents. In addition, the design incorporates features which minimize the probability and effects of fires and explosions. Chapter 17 discusses the quality assurance program which has been implemented to assure that the NSSS will satisfactorily perform its assigned safety functions. The incorporation of these features in the NSSS, coupled with the reliability of the design, ensures that the normally operating systems and components listed in Table 15.0-6 will be available for mitigation of the events discussed in Chapter 15. In determining which systems 15.0-9 Amendment No. 104

CPNPP/FSAR are necessary to mitigate the effects of these postulated events, the classification system of ANSI-N18.2-1973 is utilized. The design of systems important to safety (including protection systems) is consistent with IEEE Standard 379-1972 and Regulatory Guide 1.53 in the application of the single failure criterion.

In the analysis of the Chapter 15 events, control system action is considered only if that action results in more severe accident results. No credit is taken for control system operation if that operation mitigates the results of an accident. For some accidents, the analysis is performed both with and without control system operation to determine the worst case.

15.0.9 FISSION PRODUCT INVENTORIES 15.0.9.1 Activities in the Core The calculation of the core iodine fission product inventory is consistent with the inventories given in TID-14844 [1]. The fission product inventories for other isotopes which are important from a health hazards point of view are calculated using the data from APED- 5398 [2]. These inventories are given in Table 15.0-7. The isotopes included in Table 15.0-7 are the isotopes controlling from considerations of inhalation dose (iodines) and from direct dose due to immersion (noble gases).

The isotopic yields used in the calculations are from the data of APED-5398, utilizing the isotopic yield data for thermal fissioning of uranium-235 as the sole fissioning source. The change in fission product inventory resulting from the fissioning of other fissionable atoms has been reviewed. The results of this review indicated that inclusion of all fission source data would result in a small (less than 10 percent) change in the isotopic inventories.

15.0.9.2 Activities in Coolant The activities in the reactor coolant as well as in the volume control tank, pressurizer and waste gas decay tanks are given in Chapter 11 along with the data on which these computations are based.

15.0.10 RESIDUAL DECAY HEAT 15.0.10.1 Total Residual Heat Residual heat in a subcritical core is calculated for the loss of coolant accident per the requirements of Appendix K of 10CFR50.46. (See Section 15.6 for additional details). These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For all other accidents, conservative core residual heat generation is based upon the American National Standard for Decay Heat Power in Light Water Reactors, ANSI/ANS-5.1-1979, and the assumption of an infinite irradiation time and a two-sigma uncertainty allowance.

15.0.10.2 Distribution of Decay Heat Following Loss of Coolant Accident During a loss of coolant accident the core is rapidly shut down by void formation or rod cluster control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner 15.0-10 Amendment No. 104

CPNPP/FSAR as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4 percent which represents the fraction of heat generated within the clad and pellet drops to a cycle-specific value (typically approximately 0.96) for the hot rod in a loss of coolant accident.

For example, consider the transient resulting from the postulated double ended break of the largest Reactor Coolant System pipe; 1/2 second after the rupture about 30 percent of the heat generated in the fuel rods is from gamma ray absorption. The gamma power shape is less peaked than the steady state fission power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conservative estimate of this effect is a reduction of 10 percent of the gamma ray contribution or 3 percent of the total. Since the water density is considerably reduced at this time, an average of about 98 percent of the available heat is deposited in the fuel rods, and the remainder is absorbed by water, thimbles, sleeves and grids.

The net effect is a cycle-specific factor (typically about 0.96), which is less than 0.974, to be applied to the heat production in the hot rod.

15.0.11 COMPUTER CODES UTILIZED The computer codes used to analyze each transient are discussed in the methods of analysis section of that transient.

REFERENCES

1. DiNunno, J. J., et al., Calculation of Distance Factors for Power and Test Reactor Sites, TID-14844, March 1962.
2. Meek, M. E. and Rider, B. F., Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum and 14 Mev Neutron Energies, APED-5398, March 1968.
3. Toner, D. F. and Scott, J. S., Fission-Product Release from UO2, Nuc. Safety 3, No. 2, 15-20, December 1961.
4. Belle, J., Uranium Dioxide Properties and Nuclear Applications, Naval Reactors, Division of Reactor Development United States Atomic Energy Commission, 1961.
5. Booth, A. H., A Suggested Method for Calculating the Diffusion of Radioactive Rare Gas Fission Products From UO2 Fuel Elements, DCI-27, 1957.
6. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

15.0-11 Amendment No. 104

CPNPP/FSAR TABLE 15.0-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS Nominal NSSS thermal power output (MWt) 3628 Assumed net thermal power generated by the reactor 16 coolant pumps (MWt)

Rated core thermal power (MWt) 3612 Amendment No. 104

CPNPP/FSAR TABLE 15.0-2 HAS BEEN DELETED.

Amendment No. 104

CPNPP/FSAR TABLE 15.0-3 HAS BEEN DELETED.

Amendment No. 104

CPNPP/FSAR TABLE 15.0-4 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES (Sheet 1 of 2)

Limiting Trip Trip Point Assumed Time Delays Function In Analysis (Seconds)

Power range high neutron 115% 0.5 flux, high setting Power range high neutron 35% 0.5 flux, low setting High neutron flux, P-8 60% 0.5 Overtemperature N-16 Variable see Figure 15.0-1 (a)

Overpower N-16 118.5% 2.0 High pressurizer pressure 2445 psig (Unit 1) 1.25 (Units 1 and 2) 2422 psig (Unit 2)

Low pressurizer pressure 1845 psig 2.0 Low reactor coolant flow 87% loop flow 1.0 (from loop flow detectors)

(b)

Undervoltage trip 1.5(b)

Amendment No. 107

CPNPP/FSAR TABLE 15.0-4 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES (Sheet 2 of 2)

Limiting Trip Trip Point Assumed Time Delays Function In Analysis (Seconds)

Underfrequency trip 57.2 Hz 0.6 Turbine trip Not applicable Low-low steam generator 10% of narrow range 2.0 water level level span High steam generator level 100% of narrow range level 2.0 trip of the feedwater pumps span and closure of feedwater systems valves, and turbine trip a) Total time delay is 9.3 seconds. This total time delay has been analyzed separately to include up to a maximum RTD response time of 6.7 seconds or up to a maximum electronic response time of 3.3 seconds. However, the sum of the RTD response time and electronic response time must not exceed 9.3 seconds.

b) The undervoltage reactor trip setpoint is not explicitly modeled. Instead, the undervoltage delay assumed in the complete loss of flow (CLOF) analysis includes an allowance for the time delay between the loss of voltage to the RCP bus and the time at which the loss of voltage is detected. Therefore, the definition of the of the reactor trip delay time for the CLOF event is unique in that the assumed delay begins when the event begins (loss of power to the RCP busses), and not when the RCP bus undervoltage condition is detected.

Amendment No. 107

CPNPP/FSAR TABLE 15.0-5 THIS TABLE IS DELETED Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 1 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment 15.1 Increase in Heat Removed by the Secondary System Feedwater system Overpower N-16, Power - - -

malfunctions that result range high flux, in a decrease in Overtemperature N-16, feedwater temperature Manual Feedwater system Power range high flux, High steam generator Feedwater isolation -

malfunctions that result high steam generator level-produced valves in an increase in level, manual feedwater isolation and feedwater flow turbine trip Excessive increase in Power range high flux, - Pressurizer -

secondary steam flow Overtemperature N-16, self-actuated safety Overpower N-16, valve steam generator manual safety valves Inadvertent opening of a Low pressurizer Low pressurizer Feedwater isolation Auxiliary Feedwater steam generator relief or pressure, manual, SIS pressure, low valves, steam line stop System, Safety Injection safety valve compensated steam line valves System pressure, manual Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 2 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Steam system piping SIS, low pressurizer Low pressurizer Feedwater isolation Auxiliary Feedwater failure pressure, manual pressure, low valves, steam line stop Safety Injection compensated steam line valves pressure, hi-1 Containment pressure, manual 15.2 Decrease in Heat Removal by the Secondary System Loss of external High pressurizer - Pressurizer safety -

electrical load/ turbine pressure, valves, steam generator trip Overtemperature N-16, safety valves manual Loss of non-emergency Steam generator lo-lo Steam generator lo-lo Steam generator safety Auxiliary Feedwater AC power to the station level, manual level valves System auxiliaries Loss of normal Steam generator lo-lo Steam generator lo-lo Steam generator safety Auxiliary Feedwater feedwater flow level, manual level valves System Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 3 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Feedwater system pipe Steam generator lo-lo High Containment Steam line isolation Auxiliary Feedwater break level, high pressurizer pressure, steam valves, feedline System, Safety Injection pressure, SIS, manual generator lo-lo water isolation, pressurizer System level, low compensated safety valves, steam steam line pressure generator safety valves 15.3 Decrease in Reactor Coolant System Flow Rate Partial and complete Low flow, under-voltage, - Steam generator safety -

loss of forced reactor underfrequency, manual valves coolant flow Reactor coolant pump Low flow, manual - Pressurizer safety -

shaft seizure (locked valves, steam generator rotor) safety valves 15.4 Reactivity and Power Distribution Anomalies Uncontrolled rod cluster Power range high flux - - -

control assembly bank (low setpoint), manual withdrawal from a subcritical or low power startup condition Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 4 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Uncontrolled rod cluster Power range high flux, - Pressurizer safety -

control assembly bank Power range high flux valves, steam generator withdrawal at power rate. Overtemperature safety valves N-16 Overpower N-16, high pressurizer pressure, manual Rod cluster control Low pressurizer - - -

assembly misalignment pressure, Overtemperature N-16, manual Chemical and Volume Source range high flux, - Low insertion limit -

Control System power range high flux, annunciators for malfunction that results power range low flux, boration, Boron dilution in a decrease in boron Overtemperature N-16, mitigation system concentration in the manual VCT water level-high reactor coolant and CVCS/RMWS annunciators Spectrum of rod cluster Power range high flux, - - -

control assembly power range low flux, ejection accidents high positive flux rate, manual Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 5 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment 15.5 Increase in Reactor Coolant Inventory Inadvertent operation of Low pressurizer - - Safety Injection System the ECCS during power pressure, manual, safety operation injection trip 15.6 Decrease in Reactor Coolant Inventory Inadvertent opening of a Low Pressurizer - - -

pressurizer safety or pressure, relief valve Overtemperature N-16, manual Steam generator tube Low pressurizer Low pressurizer Service Water System, Emergency Core failure pressure pressure, manual Component Cooling Cooling System, Overtemperature N-16 Water System, steam Auxiliary Feedwater manual generator safety and/or System, Emergency relief valves, steam line Power System stop valves, pressurizer relief valves Amendment No. 104

CPNPP/FSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS (Sheet 6 of 6)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Loss of coolant Reactor Trip System Engineered Safety Service Water System, Emergency Core accidents resulting from Features Actuation Component Cooling Cooling System, the spectrum of System Water System, steam Auxiliary Feedwater postulated piping breaks generator safety and/or System, Containment within the reactor relief Heat Removal System, coolant pressure Emergency Power boundary System Amendment No. 104

CPNPP/FSAR TABLE 15.0-7 iCORE ACTIVITIES Curies in Core Isotope (x 107)

Kr-83m 1.15 Kr-895 2.43 Kr-85m 0.113 Kr-87 4.75 Kr-88 6.36 Xe-131m 0.109 Xe-133 20.6 Xe-133m 0.644 Xe-135 3.65 Xe-138 17.4 I-131 10.2 I-132 14.7 I-133 20.6 I-134 23.0 I-135 19.6 Amendment No. 104

CPNPP/FSAR TABLE 15.0-8 POWER-TEMPERATURE DISTRIBUTION FOR FULL CORE Percent Volume of Percent of Power Fuel Temperature Core Within Temperature Within Temperature Range (°F) Range Range (MWt) 3800 - 3600 0.005 0.01 3600 - 3400 0.03 0.08 3400 - 3200 0.15 0.33 3200 - 3000 0.46 0.96 3000 - 2800 1.10 2.16 2800 - 2600 2.23 4.11 2600 - 2400 3.64 6.31 2400 - 2200 4.93 8.18 2200 - 2000 6.03 9.67

<2000 81.43 68.19 Amendment No. 104

CPNPP/FSAR 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated which could result in an increase in heat removal from the Reactor Coolant System (RCS) by the Secondary System. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following RCS cooldown events are presented in this section:

1. Feedwater system malfunctions that result in a decrease in feedwater temperature.
2. Feedwater system malfunctions that result in an increase in feedwater flow.
3. Excessive increase in secondary steam flow.
4. Inadvertent opening of a steam generator relief or safety valve.
5. Steam system piping failure.

The above are considered to be American Nuclear Society (ANS) Condition II events, with the exception of steam system piping failures, which are considered to be ANS Condition III (minor) and Condition IV (major) events. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.

15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower/overtemperature protection (neutron overpower, Overtemperature and Overpower N-16 trips) prevents any power increase which could lead to a departure from nucleate boiling ratio (DNBR) less than the limit value.

A reduction in feedwater temperature may be caused by the accidental opening of a feedwater bypass valve which diverts flow around a portion of the feedwater heaters. In the event of an accidental opening of the1 bypass valve, there is a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling will create a greater load demand on the RCS.

With the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.

The net effect on the RCS due to a reduction in feedwater temperature is similar to the effect of increasing secondary steam flow; i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T unless terminated by a reactor trip.

15.1-1 Amendment No. 105

CPNPP/FSAR A decrease in normal feedwater temperature is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

The protection available to mitigate the consequences of a decrease in feedwater temperature is discussed in Section 15.0.8 and listed in Table 15.0-6.

15.1.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the low pressure feedwater heater bypass valve. This gives the new feedwater conditions at the steam generator inlet. The RETRAN computer code (Reference 3) is used to determine the consequences of the reduced feedwater temperature.

The following assumptions are made:

1. Plant initial power level corresponding to guaranteed Nuclear Steam Supply System (NSSS) thermal output.
2. Low pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the low pressure heaters; the flow through each path is proportional to the pressure drops.
3. Heater drain pumps trip; this increases the effect of the cold bypass flow.
4. All high pressure extraction steam is isolated as a direct consequence of the low pressure feedwater heater bypass valve opening.

Opening of a low pressure heater bypass valve, tripping of the heater drain pumps, and isolating all high pressure extraction steam causes a reduction in feedwater temperature which increases the thermal load on the primary system. The calculated reduction in feedwater temperature is about 246°F, resulting in a significant increase in heat load on the primary system.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Reactor power increases until the reactor protection system functions to trip the reactor due to an overpower N-16 condition. No single active failure will prevent operation of the reactor protection system. Note that Unit 1 bounds Unit 2 because the Unit 1 steam generators have a greater heat transfer area, which is conservative for cooldown events.

15.1.1.3 Conclusions For Units 1 and 2 the results of the analysis show that the DNBR remains above the limit value; thus the acceptance criterion for the event is satisfied.

15.1-2 Amendment No. 105

CPNPP/FSAR 15.1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW 15.1.2.1 Identification of Causes and Accident Description Addition of excessive feedwater will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower/overtemperature protection (neutron overpower, Overtemperature and Overpower N-16 trips) prevents any power increase which could lead to a DNBR less than the limit value.

An example of excessive feedwater flow would be the full opening of two feedwater control valves due to a feedwater control system malfunction or an operator error. At power this excess flow causes a greater load demand on the RCS due to increased subcooling in the two steam generators. With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip. When the steam generator water levels in the affected loops reach the high-high level setpoint, all feedwater control valves and feedwater pump discharge valves are automatically closed and the main feedwater pumps are tripped. This prevents continuous addition of the feedwater. In addition, a turbine trip is initiated.

Following turbine trip, the reactor will be automatically tripped, either directly due to turbine trip or due to an Overtemperature N-16 signal. If the reactor were in the automatic control mode, the control rods would be inserted prior to the turbine trip, and the ensuing transient would then be similar to a loss of load (turbine trip event) as analyzed in Section 15.2.3.

An increase in normal feedwater flow is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0.1 for a discussion of ANS Condition II events.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6.

15.1.2.2 Analysis of Effects and Consequences Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed using the RETRAN computer code (Reference 3). For cases initiated from zero load conditions, the VIPRE computer code (Reference 4) is also used.

The system is analyzed to demonstrate plant behavior in the event that excessive feedwater addition occurs due to a control system malfunction or operator error which allows two feedwater control valves to open fully. The following cases are analyzed:

1. Accidental opening of one and two feedwater control valves with the reactor just critical at zero load conditions assuming a conservatively large negative moderator temperature coefficient.

15.1-3 Amendment No. 105

CPNPP/FSAR

2. Accidental opening of one and two feedwater control valves with the reactor at full power with automatic and manual rod control.

Asymmetric feedwater flow may result in asymmetric core inlet fluid conditions. These asymmetries are considered in the DNBR analyses.

The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:

1. For the multiple-loop feedwater control valve accident at full power, two feedwater control valves are assumed to malfunction resulting in a step increase to 168.2 percent of nominal feedwater flow to each of the two affected steam generators. The failure of a single feedwater control valve is also considered.
2. For the single-loop feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction resulting in a step increase to 207.5 percent of nominal feedwater flow to the affected steam generator.
3. For the multiple-loop feedwater control valve accident at zero load condition, two feedwater control valves are assumed to malfunction, which results in a step increase to 158.7 percent of the nominal feedwater flow to the two affected steam generators.
4. For the single-loop feedwater control valve accident at zero load condition, one feedwater control valve is assumed to malfunction, which results in a step increase to 254.3 percent of the nominal feedwater flow to the affected steam generator.
5. For the zero load condition, feedwater temperature is at a conservatively low value of 70°F.
6. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
7. The feedwater flow resulting from the fully open control valves is terminated by a steam generator high-high level trip signal which closes all feedwater control and isolation valves, trips the main feedwater pumps, and trips the turbine.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Normal reactor control systems and engineered safety systems are not required to function. The Reactor Protection System may function to trip the reactor due to overpower or high-high steam generator water level conditions. No single active failure will prevent operation of the Reactor Protection System. Note that Unit 1 bounds Unit 2 because the Unit 1 steam generators have a greater heat transfer area, which is conservative for cooldown events.

15.1.2.3 Conclusions For Units 1 and 2 the results of the analysis show that the DNBR encountered for an excessive feedwater addition at power is above the limit value; the DNBR design basis is described in Section 4.4. Additionally, it has been shown that the feedwater malfunction event at no-load is bounded by the feedwater malfunction event at full power.

15.1-4 Amendment No. 105

CPNPP/FSAR 15.1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW 15.1.3.1 Identification of Causes and Accident Description An excessive increase in secondary system steam flow (excessive load increase incident) is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The Reactor Control System is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the Reactor Protection System. Steam flow increases greater than 10 percent are analyzed in Sections 15.1.4 and 15.1.5.

This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals; i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.

For all cases, the plant rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would then be followed to reduce power.

The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip may not occur for some of the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Protection against an excessive load increase accident is provided by the following Reactor Protection System signals:

1. Overpower N-16.
2. Overtemperature N-16.
3. Power range high neutron flux.

An excessive load increase incident is considered to be an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

15.1.3.2 Analysis of Effects and Consequences Method of Analysis This event does not lead to a serious challenge to the acceptance criteria and a reactor trip is not typically generated. As such, a detailed reanalysis of this event is not necessary. A simplified statepoint evaluation, assuming a 10% step load increase, was performed and the results confirmed that core DNB limits are not challenged following this event.

15.1-5 Amendment No. 105

CPNPP/FSAR Four cases are analyzed to demonstrate the plant behavior following a 10 percent step load increase from rated load. These cases are as follows:

1. Reactor control in manual with minimum moderator reactivity feedback.
2. Reactor control in manual with maximum moderator reactivity feedback.
3. Reactor control in automatic with minimum moderator reactivity feedback.
4. Reactor control in automatic with maximum moderator reactivity feedback.

For the minimum reactivity feedback cases, the core has the least negative moderator temperature coefficient of reactivity and therefore the least inherent transient capability. For the maximum reactivity feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value. This results in the largest amount of reactivity feedback due to changes in coolant temperature. For the cases with automatic rod control, no credit was taken for N-16 trips on overtemperature or overpower in order to demonstrate the inherent transient capability of the plant. Under actual operating conditions, such a trip may occur, after which the plant would quickly stabilize.

A conservative limit on the turbine throttle valve opening is assumed, and all cases are studied without credit being taken for pressurizer heaters. Initial operating conditions are assumed at maximum values consistent with the steady state full power operation, plus uncertainties for calibration and instrument errors. These assumptions result in minimum margin to core DNB at the start of the accident.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Normal reactor control systems and engineered safety systems are not required to function. The Reactor Protection System is assumed to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints. No single active failure will prevent the Reactor Protection System from performing its intended function.

The cases which assume automatic rod control are analyzed to ensure that the worst case is considered. The automatic function is not required.

15.1.3.3 Conclusions The analysis discussed above showed for Units 1 and 2 that for a 10 percent step load increase, the DNBR remained above the limit value; the design basis for DNBR is described in Section 4.4.

The plant reaches a stabilized condition rapidly following the load increase. Furthermore, the re-sults of a simplified statepoint evaluation performed for a 10% step load increase with a nominal core power of 3612 MWt confirm that the core thermal limit lines are not challenged, and that the minimum DNBR during this transient will remain above the safety analysis limit value for Units 1 and 2.

15.1-6 Amendment No. 105

CPNPP/FSAR 15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE 15.1.4.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the Main Steam System are associated with an inadvertent opening, with failure to close, of the largest of any single relief or safety valve, or of the steam dump system. The analyses performed assuming a rupture of a main steam line are given in Section 15.1.5.

The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity.

Should the reactor be just critical or operating at power at the time of a steam release, the reactor will be tripped by the normal overpower protection when power level reaches a trip point.

Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the steam release before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero. However, since the initial steam generator water inventory is greatest at no-load, the magnitude and duration of the RCS cooldown are less for steam line release occurring at power.

An analysis of the inadvertent opening of a steam generator relief or safety valve must demonstrate that the following criterion is satisfied:

Assuming a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the Engineered Safety Features System there will be no consequential damage to the core or the RCS, after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.

Accidental depressurization of the secondary system is classified as an ANS Condition II event.

See Section 15.0.1 for a discussion of Condition II events.

The following systems provide the necessary protection against an accidental depressurization of the Main Steam System.

1. Safety Injection System actuation from any of the following:
a. Two out of four pressurizer low pressure signals.
b. Two out of three high-1 Containment pressure signals.
c. Two out of three low steamline pressure signals in a loop.
2. The overpower reactor trips (neutron flux and N-16) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

15.1-7 Amendment No. 105

CPNPP/FSAR

3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, a safety injection signal will rapidly close all feedwater isolation valves and back up feedwater control valves, trip the main feedwater pumps, and close the feedwater pump discharge valves.
4. Trip of the fast-acting steam line stop valves (designed to close in less than 5 seconds) on:
a. High-2 Containment pressure.
b. Two out of three low steam line pressure signals in any loop (above Permissive P-11).
c. High negative steam pressure rate indication from two out of three signals in any loop (below Permissive P-11).

Plant systems and equipment which are available to mitigate the effects of the accident are also discussed in Section 15.0.8 and listed in Table 15.0-6.

Due to the size limitations placed on the steam generator safety and relief valves, the failure of a single valve is capable of increasing steam flow by approximately 5 percent of full plant steam load. At full power, the power increase would be less severe than the excessive increase in secondary system steam flow transient presented in Section 15.1.3. For post reactor trip conditions or hot shutdown conditions, the analysis of this event is bounded by the main steam line rupture analysis presented in Section 15.1.5 due to the large break area modeled, which is equivalent to the maximum steam generator steam nozzle flow area (1.4 ft2).

Since an analysis of the inadvertent opening of a steam generator relief or safety valve event is always bounded by the main steam line rupture analysis presented in Section 15.1.5, no explicit inadvertent opening of a steam generator relief or safety valve analysis was performed for the power uprate program.

15.1.4.2 Analysis of Effects and Consequences (Historical)

Method of Analysis The following analyses of a secondary system steam release are performed for this section.

1. A full plant digital computer simulation using the system analyses code to determine RCS temperature and pressure during cooldown, and the effect of safety injection.
2. Analyses to determine that there is no damage to the core or the reactor coolant system.

The following conditions are assumed to exist at the time of a secondary steam system release:

15.1-8 Amendment No. 105

CPNPP/FSAR

1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, with the most reactive rod cluster control assembly stuck in its fully withdrawn position. Operation of rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a secondary system steam release accident will not lead to a more adverse condition than the case analyzed.
2. A positive moderator density coefficient corresponding to the end-of-life rodded core with the most reactive rod cluster control assembly in the fully withdrawn position.
3. Minimum capability for injection of concentrated boric acid solution corresponding to the most restrictive single failure in the Safety Injection System. This corresponds to the flow delivered by one charging pump, delivering its full contents to the cold leg header.

Unborated water must be swept from the safety injection lines downsteam of the Refueling Water Storage Tank (RWST) and the valve realignment from the Volume Control Tank (VCT) to the RWST must be completed prior to the delivery of concentrated boric acid to the reactor coolant loops. This effect has been accounted for in the analysis.

4. The case studied is a steam flow of 308 pounds per second at 1200 pounds per square inch absolute (psia) with offsite power available. This is the maximum capacity of any single steam dump, relief, or safety valve. Because the return-to-power condition is bounded by the analysis of the steam line Break accident presented in Section 15.1.5, the inadvertent opening of a relief valve is analyzed from full power conditions to demonstrate compliance with the event acceptance criteria near the time of reactor trip.
5. Perfect moisture separation in the steam generator is assumed.
6. No credit is taken for the energy stored in the system metal other than that of the fuel elements and other steam generator tubes. Since the transient occurs over a period of about 5 minutes, the neglected stored energy is likely to have a significant effect in slowing the cooldown.

15.1.4.3 Conclusions For Units 1 and 2, the analysis shows that the criteria stated earlier in this section are satisfied.

For an accidental depressurization of the main steam system the DNB design limits are not exceeded. The radiological consequences of this event are not limiting. This case is bounded by the main steam line rupture case described in Section 15.1.5. An additional case has been examined wherein the steam dump system is assumed to inadvertently actuate. No credit is taken for the proper operation of the non-Class 1E steam dump solenoid valves when the low-low Tavg (P-14) setpoint was exceeded. If a Main Steam Isolation Valve is assumed to fail to close, a non uniform cooldown of the RCS would ensue; however, the event would remain bounded by the analysis of the Steamline Break event presented in Section 15.1.5, and all event acceptance criteria would continue to be met.

15.1-9 Amendment No. 105

CPNPP/FSAR 15.1.5 STEAM SYSTEM PIPING FAILURE 15.1.5.1 Identification of Causes and Accident Description The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity. If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam line rupture is a potential problem mainly because of the high power peaking factors which exist assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by injection of boric acid delivered by the Safety Injection System and the ECCS accumulators.

The analysis of a main steam line rupture is performed to demonstrate that the following criteria are satisfied:

Assuming a stuck RCCA with or without offsite power, and assuming a single failure in the engineered safety features systems, the core remains in place and intact.

The offsite dose limits for a steam pipe rupture with a pre-accident iodine spike are the guideline values of 10CFR100. These guideline values are 300 rem thyroid and 25 rem whole body. For a steam pipe rupture with an accident-initiated iodine spike, the acceptance criterion is a small fraction of the 10CFR100 guideline values; or 30 rem thyroid and 2.5 rem whole body.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position. The DNBR design basis is discussed in Section 4.4.

A major steam line rupture is classified as an ANS Condition IV event, i.e., a limiting fault. See Section 15.0.1 for a discussion of Condition IV events.

Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as Condition III events, i.e.,

infrequent faults, as described in Section 15.0.1.3.

The major rupture of a steam line is the most limiting cooldown transient and is analyzed at zero power with no decay heat. Decay heat would retard the cooldown thereby reducing the return to power.

A detailed analysis of this transient with the most limiting break size, a double ended rupture, is presented here.

The following functions provide the protection for a steam line rupture:

1. Safety Injection System actuation from any of the following:
a. Two out of four low pressurizer pressure signals.

15.1-10 Amendment No. 105

CPNPP/FSAR

b. Two out of three high-1 Containment pressure signals.
c. Two out of three low steam line pressure signals in any loop.
2. The overpower reactor trips (neutron flux and N-16) and the reactor trip occurring in conjunction with receipt of the safety injection signal.
3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the protective action which will close the main feedwater valves on a reactor trip coincident with low average RCS temperature, a safety injection signal will rapidly close all feedwater control valves and feedwater isolation valves, as well as trip the main feedwater pumps.
4. Trip of the fast acting steam line stop valves (designed to close in less than 5 seconds) on:
a. High-2 Containment pressure.
b. Two out of three low steam line pressure signals in any loop (above Permissive P-11).
c. High negative steam pressure rate indication from two out of three signals in any loop (below Permissive P-11).

Fast-acting isolation valves are provided in each steam line; these valves will fully close within 10 seconds of a large break in the steam line. For breaks downsteam of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close. For the steam line break accident analysis, credit is taken for a safety injection actuation (S) signal which causes all main steam stop valves to close. It also causes all feedwater isolation valves to close. In addition, the S signal generates a reactor trip signal which causes closure of other valves as described in Section 10.2.2.7.7. A description of steam line isolation is included in Chapter 10.

The main steam line flow restrictor for each loop is installed in the steam generator outlet nozzle and is an integral part of the shell of the steam generator. The effective throat area of the nozzle is 1.4 square feet, which is considerably less than the main steam pipe area; thus, the nozzle serves to limit the maximum steam flow for a break at any location.

Equipment required to be operational in the event of a main steam line break accident to mitigate the accident consequences and assure a safe shutdown of the plant includes instrumentation, electrical cables, containment electrical penetration assemblies, valves and pumps. Table 15.1-2 lists the equipment required in the recovery from a high energy line rupture. Not all equipment is required for any one particular break, since the requirements will vary depending upon postulated break location and details of balance of plant design and pipe rupture criteria as discussed elsewhere in this application. Design criteria and methods of protection of safety-related equipment from the dynamic effects of postulated piping ruptures are provided in Section 3.6N.

15.1-11 Amendment No. 105

CPNPP/FSAR Equipment provided and relied upon for the Post-Accident Monitoring System is discussed in Section 7.5.

15.1.5.2 Analysis of Effects and Consequences Method of Analysis The analysis of the steam pipe rupture has been performed to determine:

1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN computer code (Reference 3) has been used.
2. The thermal-hydraulic behavior of the core following a steam line break. The detailed thermal-hydraulic digital computer code VIPRE (Reference 4) has been used to determine if the DNB design basis is met for the core conditions computed by RETRAN.

The following conditions were assumed to exist at the time of a main steam line break accident:

1. End-of-life shut down margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.
2. A positive moderator density coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked for the limiting statepoints for the cases analyzed.

This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis sufficiently matched the reactivity calculated including the above local effects for the statepoints.

3. Minimum capability for injection of concentrated boric acid solution from the RWST corresponding to the most restrictive single failure in the Safety Injection System. The Emergency Core Cooling System consists of three systems: 1) the passive accumulators, 2) the Residual Heat Removal System, and 3) the Safety Injection System.

Only the Safety Injection System and the accumulators are modeled for the steam line break accident analysis.

15.1-12 Amendment No. 105

CPNPP/FSAR The Safety Injection System flow in the system model corresponds to that delivered by one charging pump delivering its full flow to the cold leg header. Unborated water must be swept from the safety injection lines downstream of the RWST and the valve realignment from the VCT to the RWST must be completed prior to the delivery of concentrated boric acid to the reactor coolant loops. This effect has been accounted for in the analysis.

For the cases where offsite power is assumed, a total delay of 27 seconds was assumed to account for SI signal generation, opening of the RWST suction isolation valves, closing of the volume control tank (VCT) outlet isolation valves, startup of the charging pumps, isolation of the normal charging flow path from the VCT and to align suction to the borated water in the RWST. The volume containing the unborated water is swept into the core before the borated water reaches the core. This delay, described above, is inherently included in the modeling.

In cases where offsite power is not available, an additional 10 second delay is assumed to start the diesels and then load the necessary safety injection equipment onto them.

4. Since the steam generators are provided with integral flow restrictors with a 1.4 square foot throat area, any rupture with a break area greater than 1.4 square feet, regardless of location, would have the same effect on the NSSS as the 1.4 square foot break.
5. Offsite power is assumed available so that full reactor coolant flow exists. The transient assumes an uncontrolled steam release from only one steam generator. Should the core be critical at near zero power when the rupture occurs, the initiation of safety injection by low steam line pressure will trip the reactor. During full power operations, a reactor trip will occur due to the generation of either an overpower/overtemperature N-16, or, when the containment temperature is greater than 200°F, a Hi-1 containment pressure trip signal. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines, by high containment pressure signals, or by low steam line pressure signals. Even with the failure of one valve, release is limited to a few seconds for the other steam generators while the one generator blows down. The steam line stop valves are designed to be fully closed in less than 5 seconds from receipt of a closure signal.
6. Power peaking factors corresponding to one stuck RCCA and non-uniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break. This void in conjunction with the large negative moderator coefficient partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.

The core parameters used for the analysis correspond to values determined from the respective transient analysis.

The analysis assumes initial hot shutdown conditions at time zero since this represents the most pessimistic initial condition. Should the reactor be just critical or operating at power at the time of a steam line break, the reactor will be tripped by the normal 15.1-13 Amendment No. 105

CPNPP/FSAR overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load conditions at time zero.

15.1.5.3 Environmental Consequences The postulated accidents involving release of steam from the secondary system do not result in a release of radioactivity unless there is leakage from the RCS to the secondary system in the steam generators. A conservative analysis of the potential offsite doses resulting from this accident is presented considering equilibrium operation based upon Technical Specification limits of primary coolant activity concentration and primary to secondary leakage.

The following assumptions and parameters are used to calculate the activity releases and offsite doses for a postulated main steam line break.

1. Offsite power is lost; thus, the main steam condenser is not available for steam dump.
2. Air ejector release and steam generator blowdown do not occur during the accident.
3. Steam and activity release to the environment from the intact SGs is terminated at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> due to primary and secondary side pressure equalization.
4. The release of activity that leaks into the faulted SG continues until the RCS is cooled below 212 degrees F (25.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />).
5. The elemental iodine partition factor in the affected steam generator throughout the accident is 1.0.
6. The elemental iodine partition factor in the unaffected steam generators throughout the accident is 0.01.
7. All releases are assumed to be at ground level.
8. Two separate cases are analyzed:
a. An iodine spike occurs coincident with the steam line break. The iodine appearance rates from the fuel are increased to 500 times the equilibrium appearance rates associated with a primary coolant concentration of 1.0 uCi/gm Dose Equivalent I-131. The spike appearance rates are given in Table 15.1-3.
b. A transient has occurred prior to the steam line break. The transient causes an iodine spike that raises the primary coolant activity to 60 uCi/gm Dose Equivalent I-131. The preaccident spike concentrations are given in Table 15.1-3.
9. Other assumptions are in Table 15.1-3.

15.1-14 Amendment No. 105

CPNPP/FSAR Based on the foregoing model, the thyroid doses and whole body doses for the pre-accident iodine spike case were calculated to be 1.2 rem and 0.0025 rem, respectively, at the EAB and 0.67 rem and 0.0011 rem, respectively, at the LPZ. These doses are below the applicable limit values of 300 rem thyroid and 25 rem whole body set forth in 10CFR100. The thyroid doses and whole body doses for the accident-initiated iodine spike case were calculated to be 1.5 rem and 0.0049 rem, respectively, at the EAB and 3.1 rem and 0.0054 rem, respectively, at the LPZ. These doses are below a small fraction of the 10CFR100 values; or 30 rem thyroid and 2.5 rem whole body.

15.1.5.4 Conclusions The analysis has shown that the criteria stated earlier in Section 15.1.5.1 are satisfied for Units 1 and 2.

Although DNB and possible clad perforation following a steam line rupture are not necessarily unacceptable and not precluded by the criteria, the analysis shows that no DNB or clad perforation occurs for any main steam line rupture assuming the most reactive RCCA stuck in its fully withdrawn position. The radiological consequences are within the guideline values of 10CFR100 for the pre-accident iodine spike case and within a small fraction (10%) of the 10CFR100 guideline values for the accident-initiated iodine spike case.

REFERENCES

1. Westinghouse Anticipated Transients Without Trip Analysis, WCAP-8330, August 1974.
2. International Commission on Radiological Protection, Limits for Intakes of Radionuclides by Workers, ICRP Publication 30, Volume 3 No. 1-4, 1979.
3. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.
4. Sung, Y. Xl, et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A, October 1999.

15.1-15 Amendment No. 105

CPNPP/FSAR TABLE 15.1-1 HAS BEEN DELETED.

Amendment No. 104

CPNPP/FSAR TABLE 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAM LINE (Sheet 1 of 2)

Short Term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Reactor trip and engineered safety feature Auxiliary Feedwater System including pumps, Steam generator power operated relief valves actuation channels including sensors, circuitry, water supply, and system valves and piping (can be manually operated locally).

and processing equipment (the protection (this system must be placed in service to circuits used to trip the reactor on supply water to operable steam generators no Control for defeating automatic safety injection undervoltage, underfrequency, and turbine trip later than 10 minutes after the incident). actuation during a cooldown and may be excluded). depressurization.

Safety Injection System including the pumps, Reactor Containment ventilation cooling units. Residual Heat Removal System including the refueling water storage tank, and the pumps, heat exchanger, and system valves system valves and piping. Capability for obtaining a Reactor Coolant and piping necessary to cool and maintain the System sample. Reactor Coolant System in a cold shutdown condition.

Diesel generators and emergency power distribution equipment.

Containment engineered safety features cooling equipment.

Auxiliary Feedwater System including pumps, water supplies, piping and valves.

Main feedwater control valves (trip closed feature).

Bypass feedwater control valves (trip closed feature).

Primary and secondary safety valves.

Amendment No. 104

CPNPP/FSAR TABLE 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAM LINE (Sheet 2 of 2)

Short Term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Circuits and/or equipment required to trip the main feedwater pumps.

Main feedwater isolation valves (trip closed feature).

Main steam line stop valves (trip closed feature).

Steam generator blowdown isolation valves (automatic closure feature).

Batteries (Class IE).

Control Room ventilation.

Control Room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.

Emergency lighting.

Post Accident Monitoring System(a).

a) See Section 7.5 for a discussion of the Post Accident Monitoring System Amendment No. 104

CPNPP/FSAR TABLE 15.1-3 PARAMETERS FOR POSTULATED MAIN STEAM LINE BREAK ACCIDENT ANALYSIS (Sheet 1 of 3)

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level (MWt) 3684
b. Primary coolant activity concentration 1.0 uCi/gm Dose prior to accident Equivalent I-131
c. Secondary side coolant activity 0.1 uCi/gm Dose concentration prior to accident Equivalent I-131
d. Primary to Secondary leakage in 0.3472 affected steam generator (gpm)
e. Primary to Secondary leakage in 0.6528 unaffected steam generators (gpm)
f. Offsite power lost lost
g. Failed fuel none
2. Data and assumptions used to estimate activity released
a. Iodine partition factor for initial and long 1.0 term steam release from affected steam generator
b. Iodine partition factor in unaffected 0.01 steam generators prior to and during accident
c. Initial steam release from affected steam 176,000 generator (lbm) (0 to 5 min)

Note: The entire secondary side liquid inventory in the affected steam generator is assumed to be released.

d. Long term steam release from affected 0 steam generator (lbm) (5 min to 20 hr)
e. steam release from three unaffected steam generators (lbm) (0 to 2 hr) 434,000 (2 to 8 hr) 970,000 Amendment No. 104

CPNPP/FSAR TABLE 15.1-3 PARAMETERS FOR POSTULATED MAIN STEAM LINE BREAK ACCIDENT ANALYSIS (Sheet 2 of 3)

(8 to 11 hr) 265,000

3. Dispersion data
a. EAB and LPZ distances 2080m and 4 miles
b. x/Q @ EAB (0 - 2 hr) 1.6 x 10-4sec/m3

@ LPZ (0 - 8 hr) 2.4 x 10-5sec/m3

@ LPZ (8 - 24 hr) 1.6 x 10-5 sec/m3

4. Dose data
a. Method of dose calculations See Appendix 15B
b. Dose conversion assumptions See Appendix 15B
c. Primary and secondary side equilibrium See Table 15.1-4 activities
d. Iodine spike appearance rates I-131: 225.5 Ci/min I-132: 766 Ci/min I-133: 439.5 Ci/min I-134: 354 Ci/min I-135: 346.5 Ci/min
e. Pre-accident spike iodine concentrations I-131: 46.1 uCi/gm I-132: 49.2 uCi/gm I-133: 73.8 uCi/gm I-134: 10.7 uCi/gm I-135: 40.6 uCi/gm
f. Doses (rem) thyroid whole body (gamma dose)

@EAB (0-2 hr) concurrent iodine spike 1.5 0.0049 preaccident iodine spike 1.2 0.0025

@LPZ (0-30 days) concurrent iodine spike 3.1 0.0049 Amendment No. 104

CPNPP/FSAR TABLE 15.1-3 PARAMETERS FOR POSTULATED MAIN STEAM LINE BREAK ACCIDENT ANALYSIS (Sheet 3 of 3) preaccident iodine spike 0.67 0.0011 Amendment No. 104

CPNPP/FSAR TABLE 15.1-4 PRIMARY AND SECONDARY SIDE EQUILIBRIUM ACTIVITIES (ACCIDENT ANALYSIS)

Primary Coolant Concentration Secondary Liquid Concentration Nuclide (uCi/gm)(a) (uCi/gm)(b)

Kr-83m 4.77E-01 0.00 x 10-0 Kr-85m 1.95E+00 0.00 x 10-0 Kr-85 8.73E+00 0.00 x 10-0 Kr-87 1.29E+00 0.00 x 10-0 Kr-88 3.61E+00 0.00 x 10-0 Xe-131m 3.20E+00 0.00 x 10-0 Xe-133m 4.81E+00 0.00 x 10-0 Xe-133 2.80E+02 0.00 x 10-0 Xe-135m 5.36E-01 0.00 x 10-0 Xe-135 8.18E+00 0.00 x 10-0 Xe-138 7.25E-01 0.00 x 10-0 I-131 7.68E-01 7.68E-02 I-132 8.20E-01 8.20E-02 I-133 1.23E+00 1.23E-01 I-134 1.78E-01 1.78E-02 I-135 6.77E-01 6.77E-02 a) Based on a primary coolant specific activity of 1.0 uCi/gm Dose Equivalent I-131. Noble gases are based on operation with 1% fuel defects.

b) Based on a secondary side specific activity of 0.10 uCi/gm Dose Equivalent I-131.

Amendment No. 104

CPNPP/FSAR TABLE 15.1-4A THIS TABLE IS DELETED Amendment No. 104

CPNPP/FSAR 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the Reactor Coolant System (RCS). Detailed analyses are presented in this section for several such events which have been identified as more limiting than the others.

Discussions of the following RCS coolant heatup events are presented in Section 15.2:

1. Steam pressure regulator malfunction or failure that results in decreasing steam flow.
2. Loss of external electrical load.
3. Turbine trip.
4. Inadvertent closure of main steam isolation valves.
5. Loss of condenser vacuum and other events resulting in turbine trip.
6. Loss of nonemergency AC power to the station auxiliaries.
7. Loss of normal feedwater flow.
8. Feedwater system pipe break.

The above items are considered to be American Nuclear Society (ANS) Condition II events, with the exception of a feedwater system pipe break, which is considered to be an ANS Condition IV event. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.

15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW There are no steam pressure regulators in the Comanche Peak Nuclear Power Plant (CPNPP) whose failure or malfunction could cause a steam flow transient.

15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite alternating current (AC) power remains available to operate plant components such as the reactor coolant pumps; as a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.

15.2-1 Amendment No. 104

CPNPP/FSAR For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. The plant would be expected to trip from the Reactor Protection System if a safety limit were approached. A continued steam load of approximately 5 percent would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.

In the event that a safety limit is approached, protection would be provided by the high pressurizer pressure and Overtemperature N-16 trips. Voltage and frequency relays associated with the reactor coolant pump provide no additional safety function for this event. Following a complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an overfrequency of less than 6 hertz (Hz). This resulting overfrequency is not expected to damage the sensors (non-Nuclear Steam Supply System) in any way. However, it is noted that frequent testing of this equipment is required by the Technical Specifications. Any degradation in their performance could be ascertained at that time. Any increased frequency to the reactor coolant pump motors will result in slightly increased flow rate and subsequent additional margin to safety limits. For postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition is not seen by other safety-related pump motors, Reactor Protection System equipment, or other engineered safety features (ESF) loads. These ESF loads are supplied from offsite power or, alternatively, from emergency diesels. Reactor Protection System equipment is supplied from the 118 volt AC instrument power supply system, which in turn is supplied from the inverters; the inverters are supplied from a direct current (DC) bus energized from batteries or by a rectified AC voltage from Class 1E buses.

In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, or the Overtemperature N-16 signal. The steam generator shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power operated relief valves, automatic rod cluster control assembly control or direct reactor trip on turbine trip.

The steam generator safety valve capacity is sized to remove the steam flow at the engineered safety features rating (105 percent of steam flow at rated power) from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves.

The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure within 110 percent of the RCS design pressure.

A more complete discussion of overpressure protection can be found in Reference [1], which also provides the original bases for establishing the capacities of the steam generator and pressurizer safety valves.

A loss of external load is classified as an ANS Condition II event, fault of moderate frequency.

See Section 15.0.1 for a discussion of Condition II events.

A loss of external load event results in a Nuclear Steam Supply System transient that is less severe than a turbine trip event (see Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load.

15.2-2 Amendment No. 104

CPNPP/FSAR The primary side transient is caused by a decrease in heat transfer capability from primary to secondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of feedwater flow (should feed flow not be reduced, a larger heat sink would be available and the transient would be less severe). Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in less than 0.5 seconds. Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in less than 0.5 seconds. Therefore, the transient in primary pressure, temperature, and water volume will be less severe for the loss of external load than for the turbine trip due to a slightly slower loss of heat transfer capability.

The protection available to mitigate the consequences of a loss of external load is the same as that for a turbine trip, as listed in Table 15.0-6.

15.2.2.2 Analysis of Effects and Consequences Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more severe than those expected for the loss of external load, as discussed in Section 15.2.2.1.

Normal reactor control systems and engineered safety systems are not required to function. The Auxiliary Feedwater System may, however, be automatically actuated following a loss of main feedwater; this will further mitigate the effects of the transient.

The Reactor Protection System may be required to function following a complete loss of external load to terminate core heat input and prevent departure from nucleate boiling (DNB). Depending on the magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressure below allowable limits. No single active failure will prevent operation of any system required to function. Refer to Section 15.8 and Reference [2] for a discussion of anticipated transients without trip (ATWT) considerations.

15.2.2.3 Conclusions Based on results obtained for the turbine trip event (Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.

15.2.3 TURBINE TRIP 15.2.3.1 Identification of Causes and Accident Description For a turbine trip event, the reactor would be tripped directly (unless below approximately 50 percent power) from a signal derived from the turbine stop emergency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly (typically less than 0.5 seconds) on loss of trip fluid pressure actuated by one of a number of possible turbine trip signals. Turbine trip initiation signals include:

1. Generator trip.
2. Low condenser vacuum.

15.2-3 Amendment No. 104

CPNPP/FSAR

3. Loss of lubricating oil.
4. Turbine thrust bearing failure.
5. Turbine overspeed.
6. Moisture Separator Reheater high level.
7. Manual trip.

Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and initiate steam dump and, if above 50 percent power, a reactor trip. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external load event. A slightly more severe transient occurs for the turbine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.

The automatic steam dump system would normally accommodate the excess steam generation.

Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost. For this situation feedwater flow would be maintained by the Auxiliary Feedwater System to ensure adequate residual and decay heat removal capability.

Should the steam dump system fail to operate, the steam generator safety valves may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the transient.

A turbine trip is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

A turbine trip event is more limiting than loss of external load, loss of condenser vacuum, and other turbine trip events. As such, this event has been analyzed in detail. Results and discussion of the analysis are presented in Section 15.2.3.2.

The plant systems and equipment available to mitigate the consequences of a turbine trip are discussed in Section 15.0.8 and listed in Table 15.0-6.

15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from full power without direct reactor trip. This is done primarily to show the adequacy of the pressure relieving devices and also to demonstrate core protection margins; that is, the turbine is assumed to trip without actuating all the sensors for reactor trip on the turbine stop valves. The assumption delays reactor trip until conditions in the RCS result in a trip due to other signals.

Thus, the analysis assumes a worst transient. In addition, no credit is taken for steam dump.

Main feedwater flow is terminated at the time of turbine trip, with no credit taken for auxiliary feedwater to mitigate the consequences of the transient.

15.2-4 Amendment No. 104

CPNPP/FSAR The turbine trip transients are analyzed using the RETRAN computer code (Reference 3).

Major assumptions are summarized below:

1. Initial operating conditions For the peak RCS and main steam system (MSS) pressure analyses, the initial reactor power is assumed at the maximum value consistent with steady state full power operation including allowances for calibration and instrument errors. The initial pressurizer pressure is assumed at a minimum value consistent with steady state full power operation including allowances for calibration and instrument errors. For the peak MSS pressure analysis, the initial RCS temperature is chosen at the highest value plus uncertainties.

For the peak RCS pressure analysis, the initial RCS temperature is chosen at the highest value (within uncertainties) such that the MSSVs open after the time of peak RCS pressure. For the DNB analysis, the initial reactor power, pressurizer pressure, and RCS temperature are assumed to be at their nominal values consistent with steady state full power operation; uncertainties in initial conditions are accounted for in the DNBR limit as described in Reference 4. Tube plugging is assumed to be the maximum value for the peak RCS pressure and DNB analyses, and zero for the peak MSS pressure analysis.

2. Moderator and Doppler coefficients of reactivity The turbine trip is analyzed with minimum reactivity feedback. The minimum feedback (BOL) cases assume the most positive moderator temperature coefficient and the least negative Doppler coefficient.
3. Reactor control From the standpoint of the maximum pressures and minimum DNBRs attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
4. Steam release No credit is taken for the operation of the steam dump system or steam generator power operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits secondary steam pressure at the setpoint value.
5. Pressurizer spray and power operated relief valves Two combinations are modeled:
a. The pressurizer spray and power operated relief valves were modeled to conservatively reduce or limit the coolant pressure for the DNB and peak MSS pressure analyses. Safety valves were also assumed to be available.

15.2-5 Amendment No. 104

CPNPP/FSAR

b. No credit was taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the peak RCS pressure analysis. Safety valves were assumed to be operable.
6. Feedwater flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
7. Reactor trip is actuated by the first Reactor Protection System trip setpoint reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, Overtemperature N-16, high pressurizer water level, and low-low steam generator water level.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Except as discussed above, normal Reactor Control System and engineered safety systems are not required to function.

The Reactor Protection System may be required to function following a turbine trip. Pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWT considerations is presented in Section 15.8 and Reference [2].

15.2.3.3 Conclusions For Units 1 and 2, the results of the analyses show that the plant design is such that a turbine trip without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within 110 percent of the system design pressures.

The integrity of the core is maintained by operation of the Reactor Protection System, i.e., the DNBR will be maintained above the limit value. The DNBR design basis is described in Section 4.4. Applicable acceptance criteria as listed in Section 15.0.1 have been met. The above analysis results demonstrate the ability of the Nuclear Steam Supply System to safely withstand a full load rejection.

15.2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES Inadvertent closure of the main steam isolation valves would result in a turbine trip. Turbine trips are discussed in Section 15.2.3.

15.2-6 Amendment No. 104

CPNPP/FSAR 15.2.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 15.2.3. A loss of condenser vacuum would preclude the use of steam dump to the condenser; however, since steam dump is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as listed in Section 15.2.3.1, are covered by Section 15.2.3. Possible overfrequency effects due to a turbine overspeed condition are discussed in Section 15.2.2.1 and are not a concern for this type of event.

A decreasing condenser vacuum would result in higher steam flow, lower steam pressure, constant or decreasing electrical load, constant or decreasing Tavg, and increasing reactor power, depending on initial plant conditions. This is the result of the main turbine control system attempting to maintain a constant electrical output.

The increase in reactor power will be limited by the magnitude of the change in condenser backpressure, the turbine backpressure trip point, initial power level, and/or turbine nozzle sizing.

The worst case turbine trip accident analyzed in Section 15.2.3 assumes an initial reactor power level that is consistent with steady state full power operation including allowances for calibration and instrument errors. Should condenser backpressure increase at 100%, the rise in reactor power will be limited to approximately 105% due to turbine nozzle sizing. The limiting criterion for a turbine trip is the resulting pressure excursion; in other words, it is an overpressure accident.

The analysis described in Section 15.2.3 verifies the adequacy of the Westinghouse overpressure protection for Units 1 and 2.

15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES 15.2.6.1 Identification of Causes and Accident Description A complete loss of nonemergency AC power may result in the loss of all power to the station auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system.

This transient is more severe than the turbine trip event analyzed in Section 15.2.3. For this case, the decrease in heat removal by the secondary system is accompanied by a flow coastdown which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip: 1) due to turbine trip; 2) upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or 3) due to loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.

Following a loss of AC power with turbine and reactor trips, the sequence described below will occur:

1. Plant vital instruments are supplied from emergency DC power sources.

15.2-7 Amendment No. 104

CPNPP/FSAR

2. As the steam system pressure rises following the trip, the steam generator power operated relief valves may be automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
3. As the no-load temperature is approached, the steam generator power operated relief valves (or the self actuated safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
4. The emergency diesel generators, started on loss of voltage on the plant emergency buses, begin to supply plant vital loads.

The Auxiliary Feedwater System is started automatically as follows:

Two motor driven auxiliary feedwater pumps are started on any of the following:

1. Low-low level in any steam generator.
2. Trip of all main feedwater pumps.
3. Any safety injection signal.
4. Loss of offsite power.
5. Manual actuation.
6. AMSAC One turbine driven auxiliary feedwater pump is started on any of the following:
1. Low-low level in any two steam generators.
2. Loss of offsite power.
3. Manual actuation.
4. AMSAC Refer to Section 10.4.9 for a description of the Auxiliary Feedwater System.

The motor driven auxiliary feedwater pumps are supplied power by the diesels and the turbine driven pump utilizes steam from the secondary system. The turbine exhausts the secondary steam to the atmosphere. The auxiliary feedwater pumps take suction from the Condensate Storage Tank for delivery to the steam generator.

Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops. A 15.2-8 Amendment No. 104

CPNPP/FSAR loss of nonemergency AC power to the station auxiliaries is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

A loss of AC power event, as described above, is a more limiting DNB event than the turbine trip-initiated decrease in secondary heat removal without loss of AC power, which was analyzed in Section 15.2.3. However, the DNB transient for this event is bounded by the complete loss of flow transient analyzed in Section 15.3.2. A loss of AC power to the station auxiliaries as postulated above could also result in a loss of normal feedwater if the condensate pumps lose power to operate. Therefore, detailed analytical results for a for a loss of normal feedwater transient with a loss of AC power are presented here. The results of the analysis in Section 15.2.7 address the loss of feedwater with AC power available.

Following the reactor coolant pump coastdown caused by the loss of AC power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. An analysis is presented here to show that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.

The plant systems and equipment available to mitigate the consequences of a loss of AC power event are discussed in Section 15.0.8 and listed in Table 15.0-6.

15.2.6.2 Analysis of Effects and Consequences 15.2.6.2.1 Method of Analysis A detailed analysis using the RETRAN computer code (Reference 3) is performed in order to obtain the plant transient following a loss of nonemergency AC power. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

The assumptions used in the analysis are as follows:

1. A 0.6% allowance for uncertainties associated with the plant calorimetric measurement for operation at an NSSS power of 3628 MWt.
2. A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip.
3. A heat transfer coefficient in the steam generator associated with RCS natural circulation.
4. Reactor trip occurs on steam generator low-low level. No credit is taken for immediate release of the control rod drive mechanisms caused by a loss-of-offsite power.
5. Both motor-driven auxiliary feedwater pumps supply a total of 860 gpm to all four steam generators within 60 seconds after the steam generator low-low water level setpoint is exceeded. The turbine-driven auxiliary feedwater pump is the assumed single active failure.
6. Secondary system steam relief is achieved through the steam generator safety valves.

15.2-9 Amendment No. 104

CPNPP/FSAR

7. Since the plant is allowed to operate over a range of reactor vessel average temperatures (Tavg), and because the pressurizer level program varies over the range, analyses were performed to establish the most limiting initial conditions. For Unit 1, a Tavg of 574.2°F minus 6°F for uncertainty is limiting. For Unit 2, a Tavg of 584.7°F minus 6°F for uncertainty is limiting. An initial pressurizer pressure that is 30 psi higher than nominal is limiting for both Units 1 and 2.
8. The core nuclear physics parameters are chosen to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

15.2.6.3 Conclusions For Units 1 and 2, the analysis of the natural circulation capability of the RCS has demonstrated that sufficient heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage.

15.2.7 LOSS OF NORMAL FEEDWATER FLOW 15.2.7.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The following events occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

1. As the steam system pressure rises following the trip, the steam generator power operated relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power operated relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
2. As the no-load temperature is approached, the steam generator power operated relief valves (or the self actuated safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

A loss of normal feedwater is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

The reactor trip on low-low water level in any steam generator provides the necessary protection against a loss of normal feedwater.

15.2-10 Amendment No. 104

CPNPP/FSAR The Auxiliary Feedwater System is started automatically as discussed in Section 15.2.6.1. The steam driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor driven auxiliary feedwater pumps are supplied by power from the diesel generators. The pumps take suction directly from the condensate storage tank for delivery to the steam generators.

An analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition.

15.2.7.2 Analysis of Effects and Consequences 15.2.7.2.1 Method of Analysis A detailed analysis using the RETRAN computer code (Reference 3) is performed in order to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

Assumptions made in the analysis are:

1. A 0.6% allowance for uncertainties associated with the plant calorimetric measurement for operation at an NSSS power of 3628 MWt.
2. An error of +5% in the full power programmed pressurizer water level is assumed since, although the surge rate is low, the total volumetric expansion of the primary coolant is sufficient to nearly fill the pressurizer. It should be noted for this event that, even if the pressurizer did fill with water, the low surge rate would not cause an excessive pressure rise.
3. A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip.
4. Reactor trip occurs on steam generator low-low level.
5. Both motor-driven auxiliary feedwater pumps supplying a total of 860 gpm to all four steam generators within 60 seconds after the steam generator low-low water level setpoint is exceeded. The turbine-driven auxiliary feedwater pump is the assumed single active failure.
6. Secondary system steam relief is achieved through the steam generator self-actuated safety valves. Note that steam relief will, in fact, be through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater. However, for the sake of analysis these have been assumed unavailable.
7. Since the plant is allowed to operate over a range of reactor vessel average temperatures (Tavg), and because the pressurizer level program varies over the range, analyses were performed to establish the most limiting initial conditions. For Unit 1, a Tavg of 574.2°F 15.2-11 Amendment No. 104

CPNPP/FSAR minus 6°F for uncertainty is limiting. For Unit 2, a Tavg of 589.2°F plus 6°F for uncertainty is limiting. An initial pressurizer pressure that is 30 psi higher than nominal is limiting for Unit 1 and that is 30 psi lower than nominal is limiting for Unit 2.

8. The core nuclear physics parameters are chosen to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion.

The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safety features systems (e.g., the Auxiliary Feedwater System) in removing long term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

For the Loss of Normal Feedwater transient, the reactor coolant volumetric flow would remain at its normal value and the reactor trips via the low-low steam generator level trip. The reactor coolant pumps would be manually tripped at some later time to reduce heat addition to the RCS.

The Auxiliary Feedwater System has sufficient capacity, even assuming the worst single failure, to preclude filling the pressurizer should the pumps not be tripped.

Because the two Comanche Peak units have different steam generators (see Section 5.4.2), the effect of this difference has been considered in the analysis. The initial steam generator level and the trip setpoints assumed in the analysis are conservative for the unit analyzed.

All Unit 2 steam generators are equipped with separate feedwater connections for injection of auxiliary feedwater and main feedwater at low power operation (the Unit 1 steam generators have completely separate connections at the same steam generator level for both main and auxiliary feedwater at all power levels). The major effect of injecting auxiliary feedwater into the upper section of the downcomer is that most of the flow will bypass the preheat region due to the higher resistance to flow in the preheater. This will result in a slight decrease in heat removal capability. However, the auxiliary feedwater injection point is now much closer to the steam generator, resulting in a much smaller volume of hot feedwater which must be purged before the colder auxiliary feed enters the steam generators. This effect has been considered in the analysis for Unit 2 (not applicable for Unit 1).

Plant characteristics and initial conditions are further discussed in Section 15.0.3. Plant systems and equipment which are available to mitigate the effects of a loss of normal feedwater accident are discussed in Section 15.0.8 and listed in Table 15.0-6. Normal reactor control systems are not required to function. The Reactor Protection System is required to function following a loss of normal feedwater as analyzed here. The Auxiliary Feedwater System is required to deliver a minimum auxiliary feedwater flow rate. No single active failure will prevent operation of any system required to function. A discussion of ATWT considerations is presented in Section 15.8 and Reference [2].

15.2.7.3 Conclusions For Units 1 and 2, results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system since the auxiliary feedwater capacity is such that 15.2-12 Amendment No. 104

CPNPP/FSAR reactor coolant water is not relieved from the pressurizer relief or safety valves, and the water level in all steam generators is maintained above the tubesheets.

15.2.8 FEEDWATER SYSTEM PIPE BREAK 15.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break.

Further, a break in this location could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. (A break upstream of the feedline check valve would affect the Nuclear Steam Supply System only as a loss of feedwater. This case is covered by the evaluation in Section 15.2.7).

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.

A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:

1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.
2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.
3. The break may be large enough to prevent the addition of any main feedwater after trip.

An Auxiliary Feedwater System is provided to assure that adequate feedwater will be available such that:

1. No substantial overpressurization of the RCS shall occur.
2. Sufficient liquid in the RCS shall be maintained in order to provide adequate decay heat removal.

Refer to Section 10.4.9 for a description of the Auxiliary Feedwater System interfaces.

A major feedwater line rupture is classified as an ANS Condition IV event (i.e., a limiting fault).

See Section 15.0.1 for a discussion of Condition IV events.

A main feedwater line rupture is the most limiting event in the decrease in secondary heat removal category. Therefore, a full transient analysis is presented here.

15.2-13 Amendment No. 104

CPNPP/FSAR The severity of the feedwater line rupture transient depends on a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. A number of cases of feedwater line break have been analyzed. Based on these analyses, it has been shown that the most limiting feedwater line ruptures are the double ended rupture of the largest feedwater line, occurring at full power with and without loss of offsite power, with no credit taken for pressurizer pressure control. These cases are analyzed below.

The following provides the necessary protection for a main feedwater line rupture:

1. A reactor trip on any of the following conditions:
a. High pressurizer pressure.
b. Overtemperature N-16.
c. Low-low steam generator water level in any steam generator.
d. Safety injection signals from any of the following:
1. Low steam line pressure.
2. High Containment pressure (hi-1).

(Refer to Chapter 7 for a description of the actuation system).

2. An Auxiliary Feedwater System to provide an assured source of feedwater to the steam generators for decay heat removal. (Refer to Section 10.4.9 for a description of the Auxiliary Feedwater System).

15.2.8.2 Analysis of Effects and Consequences 15.2.8.2.1 Method of Analysis The feedline break is analyzed with the RETRAN computer code (Reference 3) to demonstrate the adequacy of the Auxiliary Feedwater System for removing decay heat. The relevant acceptance criteria are that the hot leg and cold leg fluid remains subcooled and the RCS and MSS pressures remain below 110% of their respective design values.

The cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.

Major assumptions made in the analyses are as follows:

1. The plant is initially operating at Rated Thermal Power level plus uncertainties (3628 MWt).
2. Initial reactor coolant average temperature is 6.0°F above the nominal full power value, and the initial pressurizer pressure is 30 psi below its nominal value.
3. The pressurizer power operated relief valves are assumed operable as they minimize RCS pressure, which results in a lower saturation temperature. No credit is taken for the pressurizer spray and heaters.

15.2-14 Amendment No. 104

CPNPP/FSAR

4. For Unit 1, initial steam generator water level is at the nominal value, plus 10 percent in the faulted steam generator and at the nominal value minus 10 percent in the intact steam generators. For Unit 2, the initial steam generator water level is at the nominal value, plus 18 percent in the faulted steam generator and at the nominal value minus 7 percent in the intact steam generators.
5. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).
6. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.
7. Reactor trip occurs on steam generator low-low water level.
8. The limiting single active failure in the Auxiliary Feedwater System, the failure of one motor-driven auxiliary feedwater pump, is assumed. The flow from the second motor-driven auxiliary feedwater pump is assumed to spill out the break through the faulted steam generator. No credit is taken for heat removal through the faulted steam generator. The turbine-driven auxiliary feedwater pump is assumed to supply a total of 430 gpm to the three steam generators against a steamline backpressure of 1236 psia, beginning 85 seconds after the low-low steam generator water level setpoint is reached.

The remainder of the flow from the turbine-driven auxiliary feedwater pump is assumed to spill our the break through the faulted steam generator.

Approximately 250 seconds are required to purge the feedwater lines of main feedwater before relatively cold (120°F) auxiliary feedwater can enter the unaffected steam generators (Unit 2 only; Unit 1 has completely separate connections for main and auxiliary feedwater).

9. Thirty minutes after the reactor trip, operator action to isolate the Auxiliary Feedwater System from the break is assumed. In addition, and depending on the specific single failure assumptions, the operators may also have to start an additional MDAFP or open any closed TDAFP Steam Admission valves. At that time, an additional 370 gpm is assumed to be supplied to the three intact steam generators. No credit is taken for the delivery of additional auxiliary feedwater from the second motor-driven auxiliary feedwater pump.
10. No credit is taken for heat energy deposited in RCS metal during the RCS heatup.
11. No credit is taken for charging or letdown.
12. Steam generator heat transfer area is assumed to decrease as the shell side liquid inventory decreases.
13. Conservative core residual heat generation is based upon the American National Standard For Decay Heat Power In Light Water Reactors, ANSI/ANS-5.1-1979 and assumes an infinite irradiation time and a two sigma uncertainty allowance.
14. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

15.2-15 Amendment No. 104

CPNPP/FSAR

a. High pressurizer pressure.
b. Overtemperature N-16.
c. High pressurizer level.
d. High Containment pressure.
15. Although it is expected that the actuation of the safety injection system would occur during this event, the analysis conservatively does not model safety injection flow.

Receipt of a low-low steam generator water level signal in at least one steam generator starts the motor driven auxiliary feedwater pumps, which then deliver auxiliary feedwater flow to the steam generators. The turbine driven auxiliary feedwater pump is initiated if the low-low steam generator water level signal is reached in at least two steam generators. Similarly, receipt of a low steam line pressure signal in at least one steam line initiates a steam line isolation signal which closes the main steam line isolation valves in all steam lines. This signal also gives a safety injection signal which initiates flow of borated water into the RCS (not credited in this analysis). The amount of safety injection flow is a function of RCS pressure.

Emergency operating procedures following a secondary system line rupture typically will call for the following actions to be taken by the reactor operator:

1. Isolate feedwater flow spilling out the break of ruptured steam generator and align system so level in intact steam generators recovers. In addition, and depending on the specific single assumptions, the operators may also have to start an additional MDAFP or open any closed TDAFP Steam Admission valves.
2. Turn off all reactor coolant pumps (if offsite power is still available). The emergency operating procedure used in the event of secondary system line rupture when offsite power is available calls for reactor coolant pumps to be stopped in the case of either a normal or adverse (harsh) containment environment, if RCS subcooling is below specified limits and at least one CCP or SIP is operating. At this point, natural circulation will provide sufficient heat removal capability.
3. Stop high head safety injection pumps if RCS subcooling is adequate, and there is sufficient inventory in the intact steam generators, and the RCS pressure is stable or increasing, and the pressurizer level is increasing.

Shutting off the reactor coolant pumps (action 2, above) serves to decrease the addition of energy to the RCS. Isolating feedwater flow through the break allows additional auxiliary feedwater flow to be diverted to the intact steam generators (see assumption 9, above).

Subsequent to recovery of level in the intact steam generators, the high head safety injection pumps will be turned off and plant operating procedures will be followed in cooling the plant to hot shutdown conditions. These actions are not modeled in the safety analysis.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

15.2-16 Amendment No. 104

CPNPP/FSAR No reactor control systems are assumed to function. The Reactor Protection System is required to function following a feedwater line rupture as analyzed here. No single active failure will prevent operation of this system.

The engineered safety features system assumed to function is the Auxiliary Feedwater System.

The limiting single failure has been used, i.e., a failure of a motor-driven auxiliary feedwater pump.

Following the trip of the reactor coolant pumps, there will be a flow coastdown until flow in the loops reaches the natural circulation value. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss of AC power transient, to be sufficient to remove core decay heat following reactor trip. Pump coastdown characteristics are demonstrated in Sections 15.3.1 and 15.3.2, where DNB considerations are addressed for single and multiple reactor coolant pump trips, respectively.

A detailed description and analysis of the Safety Injection System is provided in Section 6.3. The Auxiliary Feedwater System is described in Section 10.4.9.

15.2.8.3 Conclusions For Units 1 and 2, the results of the analyses show that for the postulated feedwater line rupture, the assumed Auxiliary Feedwater System capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core.

Water relief can occur for feedwater line break events. Any water relief, however, would occur through the pressurizer power operated relief valves since they were conservatively assumed in the analysis to minimize RCS pressure, which results in a lower saturation temperature.

15.2.8.4 Analysis of Radiological Effects and Consequences Radioactivity doses from the postulated feedwater line rupture are less than those previously presented for the postulated steam line break. All applicable acceptance criteria are therefore met.

REFERENCES

1. Mangan, M. A., Overpressure Protection for Westinghouse Pressurized Water Reactors, WCAP-7769, Rev. 1, June 1972.
2. Westinghouse Anticipated Transients Without Trip Analysis, WCAP-8330, August 1974.
3. Huegel, D. S., et all, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-!, April 1999.
4. Friedlant, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

15.2-17 Amendment No. 104

CPNPP/FSAR TABLE 15.2-1 TABLE HAS BEEN DELETED.

Amendment No. 104

CPNPP/FSAR TABLE 15.2-2 NATURAL CIRCULATION FLOW DELETED Amendment No. 104

CPNPP/FSAR 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE A number of faults are postulated which could result in a decrease in Reactor Coolant System (RCS) flow rate. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.

Discussions of the following flow decrease events are presented in Section 15.3:

1. Partial loss of forced reactor coolant flow.
2. Complete loss of forced reactor coolant flow.
3. Reactor coolant pump shaft seizure (locked rotor).
4. Reactor coolant pump shaft break.

Item 1 above is considered to be an American Nuclear Society (ANS) Condition II event, item 2 an ANS Condition III event, and items 3 and 4 ANS Condition IV events. Section 15.0.1 contains a discussion of ANS classifications.

15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.3.1.1 Identification of Causes and Accident Description A partial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through individual buses connected to the generator.

When a generator trip occurs, the buses are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to supply coolant flow to the core.

Following any automatic turbine trip where there are no electrical or turbine faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pump buses remain connected to the network thus ensuring full flow for approximately 30 seconds after the reactor trip before any transfer is made. For a manual turbine trip, or a turbine trip due to certain turbine faults or certain generator protection signals, the generator remains connected to the network for approximately 11.5 seconds. For a complete description of the turbine/generator trip logic, see Figure 7.2-1, Sheet 16 and Figure 10.2-1.

This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8, low flow in any loop will actuate a reactor trip.

Between approximately 10 percent power (Permissive 7) and the power level corresponding to 15.3-1 Amendment No. 104

CPNPP/FSAR Permissive 8, low flow in any two loops will actuate a reactor trip. Above Permissive 7, two or more reactor coolant pump circuit breakers opening will actuate the corresponding undervoltage relays. This results in a reactor trip which serves as a back up to the low flow trip.

15.3.1.2 Analysis of Effects and Consequences Method of Analysis This transient (loss of one reactor coolant pump with four loops in operation) is analyzed using two digital computer codes: RETRAN and VIPRE. The RETRAN code (Reference 3) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE code (Reference 4) is then used to calculate the heat flux and DNBR during the transient based on the nuclear power, core inlet enthalpy and flow, and core exit pressure calculated by RETRAN.

Initial Conditions Initial reactor power, pressurizer pressure, and reactor coolant system (RCS) temperature are assumed to be at their nominal values. Uncertainties in initial conditions are included in the DNBR limit as described in the Revised Thermal Design Procedure (RTDP) (Reference 5). Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Reactivity Coefficients A conservatively large absolute value of the Doppler coefficient is used. The most positive moderator temperature coefficient is assumed because this results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of this accident.

15.3.1.3 Conclusions For Units 1 and 2 the analysis shows that the DNBR will not decrease below the limit value at any time during the transient. The DNBR design basis is described in Section 4.4. All applicable acceptance criteria are met.

15.3-2 Amendment No. 104

CPNPP/FSAR 15.3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 15.3.2.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator. When a generator trip occurs, the buses are automatically transferred to a transformer supplied from external power lines, and the pumps will continue to supply coolant flow to the core. Following any automatic turbine trip where there are no electrical or turbine faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pump buses remain connected to the network, thus ensuring full flow for 30 seconds after the reactor trip before any transfer is made. For a manual turbine trip, or a turbine trip due to certain turbine faults or certain generator protection signals, the generator remains connected to the network for approximately 11.5 seconds. For a complete description of the turbine/generator trip logic, see Figure 7.2-1, Sheet 16 and Figure 10.2-1.

This event is classified as an ANS Condition III incident (an infrequent fault) as defined in Section 15.0.1. However, this transient is analyzed to meet Condition II safety acceptance criteria.

The following signals provide the necessary protection against a complete loss of flow accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.
2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a simultaneous opening of all reactor coolant pump breakers. This function is blocked below approximately 10 percent power (Permissive P-7).

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid.

Reference [2] provides analyses of grid frequency disturbances and the resulting Nuclear Steam Supply System protection requirements which are applicable to the Comanche Peak Nuclear Power Plant (CPNPP). The maximum expected frequency decay rate for the Luminant Power system power grid is 2.4 Hz./sec. (see Section 8.2.2); thus, the nominal underfrequency setpoint of 57 Hz., as recommended in Reference [2], (which examined grid frequency decay rates as high as 5 Hz./sec.) is appropriate for Comanche Peak.

Due to the rapid decrease in the reactor coolant pump bus frequency following a loss of offsite power, the underfrequency reactor trip function will usually initiate a reactor trip prior to the undervoltage reactor trip function.

15.3-3 Amendment No. 104

CPNPP/FSAR The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive P-8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive P-7) and the power level corresponding to Permissive P-8, low flow in any two loops will actuate a reactor trip. For a decrease in reactor coolant flow during operation below approximately 10 percent power (Permissive P-7), there is no immediate reactor trip function required. Natural circulation flow in the RCS provides adequate core cooling capability. If the maximum grid frequency decay rate is less than approximately 2.5 Hz./sec., this trip function will protect the core from underfrequency events. This effect is fully described in Reference [2]. In addition, the overtemperature N-16 trip function remains active, and will result in a reactor trip if the core protection limits described in Section 15.0 of the FSAR are approached.

15.3.2.2 Analysis of Effects and Consequences Method of Analysis This transient (complete loss of forced reactor coolant flow) is analyzed using two digital computer codes: RETRAN and VIPRE. The RETRAN code (Reference 3) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE code (Reference 4) is then used to calculate the heat flux and DNBR during the transient based on the nuclear power, core inlet enthalpy and flow, and core exit pressure calculated by RETRAN.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are similar to those discussed in Section 15.3.1, except that following the loss of power supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency.

15.3.2.3 Conclusions For Units 1 and 2, the analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the limit value at any time during the transient. The design basis for DNBR is described in Section 4.4. All applicable acceptance criteria are met.

15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR) 15.3.3.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor such as is discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid 15.3-4 Amendment No. 104

CPNPP/FSAR expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators causes an insurge into the pressurizer and a pressure increase throughout the RCS.

The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

This event is classified as an ANS Condition IV incident (a limiting fault) as defined in Section 15.0.1. This classification is used in the Chapter 15 safety analysis. However, the results of the analysis for this event meet the safety criteria for a Condition III event. The peak RCS pressure is maintained below 110% of the design pressure, and the peak clad average temperature is well below 2700°F.

15.3.3.2 Analysis of Effects and Consequences Method of Analysis This transient (locked rotor) is analyzed using two digital computer codes: RETRAN and VIPRE.

The RETRAN code (Reference 3) is used to calculate the loop and core flow transients following the pump shaft seizure, the time of reactor trip based on the loop flow transients, the nuclear power transient, and the primary system pressure and temperature transients. The thermal behavior of the fuel located at the core hot spot is analyzed using the VIPRE code (Reference 4),

which uses the core flow and the nuclear power calculated by RETRAN. The VIPRE code includes a film boiling heat transfer coefficient.

Two locked rotor cases are analyzed. The first case maximizes the peak clad temperature (PCT) and peak RCS pressure. The second case maximizes the percentage of fuel rods that experience DNB conditions.

At the beginning of the postulated locked rotor accident for the PCT/peak RCS pressure case, i.e., at the time the shaft in one of the reactor coolant pumps is assumed to seize, the plant is assumed to be in operation under the most adverse steady state operating conditions, i.e.,

maximum guaranteed steady state thermal power, maximum steady state pressure, and maximum steady state coolant average temperature, with consideration for uncertainties in the measurement and control channels. Plant characteristics and initial conditions are further discussed in Section 15.0.3. The accident as evaluated accounts for a loss of offsite power by assuming power to the unaffected reactor coolant pumps is lost coincident with the reactor trip.

For the peak pressure evaluation, a positive moderator temperature coefficient is assumed and the initial pressure is conservatively estimated as 30 pounds per square inch (psi) above nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement and control channels.

This is done to obtain the highest possible rise in the coolant pressure during the transient.

For the rods-in-DNB case, the initial core power is assumed to be at the nominal value consistent with steady-state, full-power operation. The initial pressurizer pressure and vessel average temperature are assumed to be at the respective nominal values, and the reactor coolant flow is 15.3-5 Amendment No. 104

CPNPP/FSAR at the minimum measured flow value. Uncertainties in the initial conditions are accounted for in the DNBR limit value as described in Reference 5.

Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is assumed to begin one second after the flow in the affected loop reaches 87 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip.

Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.

The pressurizer safety valves are fully open at 2575 psia and their capacity for steam relief is as described in Section 5.4. No water relief through the pressurizer safety valves occurs for the reactor coolant pump locked rotor (and shaft break) events.

Evaluation of PCT and Zirconium-Water Reaction During the Accident For this evaluation, DNB is assumed to occur in the core at the initiation of the transient in order to conservatively predict the peak clad temperature. Therefore, an evaluation of the consequences with respect to fuel rod thermal transients is performed. Results obtained from analysis of this hot spot condition represent the upper limit with respect to clad temperature and zirconium-water reaction.

In the evaluation, the rod power at the hot spot is assumed to be 2.5 times the average rod power (i.e., FQ = 2.5) at the initial core power level.

Film Boiling Coefficient The film boiling coefficient is calculated using the Bishop-Sandberg-Tong film boiling correlation.

The fluid properties are evaluated at film temperature (average between wall and bulk temperatures). The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density and mass flow rate as a function of time are used as program input.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with the initial fuel temperature to a conservatively large value at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient.

15.3-6 Amendment No. 104

CPNPP/FSAR Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium-steam reaction.

2 d( w ) 6

= 33.3 x 10 exp ( - 45, 500/1.986T )

dt where w = amount reacted (mg/cm2) t = time (sec)

T = temperature (°K)

The heat of reaction is 1510 cal/gm.

The effect of the zirconium-steam reaction is included in the calculation of the hot spot clad temperature transient.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

Evaluation of the Radiological Consequences An evaluation of the number of rods in DNB was performed in order to assess the radiological consequences of this event. Analysis assumptions were made to maximize the heat flux and thus minimize the DNB, consistent with the current FSAR. The number of rods experiencing DNB is determined from a pin census showing the relative peaking factors of each rod.

Locked Rotor The doses resulting from a locked rotor accident are based on a conservative fission product release to the reactor coolant of the gap activity shown in sheet 2 of Table 15.0-7 from 15% of the fuel rods in the core. The method follows Regulatory Guide 1.195. Prior to the accident, it is assumed that the plant has been operating with simultaneous fuel defects and steam generator tube leakage for a sufficient amount of time to establish equilibrium levels of activity in the primary and secondary coolants equal to the Table 15.1-4 values.

Following the postulated locked rotor accident, the activity released from the pellet-gap due to the fuel failure is assumed to be instantaneously released to the primary coolant and is assumed to be immediately available for release from the RCS.

The following assumptions are used in the analysis:

15.3-7 Amendment No. 104

CPNPP/FSAR

1. The initial Reactor Coolant System (RCS) iodine activity is 1.0 uCi/gm DE I-131.
2. The initial RCS noble gas activity is based on 1% fuel defects.
3. The initial secondary coolant iodine activity is 0.1 uCi/gm DE I-131.
4. A radial peaking factor (FH) of 1.65 is applied in the calculation of gap activities released (per Regulatory Guide 1.195).
5. 15% of rods are assumed to undergo clad damage sufficient to release all of their gap activity.
6. The primary to secondary leak rate is 1.0 gpm plant total.

A summary of the parameters used in the analysis is given in Table 15.3-1.

Based on the foregoing model, the thyroid and whole body doses are conservatively calculated to be 2.7 rem and 0.17 rem, respectively, for the exclusion area boundary (EAB), and 5.1 rem and 0.058 rem respectively, for the low population zone (LPZ). These doses are well below the values of 30 rem thyroid and 2.5 rem whole body set forth in Regulatory Guide 1.195.

15.3.3.3 Conclusions For Units 1 and 2, the following conclusions are made:

1. Because the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.
2. Because the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2700°F, the core will remain in place and intact with no loss of core cooling capability.
3. The number of rods experiencing DNB remains less than the number of rods assumed to experience DNB for the radiological analysis (i.e., the radiological doses are below the dose values set forth in 10CFR100).

15.3.4 REACTOR COOLANT PUMP SHAFT BREAK 15.3.4.1 Identification of Causes and Accident Description The accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor seizure event. With a failed shaft, the impeller could conceivably be free to spin in the reverse direction instead of being fixed in position. The effect of such reverse spinning is a slight decrease in the end point (steady state) core flow.

15.3-8 Amendment No. 104

CPNPP/FSAR The analysis presented in Section 15.3.3 represents the limiting condition, assuming a locked rotor for forward flow but a free-spinning shaft for reverse flow in the affected loop.

15.3.4.2 Conclusions The conclusions of Section 15.3.3.3 apply for the Reactor Coolant Pump Shaft Break event.

REFERENCES

1. Not Used.
2. Baldwin, M. S., Merrian, M. M., Schenkel, H. S. and Van De Walle, D. J., An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in Westinghouse PWRs, WCAP-8424, Revision 1, June 1975.
3. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.
4. Sung, Y. X. et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A, October 1999.
5. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

15.3-9 Amendment No. 104

CPNPP/FSAR TABLE 15.3-1 Page 1 of 2 PARAMETERS FOR POSTULATED LOCKED ROTOR ACCIDENT ANALYSIS

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level 3684
b. Primary coolant activity concentration 1.0 uCi/gm Dose prior to accident Equivalent I-131
c. Secondary side coolant activity concentration 0.1 uCi/gm Dose prior to accident Equivalent I-131
d. Primary to secondary leakage 1 gpm plant total
e. Offsite power lost
f. Failed fuel 15%
g. Radial Peaking Factor 1.65
2. Data assumptions used to estimate activity released
a. Iodine partition factor for steam release from 0.01 secondary side
b. Steam release from secondary side 450,000 (0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 1,300,000 (2 - 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />)
3. Dispersion data
a. EAB and LPZ distances 2080 m and 4 miles
b. X/Q @ EAB (0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 1.6 x 10-4 sec/m3

@ LPZ (0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) 2.4 x 10-5 sec/m3

@ LPZ (8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) 1.6 x 10-5 sec/m3

4. Dose Data
a. Method of dose calculations See Appendix 15B
b. Dose conversion assumptions See Appendix 15B
c. Doses thyroid whole body (gamma dose)

Amendment No. 104

CPNPP/FSAR TABLE 15.3-1 Page 2 of 2 PARAMETERS FOR POSTULATED LOCKED ROTOR ACCIDENT ANALYSIS

@ EAB (0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 2.7 rem 0.17 rem

@ LPZ (0 - 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) 5.1 rem 0.058 rem Amendment No. 104

CPNPP/FSAR TABLE 15.3-2 HAS BEEN DELETED.

Amendment No. 104

CPNPP/FSAR 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivity and power distribution anomalies. Reactivity changes could be caused by control rod motion or ejection, boron concentration changes, or addition of cold water to the Reactor Coolant System (RCS). Power distribution changes could be caused by control rod motion, misalignment, or ejection, or by static means such as fuel assembly mislocation. These events are discussed in this section.

Detailed analyses are presented for the most limiting of these events.

Discussions of the following incidents are presented in Section 15.4:

1. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.
2. Uncontrolled rod cluster control assembly bank withdrawal at power.
3. Rod cluster control assembly misalignment.
4. Startup of an inactive reactor coolant pump at an incorrect temperature.
5. A malfunction or failure of the flow controller in a BWR loop that results in an increased reactor coolant flow rate. (Not applicable to the Comanche Peak Nuclear Power Plant (CPNPP).)
6. Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant.
7. Inadvertent loading and operation of a fuel assembly in an improper position.
8. Spectrum of rod cluster control assembly ejection accidents.

Items 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II events, item 7 an ANS Condition III event, and item 8 an ANS Condition IV event. Item 3 entails both Condition II and III events. Section 15.0.1 contains a discussion of ANS classifications.

15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of one or more RCCA banks resulting in a power excursion. Such a transient could be caused by operator action or by a malfunction of the reactor control or rod control systems. This could occur with the reactor subcritical, at hot zero power or at power. The at power case is discussed in Section 15.4.2.

The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCAs from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The 15.4-1 Amendment No. 106

CPNPP/FSAR RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is greater than that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed.

This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the Reactor Protection System:

1. Source range high neutron flux reactor trip Actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified value.
2. Intermediate range high neutron flux reactor trip Actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two out of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three out of the four channels indicate a power level below this value.
3. Power range high neutron flux reactor trip (low setting)

Actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two out of the four power range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated only after three out of the four channels indicate a power level below this value.

4. Power range high neutron flux reactor trip (high setting)

Actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

5. High nuclear flux rate reactor trip Actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicates a rate above the preset setpoint. This trip function is always active.

15.4-2 Amendment No. 106

CPNPP/FSAR In addition, control rod stops on high intermediate range flux level (one out of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

15.4.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages. First, a spatial neutron kinetics computer code, TWINKLE (Reference 4), is used to calculate the core average nuclear power transient, including various core feedback effects, i.e.,

Doppler and moderator reactivity. Next, the FACTRAN computer code (Reference 5) uses the average nuclear power calculated by TWINKLE and performs a fuel rod transient heat transfer calculation to determine the core average heat flux and hot spot fuel temperature transients.

Finally, the core average heat flux calculated by FACTRAN is used in the VIPRE computer code (Reference 6) for DNBR calculations.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results for a startup accident, the following assumptions are made:

1. The magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler-only power defect.

Therefore, a conservatively low absolute value is used to maximize the nuclear power transient.

2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient.

The most positive value of the moderator temperature coefficient is used in the analysis to yield the maximum peak heat flux.

3. The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.
4. Reactor trip is assumed to be initiated by power range high neutron flux (low setting).

The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10 percent increase is assumed for the power range flux trip setpoint raising it from the nominal value of 25 percent to 35 percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.0.5 for RCCA insertion characteristics.

15.4-3 Amendment No. 106

CPNPP/FSAR

5. Reactivity insertion rates are assumed to bound the maximum positive reactivity insertion rate that would result from the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute). Control rod drive mechanism design is discussed in Section 4.6.
6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.
7. The initial power level was assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
8. Two reactor coolant pumps are assumed to be in operation.
9. The RCS pressure is below nominal pressure by 30 psi.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

15.4.1.3 Conclusions For Units 1 and 2, in the event of an RCCA withdrawal accident from the subcritical condition, the core and the RCS are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. The DNBR design basis as described in Section 4.4; is met.

15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER 15.4.2.1 Identification of Causes and Accident Description Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB.

Therefore, in order to avert damage to the fuel clad the Reactor Protection System is designed to terminate any such transient before the DNBR falls below the limit value.

This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

The automatic features of the Reactor Protection System which prevent core damage following the postulated accident include the following:

1. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint.

15.4-4 Amendment No. 106

CPNPP/FSAR

2. Reactor trip is actuated if any two out of four N-16 channels exceed an Overtemperature N-16 setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
3. Reactor trip is actuated if any two out of four N-16 channels exceed an Overpower N-16 setpoint. This setpoint can be automatically varied with axial power imbalance to ensure that the allowable heat generation rate (kW/ft) is not exceeded.
4. A high pressurizer pressure reactor trip actuated from any two out of four pressure channels, which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
5. A high pressurizer water level reactor trip actuated from any two out of three level channels when the reactor power is above approximately 10 percent (Permissive-7).
6. Reactor trip is actuated if any two of four power range neutron flux high positive rate channels exceed a setpoint to protect against exceeding the Reactor Coolant System pressure limits.

In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:

1. High neutron flux (one out of four power range).
2. Overpower N-16 (two out of four).
3. Overtemperature N-16 (two out of four).

The manner in which the combination of Overpower and Overtemperature N-16 trips provide protection over the full range of RCS conditions is described in Chapter 7. Figure 15.0-1 presents allowable reactor coolant loop Tcold and power for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the Overpower N-16 trip and the Overtemperature N-16 trip are represented as protection lines on this diagram. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); Overpower and Overtemperature N-16 (variable setpoints).

15.4.2.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed for Units 1 and 2 using the RETRAN computer code (Reference 10).

15.4-5 Amendment No. 106

CPNPP/FSAR Multiple cases (with varying reactivity insertion rates) at initial power levels of 100%, 60% and 10% of rated thermal were analyzed.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made:

1. The initial core power, pressurizer pressure and vessel average temperature are assumed to be at the respective nominal values, and the reactor coolant flow is at the minimum measured flow value. Uncertainties in the initial conditions are accounted for in the DNBR limit value as described in Reference 11.
2. Reactivity coefficients - two feedback conditions are analyzed:
a. Minimum reactivity feedback A least negative or positive value of the moderator temperature coefficient of reactivity is assumed corresponding to the beginning of core life. A conservatively small (in absolute magnitude) value of the Doppler coefficient is assumed.
b. Maximum reactivity feedback A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler coefficient are assumed.
3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 115 percent of nominal full power. The N-16 trips include allowances for all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.
4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.

The effect of RCCA movement on the axial core power distribution is accounted for by causing a decrease in Overtemperature N-16 trip setpoint proportional to a decrease in margin to DNB.

For conservatism, this feature is not credited in the analysis of the uncontrolled RCCA bank withdrawal at power event.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

15.4.2.3 Conclusions For Units 1 and 2, all relevant event acceptance criteria are satisfied. The reactor is tripped sufficiently fast during the RCCA withdrawal at power transient to ensure that the ability of the 15.4-6 Amendment No. 106

CPNPP/FSAR primary coolant to remove heat from the fuel rods is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The high neutron flux, Overtemperature N-16 and Overpower N-16 trip channels provide adequate protection over the entire range of possible reactivity insertion rates; i.e., the minimum value of DNBR is always larger than the limit value.

15.4.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT (SYSTEM MALFUNCTION OR OPERATOR ERROR) 15.4.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include:

1. One or more dropped RCCAs within the same group,
2. A dropped RCCA bank,
3. Statically misaligned RCCA,
4. Withdrawal of a single RCCA.

Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the operators convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates an alarm and a control room annunciator. Group demand position is also indicated.

Full length RCCAs are moved in preselected banks, and the banks are moved in the same preselected sequence. Each control bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism.

Since the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.

The dropped RCCA assemblies, dropped RCCA assembly bank, and statically misaligned RCCA assembly events are classified as ANS Condition II incidents (incidents of moderate frequency) as defined in Section 15.0.1. The single RCCA withdrawal incident is classified as an ANS Condition III event (i.e., an infrequent fault), as discussed below.

No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single random failure is of the order of 10-4/year; refer to Section 7.7.2.2) or multiple significant operator errors and subsequent and repeated operator 15.4-7 Amendment No. 106

CPNPP/FSAR disregard of event indication. The probability of such a combination of conditions is considered sufficiently low that the limiting consequences may include slight fuel damage.

Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant, and shall not cause more than a small fraction of fuel elements in the reactor to be damaged...

The selection of this criterion is in accordance with GDC 25 which states, The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods. (Emphases have been added). It has been shown that single failures resulting in RCCA bank withdrawals do not violate specified fuel design limits. Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that the criterion established for the single rod withdrawal at power accident is appropriate and in accordance with GDC 25.

A dropped RCCA or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the Nuclear Instrumentation System,
2. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples,
3. Rod at bottom signal,
4. Rod deviation alarm, or
5. Rod position indication.

Misaligned RCCAs are detected by:

1. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples,
2. Rod deviation alarm, or
3. Rod position indicators.

Rod position is displayed in 6 step increments with an accuracy of +/-4 steps. Deviation of any RCCA from its group by twice this distance (12 steps) will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 6 steps. If the rod deviation alarm is not operable, the operator is required to take action as required by the Technical Requirements Manual (TRM).

If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to assure the alignment of the non-indicated RCCAs. The operator is also required to take action as required by the technical specifications.

15.4-8 Amendment No. 106

CPNPP/FSAR In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the Overtemperature N-16 reactor trip, although due to the increase in local power density it is not possible in all cases to provide assurance that the core safety limits will not be violated.

Plant systems and equipment which are available to mitigate the effects of the various control rod misoperations are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

15.4.3.2 Analysis of Effects and Consequences

1. Dropped RCCAs, dropped RCCA bank, and statically misaligned RCCA.

Method of Analysis

a. One or more dropped RCCAs from the same group.

For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN computer code (Reference 7) with the methodology described in Reference 8.

Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transients and the hot channel factor from the nuclear analysis, the DNB basis can be shown to be met using dropped rod limit lines developed with the VIPRE computer code (Reference 6).

Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. If the worth of the dropped rod(s) is sufficiently large, and if the turbine load is constant, a reactor trip may occur on low pressurizer pressure due to the mismatch between the reactor power and the turbine power. The core is not adversely affected during this period since power is decreasing rapidly.

Following reactor trip, normal shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.

For those dropped RCCAs which do not result in a reactor trip, power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

15.4-9 Amendment No. 106

CPNPP/FSAR For a dropped RCCA event in the automatic rod control mode, the Rod Control System detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power.

Uncertainties in the initial conditions are included in the DNB evaluation. In all cases, the minimum DNBR remains above the limit value.

b. Dropped RCCA Bank A dropped RCCA bank typically results in a negative reactivity insertion greater than 500 pcm. Due to the relatively large worth of the dropped bank, and if the turbine load is constant, a reactor trip may occur on low pressurizer pressure due to the mismatch between the reactor power and the turbine power. The core is not adversely affected during this period, since power is decreasing rapidly.

Following reactor trip, normal shutdown procedures are followed to further cool down the plant. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following the incident.

c. Statically Misaligned RCCA No transient analysis is performed, rather steady state power distributions are analyzed using the ANC computer code (Reference 9). The peaking factors are then compared to peaking factor limits developed using the VIPRE computer code (Reference 6), which are based on meeting the DNB design criterion.

The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value.

The insertion limits in the technical specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, and RCS pressure and temperature are at their nominal values including uncertainties but with the increased radial peaking factor associated with the misaligned RCCA.

DNB calculations have not been performed specifically for RCCAs missing from other banks; however, power shape calculations have been done as required for 15.4-10 Amendment No. 106

CPNPP/FSAR the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kw/ft situation is less severe than the bank D case discussed above assuming insertion limits on the other banks equivalent to a bank D full-in insertion limit.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, and RCS pressure and temperature are at their nominal values, including uncertainties but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.

Following the identification of a RCCA group misalignment condition by the operator is required to take action as required by the plant technical specifications and operating instructions.

2. Single RCCA Withdrawal Method of Analysis Power distributions within the core are calculated using the ANC computer code (Reference 9). The peaking factors are then used by the VIPRE computer code (Reference 6) to calculate the DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the insertion limit, with the reactor initially at full power, is analyzed. This incident is assumed to occur at the initial core power, pressurizer pressure and vessel average temperature are assumed to be at the respective nominal values, and the reactor coolant flow is at the minimum measured flow value.

Uncertainties in the initial conditions are accounted for in the DNBR limit value as described in Reference 11.

For the single rod withdrawal event, two cases are considered as follows:

a. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the Overtemperature N-16 trip would be expected to trip the plant shows that an upper limit for the number of fuel rods with a DNBR less than the limit value is 5 percent of the total rods in the core.

15.4-11 Amendment No. 106

CPNPP/FSAR

b. If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case a described above.

For such cases as above, a reactor trip will ultimately ensue, although not sufficiently fast in all cases to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures are followed. No single failure of the Reactor Trip System will negate the protection functions required for the single RCCA withdrawal accident, or adversely affect the consequences of the accident.

15.4.3.3 Conclusions For Units 1 and 2, it is confirmed that the DNBR remains greater than the limit value for all cases of dropped RCCAs and dropped banks; therefore the DNB design basis is met. It is shown for all cases which do not result in reactor trip that the DNBR remains greater than the limit value and, therefore, the DNB design is met.

For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value.

For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core.

15.4.4 STARTUP OF AN INACTIVE REACTOR COOLANT PUMP AT AN INCORRECT TEMPERATURE 15.4.4.1 Identification of Causes and Accident Description If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the steam generator in the inactive loop is not isolated, there is a temperature drop across the steam generator in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

CPNPP technical specifications require all four reactor coolant loops to be in operation while at power or in startup conditions (Modes 1 and 2). Since by definition, the event can only occur during power operations (Mode 1 and 2) when a loop is out of service, a detailed analysis of this event is not presented.

15.4.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE This section is not applicable to the CPNPP.

15.4-12 Amendment No. 106

CPNPP/FSAR 15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT 15.4.6.1 Identification of Causes and Accident Description One of the two principal means of positive reactivity insertion to the core is the addition of unborated, primary grade water from the Demineralized and Reactor Makeup Water System (RMWS) into the RCS through the reactor makeup portion of the Chemical and Volume Control System (CVCS). Boron dilution with these systems is a manually initiated operation under strict administrative controls requiring close operator surveillance with procedures limiting the rate and duration of the dilution. A boric acid blend system is available to allow the operator to match the makeups boron concentration to that of the RCS during normal charging.

A comprehensive review of the primary system showed that a single failure in the NaOH spray system would not result in a boron dilution of the Reactor Coolant System and that the CVCS malfunction represents the most limiting potential source of dilution. Based on this review, it is clear that the analysis results presented below bounds all potential sources of inadvertent dilution under all modes of operation.

The principal means of causing an inadvertent boron dilution are the opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. The CVCS and RMWS are designed to limit, even under various postulated failure modes, the potential rate of dilution to values which, with indication by alarms and instrumentation, will allow sufficient time for automatic or operator response (depending on the mode of operation) to terminate the dilution. An inadvertent dilution from the RMWS may be terminated by closing the primary water makeup control valve. All expected sources of dilution may be terminated by closing isolation valves in the CVCS, 1,2-LCV-112B and C. The lost shutdown margin (SDM) may be regained by the opening of isolation valves to the RWST, 1,2-LCV-112D and E, thus allowing the addition of borated water to the RCS.

The rate at which unborated water can be added to the RCS is limited by the design of the CVCS and RMWS. Alarms in the CVCS are available to alert the reactor operators to high flow rates.

In addition, the makeup flow is limited to a maximum dilution flow rate of 167 gpm for Cold Shutdown, Hot Shutdown and Hot Standby.

Generally, to dilute, the operator must perform two distinct actions:

1. Switch control of the makeup from the automatic makeup mode to the dilute mode, and
2. Turn the RCS makeup actuation handswitch to the on position.

Failure to carry out either of the above actions prevents initiation of dilution. Also during normal operation the operator may add borated water to the RCS by blending boric acid from the boric acid storage tanks with primary grade water. This requires the operator to determine the concentration of the addition and to set the blended flow rate and the boric acid flow rate. The makeup controller will then limit the sum of the boric acid flow rate and primary grade water flow rate to the blended flow rate after turning the RCS system makeup actuation switch to the on position (i.e., the controller determines the primary grade water flow rate).

15.4-13 Amendment No. 106

CPNPP/FSAR The status of the RCS makeup is continuously available to the operator by:

1. Indication of the boric acid and blended flow rates,
2. CVCS and RMWS pump status lights,
3. Deviation alarms if the boric acid or blended flow rates deviate by +/- 1 gpm or +/- 8 gpm, respectively, from the preset values,
4. High charging flow rate alarm,
5. Volume control tank high and high-high water level and high pressure alarms,
6. Letdown divert valve position alarm,
7. Source Range Neutron Flux - when reactor is subcritical;
a. High Flux at Shutdown Alarm,
b. Indicated Source Range Neutron Flux count rates,
c. Audible Source Range Neutron Flux count rate, and
d. Source Range Neutron Flux - Doubling Alarm.
8. With the reactor critical
a. Axial Flux Difference Alarm (reactor power 50% RTP),
b. Control Rod Insertion Limit Low and Low-Low Alarms,
c. Overtemperature N-16 Alarm (at power),
d. Overtemperature N-16 turbine runback (at power),
e. Overtemperature N-16 Reactor Trip, and
f. Power Range Neutron Flux - High, both high and low setpoint Reactor Trips.

This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

15.4.6.2 Analysis of Effects and Consequences To cover all phases of plant operation, boron dilution during Refueling, Cold Shutdown, Hot Shutdown, Hot Standby, Startup, and Power modes of operation are considered in this analysis.

Conservative values for necessary parameters were used, i.e., high RCS critical boron concentrations, high boron worths, minimum shutdown margins, and lower than actual RCS volumes. These assumptions result in conservative determinations of the time available for operator or system response after detection of a dilution transient in progress.

15.4-14 Amendment No. 106

CPNPP/FSAR Dilution During Refueling An uncontrolled boron dilution transient cannot occur during this mode of operation. Inadvertent dilution is prevented by administrative controls which isolate the RCS from the potential source of unborated water. Either valve 1,2CS-8455 or valves 1,2CS-8560, 1,2FCV-111B, 1,2CS-8441, 1,2CS-8453 and 1,2CS-8439 in the CVCS will be locked closed during refueling operations.

These valves block all flow paths that could allow significant rates of unborated makeup water to reach the RCS. Any makeup which is required during refueling will be borated water supplied from the RWST.

Dilution During Cold Shutdown, Hot Shutdown and Hot Standby The Technical Specifications require the reactor to be shutdown by the amount specified in the Core Operating Limits Report when the unit is operating in Mode 5 (Cold Shutdown), Mode 4, or 3, (Hot Shutdown or Hot Standby). The following conditions are assumed for the analysis of the inadvertent boron dilution event while in these operating modes:

1. An assumed dilution flow rate of 157.5 gpm is used. This value corresponds to the high charging flow rate alarm plus a 5% allowance for uncertainties.
2. The following minimum RCS water volumes are used while in these operating modes:

Mode(s) RCS Water Volume (ft3) Assumption Used to Minimize RCS Water Volume 3, 4, & 9903.7 (Unit 1) The volumes for the pressurizer, surge line and 5 (filled) 8594.1 (Unit 2) reactor vessel upper head were excluded.

5 (drained) The RCS water level is drained down to the mid-4513.0 (Units 1 & 2) plane of the hot legs.

3. If no reactor coolant pump is in operation, all dilution sources are isolated or under administrative control.

Dilution During Startup Startup is a transitory mode of operation. In this mode the plant is being taken from one long term mode of operation, Hot Standby, to another, Power. The plant is maintained in the Startup mode only for the purpose of startup testing at the beginning of each cycle. During this mode of operation the plant is in manual control, i.e., Tavg/ rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation. The Technical Specifications require a SDM of at least 1.3% K/K and four reactor coolant pumps operating.

Other conditions assumed are:

1. Dilution flow rate is limited by the design of the CVCS and RMWS. The makeup flow rate is limited to a maximum of 157.5 gpm for startup, which corresponds to the high charging flow alarm plus uncertainties.

15.4-15 Amendment No. 106

CPNPP/FSAR

2. A minimum RCS water volume of 11072 (Unit 1) and 9762 (Unit 2) ft3. These very conservative estimates of the active RCS volume exclude the pressurizer and surge line volumes.

Dilution During Full Power Operation The plant may be operated at power two ways, automatic Tavg/rod control or under manual (operator) rod control. The Technical Specifications require an available shutdown margin as specified in the Core Operating Limits Report and four reactor coolant pumps operating. With the plant at power and the RCS at pressure, the dilution rate is limited by the capacity of the centrifugal charging pumps (analysis is performed assuming two charging pumps are in operation even though normal operation is with one pump). Conditions assumed for this mode are:

1. Dilution flow rate is limited by the design of the CVCS and RMWS. The makeup flow rate is limited to a maximum of 157.5 gpm, which corresponds to the high charging flow alarm plus uncertainties. When the pressurizer level control is in manual, the maximum assumed dilution flow rate is 157.5 gpm and when in automatic pressurizer level control, the dilution is limited to the maximum letdown flow rate (approximately 125 gpm).
2. A minimum RCS water volume of 11072 (Unit 1) and 9762 (Unit 2) ft3. These very conservative estimates of the active RCS volume exclude the pressurizer and surge line volumes.

15.4.6.3 Conclusions Dilution During Refueling Dilution during this mode has been precluded through administrative control of valves in the possible dilution flow paths (see Section 15.4.6.2).

Dilution During Cold Shutdown, Hot Shutdown, or Hot Standby In Modes 3, 4, or 5, the reactor operators are relied upon to detect and recover from an inadvertent boron dilution event. Numerous alarms from the CVCS and RMWS and in the Nuclear Instrumentation System are available to provide assistance to the reactor operator in the detection of an inadvertent boron dilution event. In the analyses of the event initiated from Mode 3, 4, or 5, the VCT high water level alarm (at 70% span) is credited as the initial alarm.

The time required to perform the VCT/RWST valve swap-over and to purge the charging lines of dilute water are included in the calculation of the time available to the reactor operators to initiate corrective actions. For both units, in Modes 3, 4 and 5, analyses have demonstrated that the reactor operators have at least 15 minutes in which to initiate actions to terminate the dilution and initiate boration of the RCS.

Dilution During Startup This mode of operation is a transitory mode to go to power and is the operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode the reactor is in manual rod control with the operator required to maintain a very high 15.4-16 Amendment No. 106

CPNPP/FSAR awareness of the plant status. For a normal approach to criticality the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The plant Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching criticality thus assuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the Source Range reactor trip after receiving P-6 from the Intermediate Range. Too fast a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the Source Range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor.

However, in the event of an unplanned approach to criticality or dilution during power escalation while in the Startup mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the Power Range Neutron Flux - High, low setpoint (nominally 25% RTP). After reactor trip there is at least 15 minutes for operator action prior to return to criticality. The required operator action is the opening of valves 1,2-LCV-112D and E to initiate boration and the closing of valves 1,2-LCV-112B and C to terminate dilution.

Dilution During Full Power Operation With the reactor under manual rod control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the Overtemperature N-16 trip setpoint resulting in a reactor trip. After reactor trip there is at least 15 minutes for operator action prior to return to criticality. The required operator action is the opening of valves 1,2-LCV-112D and E and the closing of valves 1,2-LCV-112B and C. The boron dilution transient in this case is essentially equivalent to an uncontrolled rod withdrawal at power. A reactor trip occurs when either the Hi Neutron Flux or the Overtemperature N-16 setpoint is reached. The maximum reactivity insertion rate for a boron dilution transient is conservatively estimated to be within the range of insertion rates analyzed for uncontrolled rod withdrawal at power.

It should be noted that prior to reaching the Overtemperature N-16 reactor trip the operator will have received an alarm on Overtemperature N-16 and an Overtemperature N-16 turbine runback. With the reactor in automatic rod control the pressurizer level controller will limit the dilution flow rate to the maximum letdown rate, approximately 125 gpm. If a dilution rate in excess of the letdown rate is present, the pressurizer level controller will throttle charging flow down to match the letdown rate.

Thus, with the reactor in automatic rod control, a boron dilution will result in a power and temperature increase such that the rod controller will attempt to compensate by slow insertion of the control rods. This action by the controller will result in at least three alarms to the operator:

1. rod insertion limit - low level alarm,
2. rod insertion limit - low-low level alarm if insertion continued after (1) above, and
3. axial flux difference alarm (I outside of the target band).

Given the many alarms, indications, and the inherent slow process of dilution at power, the operator has sufficient time for action. For example, the operator has at least 15 minutes from 15.4-17 Amendment No. 106

CPNPP/FSAR the rod insertion limit low-low alarm until the shutdown margin is completely eroded at beginning-of-life. The time would be significantly longer at end-of-life, due to the low initial boron concentration, when shutdown margin is a concern.

The above results demonstrate that in all modes of operation an inadvertent boron dilution is precluded, or sufficient time is available for operator action to terminate the transient. Following termination of the dilution flow and initiation of boration, the reactor is in a stable condition with the operator regaining the required shutdown margin.

15.4.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY INTO AN IMPROPER POSITION 15.4.7.1 Acceptance Criteria This event is classified as a Condition III event. Condition III events are defined as those events that do not cause more than a small fraction of fuel rods to fail, although sufficient fuel damage might occur to preclude immediate resumption of operation. The specific acceptance criteria for this even are as follows:

a. To meet the requirements of General Design Criteria 13, plant operating procedures should include a provision requiring that reactor instrumentation be used to search for potential fuel loading errors after fueling operations.
b. In the event the error is not detectable by the instrumentation system and fuel rod failure limits could be exceeded during normal operation, the offsite consequences should be a small fraction of the 10 CFR Part 100 guidelines.

15.4.7.2 Identification of Causes and Accident Description The Inadvertent Loading Event comprises core misloading scenarios such as the loading of one or more fuel assemblies into improper positions, the loading of a fuel rod during manufacture with one or more pellets of the wrong enrichment, or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment. In addition to these scenarios, misloading events involving burnable absorbers are theoretically possible, scenarios such as the placement of a cluster of 20 burnable absorbers into a core location slated to have 24 burnable absorbers.

All of these misloading scenarios potentially result in a core reactivity distribution that differs from the intended core reactivity distribution. As a result, the core power distribution and peaking factors may differ from predictions. Specifically, misloading errors can lead to increased local power peaking at the location of the misloading if the misloading results in a local reactivity increase relative to the intended pattern. If the misloading results in a local reactivity decrease, power peaking increases away from the location of the misloading are possible due to unintended power tilts. These kinds of increases, however, are generally distributed over a large core volume and are small relative to those where the local reactivity is increased.

Fuel misloads are prevented by the manufacturing controls employed to build the fuel and the core loading controls used to assemble the core. The manufacturing controls include checks on fuel rod weight to confirm the uranium loading in the fuel rod, active and passive gamma scans of individual fuel rods to confirm fuel enrichments, pellet stack lengths, pellet types, and the absence of pellet gaps during fuel manufacturing, and bar coding of each fuel rod to confirm its proper placement in the fuel assembly.

15.4-18 Amendment No. 106

CPNPP/FSAR To reduce the probability of core loading errors during fuel loading, each fuel assembly and core component is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the fuel identification numbers are checked before each assembly is moved into the core. Identification numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placement after the loading is completed. The correct type of insert is also confirmed for each location. These procedures make the likelihood of core misloadings very small.

The severity and detectability of fuel misloads are influenced by several factors: the local reactivity perturbation relative to the intended core loading pattern, the core position of the misload, the local environment of the misloaded fuel assembly, and the number of operable incore detector locations and their proximity to the misload location. Should misloadings occur, the incore system of movable flux detectors, which is used to verify power distributions during startup and throughout the operating cycle, is capable of revealing enrichment errors or misloadings which would cause the kind of substantial power distribution perturbation that would be necessary to induce large numbers of fuel rod failures. In addition, thermocouples and excore detectors can provide additional indications of power distribution anomalies. This instrumentation, along with the startup testing performed each cycle, make the detection of severe misloadings highly likely.

15.4.7.3 Evaluation The incore moveable detector system is used to search for potential fuel misloads at the start of each operating cycle. Following fuel loading and low power physics testing, an initial core power distribution measurement is made. The core power level of this initial flux map is typically between ~30% and ~50% of rated thermal power. This initial power distribution measurement is used to confirm that the measured power distribution is consistent with the predicted power distribution. Observed flux map deviations in excess of the flux map review criteria (see Table 1) would prompt an investigation of a possible core anomaly. This satisfies the first acceptance criterion given above.

In Reference 1, a large number of misloads were evaluated for representative core designs employing current fuel types and fuel features. The simulated misloads, involving one or two fuel assemblies, covered a wide range of local reactivity perturbations and core positions. The resulting hot full power (HFP) FH peaking factors ranged from benign to very severe. Severe misloads with peaking factors that exceed the FH limit for DNB at normal operation conditions have the potential for fuel failure if they remain undetected. The simulated misloads were assessed with respect to severity and detectability.

The detectability assessments of Reference 1 demonstrated that the incore detector system is very robust with respect to detection of misloads severe enough to fail fuel during normal operation. By examining a large number of moveable detector thimble patterns, the detectability assessments considered the effect of inoperable moveable detector thimbles on misload detectability. Even when the minimum number of operable detector locations allowed per the plant licensing bases was assumed, the incore detector system was capable of reliably detecting misloads severe enough to fail fuel during normal operation.

Fuel misloads involving a single fuel rod or fuel pellet were not evaluated as part of Reference 1.

Such misloads, in general, will not be detectable using the incore detector system due to the very small power distribution perturbation. In terms of increased peaking factors and reduced DNBR 15.4-19 Amendment No. 106

CPNPP/FSAR values, however, the consequences of such misloads will be very small and limited to the affected fuel rod and the immediately adjacent fuel rods.

Detection of fuel misloads is, in part, a function of the number of available incore detector locations. Reference 1 demonstrated that the flux map review criteria of Table 1 are effective in detecting fuel misloads that could lead to fuel failures during normal operation. To enhance the probability that significant misloads will be detected, tighter review criteria are employed when the number of available detector locations is reduced.

The detectability assessments of Reference 1 confirm that the moveable detector system can reliably detect fuel misloads that could fail fuel during normal operation when the Table 1 review criteria are employed. Specifically, Reference 1 demonstrated that only a small fraction of 1% of misloads severe enough to fail fuel during normal operation would be undetected at startup using these limited review criteria. Furthermore, it was judged that even these undetected misloads would very likely be detected if other attributes of the startup power distribution measurement (e.g., tilts and reaction rate error contours) were considered along with the results of low power physics testing. Given that detection of >99% of misloads severe enough to fail fuel is expected using these review criteria, a radiological consequences analysis is deemed unnecessary.

Failures in fresh fuel during startup would have negligible radiological consequences since there is only a small fission product inventory. Following startup, any fuel rod failures would occur gradually and would be detected by coolant activity monitoring. Since the number of potential fuel rod failures due to a core misload would be extremely small and such failures would occur gradually, any coolant activity releases would initially be well within the cleanup capacity of the plant. Any trend in increased coolant activity would warrant further investigation and evaluation.

Therefore, the second acceptance criterion for this event would be satisfied since failures would be gradual, detectable, and the operations would be maintained within Technical Specification coolant activity guidelines.

15.4.7.4 Conclusion Fuel misloads are prevented by manufacturing controls and core loading controls. In the unlikely event that a fuel misload should occur, the incore moveable detector system is capable of reliably detecting misloads that could fail fuel at normal operation conditions. Exceeding the review criteria herein would initiate an investigation to identify potential core anomalies. Any failures associated with an undetected fuel misload would be gradual, detectable, and the operations would be maintained within Technical Specification coolant activity guidelines.

REFERENCE

1. WCAP-16676-NP, R. D. Ankney and J. L. Grover, Analysis Update for the Inadvertent Loading Event, March 2009.

15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a RCCA and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4-20 Amendment No. 106

CPNPP/FSAR 15.4.8.1.1 Design Precautions and Protection Certain features in the CPNPP pressurized water reactors are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs, and minimizes the number of assemblies inserted at high power levels.

Mechanical Design The mechanical design is discussed in Section 4.6. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:

1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4100 psi.
2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and are checked during the hydrotest of the completed reactor coolant system.
3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the American Society of Mechanical Engineers (ASME) Code,Section III, for Class 1 components.
4. The latch mechanism housing and rod travel housing are each a single length of forged Type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow.

Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur.

15.4-21 Amendment No. 106

CPNPP/FSAR However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution.

The position of all RCCAs is continuously indicated in the Control Room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions when the LO-LO alarm is received requires the shutdown margin to be verified within limits or to take actions to restore the shutdown margin in accordance with the Technical Specifications.

Reactor Protection The reactor protection in the event of a rod ejection accident is provided by the high neutron flux trip (high and low setting) and the high rate of neutron flux increase trip. These protection functions are described in detail in Section 7.2.

Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. The full length control rod drive mechanism is described in Section 3.9N.4.

Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor coolant pressure of 2250 psia.

The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the hollow tube along which the coil assemblies are mounted.

If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings were on the periphery, they might bend outward from their bases. The housing material is quite ductile; plastic hinging without cracking would be expected. Housings adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.

Effect of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, the broken-off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When the projectile reached the missile shield it would partially penetrate the shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield.

If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. The top end plates of the position indicator coil assemblies would prevent the broken piece from directly hitting the rod travel 15.4-22 Amendment No. 106

CPNPP/FSAR housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage.

Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to the worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.

Summary The considerations given above lead to the conclusion that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase the severity of the initial accident.

15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident (i.e., a limiting fault). See Section 15.0.1 for a discussion of ANS classifications. Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are:

1. Average fuel pellet enthalpy at the hot spot must remain less than 200 cal/gm for irradiated fuel. This bounds non-irradiated fuel, which has a slightly higher enthalpy limit.
2. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
3. Fuel melting will be limited to less than 10 percent of the fuel pellet volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion 1 above.

15.4.8.2 Analysis of Effects and Consequences Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power 15.4-23 Amendment No. 106

CPNPP/FSAR distribution calculated without feedback is pessimistically assumed to persist throughout the transient.

A detailed discussion of the method of analysis can be found in Reference 2.

Average Core Analysis The spatial kinetics computer code, TWINKLE (Reference 4), is used for the average core transient analysis. This code solves the two group neutron diffusion theory kinetic equation in one, two or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2,000 spatial points. The computer code includes a detailed multi-region, transient fuel-clad-coolant heat transfer model for calculations of point-wise Doppler and moderator feedback effects. In this analysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor.

Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region will necessarily be depressed.

The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN (Reference 5). This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time from the TWINKLE code (as discussed above) and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation (Reference 3) to determine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used assuming zero bulk fluid quality. The DNBR is not calculated; instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient is calculated by the code; however, it adjusted in order to force the full power steady state temperature distribution to agree with the fuel heat transfer design codes.

System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant. Due to the very conservative method of analysis, the peak surge rate is high enough to cause the reactor coolant pressure to exceed the pressurizer safety valve actuation pressure; however, this 15.4-24 Amendment No. 106

CPNPP/FSAR condition exists only for a few seconds. The pressurizer water volume does not change significantly. Therefore, these transients are not sensitive to the initial pressurizer water volume.

The pressure surge was calculated generically (Reference 2) by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a calculation was performed to determine the volume surge. Finally, the volume surge is simulated in a plant transient computer code. This code calculates the pressure transient taking into account fluid transport in the RCS and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.

15.4.8.2.1 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. A summary of parameters used in the analysis is given in Table 15.4-3. The more important parameters are discussed below.

Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three dimensional static methods or by a synthesis method employing one dimensional and two dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits.

Adverse xenon distributions are considered in the calculation.

Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.

Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions.

Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single channel feedbacks, correct them to effective whole core feedbacks for the appropriate flux shape. No weighting is applied to the moderator feedback.

A conservative radial weighing factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension.

These weighting factors have also been shown to be conservative compared to three dimensional analysis (Reference 2).

15.4-25 Amendment No. 106

CPNPP/FSAR Moderator and Doppler Coefficient The critical boron concentrations and BOL and EOL were adjusted in the nuclear code in order to obtain moderator density coefficient curves that were conservative when compared to the actual design conditions for the plant. As discussed above, no weighting factor is applied to these results. The applicable MTCs modeled were +5 pcm/oF at zero-power nominal Tavg and 0 pcm/

o F at full-power Tavg for the BOL cases. For the EOL cases, the applicable zero-power MTC was -16.817 pcm/oF and the full-power MTC was -22.920 pcm/oF.

The Doppler reactivity defect is determined using a one dimensional steady state computer code with a Doppler weighting factor of 1.0. The Doppler weighting factor will increase under accident conditions, as discussed above.

Delayed Neutron Fraction Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.75 percent at beginning-of-life and 0.50 percent at end-of-life. The accident is sensitive to eff if the ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of 0.55 percent at beginning of cycle and 0.44 percent at end of cycle were used in the analysis.

Trip Reactivity Insertion The trip reactivity insertion includes the effect of one stuck RCCA. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion is assumed to occur 0.5 seconds after the high neutron flux trip point was reached.

The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, and adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown margin by about an additional 1 percent k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head.

The results show a rapid pressure drop and a decrease in system water mass due to the break.

The Safety Injection System is actuated on low pressurizer pressure within 1 minute after the break. The RCS pressure continues to drop and reaches saturation (1200 psi) in about 2 to 3 minutes. Due to the large thermal inertia of the primary and secondary system, there has been no significant decrease in the RCS temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2 percent k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated safety injection flow 15.4-26 Amendment No. 106

CPNPP/FSAR starting 1 minute after the break is sufficient to ensure that the core remains subcritical during the cooldown.

Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are part of the Reactor Trip System. No single failure of the Reactor Trip System will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.

15.4.8.3 Environmental Consequences The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss of coolant accidents are discussed in Section 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss of coolant accident to recover from the event.

Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. In all cases considered, less than 15 percent of the rods entered DNB.

Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits [2]. Since the severity of the present analysis does not exceed the worst case analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the RCS.

Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since the core is under-moderated, and bowing will tend to increase the under-moderation at the hot spot.

In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

15.4-27 Amendment No. 106

CPNPP/FSAR Radiological Consequences The doses resulting from a rod ejection accident are based on a conservative fission product release to the reactor coolant of the gap activity shown in sheet 2 of Table 15.0-7 from 15 percent of the fuel rods in the core plus the core activity shown in sheet 2 of Table 15.0-7 from the assumed 0.375 percent core melt. The method of analysis complies with the requirements of Position 3 of Regulatory Guide 1.195.

Following a postulated rod ejection accident, two alternate activity release paths are considered when determining radiological consequences of the accident. The first release path is via Containment leakage resulting from release of activity from the primary coolant to the Containment. The second path assumes that the Reactor Coolant System remains intact and that the activity enters the secondary system due to tube leakage and then is released to the environment as contaminated steam and is dumped through the relief valves, since offsite power is assumed to be lost.

Prior to the accident, it is assumed that the plant has been operating with simultaneous fuel defects and steam generator tube leakage for a sufficient period of time to establish equilibrium levels of activity in the primary and secondary coolants equal to the Table 15.1-4 values.

Following a postulated rod ejection accident, the activity released from the pellet-clad gap due to failure of a portion of the fuel rods and the melted fuel is assumed to be instantaneously released to the primary coolant. The activity released to the primary coolant is assumed to be uniformly mixed throughout the coolant instantaneously. Thus, the total activity of the primary coolant is assumed to be immediately available for release from the RCS. Of the activity released to the Containment from the coolant through the rupture in the reactor vessel head, 100 percent is assumed to be mixed instantaneously throughout the Containment. Fifty (50) percent of the iodine activity released from the melted fuel is assumed to immediately plate out on Containment surfaces. The remaining activity is available for leakage from the Containment at the design leak rate of 0.10 percent of Containment volume per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and at a rate of 0.05 percent of Containment volume per day for the duration of the accident. The only removal processes considered in the Containment for the activity remaining after the above plate out are radioactive decay and leakage from the Containment.

The model for the activity available for release to the atmosphere from the relief valves assumes that the release consists of the activity in the secondary coolant prior to the accident plus that fraction of the activity leaking from the primary coolant through the steam generator tubes following the accident. The leakage of primary coolant to the secondary side of the steam generator is assumed to continue at its initial rate, which is assumed to be the same rate as the leakage prior to the accident. With the assumption of coincident loss of offsite power, activity is assumed to be released to the atmosphere from a steam dump through the relief valves until the Reactor Coolant System temperature and pressure are reduced sufficiently to allow operation of the Residual Heat Removal System at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

A summary of parameters used in the analysis is given in Table 15.4-4.

Fuel melting, limited to less than the innermost 10 percent of the fuel pellet at the hotspot, is included in the design criteria to ensure that fuel dispersion into the coolant does not occur [1].

Even though centerline melting in a small fraction of the core is not expected, a conservative 15.4-28 Amendment No. 106

CPNPP/FSAR upper limit of fission product release from the core as a result of a rod ejection accident can be estimated.

The Regulatory Guide 1.195 limit of fission product release from the core for this very conservative case is determined using the following assumptions:

1. 100 percent of the noble gases and iodines in the clad gaps of those fuel rods experiencing clad damage (assumed to be 15 percent of the rods in the core) are released to the reactor coolant. The affected fuel rods are assumed to be operating at 1.65 times the core average and thus have 1.65 times the average fission product inventory. The core activities are presented in Table 15.0-7.
2. 25 percent of the iodines and 100 percent of the noble gases in the fuel that melts are assumed to be released to the reactor coolant and available for release via the containment building. 50 percent of the iodines and 100 percent of the noble gases in the fuel that melts are assumed to be available for release from the secondary systems via primary-to-secondary leakage. The core activities are presented in Table 15.0-7.
3. The fraction of fuel melting is conservatively assumed to be 0.375 percent of the core, as determined by the following method [1]:
a. A conservative upper limit of 50 percent of the rods experiencing clad damage also may experience centerline melting (a total of 7.5 percent of the rods in the core).
b. Of rods experiencing centerline melting, only a conservative maximum of the innermost 10 percent of the volume actually melts (equivalent to 0.5 percent of the core that could experience melting).
c. A conservative maximum of 50 percent of the axial length of the rod experiences melting due to the power distribution (0.5 of the 0.75 percent of the core = 0.375 percent of the core).
4. Prior to the accident, the plant is assumed to be operating at full power with coincident fuel defects and steam generator tube leakage. The steam generator tube leak rate is assumed to be 1.0 gpm. The initial primary coolant and secondary liquid activity concentrations are given in Table 15.1-4.
5. Instantaneous mixing in the Containment of all activity released from the coolant is assumed.
6. Fifty (50) percent of the iodine activity released from the melted fuel to the Containment atmosphere immediately plates out on Containment surfaces.
7. The Residual Heat Removal System is brought into service at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, thus terminating steam releases.
8. Loss of offsite power is assumed and, 1,750,000 lb of steam are discharged from the secondary system through the relief valves, during the 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> following the accident.

Steam dump is terminated after 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

15.4-29 Amendment No. 106

CPNPP/FSAR

9. All releases to the atmosphere are assumed to be at ground level.
10. Other assumptions are detailed in Table 15.4-4.

Based on the foregoing model, the thyroid and whole body doses from the containment leakage for this accident are conservatively calculated to be 20.0 rem and 0.082 rem, respectively, for the exclusion area boundary (EAB), and 28.0 rem and 0.043 rem, respectively, for the low population zone (LPZ). The thyroid and whole body doses from the secondary side releases for this accident are conservatively calculated to be 4.2 rem and 0.42, respectively, for the EAB, and 7.9 rem and 0.15 rem, respectively, for the LPZ. For each scenario, the doses at these distances are below the dose values of 6.3 rem whole body and 75 rem thyroid set forth in RG 1.195.

15.4.8.4 Conclusions For Units 1 and 2, even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS. The analyses have demonstrated that upper limit in fission product release as a result of a number of fuel rods entering DNB amounts to 15 percent.

REFERENCES

2. Not Used.
3. Risher, D. H., Jr., An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods, WCAP-7588, Revision 1-A, January 1975.
4. Bishop, A. A., Sandburg, R. O. and Tong, L. S., Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux, ASME 65-HT-31, August 1965.
5. Barry, R. F., Jr. and Risher, D. Hl, TWINKLE - A Multi-dimensional Neutron Kinetics Computer Code, WCAP-7979-P-A, January 1975.
6. Hargrove, H. G., FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod, WCAP-7908-A, December 1989.
7. Sung, Y. X. et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A, October 1999.
8. Burnett, T. W. T., et al., LOFTRAN Code Description, WCAP-7907-P-A, April 1984.
9. Haessler, R. L., et al., Methodology for the Analysis of the Dropped Rod Event, WCAP-11394-P-A, January 1990.
10. Liu, Y. S., et al., ANC: A Westinghouse Advanced Nodal Computer Code, WCAP-10965-P-A, September 1986.

15.4-30 Amendment No. 106

CPNPP/FSAR

11. Huegal, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.
12. Friedland, A. J. and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

15.4-31 Amendment No. 106

CPNPP/FSAR TABLE 15.4-1 HAS BEEN DELETED Amendment No. 104

CPNPP/FSAR TABLE 15.4-2 HAS BEEN DELETED Amendment No. 104

CPNPP/FSAR TABLE 15.4-3 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT Beginning Beginning of Core of Core End of End of Life Life Core Life Core Life (HFP) (HZP) (HFP) (HZP)

Power Level (percent) 100.6 0 100.6 0 Ejected Rod Worth (percent k) 0.24 0.75 0.25 0.84 Delayed Neutron Fraction 0.55 0.55 0.44 0.44 (percent)

Feedback Reactivity Weighting 1.2927 2.0079 1.3549 3.7649 Trip Reactivity (percent k) 4.0 2.0 4.0 2.0 FQ Before Rod Ejection 2.50 - 2.50 -

FQ After Rod Ejection 5.5 11.0 6.0 26.0 Doppler Defect (pcm) -1000 -1000 -950 -950 Number of Operational Reactor 4 2 4 2 Coolant Pumps Amendment No. 104

CPNPP/FSAR TABLE 15.4-4 PARAMETERS FOR POSTULATED ROD EJECTION ACCIDENT ANALYSIS (Sheet 1 of 3)

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level (MWt) 3684
b. Primary Side equilibrium activity 1.0 uCi/gm Dose concentration Equivalent I-131
c. Secondary Side equilibrium activity 0.1 uCi/gm Dose concentration Equivalent I-131
d. Steam generator tube leak rate 1 prior to and during steam dump (gpm)
e. Failed fuel 15 percent of fuel rods in core
f. Radial peaking factor 1.65
g. Activity released to reactor coolant from failed fuel and available for release (i.e., gap fraction)

Noble gases 10 percent of core inventory Iodines 10 percent of core inventory

h. Melted fuel 0.375 percent of core
i. Activity released to reactor coolant from melted fuel Noble gases inventory 0.375 percent of core Iodines 0.1875 percent of core inventory
j. Iodine fractions (organic, Regulatory Guide 1.195 elemental, and particulate)
2. Data and assumptions used to estimate activity released
a. Plate out of iodine activity 50 percent released to Containment (applied only to fuel melt releases)

Amendment No. 104

CPNPP/FSAR TABLE 15.4-4 PARAMETERS FOR POSTULATED ROD EJECTION ACCIDENT ANALYSIS (Sheet 2 of 3)

b. Containment leak rate 0.1 percent of containment volume per day (0t24 hr) 0.05 percent of containment volume per day (24 < t < 720 hr)
c. Iodine partition factor in steam 0.01 generators prior to and during accident
d. Offsite power lost
e. Steam dump from relief valves 450,000 (0 - 2 Hours)

(lbm) 1,300,000 (2 - 11 Hours)

f. Duration of dump from relief valves 11 (hour)
g. Steam dump to condenser (lbm) 0.0
3. Dispersion data
a. EAB and LPZ distances 2080m and 4 miles
b. X/Q 1.6 x 10-4 sec/m3

@EAB (0-2 hr) 2.4 x 10-5 sec/m3

@LPZ (0-8 hr) 1.6E-05 sec/m3

@LPZ (8-24 hr)

Amendment No. 104

CPNPP/FSAR TABLE 15.4-4 PARAMETERS FOR POSTULATED ROD EJECTION ACCIDENT ANALYSIS (Sheet 3 of 3)

4. Dose data
a. Method of dose calculation See Appendix 15B
b. Dose conversion assumptions See Appendix 15B
c. Doses @EAB (0-2 hr) thyroid dose Containment leakage = 20.0 Rem Primary to secondary leakage = 4.2 rem Whole body dose (gamma dose)

Containment leakage = 0.082 rem Primary to secondary leakage = 0.42 rem

@LPZ (0 - 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) thyroid dose Containment leakage = 28.0 rem Primary to secondary leakage = 7.9 rem Whole body dose (gamma dose)

Containment leakage = 0.043 rem Primary to secondary leakage = 0.015 rem Amendment No. 104

CPNPP/FSAR TABLE 15.4.7.3-1 FLUX MAP REVIEW CRITERIA FOR A 4-LOOP CORE Measured vs. Predicted Number of Available Detector Detector Reaction Rate Symmetric Thimble Reaction Locations Comparison(a) Rate Comparison(b) 55 to 58 10% 7%

49 to 54 8% 5%

44 to 48 6% 5%

a) The review criterion is the table value (%) or an absolute normalized reaction rate difference equal to the table value divided by 100% (e.g., 10%/100%=0.1), whichever is greater.

b) Applicable to symmetric thimbles with normalized reaction rates above 0.7. The review criterion is relative to the expected reaction rate difference.

Amendment No. 104

CPNPP/FSAR 15.5 INCREASE IN REACTOR COOLANT INVENTORY Discussion and analysis of the following events are presented in this section:

1. Inadvertent operation of the Emergency Core Cooling System during power operation
2. Chemical and Volume Control System malfunction that increases reactor coolant inventory
3. A number of BWR transients. (Not applicable to the Comanche Peak Nuclear Power Plant (CPNPP)).

These events, considered to be American Nuclear Society (ANS) Condition II event (i.e., a fault of moderate frequency), cause an increase in reactor coolant inventory. Section 15.0.1 contains a discussion of ANS classifications.

15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION 15.5.1.1 Identification of Causes and Accident Description Spurious Emergency Core Cooling System (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels as described in Section 7.3.

Following the actuation signal, the suction of the coolant charging pumps is diverted from the volume control tank to the Refueling Water Storage Tank. The charging pumps then force highly concentrated boric acid solution from the Refueling Water Storage Tank, through the header and injection line and into the cold leg of each loop. The safety injection pumps also start automatically but provide no flow when the Reactor Coolant System (RCS) is at normal pressure.

The passive injection system and the low head system also provide no flow at normal RCS pressure.

A Safety Injection Actuation System (SIAS) signal normally results in a reactor trip followed by a turbine trip. However, it cannot be assumed that any single fault that actuates the SIAS will also produce a reactor trip. If a reactor trip is generated by the spurious SIAS signal, the operator would consult the appropriate emergency operating procedure to determine if the spurious signal was transient or steady state in nature.

The emergency operating procedures clearly define the diagnostics for a spurious Safety Injection signal. These emergency procedures provide direction to the operator as to the specific actions to be taken based on measured process variables (e.g., pressure, temperature, etc.) so it is unlikely that any judgment errors will be made. Thus, by following the procedures, the operator would be able to diagnose the event and take the appropriate corrective action.

If the operator incorrectly diagnoses an event as a spurious SI signal, this could result in the termination of safety injection for an accident where safety injection is needed (e.g., LOCA). The consequences of this action and the system failures are given in WCAP-9691, NUREG-0578 2.1.9.c, Transient and Accident Analysis. If the operator incorrectly diagnoses a spurious safety injection event as some other accident, the emergency operating procedures for 15.5-1 Amendment No. 105

CPNPP/FSAR that accident would be followed until it became apparent (when monitoring the process variables called for in the emergency procedure) that the wrong accident had been identified. The operator would then revert to the correct procedure and, based on the results of process variable monitoring, he would take the appropriate actions to bring the plant to a safe shutdown condition.

Following a spurious safety injection signal, the operator cannot reset SI until all the required conditions given in the emergency operating procedures are met. Also, an interlock exists which does not allow manual resetting of SI for at least 60 seconds.

If a loss of offsite power occurs after resetting safety injection, manual action will be required to load the engineered safety features equipment onto the diesel powered emergency busses. The procedures to be followed by the operator in performing this action have been incorporated in the CPNPP Emergency Operating Procedures for the manual reset of safety injection.

If the ECCS actuation instrumentation must be repaired, future plant operation would be in accordance with the Technical Specifications.

If the Reactor Protection System does not produce an immediate trip as a result of the spurious SIAS signal, the reactor experiences a negative reactivity excursion due to the injected boron causing a decrease in reactor power. The power mismatch results in a drop in Tavg and consequent coolant shrinkage causing pressurizer pressure and water level to drop. Load will decrease due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open. If automatic rod control is used, these effects will be lessened until the rods have moved out of the core. The transient is eventually terminated by the Reactor Protection System low pressure trip or by manual trip.

The time to trip is affected by initial operating conditions including core burnup history which affects initial boron concentration, rate of change of boron concentration, and Doppler and moderator coefficients.

Recovery from this second case is made in the same manner as described for the case where the SIAS signal results directly in a reactor trip. The only differences are the lower Tavg and pressurizer pressure associated with the power mismatch during the transient. The time at which reactor trip occurs is of little concern for this transient. At lower loads coolant contraction will be slower resulting in a longer time to trip.

This event is non-limiting with respect to Departure from Nucleate Boiling (DNB) since the conditions resulting from injecting borated water into the RCS are beneficial with respect to DNB.

Depending on the control systems in operation, core power and RCS temperatures either remain near the initial nominal conditions or decrease during this event. The RCS flow remains constant throughout the event. A decrease in RCS pressure is the only condition that may occur which would adversely affect DNB. However, for the decrease in RCS pressure that may occur, the effects are more than offset by beneficial reduction in power and temperature. The net effect is a DNB Ratio (DNBR) that remains near the initial DNBR or increases throughout the event.

The major concern resulting from an Inadvertent ECCS Actuation at Power event is the potential to violate the ANS Condition II acceptance criterion where an incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

15.5-2 Amendment No. 105

CPNPP/FSAR The pressurizer water volume increase for this event is a result of continuous safety injection flow. Operator action is required to terminate safety injection flow prior to filling the pressurizer, thus demonstrating that this ANS Condition II event does not propagate to a more serious plant condition. Therefore, this event is analyzed to demonstrate that sufficient time is available for the operator to take appropriate actions to preclude a pressurizer water-solid condition.

This event is classified as a Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

15.5.1.2 Analysis of Effects and Consequences Method of Analysis The Inadvertent Actuation of the ECCS System at Power event is analyzed by employing the detailed digital computer code RETRAN (Reference 1). The code simulates the neutron kinetics, and models the reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves and the safety injection system. The code computes pertinent plant variables including temperature, pressures, and power level.

The assumptions are as follows:

1. Initial operating conditions The initial reactor power is assumed at its maximum value consistent with the steady state full power plus 0.6 percent allowance for calibration and instrument errors. The initial pressurizer water level is at the full power value of 60% span plus 5% uncertainty allowance and pressurizer pressure is 30 psi lower than nominal. The initial RCS temperature is assumed at the full power value minus 6oF uncertainty allowance.
2. Moderator and Doppler coefficients of reactivity This event is analyzed with the maximum reactivity feedback such that the most negative moderator temperature coefficient and most negative Doppler power coefficient are assumed.
3. Reactor Control System The Reactor Control System is assumed to be in the manual mode of operation.
4. Pressurizer Pressure and Level Control System Pressurizer sprays are assumed to be operable to increase the rate of pressurizer filling.

The pressurizer sprays act to reduce the RCS pressure, thus increasing ECCS injection.

The pressurizer heaters are assumed to be de-energized (the pressurizer heaters at CPNPP are automatically de-energized upon receipt of a safety injection signal by safety-related SSPS relays).

15.5-3 Amendment No. 105

CPNPP/FSAR

5. Boron injection At time zero two charging pumps inject borated water into the cold leg of each loop. The RCS pressure does not decrease to the point where the Safety Injection pumps could deliver flow to the RCS.
6. Reactor trip The reactor and turbine are assumed to trip upon receipt of the SIAS signal. Assuming a reactor trip on the SIAS signal and a turbine trip derived from the reactor trip minimizes the heat removal capability of the RCS, thereby maximizing the RCS inventory increase through SI flow and thermal expansion of the RCS fluid.
7. Pressurizer PORVs No credit is taken for any pressurizer PORV operation.
8. Operator Actions The first operator action assumed is the initiation of the opening of at least three of the four steam generator atmospheric relief valves (ARVs) within 8 minutes after the event initiation to control Tavg to the no-load temperature of 557°F.

The operators are then assumed to secure ECCS within 14 minutes after the event initiation. Operator action is also required to take positive control of the Pressurizer Pressure and Level Control System.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

15.5.1.3 Conclusions The filling of the pressurizer is the acceptance criterion of concern for this analysis. This criterion is more conservative than preventing water relief through the Pressurizer Safety Valves (PSVs),

as it is possible to fill the pressurizer at a pressure below the PSV set pressure.

Results of the analysis show for Units 1 and 2 that the pressurizer does not reach a water-solid condition as a consequence of the inadvertent operation of ECCS during power operation, provided that the operator initiates the opening of the ARVs within 8 minutes to reduce Tavg close to 557°F, and the SI flow is turned off within 14 minutes after the event initiation.

15.5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY An increase in reactor coolant inventory which results from the addition of cold, unborated water to the RCS is analyzed in Section 15.4.6, Chemical and Volume Control System malfunction that results in a decrease in boron concentration in the reactor coolant. An increase in reactor coolant inventory which results from the injection of highly borated water into the RCS is 15.5-4 Amendment No. 105

CPNPP/FSAR analyzed in Section 15.5.1, inadvertent operation of the Emergency Core Cooling System during power operation.

15.5.3 A NUMBER OF BWR TRANSIENTS This section is not applicable to the CPNPP.

REFERENCES

1. Huegal, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.

15.5-5 Amendment No. 105

CPNPP/FSAR TABLE 15.5-1 HAS BEEN DELETED Amendment No. 104

CPNPP/FSAR 15.6 DECREASE IN REACTOR COOLANT INVENTORY Events which result in a decrease in reactor coolant inventory as discussed in this section are as follows:

1. Inadvertent opening of a pressurizer safety or relief valve.
2. Break in instrument line or other lines from reactor coolant pressure boundary that penetrate containment.
3. Steam generator tube failure.
4. Spectrum of boiling water reactor (BWR) steam system piping failures outside of Containment. (Not applicable to the CPNPP.)
5. Loss of coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary.
6. A number of BWR transients. (Not applicable to the CPNPP.)

15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the Reactor Coolant System (RCS) could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flow rate of a relief valve (i.e., 420,000 lb/hr vs.

210,000 lb/hr), and will therefore allow a much more rapid depressurization upon opening, the most severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve. The flow of released coolant due to the inadvertent opening of a pressurizer safety valve is equivalent to approximately a 2.0 in. break in the RCS hot leg. It is shown [13, 14] that a hot leg break transient is much less severe than an equivalent sized break in the cold leg. Thus, the transient due to the inadvertent opening of a pressurizer safety valve would be much less severe than the small break cold leg transients discussed in Section 15.6.5. Initially the event results in a rapidly decreasing RCS pressure until this pressure reaches a value corresponding to the hot leg saturation pressure. At this time, the pressure decrease is slowed considerably. The pressure continues to decrease throughout the transient. The effect of the pressure decrease would be to decrease or increase the neutron flux depending on the moderator density feedback, but the Reactor Control System (if in the automatic mode) functions to maintain the power and average coolant temperature essentially constant until the reactor trip occurs. Initially, the pressurizer level increases due to expansion caused by the depressurization, and then decreases following the reactor trip.

The reactor may be tripped by the following Reactor Protection System signals:

1. Overtemperature N-16.
2. Pressurizer low pressure.

15.6-1 Amendment No. 106

CPNPP/FSAR An inadvertent opening of a pressurizer safety valve is classified as an American Nuclear Society (ANS) Condition II event, a fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

15.6.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed using the RETRAN computer code (Reference 1).

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results in calculating the departure from nucleate boiling ratio (DNBR) during the transient, the following assumptions are made:

1. The initial core power is assumed to be at the nominal value consistent with steady-state, full-power operation. The initial pressurizer pressure and vessel average temperature are assumed to be at the respective nominal values, and the reactor coolant flow is at the minimum measured flow value. Uncertainties in the initial conditions are accounted for in the DNBR limit value as described in Reference 2.
2. A zero moderator temperature coefficient of reactivity is assumed in order to provide a conservatively low amount of negative reactivity feedback due to changes in the moderator density. The spatial effect of void due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.

These voids would tend to flatten the core power distribution.

3. The least negative Doppler coefficient of reactivity is assumed such that the resultant amount of negative feedback is conservatively low in order to maximize any power increase due to moderator reactivity feedback.

Plant systems and equipment which are necessary to mitigate the effects of RCS depressurization caused by an inadvertent safety valve opening are discussed in Section 15.0.8 and listed in Table 15.0-6.

Normal reactor control systems are not required to function. The Rod Control System is assumed to be in the manual mode in order to maximize the nuclear power increase and to prevent rod insertion prior to reactor trip. The Reactor Protection System functions to trip the reactor on the appropriate signal. No single active failure will prevent the Reactor Protection System from functioning properly.

15.6.1.3 Conclusions For Units 1 and 2, the results of the analysis show that the pressurizer low pressure and the Overtemperature N-16 Reactor Protection System signals provide adequate protection against the RCS depressurization event.

15.6-2 Amendment No. 106

CPNPP/FSAR 15.6.2 BREAK IN INSTRUMENT LINE OR OTHER LINES FROM REACTOR COOLANT PRESSURE BOUNDARY THAT PENETRATE CONTAINMENT There are no instrument lines connected to the RCS that penetrate the Containment. However, the 3 inch CVCS letdown line and grab sample lines from the hot legs of reactor coolant loops 1 and 4, and from the steam and liquid space of the pressurizer, do penetrate the Containment.

The grab sample lines are provided with normally closed isolation valves on both sides of the Containment wall and are designed in accordance with the requirements of General Design Criterion 55.

The most severe pipe rupture with regard to radioactivity release during normal plant operation occurs in the Chemical and Volume Control System (CVCS). This Condition III event would be a complete severance of the 3 inch letdown line just outside containment, between the outboard letdown isolation valve and letdown heat exchanger (see Figure 9.3-10), at rated power condition with a maximum letdown rate of 140 gpm. The occurrence of a complete severance of the letdown line would result in a loss-of-reactor coolant through two letdown orifices at the rate of about 190 gpm, which is within the makeup capacity of any two of the three charging pumps (see Table 9.3-7, sheet 1). Two non-safety related pressure switches located in the CVCS letdown line provide a means for detecting a rupture of the line. A low pressure signal, initiated by the rupture, will activate an alarm on the main control board, alerting the operator of the rupture, causing him to manually isolate the system. No credit is taken for Engineered Safety Features System actuation. Frequent operation of the automatic Reactor Makeup System and increased charging flow will also provide the operator indication of the loss-of-reactor coolant. No transient analysis is performed for this accident.

The time required for the operator to identify the accident and initiate the closure of the letdown isolation valve is expected to be within 30 minutes after accident initiation including 10 seconds for the letdown isolation valve closure time. Reactor coolant is assumed to be released until the isolation valve is fully closed. It is conservatively assumed that 20.1 percent of the leaking coolant flashes to steam. All of the iodine in this steam is assumed to become airborne and is available for release to the atmosphere. All noble gases contained in the leaking primary coolant are available for release to the atmosphere. A ground level release was postulated with an atmospheric dilution factor of 1.6 x 10-4 sec/m3 at the minimum EAB distance. The equilibrium concentration of radioactive nuclides in the reactor coolant is given in Table 15.1-4. Effects of a concurrent iodine spike are included in the analysis.

Based on the foregoing model, the doses at the EAB are conservatively calculated to be 6.2 rem to the thyroid and 0.05 rem to the whole body. The LPZ doses are conservatively calculated to be 1.0 rem to the thyroid and 0.007 rem to the whole body. As expected, the radiological consequences resulting from the failure of the 3 inch CVCS letdown line do not exceed a small fraction of the dose values set forth in 10CFR100.

In Mode 3, below 500 degrees F, with three letdown orifices open (in lieu of two), the doses at the EAB are conservatively calculated to be 9.4 rem to the thyroid and 0.07 rem to the whole body.

The LPZ doses are conservatively estimated to be 1.5 rem to the thyroid and 0.01 rem to the whole body. As expected, the radiological consequences resulting from the failure of the 3 inch CVCS letdown line in Mode 3 do not exceed a small fraction of the dose values set forth in 10CFR100.

15.6-3 Amendment No. 106

CPNPP/FSAR 15.6.3 STEAM GENERATOR TUBE FAILURE 15.6.3.1 Identification of Causes and Accident Description The accident examined is the complete severance of a single steam generator tube. This event is considered an ANS Condition IV event, a limiting fault (see Section 15.0.1) and is analyzed to demonstrate that the resulting radiological doses are within the guideline values of 10CFR100.

Timely operator response is required to terminate the primary-to-secondary break flow and to ensure that the ruptured steam generator does not fill with water and flood the main steamlines.

This criterion is important because the main steamlines and relief valves are not designed for liquid flow.

The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident loss of offsite power, or failure of the condenser dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or power operated relief valves.

In view of the fact that the steam generator tube material is Inconel-600 (for Unit 2) and Inconel-690 (for Unit 1), both of which are a highly ductile material, it is considered that the assumption of a complete severance of a tube is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the Steam and Power Conversion System is subject to continual surveillance and an accumulation of minor leaks which exceeds the limits established in the Technical Specifications is not permitted during unit operation.

The reactor operators are expected to determine that a steam generator tube rupture has occurred, and to identify and isolate the ruptured steam generator on a restricted time scale in order to minimize the contamination of the secondary system and to ensure the termination of the radioactive release to the atmosphere from the ruptured steam generator. In the following discussions, the steam generator with the ruptured U-tube is referred to as the ruptured steam generator. The operator is then expected to carry out the appropriate recovery procedures on a restricted time scale in order to terminate the primary-to-secondary break flow before the water level in the ruptured steam generator rises into the main steam system piping. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by a tube rupture:

1. Pressurizer low pressure and low level alarms are actuated and charging pump flow is increased to maintain pressurizer level. On the secondary side, there is a steam flow/

feedwater flow mismatch prior to reactor trip as the feedwater flow to the faulted steam generator is reduced due to the break flow being supplied to that unit.

2. The steam generator blowdown liquid monitor and the condenser off gas radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system and the steam generator blowdown liquid monitor will automatically terminate steam generator blowdown. The steam generator leak rate monitor will also provide an alarm.

15.6-4 Amendment No. 106

CPNPP/FSAR

3. Continued loss of reactor coolant inventory may result in an Overtemperature N-16 initiated turbine runback, eventually followed by a reactor trip signal being generated by either the Overtemperature N-16 or Low Pressurizer Pressure reactor trip signals. The resultant plant cooldown following reactor trip leads to a rapid decrease in the pressurizer level, and the safety injection actuation signal, initiated on low pressurizer pressure, follows soon after the reactor trip. The safety injection actuation signal automatically causes the termination of the normal feedwater supply and the initiation of the Auxiliary Feedwater System.
4. The reactor trip automatically trips the turbine and if offsite power is available, the steam dump valves open, permitting steam release to the condenser. In the event of a coincident station blackout, the steam dump valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator safety and/or power operated relief valves.

Operator Responses The immediately apparent symptoms of a tube rupture accident, such as falling pressurizer pressure and level and increased charging pump flow, are also symptoms of small steamline breaks and loss of coolant accidents. Therefore, it is important for the operator to identify the accident as a steam generator tube rupture in order to execute the correct recovery procedure.

The steam generator tube rupture event can be uniquely identified by alarms from the condenser offgas, steam generator blowdown, or main steamline radiation monitors. The steam generator leak rate monitor will also provide an alarm. In addition, following reactor trip, the narrow range water level will rise more rapidly in the faulted steam generator than in the other steam generators due to the primary-to-secondary break flow.

Following identification of the event as a steam generator tube rupture, the following operator responses are required to terminate the primary-to-secondary break flow and to terminate the event.

1. The ruptured steam generator is isolated to minimize the release of radioactivity.

Isolation of the ruptured steam generator is accomplished by closing the main steam isolation valve, isolating auxiliary feedwater, and increasing the setpoint pressure of the atmospheric relief valve.

2. The operators then cool the RCS at the maximum rate using the steam dump valves if offsite power is available, or the atmospheric relief valve on the intact steam generators if offsite power is lost. The cooldown is continued until the core exit temperature is less than the saturation temperature of the ruptured steam generator. This action ensures that the RCS can be rapidly depressurized to terminate the break flow.
3. Following the termination of the maximum rate cooldown, the RCS is depressurized using the pressurizer sprays, if available, or a pressurizer power operated relief valve if offsite power has been lost. In accordance with the emergency operating procedures, the depressurization is continued until the RCS pressure is lower than the faulted steam generator pressure. The primary to secondary leakage flow is terminated when the RCS pressure is less than the pressure in the ruptured steam generator.

15.6-5 Amendment No. 106

CPNPP/FSAR

4. The Emergency Core Cooling System (ECCS) pumps are then secured to prevent the RCS from repressurizing and reestablishing the break flow.
5. Following the termination of the break flow, the operators initiate a controlled cooldown and depressurization of the RCS to maintain the RCS pressure less than the pressure in the ruptured steam generator, thus preventing any further leakage of RCS fluid into the ruptured steam generator.

15.6.3.1.1 Analysis of Effects and Consequences Determination of Operator Response Times Because the reactor operators are required to terminate the primary- to-secondary break flow in a restricted period of time, the time needed for the operators to complete the required actions is important in evaluating the effects of the postulated event. Operator responses are separated into four significant actions:

1. Identification and isolation of the faulted steam generator;
2. Initiation of RCS cooldown;
3. Initiation of RCS depressurization; and,
4. Termination of the ECCS flow.

Conservative time requirements for completion of each of the important actions listed above were determined through observation of numerous simulator exercises using licensed reactor operators.

Conservative times required to perform each of the significant actions listed above were determined to be:

1. Identify and isolate the ruptured steam generator after 13 minutes initiation of the steam generator tube rupture event:
2. Initiate the RCS cooldown after steam generator 5 minutes isolation:
3. Initiate the RCS depressurization after the end of the 2 minutes RCS cooldown:
4. Terminate Safety Injection Flow following the end of the 2 minutes RCS depressurization:

Method of Analysis The postulated Steam Generator Tube Rupture event is analyzed to demonstrate that the operators can terminate the primary-to-secondary break flow in a time frame compatible with preventing the filling of the ruptured steam generator. The RETRAN02 computer code is used to 15.6-6 Amendment No. 106

CPNPP/FSAR calculate the transient response. Additional details concerning the design-basis analysis methodology are contained in References 37, 38 and 39.

Assumptions for initial conditions, control and protection system setpoints, and offsite power availability are selected for conservatism with respect to the maximum liquid volume in the ruptured steam generator.

The major analysis assumptions are summarized below:

1. Initial Operating Conditions The initial reactor power and RCS temperatures are assumed to be at their nominal operating values consistent with steady-state, full power operation. The initial RCS pressurizer pressure and level are assumed to be consistent with steady-state full power operation, including appropriate allowances for calibration and instrumentation errors.

The initial water inventory in the ruptured steam generator is conservatively selected to minimize the margin to overfill.

2. ESF System Capacities The capacities of the ECCS components, i.e., the centrifugal charging pumps and the safety injection pumps, are conservatively maximized to increase the primary to secondary leak rate, thereby maximizing the liquid volume in the ruptured steam generator. The total auxiliary feedwater flow to the ruptured steam generator from the turbine-driven and motor-driven auxiliary feedwater pumps is also conservatively maximized.
3. Offsite Power Offsite power is assumed to be lost coincident with the reactor trip and turbine trip. Thus, the reactor coolant pumps begin to coast down immediately following the reactor trip and the pressurizer sprays are not available for RCS depressurization. The steam dump valves are also inoperable following the loss of offsite power.
4. Equipment Availability To conservatively increase the break flow rate, the pressure in the ruptured steam generator is maintained at or below the setpoint pressure of the atmospheric relief valve rather than that of the main steam safety valves. The atmospheric relief valves on all intact steam generators are available for cooling the RCS.

The pressurizer power-operated relief valves and their associated block valves are assumed to be operable. Nitrogen accumulators are provided for the pressurizer PORVs should offsite power not be available.

5. Protection and Control Systems The turbine and rod control systems are assumed to be in the manual mode of operation; the effects of automatic control have been bounded by the selection of conservative initial conditions. The Steam Generator Water Level Control System is assumed to function 15.6-7 Amendment No. 106

CPNPP/FSAR normally prior to reactor trip. If the steam generator water level controller were in manual, the faulted steam generator would be identified earlier, thus decreasing the maximum liquid volume. To maximize the liquid volume in the ruptured steam generator, the turbine is tripped and auxiliary feedwater actuation is initiated concurrently with the reactor trip.

No delay time is assumed between the initiation of the auxiliary feedwater and ECCS systems and the delivery of fluid from these pumps.

6. Single Active Failure The failure of one (Unit 1) or two (Unit 2) intact steam generator ARVs to open is the limiting single active failure with respect to filling the ruptured steam generator. This leaves two ARVs (Unit 1) or one ARV (Unit 2) on intact steam generators available for cooling the RCS. This assumed failure extends the time required to cool the RCS to the point that the RCS can be depressurized and the break flow terminated.

15.6.3.2 Environmental Consequences Evaluation of the steam generator tube rupture event indicates that DNBR is not reached and, thus, no clad damage would be expected in this transient. This is consistent with the fact that when the reactor is at power, the reactor coolant pumps are operating and, for this event, only a small fraction of the total primary system fluid inventory has leaked to the secondary side. Thus, it is very unlikely that DNB would occur as a result of the reduced RCS flow. The RCS depressurization that results due to flow out of the tube rupture presents another possibility for obtaining a low DNBR. However, the depressurization that occurs in a steam generator tube rupture is much less than considered in the depressurization transient analyzed in Section 15.6.1 for the Inadvertent Opening of a Pressurizer Safety or Relief Valve. In the analysis of that event, it was determined that the DNBR remains above the limit value throughout the transient and, thus, no clad damage is expected. From this, it is concluded that no clad damage is expected in the steam generator tube rupture event.

At the time of event termination, the liquid volume in the ruptured steam generator is less than that required to fill the steam generator to the level of the steam generator outlet nozzle. Thus, the acceptance criterion of preventing the filling of the ruptured steam generator is satisfied.

A conservative analysis of the postulated steam generator tube rupture assumes the loss of offsite power. The scenario involves the release of steam from the secondary system caused by a turbine trip in conjunction with loss of main steam dump capabilities, and subsequent venting to the atmosphere through the atmospheric relief valves.

The limiting single active failure is chosen in order to maximize the amount of radioactivity released directly to the atmosphere. It has been demonstrated that no single active failure scenario results in the flooding of the main steamlines. Thus, the limiting single active failure for the steam generator tube rupture event is the failure to close of the atmospheric relief valve on the loop with the ruptured steam generator. After identifying the stuck open atmospheric relief valve, operations personnel are dispatched to locally close the atmospheric relief valve block valve. For the environmental consequences analysis, it is assumed that the block valve is closed within 30 minutes after identifying the stuck open atmospheric relief valve, thus terminating the release of radioactive steam from the ruptured steam generator to the atmosphere. Following the closure of the block valve, the primary and secondary system pressures are equalized in a manner similar to that previously described. Equalization of the primary and secondary system 15.6-8 Amendment No. 106

CPNPP/FSAR pressures terminates the leakage flow into the ruptured steam generator in sufficient time to prevent filling the ruptured steam generator. The volume available prior to filling the ruptured steam generator is greater than for the previous scenario.

The time dependent mass releases used to assess the radiological consequences of the postulated steam generator tube rupture are calculated from the RETRAN02 thermal-hydraulic analysis described above. Time-dependent values of the leakage rate into the ruptured steam generator and the flashing fraction were also used to assess the radiological consequences for the 0-2 hour time period following the event. Following the closure of the atmospheric relief valve block valve, the additional radiological dose is due to the leakage from the primary system into the intact steam generators and the initial concentration of radioactivity contained in the intact steam generators. The steam releases from 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to residual heat removal system (RHRS) cut-in are determined from mass and energy balances using the RCS and intact steam generator conditions. Following termination of break flow, the intact steam generators' ARVs are assumed to cool down the plant at less than the maximum allowable rate to the RHRS in-service temperature. The ruptured steam generator is assumed to be depressurized to the RHRS in-service pressure immediately after the cooldown of the RCS. The amount of steam released is determined from mass and energy balances; no changes in thermodynamic conditions are assumed from termination of tube flow until depressurization is started since the ruptured steam generator is isolated. Steam releases from all steam generators are considered terminated when the RHRS in-service conditions are reached.

Two separate iodine spikes are considered:

Case I A reactor transient has occurred prior to the tube rupture and raised the primary coolant iodine concentration to 60 uCi/gm Dose Equivalent Iodine-131 (DEQ I-131). The resulting preaccident isotopic iodine concentrations are shown in Table 15.6-2.

Case II The reactor trip or primary system depressurization associated with the postulated accident creates an iodine spike in the primary system. The spike is assumed to increase the iodine appearance rate (inleakage from the defective fuel rods to the primary coolant) to 335 times the equilibrium appearance rate. The concurrent iodine spike appearance rates are presented in Table 15.6-3.

The assumptions below are used to determine the initial primary and secondary activities and to calculate the activity released and the offsite doses for the postulated steam generator tube rupture accident.

1. The initial primary coolant iodine activity (i.e., prior to any iodine spike considerations) is assumed to be at 1.0 uCi/gm DEQ I-131.
2. The primary coolant activity has been leaking into the secondary side at one gpm for a period of time long enough to establish equilibrium activity concentrations in the steam generators.
3. All noble gas activity transported from the primary system to the secondary system is immediately released to the environment. The initial iodine activity in the water region of the ruptured steam generator increases over time due to the unflashed portion of the leakage.

15.6-9 Amendment No. 106

CPNPP/FSAR

4. Due to the pressure differential between the primary and secondary sides, a fraction of the primary coolant that is discharged to the defective steam generator flashes to steam.

This flashed fraction does not mix with the steam generator water and, therefore, is not subjected to any iodine removal process in the steam generator. However, the flashed fraction experiences iodine removal in the condenser when that path is available.

5. Radioactive decay of parent iodines to noble gas products is not considered during the iodine spiking processes or as unflashed iodine accumulates in the steam generators.
6. A ground level release is assumed. No credit is taken for radioactive decay or cloud depletion due to ground deposition during plume transport.
7. Worst case, five percentile atmospheric dispersion factors are assumed.
8. A breathing rate of 3.5E-04 m3/sec is assumed.
9. Conservative iodine partition factors of 0.01 and 0.15 are used in the steam generator and condenser, respectively, to account for iodine removal effects within those components.
10. The dose contribution from the intact generator is based upon the effects of iodine spiking and a 1 gpm primary-to-secondary leak rate lasting for 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. The leakage is assumed to mix with the secondary side water.
11. Other assumptions are detailed in Table 15.6-1.

Based on the foregoing model, the thyroid and whole body doses at the EAB are conservatively calculated to be 40 rem and 0.14 rem, respectively, for the preaccident iodine spike case and 26 rem and 0.18 rem, respectively, for the concurrent iodine spike case. The thyroid and whole body doses at the LPZ are conservatively calculated to be 6.0 rem and 0.03 rem, respectively, for the preaccident iodine spike case and 4.0 rem and 0.03 rem, respectively, for the concurrent iodine spike case. As expected, the doses are well below the values of 300 rem to the thyroid and 25 rem to the whole body set forth in 10CFR100.

15.6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT This section is not applicable to the CPNPP.

15.6.5 LOSS OF COOLANT ACCIDENT RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY 15.6.5.1 Identification of Causes and Frequency Classification A LOCA is the result of a pipe rupture of the RCS pressure boundary. For the analyses reported here, a major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0 square feet (ft2). This event is considered an ANS Condition IV 15.6-10 Amendment No. 106

CPNPP/FSAR event, a limiting fault, in that it is not expected to occur during the lifetime of the plant but is postulated as a conservative design basis (see Section 15.0.1).

A minor pipe break (small break), as considered in this section, is defined as a rupture of the reactor coolant pressure boundary (see Section 5.2) with a total cross-sectional area less than 1.0 ft2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered a Condition III event, in that it is an infrequent fault which may occur during the life of the plant.

The Acceptance Criteria for the LOCA are described in 10CFR50.46 (Reference 1) as follows:

1. The calculated maximum fuel element cladding temperature shall not exceed 2200 °F.
2. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
3. The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.
4. Calculated changes in core geometry shall be such that the core remains amenable to cooling.
5. After any successful operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

These criteria were established to provide significant margin in Emergency Core Cooling System (ECCS) performance following a LOCA. Reference 2 presents a study in regard to the probability of occurrence of RCS pipe ruptures.

In all cases for Comanche Peak Units 1 and 2, small breaks (less than 1.0 ft2) yield results with more margin to the Acceptance Criteria limits than large breaks.

15.6.5.1.1 References

1. 10CFR50.46 and Appendix K of 10CFR50. Federal Register, Volume 39, Number 3, January 4, 1974. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors.
2. WASH-1400, NUREG-75/014, October 1975. Reactor Safety Study - An Assessment of Accident Risks in U. S. Commercial Nuclear Power Plants.

15.6-11 Amendment No. 106

CPNPP/FSAR 15.6.5.2 Best Estimate Large Break Loss of Coolant Analysis (BE-LBLOCA) 15.6.5.2.1 General When the Final Acceptance Criteria (FAC) governing the loss-of-coolant accident (LOCA) for Light Water Reactors was issued in Appendix K of 10 CFR 50.46, both the Nuclear Regulatory Commission (NRC) and the industry recognized that the stipulations of Appendix K were highly conservative. That is, using the then accepted analysis methods, the performance of the Emergency Core Cooling System (ECCS) would be conservatively underestimated, resulting in predicted Peak Clad Temperatures (PCTs) much higher than expected. At that time, however, the degree of conservatism in the analysis could not be quantified. As a result, the NRC began a large-scale confirmatory research program with the following objectives:

1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those areas in which a purposely prescriptive approach was used in the Appendix K rule could be quantified with additional data so that a less prescriptive future approach might be allowed.
2. Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The purpose of this research was to develop an accurate predictive capability so that the uncertainties in the ECCS performance and the degree of conservatism with respect to the Appendix K limits could be quantified.

Since that time, the NRC and the nuclear industry have sponsored reactor safety research programs directed at meeting the above two objectives. The overall results have quantified the conservatism in the Appendix K rule for LOCA analyses and confirmed that some relaxation of the rule can be made without a loss in safety to the public. It was also found that some plants were being restricted in operating flexibility by the overly conservative Appendix K requirements.

In recognition of the Appendix K conservatism that was being quantified by the research programs, the NRC adopted an interim approach for evaluation methods. This interim approach is described in SECY-83-472. The SECY-83-472 approach retained those features of Appendix K that were legal requirements, but permitted applicants to use best-estimate thermal-hydraulic models in their ECCS evaluation model. Thus, SECY-83-472 represented an important step in basing licensing decisions on realistic calculations, as opposed to those calculations prescribed by Appendix K.

In 1998, the NRC Staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS Evaluation Models, to permit the use of a realistic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.

Under the amended rules, best-estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best-estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate codes is provided in Regulatory Guide 1.157.

15.6-12 Amendment No. 106

CPNPP/FSAR To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (NUREG/

CR-5249). This method outlined an approach for defining and qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three- and four-loop Pressurized Water Reactor (PWR) plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and has been approved by the NRC (WCAP-12945-P-A).

More recently, Westinghouse developed an alternative uncertainty methodology called ASTRUM, which stands for Automated Statistical TReatment of Uncertainty Method (WCAP-16009-P-A). This method is still based on the CQD methodology and follows the steps in the CSAU methodology (NUREG/CR-5249). However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order statistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncertainty parameters are simultaneously sampled for each case. The ASTRUM methodology has received NRC approval for referencing in licensing calculations in WCAP-16009-P-A.

The three 10 CFR 50.46 criteria (peak clad temperature, maximum local oxidation, and core-wide oxidation) are satisfied by running a sufficient number of WCOBRA/TRAC calculations (sample size). In particular, the statistical theory predicts that 124 calculations are required to simultaneously bound the 95th percentile values of three parameters with a 95-percent confidence level.

This analysis is in accordance with the applicability limits and usage conditions defined in Section 13-3 of WCAP-16009-P-A, as applicable to the ASTRUM methodology. Section 13-3 of WCAP-16009-P-A was found to acceptably disposition each of the identified conditions and limitations related to WCOBRA/TRAC and the CQD uncertainty approach per Section 4.0 of the ASTRUM Final Safety Evaluation Report appended to this topical report.

15.6.5.2.2 Method of Analysis The methods used in the application of WCOBRA/TRAC to the large break LOCA with ASTRUM are described in WCAP-12945-P-A and WCAP-16009-P-A. A detailed assessment of the computer code WCOBRA/TRAC was made through comparisons to experimental data. These assessments were used to develop quantitative estimates of the codes ability to predict key physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis. WCOBRA/TRAC MOD7A was used for the execution of ASTRUM for Comanche Peak Units 1 and 2 (WCAP-16009-P-A).

WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. This best-estimate computer code contains the following features:

1. Ability to model transient three-dimensional flows in different geometries inside the vessel
2. Ability to model thermal and mechanical non-equilibrium between phases 15.6-13 Amendment No. 106

CPNPP/FSAR

3. Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes
4. Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.

A typical calculation using WCOBRA/TRAC begins with the establishment of a steady-state, initial condition with all loops intact. The input parameters and initial conditions for this steady-state calculation are discussed in the next section.

Following the establishment of an acceptable steady-state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRA/

TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure is calculated using the COCO code (WCAP-8326 and WCAP-8327) and mass and energy releases from the WCOBRA/TRAC calculation.

The final step of the best-estimate methodology, in which all uncertainties of the LOCA parameters are accounted for to estimate a PCT, Local Maximum Oxidation (LMO), and Core-Wide Oxidation (CWO) at 95-percent probability, is described in the following sections.

1. Plant Model Development:

In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used in order to provide an accurate simulation of the transient.

However, specific guidelines are followed to ensure that the model is consistent with models used in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences, such as in the upper plenum of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions:

In this step, the expected or desired operating range of the plant to which the analysis applies is established. The parameters considered are based on a key LOCA parameters list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the initial transient. Next, several confirmatory runs are made, which vary a subset of the key LOCA parameters over their expected operating range in one-at-a-time sensitivities. Because certain parameters are not included in the uncertainty analysis, these parameters are set at their bounding condition. This analysis is commonly referred to as the confirmatory analysis. The most limiting input conditions, based on these confirmatory runs, are then combined into the model that will represent the limiting state for the plant, which is the starting point for the assessment of uncertainties.

3. Assessment of Uncertainty:

15.6-14 Amendment No. 106

CPNPP/FSAR The ASTRUM methodology is based on order statistics. The technical basis of the order statistics is described in Section 11 of WCAP-16009-P-A. The determination of the PCT uncertainty, LMO uncertainty, and CWO uncertainty relies on a statistical sampling technique. According to the statistical theory, 124 WCOBRA/TRAC calculations are necessary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, CWO).

The uncertainty contributors are sampled randomly from their respective distributions for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are randomly sampled for each time in the cycle, break type (split or double-ended guillotine), and break size for the split break are also sampled as uncertainty contributors within the ASTRUM methodology.

Results from the 124 calculations are tallied by ranking the PCT from highest to lowest. A similar procedure is repeated for LMO and CWO. The highest rank of PCT, LMO, and CWO will bound 95 percent of their respective populations with 95-percent confidence level.

4. Plant Operating Range:

The plant operating range over which the uncertainty evaluation applies is defined. Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range or may be narrower for some parameters to gain additional margin.

15.6.5.2.3 Analysis Assumptions The expected PCT and its uncertainty developed are valid for a range of plant operating conditions. The range of variation of the operating parameters has been accounted for in the uncertainty evaluation. Tables 15.6-4 and 15.6-5 summarize the operating ranges as defined for the proposed operating conditions which are supported by the Best-Estimate LBLOCA analysis for Comanche Peak Unit 1 and Unit 2, respectively. Tables 15.6-6 and 15.6-7 summarize the LBLOCA containment data used for calculating containment pressure (for both units). If operation is maintained within these ranges, the LBLOCA results developed in this report using WCOBRA/TRAC are considered to be valid. Note that some of these parameters vary over their range during normal operation (accumulator temperature) and other ranges are fixed for a given operational condition (Tavg).

15.6.5.2.4 Design Basis Accident The Comanche Peak Units 1 and 2 PCT-limiting transients are both double-ended cold leg guillotine break which analyze conditions that fall within those listed in Table 15.6-4 (Unit 1) and Table 15.6-5 (Unit 2). Traditionally, cold leg breaks have been limiting for large break LOCA.

This location is the one where flow stagnation in the core appears most likely to occur. Scoping studies with WCOBRA/TRAC have confirmed that the cold leg remains the limiting break location (WCAP-12945-P-A).

The large break LOCA transient can be divided into convenient time periods in which specific phenomena occur, such as various hot assembly heatup and cooldown transients. For a typical 15.6-15 Amendment No. 106

CPNPP/FSAR large break, the blowdown period can be divided into the Critical Heat Flux (CHF) phase, the upward core flow phase, and the downward core flow phase. These are followed by the refill, reflood, and long-term cooling periods. Specific important transient phenomena and heat transfer regimes are discussed below, with the transient results shown in Figures 15.6-1 to 15.6-14 for Unit 1 and Figures 15.6-15 to 15.6-28 for Unit 2. (The PCT-limiting case for each unit was chosen to show a conservative representation of the response to a large break LOCA.)

1. Critical Heat Flux (CHF) Phase:

Immediately following the cold leg rupture, the break discharge rate is subcooled and high (Figures 15.6-2, 15.6-3 for Unit 1 and 15.6-16, 15.6-17 for Unit 2). The regions of the RCS with the highest initial temperatures (core, upper plenum, upper head, and hot legs) begin to flash to steam, the core flow reverses and the fuel rods begin to go through departure from nucleate boiling (DNB). The fuel cladding rapidly heats up (Figure 15.6-1 for Unit 1 and 15.6-15 for Unit 2) while the core power shuts down due to voiding in the core. This phase is terminated when the water in the lower plenum and downcomer begins to flash (Figures 15.6-7 and 15.6-12 for Unit 1 and 15.6-21 and 15.6-26 for Unit 2, respectively). The mixture swells and intact loop pumps, still rotating in single-phase liquid, push this two-phase mixture into the core.

2. Upward Core Flow Phase:

Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be enhanced if the pumps are not degraded, or if the break discharge rate is low due to saturated fluid conditions at the break. If pump degradation is high or the break flow is large, the cooling effect due to upward flow may not be significant. Figures 15.6-4 (Unit 1) and 15.6-18 (Unit 2) show the void fraction for one intact loop pump and the broken loop pump. Each figure shows that the intact loop remains in single-phase liquid flow for several seconds, resulting in enhanced upward core flow cooling. This phase ends as the lower plenum mass is depleted, the loop flow becomes two-phase, and the pump head degrades.

3. Downward Core Flow Phase:

The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump flow becomes two-phase. The break flow begins to dominate and pulls flow down through the core, up the downcomer to the broken loop cold leg, and out the break. While liquid and entrained liquid flow provide core cooling, the top third of core vapor flow (Figure 15.6-5 for Unit 1 and Figure 15.6-19 for Unit 2) best illustrates this phase of core cooling. Once the system has depressurized to the accumulator pressure (15.6-6 for Unit 1 and 15.6-20 for Unit 2), the accumulators begin to inject cold borated water into the intact cold legs (Figure 15.6-9 for Unit 1 and 15.6-23 for Unit 2). During this period, due to steam upflow in the downcomer, a portion of the injected ECCS water is calculated to be bypassed around the downcomer and out the break. As the system pressure continues to fall, the break flow, and consequently the downward core flow, is reduced. The core begins to heat up as the system pressure approaches the containment pressure and the vessel begins to fill with ECCS water (Figure 15.6-8 for Unit 1 and 15.6-22 for Unit 2).

15.6-16 Amendment No. 106

CPNPP/FSAR

4. Refill Period:

As the refill period begins, the core begins a period of heatup and the vessel begins to fill with ECCS water (Figures 15.6-9, 15.6-10 for Unit 1 and 15.6-23, 15.6-24 for Unit 2). This period is characterized by a rapid increase in cladding temperatures at all elevations due to the lack of liquid and steam flow in the core region. This period continues until the lower plenum is filled and the bottom of the core begins to reflood and entrainment begins.

5. Reflood Period:

During the early reflood phase, the accumulators begin to empty and nitrogen enters the system. This forces water into the core, which then boils, causing system re-pressurization, and the lower core region begins to quench (Figure 15.6-11 for Unit 1 and 15.6-25 for Unit 2). During this time, core cooling may increase due to vapor generation and liquid entrainment. During the reflood period, the core flow is oscillatory as cold water periodically rewets and quenches the hot fuel cladding, which generates steam and causes system re-pressurization. The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out of the break. This flow path resistance is overcome by the downcomer water elevation head, which provides the gravity driven reflood force.

From the later stage of blowdown to the beginning of reflood, the accumulators rapidly discharge borated cooling water into the RCS, filling the lower plenum and contributing to the filling of the downcomer. The pumped ECCS water aids in the filling of the downcomer and subsequently supplies water to maintain a full downcomer and complete the reflood period. As the quench front progresses up the core, the PCT location moves higher into the top core region. As the vessel continues to fill, the PCT location is cooled and the early reflood period is terminated.

A second cladding heatup transient may occur due to boiling in the downcomer.

The mixing of ECCS water with hot water and steam from the core, in addition to the continued heat transfer from the hot vessel and vessel metal, reduces the subcooling of ECCS water in the lower plenum and downcomer. The saturation temperature is dictated by the containment pressure. If the liquid temperature in the downcomer reaches saturation, subsequent heat transfer from the vessel and other structures will cause boiling and level swell in the downcomer. The downcomer liquid will spill out of the broken cold leg and reduce the driving head, which can reduce the reflood rate, causing a late reflood heatup at the upper core elevations. Figures 15.6-12 (Unit 1) and 15.6-26 (Unit 2) show only a slight reduction in downcomer level and indicates that a late reflood heatup does not occur.

15.6.5.2.5 Post Analysis of Record Evaluations In addition to the analyses presented in this section, evaluations and reanalyses may be performed as needed to address computer code errors and emergent issues, or to support plant changes. The issues or changes are evaluated, and the impact on the Peak Cladding Temperature (PCT) is determined. The resultant increase or decrease in PCT is applied to the 15.6-17 Amendment No. 106

CPNPP/FSAR analysis of record PCT. The PCT, including all penalties and benefits is presented in Tables 15.6-8 (Unit 1) and 15.6-10 (Unit 2) for the large break LOCA. The current PCT is demonstrated to be less than the 10 CFR 50.46(b) requirement of 2200 ºF.

In addition, 10 CFR 50.46 requires that licensees assess and report the effect of changes to or errors in the evaluation model used in the large break LOCA analysis. These reports constitute addenda to the analysis of record provided in the UFSAR until the overall changes become significant as defined by 10 CFR 50.46. If the assessed changes or errors in the evaluation model results in significant changes in calculated PCT, a schedule for formal reanalysis or other action as needed to show compliance will be addressed in the report to the NRC.

Finally, the criteria of 10 CFR 50.46 requires that holders and users of the evaluation models establish a number of definitions and processes for assessing changes in the models or their use. Westinghouse, in consultation with the PWR Owners Group (PWROG), has developed an approach for compliance with the reporting requirements. This approach is documented in WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting.

Luminant Power provides the NRC with annual and 30-day reports, as applicable, for Comanche Peak Units 1 and 2. Luminant Power intends to provide future reports required by 10 CFR 50.46 consistent with the approach described in WCAP-13451.

15.6.5.2.6 Conclusions It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR 50.46 are met. The demonstration that these limits are met is as follows:

(b)(1) The limiting PCT corresponds to a bounding estimate of the 95th percentile PCT at the 95-percent confidence level. The analysis confirms that 10 CFR 50.46 acceptance criterion (b)(1), i.e., Peak Clad Temperature less than 2200 ºF, is demonstrated. The results are shown in Table 15.6-9 for Unit 1 and Table 15.6-11 for Unit 2.

(b)(2) The maximum cladding oxidation corresponds to a bounding estimate of the 95th percentile LMO at the 95-percent confidence level. The analysis confirms that 10 CFR 50.46 acceptance criterion (b)(2), i.e., Local Maximum Oxidation of the cladding less than 17 percent, is demonstrated. The results are shown in Table 15.6-9 for Unit 1 and Table 15.6-11 for Unit 2.

(b)(3) The limiting core-wide oxidation (CWO) corresponds to a bounding estimate of the 95th percentile CWO at the 95-percent confidence level. The limiting Hot Assembly Rod (HAR) total maximum oxidation is 0.0 percent for both units. A detailed CWO calculation takes advantage of the core power census that includes many lower power assemblies. Because there is significant margin to the regulatory limit, the CWO value can be conservatively chosen as that calculated for the limiting HAR. A detailed CWO calculation is therefore not needed because the outcome will always be less than the HAR value. The analysis confirms that 10 CFR 50.46 acceptance criterion (b)(3), i.e., Core-Wide Oxidation less than 1 percent, is demonstrated. The results are shown in Table 15.6-9 for Unit 1 and Table 15.6-11 for Unit 2.

15.6-18 Amendment No. 106

CPNPP/FSAR (b)(4) 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains amenable to cooling. This criterion has historically been satisfied by adherence to criteria (b)(1) and (b)(2), and by assuring that fuel deformation due to combined LOCA and seismic loads is specifically addressed. It has been demonstrated that the PCT and maximum cladding oxidation limits remain in effect for Best-Estimate LOCA applications.

The approved methodology (WCAP-12945-P-A) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the 44 assemblies in the low-power channel. This situation has not been calculated to occur for Comanche Peak Units 1 and 2.

Therefore, acceptance criterion (b)(4) is satisfied.

(b)(5) 10 CFR 50.46 acceptance criterion (b)(5) requires that long-term core cooling be provided following the successful initial operation of the ECCS. Long-term cooling is dependent on the demonstration of continued delivery of cooling water to the core. The actions, automatic or manual, that are currently in place at these plants to maintain long-term cooling remain unchanged with the application of the ASTRUM methodology (WCAP-16009-P-A).

Based on the ASTRUM Analysis results (Tables 15.6-9 and 15.6-11), it is concluded that Comanche Peak Units 1 and 2 continue to maintain a margin of safety to the limits prescribed by 10 CFR 50.46.

15.6.5.2.7 References

1. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, January 4, 1974.
2. SECY-83-472, Information Report from W.J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, November 17, 1983.
3. Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, USNRC, May 1989.
4. NUREG/CR-5249, Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, B. Boyack, et. al., 1989.
5. Bajorek, S.M., et. al., 1998, Code Qualification Document for Best-Estimate LOCA Analysis, WCAP-12945-P-A, Volume 1, Revision 2 and Volumes 2 through 5, Revision 1.
6. WCAP-16009-P-A, Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), (Proprietary),

January 2005.

7. Containment Pressure Analysis Code (COCO), WCAP-8327 (Proprietary) and WCAP-8326 (Non-Proprietary), June 1974.

15.6-19 Amendment No. 106

CPNPP/FSAR

8. WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting, October 1992.

15.6.5.3 Small Break Loss of Coolant Accident 15.6.5.3.1 Sequence of Events and System Operations A LOCA can result from a rupture of the reactor coolant system (RCS) or of any line connected to that system up to the first isolation valve. Ruptures of small cross section will cause expulsion of the coolant at a rate that can be accommodated by the charging pumps. Breaks of greater size (up to 1 ft2 area) are defined as small breaks and are analyzed with the NOTRUMP computer code. A rupture in the reactor coolant system results in the discharge to the containment of reactor coolant and associated energy. The result of this discharge is a decrease in coolant pressure in the reactor coolant system and an increase in containment temperature and pressure.

The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection system (SIS) signal is actuated when the appropriate pressurizer low pressure setpoint is reached, activating the Emergency Core Cooling System (ECCS) (assuming the most limiting single failure of ECCS equipment).

Before the break occurs, the unit is assumed to be in an equilibrium condition, (i.e., the heat generated in the core is being removed via the secondary system). In the small break LOCA, the blowdown phase of the small break occurs over a long time period. Thus for a small break LOCA, there are three characteristic stages: (1) a gradual blowdown in which the decrease in water level is checked by the inventory replenishment associated with safety injection, (2) core recovery, and (3) long-term recirculation. The heat transfer between the reactor coolant system and the secondary system may be in either direction, depending on the relative temperature. For the case of continued heat addition to the secondary side, the secondary side pressure increases and the main steam safety valves may actuate to reduce the pressure. Makeup to the secondary side is automatically provided by the auxiliary feedwater system. Coincident with the SIS, normal feedwater flow is stopped by closing the main feedwater control valves and tripping the main feedwater pumps. Emergency feedwater flow is initiated by starting the auxiliary feedwater pumps. The secondary side flow aids in the reduction of RCS pressure with the break being the primary means of heat removal. When the reactor coolant system depressurizes to approximately 600 psia, the accumulators begin to inject borated water into the reactor coolant loops. Reflecting the loss of offsite power assumption, the reactor coolant pumps are assumed to be tripped at the time of reactor trip, and the effects of pump coastdown are included in the blowdown analysis.

15.6.5.3.2 Small Break Evaluation Model The NOTRUMP and LOCTA-IV computer codes are used to perform the analysis of LOCAs due to small breaks in the RCS. The NOTRUMP computer code, approved for this use by the U.S.

Nuclear Regulatory Commission in May 1985 (Reference 1), is used to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of the flow through the break. This code is a one-dimensional general network code incorporating a number of features, including the utilization of nonequilibrium thermal calculation in all-fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking 15.6-20 Amendment No. 106

CPNPP/FSAR logic in multiple-stacked fluid nodes, and regime-dependent heat transfer correlations. Also, safety injection into the broken loop is modeled using the COSI condensation model (Reference 2). The NOTRUMP small-break LOCA ECCS evaluation model was developed to determine the RCS response to design basis small-break LOCAs and to address the NRC concerns expressed in NUREG-0611, Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants.

In NOTRUMP, the RCS is subdivided into fluid-filled control volumes (fluid nodes) and metal nodes interconnected by flow paths and heat transfer links. The transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum applied to these nodes. The broken loop is modeled explicitly, and the intact loops are lumped into a second loop. A detailed description of the NOTRUMP code is provided in References 1, 2, and 3.

In the NOTRUMP model, the reactor core is represented as a vertical stack of heated control volumes with an associated bubble rise model to permit a transient mixture height calculation.

The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a LOCA.

Clad thermal analyses are performed with the LOCTA-IV code (Reference 4) which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height from the NOTRUMP hydraulic calculations as input. For all computations where core uncovery occurred, the NOTRUMP and LOCTA runs were terminated after the time the core mixture level reached the top of the core following uncovery.

A schematic representation of the computer code interfaces is given in Figure 15.6.5-29.

15.6.5.3.3 Input Parameters and Initial Conditions Significant input parameters are given in Table 15.6.5-13.

The bases used to select the numerical values that are input parameters to the analysis have been conservatively determined from sensitivity studies (References 5, 6, and 7). In addition, the requirements of 10CFR50 Appendix K regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time that the LOCA occurs and include such items as the core-peaking factors and ECCS performance.

Decay heat generated throughout the transient is also conservatively calculated.

For the small break LOCA (SBLOCA) analysis, loss of offsite power (LOOP) is assumed, which results in the limiting single failure assumption of the loss of one Emergency Diesel Generator (EDG) and a subsequent loss of one train of pumped Emergency Core Cooling System (ECCS) flow. The SBLOCA analysis assumes that reactor trip occurs coincident with the LOOP, which results in the following: (a) Reactor Coolant Pump (RCP) trip and coastdown and (b) Steam Dump System being inoperable.

15.6-21 Amendment No. 106

CPNPP/FSAR The SBLOCA analysis is performed with a high nominal vessel average temperature (Tavg) value of 589.2°F. The high Tavg value chosen is evaluated to be applicable over the range of nominal vessel average temperature values (574.2°F to 589.2°F).

The safety injection (SI) system consists of gas pressurized accumulator tanks and pumped injection systems. The accumulators are modeled to inject borated water into the RCS when the RCS depressurizes to 603 psia. Minimum ECCS availability is assumed for the analysis from one centrifugal charging pump (CCP), one SI pump and one RHR pump. Assumed pumped SI characteristics as a function of RCS pressure used as boundary conditions in the analysis are shown in Table 15.6.5-14 and corresponding Figure 15.6.5-31 for break sizes less than 8.75 inches and Table 15.6.5-15 and corresponding Figure 15.6.5-32 for the 8.75 inch break case.

For the break sizes less than 8.75 inches the broken loop safety injection flow is assumed to spill to RCS pressure and for the 8.75 inch break case the broken loop safety injection flow is assumed to spill to the containment back pressure of 0 psig. The ECCS was assumed to deliver to the RCS 22 seconds after the generation of the SI signal. This delay includes time required for sensor response, diesel generator startup and emergency power bus loading in case of a loss of offsite power coincident with an accident.

15.6.5.3.4 Small Break LOCA Results The calculated peak clad temperature (PCT) resulting from the limiting small break LOCA is less than that calculated for the limiting large break for both Units. To insure that the worst possible small break size has been identified, calculations were performed for a spectrum of small breaks (2, 3, 4, 6 inch equivalent diameter cold leg breaks) as well as an 8.75 inch equivalent diameter accumulator line break for each unit. The results of these analyses are summarized in Tables 15.6.5-16 and 15.6.5-17 for Unit 1 and in Tables 15.6.5-18 and 15.6.5-19 for Unit 2.

Based on the results of these analyses, the limiting small break was determined to be a 4-inch diameter rupture of the RCS cold leg for both Unit 1 and Unit 2 with a PCT of 1013ºF and 1210ºF for Unit 1 and Unit 2, respectively. The clad did not rupture in any of the cases simulated.

Figures 15.6.5-33 through 15.6.5-80 present the principal parameters of interest for the small-break ECCS analyses. For all cases analyzed, the following transient parameters, where applicable, are presented (note that since there was no or minimal core uncovery for the 2, 6, and 8.75-inch cases, no LOCTA calculations were performed and no clad temperature or maximum local oxidation figures are provided for these breaks):

  • Core Mixture Height
  • Core Exit Vapor Temperature
  • Clad Temperature at Peak Clad Temperature Elevation
  • Maximum Local ZrO2 Thickness For the limiting (4-inch) breaks analyzed, the following additional transient parameters are presented:

15.6-22 Amendment No. 106

CPNPP/FSAR

  • Core Exit Steam Flow Rate
  • Total Break Flow and Safety Injection Flow
  • Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation
  • Fluid Temperature at Peak Clad Temperature Elevation The maximum calculated PCT for all small breaks analyzed is 1210°F. These results are well below all corresponding acceptance criteria limits of 10CFR50.46.

15.6.5.3.5 References

1. WCAP-10079-P-A (Proprietary) and WCAP-10080-A (Non-proprietary), 1985. Meyer, P.

E., NOTRUMP, A Nodal Transient Small Break and General Network Code.

2. WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), 1995. Thompson, C.M., et al, Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model.
3. WCAP-10054-P-A (Proprietary) and WCAP-10081-A (Non-proprietary), 1985. Lee, N.

Rupprecht, S. D., Schwarz, W. R, and Tauche, W. D., Westinghouse Small ECCS Evaluation Model Using the NOTRUMP Code.

4. WCAP 8301 (Proprietary) and WCAP 8305 (Non-proprietary), 1974. Bordelon, F. M. et al.

LOCTA IV Program: Loss of Coolant Transient Analysis.

5. WCAP-8340 (Proprietary) and WCAP-8356 (Non-proprietary), 1974. Salvatori, R.

Westinghouse ECCS - Plant Sensitivity Studies.

6. WCAP-8341 (Proprietary) and WCAP-8342 (Non-proprietary), 1974. Westinghouse ECCS Evaluation Model Sensitivity Studies.
7. WCAP-8565-P-A (Proprietary) and WCAP-8566-A (Non-proprietary), 1975. Johnson, W.J.; Massie, H.W.; and Thompson, C.M. Westinghouse ECCS-Four Loop Plant (17 x 17)

Sensitivity Studies.

15.6.5.4 Environmental Consequences To demonstrate in a conservative manner that the operation of a nuclear power station does not present any undue radiological hazard to the general public, a hypothetical accident involving a gross release of fission products is evaluated. No mechanism for such a release has been postulated because it would require a number of simultaneous failures to occur in the engineered safety features. The core fission product inventory is assumed to be released into the containment as described in Regulatory Guide 1.195 [34]. Numerical values for the total core fission product inventory of the isotopes considered in calculating the radiation doses are listed in Table 15.0-7.

15.6-23 Amendment No. 106

CPNPP/FSAR The radiological evaluation of this accident is divided into two parts: internal (thyroid) dose from inhalation of iodines in the leakage plume, and external (whole body) exposure as a result of immersion in the leakage plume.

The radiological consequences due to the release of core fission products during a postulated loss-of-coolant accident are evaluated in the following sections:

1. Radiological consequences of containment leakage The integrated thyroid doses and the integrated whole body doses are calculated using methods and assumptions in conformance with Regulatory Guide 1.195. The assumptions used in the analysis are listed below.
a. Twenty-five percent of the equilibrium radioactive iodine inventory developed from maximum full-power operation of the core is immediately available for leakage from the reactor containment. Of this 25 percent, 91 percent is in the form of elemental iodine, 5 percent is in the form of particulate iodine, and 4 percent is in the form of organic iodides.
b. All (i.e., 100 percent) of the equilibrium radioactive noble gas inventory developed from maximum full-power operation of the core is immediately available for leakage from the reactor containment.
c. The effects of radiological decay during holdup in the containment are taken into account.
d. The containment volume is divided into separate regions by concrete floors at different elevations (see Section 6.5.2). A radial gap between the concrete floors and the inner wall of the Containment Building permits a limited amount of convective mixing between these regions. The region not covered by containment spray is treated as a separate unsprayed volume which is assumed to mix with the volumes in the sprayed areas at a mixing rate of two turnovers per hour.

The Containment Spray System is actuated by a high containment pressure signal. For a discussion of the sequence of events of spray system operation, see Section 6.5.2. A sodium hydroxide spray is used to reduce the amount of fission product iodine available for release during the LOCA. The containment spray solution is assumed to interact with the elemental iodine and particulate iodine.

The mathematical models which calculate the iodine spray removal coefficients are presented in Section 6.5.2. For each region the calculated elemental iodine removal coefficients are above 10 hr-1. The removal coefficient for elemental iodine used in the offsite dose calculation is limited to a maximum value of 10 hr-1

[22]. The calculated value of 11.4 hr-1 is used for the particulate iodine removal coefficient, until a DF of 50 is reached at which time the particulate removal coefficient is reduced by a factor of 10. The elemental iodine removal effectiveness may be expected to diminish after the concentration in the containment atmosphere has been reduced by several orders of magnitude. The elemental iodine removal effectiveness of the spray system is conservatively 15.6-24 Amendment No. 106

CPNPP/FSAR assumed to cease after a decontamination of 100 in the containment atmosphere has been achieved.

e. The iodine and noble gases available for release to the environment are assumed to leak from the Containment at a maximum leak rate of 0.10 percent of the containment volume per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and at 0.05 percent of the containment volume per day for the duration of the accident.
f. The duration of the accident is considered to be 30 days.
g. A ground-level release is assumed. Atmospheric dilution factors are discussed in Section 2.3 [23] and listed in Table 15.6-20.
h. No credit is taken for depletion of fission products in the plume due to ground deposition or radioactive decay in transit.
i. For the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident, the breathing rate of persons offsite is assumed to be 3.5 x 10-4 cubic meters per second (m3/sec). Eight to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the accident, the breathing rate is assumed to be 1.8 x 10-4 m3/sec.

From 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> through 30 days after the accident, the rate is assumed to be 2.3 x 10-4 m3/sec.

j. The mathematical model and dose conversion factors presented in Appendix 15B are used for evaluating the radiological consequences of the LOCA
k. Other assumptions are detailed in Table 15.6-20.

Using the assumptions presented above and the mathematical models presented in Appendix 15B, the doses at the EAB were conservatively calculated to be 46.4 rem to the thyroid and 0.655 rem to the whole body; the doses at the LPZ were conservatively calculated to be 18.7 rem to the thyroid and 0.224 rem to the whole body.

2. Radiological consequences of engineered safety features equipment leakage outside containment.

Following a postulated LOCA, a potential source of fission product release is the leakage of water from engineered safety features (ESF) equipment located outside the containment. Such leakage could occur during the recirculation phase through components such as pump flanges, valves, and heat exchangers. The fission products could then be released from the water into the atmosphere resulting in offsite radiological consequences that contribute to the total dose from the LOCA.

An analysis of the offsite effects attributable to ESF equipment leakage is performed based on the following conservative assumptions:

a. 50 percent of the halogens originally present in the core are intimately mixed with the coolant water and are assumed to be available for release through ESF equipment outside containment (see Table 15.6-21).

15.6-25 Amendment No. 106

CPNPP/FSAR

b. The leakage from all ESF components is conservatively assumed to start 10 minutes after the LOCA and continue for the duration of the accident at a rate of 2 gallons per minute.
c. An iodine partition factor of 0.1 is assumed. This factor is taken as the fraction of iodine in the leakage that becomes airborne.
d. Gaseous radioactivity released to rooms housing the leaking components is considered to be immediately swept away by the ventilation system and released to the atmosphere. (See Section 9.4.5 and Figures 1.2-16, 1.2-35 and 9.4-9).
e. An iodine adsorber efficiency of 95 percent is applied since the ventilation exhaust passes through HEPA filters and iodine adsorbers prior to release to the atmosphere. The iodine adsorbers are designed to the requirements of NRC Regulatory Guide 1.52 (See Appendix 1A(B)) as discussed in Section 9.4.3.
f. No credit is taken for an elevated release; all meteorological parameters are considered to be identical to those previously defined in this section.

Based upon the foregoing model, the thyroid and whole body dose contributions due to ESF equipment leakage are conservatively calculated to be 12.1 rem and 0.0402 rem, respectively, for the EAB. The LPZ doses are conservatively calculated to be 24.8 rem to the thyroid and 0.0266 rem to the whole body.

3. Environmental consequences of releases through the containment pressure relief line in the event of a LOCA An analysis of the radioactive effluents escaping the Containment to the environment after a LOCA, via the line through the controlled access area exhaust system, was performed using the following assumptions:
a. The maximum containment air/steam mass release to the environment was conservatively calculated assuming containment pressures for a large break LOCA, and critical flow via the 3-3/8 inch orifice plate at the inlet to the pressure relief system ductwork. No credit was taken for line losses in the ductwork or two butterfly valves.
b. Only reactor coolant activity is assumed to be released. It was conservatively assumed that all iodine and noble gas activity in the primary coolant was instantaneously released to the containment atmosphere.
c. The primary coolant iodine activity is assumed to be 1.0 micro curie per gram dose equivalent I-131. The noble gas activity is based on operation with 1% fuel defects. The activity concentrations are presented in Table 15.1-4.
d. The containment pressure relief line isolation valve closure time including instrumentation delays will not exceed 5 seconds. The analysis did not consider the reduction of mass flow during the valve closure time of five seconds; full flow was assumed until the lapse of five seconds.

15.6-26 Amendment No. 106

CPNPP/FSAR

e. No credit was taken for radioactive decay.
f. No credit was taken for an elevated release.

Based on the foregoing assumptions, the doses to the thyroid and whole body were both conservatively calculated to be less than 1 rem at the exclusion area boundary. The doses from this accident are well within the values set forth in 10CFR100.

4. Total dose due to a postulated LOCA The total dose attributed to a postulated LOCA is the combined doses due to containment leakage ESF equipment leakage, and releases through the containment pressure relief line. The combined EAB doses are 59.0 rem to the thyroid and 0.70 rem to the whole body. The combined LPZ doses are 44.0 rem to the thyroid and 0.25 rem to the whole body. As expected, the doses are below the values set forth in 10CFR100.

The dose to personnel engaging in mineral extraction operations within the exclusion area, in the event of a postulated LOCA, would be less than the dose values of 300 rem to the thyroid and 25 rem to the whole body set forth in 10CFR100.

5. Dose to the control room occupants In the event of a Design Basis Accident (DBA), the safety injection actuation signal or a high radiation signal from the control room air intake monitors will initiate emergency recirculation and pressurization of the Control Room air conditioning system. Later, the emergency ventilation air makeup system can be brought into operation as described in Section 9.4.1.

The control room doses were analyzed for various design basis accidents. It was determined that the LOCA doses represent the limiting case. Therefore the methodology and the doses calculated for the LOCA are reported here.

The following assumptions are applied in the calculations of the dose to the control room occupants following the LOCA:

a. The basic assumptions presented in Items 1 and 2, above, are applied, except a constant breathing rate of 3.5 x 10-4 m3/sec is assumed throughout the accident.
b. The control room pressurization (air intake) and recirculation iodine adsorbers are assigned a 99 percent decontamination efficiency for both elemental and organic iodines in accordance with Table 2 of Regulatory Guide 1.52 (See Appendix 1A(B)). The pressurization adsorbers are arranged in series with the recirculation adsorbers (see Figure 9.4-1) during the emergency pressurization mode, thus providing an equivalent decontaminating efficiency in excess of 99 percent for both elemental and organic iodines from the pressurization makeup air.
c. The control room air-conditioning system runs either in the emergency recirculation mode or the emergency ventilation mode during a LOCA.

15.6-27 Amendment No. 106

CPNPP/FSAR

d. During the emergency recirculation mode of operation, a constant air intake flow rate of 800 ft3/min is assumed. This makes up for losses caused by leaks and maintains the control room atmosphere at a positive pressure of 0.125 inch water gauge relative to adjacent areas.

Since both recirculation trains are actuated by the safety injection signal, the outside air intake flow rate during dual train operation is conservatively estimated to be 1600 cfm. If both trains are assumed to operate for one hour, the calculated thyroid dose would decrease, due to the additional iodine filtration. The calculated whole body gamma and beta skin doses would increase slightly due to the additional intake of outside air. In both cases, the calculated doses remain below the limits specified in 10 CFR 50, Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 19. The reported control room doses are the higher values of the two cases.

e. During the emergency ventilation mode of operation, 3800 ft3/min of outdoor air is used to introduce fresh air into the control room.
f. The emergency ventilation mode of operation is under administrative control so that the dose to the control room occupants is minimized, and the need for air change is satisfied.

The operating mode sequence used in this analysis is as follows:

Filtered Operating Air Intake Recirculation Time Period Mode Time in Mode Flow Rate Flow Rate 0 to Emergency 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> 800 ft3/min 7200 ft3/min 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />(a) recirculation 96 to Emergency 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> 3800 ft3/min 4200 ft3/min 117 hours0.00135 days <br />0.0325 hours <br />1.934524e-4 weeks <br />4.45185e-5 months <br /> ventilation 117 to Emergency 603 hours0.00698 days <br />0.168 hours <br />9.970238e-4 weeks <br />2.294415e-4 months <br /> 800 ft3/min 7200 ft3/min 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> recirculation a) Since both recirculation trains are actuated by the SI signal, one train must be turned off manually by the operators within one (1) hour.

g. The distance from the Containment to the control room air intake is 94 feet, and the air intake is located 56 feet above ground. The distance from the primary plant vent stack (i.e. the ESF leakage release point) to the closest air intake is 138 ft.

15.6-28 Amendment No. 106

CPNPP/FSAR

h. Atmospheric dilution factors are determined from the following equation based on Reference [24]:

X/Q = [U(y z + A/(K+2)]-1 where:

U= wind speed at an elevation of 10 meters (m/sec) y, z = standard deviation of the gas concentration in the horizontal and vertical crosswind directions, respectively, both being evaluated at a distance of 94 feet for the containment leakage source and at a distance of 138 feet for the ESF leakage source 3

K = ----------------------

1.4

( S/D )

S= distance between containment surface or primary plant vent and closest control room intake D= diameter of Containment for the containment leakage source and a combination of portions of the Containment and Auxiliary Building for the ESF leakage source A= projected area of Containment Building (3265 m2) for the containment leakage source and 2088 m2 for the ESF leakage source Table 15.6-22 summarizes the X/Q values calculated utilizing this expression.

i. The CPNPP CREFS design is zone isolation, with filtered recirculation air, and with a positive pressure. This design maximizes the iodine protection factors and minimizes the dose from iodine. The total unfiltered infiltration rate in the control room is conservatively assumed to be 27 cfm, including 10 cfm due to ingress/

egress, 2 cfm leakage from the ductwork passing through the control room pressure boundary, and 15 cfm from other sources. Filtered inleakage through the closed inlet bubble tight dampers due to the pressure differential is conservatively included for the impact on whole body due to noble gases. Though negligible, any inleakage through the bubble tight dampers will be filtered by the recirculation filtration units.

Because the control room door ingress/egress is to a stairwell which is equivalent to a two-door vestibule, backflow will not occur with the CPNPP CREFS design and the 10 cfm is not applicable per SRP 6.4. The ductwork has all welded joints which were leak tested prior to operation. Therefore, the assumed unfiltered inleakage from adjacent areas is conservative with respect to the SRP review criteria.

15.6-29 Amendment No. 106

CPNPP/FSAR

j. Habitability of the control room is based on the following occupancy factors:

Time Period Occupancy Factor 0 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.0 1 to 4 days 0.6 4 to 30 days 0.4

k. The air volume in the control room used to determine exposures to operators is 423,032 ft3.
l. The models for the major contributors to the control room dose are provided in Appendix 15B.

Using the above assumptions and procedures, the thyroid dose is conservatively calculated to be 40.0 rem in the control room for the duration of the accident. The thyroid dose can be further reduced by the use of the available respiratory protection equipment. The total whole body gamma dose is conservatively calculated to be 1.2 rem. This calculated dose includes whole body dose contributions from containment sources (both direct and scattered radiation), the external passing cloud, control room atmosphere, activity buildup on filters, and streaming through doors and penetrations. These calculated doses are less than the limiting values specified in Regulatory Guide 1.195.

The skin dose received in the control room during the accident period is conservatively calculated to be 13.0 rem. This calculated beta skin dose is less than the 50 rem limit allowed by Regulatory Guide 1.195 if special protective clothing and eye protection is not used. However, special protective clothing and eye protection are provided for use, if required, to reduce the beta skin doses to the operators.

6. Environmental consequences of containment purging to control containment hydrogen concentration after a LOCA Purging of the containment atmosphere for controlling potential hydrogen accumulation in the Containment following a postulated LOCA is not required. Thus, an analysis of the radiological consequences of containment purging is not provided.

15.6.6 A NUMBER OF BWR TRANSIENTS This section is not applicable to the CPNPP.

REFERENCES

1. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.
2. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

15.6-30 Amendment No. 106

CPNPP/FSAR

3. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, 10CFR50.46 and Appendix K of 10CFR50. Federal Register, Volume 39, Number 3, January 4, 1974.
4. Reactor Safety Study - An Assessment of Accident Risks in U. S. Commercial Nuclear Power Plants, WASH-1400, NUREG-75/014, October 1975.
5. Deleted
6. Deleted
7. Deleted
8. Deleted
9. Deleted
10. Deleted
11. Deleted
12. Deleted
13. Deleted
14. Deleted
15. Deleted
16. Deleted
17. Deleted 17a. Deleted
18. Deleted
19. Deleted
20. Deleted 20a. Deleted
21. DiNunno, J.J., Anderson, F. D., Baker, P.E. and Waterfield, R. L., Calculation of Distance Factors for Power and Test Reactor Sites, TID-14844, U. S. Nuclear Regulatory Commission, Division of Licensing and Regulation, March 1962.
22. Postma, A. K., and Pasedag, W. F., A Review of Mathematical Models for Predicting Spray Removal of Fission Products in Reactor Containment Vessels, WASH-1329, U. S. Nuclear Regulatory Commission, Accident Analysis Branch.

15.6-31 Amendment No. 106

CPNPP/FSAR

23. Meteorology and Atomic Energy, U. S. Nuclear Regulatory Commission, Division of Technical Information, 1968.
24. Murphy, K. G. and Campe, Dr. K. M., Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19, U. S. Nuclear Regulatory Commission.
25. Deleted
26. Deleted
27. Deleted
28. Deleted
29. Deleted
30. Deleted
31. Deleted
32. Deleted
33. Deleted
34. Regulatory Guide 1.195, Methods and Assumptions For Evaluating Radiological Consequences Of Design Basis Accidents At Light-Water Nuclear Power Reactors, May 2003.
35. Deleted
36. Deleted
37. WCAP-10698, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, August 1987.
38. Supplement 1 to WCAP-10698-P-A, Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident, March 1986.
39. WCAP-14882-P-A, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, April 1999.

15.6-32 Amendment No. 106

CPNPP/FSAR TABLE 15.6-1 PARAMETERS FOR POSTULATED STEAM GENERATOR TUBE RUPTURE ACCIDENT ANALYSIS (Sheet 1 of 2)

Parameter Value

1. Data and Assumptions Used to Estimate Radioactive Source Term For the Postulated Steam Generator Tube Rupture Accident
a. Steam generator tube leak prior to and during 1.0 accident (gpm)
b. Offsite power lost on reactor trip
2. Data and Assumptions Used to Estimate Activity Released to the Atmosphere
a. Iodine partition factor in steam generators prior to 0.01 and during accident
b. Iodine partition factor in condensers prior to 0.15 accident
c. Duration of plant cooldown by secondary system 11 after accident (hr)
3. Dispersion Data
a. Exclusion area boundary and low population 2080 m and 4 miles zone distances
b. x/Q (sec/m3) 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (EAB) 1.6 x 10-4 0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (LPZ) 2.4 x 10-5 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (LPZ) 1.6 x 10-5
4. Dose Data
a. Method of dose calculation See Appendix 15B
b. Dose conversion assumptions See Appendix 15B Amendment No. 104

CPNPP/FSAR TABLE 15.6-1 PARAMETERS FOR POSTULATED STEAM GENERATOR TUBE RUPTURE ACCIDENT ANALYSIS (Sheet 2 of 2)

Parameter Value

c. Doses (rem)

With preaccident iodine spike

@ exclusion area boundary (0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

Thyroid inhalation 40.0 Whole body gamma 0.14

@ low population zone (0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)

Thyroid inhalation 6.0 Whole body gamma 0.03 With concurrent iodine spike

@ exclusion area boundary (0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

Thyroid inhalation 26.0 Whole body gamma 0.18

@ low population zone (0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)

Thyroid inhalation 4.0 Whole body gamma 0.03 Amendment No. 104

CPNPP/FSAR TABLE 15.6-2 PREACCIDENT IODINE SPIKE CONCENTRATION IN THE PRIMARY COOLANT(a)

Preaccident Iodine Spike Concentration Isotope (Ci/gm)

I-131 46.1 I-132 49.2 I-133 73.8 I-134 10.7 I-135 40.6 a) This concentration corresponds to 60 Ci/gm Dose Equivalent I-131, the maximum allowed at Rated Thermal Power by the Technical Specifications.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-3 IODINE APPEARANCE RATE TO THE REACTOR COOLANT AFTER THE ACCIDENT Iodine Appearance Rate(a)

Isotope (Ci/min)

I-131 151.1 I-132 513.2 I-133 294.5 I-134 237.2 I-135 232.2 a) Corresponds to 335 times the equilibrium appearance rate based on operation with reactor coolant activity at 1.0 uCi/gm Dose Equivalent I-131.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-4 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 1 (Sheet 1 of 3)

Parameter As-Analyzed Value or Operating Range or Range Target Value 1.0 Plant Physical Description a) Dimensions Nominal N/A b) Pressurizer location On an intact loop N/A c) Hot assembly location Anywhere in core(a) N/A d) Hot assembly type(b) 17 x 17 OFA fuel 17 x 17 OFA fuel design design e) Steam generator tube < 10% 0% < SGTP < 10%

plugging level (in any one SG) f) Fuel assembly type(b) 17 x 17 OFA fuel with 17 x 17 OFA fuel with ZIRLO cladding, ZIRLO cladding, non-IFBA or IFBA non-IFBA or IFBA 2.0 Plant Initial Operating Conditions 2.1 Reactor Power a) Core power < 100.6% of 3612 MWt < 3612 MWt b) Peak heat flux hot < 2.5 < 2.5 channel factor (FQ)(b) c) Peak hot rod enthalpy < 1.60 < 1.60 rise hot channel factor (FH)(b) d) Hot assembly radial < 1.60/1.04 < 1.60/1.04 peaking factor (PHA)(b) e) Hot assembly heat flux < 2.5/1.04 < 2.5/1.04 hot channel factor (FQHA)

Amendment No. 105

CPNPP/FSAR TABLE 15.6-4 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 1 (Sheet 2 of 3)

Parameter As-Analyzed Value or Operating Range or Range Target Value f) Axial power distribution Figure 15.6-13 Figure 15.6-13 (PBOT, PMID)(b) g) Low power region 02. < PLOW < 0.7 02. < PLOW < 0.7 relative power (PLOW)(b) h) Hot assembly burnup < 75,000 MWD/MTU, < 62,000 MWD/MTU, lead rod(a) lead rod(a)(c) i) MTC < 0 at hot full power < 0 at hot full power (HFP) (HFP) j) Typical cycle length 18 months 18 months k) Minimum core average > 10,000 MWD/MTU > 10,000 MWD/MTU burnup(b) l) Maximum steady state 2.0 2.0 depletion, FQ(b) 2.2 Fluid Conditions a) TAVG 574.2 - 6.5ºF < TAVG 574.2 - 589.2

< 589.2 + 6.5ºF b) Pressurizer pressure 2250 - 30 psia < PRCS 2250 psia(d)

< 2250 + 30 psia c) Loop flow TDF > 95,700 gpm/loop mmf > 99,100 gpm/

loop(e) d) Upper head design TCOLD TCOLD e) Pressurizer level 60.0% of span 60.0% of span (TAVG of 589.2ºF) (TAVG of 589.2ºF)(d) 43.1% of span 43.1% of span (TAVG of 574.2ºF)

(TAVG of 574.2ºF)(d)

Amendment No. 105

CPNPP/FSAR TABLE 15.6-4 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 1 (Sheet 3 of 3)

Parameter As-Analyzed Value or Operating Range or Range Target Value f) Accumulator 88ºF < TACC < 120ºF 88ºF < TACC < 120ºF temperature g) Accumulator pressure 603 psia < PACC 603 psia < PACC

< 693 psia < 693 psia h) Accumulator liquid 6119 gallon < VACC 6119 gallon < VACC volume < 6597 gallon < 6597 gallon i) Accumulator fL/D 4.3736(f) Current line configuration j) Minimum accumulator > 2300 ppm > 2300 ppm boron 3.0 Accident Boundary Conditions a) Minimum safety injection Table 15.6-12 Table 15.6-12 b) Safety injection temperature 40ºF < SI Temp 40ºF < SI Temp

< 120ºF < 120ºF c) Safety injection delay 17 seconds (with offsite < 17 seconds (with power) offsite power) 27 seconds (with < 27 seconds (with LOOP) LOOP) d) Containment modeling See Figure 15.6-14 and See Figure 15.6-14 and raw data in Tables raw data in Tables 15.6-6 and 15.6-7 15.6-6 and 15.6-7 e) Minimum containment air 13.54 psia > 13.54 psia partial pressure f) Containment spray initiation 22 seconds > 22 seconds delay g) Recirculation spray initiation Not Applicable Not Applicable delay h) Single failure Loss of one ECCS train Loss of one ECCS train Amendment No. 105

CPNPP/FSAR a) 44 peripheral locations will not physically be lead power assembly.

b) In the Westinghouse Reload Safety Analysis Checklist (RSAC) process, this parameter is identified as a key safety analysis parameter that could be impacted by a fuel reload.

c) Please note that the fuel temperature and rod internal pressure data is only provided up to 62,000 MWD/MTU. In addition, the hot assembly/hot rod will not have a burnup this high in ASTRUM analyses.

d) Plant control systems are designed to control these parameters to the stated values.

e) > TDF plus uncertainties.

f) fL/D based on average L/D of 312.4.

Amendment No. 105

CPNPP/FSAR TABLE 15.6-5 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 2 (Sheet 1 of 3)

Parameter As-Analyzed Value or Operating Range or Range Target Value 1.0 Plant Physical Description a) Dimensions Nominal N/A b) Pressurizer location On an intact loop N/A c) Hot assembly location Anywhere in core(a) N/A d) Hot assembly type(b) 17 x 17 OFA fuel 17 x 17 OFA fuel design design e) Steam generator tube < 10% 0% < SGTP < 10%

plugging level (in any one SG) f) Fuel assembly type(b) 17 x 17 OFA fuel with 17 x 17 OFA fuel with ZIRLO cladding, ZIRLO cladding, non-IFBA or IFBA non-IFBA or IFBA 2.0 Plant Initial Operating Conditions 2.1 Reactor Power a) Core power < 100.6% of 3612 MWt < 3612 MWt b) Peak heat flux hot < 2.5 < 2.5 channel factor (FQ)(b) c) Peak hot rod enthalpy < 1.60 < 1.60 rise hot channel factor (FH)(b) d) Hot assembly radial < 1.60/1.04 < 1.60/1.04 peaking factor (PHA)(b) e) Hot assembly heat flux < 2.5/1.04 < 2.5/1.04 hot channel factor (FQHA)

Parameter As-Analyzed Value or Operating Range or Range Target Value Amendment No. 105

CPNPP/FSAR TABLE 15.6-5 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 2 (Sheet 2 of 3) f) Axial power distribution Figure 15.6-27 Figure 15.6-27 (PBOT, PMID)(b) g) Low power region 02. < PLOW < 0.7 02. < PLOW < 0.7 relative power (PLOW)(b) h) Hot assembly burnup < 75,000 MWD/MTU, < 62,000 MWD/MTU, lead rod(a) lead rod(a)(c) i) MTC < 0 at hot full power < 0 at hot full power (HFP) (HFP) j) Typical cycle length 18 months 18 months k) Minimum core average > 10,000 MWD/MTU > 10,000 MWD/MTU burnup(b) l) Maximum steady state 2.0 2.0 depletion, FQ(b) 2.2 Fluid Conditions a) TAVG 574.2 - 6.5ºF < TAVG 574.2 - 589.2

< 589.2 + 6.5ºF b) Pressurizer pressure 2250 - 30 psia < PRCS 2250 psia(d)

< 2250 + 30 psia c) Loop flow TDF > 95,700 gpm/loop mmf > 99,100 gpm/

loop(e) d) Upper head design TCOLD TCOLD e) Pressurizer level 60.0% of span 60.0% of span (TAVG of 589.2ºF) (TAVG of 589.2ºF)(d) 43.1% of span 43.1% of span (TAVG of 574.2ºF)

(TAVG of 574.2ºF)(d)

Parameter As-Analyzed Value or Operating Range or Range Target Value Amendment No. 105

CPNPP/FSAR TABLE 15.6-5 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNIT 2 (Sheet 3 of 3) f) Accumulator 88ºF < TACC < 120ºF 88ºF < TACC < 120ºF temperature g) Accumulator pressure 603 psia < PACC 603 psia < PACC

< 693 psia < 693 psia h) Accumulator liquid 6119 gallon < VACC 6119 gallon < VACC volume < 6597 gallon < 6597 gallon i) Accumulator fL/D 4.3736(f) Current line configuration j) Minimum accumulator > 2300 ppm > 2300 ppm boron 3.0 Accident Boundary Conditions a) Minimum safety injection Table 15.6-12 Table 15.6-12 b) Safety injection temperature 40ºF < SI Temp 40ºF < SI Temp

< 120ºF < 120ºF c) Safety injection delay 17 seconds (with offsite < 17 seconds (with power) offsite power) 27 seconds (with < 27 seconds (with LOOP) LOOP) d) Containment modeling See Figure 15.6-28 and See Figure 15.6-28 and raw data in Tables raw data in Tables 15.6-6 and 15.6-7 15.6-6 and 15.6-7 e) Minimum containment air 13.54 psia > 13.54 psia partial pressure f) Containment spray initiation 22 seconds > 22 seconds delay g) Recirculation spray initiation Not Applicable Not Applicable delay h) Single failure Loss of one ECCS train Loss of one ECCS train a) 44 peripheral locations will not physically be lead power assembly.

Amendment No. 105

CPNPP/FSAR b) In the Westinghouse Reload Safety Analysis Checklist (RSAC) process, this parameter is identified as a key safety analysis parameter that could be impacted by a fuel reload.

c) Please note that the fuel temperature and rod internal pressure data is only provided up to 62,000 MWD/MTU. In addition, the hot assembly/hot rod will not have a burnup this high in ASTRUM analyses.

d) Plant control systems are designed to control these parameters to the stated values.

e) > TDF plus uncertainties.

f) fL/D based on average L/D of 355.2.

Amendment No. 105

CPNPP/FSAR TABLE 15.6-6 LARGE-BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE FOR COMANCHE PEAK UNITS 1 AND 2 (Sheet 1 of 2)

Structural Heat Sinks Wall Tair Area Height Tinitial (feet) (ºF) (ft2) (ft) (ºF)

1. 0.000583 paint, 40.0 29,487.0 10.0 88.0 0.041670 steel, 2.458 concrete
2. 0.000583 paint, 40.0 84,091.0 10.0 88.0 0.031330 steel, 4.467 concrete
3. 0.000583 paint, 88.0 3371.0 10.0 88.0 0.125 steel
4. 0.000583 paint, 88.0 198,763.5 10.0 88.0 4.27 concrete
5. 0.000583 paint, 88.0 1,078,360.0 10.0 88.0 0.00125 steel
6. 0.000583 paint, 88.0 93,014.86 10.0 88.0 0.02630 steel
7. 0.000583 paint, 88.0 7477.66 10.0 88.0 0.03980 steel
8. 0.000583 paint, 88.0 2520.82 10.0 88.0 0.048580 steel
9. 0.000583 paint, 88.0 753.28 10.0 88.0 0.06250 steel
10. 0.000583 paint, 88.0 2061.96 10.0 88.0 0.08330 steel
11. 0.000583 paint, 88.0 3239.25 10.0 88.0 0.15920 steel
12. 0.000583 paint, 88.0 6819.36 10.0 88.0 0.20830 steel
13. 0.000583 paint, 88.0 963.64 10.0 88.0 0.250 steel Amendment No. 104

CPNPP/FSAR TABLE 15.6-6 LARGE-BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE FOR COMANCHE PEAK UNITS 1 AND 2 (Sheet 2 of 2)

Structural Heat Sinks Wall Tair Area Height Tinitial (feet) (ºF) (ft2) (ft) (ºF)

14. 0.000583 paint, 88.0 7012.0 10.0 88.0 0.500 steel
15. 0.000583 paint, 88.0 730.0 10.0 88.0 0.750 steel
16. 0.000583 paint, 88.0 1287.0 10.0 88.0 1.500 steel
17. 0.000583 paint, 88.0 1152.1 10.0 88.0 0.710 steel
18. 0.000583 paint, 40.0 3012.0 10.0 88.0 6.500 concrete, 0.020830 steel, 12.0 concrete
19. 0.000583 paint, 40.0 8798.0 10.0 88.0 2.500 concrete, 0.020830 steel, 12.0 concrete
20. 0.000583 paint, 40.0 4086.8 10.0 88.0 0.016250 steel Amendment No. 104

CPNPP/FSAR TABLE 15.6-7 LARGE-BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE FOR COMANCHE PEAK UNITS 1 AND 2 Containment Net Free Volume 3,063,000ft3 Initial Conditions Minimum air initial containment partial pressure at full power 13.54 psia operation Minimum steam initial containment partial pressure at full power 0.66 psia operation Minimum initial containment temperature at full operation 88ºF RWST temperature 40.0ºF Temperature outside containment 40.0ºF Initial spray temperature 40.0ºF Spray System Number of containment spray pumps operating 4 Post-accident containment spray system initiation delay 22.0 sec(a)

Maximum spray system flow from all containment spray pumps 18,000 gal/min.

Fan Coolers Not Applicable Recirculation spray Not Applicable a) Assumes offsite power is available.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-8 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST-ESTIMATE LARGE BREAK LOCA (BE LBLOCA) FOR COMANCHE PEAK UNIT 1 PCT for Analysis-of-Record (AOR) 1492ºF PCT Assessments Allocated to AOR

1. Revised Heat Transfer Multiplier Distributions -6ºF Fuel Pellet Thermal conductivity Degradation and Peaking Factor Burndown +122ºF BE LBLOCA PCT for Comparison to 10 CFR 50.46 Requirements 1608ºF Amendment No. 106

CPNPP/FSAR TABLE 15.6-9 COMANCHE PEAK UNIT 1 BEST-ESTIMATE LARGE BREAK LOCA RESULTS 10 CFR 50.46 Requirement Value Criteria 95/95 PCT(a) (ºF) 1614 <2,200 95/95 LMO(b) (%) 0.23 <17 95/95 CWO(c) (%) 0.0 <1 a) Peak Cladding Temperature b) Local Maximum Oxidation c) Core-Wide Oxidation Amendment No. 105

CPNPP/FSAR TABLE 15.6-10 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST-ESTIMATE LARGE BREAK LOCA (BE LBLOCA) FOR COMANCHE PEAK UNIT 2 PCT for Analysis-of-Record (AOR) 1632ºF PCT Assessments Allocated to AOR

1. Revised Heat Transfer Multiplier Distributions -17ºF Fuel Pellet Thermal Conductivity Degradation and Peaking Factor Burndown +190ºF BE LBLOCA PCT for Comparison to 10 CFR 50.46 Requirements 1805ºF Amendment No. 106

CPNPP/FSAR TABLE 15.6-11 COMANCHE PEAK UNIT 2 BEST-ESTIMATE LARGE BREAK LOCA RESULTS 10 CFR 50.46 Requirement Value Criteria 95/95 PCT(a) (ºF) 1822 <2,200 95/95 LMO(b) (%) 0.71 <17 95/95 CWO(c) (%) 0.0 <1 a) Peak Cladding Temperature b) Local Maximum Oxidation c) Core-Wide Oxidation Amendment No. 105

CPNPP/FSAR TABLE 15.6-12 TOTAL MINIMUM INJECTED SAFETY INJECTION FLOW USED IN BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS FOR COMANCHE PEAK UNITS 1 AND 2 RCS Pressure Flow Rate (psia) (gpm) 14.7 3864.2 34.7 2538.5 54.7 1963.8 74.7 1324.2 94.7 609.4 114.7 604.7 114.8 0.0 Amendment No. 104

CPNPP/FSAR TABLE 15.6-13 INPUT PARAMETERS USED IN THE SMALL BREAK LOCA ANALYSIS Unit 1 Unit 2 100% Licensed Core Power(a) (MWt) 3612 Peak Linear Power (kW/ft) 13.897 Total Peaking Factor [FQ] 2.50 Axial Peaking Factor [FZ] 1.5625 Hot Channel Enthalpy Rise Factor [FH] 1.60 Hot Assembly Peaking Factor [PHA] 1.4245 Power Shape Figure 15.6.5-30 Fuel Type 17x17 Vantage 5 with IFMs Accumulator Water Volume (ft3) 850 Accumulator Gas Pressure, Minimum 603 (including uncertainties), (psia)

Pumped Safety Injection Flow Tables 15.6.5-11 and 15.6.5-12 Tables 15.6.5-31 and 15.6.5-32 Thermal Design Flow (gpm/loop) 95,700 Nominal Vessel Average Temperture (ºF) 574.2 - 589.2 Reactor Coolant Pressure (including 2280 uncertainties) (psia)

Steam Pressure, (psia) 1006.39 949.24 Steam Generator Tube Plugging Level (%) 10 AFW Flow (Minimum) to all 4 Steam 430 (107.5 gpm/SG

  • 4)

Generators (gpm) a) 0.6 percent is added to this power to account for calorimetirc uncertainty. Reactor coolant pump heat is not modeled in LOCA analysis.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-14 SAFETY INJECTION FLOWS FOR 2-INCH TO 6-INCH BREAK SIZES (SPILLING TO RCS PRESSURE)

(UNIT 1 AND UNIT 2)

(Sheet 1 of 2)

RCS Injected Pressure Flow Spilled Flow (psia) (lbm/s) (lbm/s) 14.7 527.37 199.93 34.7 501.77 190.22 114.7 375.32 142.33 134.7 330.65 125.43 154.7 274.99 104.37 174.7 190.59 72.51 194.7 89.88 31.43 214.7 89.88 31.84 314.7 87.24 31.27 414.7 83.89 30.06 514.7 80.43 28.81 614.7 76.81 27.49 714.7 72.89 26.09 814.7 68.79 24.60 914.7 64.45 23.04 1014.7 59.76 21.32 1114.7 54.37 19.36 1214.7 48.08 17.07 1314.7 40.89 14.45 1414.7 29.56 10.31 1514.7 23.02 7.94 Amendment No. 104

CPNPP/FSAR TABLE 15.6-14 SAFETY INJECTION FLOWS FOR 2-INCH TO 6-INCH BREAK SIZES (SPILLING TO RCS PRESSURE)

(UNIT 1 AND UNIT 2)

(Sheet 2 of 2)

RCS Injected Pressure Flow Spilled Flow (psia) (lbm/s) (lbm/s) 1614.7 21.69 7.47 1714.7 20.26 6.99 1814.7 18.79 6.48 1914.7 17.29 5.96 2014.7 15.72 5.42 2114.7 13.70 4.72 2214.7 11.28 3.88 2314.7 7.45 2.57 2414.7 0 0 Amendment No. 104

CPNPP/FSAR TABLE 15.6-15 SAFETY INJECTION FLOWS FOR 8.75-INCH BREAK SIZE (SPILLING TO CONTAINMENT PRESSURE)

(UNIT 1 AND UNIT 2)

(Sheet 1 of 2)

RCS Pressure Injected Flow Spilled Flow (psia) (lbm/s) (lbm/s) 14.7 527.63 190.65 34.7 346.45 344.63 54.7 267.12 397.75 74.7 180.32 451.99 94.7 83.82 509.29 114.7 83.17 507.64 134.7 82.49 507.78 214.7 79.81 508.30 314.7 76.37 508.98 414.7 72.80 509.64 514.7 68.97 510.28 614.7 65.01 510.94 714.7 60.83 511.60 814.7 56.43 512.28 914.7 51.70 512.97 1014.7 46.47 513.65 1114.7 40.65 514.38 1214.7 32.94 517.74 1314.7 21.01 518.82 1414.7 19.10 519.57 1514.7 17.74 519.44 Amendment No. 104

CPNPP/FSAR TABLE 15.6-15 SAFETY INJECTION FLOWS FOR 8.75-INCH BREAK SIZE (SPILLING TO CONTAINMENT PRESSURE)

(UNIT 1 AND UNIT 2)

(Sheet 2 of 2)

RCS Pressure Injected Flow Spilled Flow (psia) (lbm/s) (lbm/s) 1614.7 16.34 519.73 1714.7 14.72 520.02 1814.7 12.89 520.28 1914.7 10.95 520.57 2014.7 8.54 522.85 2114.7 5.89 523.24 2214.7 2.35 523.64 2314.7 0 524.00 2414.7 0 524.00 Amendment No. 104

CPNPP/FSAR TABLE 15.6-16 NOTRUMP TRANSIENT RESULTS (UNIT 1)

Event (sec) 2-inch(a) 3-inch 4-inch 6-inch 8.75-inch(a)

Break Initiated 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 95.94 20.92 12.17 7.56 6.28 Safety Injection Signal 105.75 30.60 21.25 14.56 8.61 Safety Injection Begins(b) 127.25 52.60 43.25 36.56 30.61 Loop Seal Clearing Occurs(c) 1370 ~535 ~315 70, 135 ~22 Core Uncovery N/A ~955 ~715 ~440 ~22 Accumulator Injection Begins N/A N/A(d) ~970 ~405 ~200 Core Recovery N/A ~3000 ~1520 ~485 N/A RWST Low Level(e) 1608.5 1600.19 1586.95 1574.98 1474.99 a) There is no core uncovery for the 2-inch and 8.75-inch cases, and only minimal core uncovery for the 6-inch case.

b) Safety injection begins 22.0 seconds (SI delay time) after the safety injection signal is reached.

c) Loop seal clearing is considered to occur when the broken loop seal vapor flow rate is sustained above 1 lbm/s.

d) Accumulator actually injects at 3485 seconds for Unit 1, but this is after the core has recovered and has no bearing on the LOCA recovery.

e) The analysis assumes minimum usable RWST volume (440,300 gal) before the low-1 RWST water level signal for switchover to cold leg recirculation is reached.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-17 SBLOCTA BOL RESULTS (UNIT 1)

Result 2-inch(a) 3-inch 4-inch 6-inch(a) 8.75-inch(a)

PCT, oF 950 1013 PCT Time, sec 2026 1058 PCT Elevation, ft 10.75 11.00 HR Burst Time(b), sec N/A N/A N/A N/A N/A (b)

HR Burst Elevation , ft N/A N/A Max. Local Transient ZrO2, % 0.02 0.01 Max. Local ZrO2 Elevation, ft 10.75 11.00 Average ZrO2, % 0.00 0.00 a) The core either does not uncover or only uncovers for a very short time and therefore does not warrant SBLOCTA calculations for these break sizes.

b) None of the hot rods nor the hot assembly rods burst during the SBLOCTA calculations.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-18 NOTRUMP TRANSIENT RESULTS (UNIT 2)

Event (sec) 2-inch(a) 3-inch 4-inch 6-inch 8.75-inch(a)

Break Initiated 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 101.81 35.60 12.52 7.79 6.19 Safety Injection Signal 111.82 44.53 21.99 14.81 8.58 Safety Injection Begins(b) 133.82 66.53 43.99 36.81 30.58 Loop Seal Clearing 40, 60, Occurs(c) 1140 510 255 135 ~17 Core Uncovery N/A ~670 ~575 ~420 N/A Accumulator Injection Begins N/A N/A(d) ~850 ~380 ~170 Core Recovery N/A ~2800 ~1630 ~470 N/A RWST Low Level(e) 1609.1 1599.1 1585.37 1574.83 1474.55 a) There is no core uncovery for the 2-inch and 8.75-inch cases, and only minimal core uncovery for the 6-inch case.

b) Safety injection begins 22.0 seconds (SI delay time) after the safety injection signal is reached.

c) Loop seal clearing is considered to occur when the broken loop loop seal vapor flow rate is sustained above 1 lbm/s.

d) Accumulator actually injects at ~3330 seconds for Unit 2, but this is after the core has recovered and has no bearing on the LOCA recovery.

e) The analysis assumes minimum usable RWST volume (440,300 gal) before the low-1 RWST water level signal for switchover to cold leg recirculation is reached.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-19 SBLOCTA BOL RESULTS (UNIT 2)

Result 2-inch(a) 3-inch 4-inch 6-inch(a) 8.75-inch(a)

PCT, oF 1069 1210 PCT Time, sec 1788 920 PCT Elevation, ft 11.00 11.00 HR Burst Time(b), sec N/A N/A N/A N/A N/A (b)

HR Burst Elevation , ft N/A N/A Max. Local Transient ZrO2, % 0.04 0.06 Max. Local ZrO2 Elevation, ft 11.00 11.00 Average ZrO2, % 0.01 0.01 a) The core either does not uncover or only uncovers for a very short time and therefore does not warrant SBLOCTA calculations for these break sizes.

b) None of the hot rods nor the hot assembly rods burst during the SBLOCTA calculations.

Amendment No. 104

CPNPP/FSAR TABLE 15.6-20 PARAMETERS FOR POSTULATED LOCA ANALYSIS(a)

(Sheet 1 of 2)

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level (MWt) 3684
b. Plateout of iodine activity released 50%

to containment

c. Activity released to containment and available for release to environment Noble gases 100% of core inventory Iodines 25% of core inventory
d. Iodine fractions (organic, Regulatory Guide 1.195 elemental, and particulate)
2. Data and assumptions used to estimate activity released
a. Containment volume Directly sprayed volumes 1.706 x 106 ft3 Unsprayed volumes affected by 1.325 x 106 ft3 spray Total free volume 3.031 x 106 ft3
b. Mixing rate between sprayed and 2 turnovers per hour unsprayed volumes
c. Spray removal coefficient Elemental iodine 10 hr-1 Organic iodines 0 hr-1 11.4 hr-1 for DF less than or equal to 50 Particulate iodine 1.14 hr-1 for DF greater than 50
d. Effective decontamination factor 100 of spray for elemental iodine
e. Containment leak rate 0.1% containment volume per day, (0t24 hrs) 0.05% of containment volume per day, (t > 24 hrs)

Amendment No. 104

CPNPP/FSAR TABLE 15.6-20 PARAMETERS FOR POSTULATED LOCA ANALYSIS(a)

(Sheet 2 of 2)

f. Duration of removal effectiveness Elemental iodine 2.518 hr (DF of 100 attained)

Particulate iodine 2.03 hr (DF of 50 attained) 4.0 hr sprays assumed to be terminated

3. Dispersion data
a. Exclusion area boundary and 2080 m and 4 miles LPZ distances
b. x/Qs (for time intervals of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, @ EAB, onsite 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 4 days, 5 percentile data 30 days) 1.6 x 10-4 sec/m3 (0-2 hrs)

@LPZ, onsite 5 percentile data 2.4e-05 sec/m3 (0-8 hrs) 1.6e-05 sec/m3 (8-24 hrs) 6.2e-06 sec/m3 (1-4 days) 1.7e-06 sec/m3 (4-30 days)

4. Dose due to containment and ESF equipment leakage and the containment pressure relief line.
a. Method of dose calculation See Appendix 15B
b. Dose conversion assumptions See Appendix 15B
c. Doses @EAB, (0-2 hrs) thyroid = 59.0 rem whole body gamma = 0.7 rem

@LPZ (0-30 days) thyroid = 44.0 rem whole body gamma = 0.25 rem a) Per Regulatory Guide 1.195 Amendment No. 104

CPNPP/FSAR TABLE 15.6-21 ACTIVITY AVAILABLE FOR RELEASE VIA ESF COMPONENTS AT T=O FOLLOWING LOCA ISOTOPE ACTIVITY IN CURIES I-131 5.1 X 107 I-132 7.35 x 107 I-133 1.03 x 108 I-134 1.15 x 108 I-135 9.80 x 107 Amendment No. 104

CPNPP/FSAR TABLE 15.6-22 ATMOSPHERIC DILUTION FACTORS IN CONTROL ROOM DOSE ANALYSIS A. Containment Leakage(a)

Corresponding Representative Representative Representative Control Room Overall Wind Speed Wind Speed Wind Speed Wind Direction Occupancy Reduction Period Percentile (m/sec) Factor Factor, F=0.352 Factor Factor X/Q (sec/m3) 0-8 Hours 5 0.75 1 1 1 1 3.04 x 10-3 8-24 Hours 10 1.05 0.71 0.84 1 0.60 1.82 x 10-3 1-4 Days 20 1.49 0.50 0.68 0.6 0.20 6.08 x 10-4 4-30 Days 40 2.25 0.33 0.352 0.4 0.046 1.40 x 10-4 B. ESF Equipment Leakage Outside Containment(b)

Corresponding Representative Representative Representative Control Room Overall Wind Speed Wind Speed Wind Speed Wind Direction Occupancy Reduction Period Percentile (m/sec) Factor Factor, F=0.401 Factor Factor X/Q (sec/m3) 0-8 Hours 5 0.83 1 1 1 1 2.96 x 10-3 8-24 Hours 10 1.12 0.74 0.85 1 0.63 1.86 x 10-3 1-4 Days 20 1.56 0.53 0.70 0.6 0.22 6.51 x 10-4 4-30 Days 40 2.32 0.36 0.401 0.4 0.06 1.78 x 10-4 a) S, SSW, SW, WSW, W, WNW and NW are considered to be affected sectors.

b) SW, WSW, W, WNW, NW and NNW are considered to be affected sectors.

Amendment No. 104

CPNPP/FSAR 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT 15.7.1 RADIOACTIVE GAS WASTE SYSTEM LEAK OR FAILURE 15.7.1.1 Identification of Causes and Accident Description The Gaseous Waste Processing System (GWPS), as discussed in Chapter 11, is designed to remove fission product gases from the reactor coolant. The system consists of a closed loop with waste gas compressors, hydrogen recombiners, waste gas decay tanks for service at power and other waste gas decay tanks for service at shutdown and startup.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste decay tank as a consequence of a failure of a single gas decay tank or associated piping.

Nonvolatile fission product concentrations are greatly reduced as the coolant is passed through the purification demineralizers. An iodine removal factor of 10 is expected in the mixed bed demineralizers, and an iodine partition factor of 100 is expected between the liquid and vapor phases in the volume control tank. Based on the above analysis and operating experience at Yankee-Rowe and Saxton, activity stored in a gas decay tank consists of the noble gases released from the processed coolant and only negligible quantities of less volatile isotopes.

15.7.1.2 Analysis of Effects and Consequences The maximum activity in a single gas decay tank, the assumptions on which the activity is based, and the radiological consequences resulting from the release of this activity are discussed in Section 15.7.1.3.

15.7.1.3 Environmental Consequences With the exception of the gas decay tank inventory assumption, the assumptions and equations delineated in Regulatory Guide 1.24 and summarized in Table 15.7-1 are used to evaluate the radiological consequences resulting from the postulated tank rupture. The noble gas inventory in the tank at the time of the rupture is assumed to be the activity in a single waste gas decay tank immediately after it has been isolated from the GWPS (see Table 15.7-2).

The GWPS is designed with sufficient tank capacity to store radioactive gases generated by the plant to allow for holdup of the gases.

The system is also designed to operate so that release of the maximum activity in any one gas decay tank, from a rupture of the tank, will not result in offsite doses that exceed the values set forth in 10CFRl00. The system is equipped with a radiation monitor which is installed so that it indicates the concentration level in the tank on stream. The monitor alarms at the waste panel when the concentration level in the on stream tank reaches a predetermined level. Initiation of the alarm on the waste panel also initiates a general alarm in the Control Room. The gaseous activity in the tanks then decays while the other tanks in the system are being filled with gaseous radioactivity. The maximum activity that can be released as a result of a gas decay tank rupture is the activity stored in one gas decay tank immediately after it has been isolated from the GWPS.

15.7-1 Amendment No. 104

CPNPP/FSAR The entire content of a single waste gas decay tank inventory of 200,000 Ci of noble gases (considered as dose equivalent Xe-133) is assumed to be released to the Auxiliary Building, and all of the noble gases are assumed to leak from the building at ground level over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period.

Based on this model and an onsite 0 to 2 hr atmospheric dilution factor (1.6x10-4 sec/m3), the whole body dose at the nearest point on the exclusion area boundary (EAB) is conservatively calculated to be 0.19 rem. This dose is substantially below the 25 rem whole body value set forth in 10CFR100; it may be concluded that such an incident would not interrupt or restrict public use of areas beyond the EAB.

15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE 15.7.2.1 Identification of Causes and Accident Description The accident is defined as the uncontrolled atmospheric release from the 30,000 gallon floor drain tank due to the postulated rupture of the tank. This tank is the highest potential atmospheric release source term because of its large volume and the fact that it is assumed to be 80 percent full of reactor coolant.

15.7.2.2 Analysis of Effects and Consequences The activity in the 30,000 gallon floor drain tank, the assumptions on which the activity is based, and the radiological consequences resulting from the release of the activity are discussed in Section 15.7.2.3.

15.7.2.3 Environmental Consequences This analysis assumes that the plant has been operating with 1 percent failed fuel for an extended period sufficient to achieve equilibrium radioactive concentrations. Floor drain tank III is assumed to contain the inventory as indicated in Table 15.7-3. The entire contents of the tank are assumed to be released to the atmosphere at ground level over a 2 hr period. Other conservative assumptions are detailed in Table 15.7-4.

Based on the foregoing model, the thyroid and whole body doses at the EAB are conservatively calculated to be 2.1 rem and 3.8E-03 rem, respectively. The doses from this accident are substantially below the values set forth in 10CFR100.

15.7.3 POSTULATED RADIOACTIVE RELEASES DUE TO LIQUID TANK FAILURES The analysis is presented in Section 2.4.12 and 2.4.13.3.

15.7.4 DESIGN BASIS FUEL HANDLING ACCIDENTS 15.7.4.1 Identification of Causes and Accident Description The accident is defined as dropping of a spent fuel assembly in the Containment Building or spent fuel pool fuel storage area floor resulting in the rupture of the cladding of all the fuel rods in the assembly despite many administrative controls and physical limitations imposed on fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures under the direct surveillance of a supervisor.

15.7-2 Amendment No. 104

CPNPP/FSAR 15.7.4.2 Analysis of Effects and Consequences Method of Analysis The method of analysis used for evaluating the potential radiological consequences of a fuel handling accident is in compliance with Regulatory Guide 1.195. A two hour, ground level release is assumed for the analysis.

The following assumptions are postulated in the calculation of the radiological consequences of a fuel handling accident:

1. The accident occurs at 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> following the reactor shutdown, the minimum time at which spent fuel could be first moved into the fuel storage area.
2. The accident results in the rupture of the cladding of all fuel rods in a single assembly.
3. The damaged assembly is, coincidentally, the one operating at the highest power level in the core region to be discharged.
4. The power in this assembly establishes the total fission product inventory which is present in the fuel at the time of reactor shutdown.
5. The fuel pellet-cladding gap inventory of fission products is released to the refueling cavity or spent fuel pool at the time of the accident.
6. The refueling cavity or spent fuel pool retains a large fraction of the gap activity of halogens by virtue of their solubility and hydrolysis. Noble gases are not retained by the water as they are not subject to hydrolysis reactions.

Fission Product Inventories The actual fission product gap inventory in the fuel assembly is dependent on the linear heat generation rate of the assembly and the temperature of the fuel. However, the gap inventories assumed in fuel handling accident analyses were based on the conservative guidance contained in Regulatory Guide 1.195. Table 15.7-6 lists the fission product activities released from the damaged fuel rods at the time of the fuel handling accident. These activities are consistent with the assumptions used in analyzing the environmental consequences of postulated fuel handling accidents detailed in Section 15.7.4.3.

Iodine Decontamination Factors An experimental test program [1] was conducted to evaluate the extent of removal of iodine released from a damaged irradiated fuel assembly. Iodine removal from the released gas takes place as the gas rises through the body of solution in the fuel storage area to the pool surface.

The extent of iodine removal is determined by mass transfer from the gas phase to the surrounding liquid and is controlled by the bubble diameter and the contact time of the bubble in the solution.

In order to obtain all the necessary information regarding this mass transfer process, a number of small scale tests were conducted, using trace iodine and carbon dioxide in an inert carrier gas.

15.7-3 Amendment No. 104

CPNPP/FSAR Iodine testing was performed at the design basis solution conditions (temperature and chemistry) and data were collected for various bubble diameters and solution depths. This work resulted in the formulation of a mathematical expression for the iodine decontamination factor in terms of bubble size and bubble rise time.

Similar tests were conducted with carbon dioxide in an inert carrier, except that the solution temperature and chemistry were patterned after that of a deep pool where large scale tests were also performed with carbon dioxide. The small scale carbon dioxide tests also resulted in a mathematical expression for the decontamination factor in terms of bubble size and bubble rise time through the solution.

To complete the experimental program, a full size fuel assembly simulator was fabricated and placed in a deep pool for testing, where the gas released would be typical of that from the postulated damaged assembly. Tests were conducted with trace carbon dioxide in an inert carrier gas and overall decontamination factors were measured as a function of the total gas volume released. These measurements, combined with the analytical expression derived from small scale tests with carbon dioxide, permitted an in-situ measurement of both the effective bubble diameter and rise time, both as a function of the volume of gas released. Having measured the characteristics of large scale gas releases, the decontamination factor for iodine was obtained, using the analytical expression from small scale iodine testing.

Decontamination Factor = 7.3 e0.313 t/d where t = rise time (sec) d = effective bubble diameter (cm)

The overall test results clearly indicate that iodine will be readily removed from the gas rising through the fuel storage area solution and that the efficiency of removal will depend on the volume of gas released instantaneously from the fuel void space.

With the consideration given to the total quantity of gas released from a fuel assembly, a pool decontamination factor for elemental iodine is at least 580 for the 23 foot water depth over the damage fuel, assuming a fuel rod internal pressure of less than 1200 psig. Based on the assumption that the iodine release from the fuel is 99.75% elemental and 0.25% organic (which is not subject to retention in the water), the overall decontamination factor is 237.

However, fuel rod pressure may be greater than 1200 psig (but would not exceed 1500 psig) and there is the potential that the water depth over the damage fuel could be as low as 21 feet. Using the models and data from WCAP-7828, and considering the reduced pool depth and increased rod internal pressure, the elemental iodine decontamination factor is calculated to be 403. While WCAP-7828 supports an elemental iodine decontamination factor of 580 at a pool depth of 23 feet and with a rod internal pressure of 1200 psig, RG 1.195 specifies an elemental decontamination factor of 400. To apply a comparable level of conservatism, the calculated decontamination factor of 403 is reduced by the ratio of value in RG 1.195 and the value supported by WCAP-7828 (580). This produces an elemental iodine decontamination factor of 278 which is then conservatively decreased to 270. The elemental decontamination factor of 270 15.7-4 Amendment No. 104

CPNPP/FSAR is then used to compute the overall pool decontamination factor based on the RG 1.195 iodine characterization as 99.75% elemental and 0,25% organic. This yields an overall pool decontamination factor of 160 for iodine.

15.7.4.3 Environmental Consequences 15.7.4.3.1 Postulated Fuel Handling Accident Outside Containment The analysis of a postulated fuel handling accident is performed as follows:

1. The accident is assumed to occur 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> after plant shutdown.
2. All of the rods in one fuel assembly are ruptured.
3. The damaged assembly is the highest powered assembly in the core region to be discharged. The values for individual fission product inventories in the damaged assembly are calculated assuming full power operation at the end of core life and a 50 hour5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> shutdown. A radial peaking factor of 1.65 is used.
4. The minimum water depth between the top of the damaged fuel rods and the spent fuel pool surface is 21 ft.
5. All of the gap activity in the rods of the damaged assembly is released to the spent fuel pool. It is assumed that 10% of the fuel in the damaged assembly has an average burnup greater than 54 GWD/MTU and average rod power in excess of 6.3 kW/ft. The gap activity in the 10% of the assembly that exceeds the above limits is 30% for krypton-85, 12% for iodine-131, and 10% for the remaining iodines and noble gases. The gap activity for the remaining 90% of the assembly is 10% for krypton-85, 8% for iodine-131, and 5%

for the remaining iodines and noble gases. The gap activities released as a result of this accident are presented in Table 15.7-6.

6. All activity released from the spent fuel pool is released at ground level to the environment over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period.
7. The iodine gap inventory is composed of inorganic species (99.75 percent) and organic species (0.25 percent).
8. The overall decontamination factor for the spent fuel pool is 160.
9. No credit is taken for iodine filtration by the primary plant ventilation system.
10. Atmospheric diffusion conditions are assumed to be the 0 to 2 hr ground level case.

The parameters used for this analysis are listed in Table 15.7-7.

Based on the foregoing assumptions, the thyroid and whole body doses at the EAB are conservatively calculated to be 26.0 rem and 0.14 rem, respectively. The corresponding doses at the LPZ are conservatively calculated to be 3.9 rem and 0.021 rem. The calculated doses are within the values set forth in 10CFR100.

15.7-5 Amendment No. 104

CPNPP/FSAR 15.7.4.3.2 Postulated Fuel Handling Accident Inside Containment An analysis of the radiological consequences of a fuel handling accident inside the Containment Building would use the same assumptions and yield the same results as those of a fuel handling accident outside the Containment Building. The accident described in the preceding section is considered to represent the limiting case; therefore, no specific analysis of such an accident inside the Containment is provided.

15.7.4.4 Conclusions The possibility of a fuel handling accident is relatively small due to the many physical, administrative, and safety restrictions imposed on fuel handling operations. However, based on conservative design basis parameters, the calculated doses from a postulated fuel handling accident are well within the values set forth in 10CFR100.

15.7.5 SPENT FUEL CASK DROP ACCIDENTS The Comanche Peak Nuclear Power Plant Fuel Handling Building overhead crane satisfies NUREG-0554 single-failure-proof requirements and is designed to the requirements of seismic Category I (See Section 3.2). As such it can retain the maximum design load during a Safe Shutdown Earthquake and remain in place under all postulated seismic loadings. The crane is also provided with interlocks which prevent a fuel cask from being lifted more than 29.25 ft above floor elevation or from passing over the new fuel storage area during the spent fuel cask mode of operation (see Section 9.1.2.2). The crane does not pass over the spent fuel pool in any mode of operation. Based on this design approach, the radiological consequences of a spent fuel cask drop accident need not be evaluated.

REFERENCES

1. Bell, M. J., Duhn, E. R., Locante, J. and Malinowski, D. D., Radiological Consequences of a Fuel Handling Accident, WCAP- 7518-L (Proprietary) and WCAP-7828 (Non-Proprietary), June 1970.
2. Radiation Analysis Manual, Standard Plant Model 412, Rev. 3, Westinghouse Electric Corporation, November 1978.
3. Killough, G. G., Begovich, C. L., Sjoreen, A. L. and Bell, L. W., A Guide for the TACT III Computer Code, NUREG/CR-3287, Oak Ridge National Laboratory, May 1983.

15.7-6 Amendment No. 104

CPNPP/FSAR TABLE 15.7-1 PARAMETERS FOR POSTULATED WASTE GAS DECAY TANK RUPTURE ACCIDENT

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level (MWt) 3684
b. Percent of fuel defected (%) 1
c. Release of activity by nuclide Table 15.7-2 Values increased to equal 200,000 Ci of dose equivalent Xe-133
2. All pertinent data and assumptions used to estimate activity released
a. The maximum content of the decay tank is considered for computing noble gas inventory
b. Radiological decay is considered for minimum time required to transfer the gases from the primary system to the decay tank
c. Entire content of one tank is assumed to be released to the building due to failure
d. All of the noble gas is assumed to be released to the atmosphere over a 2 hr period
3. Dispersion data
a. Exclusion area boundary (EAB) and 2080 m and 4 miles low population zone (LPZ) distances
b. X/Q 1.6 x 10-4 sec/m3 (0 - 2 hr)
4. Dose data
a. Method of dose calculations Appendix 15B
b. Doses dose = 0.19

@EAB, whole body rem (gamma dose)

Amendment No. 104

CPNPP/FSAR TABLE 15.7-2 GAS DECAY TANK INVENTORY FOR ACCIDENT ANALYSIS (ONE GAS DECAY TANK)

Tank Activity (Ci) Based On Tank Activity Corresponding Isotope Assumptions Below to 200,000 Ci DEQ Xe-133 Kr-85 5.44E + 04 3.28E + 02 Kr-85m 1.66e + 02 1.07E + 05 Kr-87 3.30E +01 6.5E + 01 Kr-88 1.96E + 02 3.87E + 02 Xe-131m 9.12E + 02 1.80E + 03 Xe-133 7.39E + 04 2.19E + 03 Xe-133m 1.11E + 03 1.46E + 05 Xe-135 1.02E + 03 2.01E + 03 Assumptions:

1. 3684 MWT
2. 40 Year continuous operation at 1 percent fuel defects
3. 100 percent stripping efficiency
4. Volume control tank purge rate of 0.7 standard cubic feet per minute (scfm)
5. Tanks switched at regular intervals
6. 8 gas decay tanks shared between two units Amendment No. 104

CPNPP/FSAR TABLE 15.7-3 MAXIMUM RADIOACTIVITY IN A FLOOR DRAIN TANK FOR ACCIDENT ANALYSIS Floor Drain Tank Activity Used To Determine The offsite And Control Room Dose Isotope Consequences (Ci)

I-131 2.60E + 02 I-132 2.78E + 02 I-133 4.18E + 02 I-134 6.05E + 01 I-135 2.30E + 02 Assumptions:

a. 3565 MWt
b. Based on 1 percent failed fuel
c. Floor drain tank of 30,000 gal capacity assumed 80 percent full of reactor coolant Amendment No. 104

CPNPP/FSAR TABLE 15.7-4 PARAMETERS FOR POSTULATED RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE

1. Data and assumptions used to estimate radioactive source from postulated accident
a. Power level (MWt) 3684
b. Percent of fuel defected (%) 1
c. Release of activity by nuclide Table 15.7-3
2. Data and assumptions used to estimate activity release
a. Entire content of tank is assumed to be released to the building due to failure
b. Activity release to the atmosphere takes place over a two hour period at ground level.
c. Iodine Partition factor is 0.1
3. Dispersion data
a. EAB distance 2080 m
b. X/Q 1.6 x 10-4 sec/m3 (0-2 hr)
4. Dose data
a. Method of dose calculations See Appendix 15B
b. Doses @EAB thyroid dose = 2.1 rem whole body dose = 0.0038 rem (gamma dose)

Amendment No. 104

CPNPP/FSAR TABLE 15.7-5 DELETED Amendment No. 104

CPNPP/FSAR TABLE 15.7-6 NOBLE GAS AND IODINE ACTIVITIES RELEASED FROM DAMAGED FUEL RODS AS A RESULT OF A FUEL HANDLING ACCIDENT(a)

Nuclide Curies Released Kr-83m 1.32E - 2 Kr-85m 5.08E + 0 Kr-88 1.50E - 1 Kr-85 116E + 3 Kr-85m 9.62e-02 Kr-88 3.05e-04 Xe-131m 5.08E + 2 Xe-133m 2.18E + 3 Xe-133 8.51E + 4 Xe-135m 7.71E + 1 Xe-135 4.52E + 3 I-131 6.25E + 4 I-132 4.45E + 4 I-133 1.88E + 4 I-135 4.75E + 2 a) Based on the following assumptions:

1. The total gap inventory of one fuel assembly in the discharge region is released to the spent fuel pool.
2. A radial peaking factor of 1.65 is applied.
3. The accident occurs 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> after shutdown.
4. Gap activities are 10% of the damaged assembly are 30% for Kr-85, 12% for I-131, and 10% for all other iodines and noble gases. The gap activities for the remaining 90% of the damaged assembly are 10% for Kr-85, 8% for I-131, and 5% for all other iodines and noble gases.

Amendment No. 104

CPNPP/FSAR TABLE 15.7-7 PARAMETERS FOR POSTULATED FUEL HANDLING ACCIDENT ANALYSIS

1. Data and assumptions used to estimate radioactive source from postulated accidents
a. Power level (MWt) 3684
b. Release of activity Regulatory Guide 1.195
c. Damage to fuel assembly All rods ruptured
d. Iodine fractions (inorganic and Regulatory Guide 1.195 organic)
2. Data and assumptions used to estimate activity released
a. Spent fuel pool decontamination factor 160
b. All other pertinent data and Regulatory Guide 1.195 assumptions
3. Dispersion data
a. EAB and LPZ distances 2080 m and 4 miles
b. X/Q @ EAB 1.6 x 10-4 sec/m3 (0 - 2 hr)

@ LPZ 2.4 x 10-5 sec/m3 (0 - 8 hr)

4. Dose data
a. Method of dose calculation See Appendix 15B
b. Dose conversion assumptions See Appendix 15B
c. Doses @EAB, thyroid dose = 26.0 rem, whole body dose = 0.14 rem (gamma dose)

@ LPZ thyroid dose = 3.9 rem, whole body dose = 0.021 rem (gamma dose)

Amendment No. 104

CPNPP/FSAR 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM A discussion of Anticipated Transients Without Scram (ATWS) is presented in Reference [1].

The information provided in Reference [1] is applicable to the Comanche Peak Nuclear Power Plant.

ATWS procedures, based on procedures generated by the Westinghouse Owners Group, were reviewed and incorporated into the CPNPP Emergency Operating Procedures prior to fuel load.

The worst common mode failure which is postulated to occur is the failure to trip the reactor after an anticipated transient has occurred. A series of generic studies [1,2] on ATWS showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner. The effects of ATWS events are not considered as part of the design basis for transients analyzed in Chapter 15. The final NRC ATWS rule [3] required that Westinghouse designed plants install an ATWS Mitigation System Actuation Circuitry (AMSAC) to initiate a turbine trip and actuate auxiliary feedwater flow independent of the Reactor Protection System. The CPNPP AMSAC design is described in Section 7.8.

REFERENCES

1. Westinghouse Anticipated Transients Without Trip Analysis, WCAP-8330, August 1974.
2. Anderson, T. M., ATWS Submittal, Westinghouse letter NS-TMA-2182 to S. H. Hanaver of the NRC, December 1979.
3. ATWS Final Rule - Code of Federal Regulations, 10 CFR 50.62 and Supplementary Information Package, Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light- Water-Cooled Nuclear Power Plants.

15.8-1 Amendment No. 104

CPNPP/FSAR APPENDIX 15A DELETED 15A-1 Amendment No. 104

CPNPP/FSAR 15B DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15B.1 INTRODUCTION This section identifies the models used to calculate offsite radiological doses that would result from releases of radioactivity due to various postulated accidents. The postulated accidents are:

1. Steam Line Break
2. Rod Ejection Accident
3. Steam Generator Tube Failure
4. Loss-of-Coolant Accident
5. Radioactive Gas Waste System Leak or Failure
6. Radioactive Liquid Waste System Leak or Failure
7. Design Basis Fuel Handling Accident
8. Primary Coolant Small Line Break Outside Containment
9. Locked Reactor Coolant Pump Rotor 15B.2 ASSUMPTIONS The following assumptions are basic to the model for the gamma and beta dose due to immersion in a cloud of radioactivity and the model for the thyroid dose due to inhalation of radioactivity.
1. The dose contribution of direct radiation from sources other than the leakage cloud is negligible compared to the dose due to immersion in the leakage cloud.
2. All radioactivity releases are treated as ground level releases regardless of the point of discharge.
3. The dose receptor is a standard man as defined by the International Commission on Radiological Protection (ICRP)[1].
4. Radioactive decay from the point of release to the dose receptor is neglected.
5. Isotopic whole body and beta skin dose conversion factors are taken from references [13]

and [14] respectivily.

6. Atmospheric dispersion factors used in the analyses are presented in Section 2.3.

15B-1 Amendment No. 104

CPNPP/FSAR 15B.3 GAMMA DOSE The gamma dose is obtained by considering the dose receptor to be immersed in a radioactive cloud which is infinite in all directions above the ground plane, i.e., a semi-infinite cloud. The concentration of radioactive material within this cloud is taken to be uniform and equal to the maximum centerline ground level concentration that would exist in the cloud at the appropriate distance from the point of release.

The whole body dose is a result of exposure to external gamma radiation. The whole body dose due to immersion in a semi-infinite cloud is given by:

D = K X Q Ai Ri DCFi (15B-1) where:

D is the whole body gamma dose from immersion in a semi-infinite cloud for a given time period, rem.

AR is the activity of isotope i released during a given time period, curies i

X/Q is the atmospheric dilution factor for a given time period, sec/m3 K is the conversion factor 3.7E12 rem-Bq/Ci-Sv DCF i is the whole body gamma dose conversion factor for isotope I, Sv-m3/Bq-sec 15B.4 THYROID INHALATION DOSE The thyroid inhalation dose is obtained from the following expression:

D THY = K Q B (15B-2)

Q1* ( DCF )i i

15B-2 Amendment No. 104

CPNPP/FSAR where:

DTHY = thyroid inhalation dose, rem X/Q = atmospheric dilution factor for a given time period, sec/m3 B = breathing rate for a given time period t, m3/sec Qi = total activity of iodine isotope i released in time period t, curies (DCF)i = dose conversion factor for iodine isotope i, Sv/Bq inhaled K is the conversion factor 3.7E12 rem-Bq/Ci-Sv The thyroid inhalation dose conversion factors and offsite breathing rates used in the above model are given in Table 15B-1.

15B.5 CONTROL ROOM DOSE The thyroid inhalation, whole body gamma, and beta skin dose models for the major contributors to the Control Room dose are described below. The dose to the Control Room occupants due to a postulated accident is calculated on the basis of source strength, atmospheric transport, dosimetry and Control Room emergency pressurization and filtration considerations as illustrated in the following equations.

The thyroid inhalation dose is obtained from the following expression:

Tj DTHY = K BR DCFi ³ A j ( t ) dt (15B-3) i j Tj - 1 where:

i = isotope index j = time interval index BR = breathing rate, m3/sec DCFi = dose conversion factor for iodine isotope i, Sv/Bq inhaled Ai(t) = airborne concentration of iodine isotope i at time t (sec), in the Control Room, curies/m3 K = is the conversion factor 3.7E12 rem-Bq/Ci-Sv The thyroid inhalation dose conversion factors and Control Room breathing rate used in the above model are presented in Table 15B-1.

15B-3 Amendment No. 104

CPNPP/FSAR The whole body gamma dose due to inleakage is calculated using the following equation:

D R = K 1 GF A1* ( DCF )1* (15B-4) i where:

DR = Whole body gamma dose, rem Ai = time integrated concentration of nuclide i, Ci-sec/m3 K = the conversion factor 3.7E12 rem-Bq/Ci-Sv GF = Geometry Factor to adjust the dose to reflect the finite cloud in the control room

( DCF ) * = the whole body gamma dose conversion factor for 1

isotope i, Sv-m3/Bq-sec 0.338 (15B-5)

GF = 1173 V V = control room volume, ft3 The whole body gamma dose conversion factors are presented in Table 15B-1 The beta skin dose due to inleakage is calculated using the following equation:

DB = K A1* ( DCF )Bi (15B-6) i where:

DB = beta skin dose from immersion in a semi-infinite cloud, rem Ai = time integrated concentration of nuclide i, Ci-sec/m3 K = the conversion factor 3.7E12 rem-Bq/Ci-Sv DCFBi = the beta skin dose conversion factor for isotope i, Sv-m3/Bq-sec The beta skin dose conversion factors are presented in Table 15.B-1.

15B-4 Amendment No. 104

CPNPP/FSAR The whole body gamma dose to Control Room personnel due to a cloud external to the Control Room is calculated using the following equation:

§

  • D c = ¨ X Q j A ij CF¸ (15B-7) j © j ¹ where:

Dc = whole body gamma dose due to external cloud shine, rem X/Qj = atmospheric dispersion factor for the time period j, calculated at the Control Room air intake assuming a ground level release, sec/m3 Aij = total activity of nuclide i released during time period j, Ci CFi = a dose rate response function for a unit concentration of nuclide i, rem-m2/Ci-sec.

15B.6 COMPUTER CODES USED IN ACCIDENT ANALYSIS The computer programs described below may have been used to calculate design-basis source terms and radiological consequences of design basis accidents.

1. RADIOISOTOPE [6]

Program RADIOISOTOPE calculates the activity of isotopes in a closed system by solving the appropriate simultaneous radioactive decay equations. Based on the activity of any isotope in the system at an initial time, the program calculates the activity of that isotope and its offspring at any later time, provided that the decay scheme is contained in the program library. Furthermore, because gamma activity is important for dose rate and shielding calculations. RADIOISOTOPE also calculates the energy releases in seven gamma energy groups from the decay of an inventory of radionuclides.

2. DRAGON [7]

Program DRAGON evaluates the activities, dose rates, and time-integrated dose in the reactor building and control room of a nuclear facility or at an adjacent site following release of halogens and noble gases from some control volume. The fission product release to the atmosphere, together with the activities and time-integrated activity concentrations of the halogens which are accumulated in the system, are also computed.

Site dose calculations performed by DRAGON employ the semi-infinite cloud models suggested by Regulatory Guide 1.4. The gamma dose in the control room is computed based upon a finite cloud model. Average beta and gamma energies are used in all dose calculations.

3. QADMOD [8]

15B-5 Amendment No. 104

CPNPP/FSAR Program QADMOD calculates dose rates at specified detector locations for a number of different source points representing volumetric sources. The calculational technique employed by this program is commonly referred to as the point kernel technique.

QADMOD is a modified version of the QAD P-5 program written at Los Alamos Scientific Laboratory by R.E. Malenfant. This modification includes a) the FASTER geometry routines, b) a single point source option, c) a translated cylindrical source volume option, and d) an internal data library which contains flux-to-dose rate conversion factors, buildup factor polynomial coefficients, and mass attenuation coefficients for several materials and compositions.

4. ANISND [9]

ANISND solves the one-dimensional Boltzmann transport equation for neutrons or gamma rays in rectangular, spherical or cylindrical geometry. The source may be fixed, fission, or a subcritical combination of the two. Criticality search may be performed on any one of several parameters. Cross sections may be weighted using the space and energy dependent flux generated in solving the transport equation. The external cloud dose calculations use Bugle 80, a P-3 cross section library.

5. EFFLMDA [10]

EFFLMDA calculates the effective spray removal constant as a function of time. The calculation is based on a multi- region model with intermixing among the sprayed and unsprayed regions in a reactor containment.

The EFFLMDA results are merged with DRAGON input data. This enables the DRAGON program, a single spray region computer code, to simulate a multi-region spray model with step changes in the effective spray constants.

6. RADTRAD [12]

Program RADTRAD performs similar analysis functions as described above for DRAGON.

REFERENCES

1. ICRP Publication 2, Report of Committee II on Permissible Dose for Internal Radiation (1959). The International Commission on Radiological Protection.
2. Not Used.
3. Not Used.
4. Not Used.
5. Not Used.
6. RADIOISOTOPE, SWEC proprietary computer code NU-007, Version 01, Level 02, April, 1985.

15B-6 Amendment No. 104

CPNPP/FSAR

7. DRAGON, SWEC proprietary computer code NU-115, Version 04, Level 02, September 1984 and Version 05 Level 00, April, 1986.
8. QADMOD, SWEC proprietary computer code NU-137U, Version 00, Level 03, November 1985.
9. ANISND, SWEC proprietary computer code NU-146, Version 01, Level 01, January 1985.
10. EFFLMDA, SWEC proprietary computer code NU-159, Version 01, Level 00, December, 1984.
11. International Commission on Radiological Protection, Limits for Intakes of Radionuclides by Workers, ICRP Publication 30, Volume 3 No. 1-4, 1979.
12. NUREG/CR-6604, RADTRAD: A Simplified Model for RADionuclide Transport and Removal And Dose Estimation, December 1997.

NUREG/CR-6604, Supplement 1, RADTRAD: A Simplified Model for RADionuclide Transport and Removal and Dose Estimation, June 1999.

NUREG/CR-6604, Supplement 2, RADTRAD: A Simplified Model for RADionuclide Transport and Removal And Dose Estimation, October 2002.

13. K. F. Eckerman and J. C. Ryman, External Exposure to Radionuclides in Air, Water, and Soil, Federal Guidance Report No. 12, EPA 402-R-93-081, Environmental Protection Agency, September 1993.
14. DOE/EH-0070, External Dose-Rate Conversion Factors for Calculation of Dose to the Public, July 1988.
15. NRC Regulatory Issue Summary 2001-19: Deficiencies in the Documentation of Design Basis Radiological Analyses Submitted in Conjunction with License Amendment Requests, 10/18/01.

15B-7 Amendment No. 104

CPNPP/FSAR TABLE 15B-1 DOSE CONVERSIONS FACTORS Thyroid DCF(a) Whole Body DCF(b) Beta-Skin DCFc Isotope (Sv/Bg) (Sv-m(c)/Bg-sec) (Sv-mc/Bg-sec)

I-131 2.9E-7 1.82E-14 8.66E-15 I-132 1.7E-9 1.12E-13 3.02E-14 I-133 4.9E-8 2.94E-14 2.44E-14 I-134 2.9E-10 1.30E-13 3.87E-14 I-135 8.5E-9 7.98E-14 2.16E-14 Kr-83m N/A 1.50E-18 0.00E+00 Kr-85m N/A 7.48E-15 1.38E-14 Kr-85 N/A 1.19E-16 1.35E-14 Kr-87 N/A 4.12E-14 9.08E-14 Kr-88 N/A 1.02E-13 2.13E-14 Xe-131m N/A 3.89E-16 4.07E-15 Xe-133m N/A 1.37E-15 8.46E-15 Xe-133 N/A 1.56E-15 2.85E-15 Xe-135m N/A 2.04E-14 5.85E-15 Xe-135 N/A 1.19E-14 1.75E-14 Xe-138 N/A 5.77E-14 3.99E-14 a) Thyroid DCFs from ICRP-30 (Reference 11).

b) Whole-body DCFs from Federal Guidance Report 12 (Reference 13).

c) Beta-skin DCFs from DOE/EH-0070 (Reference 14). Skin doses are modeled without the contribution from photon emissions as supported by the NRC in Reference 15.

Breathing Rates (mc/sec)

Time Period (hours) Offsite Control Room 0-8 3.5E-4 3.5E-4 8 - 24 1.8E-4 3.5E-4 24 - 720 2.3E-4 3.5E-4 Amendment No. 104

Retrieved from "https://kanterella.com/w/index.php?title=ML16180A430&oldid=2084260"